chore(cli-v2): un-ignore CLI source tree for binary release workflow

The CLI source (242 files, ~14k lines) was gitignored during the
earlier cli→cli-v2 reorg so only the published npm package carried it.
That blocks the GitHub Actions release workflow (release-cli.yml),
which clones the repo fresh on each runner and needs the source to
compile binaries via `bun build --compile`.

Moves the gitignore from root-level to `apps/cli-v2/.gitignore` with
only the usual build artefacts excluded (node_modules, dist, .turbo,
.cache). Source is now in git at apps/cli-v2/src/.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli-v2/tests/unit/argv.test.ts

@@ -0,0 +1,42 @@
+import { describe, it, expect } from "vitest";
+import { parseArgv } from "~/cli/argv.js";
+
+describe("parseArgv", () => {
+  it("parses bare command", () => {
+    const r = parseArgv(["node", "cli.js", "login"]);
+    expect(r.command).toBe("login");
+    expect(r.positionals).toEqual([]);
+    expect(r.flags).toEqual({});
+  });
+
+  it("parses command with positionals", () => {
+    const r = parseArgv(["node", "cli.js", "send", "alice", "hello world"]);
+    expect(r.command).toBe("send");
+    expect(r.positionals).toEqual(["alice", "hello world"]);
+  });
+
+  it("parses flags before command", () => {
+    const r = parseArgv(["node", "cli.js", "--version"]);
+    expect(r.command).toBe("");
+    expect(r.flags.version).toBe(true);
+  });
+
+  it("parses flags with values", () => {
+    const r = parseArgv(["node", "cli.js", "peers", "--mesh", "my-team", "--json"]);
+    expect(r.command).toBe("peers");
+    expect(r.flags.mesh).toBe("my-team");
+    expect(r.flags.json).toBe(true);
+  });
+
+  it("parses short flags", () => {
+    const r = parseArgv(["node", "cli.js", "-y", "-q"]);
+    expect(r.flags.y).toBe(true);
+    expect(r.flags.q).toBe(true);
+  });
+
+  it("empty args", () => {
+    const r = parseArgv(["node", "cli.js"]);
+    expect(r.command).toBe("");
+    expect(r.positionals).toEqual([]);
+  });
+});

apps/cli-v2/tests/unit/config.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdirSync, rmSync, existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const TEST_DIR = join(tmpdir(), "claudemesh-test-" + Date.now());
+
+describe("config", () => {
+  beforeEach(() => {
+    mkdirSync(TEST_DIR, { recursive: true });
+    process.env.CLAUDEMESH_CONFIG_DIR = TEST_DIR;
+  });
+  afterEach(() => {
+    rmSync(TEST_DIR, { recursive: true, force: true });
+    delete process.env.CLAUDEMESH_CONFIG_DIR;
+  });
+
+  it("readConfig returns empty when no file", async () => {
+    // Dynamic import to pick up env change
+    const { readConfig } = await import("~/services/config/read.js");
+    const config = readConfig();
+    expect(config.version).toBe(1);
+    expect(config.meshes).toEqual([]);
+  });
+
+  it("writeConfig + readConfig round-trip", async () => {
+    const { writeConfig } = await import("~/services/config/write.js");
+    const { readConfig } = await import("~/services/config/read.js");
+    writeConfig({
+      version: 1,
+      meshes: [{ meshId: "m1", memberId: "mb1", slug: "test", name: "Test", pubkey: "a".repeat(64), secretKey: "b".repeat(128), brokerUrl: "wss://localhost/ws", joinedAt: "2026-01-01" }],
+    });
+
+    const config = readConfig();
+    expect(config.meshes).toHaveLength(1);
+    expect(config.meshes[0]!.slug).toBe("test");
+  });
+
+  it("config file has 0600 permissions on unix", async () => {
+    if (process.platform === "win32") return;
+    const { writeConfig } = await import("~/services/config/write.js");
+    writeConfig({ version: 1, meshes: [] });
+
+    const configPath = join(TEST_DIR, "config.json");
+    const mode = statSync(configPath).mode & 0o777;
+    expect(mode).toBe(0o600);
+  });
+});

apps/cli-v2/tests/unit/crypto-roundtrip.test.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from "vitest";
+import {
+  generateKeypair, sign, verify, encrypt, decrypt, boxSeal, boxOpen,
+  encryptDirect, decryptDirect, randomBytes, randomHex,
+} from "~/services/crypto/facade.js";
+
+describe("crypto", () => {
+  it("generates valid Ed25519 keypair", async () => {
+    const kp = await generateKeypair();
+    expect(kp.publicKey).toMatch(/^[0-9a-f]{64}$/);
+    expect(kp.secretKey).toMatch(/^[0-9a-f]{128}$/);
+  });
+
+  it("sign + verify round-trip", async () => {
+    const kp = await generateKeypair();
+    const msg = "hello world";
+    const sig = await sign(msg, kp.secretKey);
+    expect(await verify(msg, sig, kp.publicKey)).toBe(true);
+    expect(await verify("tampered", sig, kp.publicKey)).toBe(false);
+  });
+
+  it("file encrypt + decrypt round-trip", async () => {
+    const data = new TextEncoder().encode("secret document");
+    const encrypted = await encrypt(data);
+    expect(encrypted.ciphertext.length).toBeGreaterThan(0);
+    expect(encrypted.nonce).toBeTruthy();
+
+    const decrypted = await decrypt(encrypted.ciphertext, encrypted.nonce, encrypted.key);
+    expect(decrypted).not.toBeNull();
+    expect(new TextDecoder().decode(decrypted!)).toBe("secret document");
+  });
+
+  it("file encrypt + decrypt fails with wrong key", async () => {
+    const data = new TextEncoder().encode("secret");
+    const encrypted = await encrypt(data);
+    const wrongKey = await randomBytes(32);
+    const result = await decrypt(encrypted.ciphertext, encrypted.nonce, wrongKey);
+    expect(result).toBeNull();
+  });
+
+  it("boxSeal + boxOpen round-trip", async () => {
+    const kp = await generateKeypair();
+    const secret = await randomBytes(32);
+    const sealed = await boxSeal(secret, kp.publicKey);
+    expect(sealed).toBeTruthy();
+
+    const opened = await boxOpen(sealed, kp.publicKey, kp.secretKey);
+    expect(opened).not.toBeNull();
+    expect(Buffer.from(opened!).toString("hex")).toBe(Buffer.from(secret).toString("hex"));
+  });
+
+  it("crypto_box direct message round-trip", async () => {
+    const alice = await generateKeypair();
+    const bob = await generateKeypair();
+    const msg = "hello bob";
+
+    const envelope = await encryptDirect(msg, bob.publicKey, alice.secretKey);
+    expect(envelope.nonce).toBeTruthy();
+    expect(envelope.ciphertext).toBeTruthy();
+
+    const decrypted = await decryptDirect(envelope, alice.publicKey, bob.secretKey);
+    expect(decrypted).toBe("hello bob");
+  });
+
+  it("crypto_box decrypt fails with wrong keys", async () => {
+    const alice = await generateKeypair();
+    const bob = await generateKeypair();
+    const eve = await generateKeypair();
+
+    const envelope = await encryptDirect("secret", bob.publicKey, alice.secretKey);
+    const result = await decryptDirect(envelope, alice.publicKey, eve.secretKey);
+    expect(result).toBeNull();
+  });
+
+  it("randomBytes returns correct length", async () => {
+    const bytes = await randomBytes(16);
+    expect(bytes.length).toBe(16);
+  });
+
+  it("randomHex returns correct length", async () => {
+    const hex = await randomHex(8);
+    expect(hex).toMatch(/^[0-9a-f]{16}$/);
+  });
+});

apps/cli-v2/tests/unit/exit-codes.test.ts

@@ -0,0 +1,13 @@
+import { describe, it, expect } from "vitest";
+import { EXIT } from "~/constants/exit-codes.js";
+
+describe("exit codes", () => {
+  it("SUCCESS is 0", () => { expect(EXIT.SUCCESS).toBe(0); });
+  it("AUTH_FAILED is 2", () => { expect(EXIT.AUTH_FAILED).toBe(2); });
+  it("INVALID_ARGS is 3", () => { expect(EXIT.INVALID_ARGS).toBe(3); });
+  it("INTERNAL_ERROR is 8", () => { expect(EXIT.INTERNAL_ERROR).toBe(8); });
+  it("all codes are unique", () => {
+    const values = Object.values(EXIT);
+    expect(new Set(values).size).toBe(values.length);
+  });
+});

apps/cli-v2/tests/unit/health.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from "vitest";
+import { runAllChecks, runCheck } from "~/services/health/facade.js";
+
+describe("health checks", () => {
+  it("runAllChecks returns 6 results", () => {
+    const results = runAllChecks();
+    expect(results).toHaveLength(6);
+    for (const r of results) {
+      expect(r).toHaveProperty("name");
+      expect(r).toHaveProperty("ok");
+      expect(r).toHaveProperty("message");
+    }
+  });
+
+  it("node-version passes on Node 20+", () => {
+    const result = runCheck("node-version");
+    expect(result).not.toBeNull();
+    expect(result!.ok).toBe(true);
+  });
+
+  it("runCheck returns null for unknown check", () => {
+    expect(runCheck("nonexistent")).toBeNull();
+  });
+});

apps/cli-v2/tests/unit/templates.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from "vitest";
+import { TEMPLATES, listTemplates, getTemplate } from "~/templates/index.js";
+
+describe("templates", () => {
+  it("has 5 templates", () => {
+    expect(Object.keys(TEMPLATES)).toHaveLength(5);
+    expect(listTemplates()).toHaveLength(5);
+  });
+
+  it("each template has required fields", () => {
+    for (const t of listTemplates()) {
+      expect(t.name).toBeTruthy();
+      expect(t.description).toBeTruthy();
+      expect(Array.isArray(t.groups)).toBe(true);
+      expect(typeof t.stateKeys).toBe("object");
+      expect(Array.isArray(t.suggestedRoles)).toBe(true);
+      expect(t.systemPromptHint).toBeTruthy();
+    }
+  });
+
+  it("getTemplate returns correct template", () => {
+    const t = getTemplate("dev-team");
+    expect(t).toBeDefined();
+    expect(t!.name).toBe("Dev Team");
+  });
+
+  it("getTemplate returns undefined for unknown", () => {
+    expect(getTemplate("nonexistent")).toBeUndefined();
+  });
+});

apps/cli-v2/tests/unit/utils.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest";
+import { levenshtein } from "~/utils/levenshtein.js";
+import { toSlug } from "~/utils/slug.js";
+import { isInviteUrl, extractInviteCode } from "~/utils/url.js";
+import { formatBytes, formatDuration } from "~/utils/format.js";
+import { isNewer } from "~/utils/semver.js";
+
+describe("levenshtein", () => {
+  it("identical strings = 0", () => { expect(levenshtein("abc", "abc")).toBe(0); });
+  it("empty vs non-empty", () => { expect(levenshtein("", "abc")).toBe(3); });
+  it("single edit", () => { expect(levenshtein("kitten", "sitten")).toBe(1); });
+  it("full transform", () => { expect(levenshtein("kitten", "sitting")).toBe(3); });
+});
+
+describe("toSlug", () => {
+  it("lowercases and replaces spaces", () => { expect(toSlug("My Team")).toBe("my-team"); });
+  it("strips special chars", () => { expect(toSlug("test@#$mesh")).toBe("test-mesh"); });
+  it("trims dashes", () => { expect(toSlug("--hello--")).toBe("hello"); });
+});
+
+describe("isInviteUrl", () => {
+  it("matches https claudemesh.com/i/", () => { expect(isInviteUrl("https://claudemesh.com/i/ABC123")).toBe(true); });
+  it("matches ic:// protocol", () => { expect(isInviteUrl("ic://ABC123")).toBe(true); });
+  it("rejects random URL", () => { expect(isInviteUrl("https://example.com")).toBe(false); });
+});
+
+describe("extractInviteCode", () => {
+  it("extracts from /i/ URL", () => { expect(extractInviteCode("https://claudemesh.com/i/AB12CD34")).toBe("AB12CD34"); });
+  it("extracts from ic:// URL", () => { expect(extractInviteCode("ic://XY99")).toBe("XY99"); });
+  it("returns null for invalid", () => { expect(extractInviteCode("https://example.com")).toBeNull(); });
+});
+
+describe("formatBytes", () => {
+  it("bytes", () => { expect(formatBytes(500)).toBe("500 B"); });
+  it("kilobytes", () => { expect(formatBytes(2048)).toBe("2.0 KB"); });
+  it("megabytes", () => { expect(formatBytes(5 * 1024 * 1024)).toBe("5.0 MB"); });
+});
+
+describe("formatDuration", () => {
+  it("milliseconds", () => { expect(formatDuration(500)).toBe("500ms"); });
+  it("seconds", () => { expect(formatDuration(3500)).toBe("3.5s"); });
+  it("minutes", () => { expect(formatDuration(125000)).toBe("2m 5s"); });
+});
+
+describe("isNewer", () => {
+  it("major bump", () => { expect(isNewer("1.0.0", "2.0.0")).toBe(true); });
+  it("minor bump", () => { expect(isNewer("1.0.0", "1.1.0")).toBe(true); });
+  it("patch bump", () => { expect(isNewer("1.0.0", "1.0.1")).toBe(true); });
+  it("same version", () => { expect(isNewer("1.0.0", "1.0.0")).toBe(false); });
+  it("older version", () => { expect(isNewer("2.0.0", "1.0.0")).toBe(false); });
+});