signalmesh-meshd 0.1.2__tar.gz

signalmesh_meshd-0.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 acecalisto3
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

signalmesh_meshd-0.1.2/PKG-INFO

@@ -0,0 +1,131 @@
+Metadata-Version: 2.4
+Name: signalmesh-meshd
+Version: 0.1.2
+Summary: Outbound-only edge daemon for the SignalMesh Submesh Protocol — wrap local software as callable mesh coords with zero inbound ports.
+Author-email: acecalisto3 <acecalisto3@gmail.com>
+License: MIT
+Project-URL: Homepage, https://huggingface.co/spaces/acecalisto3/SignalMesh
+Project-URL: HuggingFace Space, https://huggingface.co/spaces/acecalisto3/SignalMesh
+Project-URL: Live App, https://acecalisto3-signalmesh.hf.space
+Project-URL: Live Lander, https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag
+Keywords: mesh,agents,protocol,websocket,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.0
+Requires-Dist: websockets>=12
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: test
+Requires-Dist: pytest>=7.0; extra == "test"
+Dynamic: license-file
+
+# signalmesh-meshd
+
+Outbound-only edge daemon for the SignalMesh Submesh Protocol. It holds one
+persistent WebSocket to the SignalMesh cloud, walks
+`~/.signalmesh/harnesses/*/SKILL.md` for op manifests, and executes
+`call_request`s as local subprocesses — no inbound ports, ever.
+
+## Install
+
+```bash
+pipx install signalmesh-meshd
+```
+
+Not on PyPI yet? Install straight from the built wheel:
+
+```bash
+pipx install /path/to/signalmesh_meshd-0.1.2-py3-none-any.whl
+```
+
+## Quick start
+
+Pair once — exchanges your SignalMesh key for a `device_id` + `device_token`,
+written to `~/.signalmesh/meshd.yaml` at mode `0600`:
+
+```bash
+meshd pair --key=smesh-XXXXXX --name=my-desktop
+```
+
+Connect — opens the outbound WebSocket, advertises discovered ops, and blocks
+serving `call_request`s until you kill it:
+
+```bash
+meshd connect
+```
+
+Invoke a coord from the cloud (this is what the SignalMesh backend does on
+your behalf when a mesh caller routes to your device):
+
+```bash
+curl -X POST https://acecalisto3-signalmesh.hf.space/api/submesh/call \
+  -H "Content-Type: application/json" \
+  -H "X-SignalMesh-Key: smesh-XXXXXX" \
+  -d '{"coord": "submesh.my_desktop.echo_test.say", "input": {"msg": "hello mesh"}}'
+```
+
+## Writing a SKILL.md manifest
+
+Drop a directory under `~/.signalmesh/harnesses/<harness-name>/` containing a
+`SKILL.md` with YAML frontmatter. meshd parses the frontmatter block, refuses
+any `exec` argv containing shell metacharacters, and advertises one coord per
+subcommand.
+
+`~/.signalmesh/harnesses/echo-test/SKILL.md`:
+
+```markdown
+---
+binary: /bin/echo
+subcommands:
+  - op_id: say
+    exec: ["{msg}"]
+    summary: "Echo a string back through the mesh."
+    params_schema:
+      msg: string
+    timeout_ms: 5000
+---
+
+# echo-test
+
+Minimal harness proving the mesh call → subprocess → response round trip.
+```
+
+This advertises `submesh.<device_name>.echo_test.say`, callable with
+`{"msg": "..."}`.
+
+## Safety model
+
+Every argv token is checked against a shell-metachar denylist twice: once at
+manifest-load time (before a coord is even advertised) and once again after
+`{param}` substitution (before the subprocess actually runs) — a manifest
+can't sneak a malicious literal past you, and a caller can't sneak one in
+through input params either. Subprocesses always run with `shell=False`.
+Path-typed params are additionally checked against each subcommand's
+`allow_paths` glob list; anything that resolves outside the allowlist is
+rejected before it ever reaches `argv`.
+
+## Links
+
+- 🤗 **HuggingFace Space** (canonical): https://huggingface.co/spaces/acecalisto3/SignalMesh
+- Live app (API endpoints): https://acecalisto3-signalmesh.hf.space
+- Interactive lander: https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag
+- Protocol docs: see the Space's `/api/submesh/*` routes (`device/pair`,
+  `device/{id}/revoke`, `devices`, `edge`, `call`)
+
+## License
+
+MIT

signalmesh_meshd-0.1.2/README.md

@@ -0,0 +1,96 @@
+# signalmesh-meshd
+
+Outbound-only edge daemon for the SignalMesh Submesh Protocol. It holds one
+persistent WebSocket to the SignalMesh cloud, walks
+`~/.signalmesh/harnesses/*/SKILL.md` for op manifests, and executes
+`call_request`s as local subprocesses — no inbound ports, ever.
+
+## Install
+
+```bash
+pipx install signalmesh-meshd
+```
+
+Not on PyPI yet? Install straight from the built wheel:
+
+```bash
+pipx install /path/to/signalmesh_meshd-0.1.2-py3-none-any.whl
+```
+
+## Quick start
+
+Pair once — exchanges your SignalMesh key for a `device_id` + `device_token`,
+written to `~/.signalmesh/meshd.yaml` at mode `0600`:
+
+```bash
+meshd pair --key=smesh-XXXXXX --name=my-desktop
+```
+
+Connect — opens the outbound WebSocket, advertises discovered ops, and blocks
+serving `call_request`s until you kill it:
+
+```bash
+meshd connect
+```
+
+Invoke a coord from the cloud (this is what the SignalMesh backend does on
+your behalf when a mesh caller routes to your device):
+
+```bash
+curl -X POST https://acecalisto3-signalmesh.hf.space/api/submesh/call \
+  -H "Content-Type: application/json" \
+  -H "X-SignalMesh-Key: smesh-XXXXXX" \
+  -d '{"coord": "submesh.my_desktop.echo_test.say", "input": {"msg": "hello mesh"}}'
+```
+
+## Writing a SKILL.md manifest
+
+Drop a directory under `~/.signalmesh/harnesses/<harness-name>/` containing a
+`SKILL.md` with YAML frontmatter. meshd parses the frontmatter block, refuses
+any `exec` argv containing shell metacharacters, and advertises one coord per
+subcommand.
+
+`~/.signalmesh/harnesses/echo-test/SKILL.md`:
+
+```markdown
+---
+binary: /bin/echo
+subcommands:
+  - op_id: say
+    exec: ["{msg}"]
+    summary: "Echo a string back through the mesh."
+    params_schema:
+      msg: string
+    timeout_ms: 5000
+---
+
+# echo-test
+
+Minimal harness proving the mesh call → subprocess → response round trip.
+```
+
+This advertises `submesh.<device_name>.echo_test.say`, callable with
+`{"msg": "..."}`.
+
+## Safety model
+
+Every argv token is checked against a shell-metachar denylist twice: once at
+manifest-load time (before a coord is even advertised) and once again after
+`{param}` substitution (before the subprocess actually runs) — a manifest
+can't sneak a malicious literal past you, and a caller can't sneak one in
+through input params either. Subprocesses always run with `shell=False`.
+Path-typed params are additionally checked against each subcommand's
+`allow_paths` glob list; anything that resolves outside the allowlist is
+rejected before it ever reaches `argv`.
+
+## Links
+
+- 🤗 **HuggingFace Space** (canonical): https://huggingface.co/spaces/acecalisto3/SignalMesh
+- Live app (API endpoints): https://acecalisto3-signalmesh.hf.space
+- Interactive lander: https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag
+- Protocol docs: see the Space's `/api/submesh/*` routes (`device/pair`,
+  `device/{id}/revoke`, `devices`, `edge`, `call`)
+
+## License
+
+MIT

signalmesh_meshd-0.1.2/pyproject.toml

@@ -0,0 +1,53 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "signalmesh-meshd"
+version = "0.1.2"
+description = "Outbound-only edge daemon for the SignalMesh Submesh Protocol — wrap local software as callable mesh coords with zero inbound ports."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.9"
+authors = [
+    { name = "acecalisto3", email = "acecalisto3@gmail.com" },
+]
+keywords = ["mesh", "agents", "protocol", "websocket", "cli"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: System :: Networking",
+    "Topic :: System :: Systems Administration",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "click>=8.0",
+    "websockets>=12",
+    "PyYAML>=6.0",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest>=7.0",
+]
+
+[project.scripts]
+meshd = "signalmesh_meshd.cli:main"
+
+[project.urls]
+Homepage = "https://huggingface.co/spaces/acecalisto3/SignalMesh"
+"HuggingFace Space" = "https://huggingface.co/spaces/acecalisto3/SignalMesh"
+"Live App" = "https://acecalisto3-signalmesh.hf.space"
+"Live Lander" = "https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag"
+
+[tool.setuptools.packages.find]
+where = ["src"]

signalmesh_meshd-0.1.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

signalmesh_meshd-0.1.2/src/signalmesh_meshd/__init__.py

@@ -0,0 +1,20 @@
+"""signalmesh-meshd — outbound-only edge daemon for the SignalMesh Submesh Protocol.
+
+Bridges local software into the SignalMesh cloud without opening a single
+inbound port: holds one persistent outbound WebSocket, advertises locally
+discovered ops (from ~/.signalmesh/harnesses/*/SKILL.md), and executes
+call_requests as local subprocesses.
+"""
+from .cli import cli, main
+from .config import MeshdConfig
+from .daemon import run_edge_client
+
+__version__ = "0.1.2"
+
+__all__ = [
+    "__version__",
+    "cli",
+    "main",
+    "MeshdConfig",
+    "run_edge_client",
+]

signalmesh_meshd-0.1.2/src/signalmesh_meshd/__main__.py

@@ -0,0 +1,5 @@
+"""Allows `python -m signalmesh_meshd`."""
+from .cli import main
+
+if __name__ == "__main__":
+    main()

signalmesh_meshd-0.1.2/src/signalmesh_meshd/cli.py

@@ -0,0 +1,164 @@
+"""meshd CLI — click-based entry point.
+
+    meshd pair --key=smesh-XXXXXX --name=my-desktop
+    meshd connect                           # long-running WS client
+    meshd status                            # show current pairing state
+    meshd disconnect --revoke               # invalidate device server-side
+"""
+import asyncio
+import json
+import os
+import random
+import sys
+import time
+from typing import Optional
+
+try:
+    import click
+except ImportError:
+    print("meshd requires: pip install click websockets PyYAML", file=sys.stderr)
+    sys.exit(1)
+
+from .config import CLOUD_HTTPS, CONFIG_DIR, CONFIG_PATH, MeshdConfig
+from .daemon import run_edge_client
+from .safety import log
+
+try:
+    import yaml
+except ImportError:
+    yaml = None
+
+
+@click.group()
+def cli() -> None:
+    """meshd — SignalMesh outbound-only edge daemon."""
+
+
+@cli.command()
+@click.option("--key", required=True,
+              help="Your X-SignalMesh-Key (free tier or paid).")
+@click.option("--name", default=None,
+              help="Device name (default: this machine's hostname).")
+@click.option("--cloud", default=CLOUD_HTTPS,
+              help=f"SignalMesh cloud base URL (default: {CLOUD_HTTPS}).")
+def pair(key: str, name: Optional[str], cloud: str) -> None:
+    """One-time pairing — exchanges key for device_id + device_token."""
+    import socket
+    import urllib.request
+
+    device_name = name or socket.gethostname()
+    body = json.dumps({"user_key": key, "device_name": device_name}).encode()
+    req = urllib.request.Request(
+        f"{cloud.rstrip('/')}/api/submesh/device/pair",
+        data=body,
+        headers={
+            "Content-Type":     "application/json",
+            "X-SignalMesh-Key": key,
+        },
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15) as r:
+            result = json.loads(r.read())
+    except Exception as e:
+        log.error("Pairing failed: %s", e)
+        sys.exit(1)
+
+    ws_url = cloud.replace("https://", "wss://").rstrip("/") + "/api/submesh/edge"
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    CONFIG_PATH.write_text(yaml.safe_dump({
+        "device_id":         result["device_id"],
+        "device_token":      result["device_token"],
+        "device_name":       result["device_name"],
+        "cloud_url":         ws_url,
+        "exposed_harnesses": {},
+    }))
+    os.chmod(CONFIG_PATH, 0o600)
+    click.echo(f"Paired as {device_name}")
+    click.echo(f"  device_id: {result['device_id']}")
+    click.echo(f"  config:    {CONFIG_PATH}  (mode 0600)")
+    click.echo(f"  cloud:     {ws_url}")
+    click.echo(f"  next:      meshd connect")
+
+
+def _run_with_retry(cfg) -> None:
+    """Run edge client with exponential-backoff retry. Ctrl+C exits cleanly.
+    Fatal after 20 consecutive failures."""
+    attempt = 0
+    while True:
+        try:
+            asyncio.run(run_edge_client(cfg))
+            log.info("Edge client returned normally; exiting.")
+            return
+        except KeyboardInterrupt:
+            log.info("Shutting down (KeyboardInterrupt).")
+            return
+        except Exception as e:
+            attempt += 1
+            if attempt > 20:
+                log.error("Too many failures (%d); giving up. Last: %s: %s",
+                          attempt, type(e).__name__, e)
+                raise
+            delay = min(60.0, 0.5 * (2 ** min(attempt, 7))) * (0.5 + random.random())
+            log.warning("Edge client failed (attempt %d): %s: %s — retrying in %.1fs",
+                        attempt, type(e).__name__, e, delay)
+            time.sleep(delay)
+
+
+@cli.command()
+def connect() -> None:
+    """Connect to the cloud mesh and serve local capabilities."""
+    cfg = MeshdConfig.load()
+    click.echo(f"Connecting as {cfg.device_name} → {cfg.cloud_url}")
+    _run_with_retry(cfg)
+
+
+@cli.command()
+def status() -> None:
+    """Show current pairing state."""
+    if not CONFIG_PATH.exists():
+        click.echo("Not paired. Run: meshd pair --key=...")
+        return
+    cfg = MeshdConfig.load()
+    click.echo(f"Paired as {cfg.device_name} ({cfg.device_id})")
+    click.echo(f"  cloud:  {cfg.cloud_url}")
+    click.echo(f"  config: {CONFIG_PATH}")
+
+
+@cli.command()
+@click.option("--revoke", is_flag=True,
+              help="Also call the server-side revoke endpoint to invalidate the device.")
+@click.option("--key", default=None,
+              help="Your pairing key (required when --revoke is set — the mesh-issued "
+                   "device_token cannot authorize revocation of its own device).")
+def disconnect(revoke: bool, key: str) -> None:
+    """Delete local config; optionally revoke server-side."""
+    if not CONFIG_PATH.exists():
+        click.echo("No config to remove. Already disconnected.")
+        return
+    if revoke:
+        if not key:
+            raise click.UsageError("--revoke requires --key=<pairing-key> "
+                                   "(the same key you passed to `meshd pair`).")
+        cfg = MeshdConfig.load()
+        import urllib.request
+        cloud = cfg.cloud_url.replace("wss://", "https://").split("/api/")[0]
+        revoke_url = f"{cloud}/api/submesh/device/{cfg.device_id}/revoke"
+        req = urllib.request.Request(revoke_url, method="POST",
+                                      headers={"X-SignalMesh-Key": key})
+        try:
+            urllib.request.urlopen(req, timeout=8)
+            click.echo(f"Revoked device {cfg.device_id} on server.")
+        except Exception as e:
+            click.echo(f"Revoke request failed (proceeding with local disconnect): {e}")
+    CONFIG_PATH.unlink(missing_ok=True)
+    click.echo(f"Local config removed: {CONFIG_PATH}")
+
+
+def main() -> None:
+    """Console-script entry point (`meshd` and `python -m signalmesh_meshd`)."""
+    cli()
+
+
+if __name__ == "__main__":
+    main()

signalmesh_meshd-0.1.2/src/signalmesh_meshd/config.py

@@ -0,0 +1,42 @@
+"""Config load/save for meshd — pairing state lives at ~/.signalmesh/meshd.yaml."""
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:
+    print("meshd requires: pip install click websockets PyYAML", file=sys.stderr)
+    sys.exit(1)
+
+from .safety import log
+
+CONFIG_DIR = Path.home() / ".signalmesh"
+CONFIG_PATH = CONFIG_DIR / "meshd.yaml"
+HARNESS_DIR = CONFIG_DIR / "harnesses"
+CLOUD_HTTPS = "https://acecalisto3-signalmesh.hf.space"
+CLOUD_WSS = "wss://acecalisto3-signalmesh.hf.space/api/submesh/edge"
+
+
+@dataclass
+class MeshdConfig:
+    device_id: str
+    device_token: str
+    device_name: str
+    cloud_url: str = CLOUD_WSS
+    exposed_harnesses: dict = field(default_factory=dict)
+
+    @classmethod
+    def load(cls) -> "MeshdConfig":
+        if not CONFIG_PATH.exists():
+            log.error("No config at %s — run `meshd pair --key=...` first.",
+                      CONFIG_PATH)
+            sys.exit(1)
+        raw = yaml.safe_load(CONFIG_PATH.read_text())
+        return cls(
+            device_id=raw["device_id"],
+            device_token=raw["device_token"],
+            device_name=raw["device_name"],
+            cloud_url=raw.get("cloud_url", CLOUD_WSS),
+            exposed_harnesses=raw.get("exposed_harnesses", {}),
+        )

signalmesh_meshd-0.1.2/src/signalmesh_meshd/daemon.py

@@ -0,0 +1,108 @@
+"""The connect loop: WebSocket handshake, capability advertise, heartbeat,
+and message dispatch (call_request / revoke / ack)."""
+import asyncio
+import json
+import random
+import sys
+import time
+
+try:
+    import websockets
+    from websockets.exceptions import ConnectionClosed
+except ImportError:
+    print("meshd requires: pip install click websockets PyYAML", file=sys.stderr)
+    sys.exit(1)
+
+from .config import MeshdConfig
+from .harness import _execute_op, _load_local_ops
+from .safety import log
+
+
+async def run_edge_client(cfg: MeshdConfig) -> None:
+    attempt = 0
+    while True:
+        try:
+            log.info("Connecting to %s", cfg.cloud_url)
+            async with websockets.connect(cfg.cloud_url,
+                                          ping_interval=20,
+                                          ping_timeout=10) as ws:
+                # ── Handshake: hello ────────────────────────────────
+                await ws.send(json.dumps({
+                    "type":          "hello",
+                    "device_id":     cfg.device_id,
+                    "device_token":  cfg.device_token,
+                    "device_name":   cfg.device_name,
+                    "meshd_version": "0.1.0",
+                    "platform":      sys.platform,
+                }))
+                resp = json.loads(await ws.recv())
+                if resp.get("type") == "error":
+                    log.error("Auth rejected: %s (fatal, not retrying)",
+                              resp.get("code", "unknown"))
+                    return
+                if resp.get("type") != "auth_accepted":
+                    log.error("Unexpected server response: %s", resp)
+                    return
+                log.info("Connected as %s (device %s). session_ttl_ms=%s",
+                         cfg.device_name, cfg.device_id,
+                         resp.get("session_ttl_ms"))
+                attempt = 0   # reset backoff on successful connect
+
+                # ── Advertise capabilities ──────────────────────────
+                # Phase 2 MVP: empty ops list. Phase 2.1 walks
+                # ~/.signalmesh/harnesses/*/SKILL.md and emits one op per
+                # subcommand group. See core/nicoli_catalog.py server-side
+                # for the same extraction pattern.
+                ops = _load_local_ops(cfg)
+                await ws.send(json.dumps({
+                    "type":      "capabilities_advertise",
+                    "device_id": cfg.device_id,
+                    "ops":       ops,
+                }))
+                ack = json.loads(await ws.recv())
+                log.info("Advertised %d ops. Server ack: %s",
+                         len(ops), ack.get("op_count"))
+
+                # ── Heartbeat coroutine ─────────────────────────────
+                async def heartbeat_loop():
+                    while True:
+                        await asyncio.sleep(30)
+                        try:
+                            await ws.send(json.dumps({
+                                "type":      "heartbeat",
+                                "device_id": cfg.device_id,
+                                "ts":        time.time(),
+                            }))
+                        except Exception:
+                            break
+                heartbeat_task = asyncio.create_task(heartbeat_loop())
+
+                # ── Main receive loop ───────────────────────────────
+                try:
+                    async for raw in ws:
+                        msg = json.loads(raw)
+                        mtype = msg.get("type", "")
+                        if mtype == "call_request":
+                            log.info("call_request coord=%s call_id=%s",
+                                     msg.get("coord"), msg.get("call_id"))
+                            result = await _execute_op(msg.get("coord",""),
+                                                        msg.get("input",{}) or {})
+                            await ws.send(json.dumps({"type":"call_result",
+                                                       "call_id":msg.get("call_id"),
+                                                       **result}))
+                        elif mtype == "revoke":
+                            log.warning("Server sent revoke — closing.")
+                            break
+                        elif mtype == "ack":
+                            pass
+                        else:
+                            log.debug("Unhandled server message: %s", mtype)
+                finally:
+                    heartbeat_task.cancel()
+
+        except (ConnectionClosed, OSError, asyncio.TimeoutError) as e:
+            delay = min(30, 1.5 * (2 ** attempt)) + random.uniform(0, 1)
+            attempt += 1
+            log.warning("Connection lost (%s); reconnecting in %.1fs",
+                        type(e).__name__, delay)
+            await asyncio.sleep(delay)

signalmesh_meshd-0.1.2/src/signalmesh_meshd/harness.py

@@ -0,0 +1,132 @@
+"""SKILL.md walker + op execution.
+
+Walks ~/.signalmesh/harnesses/*/SKILL.md for YAML-frontmatter manifests,
+builds the ops list advertised to the cloud, and executes call_requests as
+local subprocesses (shell=False) once the cloud routes a call to a known
+coord.
+"""
+import asyncio
+import os
+import re as _re
+import time
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:  # pragma: no cover - guarded identically in config.py
+    yaml = None
+
+from .config import HARNESS_DIR, MeshdConfig
+from .safety import has_shell_metachars, log, path_under
+
+_OPS_INDEX: dict = {}
+
+
+def _load_local_ops(cfg: MeshdConfig) -> list:
+    """
+    Walk ~/.signalmesh/harnesses/*/SKILL.md for YAML-frontmatter manifests.
+    Populates _OPS_INDEX for the call_request handler. Refuses argv tokens
+    containing shell metacharacters.
+    """
+    ops = []
+    _OPS_INDEX.clear()
+    if not HARNESS_DIR.exists():
+        return ops
+    for hd in HARNESS_DIR.iterdir():
+        if not hd.is_dir():
+            continue
+        skill_md = hd / "SKILL.md"
+        if not skill_md.exists():
+            continue
+        try:
+            content = skill_md.read_text()
+            m = _re.match(r'^---\n(.*?)\n---', content, _re.DOTALL)
+            if not m:
+                continue
+            manifest = yaml.safe_load(m.group(1)) or {}
+        except Exception as e:
+            log.warning("skipping %s: %s", skill_md, e)
+            continue
+        binary = manifest.get("binary", "")
+        harness_name = hd.name
+        for sub in manifest.get("subcommands", []) or []:
+            op_id = sub.get("op_id")
+            argv = sub.get("exec", [])
+            if not op_id or not isinstance(argv, list) or not argv:
+                continue
+            if has_shell_metachars(argv):
+                log.error("refusing %s.%s: shell metachars in argv", harness_name, op_id)
+                continue
+            device_slug = cfg.device_name.lower().replace("-", "_")
+            coord = f"submesh.{device_slug}.{harness_name}.{op_id}".lower().replace("-", "_")
+            ops.append({
+                "coord":         coord,
+                "harness":       harness_name,
+                "op_id":         op_id,
+                "method":        "EXEC",
+                "summary":       sub.get("summary", ""),
+                "params_schema": sub.get("params_schema", {}),
+                "streaming":     True,
+            })
+            _OPS_INDEX[coord] = {
+                "binary":        binary,
+                "argv":          argv,
+                "allow_paths":   sub.get("allow_paths", []),
+                "timeout_ms":    sub.get("timeout_ms", 60000),
+                "params_schema": sub.get("params_schema", {}),
+            }
+    return ops
+
+
+async def _execute_op(coord: str, input_params: dict) -> dict:
+    """Resolve coord → argv → subprocess.run (shell=False) → call_result envelope."""
+    entry = _OPS_INDEX.get(coord)
+    if not entry:
+        return {"status": "error", "error": {"code": "coord_not_found", "message": coord}}
+    binary = entry["binary"]
+    if binary and not os.access(binary, os.X_OK):
+        return {"status": "error",
+                "error": {"code": "binary_not_executable", "message": binary}}
+    resolved = [binary] if binary else []
+    params_schema = entry.get("params_schema", {})
+    allow_paths = entry.get("allow_paths", [])
+    for tok in entry["argv"]:
+        s = str(tok)
+        if s.startswith("{") and s.endswith("}"):
+            key = s[1:-1]
+            val = input_params.get(key, "")
+            if params_schema.get(key) == "path" and allow_paths:
+                p = Path(str(val)).expanduser().resolve()
+                allowed = any(True for pattern in allow_paths
+                              if path_under(p, Path(pattern.split("**")[0]).expanduser().resolve()))
+                if not allowed:
+                    return {"status": "error", "error": {"code": "path_outside_allowlist",
+                                                          "message": f"{val!r} not in {allow_paths}"}}
+                val = str(p)
+            resolved.append(str(val))
+        else:
+            resolved.append(s)
+    if has_shell_metachars(resolved):
+        return {"status": "error", "error": {"code": "shell_metachar_after_subst",
+                                              "message": " ".join(resolved)}}
+    started = time.time()
+    try:
+        proc = await asyncio.create_subprocess_exec(
+            *resolved, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.STDOUT)
+        try:
+            stdout, _ = await asyncio.wait_for(proc.communicate(),
+                                                timeout=entry["timeout_ms"] / 1000.0)
+        except asyncio.TimeoutError:
+            proc.kill()
+            return {"status": "error", "duration_ms": int((time.time() - started) * 1000),
+                    "error": {"code": "timeout"}}
+    except FileNotFoundError:
+        return {"status": "error", "error": {"code": "binary_not_found",
+                                              "message": resolved[0] if resolved else ""}}
+    duration_ms = int((time.time() - started) * 1000)
+    out = stdout.decode(errors="replace") if stdout else ""
+    if proc.returncode == 0:
+        return {"status": "success", "duration_ms": duration_ms, "exit_code": 0,
+                "output": {"stdout": out[-8000:], "argv": resolved}}
+    return {"status": "error", "duration_ms": duration_ms, "exit_code": proc.returncode,
+            "error": {"code": "nonzero_exit", "message": out[-2000:]}}

signalmesh_meshd-0.1.2/src/signalmesh_meshd/safety.py

@@ -0,0 +1,23 @@
+"""Shared logging + the shell-metachar guard used by harness.py before any
+subprocess exec, both at advertise-time (argv literals) and at call-time
+(argv after {param} substitution)."""
+import logging
+from pathlib import Path
+
+logging.basicConfig(level=logging.INFO,
+                     format="%(asctime)s %(levelname)s meshd: %(message)s")
+log = logging.getLogger("meshd")
+
+SHELL_METACHARS = set(";&|`$()<>\\\"'\n")
+
+
+def has_shell_metachars(tokens) -> bool:
+    return any(any(c in SHELL_METACHARS for c in str(tok)) for tok in tokens)
+
+
+def path_under(p: Path, base: Path) -> bool:
+    try:
+        p.relative_to(base)
+        return True
+    except ValueError:
+        return False

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/PKG-INFO

@@ -0,0 +1,131 @@
+Metadata-Version: 2.4
+Name: signalmesh-meshd
+Version: 0.1.2
+Summary: Outbound-only edge daemon for the SignalMesh Submesh Protocol — wrap local software as callable mesh coords with zero inbound ports.
+Author-email: acecalisto3 <acecalisto3@gmail.com>
+License: MIT
+Project-URL: Homepage, https://huggingface.co/spaces/acecalisto3/SignalMesh
+Project-URL: HuggingFace Space, https://huggingface.co/spaces/acecalisto3/SignalMesh
+Project-URL: Live App, https://acecalisto3-signalmesh.hf.space
+Project-URL: Live Lander, https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag
+Keywords: mesh,agents,protocol,websocket,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.0
+Requires-Dist: websockets>=12
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: test
+Requires-Dist: pytest>=7.0; extra == "test"
+Dynamic: license-file
+
+# signalmesh-meshd
+
+Outbound-only edge daemon for the SignalMesh Submesh Protocol. It holds one
+persistent WebSocket to the SignalMesh cloud, walks
+`~/.signalmesh/harnesses/*/SKILL.md` for op manifests, and executes
+`call_request`s as local subprocesses — no inbound ports, ever.
+
+## Install
+
+```bash
+pipx install signalmesh-meshd
+```
+
+Not on PyPI yet? Install straight from the built wheel:
+
+```bash
+pipx install /path/to/signalmesh_meshd-0.1.2-py3-none-any.whl
+```
+
+## Quick start
+
+Pair once — exchanges your SignalMesh key for a `device_id` + `device_token`,
+written to `~/.signalmesh/meshd.yaml` at mode `0600`:
+
+```bash
+meshd pair --key=smesh-XXXXXX --name=my-desktop
+```
+
+Connect — opens the outbound WebSocket, advertises discovered ops, and blocks
+serving `call_request`s until you kill it:
+
+```bash
+meshd connect
+```
+
+Invoke a coord from the cloud (this is what the SignalMesh backend does on
+your behalf when a mesh caller routes to your device):
+
+```bash
+curl -X POST https://acecalisto3-signalmesh.hf.space/api/submesh/call \
+  -H "Content-Type: application/json" \
+  -H "X-SignalMesh-Key: smesh-XXXXXX" \
+  -d '{"coord": "submesh.my_desktop.echo_test.say", "input": {"msg": "hello mesh"}}'
+```
+
+## Writing a SKILL.md manifest
+
+Drop a directory under `~/.signalmesh/harnesses/<harness-name>/` containing a
+`SKILL.md` with YAML frontmatter. meshd parses the frontmatter block, refuses
+any `exec` argv containing shell metacharacters, and advertises one coord per
+subcommand.
+
+`~/.signalmesh/harnesses/echo-test/SKILL.md`:
+
+```markdown
+---
+binary: /bin/echo
+subcommands:
+  - op_id: say
+    exec: ["{msg}"]
+    summary: "Echo a string back through the mesh."
+    params_schema:
+      msg: string
+    timeout_ms: 5000
+---
+
+# echo-test
+
+Minimal harness proving the mesh call → subprocess → response round trip.
+```
+
+This advertises `submesh.<device_name>.echo_test.say`, callable with
+`{"msg": "..."}`.
+
+## Safety model
+
+Every argv token is checked against a shell-metachar denylist twice: once at
+manifest-load time (before a coord is even advertised) and once again after
+`{param}` substitution (before the subprocess actually runs) — a manifest
+can't sneak a malicious literal past you, and a caller can't sneak one in
+through input params either. Subprocesses always run with `shell=False`.
+Path-typed params are additionally checked against each subcommand's
+`allow_paths` glob list; anything that resolves outside the allowlist is
+rejected before it ever reaches `argv`.
+
+## Links
+
+- 🤗 **HuggingFace Space** (canonical): https://huggingface.co/spaces/acecalisto3/SignalMesh
+- Live app (API endpoints): https://acecalisto3-signalmesh.hf.space
+- Interactive lander: https://hyperagent.com/s/VpnZ7xsnstxjTfHNoYnoag
+- Protocol docs: see the Space's `/api/submesh/*` routes (`device/pair`,
+  `device/{id}/revoke`, `devices`, `edge`, `call`)
+
+## License
+
+MIT

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+LICENSE
+README.md
+pyproject.toml
+src/signalmesh_meshd/__init__.py
+src/signalmesh_meshd/__main__.py
+src/signalmesh_meshd/cli.py
+src/signalmesh_meshd/config.py
+src/signalmesh_meshd/daemon.py
+src/signalmesh_meshd/harness.py
+src/signalmesh_meshd/safety.py
+src/signalmesh_meshd.egg-info/PKG-INFO
+src/signalmesh_meshd.egg-info/SOURCES.txt
+src/signalmesh_meshd.egg-info/dependency_links.txt
+src/signalmesh_meshd.egg-info/entry_points.txt
+src/signalmesh_meshd.egg-info/requires.txt
+src/signalmesh_meshd.egg-info/top_level.txt
+tests/test_smoke.py

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+meshd = signalmesh_meshd.cli:main

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/requires.txt

@@ -0,0 +1,6 @@
+click>=8.0
+websockets>=12
+PyYAML>=6.0
+
+[test]
+pytest>=7.0

signalmesh_meshd-0.1.2/src/signalmesh_meshd.egg-info/top_level.txt

@@ -0,0 +1 @@
+signalmesh_meshd

signalmesh_meshd-0.1.2/tests/test_smoke.py

@@ -0,0 +1,38 @@
+"""Smoke test: proves the built wheel is importable end-to-end and that
+MeshdConfig can be exercised against a fake path (never touches the real
+~/.signalmesh/meshd.yaml on the machine running the tests)."""
+import os
+
+import yaml
+
+import signalmesh_meshd
+from signalmesh_meshd import config as meshd_config
+
+
+def test_version():
+    assert signalmesh_meshd.__version__ == "0.1.0"
+
+
+def test_top_level_exports():
+    assert hasattr(signalmesh_meshd, "cli")
+    assert hasattr(signalmesh_meshd, "main")
+    assert hasattr(signalmesh_meshd, "MeshdConfig")
+    assert hasattr(signalmesh_meshd, "run_edge_client")
+
+
+def test_config_load_from_fake_path(tmp_path, monkeypatch):
+    fake_config_path = tmp_path / "meshd.yaml"
+    fake_config_path.write_text(yaml.safe_dump({
+        "device_id": "dev-fake-0001",
+        "device_token": "tok-fake-secret",
+        "device_name": "test-harness",
+        "cloud_url": "wss://example.invalid/api/submesh/edge",
+        "exposed_harnesses": {},
+    }))
+
+    monkeypatch.setattr(meshd_config, "CONFIG_PATH", fake_config_path)
+
+    cfg = meshd_config.MeshdConfig.load()
+    assert cfg.device_id == "dev-fake-0001"
+    assert cfg.device_name == "test-harness"
+    assert cfg.cloud_url == "wss://example.invalid/api/submesh/edge"