feat(cli): claudemesh daemon — peer mesh runtime (v0.9.0)

Long-lived process that holds a persistent WS to the broker and exposes
a local IPC surface (UDS + bearer-auth TCP loopback). Implements the
v0.9.0 spec under .artifacts/specs/.

Core:
- daemon up | status | version | down | accept-host
- daemon outbox list [--failed|--pending|--inflight|--done|--aborted]
- daemon outbox requeue <id> [--new-client-id <id>]
- daemon install-service / uninstall-service (macOS launchd, Linux systemd)

IPC routes:
- /v1/version, /v1/health
- /v1/send  (POST)  — full §4.5.1 idempotency lookup table
- /v1/inbox (GET)   — paged history
- /v1/events        — SSE stream of message/peer_join/peer_leave/broker_status
- /v1/peers         — broker passthrough
- /v1/profile       — summary/status/visible/avatar/title/bio/capabilities
- /v1/outbox + /v1/outbox/requeue — operator recovery

Storage (SQLite via node:sqlite / bun:sqlite):
- outbox.db: pending/inflight/done/dead/aborted with audit columns
- inbox.db: dedupe by client_message_id, decrypts DMs via existing crypto
- BEGIN IMMEDIATE serialization for daemon-local accept races

Identity:
- host_fingerprint.json (machine-id || first-stable-mac)
- refuse-on-mismatch policy with `daemon accept-host` recovery

CLI integration:
- claudemesh send detects the daemon and routes through /v1/send when
  present, falling back to bridge socket / cold path otherwise

Tests: 15-case coverage of the §4.5.1 IPC duplicate lookup table.

Spec arc preserved at .artifacts/specs/2026-05-03-daemon-{v1..v10}.md;
v0.9.0 implementation target locked at 2026-05-03-daemon-spec-v0.9.0.md;
deferred items at 2026-05-03-daemon-spec-broker-hardening-followups.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/daemon/ipc/client.ts

@@ -0,0 +1,68 @@
+import { request as httpRequest } from "node:http";
+
+import { DAEMON_PATHS, DAEMON_TCP_HOST, DAEMON_TCP_DEFAULT_PORT } from "../paths.js";
+import { readLocalToken } from "../local-token.js";
+
+export interface IpcRequestOptions {
+  method?: "GET" | "POST" | "PATCH" | "DELETE";
+  path: string;
+  body?: unknown;
+  /** Force TCP loopback instead of UDS (for tests / cross-container scenarios). */
+  preferTcp?: boolean;
+  timeoutMs?: number;
+}
+
+export interface IpcResponse<T = unknown> {
+  status: number;
+  body: T;
+}
+
+export class IpcError extends Error {
+  constructor(public status: number, public payload: unknown, msg: string) {
+    super(msg);
+  }
+}
+
+/** Small, dependency-free IPC client for talking to the local daemon. */
+export async function ipc<T = unknown>(opts: IpcRequestOptions): Promise<IpcResponse<T>> {
+  const useTcp = !!opts.preferTcp;
+  const headers: Record<string, string> = {
+    accept: "application/json",
+    host: "localhost",
+  };
+
+  let bodyBuf: Buffer | undefined;
+  if (opts.body !== undefined) {
+    bodyBuf = Buffer.from(JSON.stringify(opts.body), "utf8");
+    headers["content-type"] = "application/json";
+    headers["content-length"] = String(bodyBuf.length);
+  }
+
+  if (useTcp) {
+    const tok = readLocalToken();
+    if (!tok) throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
+    headers.authorization = `Bearer ${tok}`;
+  }
+
+  return new Promise<IpcResponse<T>>((resolve, reject) => {
+    const req = httpRequest(
+      useTcp
+        ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers }
+        : { socketPath: DAEMON_PATHS.SOCK_FILE,                     path: opts.path, method: opts.method ?? "GET", headers },
+      (res) => {
+        const chunks: Buffer[] = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const raw = Buffer.concat(chunks).toString("utf8");
+          let parsed: unknown = raw;
+          try { parsed = raw.length > 0 ? JSON.parse(raw) : null; } catch { /* leave raw */ }
+          resolve({ status: res.statusCode ?? 0, body: parsed as T });
+        });
+      },
+    );
+    req.setTimeout(opts.timeoutMs ?? 5_000, () => req.destroy(new Error("ipc_timeout")));
+    req.on("error", (err) => reject(err));
+    if (bodyBuf) req.write(bodyBuf);
+    req.end();
+  });
+}