feat(cli): 1.5.0 — CLI-first architecture, tool-less MCP, policy engine

CLI becomes the API; MCP becomes a tool-less push-pipe. Bundle -42%
(250 KB → 146 KB) after stripping ~1700 lines of dead tool handlers.

- Tool-less MCP: tools/list returns []. Inbound peer messages still
  arrive as experimental.claude/channel notifications mid-turn.
- Resource-noun-verb CLI: peer list, message send, memory recall, etc.
  Legacy flat verbs (peers, send, remember) remain as aliases.
- Bundled claudemesh skill auto-installed by `claudemesh install` —
  sole CLI-discoverability surface for Claude.
- Unix-socket bridge: CLI invocations dial the push-pipe's warm WS
  (~220 ms warm vs ~600 ms cold).
- --mesh <slug> flag: connect a session to multiple meshes.
- Policy engine: every broker-touching verb runs through a YAML gate
  at ~/.claudemesh/policy.yaml (auto-created). Destructive verbs
  prompt; non-TTY auto-denies. Audit log at ~/.claudemesh/audit.log.
- --approval-mode plan|read-only|write|yolo + --policy <path>.

Spec: .artifacts/specs/2026-05-02-architecture-north-star.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/delete-mesh.ts

@@ -4,7 +4,8 @@ import { leave as leaveMesh } from "~/services/mesh/facade.js";
 import { getStoredToken } from "~/services/auth/facade.js";
 import { request } from "~/services/api/facade.js";
 import { URLS } from "~/constants/urls.js";
-import { green, red, bold, dim, yellow, icons } from "~/ui/styles.js";
+import { render } from "~/ui/render.js";
+import { bold, clay, dim, red } from "~/ui/styles.js";
 import { EXIT } from "~/constants/exit-codes.js";
 
 const BROKER_HTTP = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
@@ -23,34 +24,34 @@ function getUserId(token: string): string {
   } catch { return ""; }
 }
 
-async function isOwner(slug: string, userId: string): Promise<boolean> {
+async function isOwner(slug: string, auth: { session_token: string }): Promise<boolean> {
   try {
     const res = await request<{ meshes: Array<{ slug: string; is_owner: boolean }> }>({
-      path: `/cli/meshes?user_id=${userId}`,
+      path: `/cli/meshes`,
       baseUrl: BROKER_HTTP,
+      token: auth.session_token,
     });
-    return res.meshes?.find(m => m.slug === slug)?.is_owner ?? false;
+    return res.meshes?.find((m) => m.slug === slug)?.is_owner ?? false;
   } catch { return false; }
 }
 
 export async function deleteMesh(slug: string, opts: { yes?: boolean } = {}): Promise<number> {
   const config = readConfig();
 
-  // Mesh picker if no slug given
   if (!slug) {
     if (config.meshes.length === 0) {
-      console.error("  No meshes to remove.");
+      render.err("No meshes to remove.");
       return EXIT.NOT_FOUND;
     }
-    console.log("\n  Select mesh to remove:\n");
+    render.section("select mesh to remove");
     config.meshes.forEach((m, i) => {
-      console.log(`    ${bold(String(i + 1) + ")")} ${m.slug} ${dim("(" + m.name + ")")}`);
+      process.stdout.write(`    ${bold(String(i + 1) + ")")} ${clay(m.slug)} ${dim("(" + m.name + ")")}\n`);
     });
-    console.log("");
-    const choice = await prompt("  Choice: ");
+    render.blank();
+    const choice = await prompt(`  ${dim("choice:")} `);
     const idx = parseInt(choice, 10) - 1;
     if (idx < 0 || idx >= config.meshes.length) {
-      console.log("  Cancelled.");
+      render.info(dim("cancelled."));
       return EXIT.USER_CANCELLED;
     }
     slug = config.meshes[idx]!.slug;
@@ -58,28 +59,27 @@ export async function deleteMesh(slug: string, opts: { yes?: boolean } = {}): Pr
 
   const auth = getStoredToken();
   const userId = auth ? getUserId(auth.session_token) : "";
-  const ownerCheck = userId ? await isOwner(slug, userId) : false;
+  const ownerCheck = auth ? await isOwner(slug, auth) : false;
 
-  // Ask what to do
   if (!opts.yes) {
-    console.log(`\n  ${bold(slug)}\n`);
+    render.section(slug);
 
     if (ownerCheck) {
-      console.log(`    ${bold("1)")} Remove from this device only ${dim("(keep on server)")}`);
-      console.log(`    ${bold("2)")} ${red("Delete everywhere")} ${dim("(removes for all members)")}`);
-      console.log(`    ${bold("3)")} Cancel`);
-      console.log("");
+      process.stdout.write(`    ${bold("1)")} remove from this device only ${dim("(keep on server)")}\n`);
+      process.stdout.write(`    ${bold("2)")} ${red("delete everywhere")} ${dim("(removes for all members)")}\n`);
+      process.stdout.write(`    ${bold("3)")} cancel\n`);
+      render.blank();
 
-      const choice = await prompt("  Choice [1]: ") || "1";
+      const choice = await prompt(`  ${dim("choice [1]:")} `) || "1";
 
-      if (choice === "3") { console.log("  Cancelled."); return EXIT.USER_CANCELLED; }
+      if (choice === "3") { render.info(dim("cancelled.")); return EXIT.USER_CANCELLED; }
 
       if (choice === "2") {
-        // Server-side delete — require confirmation
-        console.log(`\n  ${red("Warning:")} This will delete ${bold(slug)} for all members.`);
-        const confirm = await prompt(`  Type "${slug}" to confirm: `);
+        render.blank();
+        render.warn(`this will delete ${bold(slug)} for all members.`);
+        const confirm = await prompt(`  ${dim(`type "${slug}" to confirm:`)} `);
         if (confirm.toLowerCase() !== slug.toLowerCase()) {
-          console.log("  Cancelled.");
+          render.info(dim("cancelled."));
           return EXIT.USER_CANCELLED;
         }
 
@@ -87,42 +87,39 @@ export async function deleteMesh(slug: string, opts: { yes?: boolean } = {}): Pr
           await request({
             path: `/cli/mesh/${slug}`,
             method: "DELETE",
-            body: { user_id: userId },
             baseUrl: BROKER_HTTP,
+            token: auth?.session_token,
+            body: { user_id: userId },
           });
-          console.log(`  ${green(icons.check)} Deleted "${slug}" from server.`);
+          render.ok(`deleted ${bold(slug)} from server.`);
         } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          console.error(`  ${icons.cross} Server delete failed: ${msg}`);
+          render.err(`server delete failed: ${err instanceof Error ? err.message : String(err)}`);
         }
 
         leaveMesh(slug);
-        console.log(`  ${green(icons.check)} Removed from local config.`);
+        render.ok("removed from local config.");
         return EXIT.SUCCESS;
       }
-
-      // choice === "1" — local only, fall through
     } else {
-      // Not owner — can only remove locally
-      console.log(`    ${bold("1)")} Remove from this device ${dim("(you can re-add later)")}`);
-      console.log(`    ${bold("2)")} Cancel`);
-      if (!ownerCheck && userId) {
-        console.log(dim(`\n    ${yellow(icons.warn)} Only the mesh owner can delete it from the server.`));
+      process.stdout.write(`    ${bold("1)")} remove from this device ${dim("(you can re-add later)")}\n`);
+      process.stdout.write(`    ${bold("2)")} cancel\n`);
+      if (userId) {
+        render.blank();
+        render.warn("only the mesh owner can delete it from the server.");
       }
-      console.log("");
+      render.blank();
 
-      const choice = await prompt("  Choice [1]: ") || "1";
-      if (choice === "2") { console.log("  Cancelled."); return EXIT.USER_CANCELLED; }
+      const choice = await prompt(`  ${dim("choice [1]:")} `) || "1";
+      if (choice === "2") { render.info(dim("cancelled.")); return EXIT.USER_CANCELLED; }
     }
   }
 
-  // Local-only removal
   const removed = leaveMesh(slug);
   if (removed) {
-    console.log(`  ${green(icons.check)} Removed "${slug}" from this device.`);
-    console.log(dim(`    Re-add anytime with: claudemesh mesh add <invite-url>`));
+    render.ok(`removed ${bold(slug)} from this device.`);
+    render.hint(`re-add anytime with: ${bold("claudemesh")} ${clay("<invite-url>")}`);
   } else {
-    console.error(`  Mesh "${slug}" not found in local config.`);
+    render.err(`mesh "${slug}" not found in local config.`);
   }
   return EXIT.SUCCESS;
 }