claudemesh-cli 1.4.0 → 1.5.0

package/dist/entrypoints/cli.js

@@ -88,7 +88,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.4.0", env;
+var URLS, VERSION = "1.5.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -136,27 +136,27 @@ function normaliseInviteUrl(input, host = "claudemesh.com") {
 }
 
 // src/constants/paths.ts
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
 var home, PATHS;
 var init_paths = __esm(() => {
-  home = homedir();
+  home = homedir2();
   PATHS = {
-    CONFIG_DIR: process.env.CLAUDEMESH_CONFIG_DIR || join(home, ".claudemesh"),
+    CONFIG_DIR: process.env.CLAUDEMESH_CONFIG_DIR || join2(home, ".claudemesh"),
     get CONFIG_FILE() {
-      return join(this.CONFIG_DIR, "config.json");
+      return join2(this.CONFIG_DIR, "config.json");
     },
     get AUTH_FILE() {
-      return join(this.CONFIG_DIR, "auth.json");
+      return join2(this.CONFIG_DIR, "auth.json");
     },
     get KEYS_DIR() {
-      return join(this.CONFIG_DIR, "keys");
+      return join2(this.CONFIG_DIR, "keys");
     },
     get LAST_USED_FILE() {
-      return join(this.CONFIG_DIR, "last-used.json");
+      return join2(this.CONFIG_DIR, "last-used.json");
     },
-    CLAUDE_JSON: join(home, ".claude.json"),
-    CLAUDE_SETTINGS: join(home, ".claude", "settings.json")
+    CLAUDE_JSON: join2(home, ".claude.json"),
+    CLAUDE_SETTINGS: join2(home, ".claude", "settings.json")
   };
 });
 
@@ -166,12 +166,12 @@ function emptyConfig() {
 }
 
 // src/services/config/read.ts
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
 function readConfig() {
-  if (!existsSync(PATHS.CONFIG_FILE))
+  if (!existsSync2(PATHS.CONFIG_FILE))
     return emptyConfig();
   try {
-    const raw = readFileSync(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync2(PATHS.CONFIG_FILE, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.meshes))
       return emptyConfig();
@@ -197,10 +197,10 @@ var init_read = __esm(() => {
 });
 
 // src/services/config/write.ts
-import { writeFileSync, mkdirSync, chmodSync, openSync, closeSync, renameSync } from "node:fs";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync, openSync, closeSync, renameSync } from "node:fs";
 import { platform } from "node:os";
 function ensureConfigDir() {
-  mkdirSync(PATHS.CONFIG_DIR, { recursive: true });
+  mkdirSync2(PATHS.CONFIG_DIR, { recursive: true });
   if (!isWindows) {
     try {
       chmodSync(PATHS.CONFIG_DIR, 448);
@@ -216,11 +216,11 @@ function writeConfig(config) {
 `;
   const tmpPath = PATHS.CONFIG_FILE + ".tmp";
   if (isWindows) {
-    writeFileSync(tmpPath, content, "utf-8");
+    writeFileSync2(tmpPath, content, "utf-8");
   } else {
     const fd = openSync(tmpPath, "w", 384);
     try {
-      writeFileSync(fd, content, "utf-8");
+      writeFileSync2(fd, content, "utf-8");
     } finally {
       closeSync(fd);
     }
@@ -501,7 +501,7 @@ var init_facade4 = __esm(() => {
 
 // src/services/spawn/claude.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 function findClaudeBinary() {
   const candidates = [
     process.env.CLAUDE_BIN,
@@ -510,7 +510,7 @@ function findClaudeBinary() {
     `${process.env.HOME}/.npm/bin/claude`
   ].filter(Boolean);
   for (const bin of candidates) {
-    if (existsSync2(bin))
+    if (existsSync3(bin))
       return bin;
   }
   const which = spawnSync("which", ["claude"], { encoding: "utf-8" });
@@ -571,12 +571,12 @@ var init_facade5 = __esm(() => {
 });
 
 // src/services/auth/token-store.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync, existsSync as existsSync3, openSync as openSync2, closeSync as closeSync2 } from "node:fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync, existsSync as existsSync4, openSync as openSync2, closeSync as closeSync2 } from "node:fs";
 function getStoredToken() {
-  if (!existsSync3(PATHS.AUTH_FILE))
+  if (!existsSync4(PATHS.AUTH_FILE))
     return null;
   try {
-    const raw = readFileSync2(PATHS.AUTH_FILE, "utf-8");
+    const raw = readFileSync3(PATHS.AUTH_FILE, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -589,7 +589,7 @@ function storeToken(auth) {
 `;
   const fd = openSync2(PATHS.AUTH_FILE, "w", 384);
   try {
-    writeFileSync2(fd, content, "utf-8");
+    writeFileSync3(fd, content, "utf-8");
   } finally {
     closeSync2(fd);
   }
@@ -626,7 +626,7 @@ var init_errors2 = __esm(() => {
 });
 
 // src/services/auth/device-code.ts
-import { createInterface } from "node:readline";
+import { createInterface as createInterface2 } from "node:readline";
 function parseJwtUser(token) {
   try {
     const parts = token.split(".");
@@ -681,7 +681,7 @@ async function loginWithDeviceCode() {
   }
   return new Promise((resolve, reject) => {
     let done = false;
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const rl = createInterface2({ input: process.stdin, output: process.stdout });
     rl.on("line", (line) => {
       if (done)
         return;
@@ -925,11 +925,6 @@ var init_facade6 = __esm(() => {
 });
 
 // src/services/crypto/keypair.ts
-var exports_keypair = {};
-__export(exports_keypair, {
-  generateKeypair: () => generateKeypair2,
-  ensureSodium: () => ensureSodium
-});
 import sodium from "libsodium-wrappers";
 async function ensureSodium() {
   if (!ready) {
@@ -950,13 +945,6 @@ var ready = false;
 var init_keypair = () => {};
 
 // src/services/crypto/file-crypto.ts
-var exports_file_crypto = {};
-__export(exports_file_crypto, {
-  sealKeyForPeer: () => sealKeyForPeer,
-  openSealedKey: () => openSealedKey,
-  encryptFile: () => encryptFile,
-  decryptFile: () => decryptFile
-});
 async function encryptFile(plaintext) {
   const s = await ensureSodium();
   const key = s.randombytes_buf(s.crypto_secretbox_KEYBYTES);
@@ -1102,18 +1090,18 @@ import WebSocket from "ws";
 import { randomBytes as randomBytes3 } from "node:crypto";
 function detectClaudeSessionId() {
   try {
-    const { readdirSync, statSync, readFileSync: readFileSync3 } = __require("node:fs");
-    const { join: join2 } = __require("node:path");
-    const { homedir: homedir2 } = __require("node:os");
+    const { readdirSync, statSync, readFileSync: readFileSync4 } = __require("node:fs");
+    const { join: join3 } = __require("node:path");
+    const { homedir: homedir3 } = __require("node:os");
     const cwd = process.cwd();
-    const projectsDir = join2(homedir2(), ".claude", "projects");
+    const projectsDir = join3(homedir3(), ".claude", "projects");
     const cwdHash = cwd.replace(/\//g, "-");
     const entries = readdirSync(projectsDir);
     const projectDir = entries.find((e) => e === cwdHash || e.startsWith(cwdHash));
     if (!projectDir)
       return null;
-    const fullDir = join2(projectsDir, projectDir);
-    const jsonls = readdirSync(fullDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ name: f, mtime: statSync(join2(fullDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    const fullDir = join3(projectsDir, projectDir);
+    const jsonls = readdirSync(fullDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ name: f, mtime: statSync(join3(fullDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
     if (jsonls.length === 0)
       return null;
     const latest = jsonls[0];
@@ -1634,9 +1622,9 @@ class BrokerClient {
     this.ws.send(JSON.stringify({ type: "delete_file", fileId }));
   }
   async uploadFile(filePath, meshId, memberId, opts) {
-    const { readFileSync: readFileSync3 } = await import("node:fs");
+    const { readFileSync: readFileSync4 } = await import("node:fs");
     const { basename } = await import("node:path");
-    const data = readFileSync3(filePath);
+    const data = readFileSync4(filePath);
     const fileName = opts.name ?? basename(filePath);
     const brokerHttp = this.mesh.brokerUrl.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
     const res = await fetch(`${brokerHttp}/upload`, {
@@ -2322,8 +2310,8 @@ class BrokerClient {
   }
   static MAX_FILE_SIZE = 1048576;
   async handlePeerFileRequest(msg) {
-    const { resolve, join: join2, normalize } = await import("node:path");
-    const { readFileSync: readFileSync3, statSync, realpathSync } = await import("node:fs");
+    const { resolve, join: join3, normalize } = await import("node:path");
+    const { readFileSync: readFileSync4, statSync, realpathSync } = await import("node:fs");
     const reqId = msg._reqId;
     const sendResponse = (content, error2) => {
       if (!this.ws || this.ws.readyState !== this.ws.OPEN)
@@ -2347,7 +2335,7 @@ class BrokerClient {
     }
     let resolvedPath = null;
     for (const dir of this.sharedDirs) {
-      const candidate = resolve(join2(dir, msg.filePath));
+      const candidate = resolve(join3(dir, msg.filePath));
       let realCandidate;
       let realDir;
       try {
@@ -2375,7 +2363,7 @@ class BrokerClient {
         sendResponse(undefined, `file too large (${stat.size} bytes, max ${BrokerClient.MAX_FILE_SIZE})`);
         return;
       }
-      const content = readFileSync3(resolvedPath);
+      const content = readFileSync4(resolvedPath);
       sendResponse(content.toString("base64"));
     } catch (e) {
       const errMsg = e instanceof Error ? e.message : String(e);
@@ -2387,7 +2375,7 @@ class BrokerClient {
     }
   }
   async handlePeerDirRequest(msg) {
-    const { resolve, join: join2, normalize, relative } = await import("node:path");
+    const { resolve, join: join3, normalize, relative } = await import("node:path");
     const { readdirSync, statSync, realpathSync } = await import("node:fs");
     const reqId = msg._reqId;
     const sendResponse = (entries, error2) => {
@@ -2413,7 +2401,7 @@ class BrokerClient {
     }
     let resolvedPath = null;
     for (const dir of this.sharedDirs) {
-      const candidate = resolve(join2(dir, dirPath));
+      const candidate = resolve(join3(dir, dirPath));
       let realCandidate;
       let realDir;
       try {
@@ -2459,16 +2447,16 @@ class BrokerClient {
               break;
             if (item.name.startsWith("."))
               continue;
-            const relPath = relative(resolvedPath, join2(dir, item.name));
+            const relPath = relative(resolvedPath, join3(dir, item.name));
             const label = item.isDirectory() ? relPath + "/" : relPath;
             if (pattern && !pattern.test(item.name)) {
               if (item.isDirectory())
-                walk(join2(dir, item.name), depth + 1);
+                walk(join3(dir, item.name), depth + 1);
               continue;
             }
             entries.push(label);
             if (item.isDirectory())
-              walk(join2(dir, item.name), depth + 1);
+              walk(join3(dir, item.name), depth + 1);
           }
         } catch {}
       };
@@ -3128,16 +3116,6 @@ async function startClients(config) {
   configGroups = config.groups ?? [];
   await Promise.allSettled(config.meshes.map(ensureClient));
 }
-function findClient(needle) {
-  const byId = clients.get(needle);
-  if (byId)
-    return byId;
-  for (const c of clients.values()) {
-    if (c.meshSlug === needle)
-      return c;
-  }
-  return null;
-}
 function allClients() {
   return [...clients.values()];
 }
@@ -3240,7 +3218,7 @@ ${INDENT}${dim("—")} ${clay(title)}
 });
 
 // src/ui/screen.ts
-import { createInterface as createInterface2 } from "node:readline";
+import { createInterface as createInterface3 } from "node:readline";
 function termSize() {
   return { cols: process.stdout.columns || 80, rows: process.stdout.rows || 24 };
 }
@@ -3276,7 +3254,7 @@ async function menuSelect(itemsOrOpts, prompt = "Choice") {
   ${title}`);
   items.forEach((item, i) => console.log(`    ${bold(String(i + 1) + ")")} ${item}`));
   console.log("");
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(`  ${prompt} [1]: `, (answer) => {
       rl.close();
@@ -3288,7 +3266,7 @@ async function menuSelect(itemsOrOpts, prompt = "Choice") {
 async function textInput(promptOrOpts, defaultVal = "") {
   const label = typeof promptOrOpts === "string" ? promptOrOpts : promptOrOpts.label;
   const placeholder = typeof promptOrOpts === "object" ? promptOrOpts.placeholder : undefined;
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     const hint = placeholder ? ` (${placeholder})` : defaultVal ? ` [${defaultVal}]` : "";
     rl.question(`  ${label}${hint}: `, (answer) => {
@@ -3297,10 +3275,10 @@ async function textInput(promptOrOpts, defaultVal = "") {
     });
   });
 }
-async function confirmPrompt(promptOrOpts, defaultYes = true) {
+async function confirmPrompt2(promptOrOpts, defaultYes = true) {
   const message = typeof promptOrOpts === "string" ? promptOrOpts : promptOrOpts.message;
   const defYes = typeof promptOrOpts === "object" && promptOrOpts.defaultYes !== undefined ? promptOrOpts.defaultYes : defaultYes;
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
   const hint = defYes ? "[Y/n]" : "[y/N]";
   return new Promise((resolve) => {
     rl.question(`  ${message} ${hint}: `, (answer) => {
@@ -3412,10 +3390,10 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync3, rmSync, readdirSync, statSync, existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { tmpdir, hostname as hostname2, homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
-import { createInterface as createInterface3 } from "node:readline";
+import { mkdtempSync, writeFileSync as writeFileSync4, rmSync, readdirSync, statSync, existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
+import { join as join3 } from "node:path";
+import { createInterface as createInterface4 } from "node:readline";
 function parseGroupsString(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean).map((token) => {
     const idx = token.indexOf(":");
@@ -3534,7 +3512,7 @@ async function runLaunchWizard(opts) {
     writeCentered(row, dim("Claude will run with --dangerously-skip-permissions,"));
     writeCentered(row + 1, dim("bypassing ALL permission prompts — not just claudemesh."));
     row += 3;
-    const confirmed = await confirmPrompt({
+    const confirmed = await confirmPrompt2({
       message: boldOrange("Autonomous mode?"),
       row,
       defaultYes: true
@@ -3644,7 +3622,7 @@ async function runLaunch(flags, rawArgs) {
     console.log(`  ${dim2(`Or join with invite: claudemesh launch --join <url>`)}
 `);
     const manualPromise = new Promise((resolve) => {
-      const rl = createInterface3({ input: process.stdin, output: process.stdout });
+      const rl = createInterface4({ input: process.stdin, output: process.stdout });
       rl.question("  Paste sync token (or wait for browser): ", (answer) => {
         rl.close();
         if (answer.trim())
@@ -3735,16 +3713,16 @@ async function runLaunch(flags, rawArgs) {
     for (const entry of readdirSync(tmpBase)) {
       if (!entry.startsWith("claudemesh-"))
         continue;
-      const full = join2(tmpBase, entry);
+      const full = join3(tmpBase, entry);
       const age = Date.now() - statSync(full).mtimeMs;
       if (age > 3600000)
         rmSync(full, { recursive: true, force: true });
     }
   } catch {}
   try {
-    const claudeConfigPath = join2(homedir2(), ".claude.json");
-    if (existsSync4(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync3(claudeConfigPath, "utf-8"));
+    const claudeConfigPath = join3(homedir3(), ".claude.json");
+    if (existsSync5(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -3762,7 +3740,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync3(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -3779,7 +3757,7 @@ async function runLaunch(flags, rawArgs) {
       console.log("  (Could not fetch service catalog — mesh services won't be natively available)");
     }
   }
-  const tmpDir = mkdtempSync(join2(tmpdir(), "claudemesh-"));
+  const tmpDir = mkdtempSync(join3(tmpdir(), "claudemesh-"));
   const sessionConfig = {
     version: 1,
     meshes: [mesh],
@@ -3788,17 +3766,17 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync3(join2(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync4(join3(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
   const meshMcpEntries = [];
   if (serviceCatalog.length > 0) {
-    const claudeConfigPath = join2(homedir2(), ".claude.json");
+    const claudeConfigPath = join3(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync3(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -3825,7 +3803,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync3(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -3862,12 +3840,12 @@ async function runLaunch(flags, rawArgs) {
   let claudeBin = "claude";
   if (!isWindows2) {
     const candidates = [
-      join2(homedir2(), ".local", "bin", "claude"),
+      join3(homedir3(), ".local", "bin", "claude"),
       "/usr/local/bin/claude",
-      join2(homedir2(), ".claude", "bin", "claude")
+      join3(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync4(c)) {
+      if (existsSync5(c)) {
         claudeBin = c;
         break;
       }
@@ -3876,14 +3854,14 @@ async function runLaunch(flags, rawArgs) {
   const cleanup = () => {
     if (meshMcpEntries.length > 0) {
       try {
-        const claudeConfigPath = join2(homedir2(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync3(claudeConfigPath, "utf-8"));
+        const claudeConfigPath = join3(homedir3(), ".claude.json");
+        const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync3(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
@@ -3977,9 +3955,9 @@ var exports_login = {};
 __export(exports_login, {
   login: () => login
 });
-import { createInterface as createInterface4 } from "node:readline";
+import { createInterface as createInterface5 } from "node:readline";
 function prompt(question) {
-  const rl = createInterface4({ input: process.stdin, output: process.stdout });
+  const rl = createInterface5({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();
@@ -4101,9 +4079,9 @@ __export(exports_welcome, {
   runWelcome: () => runWelcome,
   _stub: () => runWelcome
 });
-import { createInterface as createInterface5 } from "node:readline";
+import { createInterface as createInterface6 } from "node:readline";
 function prompt2(q) {
-  const rl = createInterface5({ input: process.stdin, output: process.stdout });
+  const rl = createInterface6({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(q, (a) => {
       rl.close();
@@ -4580,9 +4558,9 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join3, dirname } from "node:path";
-import { homedir as homedir3, hostname as hostname3 } from "node:os";
+import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join4, dirname as dirname2 } from "node:path";
+import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
   const override = process.env.CLAUDEMESH_APP_URL;
   if (override)
@@ -4701,11 +4679,11 @@ async function runJoin(args) {
     joinedAt: new Date().toISOString()
   });
   writeConfig(config);
-  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join3(homedir3(), ".claudemesh");
-  const inviteFile = join3(configDir, `invite-${payload.mesh_slug}.txt`);
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join4(homedir4(), ".claudemesh");
+  const inviteFile = join4(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
-    mkdirSync2(dirname(inviteFile), { recursive: true });
-    writeFileSync4(inviteFile, link, "utf-8");
+    mkdirSync3(dirname2(inviteFile), { recursive: true });
+    writeFileSync5(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -4809,9 +4787,9 @@ var exports_delete_mesh = {};
 __export(exports_delete_mesh, {
   deleteMesh: () => deleteMesh
 });
-import { createInterface as createInterface6 } from "node:readline";
+import { createInterface as createInterface7 } from "node:readline";
 function prompt3(question) {
-  const rl = createInterface6({ input: process.stdin, output: process.stdout });
+  const rl = createInterface7({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (a) => {
       rl.close();
@@ -6045,9 +6023,9 @@ var exports_invite = {};
 __export(exports_invite, {
   invite: () => invite
 });
-import { createInterface as createInterface7 } from "node:readline";
+import { createInterface as createInterface8 } from "node:readline";
 function prompt4(question) {
-  const rl = createInterface7({ input: process.stdin, output: process.stdout });
+  const rl = createInterface8({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (a) => {
       rl.close();
@@ -6146,7 +6124,7 @@ var init_invite = __esm(() => {
 
 // src/commands/connect.ts
 import { hostname as hostname4 } from "node:os";
-import { createInterface as createInterface8 } from "node:readline";
+import { createInterface as createInterface9 } from "node:readline";
 async function pickMesh(meshes) {
   console.log(`
   Select mesh:`);
@@ -6154,7 +6132,7 @@ async function pickMesh(meshes) {
     console.log(`    ${i + 1}) ${m.slug}`);
   });
   console.log("");
-  const rl = createInterface8({ input: process.stdin, output: process.stdout });
+  const rl = createInterface9({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question("  Choice [1]: ", (answer) => {
       rl.close();
@@ -6393,13 +6371,13 @@ var init_ban = __esm(() => {
 });
 
 // src/services/bridge/protocol.ts
-import { homedir as homedir4 } from "node:os";
-import { join as join4 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join5 } from "node:path";
 function socketPath(meshSlug) {
-  return join4(homedir4(), ".claudemesh", "sockets", `${meshSlug}.sock`);
+  return join5(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
 }
 function socketDir() {
-  return join4(homedir4(), ".claudemesh", "sockets");
+  return join5(homedir5(), ".claudemesh", "sockets");
 }
 function frame(obj) {
   return JSON.stringify(obj) + `
@@ -6426,11 +6404,11 @@ var init_protocol = () => {};
 
 // src/services/bridge/client.ts
 import { createConnection } from "node:net";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { randomUUID as randomUUID2 } from "node:crypto";
 async function tryBridge(meshSlug, verb, args = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const path = socketPath(meshSlug);
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     return null;
   return new Promise((resolve) => {
     const id = randomUUID2();
@@ -7411,19 +7389,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync5
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { homedir as homedir5, platform as platform5 } from "node:os";
-import { dirname as dirname2, join as join5, resolve } from "node:path";
+import { homedir as homedir6, platform as platform5 } from "node:os";
+import { dirname as dirname3, join as join6, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync6(CLAUDE_CONFIG))
+  if (!existsSync7(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync4(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync5(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -7433,12 +7411,12 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync6(CLAUDE_CONFIG))
+  if (!existsSync7(CLAUDE_CONFIG))
     return;
-  const backupDir = join5(dirname2(CLAUDE_CONFIG), ".claude", "backups");
-  mkdirSync3(backupDir, { recursive: true });
+  const backupDir = join6(dirname3(CLAUDE_CONFIG), ".claude", "backups");
+  mkdirSync4(backupDir, { recursive: true });
   const ts = Date.now();
-  const dest = join5(backupDir, `.claude.json.pre-claudemesh.${ts}`);
+  const dest = join6(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
 }
 function patchMcpServer(entry) {
@@ -7462,7 +7440,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync6(CLAUDE_CONFIG))
+  if (!existsSync7(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -7475,8 +7453,8 @@ function removeMcpServer() {
   return true;
 }
 function flushClaudeConfig(obj) {
-  mkdirSync3(dirname2(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync5(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  mkdirSync4(dirname3(CLAUDE_CONFIG), { recursive: true });
+  writeFileSync6(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync3(CLAUDE_CONFIG, 384);
@@ -7493,13 +7471,13 @@ function resolveEntry() {
   const here = fileURLToPath(import.meta.url);
   if (isBundledFile(here))
     return here;
-  return resolve(dirname2(here), "..", "index.ts");
+  return resolve(dirname3(here), "..", "index.ts");
 }
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
-  const pkgRoot = resolve(dirname2(here), "..", "..");
-  const skillsDir = join5(pkgRoot, "skills");
-  if (existsSync6(skillsDir))
+  const pkgRoot = resolve(dirname3(here), "..", "..");
+  const skillsDir = join6(pkgRoot, "skills");
+  if (existsSync7(skillsDir))
     return skillsDir;
   return null;
 }
@@ -7512,13 +7490,13 @@ function installSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const srcDir = join5(src, entry.name);
-    const dstDir = join5(CLAUDE_SKILLS_ROOT, entry.name);
-    mkdirSync3(dstDir, { recursive: true });
+    const srcDir = join6(src, entry.name);
+    const dstDir = join6(CLAUDE_SKILLS_ROOT, entry.name);
+    mkdirSync4(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
-      copyFileSync(join5(srcDir, file.name), join5(dstDir, file.name));
+      copyFileSync(join6(srcDir, file.name), join6(dstDir, file.name));
     }
     installed.push(entry.name);
   }
@@ -7533,8 +7511,8 @@ function uninstallSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dstDir = join5(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync6(dstDir)) {
+    const dstDir = join6(CLAUDE_SKILLS_ROOT, entry.name);
+    if (existsSync7(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -7559,9 +7537,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync6(CLAUDE_SETTINGS))
+  if (!existsSync7(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync4(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync5(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -7571,8 +7549,8 @@ function readClaudeSettings() {
   }
 }
 function writeClaudeSettings(obj) {
-  mkdirSync3(dirname2(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync5(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  mkdirSync4(dirname3(CLAUDE_SETTINGS), { recursive: true });
+  writeFileSync6(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -7586,7 +7564,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync6(CLAUDE_SETTINGS))
+  if (!existsSync7(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -7621,7 +7599,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync6(CLAUDE_SETTINGS))
+  if (!existsSync7(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks = settings.hooks;
@@ -7670,7 +7648,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync6(entry)) {
+  if (!existsSync7(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -7721,7 +7699,7 @@ function runInstall(args = []) {
       const installed = installSkills();
       if (installed.length > 0) {
         render.ok(`Claude skill${installed.length === 1 ? "" : "s"} installed`, installed.join(", "));
-        render.info(dim(`  ${join5(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
+        render.info(dim(`  ${join6(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
       }
     } catch (e) {
       render.warn(`skill install failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -7809,9 +7787,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join5(homedir5(), ".claude.json");
-  CLAUDE_SETTINGS = join5(homedir5(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join5(homedir5(), ".claude", "skills");
+  CLAUDE_CONFIG = join6(homedir6(), ".claude.json");
+  CLAUDE_SETTINGS = join6(homedir6(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join6(homedir6(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -7866,35 +7844,35 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync7, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
-import { join as join6, dirname as dirname3 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync7, existsSync as existsSync8, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7, dirname as dirname4 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join6(dirname3(here), "..", "..");
-  const skillsDir = join6(pkgRoot, "skills");
-  return existsSync7(skillsDir) ? skillsDir : null;
+  const pkgRoot = join7(dirname4(here), "..", "..");
+  const skillsDir = join7(pkgRoot, "skills");
+  return existsSync8(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync7(PATHS.CLAUDE_JSON)) {
+  if (existsSync8(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync5(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync6(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync6(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync7(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync7(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync8(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync5(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync6(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks = config.hooks;
       if (hooks) {
@@ -7915,7 +7893,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync6(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync7(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -7930,8 +7908,8 @@ async function uninstall() {
       for (const entry of readdirSync2(src, { withFileTypes: true })) {
         if (!entry.isDirectory())
           continue;
-        const dst = join6(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync7(dst)) {
+        const dst = join7(CLAUDE_SKILLS_ROOT2, entry.name);
+        if (existsSync8(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -7955,7 +7933,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join6(homedir6(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join7(homedir7(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -7963,9 +7941,9 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { homedir as homedir7, platform as platform6 } from "node:os";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
+import { homedir as homedir8, platform as platform6 } from "node:os";
+import { join as join8 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -7989,8 +7967,8 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join7(homedir7(), ".claude.json");
-  if (!existsSync8(claudeConfig)) {
+  const claudeConfig = join8(homedir8(), ".claude.json");
+  if (!existsSync9(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -7998,7 +7976,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync6(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync7(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -8015,8 +7993,8 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join7(homedir7(), ".claude", "settings.json");
-  if (!existsSync8(settings)) {
+  const settings = join8(homedir8(), ".claude", "settings.json");
+  if (!existsSync9(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -8024,7 +8002,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync6(settings, "utf-8");
+    const raw = readFileSync7(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -8041,7 +8019,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path = getConfigPath();
-  if (!existsSync8(path)) {
+  if (!existsSync9(path)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -8224,7 +8202,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus
 });
-import { statSync as statSync3, existsSync as existsSync9 } from "node:fs";
+import { statSync as statSync3, existsSync as existsSync10 } from "node:fs";
 import WebSocket2 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -8254,7 +8232,7 @@ async function runStatus() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     const mode = (statSync3(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -8312,7 +8290,7 @@ var exports_sync = {};
 __export(exports_sync, {
   runSync: () => runSync
 });
-import { createInterface as createInterface9 } from "node:readline";
+import { createInterface as createInterface10 } from "node:readline";
 import { hostname as hostname5 } from "node:os";
 async function runSync(args) {
   const useColor = !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
@@ -8326,7 +8304,7 @@ async function runSync(args) {
   console.log(dim2(`Visit: ${url}`));
   await openBrowser(url);
   const manualPromise = new Promise((resolve2) => {
-    const rl = createInterface9({ input: process.stdin, output: process.stdout });
+    const rl = createInterface10({ input: process.stdin, output: process.stdout });
     rl.question("Paste sync token (or wait for browser): ", (answer) => {
       rl.close();
       if (answer.trim())
@@ -8400,13 +8378,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync10(PATHS.CLAUDE_JSON)) {
+    if (!existsSync11(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync7(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync8(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -8421,13 +8399,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync11(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync12(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync8(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync9(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -8442,10 +8420,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync12, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync13, statSync as statSync4 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync12(configFile)) {
+  if (!existsSync13(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -8463,13 +8441,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync13(PATHS.CONFIG_FILE)) {
+  if (!existsSync14(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync9(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync10(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -8949,19 +8927,19 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir8 } from "node:os";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7, rmSync as rmSync3, chmodSync as chmodSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { platform as platform7, homedir as homedir9 } from "node:os";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8, rmSync as rmSync3, chmodSync as chmodSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
   return process.argv[1] ?? "claudemesh";
 }
 function installDarwin() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join8(homedir8(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  const contents = join8(appDir, "Contents");
-  const macOS = join8(contents, "MacOS");
-  mkdirSync4(macOS, { recursive: true });
+  const appDir = join9(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const contents = join9(appDir, "Contents");
+  const macOS = join9(contents, "MacOS");
+  mkdirSync5(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -8984,7 +8962,7 @@ function installDarwin() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync7(join8(contents, "Info.plist"), plist);
+  writeFileSync8(join9(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -8998,8 +8976,8 @@ tell application "Terminal"
 end tell
 EOF
 `;
-  const shimPath = join8(macOS, "open-url");
-  writeFileSync7(shimPath, shim);
+  const shimPath = join9(macOS, "open-url");
+  writeFileSync8(shimPath, shim);
   chmodSync4(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -9010,8 +8988,8 @@ EOF
 }
 function installLinux() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join8(homedir8(), ".local", "share", "applications");
-  mkdirSync4(appsDir, { recursive: true });
+  const appsDir = join9(homedir9(), ".local", "share", "applications");
+  mkdirSync5(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
 Name=Claudemesh
@@ -9022,8 +9000,8 @@ Terminal=true
 MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
-  const desktopPath = join8(appsDir, "claudemesh.desktop");
-  writeFileSync7(desktopPath, desktop);
+  const desktopPath = join9(appsDir, "claudemesh.desktop");
+  writeFileSync8(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -9045,8 +9023,8 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join8(homedir8(), "claudemesh-handler.reg");
-  writeFileSync7(regPath, lines.join(`\r
+  const regPath = join9(homedir9(), "claudemesh-handler.reg");
+  writeFileSync8(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -9057,15 +9035,15 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join8(homedir8(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync14(appDir))
+  const appDir = join9(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  if (existsSync15(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join8(homedir8(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync14(desktopPath))
+  const desktopPath = join9(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
+  if (existsSync15(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -9110,9 +9088,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
-import { join as join9 } from "node:path";
-import { homedir as homedir9 } from "node:os";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { join as join10 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -9120,11 +9098,11 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join9(homedir9(), ".claudemesh", "peer-cache.json");
+    const cachePath = join10(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync15(cachePath)) {
+    if (existsSync16(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync10(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync11(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -9155,12 +9133,12 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync16 } from "node:fs";
-import { createInterface as createInterface10 } from "node:readline";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync17 } from "node:fs";
+import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
     process.stdout.write(prompt5);
-    const rl = createInterface10({ input: process.stdin, output: process.stdout, terminal: true });
+    const rl = createInterface11({ input: process.stdin, output: process.stdout, terminal: true });
     const stdin = process.stdin;
     const wasRaw = Boolean(stdin.isRaw);
     if (stdin.isTTY) {
@@ -9197,11 +9175,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync16(configPath)) {
+  if (!existsSync17(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync11(configPath);
+  const plaintext = readFileSync12(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -9219,7 +9197,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync8(file, blob, { mode: 384 });
+  writeFileSync9(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -9231,11 +9209,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync16(inPath)) {
+  if (!existsSync17(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync11(inPath);
+  const blob = readFileSync12(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -9254,12 +9232,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync16(configPath)) {
+  if (existsSync17(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync8(backupOld, readFileSync11(configPath), { mode: 384 });
+    writeFileSync9(backupOld, readFileSync12(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync8(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync9(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -9279,8 +9257,8 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync17 } from "node:fs";
-import { dirname as dirname4, join as join10, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname5, join as join11, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -9293,15 +9271,15 @@ async function latestVersion() {
   }
 }
 function findNpm() {
-  const portable = join10(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync17(portable)) {
-    return { npm: portable, prefix: join10(process.env.HOME ?? "", ".claudemesh") };
+  const portable = join11(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  if (existsSync18(portable)) {
+    return { npm: portable, prefix: join11(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
-    cur = dirname4(cur);
-    const candidate = join10(cur, "bin", "npm");
-    if (existsSync17(candidate))
+    cur = dirname5(cur);
+    const candidate = join11(cur, "bin", "npm");
+    if (existsSync18(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -9363,9 +9341,9 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { join as join12 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
   if (!auth)
@@ -9383,19 +9361,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync18(GRANT_FILE))
+  if (!existsSync19(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync12(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync13(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
-  const dir = join11(homedir10(), ".claudemesh");
-  if (!existsSync18(dir))
-    mkdirSync5(dir, { recursive: true });
-  writeFileSync9(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  const dir = join12(homedir11(), ".claudemesh");
+  if (!existsSync19(dir))
+    mkdirSync6(dir, { recursive: true });
+  writeFileSync10(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -9551,7 +9529,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join11(homedir10(), ".claudemesh", "grants.json");
+  GRANT_FILE = join12(homedir11(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -10403,929 +10381,12 @@ var init_platform_actions = __esm(() => {
 // src/mcp/tools/definitions.ts
 var TOOLS;
 var init_definitions = __esm(() => {
-  TOOLS = [
-    {
-      name: "send_message",
-      description: "Send a message to a peer in one of your joined meshes. `to` can be a peer display name (resolved via list_peers), hex pubkey, @group, `#channel`, or `*` for broadcast. `priority` controls delivery: `now` bypasses busy gates, `next` waits for idle (default), `low` is pull-only.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          to: {
-            oneOf: [
-              { type: "string", description: "Peer name, pubkey, @group" },
-              { type: "array", items: { type: "string" }, description: "Multiple targets" }
-            ],
-            description: "Single target or array of targets"
-          },
-          message: { type: "string", description: "Message text" },
-          priority: {
-            type: "string",
-            enum: ["now", "next", "low"],
-            description: "Delivery priority (default: next)"
-          }
-        },
-        required: ["to", "message"]
-      }
-    },
-    {
-      name: "list_peers",
-      description: "List peers across all joined meshes. Shows name, mesh, status (idle/working/dnd), and current summary.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          mesh_slug: {
-            type: "string",
-            description: "Only list peers in this mesh (optional)"
-          }
-        }
-      }
-    },
-    {
-      name: "message_status",
-      description: "Check the delivery status of a sent message. Shows whether each recipient received it.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: {
-            type: "string",
-            description: "Message ID (returned by send_message)"
-          }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "check_messages",
-      description: "Pull any undelivered messages from the broker. Normally messages arrive via push; use this to drain the queue after being offline.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "set_summary",
-      description: "Set a 1–2 sentence summary of what you're working on. Visible to other peers.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          summary: { type: "string", description: "1-2 sentence summary" }
-        },
-        required: ["summary"]
-      }
-    },
-    {
-      name: "set_status",
-      description: "Manually override your status. `dnd` blocks everything except `now`-priority messages.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          status: {
-            type: "string",
-            enum: ["idle", "working", "dnd"],
-            description: "Your status"
-          }
-        },
-        required: ["status"]
-      }
-    },
-    {
-      name: "set_visible",
-      description: "Control your visibility in the mesh. When hidden, you won't appear in list_peers and won't receive broadcasts — but direct messages still reach you.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          visible: {
-            type: "boolean",
-            description: "true to be visible (default), false to hide"
-          }
-        },
-        required: ["visible"]
-      }
-    },
-    {
-      name: "set_profile",
-      description: "Set your public profile — what other peers see about you. Avatar (emoji), title, bio, and capabilities list.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          avatar: {
-            type: "string",
-            description: "Emoji or URL for your avatar"
-          },
-          title: {
-            type: "string",
-            description: "Short role label (e.g. 'Frontend Lead', 'DevOps')"
-          },
-          bio: {
-            type: "string",
-            description: "One-liner about yourself"
-          },
-          capabilities: {
-            type: "array",
-            items: { type: "string" },
-            description: "What you can help with"
-          }
-        }
-      }
-    },
-    {
-      name: "join_group",
-      description: "Join a group with an optional role. Other peers see your group membership in list_peers.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Group name (without @)" },
-          role: {
-            type: "string",
-            description: "Your role in the group (e.g. lead, member, observer)"
-          }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "leave_group",
-      description: "Leave a group.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Group name (without @)" }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "set_state",
-      description: "Set a shared state value visible to all peers in the mesh. Pushes a change notification.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          key: { type: "string" },
-          value: { description: "Any JSON value" }
-        },
-        required: ["key", "value"]
-      }
-    },
-    {
-      name: "get_state",
-      description: "Read a shared state value.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          key: { type: "string" }
-        },
-        required: ["key"]
-      }
-    },
-    {
-      name: "list_state",
-      description: "List all shared state keys and values in the mesh.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "remember",
-      description: "Store persistent knowledge in the mesh's shared memory. Survives across sessions.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          content: {
-            type: "string",
-            description: "The knowledge to remember"
-          },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Optional categorization tags"
-          }
-        },
-        required: ["content"]
-      }
-    },
-    {
-      name: "recall",
-      description: "Search the mesh's shared memory by relevance.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          query: { type: "string", description: "Search query" }
-        },
-        required: ["query"]
-      }
-    },
-    {
-      name: "forget",
-      description: "Remove a memory from the mesh's shared knowledge.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Memory ID to forget" }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "share_file",
-      description: "Share a persistent file with the mesh. All current and future peers can access it. If `to` is specified, the file is E2E encrypted and only accessible to that peer (and you).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          path: { type: "string", description: "Local file path to share" },
-          name: {
-            type: "string",
-            description: "Display name (defaults to filename)"
-          },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Tags for categorization"
-          },
-          to: {
-            type: "string",
-            description: "Peer display name or pubkey hex — if set, file is E2E encrypted for this peer only"
-          }
-        },
-        required: ["path"]
-      }
-    },
-    {
-      name: "get_file",
-      description: "Download a shared file to a local path.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "File ID" },
-          save_to: {
-            type: "string",
-            description: "Local path to save the file"
-          }
-        },
-        required: ["id", "save_to"]
-      }
-    },
-    {
-      name: "list_files",
-      description: "List files shared in the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          query: { type: "string", description: "Search by name or tags" },
-          from: { type: "string", description: "Filter by uploader name" }
-        }
-      }
-    },
-    {
-      name: "file_status",
-      description: "Check who has accessed a shared file.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "File ID" }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "delete_file",
-      description: "Remove a shared file from the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "File ID" }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "grant_file_access",
-      description: "Grant a peer access to an E2E encrypted file you shared. You must be the owner.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          fileId: { type: "string", description: "File ID" },
-          to: { type: "string", description: "Peer display name or pubkey hex to grant access to" }
-        },
-        required: ["fileId", "to"]
-      }
-    },
-    {
-      name: "vector_store",
-      description: "Store an embedding in a per-mesh Qdrant collection. Auto-creates the collection on first use.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          collection: { type: "string", description: "Collection name" },
-          text: { type: "string", description: "Text to embed and store" },
-          metadata: {
-            type: "object",
-            description: "Optional metadata to attach"
-          }
-        },
-        required: ["collection", "text"]
-      }
-    },
-    {
-      name: "vector_search",
-      description: "Semantic search over stored embeddings in a collection.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          collection: { type: "string", description: "Collection name" },
-          query: { type: "string", description: "Search query text" },
-          limit: {
-            type: "number",
-            description: "Max results (default: 10)"
-          }
-        },
-        required: ["collection", "query"]
-      }
-    },
-    {
-      name: "vector_delete",
-      description: "Remove an embedding from a collection.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          collection: { type: "string", description: "Collection name" },
-          id: { type: "string", description: "Embedding ID to delete" }
-        },
-        required: ["collection", "id"]
-      }
-    },
-    {
-      name: "list_collections",
-      description: "List vector collections in this mesh.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "graph_query",
-      description: "Run a read-only Cypher query on the per-mesh Neo4j database.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          cypher: { type: "string", description: "Cypher MATCH query" }
-        },
-        required: ["cypher"]
-      }
-    },
-    {
-      name: "graph_execute",
-      description: "Run a write Cypher query (CREATE, MERGE, DELETE) on the per-mesh Neo4j database.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          cypher: { type: "string", description: "Cypher write query" }
-        },
-        required: ["cypher"]
-      }
-    },
-    {
-      name: "mesh_query",
-      description: "Run a SELECT query on the per-mesh shared database.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          sql: { type: "string", description: "SQL SELECT query" }
-        },
-        required: ["sql"]
-      }
-    },
-    {
-      name: "mesh_execute",
-      description: "Run DDL/DML on the per-mesh database (CREATE TABLE, INSERT, UPDATE, DELETE).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          sql: { type: "string", description: "SQL statement" }
-        },
-        required: ["sql"]
-      }
-    },
-    {
-      name: "mesh_schema",
-      description: "List tables and columns in the per-mesh shared database.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "create_stream",
-      description: "Create a real-time data stream in the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Stream name" }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "publish",
-      description: "Push data to a stream. Subscribers receive it in real-time.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          stream: { type: "string", description: "Stream name" },
-          data: { description: "Any JSON data to publish" }
-        },
-        required: ["stream", "data"]
-      }
-    },
-    {
-      name: "subscribe",
-      description: "Subscribe to a stream. Data pushes arrive as channel notifications.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          stream: { type: "string", description: "Stream name" }
-        },
-        required: ["stream"]
-      }
-    },
-    {
-      name: "list_streams",
-      description: "List active streams in the mesh.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "share_context",
-      description: "Share your session understanding with the mesh. Call after exploring a codebase area.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          summary: {
-            type: "string",
-            description: "Summary of what you explored/learned"
-          },
-          files_read: {
-            type: "array",
-            items: { type: "string" },
-            description: "File paths you read"
-          },
-          key_findings: {
-            type: "array",
-            items: { type: "string" },
-            description: "Key findings or insights"
-          },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Tags for categorization"
-          }
-        },
-        required: ["summary"]
-      }
-    },
-    {
-      name: "get_context",
-      description: "Find context from peers who explored an area. Check before re-reading files another peer already analyzed.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          query: {
-            type: "string",
-            description: "Search query (file path, topic, etc.)"
-          }
-        },
-        required: ["query"]
-      }
-    },
-    {
-      name: "list_contexts",
-      description: "See what all peers currently know about the codebase.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "create_task",
-      description: "Create a work item for the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          title: { type: "string", description: "Task title" },
-          assignee: {
-            type: "string",
-            description: "Peer name to assign (optional)"
-          },
-          priority: {
-            type: "string",
-            enum: ["low", "normal", "high", "urgent"],
-            description: "Priority level (default: normal)"
-          },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Tags for categorization"
-          }
-        },
-        required: ["title"]
-      }
-    },
-    {
-      name: "claim_task",
-      description: "Claim an unclaimed task to take ownership.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Task ID" }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "complete_task",
-      description: "Mark a task as done with an optional result summary.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Task ID" },
-          result: {
-            type: "string",
-            description: "Summary of what was done"
-          }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "list_tasks",
-      description: "List tasks filtered by status and/or assignee.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          status: {
-            type: "string",
-            enum: ["open", "claimed", "completed"],
-            description: "Filter by status"
-          },
-          assignee: {
-            type: "string",
-            description: "Filter by assignee name"
-          }
-        }
-      }
-    },
-    {
-      name: "schedule_reminder",
-      description: "Schedule a one-shot or recurring message. Without `to`, it fires back to yourself (a self-reminder). With `to`, it delivers to a peer, @group, or * broadcast. For one-shot, provide `deliver_at` or `in_seconds`. For recurring, provide `cron` (standard 5-field expression). The broker persists schedules to the database — they survive restarts. Receivers see `subtype: reminder` in the push envelope.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          message: { type: "string", description: "Message or reminder text" },
-          deliver_at: { type: "number", description: "Unix timestamp (ms) when to deliver (one-shot)" },
-          in_seconds: { type: "number", description: "Alternative to deliver_at: fire after N seconds (one-shot)" },
-          cron: { type: "string", description: "Cron expression for recurring reminders (e.g. '0 */2 * * *' for every 2 hours, '30 9 * * 1-5' for 9:30 weekdays)" },
-          to: {
-            type: "string",
-            description: "Recipient: display name, pubkey hex, @group, or * (omit for self-reminder)"
-          }
-        },
-        required: ["message"]
-      }
-    },
-    {
-      name: "list_scheduled",
-      description: "List all your pending scheduled messages: id, recipient, preview, and delivery time.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "cancel_scheduled",
-      description: "Cancel a pending scheduled message before it fires.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Scheduled message ID" }
-        },
-        required: ["id"]
-      }
-    },
-    {
-      name: "mesh_info",
-      description: "Get a complete overview of the mesh: peers, groups, state, memory, files, tasks, streams, tables. Call on session start for full situational awareness.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_stats",
-      description: "View resource usage stats for all peers: messages sent/received, tool calls, uptime, errors.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_mcp_register",
-      description: "Register an MCP server with the mesh. Other peers can invoke its tools through the mesh without restarting their sessions. Provide the server name, description, and full tool definitions.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          server_name: { type: "string", description: "Unique name for the MCP server (e.g. 'github', 'jira')" },
-          description: { type: "string", description: "What this MCP server does" },
-          tools: {
-            type: "array",
-            items: {
-              type: "object",
-              properties: {
-                name: { type: "string" },
-                description: { type: "string" },
-                inputSchema: { type: "object", description: "JSON Schema for tool arguments" }
-              },
-              required: ["name", "description", "inputSchema"]
-            },
-            description: "Tool definitions to expose"
-          },
-          persistent: {
-            type: "boolean",
-            description: "If true, registration survives peer disconnect. Other peers see it as 'offline' until you reconnect. Default: false"
-          }
-        },
-        required: ["server_name", "description", "tools"]
-      }
-    },
-    {
-      name: "mesh_mcp_list",
-      description: "List MCP servers available in the mesh with their tools. Shows which peer hosts each server.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_tool_call",
-      description: "Call a tool on a mesh-registered MCP server. Route: you -> broker -> hosting peer -> execute -> result back. Timeout: 30s.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          server_name: { type: "string", description: "Name of the MCP server" },
-          tool_name: { type: "string", description: "Name of the tool to call" },
-          args: { type: "object", description: "Tool arguments (JSON object)" }
-        },
-        required: ["server_name", "tool_name"]
-      }
-    },
-    {
-      name: "mesh_mcp_remove",
-      description: "Unregister an MCP server you previously registered with the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          server_name: { type: "string", description: "Name of the MCP server to remove" }
-        },
-        required: ["server_name"]
-      }
-    },
-    {
-      name: "mesh_set_clock",
-      description: "Set the simulation clock speed. x1 = real-time, x10 = 10x faster, x100 = 100x. Peers receive heartbeat ticks at the simulated rate.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          speed: {
-            type: "number",
-            description: "Speed multiplier (1-100). x1 = tick every 60s, x10 = tick every 6s, x100 = tick every 600ms."
-          }
-        },
-        required: ["speed"]
-      }
-    },
-    {
-      name: "mesh_pause_clock",
-      description: "Pause the simulation clock. Ticks stop until resumed.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_resume_clock",
-      description: "Resume a paused simulation clock.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_clock",
-      description: "Get current simulation clock status: speed, tick count, simulated time.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "share_skill",
-      description: "Publish a reusable skill to the mesh. Other peers can discover and load it as a slash command. If a skill with the same name exists, it is updated. Skills are automatically exposed as MCP prompts and skill:// resources for native Claude Code integration.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Unique skill name (e.g. 'code-review', 'deploy-checklist'). Becomes the slash command name." },
-          description: { type: "string", description: "Short description of what the skill does" },
-          instructions: { type: "string", description: "Full instructions/prompt markdown. Can include frontmatter (---) block." },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Tags for discoverability"
-          },
-          when_to_use: { type: "string", description: "Detailed description of when Claude should auto-invoke this skill" },
-          allowed_tools: {
-            type: "array",
-            items: { type: "string" },
-            description: "Tool names this skill is allowed to use (e.g. ['Bash', 'Read', 'Edit'])"
-          },
-          model: { type: "string", description: "Model override (e.g. 'sonnet', 'opus', 'haiku')" },
-          context: { type: "string", enum: ["inline", "fork"], description: "Execution context: 'inline' (default) or 'fork' (sub-agent)" },
-          agent: { type: "string", description: "Agent type when forked (e.g. 'general-purpose')" },
-          user_invocable: { type: "boolean", description: "Whether users can invoke via /skill-name (default: true)" },
-          argument_hint: { type: "string", description: "Hint text for arguments (e.g. '<file-path>')" }
-        },
-        required: ["name", "description", "instructions"]
-      }
-    },
-    {
-      name: "get_skill",
-      description: "Load a skill's full instructions by name. Use to acquire capabilities shared by other peers.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Skill name to load" }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "list_skills",
-      description: "Browse available skills in the mesh. Optionally filter by keyword across name, description, and tags.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          query: { type: "string", description: "Search keyword (optional)" }
-        }
-      }
-    },
-    {
-      name: "remove_skill",
-      description: "Remove a skill you published from the mesh.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Skill name to remove" }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "ping_mesh",
-      description: "Send test messages through the full pipeline and measure round-trip timing per priority. Diagnoses push delivery issues.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          priorities: {
-            type: "array",
-            items: { type: "string", enum: ["now", "next", "low"] },
-            description: 'Priorities to test (default: ["now", "next"])'
-          }
-        }
-      }
-    },
-    {
-      name: "read_peer_file",
-      description: "Read a file from another peer's project. Specify the peer (by name) and the file path relative to their working directory. The peer must be online and sharing files. Max file size: 1MB.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          peer: { type: "string", description: "Peer display name or pubkey" },
-          path: { type: "string", description: "File path relative to peer's working directory" }
-        },
-        required: ["peer", "path"]
-      }
-    },
-    {
-      name: "list_peer_files",
-      description: "List files in a peer's shared directory. Returns a tree of file names (not contents). The peer must be online and sharing files.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          peer: { type: "string", description: "Peer display name or pubkey" },
-          path: { type: "string", description: "Directory path relative to peer's cwd (default: root)" },
-          pattern: { type: "string", description: "Glob-like filter pattern (e.g. '*.ts', 'src/*')" }
-        },
-        required: ["peer"]
-      }
-    },
-    {
-      name: "create_webhook",
-      description: "Create an inbound webhook. Returns a URL that external services (GitHub, CI/CD, monitoring) can POST to — the payload becomes a mesh message to all peers.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: {
-            type: "string",
-            description: "Webhook name (e.g. 'github-ci', 'datadog-alerts')"
-          }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "list_webhooks",
-      description: "List active webhooks for this mesh.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "delete_webhook",
-      description: "Deactivate a webhook.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          name: { type: "string", description: "Webhook name to deactivate" }
-        },
-        required: ["name"]
-      }
-    },
-    {
-      name: "mesh_mcp_deploy",
-      description: "Deploy an MCP server to the mesh from a zip file or git repo. Runs on the broker VPS, persists across peer sessions. Default scope: private (only you).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          server_name: { type: "string", description: "Unique name for the server in this mesh" },
-          file_id: { type: "string", description: "File ID of uploaded zip (from share_file)" },
-          git_url: { type: "string", description: "Git repo URL" },
-          git_branch: { type: "string", description: "Branch to clone (default: main)" },
-          npx_package: { type: "string", description: "npm package name to run via npx (e.g. @upstash/context7-mcp)" },
-          env: { type: "object", description: "Environment variables. Use $vault:<key> for vault secrets." },
-          runtime: { type: "string", enum: ["node", "python", "bun"], description: "Runtime (auto-detected if omitted)" },
-          memory_mb: { type: "number", description: "Memory limit in MB (default: 256)" },
-          network_allow: { type: "array", items: { type: "string" }, description: "Allowed outbound hosts (default: none)" },
-          scope: { description: "Visibility: 'peer' (default), 'mesh', or {group/groups/role/peers}" }
-        },
-        required: ["server_name"]
-      }
-    },
-    {
-      name: "mesh_mcp_undeploy",
-      description: "Stop and remove a managed MCP server from the mesh.",
-      inputSchema: { type: "object", properties: { server_name: { type: "string" } }, required: ["server_name"] }
-    },
-    {
-      name: "mesh_mcp_update",
-      description: "Pull latest code and restart a git-sourced MCP server.",
-      inputSchema: { type: "object", properties: { server_name: { type: "string" } }, required: ["server_name"] }
-    },
-    {
-      name: "mesh_mcp_logs",
-      description: "View recent logs from a managed MCP server.",
-      inputSchema: { type: "object", properties: { server_name: { type: "string" }, lines: { type: "number", description: "Lines (default: 50, max: 1000)" } }, required: ["server_name"] }
-    },
-    {
-      name: "mesh_mcp_scope",
-      description: "Get or set the visibility scope of a deployed MCP server.",
-      inputSchema: { type: "object", properties: { server_name: { type: "string" }, scope: { description: "New scope to set. Omit to read current." } }, required: ["server_name"] }
-    },
-    {
-      name: "mesh_mcp_schema",
-      description: "Inspect tool schemas for a deployed MCP server.",
-      inputSchema: { type: "object", properties: { server_name: { type: "string" }, tool_name: { type: "string", description: "Specific tool (omit for all)" } }, required: ["server_name"] }
-    },
-    {
-      name: "mesh_mcp_catalog",
-      description: "List all deployed services in the mesh with status, scope, and tool count.",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "mesh_skill_deploy",
-      description: "Deploy a multi-file skill bundle from a zip or git repo.",
-      inputSchema: { type: "object", properties: { file_id: { type: "string" }, git_url: { type: "string" }, git_branch: { type: "string" } } }
-    },
-    {
-      name: "vault_set",
-      description: "Store an encrypted credential in your vault. Reference in mesh_mcp_deploy with $vault:<key>.",
-      inputSchema: { type: "object", properties: { key: { type: "string" }, value: { type: "string", description: "Secret value or local file path (for type=file)" }, type: { type: "string", enum: ["env", "file"] }, mount_path: { type: "string" }, description: { type: "string" } }, required: ["key", "value"] }
-    },
-    {
-      name: "vault_list",
-      description: "List your vault entries (keys and metadata only, no secret values).",
-      inputSchema: { type: "object", properties: {} }
-    },
-    {
-      name: "vault_delete",
-      description: "Remove a credential from your vault.",
-      inputSchema: { type: "object", properties: { key: { type: "string" } }, required: ["key"] }
-    },
-    {
-      name: "mesh_watch",
-      description: "Watch a URL for changes. The broker polls it at the given interval and notifies you when the response changes. Works with any URL — websites (hash mode), JSON APIs (json mode), or status codes (status mode).",
-      inputSchema: {
-        type: "object",
-        properties: {
-          url: { type: "string", description: "URL to watch" },
-          mode: { type: "string", enum: ["hash", "json", "status"], description: "Detection mode: hash (SHA-256 of body), json (extract jsonpath value), status (HTTP status code). Default: hash" },
-          extract: { type: "string", description: "For json mode: dot path to extract (e.g. 'status' or 'data.deployments[0].status')" },
-          interval: { type: "number", description: "Poll interval in seconds (min: 5, default: 30)" },
-          notify_on: { type: "string", description: "When to notify: 'change' (default), 'match:<value>', 'not_match:<value>'" },
-          headers: { type: "object", description: "Optional HTTP headers (e.g. for auth)" },
-          label: { type: "string", description: "Human-readable label for this watch" }
-        },
-        required: ["url"]
-      }
-    },
-    {
-      name: "mesh_unwatch",
-      description: "Stop watching a URL.",
-      inputSchema: {
-        type: "object",
-        properties: { watch_id: { type: "string" } },
-        required: ["watch_id"]
-      }
-    },
-    {
-      name: "mesh_watches",
-      description: "List your active URL watches.",
-      inputSchema: { type: "object", properties: {} }
-    }
-  ];
+  TOOLS = [];
 });
 
 // src/services/bridge/server.ts
 import { createServer as createServer2 } from "node:net";
-import { mkdirSync as mkdirSync6, unlinkSync as unlinkSync2, existsSync as existsSync19, chmodSync as chmodSync5 } from "node:fs";
+import { mkdirSync as mkdirSync7, unlinkSync as unlinkSync2, existsSync as existsSync20, chmodSync as chmodSync5 } from "node:fs";
 async function resolveTarget2(client, to) {
   if (to.startsWith("@") || to === "*" || /^[0-9a-f]{64}$/i.test(to)) {
     return { ok: true, spec: to };
@@ -11439,10 +10500,10 @@ function handleConnection(socket, client) {
 function startBridgeServer(client) {
   const path = socketPath(client.meshSlug);
   const dir = socketDir();
-  if (!existsSync19(dir)) {
-    mkdirSync6(dir, { recursive: true, mode: 448 });
+  if (!existsSync20(dir)) {
+    mkdirSync7(dir, { recursive: true, mode: 448 });
   }
-  if (existsSync19(path)) {
+  if (existsSync20(path)) {
     try {
       unlinkSync2(path);
     } catch {}
@@ -11512,135 +10573,6 @@ function relativeTime(isoStr) {
   const days = Math.floor(hours / 24);
   return `${days} day${days !== 1 ? "s" : ""} ago`;
 }
-function text(msg, isError = false) {
-  return {
-    content: [{ type: "text", text: msg }],
-    ...isError ? { isError: true } : {}
-  };
-}
-async function resolveClient(to) {
-  const clients2 = allClients();
-  if (clients2.length === 0) {
-    return { client: null, targetSpec: to, error: "no meshes joined" };
-  }
-  let targetClients = clients2;
-  let target = to;
-  const colonIdx = to.indexOf(":");
-  if (colonIdx > 0 && colonIdx < to.length - 1) {
-    const slug = to.slice(0, colonIdx);
-    const rest = to.slice(colonIdx + 1);
-    const match = findClient(slug);
-    if (match) {
-      targetClients = [match];
-      target = rest;
-    }
-  }
-  if (target.startsWith("#") || target.startsWith("@") || target === "*") {
-    if (targetClients.length === 1) {
-      return { client: targetClients[0], targetSpec: target };
-    }
-    return {
-      client: null,
-      targetSpec: target,
-      error: `multiple meshes joined; prefix target with "<mesh-slug>:" (joined: ${clients2.map((c) => c.meshSlug).join(", ")})`
-    };
-  }
-  if (/^[0-9a-f]{8,64}$/.test(target)) {
-    const hits = [];
-    for (const c of targetClients) {
-      const peers = await c.listPeers();
-      for (const p of peers) {
-        if (p.pubkey.startsWith(target)) {
-          hits.push({ mesh: c, pubkey: p.pubkey, displayName: p.displayName });
-        }
-      }
-    }
-    if (hits.length === 1) {
-      return { client: hits[0].mesh, targetSpec: hits[0].pubkey };
-    }
-    if (hits.length > 1) {
-      const lines = hits.map((h) => `  - ${h.displayName} @ ${h.mesh.meshSlug} · pubkey ${h.pubkey.slice(0, 20)}…`).join(`
-`);
-      return {
-        client: null,
-        targetSpec: target,
-        error: `ambiguous pubkey prefix "${target}" matches ${hits.length} peers:
-${lines}
-Use a longer prefix.`
-      };
-    }
-    if (target.length === 64) {
-      if (targetClients.length === 1) {
-        return { client: targetClients[0], targetSpec: target };
-      }
-      return {
-        client: null,
-        targetSpec: target,
-        error: `multiple meshes joined; prefix target with "<mesh-slug>:" (joined: ${clients2.map((c) => c.meshSlug).join(", ")})`
-      };
-    }
-    return {
-      client: null,
-      targetSpec: target,
-      error: `no online peer's pubkey starts with "${target}".`
-    };
-  }
-  const nameLower = target.toLowerCase();
-  const candidates = [];
-  const exactMatches = [];
-  const partialMatches = [];
-  for (const c of targetClients) {
-    const ownSession = c.getSessionPubkey();
-    const peers = await c.listPeers();
-    candidates.push({ mesh: c.meshSlug, peers });
-    for (const p of peers) {
-      if (ownSession && p.pubkey === ownSession)
-        continue;
-      const nameLow = p.displayName.toLowerCase();
-      if (nameLow === nameLower) {
-        exactMatches.push({ mesh: c, pubkey: p.pubkey, displayName: p.displayName, cwd: p.cwd });
-      } else if (nameLow.includes(nameLower)) {
-        partialMatches.push({ mesh: c, pubkey: p.pubkey, displayName: p.displayName, cwd: p.cwd });
-      }
-    }
-  }
-  if (exactMatches.length === 1) {
-    return { client: exactMatches[0].mesh, targetSpec: exactMatches[0].pubkey };
-  }
-  if (exactMatches.length > 1) {
-    const lines = exactMatches.map((m) => `  - ${m.displayName} · pubkey ${m.pubkey.slice(0, 16)}…${m.cwd ? ` · cwd ${m.cwd}` : ""}`).join(`
-`);
-    return {
-      client: null,
-      targetSpec: target,
-      error: `"${target}" is ambiguous — ${exactMatches.length} peers share that display name:
-${lines}
-` + `Disambiguate by pubkey prefix (e.g. send to "${exactMatches[0].pubkey.slice(0, 12)}…").`
-    };
-  }
-  if (partialMatches.length === 1) {
-    process.stderr.write(`[claudemesh] resolved "${target}" → "${partialMatches[0].displayName}" (partial match)
-`);
-    return { client: partialMatches[0].mesh, targetSpec: partialMatches[0].pubkey };
-  }
-  if (partialMatches.length > 1) {
-    const lines = partialMatches.map((m) => `  - ${m.displayName} · pubkey ${m.pubkey.slice(0, 16)}…`).join(`
-`);
-    return {
-      client: null,
-      targetSpec: target,
-      error: `"${target}" partially matches ${partialMatches.length} peers:
-${lines}
-Be more specific, or use a pubkey prefix.`
-    };
-  }
-  const known = candidates.flatMap((c) => c.peers.map((p) => `${c.mesh}/${p.displayName}`));
-  return {
-    client: null,
-    targetSpec: target,
-    error: `peer "${target}" not found. ` + (known.length ? `Known peers: ${known.slice(0, 10).join(", ")}${known.length > 10 ? ", …" : ""}` : "No connected peers on your mesh(es). Use pubkey hex, @group, or * for broadcast.")
-  };
-}
 async function resolvePeerName(client, pubkey) {
   const now = Date.now();
   if (now - peerNameCacheAge > CACHE_TTL_MS) {
@@ -11658,22 +10590,6 @@ function decryptFailedWarning(senderPubkey) {
   const who = senderPubkey ? senderPubkey.slice(0, 12) + "…" : "unknown sender";
   return `⚠ message from ${who} failed to decrypt (tampered or wrong keypair)`;
 }
-function formatPush(p, meshSlug) {
-  const body = p.plaintext ?? decryptFailedWarning(p.senderPubkey);
-  const tag = p.subtype === "reminder" ? " [REMINDER]" : "";
-  return `[${meshSlug}]${tag} from ${p.senderPubkey.slice(0, 12)}… (${p.priority}, ${p.createdAt}):
-${body}`;
-}
-function maybeWarnDeprecated(toolName) {
-  const hint = DEPRECATED_TOOL_HINTS[toolName];
-  if (!hint)
-    return;
-  if (warnedTools.has(toolName))
-    return;
-  warnedTools.add(toolName);
-  process.stderr.write(`[claudemesh] mcp tool "${toolName}" is soft-deprecated in 1.1.0 ` + `and will be removed in 2.0.0. Use \`${hint}\` instead.
-`);
-}
 async function startMcpServer() {
   const serviceIdx = process.argv.indexOf("--service");
   if (serviceIdx !== -1 && process.argv[serviceIdx + 1]) {
@@ -11961,1482 +10877,6 @@ ${manifest.allowed_tools.map((t) => `  - ${t}`).join(`
       ]
     };
   });
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const { name, arguments: args } = req.params;
-    for (const c of allClients()) {
-      c.incrementToolCalls();
-    }
-    if (config.meshes.length === 0) {
-      return text("No meshes joined. Run `claudemesh join https://claudemesh.com/join/<token>` first.", true);
-    }
-    maybeWarnDeprecated(name);
-    switch (name) {
-      case "send_message": {
-        const { to, message, priority } = args ?? {};
-        if (!to || !message)
-          return text("send_message: `to` and `message` required", true);
-        const targets = Array.isArray(to) ? to : [to];
-        const results2 = [];
-        const seen2 = new Set;
-        for (const target of targets) {
-          const { client, targetSpec, error: error2 } = await resolveClient(target);
-          if (!client) {
-            results2.push(`✗ ${target}: ${error2 ?? "no client resolved"}`);
-            continue;
-          }
-          if (seen2.has(targetSpec))
-            continue;
-          seen2.add(targetSpec);
-          const result = await client.send(targetSpec, message, priority ?? "next");
-          if (!result.ok) {
-            results2.push(`✗ ${target}: ${result.error}`);
-          } else {
-            results2.push(`✓ ${target} → ${result.messageId}`);
-          }
-        }
-        return text(results2.join(`
-`));
-      }
-      case "list_peers": {
-        const { mesh_slug } = args ?? {};
-        const clients2 = mesh_slug ? [findClient(mesh_slug)].filter(Boolean) : allClients();
-        if (clients2.length === 0)
-          return text(mesh_slug ? `list_peers: no joined mesh "${mesh_slug}"` : "list_peers: no joined meshes", true);
-        const sections = [];
-        const statusCache = {};
-        for (const c of clients2) {
-          const peers = await c.listPeers();
-          const header = `## ${c.meshSlug} (${c.status}, mesh ${c.meshId.slice(0, 8)}…)`;
-          statusCache[c.meshSlug] = {
-            total: peers.length,
-            online: peers.filter((p) => p.status !== "offline").length,
-            updatedAt: new Date().toISOString(),
-            you: process.env.CLAUDEMESH_DISPLAY_NAME ?? undefined
-          };
-          if (peers.length === 0) {
-            sections.push(`${header}
-No peers connected.`);
-          } else {
-            const pubkeyCounts = new Map;
-            for (const p of peers)
-              pubkeyCounts.set(p.pubkey, (pubkeyCounts.get(p.pubkey) ?? 0) + 1);
-            const peerLines = peers.map((p) => {
-              const summary = p.summary ? ` — "${p.summary}"` : "";
-              const groupsStr = p.groups?.length ? ` [${p.groups.map((g) => `@${g.name}${g.role ? ":" + g.role : ""}`).join(", ")}]` : "";
-              const meta = [];
-              if (p.peerType)
-                meta.push(`type:${p.peerType}`);
-              if (p.channel)
-                meta.push(`channel:${p.channel}`);
-              if (p.model)
-                meta.push(`model:${p.model}`);
-              const metaStr = meta.length ? ` {${meta.join(", ")}}` : "";
-              const cwdStr = p.cwd ? ` cwd:${p.cwd}` : "";
-              const locality = p.hostname && p.hostname === __require("os").hostname() ? "local" : "remote";
-              const localityTag = ` [${locality}]`;
-              const profileAvatar = p.profile?.avatar ? `${p.profile.avatar} ` : "";
-              const profileTitle = p.profile?.title ? ` (${p.profile.title})` : "";
-              const hiddenTag = p.visible === false ? " [hidden]" : "";
-              const sameKeyCount = pubkeyCounts.get(p.pubkey) ?? 1;
-              const sameKeyTag = sameKeyCount > 1 ? ` [shares key with ${sameKeyCount - 1} other session(s)]` : "";
-              return `- ${profileAvatar}**${p.displayName}**${profileTitle} [${p.status}]${localityTag}${hiddenTag}${sameKeyTag}${groupsStr}${metaStr} (pubkey: ${p.pubkey.slice(0, 16)}…)${cwdStr}${summary}`;
-            });
-            sections.push(`${header}
-${peerLines.join(`
-`)}`);
-          }
-        }
-        try {
-          const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync7, existsSync: existsSync20 } = await import("node:fs");
-          const { join: joinPath } = await import("node:path");
-          const { homedir: homedir11 } = await import("node:os");
-          const dir = joinPath(homedir11(), ".claudemesh");
-          if (!existsSync20(dir))
-            mkdirSync7(dir, { recursive: true });
-          writeFileSync10(joinPath(dir, "peer-cache.json"), JSON.stringify(statusCache));
-        } catch {}
-        return text(sections.join(`
-
-`));
-      }
-      case "message_status": {
-        const { id } = args ?? {};
-        if (!id)
-          return text("message_status: `id` required", true);
-        const clients2 = allClients();
-        if (!clients2.length)
-          return text("message_status: not connected", true);
-        let result = null;
-        for (const c of clients2) {
-          result = await c.messageStatus(id);
-          if (result)
-            break;
-        }
-        if (!result)
-          return text(`Message ${id} not found or timed out.`);
-        const recipientLines = result.recipients.map((r) => `  - ${r.name} (${r.pubkey.slice(0, 12)}…): ${r.status}`);
-        return text(`Message ${id.slice(0, 12)}… → ${result.targetSpec}
-Delivered: ${result.delivered}${result.deliveredAt ? ` at ${result.deliveredAt}` : ""}
-Recipients:
-${recipientLines.join(`
-`)}`);
-      }
-      case "check_messages": {
-        const drained = [];
-        for (const c of allClients()) {
-          const msgs = c.drainPushBuffer();
-          for (const m of msgs)
-            drained.push(formatPush(m, c.meshSlug));
-        }
-        if (drained.length === 0)
-          return text("No new messages.");
-        return text(`${drained.length} new message(s):
-
-${drained.join(`
-
----
-
-`)}`);
-      }
-      case "set_summary": {
-        const { summary } = args ?? {};
-        if (!summary)
-          return text("set_summary: `summary` required", true);
-        for (const c of allClients())
-          await c.setSummary(summary);
-        return text(`Summary set: "${summary}" (visible to ${allClients().length} mesh(es)).`);
-      }
-      case "set_status": {
-        const { status } = args ?? {};
-        if (!status)
-          return text("set_status: `status` required", true);
-        const s = status;
-        for (const c of allClients())
-          await c.setStatus(s);
-        return text(`Status set to ${s} across ${allClients().length} mesh(es).`);
-      }
-      case "set_visible": {
-        const { visible } = args ?? {};
-        if (visible === undefined)
-          return text("set_visible: `visible` required", true);
-        for (const c of allClients())
-          await c.setVisible(visible);
-        return text(visible ? "You are now visible to peers." : "You are now hidden. Direct messages still reach you, but you won't appear in list_peers or receive broadcasts.");
-      }
-      case "set_profile": {
-        const { avatar, title, bio, capabilities } = args ?? {};
-        const profile = { avatar, title, bio, capabilities };
-        for (const c of allClients())
-          await c.setProfile(profile);
-        const parts = [];
-        if (avatar)
-          parts.push(`Avatar: ${avatar}`);
-        if (title)
-          parts.push(`Title: ${title}`);
-        if (bio)
-          parts.push(`Bio: ${bio}`);
-        if (capabilities?.length)
-          parts.push(`Capabilities: ${capabilities.join(", ")}`);
-        return text(parts.length > 0 ? `Profile updated:
-${parts.join(`
-`)}` : "Profile cleared.");
-      }
-      case "join_group": {
-        const { name: groupName, role } = args ?? {};
-        if (!groupName)
-          return text("join_group: `name` required", true);
-        for (const c of allClients())
-          await c.joinGroup(groupName, role);
-        return text(`Joined @${groupName}${role ? ` as ${role}` : ""}`);
-      }
-      case "leave_group": {
-        const { name: groupName } = args ?? {};
-        if (!groupName)
-          return text("leave_group: `name` required", true);
-        for (const c of allClients())
-          await c.leaveGroup(groupName);
-        return text(`Left @${groupName}`);
-      }
-      case "set_state": {
-        const { key, value } = args ?? {};
-        if (!key)
-          return text("set_state: `key` required", true);
-        for (const c of allClients())
-          await c.setState(key, value);
-        return text(`State set: ${key} = ${JSON.stringify(value)}`);
-      }
-      case "get_state": {
-        const { key } = args ?? {};
-        if (!key)
-          return text("get_state: `key` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("get_state: not connected", true);
-        const result = await client.getState(key);
-        if (!result)
-          return text(`State "${key}" not found.`);
-        return text(`${key} = ${JSON.stringify(result.value)} (set by ${result.updatedBy} at ${result.updatedAt})`);
-      }
-      case "list_state": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_state: not connected", true);
-        const entries = await client.listState();
-        if (entries.length === 0)
-          return text("No shared state set.");
-        const lines = entries.map((e) => `- **${e.key}** = ${JSON.stringify(e.value)} (by ${e.updatedBy})`);
-        return text(lines.join(`
-`));
-      }
-      case "remember": {
-        const { content, tags } = args ?? {};
-        if (!content)
-          return text("remember: `content` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("remember: not connected", true);
-        const id = await client.remember(content, tags);
-        return text(`Remembered${id ? ` (${id})` : ""}: "${content.slice(0, 80)}${content.length > 80 ? "..." : ""}"`);
-      }
-      case "recall": {
-        const { query } = args ?? {};
-        if (!query)
-          return text("recall: `query` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("recall: not connected", true);
-        const memories = await client.recall(query);
-        if (memories.length === 0)
-          return text(`No memories found for "${query}".`);
-        const lines = memories.map((m) => `- [${m.id.slice(0, 8)}] ${m.content} (by ${m.rememberedBy}, ${m.rememberedAt})`);
-        return text(`${memories.length} memor${memories.length === 1 ? "y" : "ies"}:
-${lines.join(`
-`)}`);
-      }
-      case "forget": {
-        const { id } = args ?? {};
-        if (!id)
-          return text("forget: `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("forget: not connected", true);
-        await client.forget(id);
-        return text(`Forgotten: ${id}`);
-      }
-      case "schedule_reminder": {
-        const sArgs = args ?? {};
-        if (!sArgs.message)
-          return text("schedule_reminder: `message` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("schedule_reminder: not connected", true);
-        const isCron = !!sArgs.cron;
-        let deliverAt;
-        if (isCron) {
-          deliverAt = 0;
-        } else if (sArgs.deliver_at) {
-          deliverAt = Number(sArgs.deliver_at);
-        } else if (sArgs.in_seconds) {
-          deliverAt = Date.now() + Number(sArgs.in_seconds) * 1000;
-        } else {
-          return text("schedule_reminder: provide `deliver_at` (ms timestamp), `in_seconds`, or `cron` expression", true);
-        }
-        const isSelf = !sArgs.to;
-        let targetSpec;
-        if (isSelf) {
-          targetSpec = client.getSessionPubkey() ?? "*";
-        } else {
-          const to = sArgs.to;
-          if (!to.startsWith("@") && to !== "*" && !/^[0-9a-f]{64}$/i.test(to)) {
-            const peers = await client.listPeers();
-            const match = peers.find((p) => p.displayName.toLowerCase() === to.toLowerCase());
-            if (!match) {
-              const names = peers.map((p) => p.displayName).join(", ");
-              return text(`schedule_reminder: peer "${to}" not found. Online: ${names || "(none)"}`, true);
-            }
-            targetSpec = match.pubkey;
-          } else {
-            targetSpec = to;
-          }
-        }
-        const result = await client.scheduleMessage(targetSpec, sArgs.message, deliverAt, true, sArgs.cron);
-        if (!result)
-          return text("schedule_reminder: broker did not acknowledge — check connection", true);
-        if (isCron) {
-          const nextFire = new Date(result.deliverAt).toISOString();
-          return text(isSelf ? `Recurring self-reminder scheduled (${result.scheduledId.slice(0, 8)}): "${sArgs.message.slice(0, 60)}" — cron: ${sArgs.cron}, next fire: ${nextFire}` : `Recurring reminder to "${sArgs.to}" scheduled (${result.scheduledId.slice(0, 8)}) — cron: ${sArgs.cron}, next fire: ${nextFire}`);
-        }
-        const when = new Date(result.deliverAt).toISOString();
-        return text(isSelf ? `Self-reminder scheduled (${result.scheduledId.slice(0, 8)}): "${sArgs.message.slice(0, 60)}" at ${when}` : `Reminder to "${sArgs.to}" scheduled (${result.scheduledId.slice(0, 8)}) for ${when}`);
-      }
-      case "list_scheduled": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_scheduled: not connected", true);
-        const scheduled = await client.listScheduled();
-        if (scheduled.length === 0)
-          return text("No pending scheduled messages.");
-        const lines = scheduled.map((m) => `- [${m.id.slice(0, 8)}] → ${m.to === client.getSessionPubkey() ? "self (reminder)" : m.to} at ${new Date(m.deliverAt).toISOString()}: "${m.message.slice(0, 60)}${m.message.length > 60 ? "…" : ""}"`);
-        return text(`${scheduled.length} scheduled:
-${lines.join(`
-`)}`);
-      }
-      case "cancel_scheduled": {
-        const client = allClients()[0];
-        if (!client)
-          return text("cancel_scheduled: not connected", true);
-        const { id: schedId } = args ?? {};
-        if (!schedId)
-          return text("cancel_scheduled: `id` required", true);
-        const ok = await client.cancelScheduled(schedId);
-        return text(ok ? `Cancelled: ${schedId}` : `Not found or already fired: ${schedId}`, !ok);
-      }
-      case "share_file": {
-        const { path: filePath, name: fileName, tags, to: fileTo } = args ?? {};
-        if (!filePath)
-          return text("share_file: `path` required", true);
-        const { existsSync: existsSync20 } = await import("node:fs");
-        if (!existsSync20(filePath))
-          return text(`share_file: file not found: ${filePath}`, true);
-        const client = allClients()[0];
-        if (!client)
-          return text("share_file: not connected", true);
-        if (fileTo) {
-          const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-          const { readFileSync: readFileSync13, writeFileSync: writeFileSync10, mkdtempSync: mkdtempSync2, unlinkSync: unlinkSync3, rmdirSync } = await import("node:fs");
-          const { tmpdir: tmpdir2 } = await import("node:os");
-          const { join: join12, basename } = await import("node:path");
-          const peers = await client.listPeers();
-          const targetPeer = peers.find((p) => p.pubkey === fileTo || p.displayName === fileTo);
-          if (!targetPeer) {
-            return text(`share_file: peer not found: ${fileTo}`, true);
-          }
-          const plaintext = readFileSync13(filePath);
-          const { ciphertext, nonce, key } = await encryptFile2(new Uint8Array(plaintext));
-          const sealedForTarget = await sealKeyForPeer2(key, targetPeer.pubkey);
-          const myPubkey = client.getSessionPubkey();
-          const sealedForSelf = myPubkey ? await sealKeyForPeer2(key, myPubkey) : null;
-          const fileKeys = [
-            { peerPubkey: targetPeer.pubkey, sealedKey: sealedForTarget },
-            ...sealedForSelf && myPubkey ? [{ peerPubkey: myPubkey, sealedKey: sealedForSelf }] : []
-          ];
-          const { ensureSodium: ensureSodium3 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
-          const sodium4 = await ensureSodium3();
-          const nonceBytes = sodium4.from_base64(nonce, sodium4.base64_variants.ORIGINAL);
-          const combined = new Uint8Array(nonceBytes.length + ciphertext.length);
-          combined.set(nonceBytes, 0);
-          combined.set(ciphertext, nonceBytes.length);
-          const rawName = fileName ?? basename(filePath);
-          const baseName = basename(rawName).replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 255);
-          const tmpDir = mkdtempSync2(join12(tmpdir2(), "cm-"));
-          const tmpPath = join12(tmpDir, baseName);
-          writeFileSync10(tmpPath, combined);
-          try {
-            const fileId = await client.uploadFile(tmpPath, client.meshId, client.meshSlug, {
-              name: baseName,
-              tags,
-              persistent: true,
-              encrypted: true,
-              ownerPubkey: myPubkey ?? undefined,
-              fileKeys
-            });
-            return text(`Shared (E2E encrypted): ${baseName} → ${targetPeer.displayName} (${fileId})`);
-          } catch (e) {
-            return text(`share_file: upload failed — ${e instanceof Error ? e.message : String(e)}`, true);
-          } finally {
-            try {
-              unlinkSync3(tmpPath);
-            } catch {}
-            try {
-              rmdirSync(tmpDir);
-            } catch {}
-          }
-        }
-        try {
-          const fileId = await client.uploadFile(filePath, client.meshId, client.meshSlug, {
-            name: fileName,
-            tags,
-            persistent: true
-          });
-          return text(`Shared: ${fileName ?? filePath} (${fileId})`);
-        } catch (e) {
-          return text(`share_file: upload failed — ${e instanceof Error ? e.message : String(e)}`, true);
-        }
-      }
-      case "get_file": {
-        const { id, save_to } = args ?? {};
-        if (!id || !save_to)
-          return text("get_file: `id` and `save_to` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("get_file: not connected", true);
-        const result = await client.getFile(id);
-        if (!result)
-          return text(`get_file: file ${id} not found`, true);
-        if (result.encrypted) {
-          const genericErr = "get_file: could not decrypt — you may not have access to this file";
-          if (!result.sealedKey)
-            return text(genericErr, true);
-          const { openSealedKey: openSealedKey2, decryptFile: decryptFile2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-          const { ensureSodium: ensureSodium3 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
-          const myPubkey = client.getSessionPubkey();
-          const mySecret = client.getSessionSecretKey();
-          if (!myPubkey || !mySecret)
-            return text(genericErr, true);
-          const kf = await openSealedKey2(result.sealedKey, myPubkey, mySecret);
-          if (!kf)
-            return text(genericErr, true);
-          const MAX_DOWNLOAD = 104857600;
-          const resp = await fetch(result.url, { signal: AbortSignal.timeout(30000) });
-          if (!resp.ok)
-            return text(`get_file: download failed (${resp.status})`, true);
-          const contentLength = parseInt(resp.headers.get("content-length") ?? "0", 10);
-          if (contentLength > MAX_DOWNLOAD)
-            return text(`get_file: file too large (${contentLength} bytes)`, true);
-          const buf = new Uint8Array(await resp.arrayBuffer());
-          if (buf.length > MAX_DOWNLOAD)
-            return text(`get_file: file too large (${buf.length} bytes)`, true);
-          const sodium4 = await ensureSodium3();
-          const NONCE_BYTES = sodium4.crypto_secretbox_NONCEBYTES;
-          if (buf.length < NONCE_BYTES)
-            return text(genericErr, true);
-          const nonce = sodium4.to_base64(buf.slice(0, NONCE_BYTES), sodium4.base64_variants.ORIGINAL);
-          const ciphertext = buf.slice(NONCE_BYTES);
-          const plaintext = await decryptFile2(ciphertext, nonce, kf);
-          if (!plaintext)
-            return text(genericErr, true);
-          const { writeFileSync: writeFileSync11, mkdirSync: mkdirSync8 } = await import("node:fs");
-          const { dirname: dirname6 } = await import("node:path");
-          mkdirSync8(dirname6(save_to), { recursive: true });
-          writeFileSync11(save_to, plaintext);
-          return text(`Downloaded and decrypted: ${result.name} → ${save_to}`);
-        }
-        let res = await fetch(result.url, { signal: AbortSignal.timeout(1e4) }).catch(() => null);
-        if (!res || !res.ok) {
-          const brokerHttp = client.brokerUrl.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
-          res = await fetch(`${brokerHttp}/download/${id}?mesh=${client.meshId}`, { signal: AbortSignal.timeout(30000) });
-        }
-        if (!res.ok)
-          return text(`get_file: download failed (${res.status})`, true);
-        const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync7 } = await import("node:fs");
-        const { dirname: dirname5 } = await import("node:path");
-        mkdirSync7(dirname5(save_to), { recursive: true });
-        writeFileSync10(save_to, Buffer.from(await res.arrayBuffer()));
-        return text(`Downloaded: ${result.name} → ${save_to}`);
-      }
-      case "list_files": {
-        const { query, from } = args ?? {};
-        const client = allClients()[0];
-        if (!client)
-          return text("list_files: not connected", true);
-        const files = await client.listFiles(query, from);
-        if (files.length === 0)
-          return text("No files found.");
-        const lines = files.map((f) => `- **${f.name}** (${f.id.slice(0, 8)}…, ${f.size} bytes) by ${f.uploadedBy}${f.tags.length ? ` [${f.tags.join(", ")}]` : ""}`);
-        return text(lines.join(`
-`));
-      }
-      case "file_status": {
-        const { id } = args ?? {};
-        if (!id)
-          return text("file_status: `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("file_status: not connected", true);
-        const accesses = await client.fileStatus(id);
-        if (accesses.length === 0)
-          return text("No one has accessed this file yet.");
-        const lines = accesses.map((a) => `- ${a.peerName} at ${a.accessedAt}`);
-        return text(`Accessed by:
-${lines.join(`
-`)}`);
-      }
-      case "delete_file": {
-        const { id } = args ?? {};
-        if (!id)
-          return text("delete_file: `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("delete_file: not connected", true);
-        await client.deleteFile(id);
-        return text(`Deleted: ${id}`);
-      }
-      case "vector_store": {
-        const { collection, text: storeText, metadata } = args ?? {};
-        if (!collection || !storeText)
-          return text("vector_store: `collection` and `text` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("vector_store: not connected", true);
-        const id = await client.vectorStore(collection, storeText, metadata);
-        return text(`Stored in ${collection}${id ? ` (${id})` : ""}`);
-      }
-      case "vector_search": {
-        const { collection, query, limit } = args ?? {};
-        if (!collection || !query)
-          return text("vector_search: `collection` and `query` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("vector_search: not connected", true);
-        const results2 = await client.vectorSearch(collection, query, limit);
-        if (results2.length === 0)
-          return text(`No results in ${collection} for "${query}".`);
-        const lines = results2.map((r) => `- [${r.id.slice(0, 8)}…] (score: ${r.score.toFixed(3)}) ${r.text.slice(0, 120)}${r.text.length > 120 ? "…" : ""}`);
-        return text(`${results2.length} result(s) in ${collection}:
-${lines.join(`
-`)}`);
-      }
-      case "vector_delete": {
-        const { collection, id } = args ?? {};
-        if (!collection || !id)
-          return text("vector_delete: `collection` and `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("vector_delete: not connected", true);
-        await client.vectorDelete(collection, id);
-        return text(`Deleted ${id} from ${collection}`);
-      }
-      case "list_collections": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_collections: not connected", true);
-        const collections = await client.listCollections();
-        if (collections.length === 0)
-          return text("No vector collections.");
-        return text(`Collections:
-${collections.map((c) => `- ${c}`).join(`
-`)}`);
-      }
-      case "graph_query": {
-        const { cypher } = args ?? {};
-        if (!cypher)
-          return text("graph_query: `cypher` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("graph_query: not connected", true);
-        const rows = await client.graphQuery(cypher);
-        if (rows.length === 0)
-          return text("No results.");
-        return text(JSON.stringify(rows, null, 2));
-      }
-      case "graph_execute": {
-        const { cypher } = args ?? {};
-        if (!cypher)
-          return text("graph_execute: `cypher` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("graph_execute: not connected", true);
-        const rows = await client.graphExecute(cypher);
-        return text(rows.length > 0 ? JSON.stringify(rows, null, 2) : "Executed successfully.");
-      }
-      case "share_context": {
-        const { summary, files_read, key_findings, tags } = args ?? {};
-        if (!summary)
-          return text("share_context: `summary` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("share_context: not connected", true);
-        await client.shareContext(summary, files_read, key_findings, tags);
-        return text(`Context shared: "${summary.slice(0, 80)}${summary.length > 80 ? "…" : ""}"`);
-      }
-      case "get_context": {
-        const { query } = args ?? {};
-        if (!query)
-          return text("get_context: `query` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("get_context: not connected", true);
-        const contexts = await client.getContext(query);
-        if (contexts.length === 0)
-          return text(`No context found for "${query}".`);
-        const lines = contexts.map((c) => {
-          const files = c.filesRead.length ? `
-  Files: ${c.filesRead.join(", ")}` : "";
-          const findings = c.keyFindings.length ? `
-  Findings: ${c.keyFindings.join("; ")}` : "";
-          return `- **${c.peerName}** (${c.updatedAt}): ${c.summary}${files}${findings}`;
-        });
-        return text(`${contexts.length} context(s):
-${lines.join(`
-`)}`);
-      }
-      case "list_contexts": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_contexts: not connected", true);
-        const contexts = await client.listContexts();
-        if (contexts.length === 0)
-          return text("No peer contexts shared yet.");
-        const lines = contexts.map((c) => `- **${c.peerName}**: ${c.summary}${c.tags.length ? ` [${c.tags.join(", ")}]` : ""}`);
-        return text(`Peer contexts:
-${lines.join(`
-`)}`);
-      }
-      case "create_task": {
-        const { title, assignee, priority, tags } = args ?? {};
-        if (!title)
-          return text("create_task: `title` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("create_task: not connected", true);
-        const id = await client.createTask(title, assignee, priority, tags);
-        return text(`Task created${id ? ` (${id})` : ""}: "${title}"${assignee ? ` → ${assignee}` : ""}`);
-      }
-      case "claim_task": {
-        const { id } = args ?? {};
-        if (!id)
-          return text("claim_task: `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("claim_task: not connected", true);
-        await client.claimTask(id);
-        return text(`Claimed task: ${id}`);
-      }
-      case "complete_task": {
-        const { id, result } = args ?? {};
-        if (!id)
-          return text("complete_task: `id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("complete_task: not connected", true);
-        await client.completeTask(id, result);
-        return text(`Completed task: ${id}${result ? ` — ${result}` : ""}`);
-      }
-      case "list_tasks": {
-        const { status, assignee } = args ?? {};
-        const client = allClients()[0];
-        if (!client)
-          return text("list_tasks: not connected", true);
-        const tasks = await client.listTasks(status, assignee);
-        if (tasks.length === 0)
-          return text("No tasks found.");
-        const lines = tasks.map((t) => `- [${t.id.slice(0, 8)}…] **${t.title}** (${t.status}, ${t.priority}) ${t.assignee ? `→ ${t.assignee}` : "unassigned"} (by ${t.createdBy})`);
-        return text(`${tasks.length} task(s):
-${lines.join(`
-`)}`);
-      }
-      case "mesh_query": {
-        const { sql: querySql } = args ?? {};
-        if (!querySql)
-          return text("mesh_query: `sql` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_query: not connected", true);
-        const result = await client.meshQuery(querySql);
-        if (!result)
-          return text("mesh_query: query failed or timed out", true);
-        if (result.rows.length === 0)
-          return text(`Query returned 0 rows.`);
-        const header = `| ${result.columns.join(" | ")} |`;
-        const sep = `| ${result.columns.map(() => "---").join(" | ")} |`;
-        const rows = result.rows.map((r) => `| ${result.columns.map((c) => String(r[c] ?? "")).join(" | ")} |`);
-        return text(`${result.rowCount} row(s):
-${header}
-${sep}
-${rows.join(`
-`)}`);
-      }
-      case "mesh_execute": {
-        const { sql: execSql } = args ?? {};
-        if (!execSql)
-          return text("mesh_execute: `sql` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_execute: not connected", true);
-        await client.meshExecute(execSql);
-        return text(`Executed.`);
-      }
-      case "mesh_schema": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_schema: not connected", true);
-        const tables = await client.meshSchema();
-        if (!tables || tables.length === 0)
-          return text("No tables in mesh database.");
-        const lines = tables.map((t) => `**${t.name}**: ${t.columns.map((c) => `${c.name} (${c.type}${c.nullable ? ", nullable" : ""})`).join(", ")}`);
-        return text(lines.join(`
-`));
-      }
-      case "create_stream": {
-        const { name: streamName } = args ?? {};
-        if (!streamName)
-          return text("create_stream: `name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("create_stream: not connected", true);
-        const streamId = await client.createStream(streamName);
-        return text(`Stream created: ${streamName}${streamId ? ` (${streamId})` : ""}`);
-      }
-      case "publish": {
-        const { stream: pubStream, data: pubData } = args ?? {};
-        if (!pubStream)
-          return text("publish: `stream` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("publish: not connected", true);
-        await client.publish(pubStream, pubData);
-        return text(`Published to ${pubStream}.`);
-      }
-      case "subscribe": {
-        const { stream: subStream } = args ?? {};
-        if (!subStream)
-          return text("subscribe: `stream` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("subscribe: not connected", true);
-        await client.subscribe(subStream);
-        return text(`Subscribed to ${subStream}. Data pushes will arrive as channel notifications.`);
-      }
-      case "list_streams": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_streams: not connected", true);
-        const streams = await client.listStreams();
-        if (streams.length === 0)
-          return text("No active streams.");
-        const lines = streams.map((s) => `- **${s.name}** (${s.id.slice(0, 8)}…) by ${s.createdBy}, ${s.subscriberCount} subscriber(s)`);
-        return text(lines.join(`
-`));
-      }
-      case "mesh_set_clock": {
-        const { speed } = args ?? {};
-        if (!speed || speed < 1 || speed > 100)
-          return text("mesh_set_clock: speed must be 1-100", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_set_clock: not connected", true);
-        const result = await client.setClock(speed);
-        if (!result)
-          return text("mesh_set_clock: timed out", true);
-        return text([
-          `**Clock set to x${result.speed}**`,
-          `Paused: ${result.paused}`,
-          `Tick: ${result.tick}`,
-          `Sim time: ${result.simTime}`,
-          `Started at: ${result.startedAt}`
-        ].join(`
-`));
-      }
-      case "mesh_pause_clock": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_pause_clock: not connected", true);
-        const result = await client.pauseClock();
-        if (!result)
-          return text("mesh_pause_clock: timed out", true);
-        return text([
-          "**Clock paused**",
-          `Speed: x${result.speed}`,
-          `Tick: ${result.tick}`,
-          `Sim time: ${result.simTime}`
-        ].join(`
-`));
-      }
-      case "mesh_resume_clock": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_resume_clock: not connected", true);
-        const result = await client.resumeClock();
-        if (!result)
-          return text("mesh_resume_clock: timed out", true);
-        return text([
-          "**Clock resumed**",
-          `Speed: x${result.speed}`,
-          `Tick: ${result.tick}`,
-          `Sim time: ${result.simTime}`
-        ].join(`
-`));
-      }
-      case "mesh_clock": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_clock: not connected", true);
-        const result = await client.getClock();
-        if (!result)
-          return text("mesh_clock: timed out", true);
-        const statusLabel = result.speed === 0 ? "not started" : result.paused ? "paused" : "running";
-        return text([
-          `**Clock status: ${statusLabel}**`,
-          `Speed: x${result.speed}`,
-          `Tick: ${result.tick}`,
-          `Sim time: ${result.simTime}`,
-          `Started at: ${result.startedAt}`
-        ].join(`
-`));
-      }
-      case "mesh_info": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_info: not connected", true);
-        const info = await client.meshInfo();
-        if (!info)
-          return text("mesh_info: timed out", true);
-        const lines = [
-          `**Mesh**: ${info.mesh}`,
-          `**Peers**: ${info.peers}`,
-          `**Groups**: ${info.groups?.join(", ") || "none"}`,
-          `**State keys**: ${info.stateKeys?.join(", ") || "none"}`,
-          `**Memories**: ${info.memoryCount}`,
-          `**Files**: ${info.fileCount}`,
-          `**Tasks**: open=${info.tasks?.open ?? 0}, claimed=${info.tasks?.claimed ?? 0}, done=${info.tasks?.done ?? 0}`,
-          `**Streams**: ${info.streams?.join(", ") || "none"}`,
-          `**Tables**: ${info.tables?.join(", ") || "none"}`,
-          `**Your name**: ${info.yourName}`,
-          `**Your groups**: ${info.yourGroups?.map((g) => `@${g.name}${g.role ? ":" + g.role : ""}`).join(", ") || "none"}`
-        ];
-        return text(lines.join(`
-`));
-      }
-      case "mesh_stats": {
-        const clients2 = allClients();
-        if (clients2.length === 0)
-          return text("mesh_stats: no joined meshes", true);
-        const sections = [];
-        for (const c of clients2) {
-          const peers = await c.listPeers();
-          const header = `## ${c.meshSlug}`;
-          const rows = peers.map((p) => {
-            const s = p.stats;
-            if (!s)
-              return `| ${p.displayName} | - | - | - | - | - |`;
-            const up = s.uptime != null ? `${Math.floor(s.uptime / 60)}m` : "-";
-            return `| ${p.displayName} | ${s.messagesIn ?? 0} | ${s.messagesOut ?? 0} | ${s.toolCalls ?? 0} | ${up} | ${s.errors ?? 0} |`;
-          });
-          sections.push(`${header}
-| Peer | Msgs In | Msgs Out | Tool Calls | Uptime | Errors |
-|------|---------|----------|------------|--------|--------|
-${rows.join(`
-`)}`);
-        }
-        return text(sections.join(`
-
-`));
-      }
-      case "share_skill": {
-        const {
-          name: skillName,
-          description: skillDesc,
-          instructions: skillInstr,
-          tags: skillTags,
-          when_to_use,
-          allowed_tools,
-          model,
-          context: skillContext,
-          agent,
-          user_invocable,
-          argument_hint
-        } = args ?? {};
-        if (!skillName || !skillDesc || !skillInstr)
-          return text("share_skill: `name`, `description`, and `instructions` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("share_skill: not connected", true);
-        const manifest = {};
-        if (when_to_use)
-          manifest.when_to_use = when_to_use;
-        if (allowed_tools?.length)
-          manifest.allowed_tools = allowed_tools;
-        if (model)
-          manifest.model = model;
-        if (skillContext)
-          manifest.context = skillContext;
-        if (agent)
-          manifest.agent = agent;
-        if (user_invocable === false)
-          manifest.user_invocable = false;
-        if (argument_hint)
-          manifest.argument_hint = argument_hint;
-        const result = await client.shareSkill(skillName, skillDesc, skillInstr, skillTags, Object.keys(manifest).length > 0 ? manifest : undefined);
-        if (!result)
-          return text("share_skill: broker did not acknowledge", true);
-        server.notification({ method: "notifications/prompts/list_changed" });
-        server.notification({ method: "notifications/resources/list_changed" });
-        return text(`Skill "${skillName}" published to the mesh. It will appear as /claudemesh:${skillName} in Claude Code.`);
-      }
-      case "get_skill": {
-        const { name: gsName } = args ?? {};
-        if (!gsName)
-          return text("get_skill: `name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("get_skill: not connected", true);
-        const skill = await client.getSkill(gsName);
-        if (!skill)
-          return text(`Skill "${gsName}" not found in the mesh.`);
-        const manifest = skill.manifest;
-        const metaLines = [];
-        if (manifest) {
-          if (manifest.when_to_use)
-            metaLines.push(`**When to use:** ${manifest.when_to_use}`);
-          if (manifest.allowed_tools)
-            metaLines.push(`**Allowed tools:** ${manifest.allowed_tools.join(", ")}`);
-          if (manifest.model)
-            metaLines.push(`**Model:** ${manifest.model}`);
-          if (manifest.context)
-            metaLines.push(`**Context:** ${manifest.context}`);
-          if (manifest.agent)
-            metaLines.push(`**Agent:** ${manifest.agent}`);
-        }
-        return text(`# Skill: ${skill.name}
-
-**Description:** ${skill.description}
-**Author:** ${skill.author}
-**Tags:** ${skill.tags.length ? skill.tags.join(", ") : "none"}
-**Created:** ${skill.createdAt}
-**Slash command:** /claudemesh:${skill.name}
-` + (metaLines.length ? metaLines.join(`
-`) + `
-` : "") + `
----
-
-## Instructions
-
-${skill.instructions}`);
-      }
-      case "list_skills": {
-        const { query: skillQuery } = args ?? {};
-        const client = allClients()[0];
-        if (!client)
-          return text("list_skills: not connected", true);
-        const skills = await client.listSkills(skillQuery);
-        if (skills.length === 0)
-          return text(skillQuery ? `No skills found for "${skillQuery}".` : "No skills in the mesh yet.");
-        const lines = skills.map((s) => `- **${s.name}**: ${s.description}${s.tags.length ? ` [${s.tags.join(", ")}]` : ""} (by ${s.author})`);
-        return text(`${skills.length} skill(s):
-${lines.join(`
-`)}`);
-      }
-      case "remove_skill": {
-        const { name: rsName } = args ?? {};
-        if (!rsName)
-          return text("remove_skill: `name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("remove_skill: not connected", true);
-        const removed = await client.removeSkill(rsName);
-        if (removed) {
-          server.notification({ method: "notifications/prompts/list_changed" });
-          server.notification({ method: "notifications/resources/list_changed" });
-        }
-        return text(removed ? `Skill "${rsName}" removed.` : `Skill "${rsName}" not found.`, !removed);
-      }
-      case "ping_mesh": {
-        const { priorities: pingPriorities } = args ?? {};
-        const toTest = pingPriorities ?? ["now", "next"];
-        const client = allClients()[0];
-        if (!client)
-          return text("ping_mesh: not connected", true);
-        const results2 = [];
-        results2.push(`WS status: ${client.status}`);
-        results2.push(`Mesh: ${client.meshSlug}`);
-        const peers = await client.listPeers();
-        const selfPeer = peers.find((p) => p.displayName === myName);
-        results2.push(`Your status: ${selfPeer?.status ?? "not found in peer list"}`);
-        results2.push(`Peers online: ${peers.length}`);
-        results2.push(`Push buffer: ${client.pushHistory.length} buffered`);
-        for (const prio of toTest) {
-          const sendTime = Date.now();
-          const target = peers.find((p) => p.displayName !== myName);
-          const sendResult = await client.send(target?.pubkey ?? "*", `__ping__ ${prio} from ${myName} at ${new Date().toISOString()}`, prio);
-          const ackTime = Date.now();
-          if (!sendResult.ok) {
-            results2.push(`[${prio}] SEND FAILED: ${sendResult.error}`);
-          } else {
-            results2.push(`[${prio}] send→ack: ${ackTime - sendTime}ms (msgId: ${sendResult.messageId?.slice(0, 12)})`);
-            if (prio !== "now" && selfPeer?.status === "working") {
-              results2.push(`  ⚠ peer status is "working" — broker holds "${prio}" until idle`);
-            }
-          }
-        }
-        results2.push("");
-        results2.push("Pipeline check:");
-        results2.push(`  onPush handlers: active`);
-        results2.push(`  messageMode: ${messageMode}`);
-        results2.push(`  server.notification: ${messageMode === "off" ? "disabled (mode=off)" : "enabled"}`);
-        return text(results2.join(`
-`));
-      }
-      case "mesh_mcp_register": {
-        const { server_name, description, tools: regTools, persistent: regPersistent } = args ?? {};
-        if (!server_name || !description || !regTools?.length)
-          return text("mesh_mcp_register: `server_name`, `description`, and `tools` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_register: not connected", true);
-        const result = await client.mcpRegister(server_name, description, regTools, regPersistent);
-        if (!result)
-          return text("mesh_mcp_register: broker did not acknowledge", true);
-        const persistLabel = regPersistent ? " (persistent — survives disconnect)" : "";
-        return text(`Registered MCP server "${result.serverName}" with ${result.toolCount} tool(s)${persistLabel}. Other peers can now call its tools via mesh_tool_call.`);
-      }
-      case "mesh_mcp_list": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_list: not connected", true);
-        const servers = await client.mcpList();
-        if (servers.length === 0)
-          return text("No MCP servers registered in the mesh.");
-        const lines = servers.map((s) => {
-          const toolList = s.tools.map((t) => `    - **${t.name}**: ${t.description}`).join(`
-`);
-          const status = s.online === false ? ` [OFFLINE${s.offlineSince ? ` since ${s.offlineSince}` : ""}]` : "";
-          return `- **${s.name}** (hosted by ${s.hostedBy})${status}: ${s.description}
-${toolList}`;
-        });
-        return text(`${servers.length} MCP server(s) in mesh:
-${lines.join(`
-`)}`);
-      }
-      case "mesh_tool_call": {
-        const { server_name: callServer, tool_name: callTool, args: callArgs } = args ?? {};
-        if (!callServer || !callTool)
-          return text("mesh_tool_call: `server_name` and `tool_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_tool_call: not connected", true);
-        const callResult = await client.mcpCall(callServer, callTool, callArgs ?? {});
-        if (callResult.error)
-          return text(`mesh_tool_call error: ${callResult.error}`, true);
-        return text(typeof callResult.result === "string" ? callResult.result : JSON.stringify(callResult.result, null, 2));
-      }
-      case "mesh_mcp_remove": {
-        const { server_name: rmServer } = args ?? {};
-        if (!rmServer)
-          return text("mesh_mcp_remove: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_remove: not connected", true);
-        await client.mcpUnregister(rmServer);
-        return text(`Unregistered MCP server "${rmServer}" from the mesh.`);
-      }
-      case "grant_file_access": {
-        const { fileId, to: grantTo } = args ?? {};
-        if (!fileId || !grantTo)
-          return text("grant_file_access: `fileId` and `to` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("grant_file_access: not connected", true);
-        const peers = await client.listPeers();
-        const targetPeer = peers.find((p) => p.pubkey === grantTo || p.displayName === grantTo);
-        if (!targetPeer)
-          return text(`grant_file_access: peer not found: ${grantTo}`, true);
-        const result = await client.getFile(fileId);
-        if (!result)
-          return text("grant_file_access: file not found", true);
-        if (!result.encrypted)
-          return text("grant_file_access: file is not encrypted", true);
-        if (!result.sealedKey)
-          return text("grant_file_access: no key available (are you the owner?)", true);
-        const { openSealedKey: openSealedKey2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-        const myPubkey = client.getSessionPubkey();
-        const mySecret = client.getSessionSecretKey();
-        if (!myPubkey || !mySecret)
-          return text("grant_file_access: no session keypair", true);
-        const kf = await openSealedKey2(result.sealedKey, myPubkey, mySecret);
-        if (!kf)
-          return text("grant_file_access: cannot decrypt your own key", true);
-        const sealedForPeer = await sealKeyForPeer2(kf, targetPeer.pubkey);
-        const ok = await client.grantFileAccess(fileId, targetPeer.pubkey, sealedForPeer);
-        if (!ok)
-          return text("grant_file_access: broker did not confirm", true);
-        return text(`Access granted: ${targetPeer.displayName} can now download file ${fileId}`);
-      }
-      case "read_peer_file": {
-        const { peer: peerName, path: filePath } = args ?? {};
-        if (!peerName || !filePath)
-          return text("read_peer_file: `peer` and `path` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("read_peer_file: not connected", true);
-        const peers = await client.listPeers();
-        const nameLower = peerName.toLowerCase();
-        let targetPubkey = null;
-        if (/^[0-9a-f]{64}$/.test(peerName)) {
-          targetPubkey = peerName;
-        } else {
-          const match = peers.find((p) => p.displayName.toLowerCase() === nameLower);
-          if (!match) {
-            const partials = peers.filter((p) => p.displayName.toLowerCase().includes(nameLower));
-            if (partials.length === 1) {
-              targetPubkey = partials[0].pubkey;
-            } else {
-              const names = peers.map((p) => p.displayName).join(", ");
-              return text(`read_peer_file: peer "${peerName}" not found. Online: ${names || "(none)"}`, true);
-            }
-          } else {
-            targetPubkey = match.pubkey;
-          }
-        }
-        const resolvedPeer = peers.find((p) => p.pubkey === targetPubkey);
-        const isLocal = resolvedPeer?.hostname && resolvedPeer.hostname === __require("os").hostname();
-        let localHint = "";
-        if (isLocal && resolvedPeer?.cwd) {
-          const directPath = __require("path").resolve(resolvedPeer.cwd, filePath);
-          localHint = `
-
-> **Hint:** This peer is LOCAL (same machine). Next time, read directly: \`${directPath}\` — faster, no size limit.
-
-`;
-        }
-        const result = await client.requestFile(targetPubkey, filePath);
-        if (result.error)
-          return text(`read_peer_file: ${result.error}`, true);
-        if (!result.content)
-          return text("read_peer_file: empty response from peer", true);
-        try {
-          const decoded = Buffer.from(result.content, "base64").toString("utf-8");
-          return text(localHint + decoded);
-        } catch {
-          return text("read_peer_file: failed to decode file content (binary file?)", true);
-        }
-      }
-      case "list_peer_files": {
-        const { peer: peerName, path: dirPath, pattern } = args ?? {};
-        if (!peerName)
-          return text("list_peer_files: `peer` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("list_peer_files: not connected", true);
-        const peers = await client.listPeers();
-        const nameLower = peerName.toLowerCase();
-        let targetPubkey = null;
-        if (/^[0-9a-f]{64}$/.test(peerName)) {
-          targetPubkey = peerName;
-        } else {
-          const match = peers.find((p) => p.displayName.toLowerCase() === nameLower);
-          if (!match) {
-            const partials = peers.filter((p) => p.displayName.toLowerCase().includes(nameLower));
-            if (partials.length === 1) {
-              targetPubkey = partials[0].pubkey;
-            } else {
-              const names = peers.map((p) => p.displayName).join(", ");
-              return text(`list_peer_files: peer "${peerName}" not found. Online: ${names || "(none)"}`, true);
-            }
-          } else {
-            targetPubkey = match.pubkey;
-          }
-        }
-        const result = await client.requestDir(targetPubkey, dirPath ?? ".", pattern);
-        if (result.error)
-          return text(`list_peer_files: ${result.error}`, true);
-        if (!result.entries || result.entries.length === 0)
-          return text("No files found.");
-        return text(result.entries.join(`
-`));
-      }
-      case "create_webhook": {
-        const { name: whName } = args ?? {};
-        if (!whName)
-          return text("create_webhook: `name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("create_webhook: not connected", true);
-        const wh = await client.createWebhook(whName);
-        if (!wh)
-          return text("create_webhook: broker did not acknowledge — check connection", true);
-        return text(`Webhook **${wh.name}** created.
-
-URL: ${wh.url}
-Secret: ${wh.secret}
-
-External services can POST JSON to this URL. The payload will be pushed to all connected mesh peers.`);
-      }
-      case "list_webhooks": {
-        const client = allClients()[0];
-        if (!client)
-          return text("list_webhooks: not connected", true);
-        const webhooks = await client.listWebhooks();
-        if (webhooks.length === 0)
-          return text("No active webhooks.");
-        const lines = webhooks.map((w) => `- **${w.name}** — ${w.url} (created ${w.createdAt})`);
-        return text(`${webhooks.length} webhook(s):
-${lines.join(`
-`)}`);
-      }
-      case "delete_webhook": {
-        const { name: delName } = args ?? {};
-        if (!delName)
-          return text("delete_webhook: `name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("delete_webhook: not connected", true);
-        const ok = await client.deleteWebhook(delName);
-        return text(ok ? `Webhook "${delName}" deactivated.` : `Failed to deactivate webhook "${delName}".`, !ok);
-      }
-      case "vault_set": {
-        const { key, value, type: vType, mount_path, description } = args ?? {};
-        if (!key || !value)
-          return text("vault_set: `key` and `value` required", true);
-        if (!/^[a-zA-Z0-9_.-]{1,128}$/.test(key))
-          return text("vault_set: `key` must be 1-128 alphanumeric/underscore/dot/dash chars", true);
-        if (mount_path && (mount_path.includes("..") || mount_path.length > 512))
-          return text("vault_set: invalid `mount_path`", true);
-        if (description && description.length > 500)
-          return text("vault_set: `description` too long (max 500 chars)", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("vault_set: not connected", true);
-        const entryType = vType ?? "env";
-        let plaintextBytes;
-        if (entryType === "file") {
-          const { existsSync: existsSync20, readFileSync: readFileSync13 } = await import("node:fs");
-          if (!existsSync20(value))
-            return text(`vault_set: file not found: ${value}`, true);
-          plaintextBytes = new Uint8Array(readFileSync13(value));
-        } else {
-          plaintextBytes = new TextEncoder().encode(value);
-        }
-        const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-        const { ciphertext, nonce, key: kf } = await encryptFile2(plaintextBytes);
-        const sealedKey = await sealKeyForPeer2(kf, client.getMeshPubkey());
-        const { ensureSodium: ensureSodium3 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
-        const sodium4 = await ensureSodium3();
-        const ciphertextB64 = sodium4.to_base64(ciphertext, sodium4.base64_variants.ORIGINAL);
-        const ok = await client.vaultSet(key, ciphertextB64, nonce, sealedKey, entryType, mount_path, description);
-        if (!ok)
-          return text("vault_set: broker did not acknowledge", true);
-        return text(`Vault entry "${key}" stored (${entryType}, E2E encrypted).`);
-      }
-      case "vault_list": {
-        const client = allClients()[0];
-        if (!client)
-          return text("vault_list: not connected", true);
-        const entries = await client.vaultList();
-        if (entries.length === 0)
-          return text("Vault is empty.");
-        const lines = entries.map((e) => `- **${e.key}** (${e.entry_type}${e.mount_path ? ` → ${e.mount_path}` : ""})${e.description ? ` — ${e.description}` : ""} (${e.updated_at})`);
-        return text(`${entries.length} vault entry(s):
-${lines.join(`
-`)}`);
-      }
-      case "vault_delete": {
-        const { key } = args ?? {};
-        if (!key)
-          return text("vault_delete: `key` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("vault_delete: not connected", true);
-        const ok = await client.vaultDelete(key);
-        return text(ok ? `Vault entry "${key}" deleted.` : `Vault entry "${key}" not found.`);
-      }
-      case "mesh_mcp_deploy": {
-        const { server_name, file_id, git_url, git_branch, npx_package, env: deployEnv, runtime, memory_mb, network_allow, scope } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_deploy: `server_name` required", true);
-        if (!file_id && !git_url && !npx_package)
-          return text("mesh_mcp_deploy: one of `file_id`, `git_url`, or `npx_package` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_deploy: not connected", true);
-        const source = npx_package ? { type: "npx", package: npx_package } : file_id ? { type: "zip", file_id } : { type: "git", url: git_url, branch: git_branch };
-        const resolvedEnv = {};
-        const vaultResolved = [];
-        if (deployEnv) {
-          const vaultRefs = [];
-          for (const [envKey, envVal] of Object.entries(deployEnv)) {
-            if (typeof envVal === "string" && envVal.startsWith("$vault:")) {
-              const parts = envVal.slice(7).split(":");
-              const vaultKey = parts[0];
-              const isFile = parts[1] === "file";
-              const mountPath = isFile ? parts.slice(2).join(":") : undefined;
-              vaultRefs.push({ envKey, vaultKey, isFile, mountPath });
-            } else {
-              resolvedEnv[envKey] = envVal;
-            }
-          }
-          if (vaultRefs.length > 0) {
-            const { openSealedKey: openSealedKey2, decryptFile: decryptFile2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-            const { ensureSodium: ensureSodium3 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
-            const sodium4 = await ensureSodium3();
-            const keys = vaultRefs.map((r) => r.vaultKey);
-            const encryptedEntries = await client.vaultGet(keys);
-            for (const ref of vaultRefs) {
-              const entry = encryptedEntries.find((e) => e.key === ref.vaultKey);
-              if (!entry)
-                return text(`mesh_mcp_deploy: a referenced vault key was not found. Use vault_set first.`, true);
-              const kf = await openSealedKey2(entry.sealed_key, client.getMeshPubkey(), client.getMeshSecretKey());
-              if (!kf)
-                return text(`mesh_mcp_deploy: failed to decrypt a vault entry — wrong keypair?`, true);
-              const ciphertextBytes = sodium4.from_base64(entry.ciphertext, sodium4.base64_variants.ORIGINAL);
-              const plainBytes = await decryptFile2(ciphertextBytes, entry.nonce, kf);
-              if (!plainBytes)
-                return text(`mesh_mcp_deploy: failed to decrypt a vault entry — data may be corrupted`, true);
-              if (ref.isFile && ref.mountPath) {
-                resolvedEnv[ref.envKey] = `__vault_file__:${ref.mountPath}:${sodium4.to_base64(plainBytes, sodium4.base64_variants.ORIGINAL)}`;
-              } else {
-                resolvedEnv[ref.envKey] = new TextDecoder().decode(plainBytes);
-              }
-              vaultResolved.push(ref.vaultKey);
-            }
-          }
-        }
-        const config2 = {};
-        if (Object.keys(resolvedEnv).length > 0 || deployEnv && Object.keys(deployEnv).length > 0) {
-          config2.env = Object.keys(resolvedEnv).length > 0 ? resolvedEnv : deployEnv;
-        }
-        if (runtime)
-          config2.runtime = runtime;
-        if (memory_mb)
-          config2.memory_mb = memory_mb;
-        if (network_allow)
-          config2.network_allow = network_allow;
-        const result = await client.mcpDeploy(server_name, source, Object.keys(config2).length > 0 ? config2 : undefined, scope);
-        const toolList = result.tools?.map((t) => `  - ${t.name}: ${t.description}`).join(`
-`) ?? "  (pending)";
-        let vaultNote = "";
-        if (vaultResolved.length > 0) {
-          vaultNote = `
-
-Vault keys resolved: ${vaultResolved.join(", ")} (decrypted client-side, sent over TLS)`;
-        }
-        return text(`Deployed "${server_name}" (status: ${result.status}).
-
-Tools:
-${toolList}
-
-Default scope: peer (private). Use mesh_mcp_scope to share.${vaultNote}`);
-      }
-      case "mesh_mcp_undeploy": {
-        const { server_name } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_undeploy: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_undeploy: not connected", true);
-        const ok = await client.mcpUndeploy(server_name);
-        return text(ok ? `Service "${server_name}" undeployed.` : `Failed to undeploy "${server_name}".`);
-      }
-      case "mesh_mcp_update": {
-        const { server_name } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_update: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_update: not connected", true);
-        const result = await client.mcpUpdate(server_name);
-        return text(`Updated "${server_name}" (status: ${result.status}).`);
-      }
-      case "mesh_mcp_logs": {
-        const { server_name, lines: logLines } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_logs: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_logs: not connected", true);
-        const logs = await client.mcpLogs(server_name, logLines);
-        if (logs.length === 0)
-          return text(`No logs for "${server_name}".`);
-        return text(`Logs for "${server_name}" (${logs.length} lines):
-\`\`\`
-${logs.join(`
-`)}
-\`\`\``);
-      }
-      case "mesh_mcp_scope": {
-        const { server_name, scope } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_scope: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_scope: not connected", true);
-        const result = await client.mcpScope(server_name, scope);
-        if (scope !== undefined) {
-          return text(`Scope for "${server_name}" updated to: ${JSON.stringify(result.scope)}`);
-        }
-        return text(`**${server_name}** scope: ${JSON.stringify(result.scope)}
-Deployed by: ${result.deployed_by}`);
-      }
-      case "mesh_mcp_schema": {
-        const { server_name, tool_name } = args ?? {};
-        if (!server_name)
-          return text("mesh_mcp_schema: `server_name` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_schema: not connected", true);
-        const tools = await client.mcpServiceSchema(server_name, tool_name);
-        if (tools.length === 0)
-          return text(`No tools found for "${server_name}"${tool_name ? ` (tool: ${tool_name})` : ""}.`);
-        const lines = tools.map((t) => `### ${t.name}
-${t.description}
-\`\`\`json
-${JSON.stringify(t.inputSchema, null, 2)}
-\`\`\``);
-        return text(`Tools for "${server_name}":
-
-${lines.join(`
-
-`)}`);
-      }
-      case "mesh_mcp_catalog": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_mcp_catalog: not connected", true);
-        const services = await client.mcpCatalog();
-        if (services.length === 0)
-          return text("No services deployed in the mesh.");
-        const lines = services.map((s) => {
-          const scopeStr = typeof s.scope === "string" ? s.scope : JSON.stringify(s.scope);
-          return `- **${s.name}** (${s.type}, ${s.status}) — ${s.description}
-  ${s.tool_count} tools | scope: ${scopeStr} | by ${s.deployed_by} | ${s.source_type}${s.runtime ? ` (${s.runtime})` : ""}`;
-        });
-        return text(`${services.length} service(s) in mesh:
-
-${lines.join(`
-`)}`);
-      }
-      case "mesh_skill_deploy": {
-        const { file_id, git_url, git_branch } = args ?? {};
-        if (!file_id && !git_url)
-          return text("mesh_skill_deploy: either `file_id` or `git_url` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_skill_deploy: not connected", true);
-        const source = file_id ? { type: "zip", file_id } : { type: "git", url: git_url, branch: git_branch };
-        const result = await client.skillDeploy(source);
-        return text(`Skill "${result.name}" deployed.
-Files: ${result.files.join(", ")}`);
-      }
-      case "mesh_watch": {
-        const { url, mode, extract, interval, notify_on, headers, label } = args ?? {};
-        if (!url)
-          return text("mesh_watch: `url` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_watch: not connected", true);
-        const result = await client.watch(url, { mode, extract, interval, notify_on, headers, label });
-        if (result.error)
-          return text(`mesh_watch: ${result.error}`, true);
-        return text(`Watching "${label ?? url}" (${result.mode}, every ${result.interval}s)
-Watch ID: ${result.watchId}`);
-      }
-      case "mesh_unwatch": {
-        const { watch_id } = args ?? {};
-        if (!watch_id)
-          return text("mesh_unwatch: `watch_id` required", true);
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_unwatch: not connected", true);
-        await client.unwatch(watch_id);
-        return text(`Watch ${watch_id} stopped.`);
-      }
-      case "mesh_watches": {
-        const client = allClients()[0];
-        if (!client)
-          return text("mesh_watches: not connected", true);
-        const watches = await client.watchList();
-        if (watches.length === 0)
-          return text("No active watches.");
-        const lines = watches.map((w) => `- **${w.id}** ${w.label ? `(${w.label}) ` : ""}${w.url}
-  mode: ${w.mode} | interval: ${w.interval}s | last: ${w.lastValue?.slice(0, 30) ?? "pending"} | checked: ${w.lastCheck ?? "never"}`);
-        return text(`${watches.length} active watch(es):
-
-${lines.join(`
-`)}`);
-      }
-      default:
-        return text(`Unknown tool: ${name}`, true);
-    }
-  });
   const transport = new StdioServerTransport;
   await server.connect(transport);
   const bridges = [];
@@ -13744,41 +11184,13 @@ async function startServiceProxy(serviceName) {
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
 }
-var peerNameCache, peerNameCacheAge = 0, CACHE_TTL_MS = 30000, DEPRECATED_TOOL_HINTS, warnedTools;
+var peerNameCache, peerNameCacheAge = 0, CACHE_TTL_MS = 30000;
 var init_server2 = __esm(() => {
   init_definitions();
   init_facade();
   init_facade8();
   init_server();
   peerNameCache = new Map;
-  DEPRECATED_TOOL_HINTS = {
-    send_message: "claudemesh send <to> <msg> [--mesh X] [--priority Y]",
-    list_peers: "claudemesh peers --json",
-    check_messages: "claudemesh inbox --json",
-    message_status: "claudemesh msg-status <id>",
-    set_profile: "claudemesh profile --avatar X --bio Y",
-    set_status: "claudemesh status set <state>",
-    set_summary: "claudemesh summary <text>",
-    set_visible: "claudemesh visible <true|false>",
-    join_group: "claudemesh group join @<name> [--role X]",
-    leave_group: "claudemesh group leave @<name>",
-    get_state: "claudemesh state get <key> --json",
-    set_state: "claudemesh state set <key> <value>",
-    list_state: "claudemesh state list --json",
-    remember: "claudemesh remember <text>",
-    recall: "claudemesh recall <query> --json",
-    forget: "claudemesh forget <id>",
-    schedule_reminder: "claudemesh remind <msg> --in/--at/--cron",
-    list_scheduled: "claudemesh remind list --json",
-    cancel_scheduled: "claudemesh remind cancel <id>",
-    mesh_info: "claudemesh info --json",
-    mesh_stats: "claudemesh stats --json",
-    mesh_clock: "claudemesh clock --json",
-    ping_mesh: "claudemesh ping",
-    claim_task: "claudemesh task claim <id>",
-    complete_task: "claudemesh task complete <id>"
-  };
-  warnedTools = new Set;
 });
 
 // src/commands/mcp.ts
@@ -14039,11 +11451,425 @@ init_styles();
 function renderVersion() {
   return "  " + boldOrange("claudemesh") + " v" + VERSION;
 }
+// src/cli/policy-classify.ts
+var SKIP = new Set([
+  "",
+  "help",
+  "version",
+  "login",
+  "register",
+  "logout",
+  "whoami",
+  "install",
+  "uninstall",
+  "doctor",
+  "sync",
+  "completions",
+  "url-handler",
+  "status-line",
+  "backup",
+  "restore",
+  "upgrade",
+  "update",
+  "list",
+  "ls",
+  "launch",
+  "connect",
+  "status",
+  "test",
+  "mcp",
+  "hook",
+  "seed-test-mesh",
+  "disconnect"
+]);
+var WRITE_VERBS = new Set([
+  "create",
+  "send",
+  "remember",
+  "forget",
+  "remind",
+  "schedule",
+  "summary",
+  "visible",
+  "join",
+  "leave",
+  "kick",
+  "ban",
+  "unban",
+  "disconnect",
+  "delete",
+  "rename",
+  "share",
+  "invite",
+  "store",
+  "publish",
+  "execute",
+  "set",
+  "remove",
+  "pause",
+  "resume",
+  "claim",
+  "complete",
+  "grant",
+  "revoke",
+  "block",
+  "call"
+]);
+function isWrite(verb) {
+  return WRITE_VERBS.has(verb);
+}
+function classifyInvocation(command, positionals) {
+  if (SKIP.has(command))
+    return null;
+  const sub = positionals[0] ?? "";
+  switch (command) {
+    case "peer": {
+      const verb = sub || "list";
+      return { resource: "peer", verb, isWrite: isWrite(verb) };
+    }
+    case "message": {
+      const verb = sub || "inbox";
+      return { resource: "message", verb, isWrite: isWrite(verb) };
+    }
+    case "memory": {
+      const verb = sub || "recall";
+      return { resource: "memory", verb, isWrite: isWrite(verb) };
+    }
+    case "profile": {
+      if (!sub)
+        return { resource: "profile", verb: "view", isWrite: false };
+      if (sub === "status") {
+        return positionals[1] === "set" ? { resource: "profile", verb: "status", isWrite: true } : { resource: "profile", verb: "view", isWrite: false };
+      }
+      return { resource: "profile", verb: sub, isWrite: true };
+    }
+    case "schedule": {
+      const verb = sub || "list";
+      return { resource: "schedule", verb, isWrite: verb !== "list" };
+    }
+    case "group": {
+      return { resource: "group", verb: sub || "list", isWrite: sub === "join" || sub === "leave" };
+    }
+    case "task": {
+      return { resource: "task", verb: sub || "list", isWrite: isWrite(sub) };
+    }
+    case "vector":
+    case "graph":
+    case "context":
+    case "stream":
+    case "sql":
+    case "skill":
+    case "vault":
+    case "watch":
+    case "webhook":
+    case "file":
+    case "mesh-mcp":
+    case "clock": {
+      const verb = sub || "list";
+      return { resource: command, verb, isWrite: isWrite(verb) };
+    }
+    case "state": {
+      const verb = sub === "set" ? "set" : sub === "list" ? "list" : "get";
+      return { resource: "state", verb, isWrite: verb === "set" };
+    }
+  }
+  switch (command) {
+    case "create":
+    case "new":
+      return { resource: "mesh", verb: "create", isWrite: true };
+    case "join":
+    case "add":
+      return { resource: "mesh", verb: "join", isWrite: true };
+    case "delete":
+    case "rm":
+      return { resource: "mesh", verb: "delete", isWrite: true };
+    case "rename":
+      return { resource: "mesh", verb: "rename", isWrite: true };
+    case "share":
+    case "invite":
+      return { resource: "mesh", verb: "share", isWrite: true };
+    case "info":
+      return { resource: "mesh", verb: "info", isWrite: false };
+    case "peers":
+      return { resource: "peer", verb: "list", isWrite: false };
+    case "kick":
+      return { resource: "peer", verb: "kick", isWrite: true };
+    case "ban":
+      return { resource: "peer", verb: "ban", isWrite: true };
+    case "unban":
+      return { resource: "peer", verb: "unban", isWrite: true };
+    case "bans":
+      return { resource: "peer", verb: "bans", isWrite: false };
+    case "verify":
+      return { resource: "peer", verb: "verify", isWrite: false };
+    case "send":
+      return { resource: "message", verb: "send", isWrite: true };
+    case "inbox":
+      return { resource: "message", verb: "inbox", isWrite: false };
+    case "msg-status":
+      return { resource: "message", verb: "status", isWrite: false };
+    case "remember":
+      return { resource: "memory", verb: "remember", isWrite: true };
+    case "recall":
+      return { resource: "memory", verb: "recall", isWrite: false };
+    case "forget":
+      return { resource: "memory", verb: "forget", isWrite: true };
+    case "remind":
+      return { resource: "schedule", verb: "msg", isWrite: true };
+    case "summary":
+      return { resource: "profile", verb: "summary", isWrite: true };
+    case "visible":
+      return { resource: "profile", verb: "visible", isWrite: true };
+    case "stats":
+      return { resource: "mesh", verb: "stats", isWrite: false };
+    case "ping":
+      return { resource: "mesh", verb: "ping", isWrite: false };
+    case "grant":
+      return { resource: "grant", verb: "grant", isWrite: true };
+    case "revoke":
+      return { resource: "grant", verb: "revoke", isWrite: true };
+    case "block":
+      return { resource: "grant", verb: "block", isWrite: true };
+    case "grants":
+      return { resource: "grant", verb: "list", isWrite: false };
+  }
+  return null;
+}
+
+// src/services/policy/index.ts
+import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { createInterface } from "node:readline";
+var DEFAULT_POLICY = {
+  default: "allow",
+  rules: [
+    { resource: "peer", verb: "kick", decision: "prompt", reason: "ends a peer's session" },
+    { resource: "peer", verb: "ban", decision: "prompt", reason: "permanently revokes membership" },
+    { resource: "peer", verb: "disconnect", decision: "prompt", reason: "disconnects a peer" },
+    { resource: "file", verb: "delete", decision: "prompt", reason: "deletes a shared file" },
+    { resource: "vector", verb: "delete", decision: "prompt", reason: "removes vector entries" },
+    { resource: "vault", verb: "delete", decision: "prompt", reason: "deletes encrypted secret" },
+    { resource: "memory", verb: "forget", decision: "prompt", reason: "removes shared memory" },
+    { resource: "skill", verb: "remove", decision: "prompt", reason: "removes published skill" },
+    { resource: "webhook", verb: "delete", decision: "prompt", reason: "removes webhook integration" },
+    { resource: "watch", verb: "remove", decision: "prompt", reason: "removes URL watcher" },
+    { resource: "sql", verb: "execute", decision: "prompt", reason: "raw SQL write to mesh DB" },
+    { resource: "graph", verb: "execute", decision: "prompt", reason: "graph mutation" },
+    { resource: "mesh", verb: "delete", decision: "prompt", reason: "deletes the mesh for everyone" }
+  ]
+};
+var USER_POLICY_PATH = join(homedir(), ".claudemesh", "policy.yaml");
+var AUDIT_LOG_PATH = join(homedir(), ".claudemesh", "audit.log");
+function parsePolicyYaml(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{")) {
+    return JSON.parse(trimmed);
+  }
+  const policy = { default: "allow", rules: [] };
+  const lines = text.split(`
+`);
+  let cur = null;
+  const flush = () => {
+    if (cur && cur.resource && cur.verb && cur.decision) {
+      policy.rules.push(cur);
+    }
+    cur = null;
+  };
+  for (const raw of lines) {
+    const line = raw.replace(/#.*$/, "").trimEnd();
+    if (!line.trim())
+      continue;
+    const top = line.match(/^(default):\s*(\S+)/);
+    if (top) {
+      policy.default = top[2];
+      continue;
+    }
+    if (/^rules\s*:/.test(line))
+      continue;
+    if (/^\s*-\s/.test(line)) {
+      flush();
+      cur = {};
+      const m = line.match(/-\s*(\w+)\s*:\s*(.*)$/);
+      if (m)
+        cur[m[1]] = parseValue(m[2]);
+      continue;
+    }
+    const kv = line.match(/^\s+(\w+)\s*:\s*(.*)$/);
+    if (kv && cur) {
+      cur[kv[1]] = parseValue(kv[2]);
+    }
+  }
+  flush();
+  return policy;
+}
+function parseValue(raw) {
+  const v = raw.trim();
+  if (!v)
+    return "";
+  if (v.startsWith("[") && v.endsWith("]")) {
+    return v.slice(1, -1).split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+  }
+  const q = v.match(/^["'](.*)["']$/);
+  if (q)
+    return q[1];
+  if (v === "true")
+    return true;
+  if (v === "false")
+    return false;
+  if (/^-?\d+(\.\d+)?$/.test(v))
+    return Number(v);
+  return v;
+}
+function serializePolicyYaml(p) {
+  let out = `# claudemesh policy file
+`;
+  out += `# Edit to change which CLI ops require confirmation or are forbidden.
+`;
+  out += `# Decisions: allow | prompt | deny
+`;
+  out += `# See: ~/.claude/skills/claudemesh/SKILL.md or claudemesh policy --help
+
+`;
+  out += `default: ${p.default}
+
+`;
+  out += `rules:
+`;
+  for (const r of p.rules) {
+    out += `  - resource: ${r.resource}
+`;
+    out += `    verb: ${r.verb}
+`;
+    if (r.mesh)
+      out += `    mesh: ${r.mesh}
+`;
+    if (r.peers)
+      out += `    peers: [${r.peers.map((p2) => `"${p2}"`).join(", ")}]
+`;
+    out += `    decision: ${r.decision}
+`;
+    if (r.reason)
+      out += `    reason: "${r.reason}"
+`;
+  }
+  return out;
+}
+function loadPolicy(opts) {
+  const path = opts?.policyPath ?? opts?.envOverride ?? process.env.CLAUDEMESH_POLICY ?? USER_POLICY_PATH;
+  if (!existsSync(path)) {
+    if (path === USER_POLICY_PATH) {
+      try {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, serializePolicyYaml(DEFAULT_POLICY), "utf-8");
+      } catch {}
+    }
+    return DEFAULT_POLICY;
+  }
+  try {
+    return parsePolicyYaml(readFileSync(path, "utf-8"));
+  } catch (e) {
+    process.stderr.write(`[claudemesh] policy: failed to parse ${path}: ${e instanceof Error ? e.message : String(e)}
+`);
+    return DEFAULT_POLICY;
+  }
+}
+function matches(rule, value) {
+  if (rule === "*")
+    return true;
+  return rule === value;
+}
+function evaluate(policy, ctx) {
+  if (ctx.mode === "yolo")
+    return { decision: "allow", reason: "yolo mode" };
+  if ((ctx.mode === "plan" || ctx.mode === "read-only") && ctx.isWrite) {
+    return { decision: "deny", reason: `${ctx.mode} mode forbids writes` };
+  }
+  for (const r of policy.rules) {
+    if (!matches(r.resource, ctx.resource))
+      continue;
+    if (!matches(r.verb, ctx.verb))
+      continue;
+    if (r.mesh && ctx.mesh && r.mesh !== ctx.mesh)
+      continue;
+    return { decision: r.decision, reason: r.reason, matchedRule: r };
+  }
+  return { decision: policy.default };
+}
+function audit(record) {
+  try {
+    mkdirSync(dirname(AUDIT_LOG_PATH), { recursive: true });
+    appendFileSync(AUDIT_LOG_PATH, JSON.stringify({ ts: new Date().toISOString(), ...record }) + `
+`, "utf-8");
+  } catch {}
+}
+async function confirmPrompt(message) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return false;
+  }
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(`${message} [y/N] `, (answer) => {
+      rl.close();
+      const a = answer.trim().toLowerCase();
+      resolve(a === "y" || a === "yes");
+    });
+  });
+}
+async function gate(ctx, opts) {
+  const policy = loadPolicy(opts);
+  const result = evaluate(policy, ctx);
+  audit({ ...ctx, decision: result.decision, reason: result.reason });
+  if (result.decision === "allow")
+    return true;
+  if (result.decision === "deny") {
+    process.stderr.write(`
+  ✘ blocked by policy: ${ctx.resource} ${ctx.verb}` + (result.reason ? ` — ${result.reason}` : "") + `
+  edit ${USER_POLICY_PATH} to change.
+`);
+    return false;
+  }
+  if (ctx.yes)
+    return true;
+  const reason = result.reason ? ` — ${result.reason}` : "";
+  const confirmed = await confirmPrompt(`
+  ⚠ ${ctx.resource} ${ctx.verb}${reason}. Continue?`);
+  if (!confirmed) {
+    process.stderr.write(`  cancelled.
+`);
+    audit({ ...ctx, decision: "cancelled-at-prompt" });
+  }
+  return confirmed;
+}
 
 // src/entrypoints/cli.ts
 installSignalHandlers();
 installErrorHandlers();
 var { command, positionals, flags } = parseArgv(process.argv);
+function resolveApprovalMode() {
+  const raw = flags["approval-mode"] ?? process.env.CLAUDEMESH_APPROVAL_MODE ?? null;
+  if (raw === "plan" || raw === "read-only" || raw === "write" || raw === "yolo")
+    return raw;
+  if (flags.y || flags.yes)
+    return "yolo";
+  return "write";
+}
+async function policyGate() {
+  const cls = classifyInvocation(command, positionals);
+  if (!cls)
+    return true;
+  const mode = resolveApprovalMode();
+  const yes = !!flags.y || !!flags.yes || mode === "yolo";
+  const ok = await gate({
+    resource: cls.resource,
+    verb: cls.verb,
+    mesh: flags.mesh,
+    mode,
+    isWrite: cls.isWrite,
+    yes
+  }, { policyPath: flags.policy });
+  return ok;
+}
 var HELP = `
 claudemesh — peer mesh for Claude Code sessions
 ${VERSION}
@@ -14150,7 +11976,9 @@ Flags
   --help, -h                       show this help
   --json                           machine-readable output
   --mesh <slug>                    override mesh selection
-  -y, --yes                        skip confirmations
+  --approval-mode <mode>           plan | read-only | write (default) | yolo
+  --policy <path>                  override policy file
+  -y, --yes                        skip confirmations (= --approval-mode yolo)
   -q, --quiet                      suppress non-essential output
 `;
 async function main() {
@@ -14162,6 +11990,8 @@ async function main() {
     console.log(renderVersion());
     process.exit(EXIT.SUCCESS);
   }
+  if (!await policyGate())
+    process.exit(EXIT.PERMISSION_DENIED);
   if (!command || isInviteUrl(command)) {
     if (command && isInviteUrl(command)) {
       const { runLaunch: runLaunch3 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
@@ -14836,4 +12666,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=4E4265490A3D56F164756E2164756E21
+//# debugId=C75596237B999F1364756E2164756E21