infinicode 2.0.0 → 2.2.0

package/README.md

@@ -90,6 +90,48 @@ infinicode mission status <id>
 infinicode mission list
 ```
 
+### As a device mesh (multi-device, new in v2)
+
+Install infinicode on every machine — laptop, workstation, Raspberry&nbsp;Pi — and they become one fleet. Spawn AI agents on any device from any device (no SSH), stream activity/hardware back, and drive it all from an MCP host like Claude Code or InfiniBot.
+
+```bash
+# install on each device
+npm install -g infinicode
+
+# same LAN — zero config: each node broadcasts a UDP beacon and auto-connects
+infinicode serve --hub --lan                         # your main machine
+infinicode serve --role satellite --lan              # a Pi / other box
+
+# across LAN + remote — auto-discover over Tailscale
+infinicode serve --hub --tailscale
+infinicode serve --role satellite --tailscale --tag tag:robopark
+
+# or point at exact peers
+infinicode serve --role satellite --seed http://192.168.1.20:47913
+
+# verify the mesh — ask any running node for its peers (self + connected)
+curl http://localhost:47913/fed/nodes
+```
+
+Set your cloud provider keys + policy **once on the hub**; every satellite auto-sources them (over `--seed`/`--lan`/`--tailscale`) and registers the providers + models live, no restart.
+
+Drive the fleet from an MCP host — register the control server (spawn / dispatch / follow / role / voice / mesh-map tools):
+
+```jsonc
+// ~/.claude.json
+{ "mcpServers": { "infinicode": { "command": "infinicode", "args": ["mcp", "--lan"] } } }
+```
+
+Link a node onto an **InfiniBot** neural-mesh map (no InfiniBot changes needed):
+
+```bash
+infinicode serve --hub --gateway ws://<infinibot-host>:18789 --gateway-token <token>
+```
+
+Discovery options: `--lan` (same subnet, zero-config UDP broadcast, port 47915), `--tailscale` (LAN+remote), `--seed <url>` (exact) — they combine. Full guide: `docs/user-manual.html`; design deep-dive: `docs/federation-architecture.html`.
+
+> The Windows TUI binaries are not shipped in the npm package (they're large and platform-specific), so `infinicode run` needs a local TUI build; the mesh commands (`serve`, `mcp`, `mission`, `console`) run everywhere as pure Node.
+
 ### As a library
 
 ```ts

package/dist/cli.js

@@ -15,7 +15,7 @@ import { consoleRepl, consoleRun } from './commands/console.js';
 import { serve } from './commands/serve.js';
 import { mcpCommand } from './commands/mcp.js';
 import { DEFAULT_CONFIG } from './kernel/config-schema.js';
-const VERSION = '2.0.0';
+const VERSION = '2.2.0';
 const config = new Conf({
     projectName: 'infinicode',
     defaults: DEFAULT_CONFIG,
@@ -287,7 +287,9 @@ program
     .option('--seed <url...>', 'peer base URL(s) to connect to on start')
     .option('--auto-update', 'accept auto-updates announced by a hub/relay')
     .option('--tailscale', 'auto-discover + connect peers over Tailscale')
-    .option('--tag <tag>', 'only discover peers carrying this Tailscale ACL tag')
+    .option('--lan', 'auto-discover + connect peers on the same LAN via UDP broadcast (no seed/Tailscale needed)')
+    .option('--lan-port <port>', 'UDP discovery port for --lan (default 47915)')
+    .option('--tag <tag>', 'only discover peers carrying this tag (Tailscale ACL tag or LAN beacon tag)')
     .option('--gateway <url>', 'link to an InfiniBot gateway (ws://host:18789) — appear on its neural-mesh map')
     .option('--gateway-token <token>', 'auth token for the InfiniBot gateway')
     .option('--gateway-password <password>', 'auth password for the InfiniBot gateway')
@@ -304,7 +306,9 @@ program
     .option('--token <token>', 'shared bearer token peers must present')
     .option('--seed <url...>', 'peer base URL(s) to connect to on start')
     .option('--tailscale', 'auto-discover + connect peers over Tailscale')
-    .option('--tag <tag>', 'only discover peers carrying this Tailscale ACL tag')
+    .option('--lan', 'auto-discover + connect peers on the same LAN via UDP broadcast (no seed/Tailscale needed)')
+    .option('--lan-port <port>', 'UDP discovery port for --lan (default 47915)')
+    .option('--tag <tag>', 'only discover peers carrying this tag (Tailscale ACL tag or LAN beacon tag)')
     .action(async (opts) => {
     await mcpCommand(config, opts);
 });

package/dist/commands/mcp.d.ts

@@ -8,5 +8,7 @@ export interface McpOptions {
     seed?: string[];
     tailscale?: boolean;
     tag?: string;
+    lan?: boolean;
+    lanPort?: string;
 }
 export declare function mcpCommand(config: Conf<InfinicodeConfig>, opts: McpOptions): Promise<void>;

package/dist/commands/mcp.js

@@ -12,7 +12,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { buildKernelFromConfig } from '../kernel/setup.js';
+import { buildKernelFromConfig, registerCloudProviders } from '../kernel/setup.js';
 import { Federation, GoalLoop, loadOrCreateIdentity, serveMcpStdio, SilentLogger, } from '../kernel/index.js';
 function pkgVersion() {
     try {
@@ -51,21 +51,39 @@ export async function mcpCommand(config, opts) {
         };
     };
     const applyConfig = (cfg) => {
-        if (cfg.cloudProviders)
-            config.set('cloudProviders', cfg.cloudProviders);
-        if (cfg.policy)
+        let live = 0;
+        if (cfg.cloudProviders) {
+            const providers = cfg.cloudProviders;
+            config.set('cloudProviders', providers);
+            live = registerCloudProviders(kernel, providers); // live → models available now
+        }
+        if (cfg.policy) {
             config.set('policy', cfg.policy);
+            kernel.setDefaultPolicy(cfg.policy);
+        }
         if (cfg.defaultModel)
             config.set('defaultModel', cfg.defaultModel);
-        stderrLogger.info(`applied shared config (rev ${cfg.revision})`);
+        stderrLogger.info(`sourced shared config from hub (rev ${cfg.revision}) — ${live} provider(s) live`);
     };
     const federation = new Federation({
         kernel,
         identity,
         describe,
         logger: stderrLogger,
-        options: { version, port, token, autoUpdate: fed.autoUpdate, applyConfig },
+        options: { version, port, token, autoUpdate: fed.autoUpdate, applyConfig, autoPullConfig: role === 'satellite' },
     });
+    // Hub/peer/relay: publish local providers + policy for satellites to source.
+    const sharedFromConf = () => ({
+        cloudProviders: config.get('cloudProviders'),
+        policy: config.get('policy'),
+        defaultModel: config.get('defaultModel'),
+    });
+    if (role !== 'satellite') {
+        federation.publishConfig(sharedFromConf());
+        for (const key of ['cloudProviders', 'policy', 'defaultModel']) {
+            config.onDidChange(key, () => federation.publishConfig(sharedFromConf()));
+        }
+    }
     try {
         await federation.start();
     }
@@ -81,6 +99,10 @@ export async function mcpCommand(config, opts) {
         const n = await federation.discoverAndConnect(opts.tag).catch(() => 0);
         stderrLogger.info(`tailscale discovery connected ${n} peer(s)`);
     }
+    if (opts.lan ?? fed.lan) {
+        federation.startLanDiscovery(opts.tag, opts.lanPort ? parseInt(opts.lanPort, 10) : fed.lanPort);
+        stderrLogger.info('LAN auto-discovery on (udp broadcast)');
+    }
     // Proactive autonomy: a goal loop the MCP host can populate (add_goal/…).
     const autonomy = new GoalLoop({ kernel, logger: stderrLogger });
     autonomy.start();

package/dist/commands/serve.d.ts

@@ -11,6 +11,8 @@ export interface ServeOptions {
     hub?: boolean;
     tailscale?: boolean;
     tag?: string;
+    lan?: boolean;
+    lanPort?: string;
     gateway?: string;
     gatewayToken?: string;
     gatewayPassword?: string;

package/dist/commands/serve.js

@@ -13,7 +13,7 @@ import chalk from 'chalk';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { buildKernelFromConfig } from '../kernel/setup.js';
+import { buildKernelFromConfig, registerCloudProviders } from '../kernel/setup.js';
 import { Federation, MoltfedConnector, loadOrCreateIdentity } from '../kernel/index.js';
 function pkgVersion() {
     try {
@@ -44,15 +44,22 @@ export async function serve(config, opts) {
             providers: kernel.providerManager.listInfos().map(p => p.id),
         };
     };
-    // Satellite: persist shared config locally so providers/keys survive a restart.
+    // Satellite: persist shared config AND hot-apply it to the running kernel so
+    // the hub's providers + their models are available immediately (no restart).
     const applyConfig = (cfg) => {
-        if (cfg.cloudProviders)
-            config.set('cloudProviders', cfg.cloudProviders);
-        if (cfg.policy)
+        let live = 0;
+        if (cfg.cloudProviders) {
+            const providers = cfg.cloudProviders;
+            config.set('cloudProviders', providers);
+            live = registerCloudProviders(kernel, providers); // live registration → models appear now
+        }
+        if (cfg.policy) {
             config.set('policy', cfg.policy);
+            kernel.setDefaultPolicy(cfg.policy);
+        }
         if (cfg.defaultModel)
             config.set('defaultModel', cfg.defaultModel);
-        console.log(chalk.green(`  ✓ applied shared config (rev ${cfg.revision}) — restart to load new providers`));
+        console.log(chalk.green(`  ✓ sourced shared config from hub (rev ${cfg.revision}) — ${live} provider(s) live`));
     };
     const federation = new Federation({
         kernel,
@@ -67,8 +74,22 @@ export async function serve(config, opts) {
             heartbeatMs: (fed.heartbeatSec ?? 30) * 1000,
             autoUpdate: opts.autoUpdate ?? fed.autoUpdate,
             applyConfig,
+            autoPullConfig: role === 'satellite',
         },
     });
+    // Hub/peer/relay: publish this machine's providers + policy so satellites can
+    // auto-source them. Re-publish when the local config changes (live).
+    const sharedFromConf = () => ({
+        cloudProviders: config.get('cloudProviders'),
+        policy: config.get('policy'),
+        defaultModel: config.get('defaultModel'),
+    });
+    if (role !== 'satellite') {
+        federation.publishConfig(sharedFromConf());
+        for (const key of ['cloudProviders', 'policy', 'defaultModel']) {
+            config.onDidChange(key, () => federation.publishConfig(sharedFromConf()));
+        }
+    }
     console.log(chalk.bold(`\n  infinicode mesh node`));
     console.log(chalk.dim('  ' + '-'.repeat(46)));
     console.log(`  node:   ${chalk.cyan(identity.displayName)} ${chalk.dim('(' + identity.nodeId + ')')}`);
@@ -78,23 +99,23 @@ export async function serve(config, opts) {
         console.log(`  auth:   ${chalk.green('token required')}`);
     console.log();
     await federation.start();
-    // Connect to seeds and, as a satellite, pull shared config from the first hub.
+    // Connect to seeds. Satellites auto-source shared config from any hub/relay
+    // they connect to (handled inside federation.connect()).
     for (const url of seeds) {
         const peer = await federation.connect(url);
-        if (peer) {
+        if (peer)
             console.log(chalk.green(`  ✓ connected to ${peer.displayName} @ ${url}`));
-            if (role === 'satellite') {
-                const applied = await federation.pullConfig(peer.nodeId).catch(() => false);
-                if (applied)
-                    console.log(chalk.green(`  ✓ pulled shared config from ${peer.displayName}`));
-            }
-        }
     }
     // Optional: auto-discover peers over Tailscale (no --seed needed).
     if (opts.tailscale) {
         const n = await federation.discoverAndConnect(opts.tag).catch(() => 0);
         console.log(chalk.green(`  ✓ tailscale discovery connected ${n} peer(s)`));
     }
+    // Optional: zero-config LAN discovery — auto-connect peers on this subnet.
+    if (opts.lan ?? fed.lan) {
+        federation.startLanDiscovery(opts.tag, opts.lanPort ? parseInt(opts.lanPort, 10) : fed.lanPort);
+        console.log(chalk.green(`  ✓ LAN auto-discovery on (udp broadcast) — peers on this subnet connect automatically`));
+    }
     // Optional: log this node into an InfiniBot gateway so it renders live on the
     // neural-mesh map + hardware panels (no InfiniBot changes needed).
     let connector;

package/dist/kernel/config-schema.d.ts

@@ -37,6 +37,10 @@ export interface FederationConfig {
     heartbeatSec?: number;
     /** Accept + apply auto-updates announced by a hub/relay. */
     autoUpdate?: boolean;
+    /** Zero-config LAN discovery: broadcast + auto-connect peers on this subnet. */
+    lan?: boolean;
+    /** UDP discovery port for LAN discovery (default 47915). */
+    lanPort?: number;
 }
 export interface InfinicodeConfig {
     masterUrl: string;

package/dist/kernel/federation/federation.d.ts

@@ -11,7 +11,7 @@
  * (heartbeat / task.dispatch / command / config / update).
  */
 import type { Capability, KernelLike, Logger } from '../types.js';
-import type { HardwareSnapshot, NodeIdentity, NodeStatus, SharedConfig, StreamFrame } from './types.js';
+import type { HardwareSnapshot, NodeIdentity, NodeStatus, PeerInfo, SharedConfig, StreamFrame } from './types.js';
 import { ConfigSync } from './config-sync.js';
 import { AutoUpdate } from './auto-update.js';
 import { ComputeRouter, type ComputeNeed } from './compute-router.js';
@@ -36,6 +36,10 @@ export interface FederationOptions {
     autoUpdate?: boolean;
     /** Satellite: how to apply an incoming shared config (register providers etc.). */
     applyConfig?: (cfg: SharedConfig) => void | Promise<void>;
+    /** Satellite: auto-pull shared config from any hub/relay we connect to. */
+    autoPullConfig?: boolean;
+    /** Satellite: how often to re-pull shared config (ms, default 30000; 0 disables). */
+    configPullMs?: number;
 }
 export interface FederationDeps {
     kernel: KernelLike;
@@ -54,6 +58,10 @@ export declare class Federation {
     private telemetryTimer?;
     private lastHw?;
     private unsub?;
+    private lan?;
+    /** nodeIds we're currently dialing via LAN discovery (dedup guard). */
+    private lanConnecting;
+    private configPullTimer?;
     readonly configSync: ConfigSync;
     readonly autoUpdate: AutoUpdate;
     readonly compute: ComputeRouter;
@@ -106,12 +114,22 @@ export declare class Federation {
     publishConfig(cfg: Omit<SharedConfig, 'revision' | 'updatedAt'>): SharedConfig;
     /** Satellite: pull shared config from a peer (usually the hub). */
     pullConfig(nodeId: string): Promise<boolean>;
-    connect(url: string): Promise<import("./types.js").PeerInfo | null>;
+    connect(url: string): Promise<PeerInfo | null>;
+    /** Satellite: pull shared config from a freshly-connected hub/relay. */
+    private maybeAutoPull;
+    /** Satellite: re-pull from the first connected hub/relay (periodic refresh). */
+    private autoPullFromHub;
     /** Auto-discover peers over Tailscale and connect to each (skips self/known). */
     discoverAndConnect(tag?: string): Promise<number>;
+    /**
+     * Start zero-config LAN discovery: broadcast a beacon on the local subnet and
+     * auto-connect to any peer we hear (no --seed / Tailscale needed). Continuous —
+     * new nodes that come online later are picked up too. Idempotent.
+     */
+    startLanDiscovery(tag?: string, discoveryPort?: number): void;
     /** Neutral node-status list (self + peers) — feeds the mesh map. */
     nodeStatuses(): NodeStatus[];
-    peers(): import("./types.js").PeerInfo[];
+    peers(): PeerInfo[];
     /** Latest local hardware snapshot (for the MOLTFED connector / panels). */
     latestHardware(): HardwareSnapshot | undefined;
     /** Subscribe to the merged mesh frame stream (local + peer frames). */

package/dist/kernel/federation/federation.js

@@ -9,6 +9,7 @@ import { buildManifest } from './node-identity.js';
 import { envelope, reply, frame, newId } from './protocol.js';
 import { loadRole, saveRole, rolePreamble } from './role-context.js';
 import { discoverTailscalePeers } from './discovery.js';
+import { LanBeacon } from './lan-discovery.js';
 import { DEFAULT_MESH_PORT } from './types.js';
 export class Federation {
     deps;
@@ -20,6 +21,10 @@ export class Federation {
     telemetryTimer;
     lastHw;
     unsub;
+    lan;
+    /** nodeIds we're currently dialing via LAN discovery (dedup guard). */
+    lanConnecting = new Set();
+    configPullTimer;
     configSync;
     autoUpdate;
     compute = new ComputeRouter();
@@ -53,6 +58,7 @@ export class Federation {
             token: options.token,
             logger,
             getManifest: () => buildManifest(identity, this.deps.describe()),
+            getNodes: () => this.nodeStatuses(),
             onRpc: (env, remote) => this.onRpc(env, remote),
         });
         await this.server.start();
@@ -78,9 +84,14 @@ export class Federation {
             this.lastHw = this.telemetry.collect();
             this.server?.broadcast(frame('hw', identity.nodeId, this.lastHw));
         }, telMs);
-        // Connect to seed peers.
+        // Connect to seed peers (via this.connect so satellites auto-pull config).
         for (const url of options.seeds ?? [])
-            void this.mesh.connect(url);
+            void this.connect(url);
+        // Satellite: periodically re-pull shared config so hub changes (new
+        // providers/keys/policy) propagate without a reconnect.
+        if (options.autoPullConfig && options.configPullMs !== 0) {
+            this.configPullTimer = setInterval(() => void this.autoPullFromHub(), options.configPullMs ?? 30_000);
+        }
         logger.info(`[federation] node ${identity.displayName} (${identity.role}) online on :${port}`);
     }
     // ── Inbound RPC ────────────────────────────────────────────────────────────
@@ -271,7 +282,26 @@ export class Federation {
         return false;
     }
     async connect(url) {
-        return this.mesh?.connect(url) ?? null;
+        const peer = (await this.mesh?.connect(url)) ?? null;
+        if (peer)
+            await this.maybeAutoPull(peer);
+        return peer;
+    }
+    /** Satellite: pull shared config from a freshly-connected hub/relay. */
+    async maybeAutoPull(peer) {
+        if (!this.deps.options.autoPullConfig)
+            return;
+        if (peer.role !== 'hub' && peer.role !== 'relay')
+            return;
+        const applied = await this.pullConfig(peer.nodeId).catch(() => false);
+        if (applied)
+            this.deps.logger.info(`[federation] pulled shared config from ${peer.displayName}`);
+    }
+    /** Satellite: re-pull from the first connected hub/relay (periodic refresh). */
+    async autoPullFromHub() {
+        const hub = (this.mesh?.connected() ?? []).find(p => p.role === 'hub' || p.role === 'relay');
+        if (hub)
+            await this.maybeAutoPull(hub);
     }
     /** Auto-discover peers over Tailscale and connect to each (skips self/known). */
     async discoverAndConnect(tag) {
@@ -279,12 +309,49 @@ export class Federation {
         const urls = await discoverTailscalePeers({ port, tag, logger: this.deps.logger });
         let connected = 0;
         for (const url of urls) {
-            const peer = await this.mesh?.connect(url);
+            const peer = await this.connect(url);
             if (peer && peer.nodeId !== this.deps.identity.nodeId)
                 connected++;
         }
         return connected;
     }
+    /**
+     * Start zero-config LAN discovery: broadcast a beacon on the local subnet and
+     * auto-connect to any peer we hear (no --seed / Tailscale needed). Continuous —
+     * new nodes that come online later are picked up too. Idempotent.
+     */
+    startLanDiscovery(tag, discoveryPort) {
+        if (this.lan)
+            return;
+        const { identity, logger, options } = this.deps;
+        this.lan = new LanBeacon({
+            nodeId: identity.nodeId,
+            name: identity.displayName,
+            role: identity.role,
+            meshPort: options.port ?? DEFAULT_MESH_PORT,
+            tag,
+            auth: !!options.token,
+            discoveryPort,
+            logger,
+            onPeer: ({ nodeId, url, name }) => {
+                if (nodeId === identity.nodeId)
+                    return; // self
+                if (this.mesh?.get(nodeId))
+                    return; // already connected
+                if (this.lanConnecting.has(nodeId))
+                    return; // dial in flight
+                this.lanConnecting.add(nodeId);
+                void this.connect(url)
+                    .then(p => {
+                    if (p)
+                        logger.info(`[federation] lan discovered ${p.displayName ?? name} @ ${url}`);
+                })
+                    .catch(() => { })
+                    .finally(() => this.lanConnecting.delete(nodeId));
+            },
+        });
+        this.lan.start();
+    }
     // ── Views ────────────────────────────────────────────────────────────────
     /** Neutral node-status list (self + peers) — feeds the mesh map. */
     nodeStatuses() {
@@ -327,6 +394,9 @@ export class Federation {
     async stop() {
         this.unsub?.();
         this.bridge?.stop();
+        this.lan?.stop();
+        if (this.configPullTimer)
+            clearInterval(this.configPullTimer);
         if (this.telemetryTimer)
             clearInterval(this.telemetryTimer);
         this.mesh?.stop();

package/dist/kernel/federation/index.d.ts

@@ -25,6 +25,8 @@ export type { ComputeCandidate, ComputeNeed } from './compute-router.js';
 export { loadRole, saveRole, rolePreamble } from './role-context.js';
 export { discoverTailscalePeers, tailscaleAvailable } from './discovery.js';
 export type { DiscoverOptions } from './discovery.js';
+export { LanBeacon, DEFAULT_LAN_DISCOVERY_PORT } from './lan-discovery.js';
+export type { LanBeaconOptions, DiscoveredLanPeer } from './lan-discovery.js';
 export { envelope, reply, frame, frameToSSE, parseSSE, newId } from './protocol.js';
 export * as moltfed from './moltfed-adapter.js';
 export { MoltfedConnector } from './moltfed-connector.js';

package/dist/kernel/federation/index.js

@@ -18,6 +18,7 @@ export { AutoUpdate, compareVersions } from './auto-update.js';
 export { ComputeRouter } from './compute-router.js';
 export { loadRole, saveRole, rolePreamble } from './role-context.js';
 export { discoverTailscalePeers, tailscaleAvailable } from './discovery.js';
+export { LanBeacon, DEFAULT_LAN_DISCOVERY_PORT } from './lan-discovery.js';
 export { envelope, reply, frame, frameToSSE, parseSSE, newId } from './protocol.js';
 export * as moltfed from './moltfed-adapter.js';
 export { MoltfedConnector } from './moltfed-connector.js';

package/dist/kernel/federation/lan-discovery.d.ts

@@ -0,0 +1,43 @@
+import type { Logger } from '../types.js';
+export declare const DEFAULT_LAN_DISCOVERY_PORT = 47915;
+export interface DiscoveredLanPeer {
+    nodeId: string;
+    name: string;
+    role: string;
+    url: string;
+    address: string;
+    tag?: string;
+}
+export interface LanBeaconOptions {
+    nodeId: string;
+    name: string;
+    role: string;
+    /** The mesh (HTTP+SSE) port this node advertises. */
+    meshPort: number;
+    /** Only match peers carrying this tag (mirrors Tailscale --tag). */
+    tag?: string;
+    /** Whether this node's mesh requires a token (informational only). */
+    auth?: boolean;
+    /** UDP port to broadcast/listen on (default 47915). */
+    discoveryPort?: number;
+    /** Broadcast cadence (default 5s). */
+    intervalMs?: number;
+    logger?: Logger;
+    /** Called when a *different* node's beacon is heard. */
+    onPeer: (peer: DiscoveredLanPeer) => void;
+}
+/** Periodically broadcasts a discovery beacon and reports peers it hears. */
+export declare class LanBeacon {
+    private opts;
+    private sock?;
+    private timer?;
+    private readonly port;
+    private readonly intervalMs;
+    private stopped;
+    constructor(opts: LanBeaconOptions);
+    start(): void;
+    private beaconPayload;
+    private broadcast;
+    private onMessage;
+    stop(): void;
+}

package/dist/kernel/federation/lan-discovery.js

@@ -0,0 +1,135 @@
+/**
+ * OpenKernel — LAN Peer Discovery (UDP broadcast)
+ *
+ * Zero-config, dependency-free same-subnet discovery. Each node periodically
+ * broadcasts a tiny beacon (nodeId, name, role, mesh port, optional tag) over
+ * UDP; any node that hears a beacon learns a peer's mesh URL and connects. No
+ * --seed, no Tailscale needed on a shared LAN.
+ *
+ * Broadcast packets are NOT forwarded by routers, so this stays within the local
+ * subnet by design — discovery only ever reaches physically co-located, trusted
+ * machines. Actual mesh RPC is still gated by the shared --token if one is set.
+ */
+import dgram from 'node:dgram';
+import os from 'node:os';
+export const DEFAULT_LAN_DISCOVERY_PORT = 47915;
+const MAGIC = 'ICMESH1';
+/** Periodically broadcasts a discovery beacon and reports peers it hears. */
+export class LanBeacon {
+    opts;
+    sock;
+    timer;
+    port;
+    intervalMs;
+    stopped = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.port = opts.discoveryPort ?? DEFAULT_LAN_DISCOVERY_PORT;
+        this.intervalMs = opts.intervalMs ?? 5000;
+    }
+    start() {
+        const sock = dgram.createSocket({ type: 'udp4', reuseAddr: true });
+        this.sock = sock;
+        sock.on('error', err => {
+            this.opts.logger?.debug?.(`[federation] lan discovery socket error: ${err.message}`);
+        });
+        sock.on('message', (buf, rinfo) => this.onMessage(buf, rinfo));
+        sock.bind(this.port, () => {
+            try {
+                sock.setBroadcast(true);
+            }
+            catch {
+                /* some platforms disallow; best-effort */
+            }
+            this.broadcast();
+            this.timer = setInterval(() => this.broadcast(), this.intervalMs);
+            this.opts.logger?.info?.(`[federation] lan discovery listening on udp/${this.port}`);
+        });
+    }
+    beaconPayload() {
+        const wire = {
+            t: MAGIC,
+            v: 1,
+            nodeId: this.opts.nodeId,
+            name: this.opts.name,
+            role: this.opts.role,
+            meshPort: this.opts.meshPort,
+            tag: this.opts.tag,
+            auth: this.opts.auth,
+        };
+        return Buffer.from(JSON.stringify(wire));
+    }
+    broadcast() {
+        if (this.stopped || !this.sock)
+            return;
+        const msg = this.beaconPayload();
+        for (const addr of broadcastAddresses()) {
+            this.sock.send(msg, this.port, addr, err => {
+                if (err)
+                    this.opts.logger?.debug?.(`[federation] lan beacon send ${addr} failed: ${err.message}`);
+            });
+        }
+    }
+    onMessage(buf, rinfo) {
+        let data;
+        try {
+            data = JSON.parse(buf.toString('utf8'));
+        }
+        catch {
+            return;
+        }
+        if (!data || data.t !== MAGIC)
+            return;
+        if (typeof data.nodeId !== 'string' || typeof data.meshPort !== 'number')
+            return;
+        if (data.nodeId === this.opts.nodeId)
+            return; // ignore our own beacon
+        if (this.opts.tag && data.tag !== this.opts.tag)
+            return; // tag filter
+        const address = rinfo.address;
+        this.opts.onPeer({
+            nodeId: data.nodeId,
+            name: data.name ?? data.nodeId,
+            role: data.role ?? 'peer',
+            url: `http://${address}:${data.meshPort}`,
+            address,
+            tag: data.tag,
+        });
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        try {
+            this.sock?.close();
+        }
+        catch {
+            /* ignore */
+        }
+        this.sock = undefined;
+    }
+}
+/** Limited broadcast + each interface's directed broadcast address (IPv4). */
+function broadcastAddresses() {
+    const addrs = new Set(['255.255.255.255']);
+    for (const list of Object.values(os.networkInterfaces())) {
+        for (const ni of list ?? []) {
+            // Node 20 reports family as 'IPv4'; guard the numeric form defensively.
+            if (ni.family !== 'IPv4' && ni.family !== 4)
+                continue;
+            if (ni.internal)
+                continue;
+            const b = directedBroadcast(ni.address, ni.netmask);
+            if (b)
+                addrs.add(b);
+        }
+    }
+    return [...addrs];
+}
+function directedBroadcast(ip, mask) {
+    const ipp = ip.split('.').map(Number);
+    const mp = mask.split('.').map(Number);
+    if (ipp.length !== 4 || mp.length !== 4 || [...ipp, ...mp].some(n => Number.isNaN(n)))
+        return null;
+    return ipp.map((o, i) => (o & mp[i]) | (~mp[i] & 0xff)).join('.');
+}

package/dist/kernel/federation/transport-http.d.ts

@@ -7,6 +7,8 @@ export interface MeshServerOptions {
     /** Optional shared token; requests must present it as Bearer auth. */
     token?: string;
     getManifest: () => NodeManifest;
+    /** Optional: full mesh view (self + peers) for the GET /fed/nodes probe. */
+    getNodes?: () => unknown;
     onRpc: RpcHandler;
     logger: Logger;
 }

package/dist/kernel/federation/transport-http.js

@@ -69,6 +69,11 @@ export class MeshServer {
             res.end(JSON.stringify(this.opts.getManifest()));
             return;
         }
+        if (req.method === 'GET' && url.startsWith('/fed/nodes')) {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(this.opts.getNodes?.() ?? []));
+            return;
+        }
         if (req.method === 'GET' && url.startsWith('/fed/stream')) {
             this.openStream(req, res);
             return;

package/dist/kernel/setup.d.ts

@@ -6,8 +6,15 @@
 import type Conf from 'conf';
 import { Kernel } from '../kernel/index.js';
 import type { Logger } from '../kernel/index.js';
-import type { InfinicodeConfig } from './config-schema.js';
+import type { InfinicodeConfig, CloudProviderConfig } from './config-schema.js';
 export type { InfinicodeConfig, CloudProviderConfig, WorkerModelPref } from './config-schema.js';
+/**
+ * Register (or re-register) cloud providers on a live kernel from config.
+ * Used at build time and for satellite hot-apply of hub-shared config, so new
+ * providers + their models become available without a restart. Returns the
+ * count of enabled providers registered.
+ */
+export declare function registerCloudProviders(kernel: Kernel, cloudProviders: CloudProviderConfig[]): number;
 export declare function buildKernelFromConfig(config: Conf<InfinicodeConfig>, options?: {
     logger?: Logger;
 }): Kernel;

package/dist/kernel/setup.js

@@ -1,20 +1,13 @@
 import { Kernel, OllamaProvider, OpenAICompatibleProvider, GeminiProvider } from '../kernel/index.js';
 import { getProviderPreset } from './free-providers.js';
-export function buildKernelFromConfig(config, options) {
-    const masterUrl = config.get('masterUrl');
-    const tailscaleMasterUrl = config.get('tailscaleMasterUrl');
-    const defaultModel = config.get('defaultModel');
-    const ollamaOptions = {
-        id: 'ollama',
-        name: 'Ollama',
-        baseURL: masterUrl,
-        fallbackURL: tailscaleMasterUrl,
-        defaultModel,
-    };
-    const kernel = new Kernel({ loadBuiltinWorkers: true, logger: options?.logger });
-    kernel.registerProvider('ollama', new OllamaProvider(ollamaOptions));
-    // Register cloud providers
-    const cloudProviders = config.get('cloudProviders') ?? [];
+/**
+ * Register (or re-register) cloud providers on a live kernel from config.
+ * Used at build time and for satellite hot-apply of hub-shared config, so new
+ * providers + their models become available without a restart. Returns the
+ * count of enabled providers registered.
+ */
+export function registerCloudProviders(kernel, cloudProviders) {
+    let n = 0;
     for (const cfg of cloudProviders) {
         if (!cfg.enabled)
             continue;
@@ -28,6 +21,7 @@ export function buildKernelFromConfig(config, options) {
                 knownModels: preset?.knownModels ?? [],
             };
             kernel.registerProvider(cfg.id, new GeminiProvider(geminiOptions));
+            n++;
             continue;
         }
         const options = {
@@ -39,7 +33,25 @@ export function buildKernelFromConfig(config, options) {
             knownModels: preset?.knownModels ?? [],
         };
         kernel.registerProvider(cfg.id, new OpenAICompatibleProvider(options));
+        n++;
     }
+    return n;
+}
+export function buildKernelFromConfig(config, options) {
+    const masterUrl = config.get('masterUrl');
+    const tailscaleMasterUrl = config.get('tailscaleMasterUrl');
+    const defaultModel = config.get('defaultModel');
+    const ollamaOptions = {
+        id: 'ollama',
+        name: 'Ollama',
+        baseURL: masterUrl,
+        fallbackURL: tailscaleMasterUrl,
+        defaultModel,
+    };
+    const kernel = new Kernel({ loadBuiltinWorkers: true, logger: options?.logger });
+    kernel.registerProvider('ollama', new OllamaProvider(ollamaOptions));
+    // Register cloud providers
+    registerCloudProviders(kernel, config.get('cloudProviders') ?? []);
     // Apply per-worker model pins — the worker runtime honors them when routing.
     const workerModels = config.get('workerModels') ?? {};
     if (workerModels && Object.keys(workerModels).length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",