claudemesh

alezmad/claudemesh

Fork 0

Commit Graph

Author	SHA1	Message	Date
Alejandro Gutiérrez	92cac16c91	feat(cli): 1.29.0 — per-session IPC tokens + auto-scoping every claudemesh launch-spawned session now mints a 32-byte random token, writes it under tmpdir (mode 0600), and registers it with the daemon. cli invocations from inside that session inherit CLAUDEMESH_IPC_TOKEN_FILE in env, attach the token via Authorization: ClaudeMesh-Session <hex>, and the daemon resolves it to a SessionInfo. server-side: every read route that filters by mesh now uses meshFromCtx — explicit query/body wins, session default fills in when missing. write routes follow the same pattern. cli-side: peers.ts (and other multi-mesh-iterating verbs in future) prefers session-token mesh over all joined meshes when the user didn't pass --mesh explicitly. backward-compatible in both directions — tokenless callers behave exactly as before. registry is in-memory; daemon restart loses it but the 30s reaper handles dead pids and most callers re-register on next launch. verified end-to-end: peer list with token returns 4 prueba1 peers, without token returns 3 meshes' peers (aggregate). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-04 12:33:06 +01:00
Alejandro Gutiérrez	abaa4bcf87	feat(cli): claudemesh daemon — peer mesh runtime (v0.9.0) Long-lived process that holds a persistent WS to the broker and exposes a local IPC surface (UDS + bearer-auth TCP loopback). Implements the v0.9.0 spec under .artifacts/specs/. Core: - daemon up \| status \| version \| down \| accept-host - daemon outbox list [--failed\|--pending\|--inflight\|--done\|--aborted] - daemon outbox requeue <id> [--new-client-id <id>] - daemon install-service / uninstall-service (macOS launchd, Linux systemd) IPC routes: - /v1/version, /v1/health - /v1/send (POST) — full §4.5.1 idempotency lookup table - /v1/inbox (GET) — paged history - /v1/events — SSE stream of message/peer_join/peer_leave/broker_status - /v1/peers — broker passthrough - /v1/profile — summary/status/visible/avatar/title/bio/capabilities - /v1/outbox + /v1/outbox/requeue — operator recovery Storage (SQLite via node:sqlite / bun:sqlite): - outbox.db: pending/inflight/done/dead/aborted with audit columns - inbox.db: dedupe by client_message_id, decrypts DMs via existing crypto - BEGIN IMMEDIATE serialization for daemon-local accept races Identity: - host_fingerprint.json (machine-id \|\| first-stable-mac) - refuse-on-mismatch policy with `daemon accept-host` recovery CLI integration: - claudemesh send detects the daemon and routes through /v1/send when present, falling back to bridge socket / cold path otherwise Tests: 15-case coverage of the §4.5.1 IPC duplicate lookup table. Spec arc preserved at .artifacts/specs/2026-05-03-daemon-{v1..v10}.md; v0.9.0 implementation target locked at 2026-05-03-daemon-spec-v0.9.0.md; deferred items at 2026-05-03-daemon-spec-broker-hardening-followups.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-03 20:03:05 +01:00

Author

SHA1

Message

Date

Alejandro Gutiérrez

92cac16c91

feat(cli): 1.29.0 — per-session IPC tokens + auto-scoping

every claudemesh launch-spawned session now mints a 32-byte random
token, writes it under tmpdir (mode 0600), and registers it with the
daemon. cli invocations from inside that session inherit
CLAUDEMESH_IPC_TOKEN_FILE in env, attach the token via Authorization:
ClaudeMesh-Session <hex>, and the daemon resolves it to a SessionInfo.

server-side: every read route that filters by mesh now uses meshFromCtx —
explicit query/body wins, session default fills in when missing. write
routes follow the same pattern.

cli-side: peers.ts (and other multi-mesh-iterating verbs in future)
prefers session-token mesh over all joined meshes when the user didn't
pass --mesh explicitly.

backward-compatible in both directions — tokenless callers behave
exactly as before. registry is in-memory; daemon restart loses it but
the 30s reaper handles dead pids and most callers re-register on next
launch.

verified end-to-end: peer list with token returns 4 prueba1 peers,
without token returns 3 meshes' peers (aggregate).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-04 12:33:06 +01:00

Alejandro Gutiérrez

abaa4bcf87

feat(cli): claudemesh daemon — peer mesh runtime (v0.9.0)

Long-lived process that holds a persistent WS to the broker and exposes
a local IPC surface (UDS + bearer-auth TCP loopback). Implements the
v0.9.0 spec under .artifacts/specs/.

Core:
- daemon up | status | version | down | accept-host
- daemon outbox list [--failed|--pending|--inflight|--done|--aborted]
- daemon outbox requeue <id> [--new-client-id <id>]
- daemon install-service / uninstall-service (macOS launchd, Linux systemd)

IPC routes:
- /v1/version, /v1/health
- /v1/send  (POST)  — full §4.5.1 idempotency lookup table
- /v1/inbox (GET)   — paged history
- /v1/events        — SSE stream of message/peer_join/peer_leave/broker_status
- /v1/peers         — broker passthrough
- /v1/profile       — summary/status/visible/avatar/title/bio/capabilities
- /v1/outbox + /v1/outbox/requeue — operator recovery

Storage (SQLite via node:sqlite / bun:sqlite):
- outbox.db: pending/inflight/done/dead/aborted with audit columns
- inbox.db: dedupe by client_message_id, decrypts DMs via existing crypto
- BEGIN IMMEDIATE serialization for daemon-local accept races

Identity:
- host_fingerprint.json (machine-id || first-stable-mac)
- refuse-on-mismatch policy with `daemon accept-host` recovery

CLI integration:
- claudemesh send detects the daemon and routes through /v1/send when
  present, falling back to bridge socket / cold path otherwise

Tests: 15-case coverage of the §4.5.1 IPC duplicate lookup table.

Spec arc preserved at .artifacts/specs/2026-05-03-daemon-{v1..v10}.md;
v0.9.0 implementation target locked at 2026-05-03-daemon-spec-v0.9.0.md;
deferred items at 2026-05-03-daemon-spec-broker-hardening-followups.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 20:03:05 +01:00

2 Commits