feat(daemon+mcp): daemon required for in-Claude-Code use; thin MCP shim

The architectural convergence v0.9.0 was building toward. CLI keeps
working without a daemon (claudemesh send/peer/inbox/...), but the MCP
push-pipe — which Claude Code uses for mid-turn channel emits, slash
commands, and resources — now requires the daemon. There is no fallback.

Daemon (additive):
- /v1/skills (list) and /v1/skills/:name (get) IPC endpoints, so the
  MCP shim can surface mesh skills without holding its own broker WS.
- listSkills() / getSkill() on DaemonBrokerClient.
- SSE 'message' event now carries plaintext body, sender_member_pubkey,
  priority, and subtype — full payload the MCP shim needs to render a
  channel notification.

MCP server: 979 → 469 LoC (470 of the remaining 469 is the unrelated
mesh-service proxy mode; the push-pipe path is ~200 LoC including
boilerplate).
- Probes ~/.claudemesh/daemon/daemon.sock at boot. Bails loudly with
  actionable instructions if missing.
- Subscribes to /v1/events SSE and translates each event into a
  notifications/claude/channel emit.
- Fetches mesh skills from the daemon for ListPrompts/GetPrompt and
  ListResources/ReadResource. ListTools returns []; the CLI is the API.
- No broker WS, no decryption, no reconnect logic. Daemon owns all of it.

claudemesh install: auto-installs and starts the daemon service for the
user's primary mesh (launchd / systemd-user). Pass --no-service to skip.

claudemesh launch: probes the daemon socket; if absent, spawns
'claudemesh daemon up --mesh <slug>' detached and waits up to 10s for
the socket. Surfaces a clear warning on timeout but doesn't block —
Claude Code's MCP shim will print the same error if the daemon really
isn't there.

Bundle: dist/entrypoints/mcp.js drops from 154KB → 104KB (gzipped 34KB
→ 19KB). Test: MCP boots cleanly via stdio, declares correct
capabilities, talks JSON-RPC; daemon /v1/skills returns the empty list
as expected on a mesh with no skills.

Released as 1.24.0 on npm.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/install.ts

@@ -437,6 +437,7 @@ function installStatusLine(): { installed: boolean } {
 export function runInstall(args: string[] = []): void {
   const skipHooks = args.includes("--no-hooks");
   const skipSkill = args.includes("--no-skill");
+  const skipService = args.includes("--no-service");
   const wantStatusLine = args.includes("--status-line");
   render.section("claudemesh install");
 
@@ -544,11 +545,33 @@ export function runInstall(args: string[] = []): void {
   }
 
   let hasMeshes = false;
+  let primaryMesh: string | undefined;
   try {
     const meshConfig = readConfig();
     hasMeshes = meshConfig.meshes.length > 0;
+    primaryMesh = meshConfig.meshes[0]?.slug;
   } catch {}
 
+  // Daemon service install — required for MCP integration as of 1.24.0.
+  // The daemon owns the broker WS and feeds the MCP push-pipe via SSE;
+  // skipping it leaves channel push, slash commands, and resources broken.
+  if (!skipService && hasMeshes && primaryMesh) {
+    try {
+      installDaemonService(entry, primaryMesh);
+    } catch (e) {
+      render.warn(
+        `daemon service install failed: ${e instanceof Error ? e.message : String(e)}`,
+        "Run `claudemesh daemon install-service --mesh <slug>` to retry.",
+      );
+    }
+  } else if (skipService) {
+    render.info(dim("· Daemon service skipped (--no-service)"));
+    render.info(dim("  MCP integration will fail at boot until you start the daemon manually:"));
+    render.info(dim("    claudemesh daemon up --mesh <slug>"));
+  } else if (!hasMeshes) {
+    render.info(dim("· Daemon service deferred — join a mesh first, then run install again."));
+  }
+
   render.blank();
   render.warn(`${bold("RESTART CLAUDE CODE")} ${yellow("for MCP tools to appear.")}`);
 
@@ -569,6 +592,67 @@ export function runInstall(args: string[] = []): void {
   render.info(dim(`  claudemesh completions zsh       # shell completions`));
 }
 
+/**
+ * Install + start the per-user daemon service for the primary mesh.
+ *
+ * Refuses on CI hosts (the service-install module guards this); falls
+ * back to a friendly message and lets the install otherwise succeed.
+ * The MCP push-pipe will fail loudly if the daemon isn't reachable, so
+ * the user knows there's a problem before it shows up as "no messages
+ * arriving."
+ */
+function installDaemonService(binaryEntry: string, meshSlug: string): void {
+  const {
+    installService,
+    detectPlatform,
+  } = require("~/daemon/service-install.js") as typeof import("../daemon/service-install.js");
+
+  const platform = detectPlatform();
+  if (!platform) {
+    render.info(dim(`· Daemon service skipped — unsupported platform: ${process.platform}`));
+    return;
+  }
+
+  // Resolve the binary the service unit should launch. When invoked from a
+  // bundled binary, argv[1] is correct. When invoked under tsx / dev, fall
+  // back to whatever `claudemesh` resolves to on PATH so the unit launches
+  // a shipped binary, not a dev script.
+  let binary = process.argv[1] ?? binaryEntry;
+  if (!binary || /\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
+    try {
+      const { execSync } = require("node:child_process") as typeof import("node:child_process");
+      binary = execSync("which claudemesh", { encoding: "utf8" }).trim();
+    } catch {
+      render.warn(
+        "couldn't resolve a 'claudemesh' binary on PATH; daemon service skipped",
+        "Install via npm/homebrew, then run `claudemesh daemon install-service --mesh " + meshSlug + "`",
+      );
+      return;
+    }
+  }
+
+  const r = installService({ binaryPath: binary, meshSlug });
+  render.ok(`daemon service installed (${r.platform})`);
+  render.kv([
+    ["unit", dim(r.unitPath)],
+    ["mesh", dim(meshSlug)],
+  ]);
+
+  // Boot the unit immediately so MCP has a daemon to attach to on next
+  // Claude Code launch. Best-effort: if launchctl/systemctl errors out we
+  // log and continue — the user can run the boot command manually.
+  try {
+    const { execSync } = require("node:child_process") as typeof import("node:child_process");
+    execSync(r.bootCommand, { stdio: "ignore" });
+    render.ok("daemon started");
+  } catch (e) {
+    render.warn(
+      `daemon service installed but failed to start: ${e instanceof Error ? e.message : String(e)}`,
+      `Run manually: ${r.bootCommand}`,
+    );
+  }
+}
+
 export function runUninstall(): void {
   render.section("claudemesh uninstall");
 

apps/cli/src/commands/launch.ts

@@ -44,6 +44,55 @@ export interface LaunchFlags {
 
 // --- Interactive mesh picker ---
 
+/**
+ * Ensure the per-user daemon is running before we hand off to Claude Code.
+ *
+ * As of 1.24.0 the daemon owns the broker WS and feeds the MCP push-pipe
+ * over IPC SSE. If the socket is absent when Claude boots its MCP shim,
+ * the shim bails (no fallback). So we probe for the socket here and, if
+ * missing, spawn `claudemesh daemon up --mesh <slug>` in the background,
+ * waiting briefly for the socket to appear.
+ *
+ * Best-effort: if the daemon spawn fails, we surface the error and let
+ * the launch proceed — Claude Code will print the same "daemon not
+ * running" message and the user can fix it manually.
+ */
+async function ensureDaemonRunning(meshSlug: string, quiet: boolean): Promise<void> {
+  const { DAEMON_PATHS } = await import("~/daemon/paths.js");
+  if (existsSync(DAEMON_PATHS.SOCK_FILE)) return;
+
+  if (!quiet) render.info("starting claudemesh daemon…");
+  const { spawn } = await import("node:child_process");
+  const argv0 = process.argv[1] ?? "claudemesh";
+  let binary = argv0;
+  if (/\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
+    try {
+      const { execSync } = await import("node:child_process");
+      binary = execSync("which claudemesh", { encoding: "utf8" }).trim();
+    } catch { binary = "claudemesh"; }
+  }
+  const child = spawn(binary, ["daemon", "up", "--mesh", meshSlug], {
+    detached: true,
+    stdio: "ignore",
+  });
+  child.unref();
+
+  // Wait for the socket to appear. 10 s budget — covers cold node start +
+  // broker hello round-trip on slow links.
+  const start = Date.now();
+  while (Date.now() - start < 10_000) {
+    if (existsSync(DAEMON_PATHS.SOCK_FILE)) {
+      if (!quiet) render.ok("daemon ready");
+      return;
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  render.warn(
+    "daemon failed to start within 10s",
+    "Run `claudemesh daemon up --mesh " + meshSlug + "` manually, then re-launch.",
+  );
+}
+
 async function pickMesh(meshes: JoinedMesh[]): Promise<JoinedMesh> {
   if (meshes.length === 1) return meshes[0]!;
 
@@ -550,6 +599,12 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
     }
   } catch { /* best effort */ }
 
+  // Ensure the daemon is running before we spawn Claude. The MCP shim
+  // (loaded by --dangerously-load-development-channels server:claudemesh)
+  // requires the daemon's UDS to be reachable at boot — if it isn't,
+  // channel push, slash commands, and resources fail.
+  await ensureDaemonRunning(mesh.slug, args.quiet);
+
   // Clean up stale mesh MCP entries from crashed sessions
   try {
     const claudeConfigPath = join(homedir(), ".claude.json");