feat: broadcast system notifications on MCP server register/unregister

Peers now receive [system] notifications when MCP servers join or
leave the mesh, with tool names and hosting peer info.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/broker/package.json

@@ -15,10 +15,13 @@
   },
   "prettier": "@turbostarter/prettier-config",
   "dependencies": {
+    "@qdrant/js-client-rest": "1.17.0",
     "@turbostarter/db": "workspace:*",
     "@turbostarter/shared": "workspace:*",
     "drizzle-orm": "0.44.7",
     "libsodium-wrappers": "0.7.15",
+    "minio": "8.0.7",
+    "neo4j-driver": "6.0.1",
     "ws": "8.20.0",
     "zod": "catalog:"
   },

apps/broker/src/audit.ts

@@ -0,0 +1,215 @@
+/**
+ * Signed audit log with hash-chain integrity.
+ *
+ * Every significant mesh event is recorded as an append-only entry.
+ * Each entry's SHA-256 hash includes the previous entry's hash,
+ * forming a tamper-evident chain per mesh. If any row is modified
+ * or deleted, all subsequent hashes will fail verification.
+ *
+ * NEVER logs message content (ciphertext or plaintext) — only metadata.
+ */
+
+import { createHash } from "node:crypto";
+import { asc, desc, eq, sql, and } from "drizzle-orm";
+import { db } from "./db";
+import { auditLog } from "@turbostarter/db/schema/mesh";
+import { log } from "./logger";
+
+// ---------------------------------------------------------------------------
+// In-memory last-hash cache (one entry per mesh, loaded from DB on startup)
+// ---------------------------------------------------------------------------
+
+const lastHash = new Map<string, string>();
+
+// ---------------------------------------------------------------------------
+// Core audit logging
+// ---------------------------------------------------------------------------
+
+function computeHash(
+  prevHash: string,
+  meshId: string,
+  eventType: string,
+  actorMemberId: string | null,
+  payload: Record<string, unknown>,
+  createdAt: Date,
+): string {
+  const input = `${prevHash}|${meshId}|${eventType}|${actorMemberId}|${JSON.stringify(payload)}|${createdAt.toISOString()}`;
+  return createHash("sha256").update(input).digest("hex");
+}
+
+/**
+ * Append an audit entry for a mesh event.
+ *
+ * Fire-and-forget safe — callers should `void audit(...)` or
+ * `.catch(log.warn)` to avoid blocking the hot path.
+ */
+export async function audit(
+  meshId: string,
+  eventType: string,
+  actorMemberId: string | null,
+  actorDisplayName: string | null,
+  payload: Record<string, unknown>,
+): Promise<void> {
+  const prevHash = lastHash.get(meshId) ?? "genesis";
+  const createdAt = new Date();
+  const hash = computeHash(prevHash, meshId, eventType, actorMemberId, payload, createdAt);
+
+  try {
+    await db.insert(auditLog).values({
+      meshId,
+      eventType,
+      actorMemberId,
+      actorDisplayName,
+      payload,
+      prevHash,
+      hash,
+      createdAt,
+    });
+    lastHash.set(meshId, hash);
+  } catch (e) {
+    log.warn("audit log insert failed", {
+      mesh_id: meshId,
+      event_type: eventType,
+      error: e instanceof Error ? e.message : String(e),
+    });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Startup: load last hash per mesh from DB
+// ---------------------------------------------------------------------------
+
+export async function loadLastHashes(): Promise<void> {
+  try {
+    // For each mesh, find the most recent audit entry by id (serial).
+    // DISTINCT ON (mesh_id) ORDER BY id DESC gives us one row per mesh.
+    const rows = await db.execute<{ mesh_id: string; hash: string }>(sql`
+      SELECT DISTINCT ON (mesh_id) mesh_id, hash
+      FROM mesh.audit_log
+      ORDER BY mesh_id, id DESC
+    `);
+
+    for (const row of rows) {
+      lastHash.set(row.mesh_id, row.hash);
+    }
+    log.info("audit: loaded last hashes", { meshes: lastHash.size });
+  } catch (e) {
+    // Table may not exist yet on first boot — that's fine.
+    log.warn("audit: loadLastHashes failed (table may not exist yet)", {
+      error: e instanceof Error ? e.message : String(e),
+    });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Chain verification
+// ---------------------------------------------------------------------------
+
+export async function verifyChain(
+  meshId: string,
+): Promise<{ valid: boolean; entries: number; brokenAt?: number }> {
+  const rows = await db
+    .select()
+    .from(auditLog)
+    .where(eq(auditLog.meshId, meshId))
+    .orderBy(asc(auditLog.id));
+
+  if (rows.length === 0) {
+    return { valid: true, entries: 0 };
+  }
+
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i]!;
+    const expectedPrevHash = i === 0 ? "genesis" : rows[i - 1]!.hash;
+
+    // Verify prevHash linkage
+    if (row.prevHash !== expectedPrevHash) {
+      return { valid: false, entries: rows.length, brokenAt: row.id };
+    }
+
+    // Recompute hash and verify
+    const recomputed = computeHash(
+      row.prevHash,
+      row.meshId,
+      row.eventType,
+      row.actorMemberId,
+      row.payload as Record<string, unknown>,
+      row.createdAt,
+    );
+    if (recomputed !== row.hash) {
+      return { valid: false, entries: rows.length, brokenAt: row.id };
+    }
+  }
+
+  return { valid: true, entries: rows.length };
+}
+
+// ---------------------------------------------------------------------------
+// Query: paginated audit entries
+// ---------------------------------------------------------------------------
+
+export async function queryAuditLog(
+  meshId: string,
+  options?: { limit?: number; offset?: number; eventType?: string },
+): Promise<{ entries: Array<{ id: number; eventType: string; actor: string; payload: Record<string, unknown>; hash: string; createdAt: string }>; total: number }> {
+  const limit = options?.limit ?? 50;
+  const offset = options?.offset ?? 0;
+
+  const conditions = [eq(auditLog.meshId, meshId)];
+  if (options?.eventType) {
+    conditions.push(eq(auditLog.eventType, options.eventType));
+  }
+  const where = conditions.length === 1 ? conditions[0]! : and(...conditions);
+
+  const [rows, countResult] = await Promise.all([
+    db
+      .select()
+      .from(auditLog)
+      .where(where)
+      .orderBy(desc(auditLog.id))
+      .limit(limit)
+      .offset(offset),
+    db
+      .select({ count: sql<number>`count(*)` })
+      .from(auditLog)
+      .where(where),
+  ]);
+
+  return {
+    entries: rows.map((r) => ({
+      id: r.id,
+      eventType: r.eventType,
+      actor: r.actorDisplayName ?? r.actorMemberId ?? "system",
+      payload: r.payload as Record<string, unknown>,
+      hash: r.hash,
+      createdAt: r.createdAt.toISOString(),
+    })),
+    total: Number(countResult[0]?.count ?? 0),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Ensure table exists (raw DDL for first-boot before migrations run)
+// ---------------------------------------------------------------------------
+
+export async function ensureAuditLogTable(): Promise<void> {
+  try {
+    await db.execute(sql`
+      CREATE TABLE IF NOT EXISTS mesh.audit_log (
+        id INTEGER GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+        mesh_id TEXT NOT NULL REFERENCES mesh.mesh(id) ON DELETE CASCADE ON UPDATE CASCADE,
+        event_type TEXT NOT NULL,
+        actor_member_id TEXT,
+        actor_display_name TEXT,
+        payload JSONB NOT NULL DEFAULT '{}',
+        prev_hash TEXT NOT NULL,
+        hash TEXT NOT NULL,
+        created_at TIMESTAMP NOT NULL DEFAULT now()
+      )
+    `);
+  } catch (e) {
+    log.warn("audit: ensureAuditLogTable failed", {
+      error: e instanceof Error ? e.message : String(e),
+    });
+  }
+}

apps/broker/src/env.ts

@@ -20,6 +20,14 @@ const envSchema = z.object({
   MAX_CONNECTIONS_PER_MESH: z.coerce.number().int().positive().default(100),
   MAX_MESSAGE_BYTES: z.coerce.number().int().positive().default(65_536),
   HOOK_RATE_LIMIT_PER_MIN: z.coerce.number().int().positive().default(30),
+  MINIO_ENDPOINT: z.string().default("minio:9000"),
+  MINIO_ACCESS_KEY: z.string().default("claudemesh"),
+  MINIO_SECRET_KEY: z.string().default("changeme"),
+  MINIO_USE_SSL: z.enum(["true", "false", ""]).transform(v => v === "true").default("false"),
+  QDRANT_URL: z.string().default("http://qdrant:6333"),
+  NEO4J_URL: z.string().default("bolt://neo4j:7687"),
+  NEO4J_USER: z.string().default("neo4j"),
+  NEO4J_PASSWORD: z.string().default("changeme"),
   NODE_ENV: z
     .enum(["development", "production", "test"])
     .default("development"),

apps/broker/src/minio.ts

@@ -0,0 +1,28 @@
+/**
+ * MinIO client for file storage.
+ *
+ * Each mesh gets its own bucket (mesh-{meshId}). Files are stored under
+ * a key path that encodes persistence and origin:
+ *   - persistent: shared/{fileId}/{originalName}
+ *   - ephemeral:  ephemeral/{YYYY-MM-DD}/{fileId}/{originalName}
+ */
+
+import { Client } from "minio";
+import { env } from "./env";
+
+export const minioClient = new Client({
+  endPoint: env.MINIO_ENDPOINT.split(":")[0]!,
+  port: parseInt(env.MINIO_ENDPOINT.split(":")[1] || "9000"),
+  useSSL: env.MINIO_USE_SSL,
+  accessKey: env.MINIO_ACCESS_KEY,
+  secretKey: env.MINIO_SECRET_KEY,
+});
+
+export async function ensureBucket(name: string): Promise<void> {
+  const exists = await minioClient.bucketExists(name);
+  if (!exists) await minioClient.makeBucket(name);
+}
+
+export function meshBucketName(meshId: string): string {
+  return `mesh-${meshId.toLowerCase().replace(/[^a-z0-9-]/g, "-")}`;
+}

apps/broker/src/neo4j-client.ts

@@ -0,0 +1,22 @@
+import neo4j from "neo4j-driver";
+import { env } from "./env";
+
+export const neo4jDriver = neo4j.driver(
+  env.NEO4J_URL,
+  neo4j.auth.basic(env.NEO4J_USER, env.NEO4J_PASSWORD),
+);
+
+export function meshDbName(meshId: string): string {
+  return `mesh_${meshId.toLowerCase().replace(/[^a-z0-9]/g, "")}`;
+}
+
+export async function ensureDatabase(name: string): Promise<void> {
+  const session = neo4jDriver.session({ database: "system" });
+  try {
+    await session.run(`CREATE DATABASE $name IF NOT EXISTS`, { name });
+  } catch {
+    /* may not support multi-db in community edition — fall back to default */
+  } finally {
+    await session.close();
+  }
+}

apps/broker/src/qdrant.ts

@@ -0,0 +1,24 @@
+import { QdrantClient } from "@qdrant/js-client-rest";
+import { env } from "./env";
+
+export const qdrant = new QdrantClient({ url: env.QDRANT_URL });
+
+export function meshCollectionName(
+  meshId: string,
+  collection: string,
+): string {
+  return `mesh_${meshId}_${collection}`.toLowerCase().replace(/[^a-z0-9_]/g, "_");
+}
+
+export async function ensureCollection(
+  name: string,
+  vectorSize = 1536,
+): Promise<void> {
+  try {
+    await qdrant.getCollection(name);
+  } catch {
+    await qdrant.createCollection(name, {
+      vectors: { size: vectorSize, distance: "Cosine" },
+    });
+  }
+}

apps/broker/src/webhooks.ts

@@ -0,0 +1,97 @@
+/**
+ * Inbound webhook handler.
+ *
+ * External services POST JSON to `/hook/:meshId/:secret`. The broker
+ * verifies the secret against the mesh.webhook table, then pushes the
+ * payload to all connected peers in that mesh as a "webhook" push.
+ */
+
+import { eq, and } from "drizzle-orm";
+import { db } from "./db";
+import { meshWebhook } from "@turbostarter/db/schema/mesh";
+import type { WSPushMessage } from "./types";
+import { log } from "./logger";
+
+export interface WebhookResult {
+  status: number;
+  body: { ok: boolean; delivered?: number; error?: string };
+}
+
+/**
+ * Look up a webhook by meshId + secret, verify it's active, then return
+ * the webhook name for push routing. Returns null if not found/inactive.
+ */
+async function findActiveWebhook(
+  meshId: string,
+  secret: string,
+): Promise<{ id: string; name: string; meshId: string } | null> {
+  const rows = await db
+    .select({ id: meshWebhook.id, name: meshWebhook.name, meshId: meshWebhook.meshId })
+    .from(meshWebhook)
+    .where(
+      and(
+        eq(meshWebhook.meshId, meshId),
+        eq(meshWebhook.secret, secret),
+        eq(meshWebhook.active, true),
+      ),
+    )
+    .limit(1);
+  return rows[0] ?? null;
+}
+
+/**
+ * Handle an inbound webhook HTTP request.
+ *
+ * @param meshId - mesh ID from the URL path
+ * @param secret - webhook secret from the URL path
+ * @param body - parsed JSON body from the request
+ * @param broadcastToMesh - callback to push a message to all connected peers in a mesh.
+ *   Returns the number of peers the message was delivered to.
+ */
+export async function handleWebhook(
+  meshId: string,
+  secret: string,
+  body: unknown,
+  broadcastToMesh: (meshId: string, msg: WSPushMessage) => number,
+): Promise<WebhookResult> {
+  try {
+    const webhook = await findActiveWebhook(meshId, secret);
+    if (!webhook) {
+      log.warn("webhook auth failed", { mesh_id: meshId });
+      return { status: 401, body: { ok: false, error: "unauthorized" } };
+    }
+
+    if (body === null || body === undefined || typeof body !== "object") {
+      return { status: 400, body: { ok: false, error: "invalid JSON body" } };
+    }
+
+    const pushMsg: WSPushMessage = {
+      type: "push",
+      subtype: "webhook" as any,
+      event: webhook.name,
+      eventData: body as Record<string, unknown>,
+      messageId: crypto.randomUUID(),
+      meshId: webhook.meshId,
+      senderPubkey: `webhook:${webhook.name}`,
+      priority: "next",
+      nonce: "",
+      ciphertext: "",
+      createdAt: new Date().toISOString(),
+    };
+
+    const delivered = broadcastToMesh(webhook.meshId, pushMsg);
+
+    log.info("webhook delivered", {
+      webhook_name: webhook.name,
+      mesh_id: webhook.meshId,
+      delivered,
+    });
+
+    return { status: 200, body: { ok: true, delivered } };
+  } catch (e) {
+    log.error("webhook handler error", {
+      error: e instanceof Error ? e.message : String(e),
+    });
+    return { status: 500, body: { ok: false, error: "internal error" } };
+  }
+}

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemesh-cli",
-  "version": "0.1.5",
+  "version": "0.7.0",
   "description": "Claude Code MCP client for claudemesh — peer mesh messaging between Claude sessions.",
   "keywords": [
     "claude-code",
@@ -47,6 +47,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.27.1",
+    "citty": "0.2.2",
     "libsodium-wrappers": "0.7.15",
     "ws": "8.20.0",
     "zod": "4.1.13"

apps/cli/src/commands/connect.ts

@@ -0,0 +1,59 @@
+/**
+ * Short-lived WS connection helper for CLI commands (peers, send, inbox, state).
+ *
+ * Opens a connection to one mesh, runs a callback, then closes cleanly.
+ * The caller never deals with connect/close lifecycle.
+ */
+
+import { hostname } from "node:os";
+import { BrokerClient } from "../ws/client";
+import { loadConfig } from "../state/config";
+import type { JoinedMesh } from "../state/config";
+
+export interface ConnectOpts {
+  /** Mesh slug to connect to. Auto-selects if only one mesh joined. */
+  meshSlug?: string | null;
+  /** Display name for this session. Defaults to hostname-pid. */
+  displayName?: string;
+}
+
+export async function withMesh<T>(
+  opts: ConnectOpts,
+  fn: (client: BrokerClient, mesh: JoinedMesh) => Promise<T>,
+): Promise<T> {
+  const config = loadConfig();
+  if (config.meshes.length === 0) {
+    console.error("No meshes joined. Run `claudemesh join <url>` first.");
+    process.exit(1);
+  }
+
+  let mesh: JoinedMesh;
+  if (opts.meshSlug) {
+    const found = config.meshes.find((m) => m.slug === opts.meshSlug);
+    if (!found) {
+      console.error(
+        `Mesh "${opts.meshSlug}" not found. Joined: ${config.meshes.map((m) => m.slug).join(", ")}`,
+      );
+      process.exit(1);
+    }
+    mesh = found;
+  } else if (config.meshes.length === 1) {
+    mesh = config.meshes[0]!;
+  } else {
+    console.error(
+      `Multiple meshes joined. Specify one with --mesh <slug>.\nJoined: ${config.meshes.map((m) => m.slug).join(", ")}`,
+    );
+    process.exit(1);
+  }
+
+  const displayName = opts.displayName ?? config.displayName ?? `${hostname()}-${process.pid}`;
+  const client = new BrokerClient(mesh, { displayName });
+
+  try {
+    await client.connect();
+    const result = await fn(client, mesh);
+    return result;
+  } finally {
+    client.close();
+  }
+}

apps/cli/src/commands/create.ts

@@ -0,0 +1,39 @@
+/**
+ * `claudemesh create` — Create a new mesh with an optional template.
+ * Lists available templates if --list-templates is passed.
+ */
+import { listTemplates, getTemplate } from "../templates/index.js";
+
+export function runCreate(args: Record<string, unknown>): void {
+  if (args["list-templates"]) {
+    console.log("Available mesh templates:\n");
+    for (const t of listTemplates()) {
+      console.log(`  ${t.name}`);
+      console.log(`    ${t.description}`);
+      console.log(`    Groups: ${t.groups.map((g) => g.name).join(", ") || "(none)"}`);
+      console.log(`    State keys: ${Object.keys(t.stateKeys).join(", ") || "(none)"}`);
+      console.log();
+    }
+    return;
+  }
+
+  const templateName = args.template as string | undefined;
+  if (templateName) {
+    const template = getTemplate(templateName);
+    if (!template) {
+      console.error(`Unknown template "${templateName}". Use --list-templates to see available options.`);
+      process.exit(1);
+    }
+    console.log(`Template "${template.name}" loaded:`);
+    console.log(`  Groups: ${template.groups.map((g) => `@${g.name}`).join(", ")}`);
+    console.log(`  State keys: ${Object.keys(template.stateKeys).join(", ")}`);
+    console.log(`  Hint: ${template.systemPromptHint.slice(0, 80)}...`);
+    console.log();
+    console.log("Template applied. Use `claudemesh launch` with --groups to join the predefined groups.");
+    // Future: wire into actual mesh creation API
+    return;
+  }
+
+  console.log("Usage: claudemesh create --template <name>");
+  console.log("       claudemesh create --list-templates");
+}

apps/cli/src/commands/inbox.ts

@@ -0,0 +1,60 @@
+/**
+ * `claudemesh inbox` — read pending peer messages.
+ *
+ * Connects, waits briefly for push delivery, drains the buffer, prints.
+ * Works best when message-mode is "inbox" or "off" (messages held at broker).
+ */
+
+import { withMesh } from "./connect";
+import type { InboundPush } from "../ws/client";
+
+export interface InboxFlags {
+  mesh?: string;
+  json?: boolean;
+  wait?: number;
+}
+
+function formatMessage(msg: InboundPush, useColor: boolean): string {
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const text = msg.plaintext ?? `[encrypted: ${msg.ciphertext.slice(0, 32)}…]`;
+  const from = msg.senderPubkey.slice(0, 8);
+  const time = new Date(msg.createdAt).toLocaleTimeString();
+  const kindTag = msg.kind === "direct" ? "→ direct" : msg.kind;
+
+  return `  ${bold(from)} ${dim(`[${kindTag}] ${time}`)}\n  ${text}`;
+}
+
+export async function runInbox(flags: InboxFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const waitMs = (flags.wait ?? 1) * 1000;
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    // Wait briefly for broker to push any held messages.
+    await new Promise<void>((resolve) => setTimeout(resolve, waitMs));
+
+    const messages = client.drainPushBuffer();
+
+    if (flags.json) {
+      console.log(JSON.stringify(messages, null, 2));
+      return;
+    }
+
+    if (messages.length === 0) {
+      console.log(dim(`No messages on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    console.log(bold(`Inbox — ${mesh.slug}`) + dim(` (${messages.length} message${messages.length === 1 ? "" : "s"})`));
+    console.log("");
+    for (const msg of messages) {
+      console.log(formatMessage(msg, useColor));
+      console.log("");
+    }
+  });
+}

apps/cli/src/commands/info.ts

@@ -0,0 +1,58 @@
+/**
+ * `claudemesh info` — show mesh overview: slug, broker URL, peer count, state count.
+ *
+ * Useful for AI agents to orient themselves in a mesh via bash.
+ */
+
+import { withMesh } from "./connect";
+import { loadConfig } from "../state/config";
+
+export interface InfoFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runInfo(flags: InfoFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const config = loadConfig();
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const [brokerInfo, peers, state] = await Promise.all([
+      client.meshInfo(),
+      client.listPeers(),
+      client.listState(),
+    ]);
+
+    const output = {
+      slug: mesh.slug,
+      meshId: mesh.meshId,
+      memberId: mesh.memberId,
+      brokerUrl: mesh.brokerUrl,
+      displayName: config.displayName ?? null,
+      peerCount: peers.length,
+      stateCount: state.length,
+      ...(brokerInfo ?? {}),
+    };
+
+    if (flags.json) {
+      console.log(JSON.stringify(output, null, 2));
+      return;
+    }
+
+    console.log(bold(mesh.slug) + dim(` · ${mesh.brokerUrl}`));
+    console.log(dim(`  mesh:   ${mesh.meshId}`));
+    console.log(dim(`  member: ${mesh.memberId}`));
+    console.log(`  peers:  ${peers.length} connected`);
+    console.log(`  state:  ${state.length} keys`);
+    if (brokerInfo && typeof brokerInfo === "object") {
+      for (const [k, v] of Object.entries(brokerInfo)) {
+        if (["slug", "meshId", "brokerUrl"].includes(k)) continue;
+        console.log(dim(`  ${k}: ${JSON.stringify(v)}`));
+      }
+    }
+  });
+}

apps/cli/src/commands/install.ts

@@ -29,6 +29,7 @@ import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
+import { loadConfig } from "../state/config";
 
 const MCP_NAME = "claudemesh";
 const CLAUDE_CONFIG = join(homedir(), ".claude.json");
@@ -212,6 +213,92 @@ function writeClaudeSettings(obj: Record<string, unknown>): void {
   );
 }
 
+/**
+ * All claudemesh MCP tool names, prefixed for allowedTools.
+ * These let Claude Code use claudemesh tools without --dangerously-skip-permissions.
+ */
+const CLAUDEMESH_TOOLS = [
+  "mcp__claudemesh__cancel_scheduled",
+  "mcp__claudemesh__check_messages",
+  "mcp__claudemesh__claim_task",
+  "mcp__claudemesh__complete_task",
+  "mcp__claudemesh__create_stream",
+  "mcp__claudemesh__create_task",
+  "mcp__claudemesh__delete_file",
+  "mcp__claudemesh__file_status",
+  "mcp__claudemesh__forget",
+  "mcp__claudemesh__get_context",
+  "mcp__claudemesh__get_file",
+  "mcp__claudemesh__get_state",
+  "mcp__claudemesh__grant_file_access",
+  "mcp__claudemesh__graph_execute",
+  "mcp__claudemesh__graph_query",
+  "mcp__claudemesh__join_group",
+  "mcp__claudemesh__leave_group",
+  "mcp__claudemesh__list_collections",
+  "mcp__claudemesh__list_contexts",
+  "mcp__claudemesh__list_files",
+  "mcp__claudemesh__list_peers",
+  "mcp__claudemesh__list_scheduled",
+  "mcp__claudemesh__list_state",
+  "mcp__claudemesh__list_streams",
+  "mcp__claudemesh__list_tasks",
+  "mcp__claudemesh__mesh_execute",
+  "mcp__claudemesh__mesh_info",
+  "mcp__claudemesh__mesh_query",
+  "mcp__claudemesh__mesh_schema",
+  "mcp__claudemesh__message_status",
+  "mcp__claudemesh__ping_mesh",
+  "mcp__claudemesh__publish",
+  "mcp__claudemesh__recall",
+  "mcp__claudemesh__remember",
+  "mcp__claudemesh__schedule_reminder",
+  "mcp__claudemesh__send_message",
+  "mcp__claudemesh__set_state",
+  "mcp__claudemesh__set_status",
+  "mcp__claudemesh__set_summary",
+  "mcp__claudemesh__share_context",
+  "mcp__claudemesh__share_file",
+  "mcp__claudemesh__subscribe",
+  "mcp__claudemesh__vector_delete",
+  "mcp__claudemesh__vector_search",
+  "mcp__claudemesh__vector_store",
+];
+
+/**
+ * Pre-approve all claudemesh MCP tools in allowedTools.
+ * Merges into any existing list — never overwrites other entries.
+ * Returns which tools were added vs already present.
+ */
+function installAllowedTools(): { added: string[]; unchanged: number } {
+  const settings = readClaudeSettings();
+  const existing = new Set<string>((settings.allowedTools as string[] | undefined) ?? []);
+  const toAdd = CLAUDEMESH_TOOLS.filter((t) => !existing.has(t));
+  if (toAdd.length > 0) {
+    settings.allowedTools = [...Array.from(existing), ...toAdd];
+    writeClaudeSettings(settings);
+  }
+  return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
+}
+
+/**
+ * Remove claudemesh tools from allowedTools.
+ * Leaves all other entries intact. Returns count removed.
+ */
+function uninstallAllowedTools(): number {
+  if (!existsSync(CLAUDE_SETTINGS)) return 0;
+  const settings = readClaudeSettings();
+  const existing = (settings.allowedTools as string[] | undefined) ?? [];
+  const toolSet = new Set(CLAUDEMESH_TOOLS);
+  const kept = existing.filter((t) => !toolSet.has(t));
+  const removed = existing.length - kept.length;
+  if (removed > 0) {
+    settings.allowedTools = kept;
+    writeClaudeSettings(settings);
+  }
+  return removed;
+}
+
 /**
  * Add a Stop + UserPromptSubmit hook entry to ~/.claude/settings.json,
  * idempotent on the command string. Returns counts for reporting.
@@ -321,6 +408,26 @@ export function runInstall(args: string[] = []): void {
     ),
   );
 
+  // allowedTools — pre-approve claudemesh MCP tools so peers don't need
+  // --dangerously-skip-permissions just to call mesh tools.
+  try {
+    const { added, unchanged } = installAllowedTools();
+    if (added.length > 0) {
+      console.log(
+        `✓ allowedTools: ${added.length} claudemesh tools pre-approved${unchanged > 0 ? `, ${unchanged} already present` : ""}`,
+      );
+      console.log(dim(`  This lets claudemesh tools run without --dangerously-skip-permissions.`));
+      console.log(dim(`  Your existing allowedTools entries were preserved.`));
+    } else {
+      console.log(`✓ allowedTools: all ${unchanged} claudemesh tools already pre-approved`);
+    }
+    console.log(dim(`  config:  ${CLAUDE_SETTINGS}`));
+  } catch (e) {
+    console.error(
+      `⚠  allowedTools update failed: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+
   // Hooks — status accuracy (Stop/UserPromptSubmit → POST /hook/set-status).
   if (!skipHooks) {
     try {
@@ -345,12 +452,35 @@ export function runInstall(args: string[] = []): void {
     console.log(dim("· Hooks skipped (--no-hooks)"));
   }
 
+  // Check if user has any meshes joined — nudge them if not.
+  let hasMeshes = false;
+  try {
+    const meshConfig = loadConfig();
+    hasMeshes = meshConfig.meshes.length > 0;
+  } catch {
+    // Config missing or corrupt — treat as no meshes.
+  }
+
   console.log("");
   console.log(yellow(bold("⚠  RESTART CLAUDE CODE")) + yellow(" for MCP tools to appear."));
-  console.log("");
-  console.log(
-    `Next: ${bold("claudemesh join https://claudemesh.com/join/<token>")}`,
-  );
+
+  if (!hasMeshes) {
+    console.log("");
+    console.log(yellow("No meshes joined.") + " To connect with peers:");
+    console.log(
+      `  ${bold("claudemesh join <invite-url>")}` +
+        dim("   — join an existing mesh"),
+    );
+    console.log(
+      `  ${dim("Create one at")} ${bold("https://claudemesh.com/dashboard")}`,
+    );
+  } else {
+    console.log("");
+    console.log(
+      `Next: ${bold("claudemesh join https://claudemesh.com/join/<token>")}`,
+    );
+  }
+
   console.log("");
   console.log(
     yellow("⚠  For real-time push messages from peers, launch with:"),
@@ -375,6 +505,20 @@ export function runUninstall(): void {
     console.log(`· MCP server "${MCP_NAME}" not present`);
   }
 
+  // allowedTools
+  try {
+    const removed = uninstallAllowedTools();
+    if (removed > 0) {
+      console.log(`✓ allowedTools: ${removed} claudemesh tools removed`);
+    } else {
+      console.log("· No claudemesh allowedTools to remove");
+    }
+  } catch (e) {
+    console.error(
+      `⚠  allowedTools removal failed: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+
   // Hooks
   try {
     const removed = uninstallHooks();

apps/cli/src/commands/join.ts

@@ -14,7 +14,10 @@ import { parseInviteLink } from "../invite/parse";
 import { enrollWithBroker } from "../invite/enroll";
 import { generateKeypair } from "../crypto/keypair";
 import { loadConfig, saveConfig, getConfigPath } from "../state/config";
-import { hostname } from "node:os";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir, hostname } from "node:os";
+import { env } from "../env";
 
 export async function runJoin(args: string[]): Promise<void> {
   const link = args[0];
@@ -78,6 +81,16 @@ export async function runJoin(args: string[]): Promise<void> {
   });
   saveConfig(config);
 
+  // 4b. Store invite token for per-session re-enrollment (launch --name).
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join(homedir(), ".claudemesh");
+  const inviteFile = join(configDir, `invite-${payload.mesh_slug}.txt`);
+  try {
+    mkdirSync(dirname(inviteFile), { recursive: true });
+    writeFileSync(inviteFile, link, "utf-8");
+  } catch {
+    // Non-fatal — launch will fall back to shared identity.
+  }
+
   // 5. Report.
   console.log("");
   console.log(

apps/cli/src/commands/launch.ts

@@ -1,82 +1,356 @@
 /**
- * `claudemesh launch` — spawn `claude` with the dev-channel flag so the
- * claudemesh MCP server's `notifications/claude/channel` pushes get
- * injected as system reminders mid-turn.
+ * `claudemesh launch` — spawn `claude` with peer mesh identity.
  *
- * Equivalent to:
- *   claude --dangerously-load-development-channels server:claudemesh [extra args]
+ * Flags are defined in index.ts (citty command) — that is the source of
+ * truth. This file receives already-parsed flags and rawArgs.
  *
- * Any additional args (e.g. --model opus, --resume, -c) are passed
- * through verbatim. Use --quiet to skip the informational banner.
+ * Flow:
+ *   1. Receive parsed flags from citty + rawArgs for -- passthrough
+ *   2. If --join: run join flow first
+ *   3. Load config → pick mesh (auto if 1, interactive picker if >1)
+ *   4. Write per-session config to tmpdir (isolates mesh selection)
+ *   5. Spawn claude with CLAUDEMESH_CONFIG_DIR + CLAUDEMESH_DISPLAY_NAME
+ *   6. On exit: cleanup tmpdir
  */
 
 import { spawn } from "node:child_process";
+import { mkdtempSync, writeFileSync, rmSync, readdirSync, statSync } from "node:fs";
+import { tmpdir, hostname } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
 import { loadConfig, getConfigPath } from "../state/config";
+import type { Config, JoinedMesh, GroupEntry } from "../state/config";
 
-function printBanner(): void {
+// Flags as parsed by citty (index.ts is the source of truth for definitions).
+export interface LaunchFlags {
+  name?: string;
+  role?: string;
+  groups?: string;
+  join?: string;
+  mesh?: string;
+  "message-mode"?: string;
+  "system-prompt"?: string;
+  yes?: boolean;
+  quiet?: boolean;
+}
+
+// --- Interactive mesh picker ---
+
+async function pickMesh(meshes: JoinedMesh[]): Promise<JoinedMesh> {
+  if (meshes.length === 1) return meshes[0]!;
+
+  console.log("\n  Select mesh:");
+  meshes.forEach((m, i) => {
+    console.log(`    ${i + 1}) ${m.slug}`);
+  });
+  console.log("");
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question("  Choice [1]: ", (answer) => {
+      rl.close();
+      const idx = parseInt(answer || "1", 10) - 1;
+      if (idx >= 0 && idx < meshes.length) {
+        resolve(meshes[idx]!);
+      } else {
+        console.error("  Invalid choice, using first mesh.");
+        resolve(meshes[0]!);
+      }
+    });
+  });
+}
+
+// --- Group string parser ---
+
+/** Parse "frontend:lead,reviewers:member,all" → GroupEntry[] */
+function parseGroupsString(raw: string): GroupEntry[] {
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .map((token) => {
+      const idx = token.indexOf(":");
+      if (idx === -1) return { name: token };
+      return { name: token.slice(0, idx), role: token.slice(idx + 1) };
+    });
+}
+
+// --- Interactive role/groups prompts ---
+
+function askLine(prompt: string): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+// --- Permission confirmation ---
+
+async function confirmPermissions(): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const bold = (s: string): string => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+  const dim = (s: string): string => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const yellow = (s: string): string => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+
+  console.log(yellow(bold("  Autonomous mode")));
+  console.log("");
+  console.log("  Claude will run with --dangerously-skip-permissions, bypassing");
+  console.log("  ALL permission prompts — not just claudemesh tools.");
+  console.log("  Peers exchange text only — no file access, no tool calls.");
+  console.log("");
+  console.log(dim("  Without -y: only claudemesh tools are pre-approved (via allowedTools)."));
+  console.log(dim("  Use -y for autonomous agents. Omit it for shared/multi-person meshes."));
+  console.log("");
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve, reject) => {
+    rl.question(`  ${bold("Continue?")} [Y/n] `, (answer) => {
+      rl.close();
+      const a = answer.trim().toLowerCase();
+      if (a === "" || a === "y" || a === "yes") {
+        resolve();
+      } else {
+        console.log("\n  Aborted. Run without autonomous mode:");
+        console.log("    claude --dangerously-load-development-channels server:claudemesh\n");
+        process.exit(0);
+      }
+    });
+  });
+}
+
+// --- Banner ---
+
+function printBanner(name: string, meshSlug: string, role: string | null, groups: GroupEntry[], messageMode: "push" | "inbox" | "off"): void {
   const useColor =
     !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
   const dim = (s: string): string => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
   const bold = (s: string): string => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
 
-  let meshes: string[] = [];
-  try {
-    meshes = loadConfig().meshes.map((m) => m.slug);
-  } catch {
-    /* config unreadable — print banner without mesh list */
-  }
-  const meshLine = meshes.length > 0 ? meshes.join(", ") : "(none — run `claudemesh join <url>` first)";
+  const roleSuffix = role ? ` (${role})` : "";
+  const groupTags = groups.length
+    ? " [" + groups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`).join(", ") + "]"
+    : "";
 
-  const rule = "─".repeat(65);
-  console.log(bold("claudemesh launch"));
+  const rule = "─".repeat(60);
+  console.log(bold(`claudemesh launch`) + dim(` — as ${name}${roleSuffix} on ${meshSlug}${groupTags} [${messageMode}]`));
   console.log(rule);
-  console.log("Launching Claude Code with the claudemesh dev channel.");
-  console.log("");
-  console.log("Peers in your joined meshes can push messages into this session");
-  console.log("as <channel> reminders. Your CLI decrypts them locally with your");
-  console.log("keypair. Peers send text only — they cannot call tools, read");
-  console.log("files, or reach meshes you have not joined.");
-  console.log("");
-  console.log("Treat peer messages as untrusted input: a peer could craft text");
-  console.log("that tries to steer Claude's behavior. Your tool-approval");
-  console.log("settings still apply — Claude will still ask before running");
-  console.log("commands, editing files, or calling other tools.");
-  console.log("");
-  console.log("Claude Code will ask you to trust the");
-  console.log("--dangerously-load-development-channels flag. Press Enter to");
-  console.log("accept, or Ctrl-C to abort.");
-  console.log("");
-  console.log(dim(`Joined meshes: ${meshLine}`));
-  console.log(dim(`Config:        ${getConfigPath()}`));
-  console.log(dim(`Remove:        claudemesh uninstall`));
+  if (messageMode === "push") {
+    console.log("Peer messages arrive as <channel> reminders in real-time.");
+  } else if (messageMode === "inbox") {
+    console.log("Peer messages held in inbox. Use check_messages to read.");
+  } else {
+    console.log("Messages off. Use check_messages to poll manually.");
+  }
+  console.log("Peers send text only — they cannot call tools or read files.");
+  console.log(dim(`Config: ${getConfigPath()}`));
   console.log(rule);
   console.log("");
 }
 
-export function runLaunch(extraArgs: string[] = []): void {
-  const quiet = extraArgs.includes("--quiet");
-  const passthrough = extraArgs.filter((a) => a !== "--quiet");
+// --- Main ---
 
-  if (!quiet) printBanner();
+export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<void> {
+  // Extract args that follow "--" — passed straight through to claude.
+  const dashIdx = rawArgs.indexOf("--");
+  const claudePassthrough = dashIdx >= 0 ? rawArgs.slice(dashIdx + 1) : [];
 
+  // Normalise flags into the internal shape used below.
+  const args = {
+    name: flags.name ?? null,
+    role: flags.role ?? null,
+    groups: flags.groups ?? null,
+    joinLink: flags.join ?? null,
+    meshSlug: flags.mesh ?? null,
+    messageMode: (["push", "inbox", "off"].includes(flags["message-mode"] ?? "")
+      ? flags["message-mode"] as "push" | "inbox" | "off"
+      : null),
+    systemPrompt: flags["system-prompt"] ?? null,
+    quiet: flags.quiet ?? false,
+    skipPermConfirm: flags.yes ?? false,
+    claudeArgs: claudePassthrough,
+  };
+
+  // 1. If --join, run join flow first.
+  if (args.joinLink) {
+    console.log("Joining mesh...");
+    const invite = await parseInviteLink(args.joinLink);
+    const keypair = await generateKeypair();
+    const displayName = args.name ?? `${hostname()}-${process.pid}`;
+    const enroll = await enrollWithBroker({
+      brokerWsUrl: invite.payload.broker_url,
+      inviteToken: invite.token,
+      invitePayload: invite.payload,
+      peerPubkey: keypair.publicKey,
+      displayName,
+    });
+    const config = loadConfig();
+    config.meshes = config.meshes.filter(
+      (m) => m.slug !== invite.payload.mesh_slug,
+    );
+    config.meshes.push({
+      meshId: invite.payload.mesh_id,
+      memberId: enroll.memberId,
+      slug: invite.payload.mesh_slug,
+      name: invite.payload.mesh_slug,
+      pubkey: keypair.publicKey,
+      secretKey: keypair.secretKey,
+      brokerUrl: invite.payload.broker_url,
+      joinedAt: new Date().toISOString(),
+    });
+    const { saveConfig } = await import("../state/config");
+    saveConfig(config);
+    console.log(
+      `✓ Joined "${invite.payload.mesh_slug}"${enroll.alreadyMember ? " (already member)" : ""}`,
+    );
+  }
+
+  // 2. Load config, pick mesh.
+  const config = loadConfig();
+  if (config.meshes.length === 0) {
+    console.error(
+      "No meshes joined. Run `claudemesh join <url>` or use --join <url>.",
+    );
+    process.exit(1);
+  }
+
+  let mesh: JoinedMesh;
+  if (args.meshSlug) {
+    const found = config.meshes.find((m) => m.slug === args.meshSlug);
+    if (!found) {
+      console.error(
+        `Mesh "${args.meshSlug}" not found. Joined: ${config.meshes.map((m) => m.slug).join(", ")}`,
+      );
+      process.exit(1);
+    }
+    mesh = found;
+  } else {
+    mesh = await pickMesh(config.meshes);
+  }
+
+  // 3. Session identity + role/groups.
+  //    The WS client auto-generates a per-session ephemeral keypair on
+  //    connect (sent in hello as sessionPubkey). We set display name via env var.
+  const displayName = args.name ?? `${hostname()}-${process.pid}`;
+
+  // Interactive wizard for role & groups (when not provided via flags and not --quiet).
+  let role: string | null = args.role;
+  let parsedGroups: GroupEntry[] = args.groups ? parseGroupsString(args.groups) : [];
+
+  let messageMode: "push" | "inbox" | "off" = args.messageMode ?? "push";
+
+  if (!args.quiet) {
+    if (role === null) {
+      const answer = await askLine("  Role (optional): ");
+      if (answer) role = answer;
+    }
+    if (parsedGroups.length === 0 && args.groups === null) {
+      const answer = await askLine("  Groups (comma-separated, optional): ");
+      if (answer) parsedGroups = parseGroupsString(answer);
+    }
+    if (args.messageMode === null) {
+      console.log("\n  Message mode:");
+      console.log("    1) Push (real-time, peers can interrupt your work)");
+      console.log("    2) Inbox (held until you check, notification only)");
+      console.log("    3) Off (tools only, no messages)");
+      console.log("");
+      const answer = await askLine("  Choice [1]: ");
+      const choice = parseInt(answer || "1", 10);
+      if (choice === 2) messageMode = "inbox";
+      else if (choice === 3) messageMode = "off";
+      else messageMode = "push";
+    }
+    if (role || parsedGroups.length) console.log("");
+  }
+
+  // Clean up orphaned tmpdirs from crashed sessions (older than 1 hour)
+  const tmpBase = tmpdir();
+  try {
+    for (const entry of readdirSync(tmpBase)) {
+      if (!entry.startsWith("claudemesh-")) continue;
+      const full = join(tmpBase, entry);
+      const age = Date.now() - statSync(full).mtimeMs;
+      if (age > 3600_000) rmSync(full, { recursive: true, force: true });
+    }
+  } catch { /* best effort */ }
+
+  // 4. Write session config to tmpdir (isolates mesh selection).
+  const tmpDir = mkdtempSync(join(tmpdir(), "claudemesh-"));
+  const sessionConfig: Config = {
+    version: 1,
+    meshes: [mesh],
+    displayName,
+    ...(role ? { role } : {}),
+    ...(parsedGroups.length > 0 ? { groups: parsedGroups } : {}),
+    messageMode,
+  };
+  writeFileSync(
+    join(tmpDir, "config.json"),
+    JSON.stringify(sessionConfig, null, 2) + "\n",
+    "utf-8",
+  );
+
+  // 5. Banner + permission confirmation.
+  if (!args.quiet) {
+    printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
+    // Auto-permissions confirmation — needed for autonomous peer messaging.
+    if (!args.skipPermConfirm) {
+      await confirmPermissions();
+    }
+  }
+
+  // 6. Spawn claude with ephemeral config + dev channel + auto-permissions.
+  //    Strip any user-supplied --dangerously flags to avoid duplicates.
+  const filtered: string[] = [];
+  for (let i = 0; i < args.claudeArgs.length; i++) {
+    if (args.claudeArgs[i] === "--dangerously-load-development-channels"
+        || args.claudeArgs[i] === "--dangerously-skip-permissions") {
+      if (args.claudeArgs[i] === "--dangerously-load-development-channels") i++;
+      continue;
+    }
+    filtered.push(args.claudeArgs[i]!);
+  }
+  // --dangerously-skip-permissions is only added when the user explicitly
+  // passes -y / --yes. Without it, claudemesh tools still work because
+  // `claudemesh install` pre-approves them via allowedTools in settings.json.
+  // This keeps permissions tight for multi-person meshes.
   const claudeArgs = [
     "--dangerously-load-development-channels",
     "server:claudemesh",
-    ...passthrough,
+    ...(args.skipPermConfirm ? ["--dangerously-skip-permissions"] : []),
+    ...(args.systemPrompt ? ["--system-prompt", args.systemPrompt] : []),
+    ...filtered,
   ];
-  // Windows: npm global binaries are .cmd shims. Node's spawn without
-  // shell:true does not resolve PATHEXT, so we need shell:true on win32
-  // to find claude.cmd. POSIX stays shell-less to avoid quoting surprises.
+
   const isWindows = process.platform === "win32";
   const child = spawn("claude", claudeArgs, {
     stdio: "inherit",
     shell: isWindows,
+    env: {
+      ...process.env,
+      CLAUDEMESH_CONFIG_DIR: tmpDir,
+      CLAUDEMESH_DISPLAY_NAME: displayName,
+      ...(role ? { CLAUDEMESH_ROLE: role } : {}),
+    },
   });
 
+  // 7. Cleanup on exit.
+  const cleanup = (): void => {
+    try {
+      rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  };
+
   child.on("error", (err: NodeJS.ErrnoException) => {
+    cleanup();
     if (err.code === "ENOENT") {
       console.error(
-        "✗ `claude` not found on PATH. Install Claude Code first: https://claude.com/claude-code",
+        "✗ `claude` not found on PATH. Install Claude Code first.",
       );
     } else {
       console.error(`✗ failed to launch claude: ${err.message}`);
@@ -85,10 +359,15 @@ export function runLaunch(extraArgs: string[] = []): void {
   });
 
   child.on("exit", (code, signal) => {
+    cleanup();
     if (signal) {
       process.kill(process.pid, signal);
       return;
     }
     process.exit(code ?? 0);
   });
+
+  // Cleanup on parent signals too.
+  process.on("SIGTERM", () => { cleanup(); process.exit(0); });
+  process.on("SIGINT", () => { cleanup(); process.exit(0); });
 }

apps/cli/src/commands/memory.ts

@@ -0,0 +1,63 @@
+/**
+ * `claudemesh remember <text> [--tags tag1,tag2]` — store a memory in the mesh.
+ * `claudemesh recall <query>`                      — search mesh memory.
+ *
+ * Useful for AI agents using bash when the MCP server isn't active.
+ */
+
+import { withMesh } from "./connect";
+
+export interface MemoryFlags {
+  mesh?: string;
+  tags?: string;
+  json?: boolean;
+}
+
+export async function runRemember(flags: MemoryFlags, content: string): Promise<void> {
+  const tags = flags.tags
+    ? flags.tags.split(",").map((t) => t.trim()).filter(Boolean)
+    : undefined;
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const id = await client.remember(content, tags);
+    if (flags.json) {
+      console.log(JSON.stringify({ id, content, tags }));
+      return;
+    }
+    if (id) {
+      console.log(`✓ Remembered (${id.slice(0, 8)})`);
+    } else {
+      console.error("✗ Failed to store memory");
+      process.exit(1);
+    }
+  });
+}
+
+export async function runRecall(flags: MemoryFlags, query: string): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const memories = await client.recall(query);
+
+    if (flags.json) {
+      console.log(JSON.stringify(memories, null, 2));
+      return;
+    }
+
+    if (memories.length === 0) {
+      console.log(dim("No memories found."));
+      return;
+    }
+
+    for (const m of memories) {
+      const tags = m.tags.length ? dim(` [${m.tags.join(", ")}]`) : "";
+      console.log(`${bold(m.id.slice(0, 8))}${tags}`);
+      console.log(`  ${m.content}`);
+      console.log(dim(`  ${m.rememberedBy} · ${new Date(m.rememberedAt).toLocaleString()}`));
+      console.log("");
+    }
+  });
+}

apps/cli/src/commands/peers.ts

@@ -0,0 +1,55 @@
+/**
+ * `claudemesh peers` — list connected peers in the mesh.
+ *
+ * Connects, fetches the peer list, prints it, disconnects.
+ */
+
+import { withMesh } from "./connect";
+
+export interface PeersFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runPeers(flags: PeersFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+  const green = (s: string) => (useColor ? `\x1b[32m${s}\x1b[39m` : s);
+  const yellow = (s: string) => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const peers = await client.listPeers();
+
+    if (flags.json) {
+      console.log(JSON.stringify(peers, null, 2));
+      return;
+    }
+
+    if (peers.length === 0) {
+      console.log(dim(`No peers connected on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    console.log(bold(`Peers on ${mesh.slug}`) + dim(` (${peers.length})`));
+    console.log("");
+    for (const p of peers) {
+      const groups = p.groups.length
+        ? " [" + p.groups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`).join(", ") + "]"
+        : "";
+      const statusIcon = p.status === "working" ? yellow("●") : green("●");
+      const name = bold(p.displayName);
+      const meta: string[] = [];
+      if (p.peerType) meta.push(p.peerType);
+      if (p.channel) meta.push(p.channel);
+      if (p.model) meta.push(p.model);
+      const metaStr = meta.length ? dim(` (${meta.join(", ")})`) : "";
+      const cwdStr = p.cwd ? dim(`  cwd: ${p.cwd}`) : "";
+      const summary = p.summary ? dim(`  ${p.summary}`) : "";
+      console.log(`  ${statusIcon} ${name}${groups}${metaStr}${summary}`);
+      if (cwdStr) console.log(`    ${cwdStr}`);
+    }
+    console.log("");
+  });
+}

apps/cli/src/commands/remind.ts

@@ -0,0 +1,142 @@
+/**
+ * `claudemesh remind <message> --in <duration> | --at <time>`
+ * `claudemesh remind list`
+ * `claudemesh remind cancel <id>`
+ *
+ * Human-facing interface to the broker's scheduled message delivery.
+ */
+
+import { withMesh } from "./connect";
+
+export interface RemindFlags {
+  mesh?: string;
+  in?: string;       // e.g. "2h", "30m", "90s"
+  at?: string;       // ISO or HH:MM
+  cron?: string;     // 5-field cron expression for recurring
+  to?: string;       // default: self
+  json?: boolean;
+}
+
+function parseDuration(raw: string): number | null {
+  const m = raw.trim().match(/^(\d+(?:\.\d+)?)\s*(s|sec|m|min|h|hr|d|day)?$/i);
+  if (!m) return null;
+  const n = parseFloat(m[1]!);
+  const unit = (m[2] ?? "s").toLowerCase();
+  if (unit.startsWith("d")) return n * 86_400_000;
+  if (unit.startsWith("h")) return n * 3_600_000;
+  if (unit.startsWith("m")) return n * 60_000;
+  return n * 1_000;
+}
+
+function parseDeliverAt(flags: RemindFlags): number | null {
+  if (flags.in) {
+    const ms = parseDuration(flags.in);
+    if (ms === null) return null;
+    return Date.now() + ms;
+  }
+  if (flags.at) {
+    // Try HH:MM first
+    const hm = flags.at.match(/^(\d{1,2}):(\d{2})$/);
+    if (hm) {
+      const now = new Date();
+      const target = new Date(now);
+      target.setHours(parseInt(hm[1]!, 10), parseInt(hm[2]!, 10), 0, 0);
+      if (target <= now) target.setDate(target.getDate() + 1); // next occurrence
+      return target.getTime();
+    }
+    const ts = Date.parse(flags.at);
+    return isNaN(ts) ? null : ts;
+  }
+  return null;
+}
+
+export async function runRemind(
+  flags: RemindFlags,
+  positional: string[],
+): Promise<void> {
+  const useColor = !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const action = positional[0];
+
+  // claudemesh remind list
+  if (action === "list") {
+    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+      const scheduled = await client.listScheduled();
+      if (flags.json) { console.log(JSON.stringify(scheduled, null, 2)); return; }
+      if (scheduled.length === 0) { console.log(dim("No pending reminders.")); return; }
+      for (const m of scheduled) {
+        const when = new Date(m.deliverAt).toLocaleString();
+        const to = m.to === client.getSessionPubkey() ? dim("(self)") : m.to;
+        console.log(`  ${bold(m.id.slice(0, 8))} → ${to} at ${when}`);
+        console.log(`  ${dim(m.message.slice(0, 80))}`);
+        console.log("");
+      }
+    });
+    return;
+  }
+
+  // claudemesh remind cancel <id>
+  if (action === "cancel") {
+    const id = positional[1];
+    if (!id) { console.error("Usage: claudemesh remind cancel <id>"); process.exit(1); }
+    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+      const ok = await client.cancelScheduled(id);
+      if (ok) console.log(`✓ Cancelled ${id}`);
+      else { console.error(`✗ Not found or already fired: ${id}`); process.exit(1); }
+    });
+    return;
+  }
+
+  // claudemesh remind <message> --in <duration> | --at <time> | --cron <expr>
+  const message = action ?? positional.join(" ");
+  if (!message) {
+    console.error("Usage: claudemesh remind <message> --in <duration>");
+    console.error("       claudemesh remind <message> --at <time>");
+    console.error('       claudemesh remind <message> --cron "0 */2 * * *"');
+    console.error("       claudemesh remind list");
+    console.error("       claudemesh remind cancel <id>");
+    process.exit(1);
+  }
+
+  const isCron = !!flags.cron;
+  const deliverAt = isCron ? 0 : parseDeliverAt(flags);
+  if (!isCron && deliverAt === null) {
+    console.error('Specify when: --in <duration> (e.g. "2h", "30m"), --at <time> (e.g. "15:00"), or --cron <expression>');
+    process.exit(1);
+  }
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    // Determine target: --to flag or self
+    let targetSpec: string;
+    if (flags.to && flags.to !== "self") {
+      if (flags.to.startsWith("@") || flags.to === "*" || /^[0-9a-f]{64}$/i.test(flags.to)) {
+        targetSpec = flags.to;
+      } else {
+        const peers = await client.listPeers();
+        const match = peers.find((p) => p.displayName.toLowerCase() === flags.to!.toLowerCase());
+        if (!match) {
+          console.error(`Peer "${flags.to}" not found. Online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`);
+          process.exit(1);
+        }
+        targetSpec = match.pubkey;
+      }
+    } else {
+      targetSpec = client.getSessionPubkey() ?? "*";
+    }
+
+    const result = await client.scheduleMessage(targetSpec, message, deliverAt ?? 0, false, flags.cron);
+    if (!result) { console.error("✗ Broker did not acknowledge — check connection"); process.exit(1); }
+
+    if (flags.json) { console.log(JSON.stringify(result)); return; }
+    const toLabel = !flags.to || flags.to === "self" ? "yourself" : flags.to;
+    if (isCron) {
+      const nextFire = new Date(result.deliverAt).toLocaleString();
+      console.log(`✓ Recurring reminder set (${result.scheduledId.slice(0, 8)}): "${message}" → ${toLabel} — cron: ${flags.cron}, next fire: ${nextFire}`);
+    } else {
+      const when = new Date(result.deliverAt).toLocaleString();
+      console.log(`✓ Reminder set (${result.scheduledId.slice(0, 8)}): "${message}" → ${toLabel} at ${when}`);
+    }
+  });
+}

apps/cli/src/commands/send.ts

@@ -0,0 +1,51 @@
+/**
+ * `claudemesh send <to> <message>` — send a message to a peer or group.
+ *
+ * <to> can be:
+ *   - a display name  ("Mou")
+ *   - a pubkey hex    ("abc123...")
+ *   - @group          ("@flexicar")
+ *   - *               (broadcast to all)
+ */
+
+import { withMesh } from "./connect";
+import type { Priority } from "../ws/client";
+
+export interface SendFlags {
+  mesh?: string;
+  priority?: string;
+}
+
+export async function runSend(flags: SendFlags, to: string, message: string): Promise<void> {
+  const priority: Priority =
+    flags.priority === "now" ? "now"
+    : flags.priority === "low" ? "low"
+    : "next";
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    // Resolve display name → pubkey for direct messages.
+    // If `to` starts with @, *, or looks like a hex pubkey, use as-is.
+    let targetSpec = to;
+    if (!to.startsWith("@") && to !== "*" && !/^[0-9a-f]{64}$/i.test(to)) {
+      // Treat as display name — look up pubkey via list_peers.
+      const peers = await client.listPeers();
+      const match = peers.find(
+        (p) => p.displayName.toLowerCase() === to.toLowerCase(),
+      );
+      if (!match) {
+        const names = peers.map((p) => p.displayName).join(", ");
+        console.error(`Peer "${to}" not found. Online: ${names || "(none)"}`);
+        process.exit(1);
+      }
+      targetSpec = match.pubkey;
+    }
+
+    const result = await client.send(targetSpec, message, priority);
+    if (result.ok) {
+      console.log(`✓ Sent to ${to}${result.messageId ? ` (${result.messageId.slice(0, 8)})` : ""}`);
+    } else {
+      console.error(`✗ Send failed: ${result.error ?? "unknown error"}`);
+      process.exit(1);
+    }
+  });
+}

apps/cli/src/commands/state.ts

@@ -0,0 +1,75 @@
+/**
+ * `claudemesh state get <key>`    — read a shared state value
+ * `claudemesh state set <key> <value>` — write a shared state value
+ * `claudemesh state list`          — list all state entries
+ */
+
+import { withMesh } from "./connect";
+
+export interface StateFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runStateGet(flags: StateFlags, key: string): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const entry = await client.getState(key);
+    if (!entry) {
+      console.log(dim(`(not set)`));
+      return;
+    }
+    if (flags.json) {
+      console.log(JSON.stringify(entry, null, 2));
+      return;
+    }
+    const val = typeof entry.value === "string" ? entry.value : JSON.stringify(entry.value);
+    console.log(val);
+    console.log(dim(`  set by ${entry.updatedBy} at ${new Date(entry.updatedAt).toLocaleString()}`));
+  });
+}
+
+export async function runStateSet(flags: StateFlags, key: string, value: string): Promise<void> {
+  // Try to parse as JSON so numbers/booleans/objects work; fall back to string.
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    parsed = value;
+  }
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    await client.setState(key, parsed);
+    console.log(`✓ ${key} = ${JSON.stringify(parsed)}`);
+  });
+}
+
+export async function runStateList(flags: StateFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const entries = await client.listState();
+
+    if (flags.json) {
+      console.log(JSON.stringify(entries, null, 2));
+      return;
+    }
+
+    if (entries.length === 0) {
+      console.log(dim(`No state on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    for (const e of entries) {
+      const val = typeof e.value === "string" ? e.value : JSON.stringify(e.value);
+      console.log(`${bold(e.key)}: ${val}`);
+      console.log(dim(`  ${e.updatedBy} · ${new Date(e.updatedAt).toLocaleString()}`));
+    }
+  });
+}

apps/cli/src/crypto/file-crypto.ts

@@ -0,0 +1,90 @@
+/**
+ * File encryption for claudemesh E2E file sharing.
+ *
+ * Symmetric: crypto_secretbox_easy with random Kf (32-byte key).
+ * Key wrapping: crypto_box_seal to recipient's X25519 pub (converted from ed25519).
+ * Key opening: crypto_box_seal_open with own X25519 keypair.
+ */
+
+import { ensureSodium } from "./keypair";
+
+export interface EncryptedFile {
+  ciphertext: Uint8Array;  // secretbox ciphertext (includes MAC)
+  nonce: string;           // base64 24-byte nonce
+  key: Uint8Array;         // 32-byte symmetric Kf (keep in memory only)
+}
+
+/**
+ * Encrypt file bytes with a fresh random symmetric key.
+ * Returns ciphertext, nonce (base64), and the plaintext Kf.
+ */
+export async function encryptFile(plaintext: Uint8Array): Promise<EncryptedFile> {
+  const sodium = await ensureSodium();
+  const key = sodium.randombytes_buf(sodium.crypto_secretbox_KEYBYTES);
+  const nonce = sodium.randombytes_buf(sodium.crypto_secretbox_NONCEBYTES);
+  const ciphertext = sodium.crypto_secretbox_easy(plaintext, nonce, key);
+  return {
+    ciphertext,
+    nonce: sodium.to_base64(nonce, sodium.base64_variants.ORIGINAL),
+    key,
+  };
+}
+
+/**
+ * Decrypt file bytes with the symmetric key Kf.
+ * Returns null if decryption fails.
+ */
+export async function decryptFile(
+  ciphertext: Uint8Array,
+  nonceB64: string,
+  key: Uint8Array,
+): Promise<Uint8Array | null> {
+  const sodium = await ensureSodium();
+  try {
+    const nonce = sodium.from_base64(nonceB64, sodium.base64_variants.ORIGINAL);
+    return sodium.crypto_secretbox_open_easy(ciphertext, nonce, key);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Seal Kf for a recipient using crypto_box_seal (ephemeral sender key).
+ * recipientPubkeyHex: ed25519 pubkey of recipient (64 hex chars).
+ * Returns base64 sealed box.
+ */
+export async function sealKeyForPeer(
+  kf: Uint8Array,
+  recipientPubkeyHex: string,
+): Promise<string> {
+  const sodium = await ensureSodium();
+  const recipientCurve = sodium.crypto_sign_ed25519_pk_to_curve25519(
+    sodium.from_hex(recipientPubkeyHex),
+  );
+  const sealed = sodium.crypto_box_seal(kf, recipientCurve);
+  return sodium.to_base64(sealed, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Open a sealed key blob using own ed25519 keypair (converted to X25519).
+ * Returns the 32-byte Kf or null if decryption fails.
+ */
+export async function openSealedKey(
+  sealedB64: string,
+  myPubkeyHex: string,
+  mySecretKeyHex: string,
+): Promise<Uint8Array | null> {
+  const sodium = await ensureSodium();
+  try {
+    const myCurvePub = sodium.crypto_sign_ed25519_pk_to_curve25519(
+      sodium.from_hex(myPubkeyHex),
+    );
+    const myCurveSec = sodium.crypto_sign_ed25519_sk_to_curve25519(
+      sodium.from_hex(mySecretKeyHex),
+    );
+    const sealed = sodium.from_base64(sealedB64, sodium.base64_variants.ORIGINAL);
+    return sodium.crypto_box_seal_open(sealed, myCurvePub, myCurveSec);
+  } catch {
+    return null;
+  }
+}

apps/cli/src/env.ts

@@ -1,27 +1,23 @@
-import { z } from "zod";
-
 /**
  * CLI environment config.
  *
  * Read once at startup. Overridable via env vars so users can point
  * at a self-hosted broker or a staging instance without rebuilding.
  */
-const envSchema = z.object({
-  CLAUDEMESH_BROKER_URL: z.string().default("wss://ic.claudemesh.com/ws"),
-  CLAUDEMESH_CONFIG_DIR: z.string().optional(),
-  CLAUDEMESH_DEBUG: z.coerce.boolean().default(false),
-});
 
-export type CliEnv = z.infer<typeof envSchema>;
+export interface CliEnv {
+  CLAUDEMESH_BROKER_URL: string;
+  CLAUDEMESH_CONFIG_DIR: string | undefined;
+  CLAUDEMESH_DEBUG: boolean;
+}
 
 export function loadEnv(): CliEnv {
-  const parsed = envSchema.safeParse(process.env);
-  if (!parsed.success) {
-    console.error("[claudemesh] invalid environment:");
-    console.error(z.treeifyError(parsed.error));
-    process.exit(1);
-  }
-  return parsed.data;
+  return {
+    CLAUDEMESH_BROKER_URL:
+      process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
+    CLAUDEMESH_CONFIG_DIR: process.env.CLAUDEMESH_CONFIG_DIR || undefined,
+    CLAUDEMESH_DEBUG: process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true",
+  };
 }
 
 export const env = loadEnv();

apps/cli/src/index.ts

@@ -1,13 +1,15 @@
 /**
  * claudemesh-cli entry point.
  *
+ * Uses citty to define commands and flags. --help is generated from
+ * the command definitions — the flag list here IS the documentation.
+ *
  * Dispatches between two modes:
  *   - `claudemesh mcp`           → MCP server (stdio transport)
  *   - `claudemesh <subcommand>`  → CLI subcommand
- *
- * Claude Code invokes the `mcp` mode via stdio. Humans use all others.
  */
 
+import { defineCommand, runMain } from "citty";
 import { startMcpServer } from "./mcp/server";
 import { runInstall, runUninstall } from "./commands/install";
 import { runJoin } from "./commands/join";
@@ -19,95 +21,268 @@ import { runLaunch } from "./commands/launch";
 import { runStatus } from "./commands/status";
 import { runDoctor } from "./commands/doctor";
 import { runWelcome } from "./commands/welcome";
+import { runPeers } from "./commands/peers";
+import { runSend } from "./commands/send";
+import { runInbox } from "./commands/inbox";
+import { runStateGet, runStateSet, runStateList } from "./commands/state";
+import { runRemember, runRecall } from "./commands/memory";
+import { runInfo } from "./commands/info";
+import { runRemind } from "./commands/remind";
+import { runCreate } from "./commands/create";
 import { VERSION } from "./version";
 
-const HELP = `claudemesh v${VERSION} — peer mesh for Claude Code sessions
-
-Usage:
-  claudemesh <command> [args]
-
-Commands:
-  install         Register MCP + Stop/UserPromptSubmit status hooks
-                  (add --no-hooks for bare MCP registration)
-  uninstall       Remove MCP server + hooks
-  launch [args]   Launch Claude Code with real-time push messages enabled
-                  (add --quiet to skip the info banner; passes through
-                  extra flags, e.g. --model, --resume)
-  join <url>      Join a mesh via https://claudemesh.com/join/... URL
-  list            Show all joined meshes
-  leave <slug>    Leave a joined mesh
-  status          Health report: broker reachability per joined mesh
-  doctor          Diagnostic checks (install, config, keypairs, PATH)
-  seed-test-mesh  Dev-only: inject a mesh into config (skips invite flow)
-  mcp             Start MCP server (stdio) — invoked by Claude Code
-  --help, -h      Show this help
-  --version, -v   Show the CLI version
-
-Environment:
-  CLAUDEMESH_BROKER_URL    Override broker URL (default: wss://ic.claudemesh.com/ws)
-  CLAUDEMESH_CONFIG_DIR    Override config directory (default: ~/.claudemesh/)
-  CLAUDEMESH_DEBUG=1       Verbose logging
-`;
-
-const cmd = process.argv[2];
-const args = process.argv.slice(3);
-
-async function main(): Promise<void> {
-  switch (cmd) {
-    case "mcp":
-      await startMcpServer();
-      return;
-    case "install":
-      runInstall(args);
-      return;
-    case "uninstall":
-      runUninstall();
-      return;
-    case "hook":
-      await runHook(args);
-      return;
-    case "launch":
-      runLaunch(args);
-      return;
-    case "join":
-      await runJoin(args);
-      return;
-    case "list":
-      runList();
-      return;
-    case "leave":
-      runLeave(args);
-      return;
-    case "status":
-      await runStatus();
-      return;
-    case "doctor":
-      await runDoctor();
-      return;
-    case "seed-test-mesh":
-      runSeedTestMesh(args);
-      return;
-    case "--version":
-    case "-v":
-    case "version":
-      console.log(VERSION);
-      return;
-    case "--help":
-    case "-h":
-    case "help":
-      console.log(HELP);
-      return;
-    case undefined:
-      runWelcome();
-      return;
-    default:
-      console.error(`Unknown command: ${cmd}`);
-      console.error("Run `claudemesh --help` for usage.");
-      process.exit(1);
-  }
-}
-
-main().catch((e) => {
-  console.error(`claudemesh: ${e instanceof Error ? e.message : String(e)}`);
-  process.exit(1);
+const launch = defineCommand({
+  meta: {
+    name: "launch",
+    description: "Spawn a Claude Code session with mesh connectivity and MCP tools",
+  },
+  args: {
+    name: {
+      type: "string",
+      description: "Display name visible to other peers",
+    },
+    role: {
+      type: "string",
+      description: "Free-form role tag: `dev`, `lead`, `analyst`, etc",
+    },
+    groups: {
+      type: "string",
+      description: 'Groups to join as `group:role,...` — e.g. `"eng/frontend:lead,qa:member"`',
+    },
+    mesh: {
+      type: "string",
+      description: "Mesh slug (interactive picker if omitted and >1 joined)",
+    },
+    join: {
+      type: "string",
+      description: "Join a mesh via invite URL before launching",
+    },
+    "message-mode": {
+      type: "string",
+      description: '`"push"` (default) | `"inbox"` | `"off"` — how peer messages arrive',
+    },
+    "system-prompt": {
+      type: "string",
+      description: "Custom system prompt for this Claude session",
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the --dangerously-skip-permissions confirmation",
+      default: false,
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress banner and interactive prompts",
+      default: false,
+    },
+  },
+  run({ args, rawArgs }) {
+    // Forward to the existing launch runner, preserving -- passthrough to claude.
+    return runLaunch(args, rawArgs);
+  },
 });
+
+const install = defineCommand({
+  meta: {
+    name: "install",
+    description: "Register MCP server and status hooks with Claude Code",
+  },
+  args: {
+    "no-hooks": {
+      type: "boolean",
+      description: "Register MCP server only, skip hooks",
+      default: false,
+    },
+  },
+  run({ rawArgs }) {
+    runInstall(rawArgs);
+  },
+});
+
+const join = defineCommand({
+  meta: {
+    name: "join",
+    description: "Join a mesh via invite URL or token",
+  },
+  args: {
+    url: {
+      type: "positional",
+      description: "Invite URL (`https://claudemesh.com/join/...`) or token",
+      required: true,
+    },
+  },
+  run({ args }) {
+    return runJoin([args.url]);
+  },
+});
+
+const leave = defineCommand({
+  meta: {
+    name: "leave",
+    description: "Leave a joined mesh and remove its local keypair",
+  },
+  args: {
+    slug: {
+      type: "positional",
+      description: "Mesh slug to leave (see `claudemesh list`)",
+      required: true,
+    },
+  },
+  run({ args }) {
+    runLeave([args.slug]);
+  },
+});
+
+const main = defineCommand({
+  meta: {
+    name: "claudemesh",
+    version: VERSION,
+    description: "Peer mesh for Claude Code sessions",
+  },
+  subCommands: {
+    launch,
+    create: defineCommand({
+      meta: { name: "create", description: "Create a new mesh from a template" },
+      args: {
+        template: { type: "string", description: "Template name: `dev-team`, `research`, `ops-incident`, `simulation`, `personal`" },
+        "list-templates": { type: "boolean", description: "List available templates and exit", default: false },
+      },
+      run({ args }) { runCreate(args); },
+    }),
+    install,
+    uninstall: defineCommand({
+      meta: { name: "uninstall", description: "Remove MCP server and hooks from Claude Code config" },
+      run() { runUninstall(); },
+    }),
+    join,
+    list: defineCommand({
+      meta: { name: "list", description: "Show joined meshes, slugs, and local identities" },
+      run() { runList(); },
+    }),
+    leave,
+    peers: defineCommand({
+      meta: { name: "peers", description: "List online peers with status, summary, and groups" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runPeers(args); },
+    }),
+    send: defineCommand({
+      meta: { name: "send", description: "Send a message to a peer, group, or all peers" },
+      args: {
+        to: { type: "positional", description: "Recipient: display name, `@group`, `*` (broadcast), or pubkey hex", required: true },
+        message: { type: "positional", description: "Message text", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        priority: { type: "string", description: '`"now"` | `"next"` (default) | `"low"`' },
+      },
+      async run({ args }) { await runSend(args, args.to, args.message); },
+    }),
+    inbox: defineCommand({
+      meta: { name: "inbox", description: "Drain pending inbound messages" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+        wait: { type: "string", description: "Seconds to wait for broker delivery (default: `1`)" },
+      },
+      async run({ args }) {
+        await runInbox({ ...args, wait: args.wait ? parseInt(args.wait, 10) : undefined });
+      },
+    }),
+    state: defineCommand({
+      meta: { name: "state", description: "Get, set, or list shared key-value state in the mesh" },
+      args: {
+        action: { type: "positional", description: "`get <key>` | `set <key> <value>` | `list`", required: true },
+        key: { type: "positional", description: "State key (required for `get` and `set`)" },
+        value: { type: "positional", description: "Value to store (required for `set`)" },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) {
+        if (args.action === "list") {
+          await runStateList(args);
+        } else if (args.action === "get") {
+          if (!args.key) { console.error("Usage: claudemesh state get <key>"); process.exit(1); }
+          await runStateGet(args, args.key);
+        } else if (args.action === "set") {
+          if (!args.key || !args.value) { console.error("Usage: claudemesh state set <key> <value>"); process.exit(1); }
+          await runStateSet(args, args.key, args.value);
+        } else {
+          console.error(`Unknown action "${args.action}". Use: get, set, list`);
+          process.exit(1);
+        }
+      },
+    }),
+    info: defineCommand({
+      meta: { name: "info", description: "Show mesh overview: slug, broker, peer count, state keys" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runInfo(args); },
+    }),
+    remember: defineCommand({
+      meta: { name: "remember", description: "Store a persistent memory visible to all peers" },
+      args: {
+        content: { type: "positional", description: "Text to store", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        tags: { type: "string", description: "Comma-separated tags, e.g. `task,context`" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runRemember(args, args.content); },
+    }),
+    recall: defineCommand({
+      meta: { name: "recall", description: "Search mesh memories by keyword or phrase" },
+      args: {
+        query: { type: "positional", description: "Full-text search query", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runRecall(args, args.query); },
+    }),
+    remind: defineCommand({
+      meta: { name: "remind", description: "Schedule a delayed message. Also: `remind list`, `remind cancel <id>`" },
+      args: {
+        message: { type: "positional", description: "Message text — or `list` / `cancel <id>` to manage reminders", required: false },
+        extra: { type: "positional", description: "Reminder ID for `cancel`", required: false },
+        in: { type: "string", description: 'Deliver after duration: `"2h"`, `"30m"`, `"90s"`' },
+        at: { type: "string", description: 'Deliver at time: `"15:00"` or ISO timestamp' },
+        cron: { type: "string", description: 'Recurring cron expression: `"0 */2 * * *"` (every 2h), `"30 9 * * 1-5"` (9:30 weekdays)' },
+        to: { type: "string", description: "Recipient (default: self). Name, `@group`, `*`, or pubkey" },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args, rawArgs }) {
+        // Collect positional args from rawArgs (before any flags)
+        const positionals = rawArgs.filter((a) => !a.startsWith("-"));
+        await runRemind(args, positionals);
+      },
+    }),
+    status: defineCommand({
+      meta: { name: "status", description: "Check broker connectivity for each joined mesh" },
+      async run() { await runStatus(); },
+    }),
+    doctor: defineCommand({
+      meta: { name: "doctor", description: "Diagnose install, config, keypairs, and PATH issues" },
+      async run() { await runDoctor(); },
+    }),
+    mcp: defineCommand({
+      meta: { name: "mcp", description: "Start MCP server on stdio (called by Claude Code, not users)" },
+      async run() { await startMcpServer(); },
+    }),
+    "seed-test-mesh": defineCommand({
+      meta: { name: "seed-test-mesh", description: "Dev: inject a mesh into local config, skip invite flow" },
+      run({ rawArgs }) { runSeedTestMesh(rawArgs); },
+    }),
+    hook: defineCommand({
+      meta: { name: "hook", description: "Internal: handle Claude Code hook events" },
+      async run({ rawArgs }) { await runHook(rawArgs); },
+    }),
+  },
+  run() {
+    runWelcome();
+  },
+});
+
+runMain(main);

apps/cli/src/invite/parse.ts

@@ -5,22 +5,19 @@
  * verification and one-time-use invite-token tracking land in Step 18.
  */
 
-import { z } from "zod";
 import { ensureSodium } from "../crypto/keypair";
 
-const invitePayloadSchema = z.object({
-  v: z.literal(1),
-  mesh_id: z.string().min(1),
-  mesh_slug: z.string().min(1),
-  broker_url: z.string().min(1),
-  expires_at: z.number().int().positive(),
-  mesh_root_key: z.string().min(1),
-  role: z.enum(["admin", "member"]),
-  owner_pubkey: z.string().regex(/^[0-9a-f]{64}$/i),
-  signature: z.string().regex(/^[0-9a-f]{128}$/i),
-});
-
-export type InvitePayload = z.infer<typeof invitePayloadSchema>;
+export interface InvitePayload {
+  v: 1;
+  mesh_id: string;
+  mesh_slug: string;
+  broker_url: string;
+  expires_at: number;
+  mesh_root_key: string;
+  role: "admin" | "member";
+  owner_pubkey: string;
+  signature: string;
+}
 
 export interface ParsedInvite {
   payload: InvitePayload;
@@ -28,6 +25,21 @@ export interface ParsedInvite {
   token: string; // base64url(JSON) — DB lookup key (everything after ic://join/)
 }
 
+function validatePayload(obj: unknown): InvitePayload {
+  if (!obj || typeof obj !== "object") throw new Error("invite payload is not an object");
+  const o = obj as Record<string, unknown>;
+  if (o.v !== 1) throw new Error("invite payload: v must be 1");
+  if (typeof o.mesh_id !== "string" || !o.mesh_id) throw new Error("invite payload: mesh_id required");
+  if (typeof o.mesh_slug !== "string" || !o.mesh_slug) throw new Error("invite payload: mesh_slug required");
+  if (typeof o.broker_url !== "string" || !o.broker_url) throw new Error("invite payload: broker_url required");
+  if (typeof o.expires_at !== "number" || o.expires_at <= 0) throw new Error("invite payload: expires_at must be a positive number");
+  if (typeof o.mesh_root_key !== "string" || !o.mesh_root_key) throw new Error("invite payload: mesh_root_key required");
+  if (o.role !== "admin" && o.role !== "member") throw new Error("invite payload: role must be admin or member");
+  if (typeof o.owner_pubkey !== "string" || !/^[0-9a-f]{64}$/i.test(o.owner_pubkey)) throw new Error("invite payload: owner_pubkey must be 64 hex chars");
+  if (typeof o.signature !== "string" || !/^[0-9a-f]{128}$/i.test(o.signature)) throw new Error("invite payload: signature must be 128 hex chars");
+  return o as unknown as InvitePayload;
+}
+
 /** Canonical invite bytes — must match broker's canonicalInvite(). */
 export function canonicalInvite(p: {
   v: number;
@@ -96,41 +108,34 @@ export async function parseInviteLink(link: string): Promise<ParsedInvite> {
     );
   }
 
-  const parsed = invitePayloadSchema.safeParse(obj);
-  if (!parsed.success) {
-    throw new Error(
-      `invite link shape invalid: ${parsed.error.issues.map((i) => i.path.join(".") + ": " + i.message).join("; ")}`,
-    );
-  }
+  const payload = validatePayload(obj);
 
   // Expiry check (unix seconds).
   const nowSeconds = Math.floor(Date.now() / 1000);
-  if (parsed.data.expires_at < nowSeconds) {
+  if (payload.expires_at < nowSeconds) {
     throw new Error(
-      `invite expired: expires_at=${parsed.data.expires_at}, now=${nowSeconds}`,
+      `invite expired: expires_at=${payload.expires_at}, now=${nowSeconds}`,
     );
   }
 
   // Verify the ed25519 signature against the embedded owner_pubkey.
-  // Client-side verification gives immediate feedback on tampered
-  // links; broker re-verifies authoritatively on /join.
   const s = await ensureSodium();
   const canonical = canonicalInvite({
-    v: parsed.data.v,
-    mesh_id: parsed.data.mesh_id,
-    mesh_slug: parsed.data.mesh_slug,
-    broker_url: parsed.data.broker_url,
-    expires_at: parsed.data.expires_at,
-    mesh_root_key: parsed.data.mesh_root_key,
-    role: parsed.data.role,
-    owner_pubkey: parsed.data.owner_pubkey,
+    v: payload.v,
+    mesh_id: payload.mesh_id,
+    mesh_slug: payload.mesh_slug,
+    broker_url: payload.broker_url,
+    expires_at: payload.expires_at,
+    mesh_root_key: payload.mesh_root_key,
+    role: payload.role,
+    owner_pubkey: payload.owner_pubkey,
   });
   const sigOk = (() => {
     try {
       return s.crypto_sign_verify_detached(
-        s.from_hex(parsed.data.signature),
+        s.from_hex(payload.signature),
         s.from_string(canonical),
-        s.from_hex(parsed.data.owner_pubkey),
+        s.from_hex(payload.owner_pubkey),
       );
     } catch {
       return false;
@@ -140,7 +145,7 @@ export async function parseInviteLink(link: string): Promise<ParsedInvite> {
     throw new Error("invite signature invalid (link tampered?)");
   }
 
-  return { payload: parsed.data, raw: link, token: encoded };
+  return { payload, raw: link, token: encoded };
 }
 
 /**
@@ -155,8 +160,6 @@ export function encodeInviteLink(payload: InvitePayload): string {
 
 /**
  * Sign and assemble an invite payload → ic://join/... link.
- * The canonical bytes (everything except signature) are signed with
- * the mesh owner's ed25519 secret key.
  */
 export async function buildSignedInvite(args: {
   v: 1;

apps/cli/src/mcp/tools.ts

@@ -12,13 +12,16 @@ export const TOOLS: Tool[] = [
   {
     name: "send_message",
     description:
-      "Send a message to a peer in one of your joined meshes. `to` is a peer display name, hex pubkey, or `#channel`. `priority` controls delivery: `now` bypasses busy gates, `next` waits for idle (default), `low` is pull-only.",
+      "Send a message to a peer in one of your joined meshes. `to` can be a peer display name (resolved via list_peers), hex pubkey, @group, `#channel`, or `*` for broadcast. `priority` controls delivery: `now` bypasses busy gates, `next` waits for idle (default), `low` is pull-only.",
     inputSchema: {
       type: "object",
       properties: {
         to: {
-          type: "string",
-          description: "Peer name, pubkey, or #channel",
+          oneOf: [
+            { type: "string", description: "Peer name, pubkey, @group" },
+            { type: "array", items: { type: "string" }, description: "Multiple targets" },
+          ],
+          description: "Single target or array of targets",
         },
         message: { type: "string", description: "Message text" },
         priority: {
@@ -44,6 +47,21 @@ export const TOOLS: Tool[] = [
       },
     },
   },
+  {
+    name: "message_status",
+    description:
+      "Check the delivery status of a sent message. Shows whether each recipient received it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: {
+          type: "string",
+          description: "Message ID (returned by send_message)",
+        },
+      },
+      required: ["id"],
+    },
+  },
   {
     name: "check_messages",
     description:
@@ -78,4 +96,797 @@ export const TOOLS: Tool[] = [
       required: ["status"],
     },
   },
+  {
+    name: "set_visible",
+    description:
+      "Control your visibility in the mesh. When hidden, you won't appear in list_peers and won't receive broadcasts — but direct messages still reach you.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        visible: {
+          type: "boolean",
+          description: "true to be visible (default), false to hide",
+        },
+      },
+      required: ["visible"],
+    },
+  },
+  {
+    name: "set_profile",
+    description:
+      "Set your public profile — what other peers see about you. Avatar (emoji), title, bio, and capabilities list.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        avatar: {
+          type: "string",
+          description: "Emoji or URL for your avatar",
+        },
+        title: {
+          type: "string",
+          description: "Short role label (e.g. 'Frontend Lead', 'DevOps')",
+        },
+        bio: {
+          type: "string",
+          description: "One-liner about yourself",
+        },
+        capabilities: {
+          type: "array",
+          items: { type: "string" },
+          description: "What you can help with",
+        },
+      },
+    },
+  },
+  {
+    name: "join_group",
+    description:
+      "Join a group with an optional role. Other peers see your group membership in list_peers.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Group name (without @)" },
+        role: {
+          type: "string",
+          description: "Your role in the group (e.g. lead, member, observer)",
+        },
+      },
+      required: ["name"],
+    },
+  },
+  {
+    name: "leave_group",
+    description: "Leave a group.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Group name (without @)" },
+      },
+      required: ["name"],
+    },
+  },
+
+  // --- State tools ---
+  {
+    name: "set_state",
+    description:
+      "Set a shared state value visible to all peers in the mesh. Pushes a change notification.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string" },
+        value: { description: "Any JSON value" },
+      },
+      required: ["key", "value"],
+    },
+  },
+  {
+    name: "get_state",
+    description: "Read a shared state value.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string" },
+      },
+      required: ["key"],
+    },
+  },
+  {
+    name: "list_state",
+    description: "List all shared state keys and values in the mesh.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Memory tools ---
+  {
+    name: "remember",
+    description:
+      "Store persistent knowledge in the mesh's shared memory. Survives across sessions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        content: {
+          type: "string",
+          description: "The knowledge to remember",
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Optional categorization tags",
+        },
+      },
+      required: ["content"],
+    },
+  },
+  {
+    name: "recall",
+    description: "Search the mesh's shared memory by relevance.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Search query" },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "forget",
+    description: "Remove a memory from the mesh's shared knowledge.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Memory ID to forget" },
+      },
+      required: ["id"],
+    },
+  },
+
+  // --- File tools ---
+  {
+    name: "share_file",
+    description:
+      "Share a persistent file with the mesh. All current and future peers can access it. If `to` is specified, the file is E2E encrypted and only accessible to that peer (and you).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Local file path to share" },
+        name: {
+          type: "string",
+          description: "Display name (defaults to filename)",
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags for categorization",
+        },
+        to: {
+          type: "string",
+          description: "Peer display name or pubkey hex — if set, file is E2E encrypted for this peer only",
+        },
+      },
+      required: ["path"],
+    },
+  },
+  {
+    name: "get_file",
+    description: "Download a shared file to a local path.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "File ID" },
+        save_to: {
+          type: "string",
+          description: "Local path to save the file",
+        },
+      },
+      required: ["id", "save_to"],
+    },
+  },
+  {
+    name: "list_files",
+    description: "List files shared in the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Search by name or tags" },
+        from: { type: "string", description: "Filter by uploader name" },
+      },
+    },
+  },
+  {
+    name: "file_status",
+    description: "Check who has accessed a shared file.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "File ID" },
+      },
+      required: ["id"],
+    },
+  },
+  {
+    name: "delete_file",
+    description: "Remove a shared file from the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "File ID" },
+      },
+      required: ["id"],
+    },
+  },
+  {
+    name: "grant_file_access",
+    description: "Grant a peer access to an E2E encrypted file you shared. You must be the owner.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        fileId: { type: "string", description: "File ID" },
+        to: { type: "string", description: "Peer display name or pubkey hex to grant access to" },
+      },
+      required: ["fileId", "to"],
+    },
+  },
+
+  // --- Vector tools ---
+  {
+    name: "vector_store",
+    description:
+      "Store an embedding in a per-mesh Qdrant collection. Auto-creates the collection on first use.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        collection: { type: "string", description: "Collection name" },
+        text: { type: "string", description: "Text to embed and store" },
+        metadata: {
+          type: "object",
+          description: "Optional metadata to attach",
+        },
+      },
+      required: ["collection", "text"],
+    },
+  },
+  {
+    name: "vector_search",
+    description: "Semantic search over stored embeddings in a collection.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        collection: { type: "string", description: "Collection name" },
+        query: { type: "string", description: "Search query text" },
+        limit: {
+          type: "number",
+          description: "Max results (default: 10)",
+        },
+      },
+      required: ["collection", "query"],
+    },
+  },
+  {
+    name: "vector_delete",
+    description: "Remove an embedding from a collection.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        collection: { type: "string", description: "Collection name" },
+        id: { type: "string", description: "Embedding ID to delete" },
+      },
+      required: ["collection", "id"],
+    },
+  },
+  {
+    name: "list_collections",
+    description: "List vector collections in this mesh.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Graph tools ---
+  {
+    name: "graph_query",
+    description:
+      "Run a read-only Cypher query on the per-mesh Neo4j database.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        cypher: { type: "string", description: "Cypher MATCH query" },
+      },
+      required: ["cypher"],
+    },
+  },
+  {
+    name: "graph_execute",
+    description:
+      "Run a write Cypher query (CREATE, MERGE, DELETE) on the per-mesh Neo4j database.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        cypher: { type: "string", description: "Cypher write query" },
+      },
+      required: ["cypher"],
+    },
+  },
+
+  // --- Mesh Database tools ---
+  {
+    name: "mesh_query",
+    description:
+      "Run a SELECT query on the per-mesh shared database.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        sql: { type: "string", description: "SQL SELECT query" },
+      },
+      required: ["sql"],
+    },
+  },
+  {
+    name: "mesh_execute",
+    description:
+      "Run DDL/DML on the per-mesh database (CREATE TABLE, INSERT, UPDATE, DELETE).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        sql: { type: "string", description: "SQL statement" },
+      },
+      required: ["sql"],
+    },
+  },
+  {
+    name: "mesh_schema",
+    description:
+      "List tables and columns in the per-mesh shared database.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Stream tools ---
+  {
+    name: "create_stream",
+    description:
+      "Create a real-time data stream in the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Stream name" },
+      },
+      required: ["name"],
+    },
+  },
+  {
+    name: "publish",
+    description:
+      "Push data to a stream. Subscribers receive it in real-time.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        stream: { type: "string", description: "Stream name" },
+        data: { description: "Any JSON data to publish" },
+      },
+      required: ["stream", "data"],
+    },
+  },
+  {
+    name: "subscribe",
+    description:
+      "Subscribe to a stream. Data pushes arrive as channel notifications.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        stream: { type: "string", description: "Stream name" },
+      },
+      required: ["stream"],
+    },
+  },
+  {
+    name: "list_streams",
+    description:
+      "List active streams in the mesh.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Context tools ---
+  {
+    name: "share_context",
+    description:
+      "Share your session understanding with the mesh. Call after exploring a codebase area.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        summary: {
+          type: "string",
+          description: "Summary of what you explored/learned",
+        },
+        files_read: {
+          type: "array",
+          items: { type: "string" },
+          description: "File paths you read",
+        },
+        key_findings: {
+          type: "array",
+          items: { type: "string" },
+          description: "Key findings or insights",
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags for categorization",
+        },
+      },
+      required: ["summary"],
+    },
+  },
+  {
+    name: "get_context",
+    description:
+      "Find context from peers who explored an area. Check before re-reading files another peer already analyzed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Search query (file path, topic, etc.)",
+        },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "list_contexts",
+    description: "See what all peers currently know about the codebase.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Task tools ---
+  {
+    name: "create_task",
+    description: "Create a work item for the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Task title" },
+        assignee: {
+          type: "string",
+          description: "Peer name to assign (optional)",
+        },
+        priority: {
+          type: "string",
+          enum: ["low", "normal", "high", "urgent"],
+          description: "Priority level (default: normal)",
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags for categorization",
+        },
+      },
+      required: ["title"],
+    },
+  },
+  {
+    name: "claim_task",
+    description: "Claim an unclaimed task to take ownership.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Task ID" },
+      },
+      required: ["id"],
+    },
+  },
+  {
+    name: "complete_task",
+    description: "Mark a task as done with an optional result summary.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Task ID" },
+        result: {
+          type: "string",
+          description: "Summary of what was done",
+        },
+      },
+      required: ["id"],
+    },
+  },
+  {
+    name: "list_tasks",
+    description: "List tasks filtered by status and/or assignee.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        status: {
+          type: "string",
+          enum: ["open", "claimed", "completed"],
+          description: "Filter by status",
+        },
+        assignee: {
+          type: "string",
+          description: "Filter by assignee name",
+        },
+      },
+    },
+  },
+
+  // --- Scheduled messages ---
+  {
+    name: "schedule_reminder",
+    description:
+      "Schedule a one-shot or recurring message. Without `to`, it fires back to yourself (a self-reminder). With `to`, it delivers to a peer, @group, or * broadcast. For one-shot, provide `deliver_at` or `in_seconds`. For recurring, provide `cron` (standard 5-field expression). The broker persists schedules to the database — they survive restarts. Receivers see `subtype: reminder` in the push envelope.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        message: { type: "string", description: "Message or reminder text" },
+        deliver_at: { type: "number", description: "Unix timestamp (ms) when to deliver (one-shot)" },
+        in_seconds: { type: "number", description: "Alternative to deliver_at: fire after N seconds (one-shot)" },
+        cron: { type: "string", description: "Cron expression for recurring reminders (e.g. '0 */2 * * *' for every 2 hours, '30 9 * * 1-5' for 9:30 weekdays)" },
+        to: {
+          type: "string",
+          description: "Recipient: display name, pubkey hex, @group, or * (omit for self-reminder)",
+        },
+      },
+      required: ["message"],
+    },
+  },
+  {
+    name: "list_scheduled",
+    description: "List all your pending scheduled messages: id, recipient, preview, and delivery time.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "cancel_scheduled",
+    description: "Cancel a pending scheduled message before it fires.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Scheduled message ID" },
+      },
+      required: ["id"],
+    },
+  },
+
+  // --- Mesh info ---
+  {
+    name: "mesh_info",
+    description:
+      "Get a complete overview of the mesh: peers, groups, state, memory, files, tasks, streams, tables. Call on session start for full situational awareness.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Stats ---
+  {
+    name: "mesh_stats",
+    description:
+      "View resource usage stats for all peers: messages sent/received, tool calls, uptime, errors.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- MCP Proxy ---
+  {
+    name: "mesh_mcp_register",
+    description:
+      "Register an MCP server with the mesh. Other peers can invoke its tools through the mesh without restarting their sessions. Provide the server name, description, and full tool definitions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        server_name: { type: "string", description: "Unique name for the MCP server (e.g. 'github', 'jira')" },
+        description: { type: "string", description: "What this MCP server does" },
+        tools: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string" },
+              description: { type: "string" },
+              inputSchema: { type: "object", description: "JSON Schema for tool arguments" },
+            },
+            required: ["name", "description", "inputSchema"],
+          },
+          description: "Tool definitions to expose",
+        },
+      },
+      required: ["server_name", "description", "tools"],
+    },
+  },
+  {
+    name: "mesh_mcp_list",
+    description:
+      "List MCP servers available in the mesh with their tools. Shows which peer hosts each server.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "mesh_tool_call",
+    description:
+      "Call a tool on a mesh-registered MCP server. Route: you -> broker -> hosting peer -> execute -> result back. Timeout: 30s.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        server_name: { type: "string", description: "Name of the MCP server" },
+        tool_name: { type: "string", description: "Name of the tool to call" },
+        args: { type: "object", description: "Tool arguments (JSON object)" },
+      },
+      required: ["server_name", "tool_name"],
+    },
+  },
+  {
+    name: "mesh_mcp_remove",
+    description:
+      "Unregister an MCP server you previously registered with the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        server_name: { type: "string", description: "Name of the MCP server to remove" },
+      },
+      required: ["server_name"],
+    },
+  },
+
+
+  // --- Simulation clock tools ---
+  {
+    name: "mesh_set_clock",
+    description:
+      "Set the simulation clock speed. x1 = real-time, x10 = 10x faster, x100 = 100x. Peers receive heartbeat ticks at the simulated rate.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        speed: {
+          type: "number",
+          description: "Speed multiplier (1-100). x1 = tick every 60s, x10 = tick every 6s, x100 = tick every 600ms.",
+        },
+      },
+      required: ["speed"],
+    },
+  },
+  {
+    name: "mesh_pause_clock",
+    description:
+      "Pause the simulation clock. Ticks stop until resumed.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "mesh_resume_clock",
+    description:
+      "Resume a paused simulation clock.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "mesh_clock",
+    description:
+      "Get current simulation clock status: speed, tick count, simulated time.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Skills ---
+  {
+    name: "share_skill",
+    description:
+      "Publish a reusable skill to the mesh. Other peers can discover and load it. If a skill with the same name exists, it is updated.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Unique skill name (e.g. 'code-review', 'deploy-checklist')" },
+        description: { type: "string", description: "Short description of what the skill does" },
+        instructions: { type: "string", description: "Full instructions/prompt that a peer loads to acquire this capability" },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags for discoverability",
+        },
+      },
+      required: ["name", "description", "instructions"],
+    },
+  },
+  {
+    name: "get_skill",
+    description:
+      "Load a skill's full instructions by name. Use to acquire capabilities shared by other peers.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Skill name to load" },
+      },
+      required: ["name"],
+    },
+  },
+  {
+    name: "list_skills",
+    description:
+      "Browse available skills in the mesh. Optionally filter by keyword across name, description, and tags.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Search keyword (optional)" },
+      },
+    },
+  },
+  {
+    name: "remove_skill",
+    description:
+      "Remove a skill you published from the mesh.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Skill name to remove" },
+      },
+      required: ["name"],
+    },
+  },
+
+  // --- Diagnostics ---
+  {
+    name: "ping_mesh",
+    description:
+      "Send test messages through the full pipeline and measure round-trip timing per priority. Diagnoses push delivery issues.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        priorities: {
+          type: "array",
+          items: { type: "string", enum: ["now", "next", "low"] },
+          description: "Priorities to test (default: [\"now\", \"next\"])",
+        },
+      },
+    },
+  },
+
+  // --- Peer file sharing ---
+  {
+    name: "read_peer_file",
+    description:
+      "Read a file from another peer's project. Specify the peer (by name) and the file path relative to their working directory. The peer must be online and sharing files. Max file size: 1MB.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        peer: { type: "string", description: "Peer display name or pubkey" },
+        path: { type: "string", description: "File path relative to peer's working directory" },
+      },
+      required: ["peer", "path"],
+    },
+  },
+  {
+    name: "list_peer_files",
+    description:
+      "List files in a peer's shared directory. Returns a tree of file names (not contents). The peer must be online and sharing files.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        peer: { type: "string", description: "Peer display name or pubkey" },
+        path: { type: "string", description: "Directory path relative to peer's cwd (default: root)" },
+        pattern: { type: "string", description: "Glob-like filter pattern (e.g. '*.ts', 'src/*')" },
+      },
+      required: ["peer"],
+    },
+  },
+
+  // --- Webhooks ---
+  {
+    name: "create_webhook",
+    description:
+      "Create an inbound webhook. Returns a URL that external services (GitHub, CI/CD, monitoring) can POST to — the payload becomes a mesh message to all peers.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Webhook name (e.g. 'github-ci', 'datadog-alerts')",
+        },
+      },
+      required: ["name"],
+    },
+  },
+  {
+    name: "list_webhooks",
+    description: "List active webhooks for this mesh.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "delete_webhook",
+    description: "Deactivate a webhook.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Webhook name to deactivate" },
+      },
+      required: ["name"],
+    },
+  },
 ];

apps/cli/src/mcp/types.ts

@@ -6,7 +6,7 @@ export type Priority = "now" | "next" | "low";
 export type PeerStatus = "idle" | "working" | "dnd";
 
 export interface SendMessageArgs {
-  to: string; // peer name, pubkey, or #channel
+  to: string | string[]; // peer name, pubkey, @group, or array of targets
   message: string;
   priority?: Priority;
 }

apps/cli/src/state/config.ts

@@ -15,38 +15,47 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
-import { z } from "zod";
 import { env } from "../env";
 
-const joinedMeshSchema = z.object({
-  meshId: z.string(),
-  memberId: z.string(),
-  slug: z.string(),
-  name: z.string(),
-  pubkey: z.string(), // ed25519 hex (32 bytes = 64 chars)
-  secretKey: z.string(), // ed25519 hex (64 bytes = 128 chars)
-  brokerUrl: z.string(),
-  joinedAt: z.string(),
-});
+export interface JoinedMesh {
+  meshId: string;
+  memberId: string;
+  slug: string;
+  name: string;
+  pubkey: string; // ed25519 hex (32 bytes = 64 chars)
+  secretKey: string; // ed25519 hex (64 bytes = 128 chars)
+  brokerUrl: string;
+  joinedAt: string;
+}
 
-const configSchema = z.object({
-  version: z.literal(1).default(1),
-  meshes: z.array(joinedMeshSchema).default([]),
-});
+export interface GroupEntry {
+  name: string;
+  role?: string;
+}
 
-export type JoinedMesh = z.infer<typeof joinedMeshSchema>;
-export type Config = z.infer<typeof configSchema>;
+export interface Config {
+  version: 1;
+  meshes: JoinedMesh[];
+  displayName?: string; // per-session override, written by `claudemesh launch --name`
+  role?: string;        // per-session role tag (display + hello)
+  groups?: GroupEntry[];
+  messageMode?: "push" | "inbox" | "off";
+}
 
 const CONFIG_DIR = env.CLAUDEMESH_CONFIG_DIR ?? join(homedir(), ".claudemesh");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 
 export function loadConfig(): Config {
   if (!existsSync(CONFIG_PATH)) {
-    return configSchema.parse({ version: 1, meshes: [] });
+    return { version: 1, meshes: [] };
   }
   try {
     const raw = readFileSync(CONFIG_PATH, "utf-8");
-    return configSchema.parse(JSON.parse(raw));
+    const parsed = JSON.parse(raw);
+    if (!parsed || !Array.isArray(parsed.meshes)) {
+      return { version: 1, meshes: [] };
+    }
+    return { version: 1, meshes: parsed.meshes, displayName: parsed.displayName, role: parsed.role, groups: parsed.groups, messageMode: parsed.messageMode };
   } catch (e) {
     throw new Error(
       `Failed to load ${CONFIG_PATH}: ${e instanceof Error ? e.message : String(e)}`,

apps/cli/src/templates/dev-team.json

@@ -0,0 +1,17 @@
+{
+  "name": "dev-team",
+  "description": "Software development team with frontend, backend, and devops groups",
+  "groups": [
+    { "name": "frontend", "roles": ["lead", "member"] },
+    { "name": "backend", "roles": ["lead", "member"] },
+    { "name": "devops", "roles": ["lead", "member"] },
+    { "name": "qa", "roles": ["lead", "member"] }
+  ],
+  "stateKeys": {
+    "sprint": "current",
+    "deploy-frozen": "false",
+    "pr-queue": "[]"
+  },
+  "suggestedRoles": ["lead", "member", "reviewer"],
+  "systemPromptHint": "You are part of a dev team. Coordinate with @frontend, @backend, @devops groups. Check state keys for sprint status and deploy freezes before making changes."
+}

apps/cli/src/templates/index.ts

@@ -0,0 +1,30 @@
+import devTeam from "./dev-team.json" with { type: "json" };
+import research from "./research.json" with { type: "json" };
+import opsIncident from "./ops-incident.json" with { type: "json" };
+import simulation from "./simulation.json" with { type: "json" };
+import personal from "./personal.json" with { type: "json" };
+
+export interface MeshTemplate {
+  name: string;
+  description: string;
+  groups: Array<{ name: string; roles: string[] }>;
+  stateKeys: Record<string, string>;
+  suggestedRoles: string[];
+  systemPromptHint: string;
+}
+
+export const TEMPLATES: Record<string, MeshTemplate> = {
+  "dev-team": devTeam,
+  research,
+  "ops-incident": opsIncident,
+  simulation,
+  personal,
+};
+
+export function listTemplates(): MeshTemplate[] {
+  return Object.values(TEMPLATES);
+}
+
+export function getTemplate(name: string): MeshTemplate | undefined {
+  return TEMPLATES[name];
+}

apps/cli/src/templates/ops-incident.json

@@ -0,0 +1,17 @@
+{
+  "name": "ops-incident",
+  "description": "Incident response team with oncall, comms, and engineering groups",
+  "groups": [
+    { "name": "oncall", "roles": ["primary", "secondary"] },
+    { "name": "comms", "roles": ["lead", "scribe"] },
+    { "name": "engineering", "roles": ["lead", "responder"] }
+  ],
+  "stateKeys": {
+    "incident-status": "investigating",
+    "severity": "unknown",
+    "commander": "",
+    "timeline": "[]"
+  },
+  "suggestedRoles": ["commander", "primary-oncall", "scribe", "responder"],
+  "systemPromptHint": "INCIDENT MODE. Priority: now for all messages. Update incident-status state. Commander coordinates. Scribe maintains timeline. Engineering fixes."
+}

apps/cli/src/templates/personal.json

@@ -0,0 +1,11 @@
+{
+  "name": "personal",
+  "description": "Private mesh for a single user — all sessions auto-join",
+  "groups": [],
+  "stateKeys": {
+    "focus": "",
+    "todos": "[]"
+  },
+  "suggestedRoles": [],
+  "systemPromptHint": "Personal workspace. All your Claude Code sessions share this mesh. Use state keys to track focus and todos across sessions."
+}

apps/cli/src/templates/research.json

@@ -0,0 +1,16 @@
+{
+  "name": "research",
+  "description": "Research and analysis team focused on deep investigation and knowledge sharing",
+  "groups": [
+    { "name": "analysis", "roles": ["lead", "analyst"] },
+    { "name": "writing", "roles": ["lead", "writer", "reviewer"] },
+    { "name": "data", "roles": ["engineer", "analyst"] }
+  ],
+  "stateKeys": {
+    "research-topic": "",
+    "phase": "exploration",
+    "findings-count": "0"
+  },
+  "suggestedRoles": ["lead", "analyst", "writer", "reviewer"],
+  "systemPromptHint": "You are part of a research team. Share findings via remember(), use recall() before starting new analysis. Coordinate phases through state keys."
+}

apps/cli/src/templates/simulation.json

@@ -0,0 +1,17 @@
+{
+  "name": "simulation",
+  "description": "Load testing simulation with configurable time multiplier and user personas",
+  "groups": [
+    { "name": "personas", "roles": ["admin", "user", "customer"] },
+    { "name": "observers", "roles": ["monitor", "analyst"] },
+    { "name": "control", "roles": ["orchestrator"] }
+  ],
+  "stateKeys": {
+    "clock-speed": "x1",
+    "sim-status": "paused",
+    "tick-count": "0",
+    "scenario": ""
+  },
+  "suggestedRoles": ["orchestrator", "persona", "monitor"],
+  "systemPromptHint": "SIMULATION MODE. Follow the clock-speed state for time multiplier. Act according to your persona role and the simulated time. Report actions to @observers."
+}

apps/cli/src/ws/manager.ts

@@ -11,15 +11,21 @@ import type { Config, JoinedMesh } from "../state/config";
 import { env } from "../env";
 
 const clients = new Map<string, BrokerClient>();
+let configDisplayName: string | undefined;
+let configGroups: Config["groups"] = [];
 
 /** Ensure a BrokerClient exists + is connecting/open for this mesh. */
 export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
   const existing = clients.get(mesh.meshId);
   if (existing) return existing;
-  const client = new BrokerClient(mesh, { debug: env.CLAUDEMESH_DEBUG });
+  const client = new BrokerClient(mesh, { debug: env.CLAUDEMESH_DEBUG, displayName: configDisplayName });
   clients.set(mesh.meshId, client);
   try {
     await client.connect();
+    // Auto-join groups declared at launch time (--groups flag or config).
+    for (const g of configGroups ?? []) {
+      try { await client.joinGroup(g.name, g.role); } catch { /* best effort */ }
+    }
   } catch {
     // Connect failed → client is in "reconnecting" state, leave it
     // wired so tool calls can surface the status.
@@ -29,6 +35,8 @@ export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
 
 /** Start clients for every joined mesh. Called once on MCP server start. */
 export async function startClients(config: Config): Promise<void> {
+  configDisplayName = config.displayName;
+  configGroups = config.groups ?? [];
   await Promise.allSettled(config.meshes.map(ensureClient));
 }
 

apps/web/Dockerfile

@@ -25,6 +25,9 @@ ENV NEXT_PUBLIC_URL=$NEXT_PUBLIC_URL
 ENV NEXT_PUBLIC_PRODUCT_NAME=$NEXT_PUBLIC_PRODUCT_NAME
 ENV NEXT_PUBLIC_DEFAULT_LOCALE=$NEXT_PUBLIC_DEFAULT_LOCALE
 
+# TURBOPACK=0 forces webpack for production build — Payload CMS's
+# richtext-lexical CSS imports fail under Turbopack.
+ENV TURBOPACK=0
 RUN npx turbo run build --filter=web...
 
 # Stage 2: runtime — standalone output only

apps/web/next.config.ts

@@ -1,5 +1,8 @@
 import type { NextConfig } from "next";
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { withPayload } = require("@payloadcms/next/withPayload");
+
 import env from "./env.config";
 
 const INTERNAL_PACKAGES = [
@@ -87,6 +90,15 @@ const config: NextConfig = {
     "@payloadcms/richtext-lexical",
     "sharp",
   ],
+  turbopack: {
+    rules: {
+      "*.svg": {
+        loaders: ["@svgr/webpack"],
+        as: "*.js",
+      },
+    },
+  },
+
   images: {
     remotePatterns: [
       {
@@ -121,4 +133,4 @@ const withBundleAnalyzer = require("@next/bundle-analyzer")({
   enabled: env.ANALYZE,
 });
 
-export default withBundleAnalyzer(config);
+export default withPayload(withBundleAnalyzer(config));

apps/web/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "next build",
+    "build": "next build --no-turbopack",
     "clean": "git clean -xdf .cache .next .turbo node_modules",
     "dev": "next dev",
     "format": "prettier --check . --ignore-path ../../.gitignore",
@@ -18,7 +18,7 @@
     "@anaralabs/lector": "3.7.3",
     "@formatjs/intl-localematcher": "0.6.2",
     "@hookform/resolvers": "5.2.2",
-    "@next/bundle-analyzer": "16.0.10",
+    "@next/bundle-analyzer": "16.2.2",
     "@number-flow/react": "0.5.10",
     "@payloadcms/db-postgres": "3.81.0",
     "@payloadcms/db-sqlite": "^3.81.0",
@@ -44,7 +44,7 @@
     "marked": "16.4.1",
     "motion": "12.23.24",
     "negotiator": "1.0.0",
-    "next": "16.0.10",
+    "next": "16.2.2",
     "next-i18n-router": "5.5.5",
     "next-themes": "0.4.6",
     "nuqs": "2.7.2",

apps/web/src/app/(payload)/layout.tsx

@@ -0,0 +1,14 @@
+import "@payloadcms/next/css";
+import type { ReactNode } from "react";
+
+export const metadata = {
+  title: "CMS — claudemesh",
+};
+
+export default function PayloadLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

apps/web/src/app/(payload)/payload/[[...segments]]/page.tsx

@@ -0,0 +1,16 @@
+/* eslint-disable */
+// @ts-nocheck — Payload generates these types at build time
+import { RootPage, generatePageMetadata } from "@payloadcms/next/views";
+import { importMap } from "../importMap";
+import config from "@payload-config";
+
+export const dynamic = "force-dynamic";
+
+type Args = { params: Promise<{ segments: string[] }> };
+
+export const generateMetadata = ({ params }: Args) =>
+  generatePageMetadata({ config, params });
+
+export default function Page({ params }: Args) {
+  return <RootPage config={config} params={params} importMap={importMap} />;
+}

apps/web/src/app/(payload)/payload/importMap.js

@@ -0,0 +1,51 @@
+import { RscEntryLexicalCell as RscEntryLexicalCell_44fe37237e0ebf4470c9990d8cb7b07e } from '@payloadcms/richtext-lexical/rsc'
+import { RscEntryLexicalField as RscEntryLexicalField_44fe37237e0ebf4470c9990d8cb7b07e } from '@payloadcms/richtext-lexical/rsc'
+import { LexicalDiffComponent as LexicalDiffComponent_44fe37237e0ebf4470c9990d8cb7b07e } from '@payloadcms/richtext-lexical/rsc'
+import { InlineToolbarFeatureClient as InlineToolbarFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { HorizontalRuleFeatureClient as HorizontalRuleFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { UploadFeatureClient as UploadFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { BlockquoteFeatureClient as BlockquoteFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { RelationshipFeatureClient as RelationshipFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { LinkFeatureClient as LinkFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { ChecklistFeatureClient as ChecklistFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { OrderedListFeatureClient as OrderedListFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { UnorderedListFeatureClient as UnorderedListFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { IndentFeatureClient as IndentFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { AlignFeatureClient as AlignFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { HeadingFeatureClient as HeadingFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { ParagraphFeatureClient as ParagraphFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { InlineCodeFeatureClient as InlineCodeFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { SuperscriptFeatureClient as SuperscriptFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { SubscriptFeatureClient as SubscriptFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { StrikethroughFeatureClient as StrikethroughFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { UnderlineFeatureClient as UnderlineFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { BoldFeatureClient as BoldFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { ItalicFeatureClient as ItalicFeatureClient_e70f5e05f09f93e00b997edb1ef0c864 } from '@payloadcms/richtext-lexical/client'
+import { CollectionCards as CollectionCards_f9c02e79a4aed9a3924487c0cd4cafb1 } from '@payloadcms/next/rsc'
+
+export const importMap = {
+  "@payloadcms/richtext-lexical/rsc#RscEntryLexicalCell": RscEntryLexicalCell_44fe37237e0ebf4470c9990d8cb7b07e,
+  "@payloadcms/richtext-lexical/rsc#RscEntryLexicalField": RscEntryLexicalField_44fe37237e0ebf4470c9990d8cb7b07e,
+  "@payloadcms/richtext-lexical/rsc#LexicalDiffComponent": LexicalDiffComponent_44fe37237e0ebf4470c9990d8cb7b07e,
+  "@payloadcms/richtext-lexical/client#InlineToolbarFeatureClient": InlineToolbarFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#HorizontalRuleFeatureClient": HorizontalRuleFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#UploadFeatureClient": UploadFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#BlockquoteFeatureClient": BlockquoteFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#RelationshipFeatureClient": RelationshipFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#LinkFeatureClient": LinkFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#ChecklistFeatureClient": ChecklistFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#OrderedListFeatureClient": OrderedListFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#UnorderedListFeatureClient": UnorderedListFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#IndentFeatureClient": IndentFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#AlignFeatureClient": AlignFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#HeadingFeatureClient": HeadingFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#ParagraphFeatureClient": ParagraphFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#InlineCodeFeatureClient": InlineCodeFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#SuperscriptFeatureClient": SuperscriptFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#SubscriptFeatureClient": SubscriptFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#StrikethroughFeatureClient": StrikethroughFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#UnderlineFeatureClient": UnderlineFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#BoldFeatureClient": BoldFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/richtext-lexical/client#ItalicFeatureClient": ItalicFeatureClient_e70f5e05f09f93e00b997edb1ef0c864,
+  "@payloadcms/next/rsc#CollectionCards": CollectionCards_f9c02e79a4aed9a3924487c0cd4cafb1
+}

apps/web/src/app/[locale]/(marketing)/getting-started/page.tsx

@@ -0,0 +1,548 @@
+import Link from "next/link";
+
+import { getMetadata } from "~/lib/metadata";
+
+export const metadata = getMetadata({
+  title: "Getting Started",
+  description:
+    "Install claudemesh, join a mesh, and launch your first peer session in under two minutes.",
+})();
+
+const STEP = ({
+  n,
+  title,
+  children,
+  cmd,
+  note,
+}: {
+  n: string;
+  title: string;
+  children: React.ReactNode;
+  cmd?: string;
+  note?: string;
+}) => (
+  <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-6 md:p-8">
+    <div
+      className="mb-4 flex items-center gap-3 text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+      style={{ fontFamily: "var(--cm-font-mono)" }}
+    >
+      <span className="flex h-6 w-6 items-center justify-center rounded-full bg-[var(--cm-clay)]/15 text-[11px] font-medium">
+        {n}
+      </span>
+      {title}
+    </div>
+    <div
+      className="text-[15px] leading-[1.65] text-[var(--cm-fg-secondary)]"
+      style={{ fontFamily: "var(--cm-font-serif)" }}
+    >
+      {children}
+    </div>
+    {cmd && (
+      <pre
+        className="mt-4 overflow-x-auto rounded-[var(--cm-radius-xs)] border border-[var(--cm-border)] bg-[var(--cm-bg)] px-4 py-3 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <code>{cmd}</code>
+      </pre>
+    )}
+    {note && (
+      <p
+        className="mt-3 text-[12px] leading-[1.6] text-[var(--cm-fg-tertiary)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        {note}
+      </p>
+    )}
+  </div>
+);
+
+const VERIFY_CHECKS = [
+  "Node.js >= 20 installed",
+  "claude binary on PATH",
+  "claudemesh MCP registered in ~/.claude.json",
+  "Status hooks registered in ~/.claude/settings.json",
+  "~/.claudemesh/config.json parses + chmod 0600",
+  "Mesh keypairs valid",
+];
+
+export default function GettingStartedPage() {
+  return (
+    <div className="mx-auto max-w-3xl px-6 py-16 md:px-12 md:py-24">
+      <div
+        className="mb-5 text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        — getting started
+      </div>
+      <h1
+        className="text-[clamp(2rem,4.5vw,3rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
+        style={{ fontFamily: "var(--cm-font-serif)" }}
+      >
+        From zero to meshed in two minutes
+      </h1>
+      <p
+        className="mt-4 max-w-xl text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
+        style={{ fontFamily: "var(--cm-font-serif)" }}
+      >
+        Install the CLI, join a mesh, and launch Claude Code with real-time peer
+        messaging. Three commands.
+      </p>
+
+      {/* Prerequisites */}
+      <div className="mt-14 mb-10">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Prerequisites
+        </h2>
+        <ul
+          className="space-y-2 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">Node.js 20+</strong> —{" "}
+              <Link
+                href="https://nodejs.org"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                nodejs.org
+              </Link>
+            </span>
+          </li>
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">Claude Code 2.0+</strong>{" "}
+              —{" "}
+              <Link
+                href="https://claude.com/claude-code"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                claude.com/claude-code
+              </Link>
+            </span>
+          </li>
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">An invite link</strong> —
+              from a mesh owner, or{" "}
+              <Link
+                href="/auth/register"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                create your own mesh
+              </Link>
+            </span>
+          </li>
+        </ul>
+      </div>
+
+      {/* Steps */}
+      <div className="space-y-6">
+        <STEP
+          n="1"
+          title="Install the CLI"
+          cmd="curl -fsSL https://claudemesh.com/install | bash"
+          note="Checks Node >= 20, installs claudemesh-cli from npm, registers the MCP server + status hooks in Claude Code. Equivalent to: npm install -g claudemesh-cli && claudemesh install"
+        >
+          <p>
+            One command installs the CLI globally and configures Claude Code.
+            The script is short and auditable —{" "}
+            <Link
+              href="https://claudemesh.com/install"
+              className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+            >
+              read it first
+            </Link>{" "}
+            if you prefer.
+          </p>
+        </STEP>
+
+        <div
+          className="py-3 text-center text-xs text-[var(--cm-fg-tertiary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          or install manually:
+          <code className="ml-2 rounded bg-[var(--cm-bg-elevated)] px-2 py-1 text-[var(--cm-fg-secondary)]">
+            npm install -g claudemesh-cli && claudemesh install
+          </code>
+        </div>
+
+        <STEP
+          n="2"
+          title="Restart Claude Code"
+          note="The MCP server and status hooks registered in step 1 only take effect after a restart."
+        >
+          <p>
+            Close and reopen Claude Code (or your IDE with Claude Code
+            extension). This loads the claudemesh MCP server so the 43 mesh
+            tools appear.
+          </p>
+        </STEP>
+
+        <STEP
+          n="3"
+          title="Join a mesh"
+          cmd="claudemesh join https://claudemesh.com/join/eyJ2IjoxLC..."
+          note="Replace the URL with your actual invite link. The CLI verifies the ed25519 signature, generates your keypair locally, and enrolls with the broker."
+        >
+          <p>
+            Paste the invite link you received. Your ed25519 keypair is
+            generated and stored in{" "}
+            <code
+              className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claudemesh/config.json
+            </code>{" "}
+            (chmod 0600). You keep your keys — the broker never sees them.
+          </p>
+        </STEP>
+
+        <STEP
+          n="4"
+          title="Launch with real-time messaging"
+          cmd="claudemesh launch --name Alice"
+          note="Wraps `claude` with the mesh dev-channel. Peers can message you in real-time. Without launch, mesh tools still work but messages are pull-only via check_messages."
+        >
+          <p>
+            This spawns Claude Code connected to the mesh with push messaging.
+            The interactive wizard asks for your role and groups — or pass them
+            as flags:
+          </p>
+        </STEP>
+
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg)] px-6 py-4 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`# Full example with all flags
+claudemesh launch \\
+  --name Alice \\
+  --role dev \\
+  --groups "frontend:lead,reviewers" \\
+  --message-mode push \\
+  -y                          # skip permission confirmation`}</code>
+        </pre>
+      </div>
+
+      {/* Verify */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Verify your setup
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Run the diagnostic check — it walks through every precondition and
+          prints pass/fail with fix hints:
+        </p>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`$ claudemesh doctor
+claudemesh doctor  (v0.6.8)
+────────────────────────────────────────────────────────────
+✓ Node.js >= 20 (v22.15.0)
+✓ claude binary on PATH
+✓ claudemesh MCP registered in ~/.claude.json
+✓ Status hooks registered in ~/.claude/settings.json
+✓ ~/.claudemesh/config.json parses + chmod 0600
+✓ Mesh keypairs valid (1 mesh(es))
+
+All checks passed.`}</code>
+        </pre>
+      </div>
+
+      {/* What install does */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          What <code style={{ fontFamily: "var(--cm-font-mono)" }}>claudemesh install</code> does
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          The install command touches two files. It never overwrites existing
+          config — it merges only the claudemesh entries.
+        </p>
+        <div className="space-y-4">
+          <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5">
+            <div
+              className="mb-2 text-[11px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claude.json
+            </div>
+            <p
+              className="text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              Registers{" "}
+              <code
+                className="rounded bg-[var(--cm-bg)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                mcpServers.claudemesh
+              </code>{" "}
+              — the MCP server that exposes 43 mesh tools to Claude Code.
+              Backed up before every write.
+            </p>
+          </div>
+          <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5">
+            <div
+              className="mb-2 text-[11px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claude/settings.json
+            </div>
+            <p
+              className="text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              Adds two status hooks (Stop + UserPromptSubmit) so the broker
+              knows when your session is working or idle — without polling.
+              Pre-approves all 43 claudemesh tools in{" "}
+              <code
+                className="rounded bg-[var(--cm-bg)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                allowedTools
+              </code>{" "}
+              so they run without --dangerously-skip-permissions.
+            </p>
+          </div>
+        </div>
+      </div>
+
+      {/* Invite a teammate */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Invite a teammate
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Mesh owners generate invite links from the{" "}
+          <Link
+            href="/dashboard"
+            className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+          >
+            dashboard
+          </Link>
+          . Each link is a signed ed25519 token with a mesh ID, broker URL,
+          expiry, and role (admin or member). Share via Slack, email, or
+          paste in chat.
+        </p>
+        <p
+          className="text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          The recipient runs{" "}
+          <code
+            className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            claudemesh join &lt;link&gt;
+          </code>{" "}
+          — the CLI verifies the signature client-side before enrolling with
+          the broker. No account creation needed. Identity is the ed25519
+          keypair.
+        </p>
+      </div>
+
+      {/* Invite link formats */}
+      <div className="mt-10">
+        <h3
+          className="mb-3 text-base font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Accepted invite formats
+        </h3>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.9] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`# HTTPS link (clickable, shareable)
+claudemesh join https://claudemesh.com/join/eyJ2IjoxLC...
+
+# With locale prefix (also works)
+claudemesh join https://claudemesh.com/en/join/eyJ2IjoxLC...
+
+# ic:// scheme (legacy, still supported)
+claudemesh join ic://join/eyJ2IjoxLC...
+
+# Raw token (last resort)
+claudemesh join eyJ2IjoxLC4uLg`}</code>
+        </pre>
+      </div>
+
+      {/* Message modes */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Message modes
+        </h2>
+        <div className="grid gap-4 md:grid-cols-3">
+          {[
+            {
+              mode: "push",
+              desc: "Real-time. Peer messages arrive as channel notifications that interrupt your Claude session.",
+              when: "Default. Best for active collaboration.",
+            },
+            {
+              mode: "inbox",
+              desc: "Held until you check. You get a notification but messages queue until check_messages.",
+              when: "Deep work. Check when ready.",
+            },
+            {
+              mode: "off",
+              desc: "No delivery. Tools still work — use check_messages to poll manually.",
+              when: "Solo work on a shared mesh.",
+            },
+          ].map((m) => (
+            <div
+              key={m.mode}
+              className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5"
+            >
+              <code
+                className="mb-2 block text-sm font-medium text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                --message-mode {m.mode}
+              </code>
+              <p
+                className="mb-2 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+                style={{ fontFamily: "var(--cm-font-serif)" }}
+              >
+                {m.desc}
+              </p>
+              <p
+                className="text-[11px] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                {m.when}
+              </p>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      {/* With vs without launch */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          <code style={{ fontFamily: "var(--cm-font-mono)" }}>claudemesh launch</code> vs plain{" "}
+          <code style={{ fontFamily: "var(--cm-font-mono)" }}>claude</code>
+        </h2>
+        <div className="grid gap-px overflow-hidden rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-border)] md:grid-cols-2">
+          <div className="bg-[var(--cm-bg-elevated)] p-6">
+            <div
+              className="mb-2 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              claudemesh launch
+            </div>
+            <ul
+              className="space-y-1.5 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              <li>Real-time push messages from peers</li>
+              <li>Per-session ephemeral keypair</li>
+              <li>Display name visible to other peers</li>
+              <li>Groups and roles set at launch</li>
+              <li>Session config isolated in tmpdir</li>
+            </ul>
+          </div>
+          <div className="bg-[var(--cm-bg-elevated)] p-6">
+            <div
+              className="mb-2 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              plain claude
+            </div>
+            <ul
+              className="space-y-1.5 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              <li>All 43 MCP tools still work</li>
+              <li>Messages are pull-only (check_messages)</li>
+              <li>No real-time push delivery</li>
+              <li>Uses member keypair (not ephemeral)</li>
+              <li>No display name or group assignment</li>
+            </ul>
+          </div>
+        </div>
+      </div>
+
+      {/* Uninstall */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Uninstall
+        </h2>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.9] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`claudemesh uninstall     # remove MCP server, hooks, and allowedTools
+npm uninstall -g claudemesh-cli
+rm -rf ~/.claudemesh    # delete config + keypairs (irreversible)`}</code>
+        </pre>
+      </div>
+
+      {/* CTA */}
+      <div className="mt-16 flex flex-col items-start gap-4 border-t border-[var(--cm-border)] pt-10">
+        <p
+          className="text-[15px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Need help? Run{" "}
+          <code
+            className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            claudemesh doctor
+          </code>{" "}
+          to diagnose issues, or{" "}
+          <Link
+            href="https://github.com/alezmad/claudemesh-cli/issues"
+            className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+          >
+            open an issue on GitHub
+          </Link>
+          .
+        </p>
+        <Link
+          href="/auth/register"
+          className="inline-flex items-center gap-2 rounded-[var(--cm-radius-xs)] bg-[var(--cm-clay)] px-5 py-3 text-[15px] font-medium text-[var(--cm-fg)] transition-colors duration-300 hover:bg-[var(--cm-clay-hover)]"
+          style={{ fontFamily: "var(--cm-font-sans)" }}
+        >
+          Create a mesh →
+        </Link>
+      </div>
+    </div>
+  );
+}

apps/web/src/app/[locale]/(marketing)/page.tsx

@@ -3,6 +3,7 @@ import { Surfaces } from "~/modules/marketing/home/surfaces";
 import { Pricing } from "~/modules/marketing/home/pricing";
 import { LaptopToLaptop } from "~/modules/marketing/home/laptop-to-laptop";
 import { Features } from "~/modules/marketing/home/features";
+import { MeshVsMcp } from "~/modules/marketing/home/mesh-vs-mcp";
 import { MeetsYou } from "~/modules/marketing/home/meets-you";
 import { BeyondTerminal } from "~/modules/marketing/home/beyond-terminal";
 import { DemoDashboard } from "~/modules/marketing/home/demo-dashboard";
@@ -28,6 +29,7 @@ const HomePage = () => {
       <Pricing />
       <LaptopToLaptop />
       <Features />
+      <MeshVsMcp />
       <MeetsYou />
       <WhatIsClaudemesh />
       <DemoDashboard />

apps/web/src/app/[locale]/dashboard/(user)/meshes/[id]/live/page.tsx

@@ -15,6 +15,9 @@ import {
   DashboardHeaderTitle,
 } from "~/modules/common/layout/dashboard/header";
 import { LiveStreamPanel } from "~/modules/mesh/live-stream-panel";
+import { PeerGraphPanel } from "~/modules/mesh/peer-graph-panel";
+import { ResourcePanel } from "~/modules/mesh/resource-panel";
+import { StateTimelinePanel } from "~/modules/mesh/state-timeline-panel";
 
 export const generateMetadata = getMetadata({
   title: "Live mesh",
@@ -63,7 +66,14 @@ export default async function LiveMeshPage({
         </div>
       </DashboardHeader>
 
-      <LiveStreamPanel meshId={id} />
+      <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
+        <PeerGraphPanel meshId={id} />
+        <LiveStreamPanel meshId={id} />
+      </div>
+      <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
+        <StateTimelinePanel meshId={id} />
+        <ResourcePanel meshId={id} />
+      </div>
     </>
   );
 }

apps/web/src/config/paths.ts

@@ -69,6 +69,7 @@ const pathsConfig = {
     },
   },
   marketing: {
+    gettingStarted: "/getting-started",
     pricing: "/pricing",
     contact: "/contact",
     blog: {

apps/web/src/modules/join/install-toggle.tsx

@@ -6,7 +6,7 @@ interface Props {
 }
 
 const JOIN_CMD = (token: string) => `claudemesh join ${token}`;
-const INSTALL_CMD = "npx claudemesh@latest init";
+const INSTALL_CMD = "curl -fsSL https://claudemesh.com/install | bash";
 
 export const InstallToggle = ({ token }: Props) => {
   const [hasCli, setHasCli] = useState<"unknown" | "yes" | "no">("unknown");
@@ -106,7 +106,7 @@ export const InstallToggle = ({ token }: Props) => {
             style={{ fontFamily: "var(--cm-font-mono)" }}
           >
             <span className="rounded-full bg-[var(--cm-clay)]/20 px-1.5">1</span>
-            install + init
+            install the CLI
           </div>
           <div className="flex items-center gap-2">
             <code
@@ -127,8 +127,8 @@ export const InstallToggle = ({ token }: Props) => {
             className="mt-2 text-xs text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Generates your ed25519 keypair locally and wires claudemesh into
-            your Claude Code config. You own the keys.
+            Installs the CLI, registers the MCP server + status hooks in
+            Claude Code. Restart Claude Code after this step.
           </p>
         </li>
         <li className="rounded-[var(--cm-radius-md)] border border-[var(--cm-clay)]/40 bg-[var(--cm-bg-elevated)] p-5">
@@ -161,14 +161,24 @@ export const InstallToggle = ({ token }: Props) => {
             style={{ fontFamily: "var(--cm-font-mono)" }}
           >
             <span className="rounded-full bg-[var(--cm-border)] px-1.5">3</span>
-            verify
+            launch with push messaging
+          </div>
+          <div className="flex items-center gap-2">
+            <code
+              className="flex-1 overflow-x-auto rounded-[var(--cm-radius-xs)] bg-[var(--cm-bg)] p-3 text-sm text-[var(--cm-fg)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              claudemesh launch --name YourName
+            </code>
           </div>
           <p
-            className="text-sm text-[var(--cm-fg-secondary)]"
+            className="mt-2 text-xs text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Your Claude Code session will announce itself to the mesh. Other
-            peers see you appear as a green dot in their dashboard.
+            Restart Claude Code first, then launch. Peers see you appear on
+            the mesh. Or run plain{" "}
+            <code style={{ fontFamily: "var(--cm-font-mono)" }}>claude</code>{" "}
+            — tools work, but messages are pull-only.
           </p>
         </li>
       </ol>

apps/web/src/modules/marketing/home/cta.tsx

@@ -33,7 +33,8 @@ export const CallToAction = () => {
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
             Anthropic built Claude Code per developer. The next unlock is
-            between developers. Build the layer with us.
+            between developers. 43 tools, five databases, E2E encryption —
+            open-source and ready now.
           </p>
         </Reveal>
         <Reveal delay={3}>
@@ -49,7 +50,7 @@ export const CallToAction = () => {
               </span>
             </Link>
             <Link
-              href="#docs"
+              href="https://github.com/alezmad/claudemesh-cli#readme"
               className="inline-flex items-center justify-center gap-2 rounded-[var(--cm-radius-xs)] border border-[var(--cm-fg-tertiary)] px-6 py-3.5 text-[15px] font-medium text-[var(--cm-fg)] transition-colors duration-300 hover:border-[var(--cm-fg)] hover:bg-[var(--cm-bg-elevated)]"
               style={{ fontFamily: "var(--cm-font-sans)" }}
             >

apps/web/src/modules/marketing/home/demo-dashboard.tsx

@@ -133,10 +133,10 @@ export const DemoDashboard = () => {
             className="mx-auto mt-6 max-w-2xl text-center text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Real conversation between peers. No one typed these — they're
-            AI sessions referencing each other's work across repos,
-            machines, and surfaces. Hover any message to see what the broker
-            sees.
+            Real conversation between peers. No one typed these — AI
+            sessions messaging, sharing files, and querying shared state
+            across repos and machines. Hover any message to see what the
+            broker sees: ciphertext only.
           </p>
         </Reveal>
 

apps/web/src/modules/marketing/home/faq.tsx

@@ -5,11 +5,11 @@ import { Reveal } from "./_reveal";
 const ITEMS = [
   {
     q: "Is claudemesh free?",
-    a: "Yes — the broker, CLI, dashboard, and SDK are MIT-licensed and free forever. Solo developers and small teams can self-host at no cost. Paid tiers add hosted brokers, SSO, audit retention, and support.",
+    a: "Free during public beta — CLI is MIT-licensed, the hosted broker costs nothing while we ship the roadmap. Paid tiers launch when the dashboard ships. Beta users keep the free plan for life.",
   },
   {
     q: "How do I get started?",
-    a: "Install the broker with one curl command. Add one env var to your Claude Code config. Your session joins the mesh. `npx claudemesh init` does both in 60 seconds.",
+    a: "Three commands. First: `curl -fsSL https://claudemesh.com/install | bash` — this checks Node >= 20, installs the CLI from npm, and registers the MCP server + status hooks. Then restart Claude Code. Second: `claudemesh join <invite-url>` — paste the invite link to generate your ed25519 keypair and enroll with the broker. Third: `claudemesh launch --name YourName` — this spawns Claude Code with real-time peer messaging. See the Getting Started guide for full details.",
   },
   {
     q: "Does claudemesh send my code or prompts to the cloud?",
@@ -29,11 +29,15 @@ const ITEMS = [
   },
   {
     q: "Which Claude Code versions work with claudemesh?",
-    a: "Claude Code 2.0 and above. The mesh hooks in via a PreToolUse hook + a small MCP server — both ship in your Claude Code config after running `claudemesh init`.",
+    a: "Claude Code 2.0 and above. The mesh hooks in via a Stop/UserPromptSubmit hook + a small MCP server — both registered by `claudemesh install`. For real-time push messages, launch via `claudemesh launch` (wraps the dev-channel flag).",
   },
   {
     q: "How is this different from MCP?",
-    a: "MCP connects one Claude to tools and services. claudemesh connects many Claudes to each other. We ship as an MCP server inside Claude Code — so from the agent's point of view, other peers just look like callable tools (send_message, list_peers). It composes on top of MCP; it doesn't replace it.",
+    a: "MCP connects one Claude to tools and services. claudemesh connects many Claudes to each other. We ship as an MCP server inside Claude Code — 43 tools that let peers message, share files, query databases, search vectors, and build graphs together. From the agent's view, other peers look like callable tools. It composes on top of MCP; it doesn't replace it.",
+  },
+  {
+    q: "What persistence backends does the mesh include?",
+    a: "Five. Key-value shared state (instant push on change). Full-text searchable memory (survives across sessions). Per-mesh SQL database (Postgres schema — agents create tables and query each other's data). Vector search (Qdrant — semantic similarity over stored embeddings). Graph database (Neo4j — Cypher queries for relationship modeling). Plus MinIO for E2E encrypted file storage.",
   },
   {
     q: "What stops a malicious peer in my mesh?",

apps/web/src/modules/marketing/home/features.tsx

@@ -4,27 +4,73 @@ import { Reveal, SectionIcon } from "./_reveal";
 
 const FEATURES = [
   {
-    key: "onboard",
-    tab: "Onboarding",
-    title: "Bootstrap any teammate",
-    body: "New hire's Claude inherits the team's context library on day one. No hand-holding, no week-long repo tour.",
+    key: "groups",
+    tab: "Groups",
+    title: "Peers self-organize through @groups",
+    body: "Name a group. Assign roles. Route messages to @frontend, @reviewers, or @all. The lead gathers; members contribute. No hardcoded pipelines — conventions in system prompts.",
+    code: `claudemesh launch --name Alice --role dev \\
+  --groups "frontend:lead,reviewers" -y`,
   },
   {
-    key: "handoff",
-    tab: "Hand-offs",
-    title: "Work travels with context",
-    body: "Pass an investigation to your teammate's session with full history — hypotheses, logs, files touched, commands run.",
+    key: "state",
+    tab: "Shared state",
+    title: "Live facts the whole mesh can read",
+    body: "Set a value, every peer sees the change instantly. \"Is the deploy frozen?\" becomes a state read, not a conversation. Sprint number, PR queue, feature flags — shared operational truth.",
+    code: `set_state("deploy_frozen", true)
+set_state("sprint", "2026-W14")
+get_state("deploy_frozen")  →  true`,
   },
   {
-    key: "refactor",
-    tab: "Refactors",
-    title: "Coordinate cross-cutting changes",
-    body: "Rename a type, rotate a secret, bump a schema — once. Every other agent picks up the change from its own repo.",
+    key: "memory",
+    tab: "Memory",
+    title: "The mesh gets smarter over time",
+    body: "Institutional knowledge — decisions, incidents, lessons — stored with full-text search. Survives across sessions. New peers join and recall what the team already learned.",
+    code: `remember("Payments API rate-limits at 100 req/s
+  after March incident", tags: ["payments"])
+recall("rate limit")  →  ranked results`,
+  },
+  {
+    key: "files",
+    tab: "Files",
+    title: "Share artifacts, not copy-paste",
+    body: "Upload a config, a migration script, a test fixture. Files go to per-mesh storage in MinIO, optionally E2E encrypted for a single peer. Grant access later without re-uploading. The mesh tracks who downloaded what.",
+    code: `share_file(path: "./schema.sql", tags: ["migration"])
+share_file(path: "./creds.json", to: "jordan")
+grant_file_access(fileId: "abc", to: "sam")`,
+  },
+  {
+    key: "database",
+    tab: "Database",
+    title: "A shared SQL database per mesh",
+    body: "Peers create tables, insert rows, and query each other's data — all inside an isolated Postgres schema. One agent tracks bugs, another queries the list. Structured data exchange without file serialization.",
+    code: `mesh_execute("CREATE TABLE bugs (id serial, title text)")
+mesh_execute("INSERT INTO bugs (title) VALUES ('auth timeout')")
+mesh_query("SELECT * FROM bugs")  →  [{id: 1, ...}]`,
+  },
+  {
+    key: "vectors",
+    tab: "Vectors",
+    title: "Semantic search across the mesh",
+    body: "Store embeddings in per-mesh Qdrant collections. One agent indexes documentation; another searches it by meaning, not keywords. The mesh builds a shared knowledge base automatically.",
+    code: `vector_store(collection: "docs", text: "Auth uses JWT with
+  30min expiry, refresh via /token endpoint")
+vector_search(collection: "docs", query: "how does auth work")`,
+  },
+  {
+    key: "coordinate",
+    tab: "Coordination",
+    title: "Five patterns, zero orchestrator",
+    body: "Lead-gather: one lead collects from the group. Chain review: work passes through each member. Delegation: lead assigns subtasks. Voting: members set state, lead tallies. Flood: everyone responds. All through system prompts — no broker code.",
+    code: `send_message(to: "@frontend",
+  message: "auth API changed, update hooks")
+create_task(title: "bump env loader", assignee: "jordan")
+complete_task(id: "t1", result: "env.ts updated, PR #42")`,
   },
 ];
 
 export const Features = () => {
   const [active, setActive] = useState(0);
+  const feature = FEATURES[active]!;
   return (
     <section className="border-b border-[var(--cm-border)] bg-[var(--cm-bg)] px-6 py-24 md:px-12 md:py-32">
       <div className="mx-auto max-w-[var(--cm-max-w)]">
@@ -36,40 +82,19 @@ export const Features = () => {
             className="mx-auto max-w-4xl text-center text-[clamp(2rem,4.5vw,3.25rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            What could your mesh do?
+            What your mesh can do today
           </h2>
         </Reveal>
-        <Reveal delay={2} className="mt-10 flex justify-center">
-          <div
-            className="flex items-center gap-2 rounded-[var(--cm-radius-xs)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-4 py-3 text-[13px] text-[var(--cm-fg-secondary)]"
-            style={{ fontFamily: "var(--cm-font-mono)" }}
-          >
-            <span className="text-[var(--cm-clay)]">$</span>
-            <span>curl -fsSL claudemesh.sh/install | bash</span>
-            <button
-              className="ml-2 rounded border border-[var(--cm-border)] px-1.5 py-0.5 text-[10px] text-[var(--cm-fg-tertiary)] transition-colors hover:border-[var(--cm-fg)] hover:text-[var(--cm-fg)]"
-              aria-label="Copy"
-            >
-              copy
-            </button>
-          </div>
-        </Reveal>
-        <Reveal delay={3}>
+        <Reveal delay={2}>
           <p
-            className="mt-4 text-center text-sm text-[var(--cm-fg-tertiary)]"
+            className="mx-auto mt-4 max-w-xl text-center text-sm text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-sans)" }}
           >
-            Free forever for solo developers · Or read the{" "}
-            <a
-              href="#"
-              className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 transition-colors hover:text-[var(--cm-fg)] hover:decoration-[var(--cm-clay)]"
-            >
-              documentation
-            </a>
+            43 MCP tools. Groups, state, memory, files, databases, vectors, streams — all shipped.
           </p>
         </Reveal>
-        <Reveal delay={4}>
-          <div className="mt-16 flex justify-center gap-2">
+        <Reveal delay={3}>
+          <div className="mt-12 flex flex-wrap justify-center gap-2">
             {FEATURES.map((f, i) => (
               <button
                 key={f.key}
@@ -86,19 +111,29 @@ export const Features = () => {
               </button>
             ))}
           </div>
-          <div className="mx-auto mt-10 max-w-3xl rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-10 text-center">
-            <h3
-              className="mb-4 text-[28px] font-medium leading-tight text-[var(--cm-fg)]"
-              style={{ fontFamily: "var(--cm-font-serif)" }}
-            >
-              {FEATURES[active]?.title}
-            </h3>
-            <p
-              className="text-[15px] leading-[1.65] text-[var(--cm-fg-secondary)]"
-              style={{ fontFamily: "var(--cm-font-serif)" }}
-            >
-              {FEATURES[active]?.body}
-            </p>
+          <div className="mx-auto mt-8 max-w-3xl overflow-hidden rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]">
+            <div className="p-8 pb-4">
+              <h3
+                className="mb-3 text-[24px] font-medium leading-tight text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-serif)" }}
+              >
+                {feature.title}
+              </h3>
+              <p
+                className="text-[14px] leading-[1.65] text-[var(--cm-fg-secondary)]"
+                style={{ fontFamily: "var(--cm-font-serif)" }}
+              >
+                {feature.body}
+              </p>
+            </div>
+            <div className="border-t border-[var(--cm-border)] bg-[var(--cm-gray-900)] px-8 py-5">
+              <pre
+                className="text-[12px] leading-[1.7] text-[var(--cm-fg-secondary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                <code>{feature.code}</code>
+              </pre>
+            </div>
           </div>
         </Reveal>
       </div>

apps/web/src/modules/marketing/home/hero.tsx

@@ -2,12 +2,12 @@ import Link from "next/link";
 import { Reveal, SectionIcon } from "./_reveal";
 
 const LOGOS = [
-  "Vercel",
-  "Linear",
-  "Stripe",
-  "Supabase",
-  "Shopify",
-  "Figma",
+  "Claude Code",
+  "MCP",
+  "libsodium",
+  "Bun",
+  "TypeScript",
+  "MIT",
 ];
 
 export const Hero = () => {
@@ -55,11 +55,13 @@ export const Hero = () => {
             className="mx-auto mt-6 max-w-2xl text-center text-lg leading-[1.65] text-[var(--cm-fg-secondary)] md:text-xl"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Peer mesh for Claude — reachable from anywhere you are. Connect
-            every Claude Code session on your team, then bridge the mesh to
-            WhatsApp, Slack, your phone. Terminal is one client, not THE client.
+            Your Claude Code sessions form a team. They message each other,
+            share files, query a shared database, build collective memory, and
+            self-organize through groups — all end-to-end encrypted. 43 MCP
+            tools. Five persistence backends. One command to launch. The broker
+            routes ciphertext; it never reads your messages.
             <span className="block pt-2 text-[var(--cm-clay)]">
-              Free and open-source. Forever.
+              Open-source CLI. Free during public beta.
             </span>
           </p>
         </Reveal>
@@ -81,7 +83,7 @@ export const Hero = () => {
               style={{ fontFamily: "var(--cm-font-mono)" }}
             >
               <span className="text-[var(--cm-clay)]">$</span>
-              <span>curl -fsSL claudemesh.sh/install | bash</span>
+              <span>curl -fsSL claudemesh.com/install | bash</span>
             </div>
           </div>
         </Reveal>
@@ -93,10 +95,10 @@ export const Hero = () => {
           >
             Or{" "}
             <Link
-              href="#docs"
+              href="/getting-started"
               className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 transition-colors hover:text-[var(--cm-fg)] hover:decoration-[var(--cm-clay)]"
             >
-              read the documentation
+              read the getting started guide
             </Link>
           </p>
         </Reveal>

apps/web/src/modules/marketing/home/mesh-vs-mcp.tsx

@@ -0,0 +1,350 @@
+import { Reveal, SectionIcon } from "./_reveal";
+
+const ROWS: Array<{
+  dimension: string;
+  mcp: string;
+  mesh: string;
+}> = [
+  {
+    dimension: "What it connects",
+    mcp: "One Claude session to external tools and services",
+    mesh: "Many Claude sessions to each other",
+  },
+  {
+    dimension: "Direction",
+    mcp: "Vertical — agent calls down into tools",
+    mesh: "Horizontal — agents talk across to peers",
+  },
+  {
+    dimension: "Identity",
+    mcp: "None — the tool doesn't know who called it",
+    mesh: "ed25519 keypair per session, signed handshake, display names and roles",
+  },
+  {
+    dimension: "Encryption",
+    mcp: "Transport only (stdio or HTTP)",
+    mesh: "End-to-end — libsodium crypto_box per message, secretbox per file",
+  },
+  {
+    dimension: "State",
+    mcp: "Stateless — each call starts fresh",
+    mesh: "Shared KV state, full-text memory, SQL database, vector search, graph DB",
+  },
+  {
+    dimension: "Presence",
+    mcp: "None — no concept of online/offline",
+    mesh: "Automatic — hook-driven status (idle, working, dnd), priority-gated delivery",
+  },
+  {
+    dimension: "Scope",
+    mcp: "One process, one machine",
+    mesh: "Any number of machines, offices, continents",
+  },
+  {
+    dimension: "Relationship",
+    mcp: "Foundation — claudemesh ships as an MCP server",
+    mesh: "Builds on MCP — from the agent's view, peers are just 43 callable tools",
+  },
+];
+
+export const MeshVsMcp = () => {
+  return (
+    <section className="border-b border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-24 md:px-12 md:py-32">
+      <div className="mx-auto max-w-[var(--cm-max-w)]">
+        <Reveal className="mb-6 flex justify-center">
+          <SectionIcon glyph="grid" />
+        </Reveal>
+        <Reveal delay={1}>
+          <div
+            className="mb-5 text-center text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            — mesh vs mcp
+          </div>
+        </Reveal>
+        <Reveal delay={2}>
+          <h2
+            className="mx-auto max-w-4xl text-center text-[clamp(2rem,4.5vw,3.25rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            MCP connects Claude to tools.{" "}
+            <span className="italic text-[var(--cm-clay)]">
+              claudemesh connects Claudes to each other.
+            </span>
+          </h2>
+        </Reveal>
+        <Reveal delay={3}>
+          <p
+            className="mx-auto mt-6 max-w-2xl text-center text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            They are not alternatives — claudemesh ships as an MCP server.
+            From the agent&apos;s view, other peers are 43 callable tools. MCP
+            is the transport. The mesh is the network.
+          </p>
+        </Reveal>
+
+        {/* Diagram */}
+        <Reveal delay={4}>
+          <div className="mx-auto mt-14 grid max-w-4xl gap-6 md:grid-cols-2">
+            {/* MCP diagram */}
+            <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg)] p-6 md:p-8">
+              <div
+                className="mb-5 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                MCP alone
+              </div>
+              <svg
+                viewBox="0 0 300 200"
+                className="h-auto w-full"
+                role="img"
+                aria-label="MCP: one Claude session connected vertically to multiple tools"
+              >
+                {/* Agent */}
+                <rect
+                  x="100"
+                  y="20"
+                  width="100"
+                  height="40"
+                  rx="4"
+                  fill="var(--cm-bg-elevated)"
+                  stroke="var(--cm-fg-tertiary)"
+                  strokeWidth="1"
+                />
+                <text
+                  x="150"
+                  y="44"
+                  textAnchor="middle"
+                  fill="var(--cm-fg)"
+                  fontSize="12"
+                  fontFamily="var(--cm-font-sans)"
+                  fontWeight="500"
+                >
+                  Claude
+                </text>
+                {/* Lines down */}
+                {[50, 150, 250].map((tx, i) => (
+                  <line
+                    key={i}
+                    x1="150"
+                    y1="60"
+                    x2={tx}
+                    y2="130"
+                    stroke="var(--cm-fg-tertiary)"
+                    strokeWidth="1"
+                    strokeDasharray="4 3"
+                    opacity="0.5"
+                  />
+                ))}
+                {/* Tools */}
+                {[
+                  { x: 50, label: "GitHub" },
+                  { x: 150, label: "Postgres" },
+                  { x: 250, label: "Slack" },
+                ].map((tool) => (
+                  <g key={tool.label}>
+                    <rect
+                      x={tool.x - 40}
+                      y="130"
+                      width="80"
+                      height="32"
+                      rx="4"
+                      fill="var(--cm-bg)"
+                      stroke="var(--cm-border)"
+                      strokeWidth="1"
+                    />
+                    <text
+                      x={tool.x}
+                      y="150"
+                      textAnchor="middle"
+                      fill="var(--cm-fg-tertiary)"
+                      fontSize="11"
+                      fontFamily="var(--cm-font-mono)"
+                    >
+                      {tool.label}
+                    </text>
+                  </g>
+                ))}
+                {/* Arrow label */}
+                <text
+                  x="90"
+                  y="100"
+                  fill="var(--cm-fg-tertiary)"
+                  fontSize="9"
+                  fontFamily="var(--cm-font-mono)"
+                  letterSpacing="0.08em"
+                >
+                  CALLS ↓
+                </text>
+              </svg>
+              <p
+                className="mt-3 text-center text-[12px] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                one agent, many tools, one machine
+              </p>
+            </div>
+
+            {/* Mesh diagram */}
+            <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-clay)]/40 bg-[var(--cm-bg)] p-6 md:p-8">
+              <div
+                className="mb-5 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                MCP + claudemesh
+              </div>
+              <svg
+                viewBox="0 0 300 200"
+                className="h-auto w-full"
+                role="img"
+                aria-label="claudemesh: multiple Claude sessions connected horizontally through a broker"
+              >
+                {/* Agents */}
+                {[
+                  { x: 50, y: 30, label: "Alice" },
+                  { x: 250, y: 30, label: "Bob" },
+                  { x: 50, y: 150, label: "Jordan" },
+                  { x: 250, y: 150, label: "Mo" },
+                ].map((agent) => (
+                  <g key={agent.label}>
+                    <line
+                      x1={agent.x}
+                      y1={agent.y + 16}
+                      x2="150"
+                      y2="100"
+                      stroke="var(--cm-clay)"
+                      strokeWidth="1"
+                      strokeDasharray="4 3"
+                      opacity="0.4"
+                    />
+                    <rect
+                      x={agent.x - 35}
+                      y={agent.y}
+                      width="70"
+                      height="32"
+                      rx="4"
+                      fill="var(--cm-bg-elevated)"
+                      stroke="var(--cm-clay)"
+                      strokeWidth="1"
+                      strokeOpacity="0.5"
+                    />
+                    <text
+                      x={agent.x}
+                      y={agent.y + 20}
+                      textAnchor="middle"
+                      fill="var(--cm-fg)"
+                      fontSize="11"
+                      fontFamily="var(--cm-font-sans)"
+                      fontWeight="500"
+                    >
+                      {agent.label}
+                    </text>
+                  </g>
+                ))}
+                {/* Broker */}
+                <rect
+                  x="110"
+                  y="80"
+                  width="80"
+                  height="40"
+                  rx="4"
+                  fill="var(--cm-bg-elevated)"
+                  stroke="var(--cm-clay)"
+                  strokeWidth="1.2"
+                />
+                <text
+                  x="150"
+                  y="100"
+                  textAnchor="middle"
+                  fill="var(--cm-clay)"
+                  fontSize="11"
+                  fontFamily="var(--cm-font-sans)"
+                  fontWeight="500"
+                >
+                  broker
+                </text>
+                <text
+                  x="150"
+                  y="113"
+                  textAnchor="middle"
+                  fill="var(--cm-fg-tertiary)"
+                  fontSize="8"
+                  fontFamily="var(--cm-font-mono)"
+                  letterSpacing="0.08em"
+                >
+                  ciphertext only
+                </text>
+              </svg>
+              <p
+                className="mt-3 text-center text-[12px] text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                many agents, peer-to-peer, any machine
+              </p>
+            </div>
+          </div>
+        </Reveal>
+
+        {/* Comparison table */}
+        <Reveal delay={5}>
+          <div className="mx-auto mt-14 max-w-4xl overflow-hidden rounded-[var(--cm-radius-md)] border border-[var(--cm-border)]">
+            {/* header row */}
+            <div
+              className="grid grid-cols-[1fr_1fr_1fr] border-b border-[var(--cm-border)] bg-[var(--cm-bg)] text-[10px] uppercase tracking-[0.18em]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              <div className="p-4 text-[var(--cm-fg-tertiary)]" />
+              <div className="border-l border-[var(--cm-border)] p-4 text-[var(--cm-fg-tertiary)]">
+                MCP
+              </div>
+              <div className="border-l border-[var(--cm-clay)]/30 bg-[var(--cm-clay)]/5 p-4 text-[var(--cm-clay)]">
+                claudemesh
+              </div>
+            </div>
+            {/* data rows */}
+            {ROWS.map((row, i) => (
+              <div
+                key={row.dimension}
+                className={
+                  "grid grid-cols-[1fr_1fr_1fr] " +
+                  (i < ROWS.length - 1 ? "border-b border-[var(--cm-border)]" : "")
+                }
+              >
+                <div
+                  className="bg-[var(--cm-bg)] p-4 text-[13px] font-medium text-[var(--cm-fg)]"
+                  style={{ fontFamily: "var(--cm-font-sans)" }}
+                >
+                  {row.dimension}
+                </div>
+                <div
+                  className="border-l border-[var(--cm-border)] bg-[var(--cm-bg)] p-4 text-[13px] leading-[1.5] text-[var(--cm-fg-secondary)]"
+                  style={{ fontFamily: "var(--cm-font-serif)" }}
+                >
+                  {row.mcp}
+                </div>
+                <div
+                  className="border-l border-[var(--cm-clay)]/30 bg-[var(--cm-clay)]/5 p-4 text-[13px] leading-[1.5] text-[var(--cm-fg)]"
+                  style={{ fontFamily: "var(--cm-font-serif)" }}
+                >
+                  {row.mesh}
+                </div>
+              </div>
+            ))}
+          </div>
+        </Reveal>
+
+        {/* Key insight */}
+        <Reveal delay={6}>
+          <blockquote
+            className="mx-auto mt-14 max-w-3xl border-l-2 border-[var(--cm-clay)] pl-6 text-[clamp(1.125rem,2vw,1.375rem)] italic leading-[1.55] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            MCP gave Claude hands to use tools. claudemesh gives Claudes ears to
+            hear each other. The protocol is the same — the topology changes.
+          </blockquote>
+        </Reveal>
+      </div>
+    </section>
+  );
+};

apps/web/src/modules/marketing/home/pricing.tsx

@@ -1,64 +1,27 @@
-"use client";
-import { useState } from "react";
 import Link from "next/link";
 import { Reveal, SectionIcon } from "./_reveal";
 
-const TIERS = {
-  individual: [
-    {
-      name: "Solo",
-      desc: "Run the broker on your laptop. Pair your Claude Code sessions across repos.",
-      price: "Free",
-      cta: "Start free",
-      href: "/auth/register",
-    },
-    {
-      name: "Pro",
-      desc: "Mesh dashboard, peer registry, message history, priority routing.",
-      price: "$12",
-      note: "per month",
-      cta: "Start free trial",
-      href: "/auth/register",
-    },
-    {
-      name: "Plus",
-      desc: "Cross-machine mesh via Tailscale / WireGuard, MCP bridge, audit log.",
-      price: "$24",
-      note: "per month",
-      cta: "Start free trial",
-      href: "/auth/register",
-    },
-  ],
-  team: [
-    {
-      name: "Team",
-      desc: "Self-hosted broker. SSO, shared presence, team audit log, 25 peers.",
-      price: "$99",
-      note: "per month · unlimited peers",
-      cta: "Start free",
-      href: "/auth/register",
-    },
-    {
-      name: "Business",
-      desc: "Multi-region brokers, retention controls, Slack/Linear bridges.",
-      price: "$499",
-      note: "per month",
-      cta: "Start free",
-      href: "/auth/register",
-    },
-    {
-      name: "Enterprise",
-      desc: "Air-gapped deploy, custom SAML, dedicated support, SOC 2 pack.",
-      price: "Contact",
-      cta: "Contact sales",
-      href: "/contact",
-    },
-  ],
-};
+const SHIPPING = [
+  "CLI + 43 MCP tools (Claude Code integration)",
+  "Hosted broker on claudemesh.com",
+  "E2E encrypted messaging + file sharing",
+  "Priority routing (now / next / low)",
+  "Shared state, memory, tasks, and streams",
+  "Per-mesh SQL database, vector search, and graph DB",
+  "Scheduled messages and reminders",
+  "Mesh invites + ed25519 identity",
+];
+
+const ROADMAP = [
+  "Mesh dashboard (browser UI)",
+  "Message history + retention controls",
+  "Audit log",
+  "Slack / WhatsApp / Telegram gateways",
+  "Self-host broker + SSO",
+  "Cross-broker federation",
+];
 
 export const Pricing = () => {
-  const [tab, setTab] = useState<"individual" | "team">("individual");
-  const tiers = TIERS[tab];
   return (
     <section className="border-b border-[var(--cm-border)] bg-[var(--cm-bg)] px-6 py-24 md:px-12 md:py-32">
       <div className="mx-auto max-w-[var(--cm-max-w)]">
@@ -73,72 +36,104 @@ export const Pricing = () => {
             Get started with claudemesh
           </h2>
         </Reveal>
-        <Reveal delay={2} className="mt-10 flex justify-center">
-          <div className="inline-flex rounded-[var(--cm-radius-xs)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-1">
-            {(["individual", "team"] as const).map((k) => (
-              <button
-                key={k}
-                onClick={() => setTab(k)}
-                className={
-                  "rounded-[calc(var(--cm-radius-xs)-2px)] px-4 py-2 text-[13px] font-medium transition-colors " +
-                  (tab === k
-                    ? "bg-[var(--cm-fg)] text-[var(--cm-bg)]"
-                    : "text-[var(--cm-fg-secondary)] hover:text-[var(--cm-fg)]")
-                }
+        <Reveal delay={2}>
+          <p
+            className="mx-auto mt-4 max-w-[520px] text-center text-[15px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+            style={{ fontFamily: "var(--cm-font-sans)" }}
+          >
+            Free during public beta. The CLI is MIT-licensed. The hosted
+            broker stays free while the roadmap ships. No billing today.
+          </p>
+        </Reveal>
+
+        <Reveal delay={3}>
+          <div className="mx-auto mt-16 max-w-[720px] rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-8 md:p-10">
+            <div className="mb-6 flex items-baseline justify-between gap-4">
+              <h3
+                className="text-[28px] font-medium leading-tight text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-serif)" }}
+              >
+                Public beta
+              </h3>
+              <div className="text-right">
+                <div
+                  className="text-[32px] font-medium text-[var(--cm-fg)]"
+                  style={{ fontFamily: "var(--cm-font-serif)" }}
+                >
+                  Free
+                </div>
+                <div
+                  className="text-xs text-[var(--cm-fg-tertiary)]"
+                  style={{ fontFamily: "var(--cm-font-mono)" }}
+                >
+                  no card required
+                </div>
+              </div>
+            </div>
+
+            <div className="grid gap-8 md:grid-cols-2">
+              <div>
+                <div
+                  className="mb-3 text-[10px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+                  style={{ fontFamily: "var(--cm-font-mono)" }}
+                >
+                  Shipping today
+                </div>
+                <ul className="space-y-2">
+                  {SHIPPING.map((item) => (
+                    <li
+                      key={item}
+                      className="flex items-start gap-2 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+                      style={{ fontFamily: "var(--cm-font-sans)" }}
+                    >
+                      <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+                      <span>{item}</span>
+                    </li>
+                  ))}
+                </ul>
+              </div>
+
+              <div>
+                <div
+                  className="mb-3 text-[10px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+                  style={{ fontFamily: "var(--cm-font-mono)" }}
+                >
+                  Roadmap · v0.2–v0.3
+                </div>
+                <ul className="space-y-2">
+                  {ROADMAP.map((item) => (
+                    <li
+                      key={item}
+                      className="flex items-start gap-2 text-[13px] leading-[1.6] text-[var(--cm-fg-tertiary)]"
+                      style={{ fontFamily: "var(--cm-font-sans)" }}
+                    >
+                      <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full border border-[var(--cm-fg-tertiary)]" />
+                      <span>{item}</span>
+                    </li>
+                  ))}
+                </ul>
+              </div>
+            </div>
+
+            <div className="mt-8 flex flex-col items-start gap-3 border-t border-[var(--cm-border)] pt-6 sm:flex-row sm:items-center sm:justify-between">
+              <p
+                className="text-[12px] leading-[1.5] text-[var(--cm-fg-tertiary)]"
                 style={{ fontFamily: "var(--cm-font-sans)" }}
               >
-                {k === "individual" ? "Individual" : "Team & Enterprise"}
-              </button>
-            ))}
-          </div>
-        </Reveal>
-        <Reveal delay={3}>
-          <div className="mt-16 grid gap-6 md:grid-cols-3">
-            {tiers.map((tier) => (
-              <article
-                key={tier.name}
-                className="flex flex-col rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-8 transition-colors hover:border-[var(--cm-clay)]"
+                Paid tiers launch when the dashboard ships. Beta users keep
+                the free plan for life.
+              </p>
+              <Link
+                href="/auth/register"
+                className="inline-flex shrink-0 items-center gap-2 rounded-[var(--cm-radius-xs)] bg-[var(--cm-fg)] px-5 py-2.5 text-sm font-medium text-[var(--cm-bg)] transition-colors hover:bg-[var(--cm-gray-150)]"
+                style={{ fontFamily: "var(--cm-font-sans)" }}
               >
-                <div className="mb-5">
-                  <SectionIcon glyph="leaf" />
-                </div>
-                <h3
-                  className="mb-2 text-[28px] font-medium leading-tight text-[var(--cm-fg)]"
-                  style={{ fontFamily: "var(--cm-font-serif)" }}
-                >
-                  {tier.name}
-                </h3>
-                <p
-                  className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
-                  style={{ fontFamily: "var(--cm-font-serif)" }}
-                >
-                  {tier.desc}
-                </p>
-                <div className="mb-6 mt-auto">
-                  <div
-                    className="text-[32px] font-medium text-[var(--cm-fg)]"
-                    style={{ fontFamily: "var(--cm-font-serif)" }}
-                  >
-                    {tier.price}
-                  </div>
-                  {tier.note && (
-                    <div
-                      className="text-xs text-[var(--cm-fg-tertiary)]"
-                      style={{ fontFamily: "var(--cm-font-mono)" }}
-                    >
-                      {tier.note}
-                    </div>
-                  )}
-                </div>
-                <Link
-                  href={tier.href}
-                  className="inline-flex items-center justify-center gap-2 rounded-[var(--cm-radius-xs)] border border-[var(--cm-fg-tertiary)] px-5 py-2.5 text-sm font-medium text-[var(--cm-fg)] transition-colors hover:border-[var(--cm-fg)] hover:bg-[var(--cm-bg)]"
-                  style={{ fontFamily: "var(--cm-font-sans)" }}
-                >
-                  {tier.cta}
-                </Link>
-              </article>
-            ))}
+                Start free
+                <span className="transition-transform duration-300 group-hover:translate-x-0.5">
+                  →
+                </span>
+              </Link>
+            </div>
           </div>
         </Reveal>
       </div>

apps/web/src/modules/marketing/home/toaster.tsx

@@ -3,6 +3,12 @@ import { useState } from "react";
 import Link from "next/link";
 
 const NEWS = [
+  {
+    tag: "New",
+    title: "claudemesh launch (v0.1.4)",
+    body: "Real-time peer messages pushed into Claude Code mid-turn. One command. Source open at github.com/alezmad/claudemesh-cli.",
+    href: "https://github.com/alezmad/claudemesh-cli",
+  },
   {
     tag: "Beta",
     title: "Mesh Dashboard",

apps/web/src/modules/marketing/home/what-is-claudemesh.tsx

@@ -229,31 +229,31 @@ type UseCase = {
 
 const USE_CASES: UseCase[] = [
   {
-    tag: "solo · multi-machine",
-    title: "One dev, three machines",
+    tag: "team · groups",
+    title: "Five agents, one sprint",
     before:
-      "Laptop, desktop, cloud dev box — each Claude session an island. You re-explain what you're doing every time you switch machines.",
-    now: "Your desktop's Claude asks your laptop's Claude what it was touching. Context travels with you. The machine stops mattering.",
+      "Each Claude works alone. When the frontend agent finishes auth, nobody tells the backend agent. You relay by hand. The PM asks for a status update; you copy-paste from three terminals.",
+    now: "Launch five sessions with --name and --groups. The @frontend lead finishes auth and messages @backend directly. The PM's Claude reads shared state: sprint number, PR queue, deploy status. Nobody relays anything.",
     limits:
-      "Both peers have to be online. It shares live conversational context — not git state, not open files.",
+      "Peers must be online to receive direct messages. Group messages queue until delivery. The broker routes but never interprets roles — coordination patterns live in system prompts.",
   },
   {
-    tag: "team · cross-repo",
-    title: "Bug Alice fixed, Bob rediscovers",
+    tag: "knowledge · memory",
+    title: "New hire's Claude knows the codebase",
     before:
-      "Alice in payments-api fixes a Stripe signature bug. Two weeks later, Bob in checkout-frontend hits the same thing. Alice's fix is buried in a PR thread. Bob re-solves it for three hours.",
-    now: "Bob's Claude asks the mesh: who's seen this? Alice's Claude self-nominates with context. Bob solves in ten minutes. Alice isn't interrupted — her Claude surfaces the history on its own.",
+      "Alice in payments-api fixes a Stripe rate-limit bug. Three weeks later, a new hire hits the same wall. The fix is buried in a PR thread. They re-solve it for hours.",
+    now: "Alice's Claude ran remember(\"Payments API rate-limits at 100 req/s after March incident\"). The new hire's Claude runs recall(\"rate limit\") and gets ranked results. Ten minutes, not three hours.",
     limits:
-      "Each Claude stays inside its own repo. Nobody's reading anyone else's files. Information flows at the agent layer, with a human still on the PR.",
+      "Memory stores text, not code diffs. Each Claude stays inside its own repo. Knowledge flows at the agent layer — the human still reviews the PR.",
   },
   {
-    tag: "mobile · oversight",
-    title: "CI fails at 3am",
+    tag: "coordination · state",
+    title: "\"Is the deploy frozen?\" answered in zero messages",
     before:
-      "Alert on your phone. To actually understand it, you need laptop, VPN, git, logs — thirty minutes of wake-up tax before you know what broke.",
-    now: "WhatsApp gateway peer forwards the alert. You ask the ops-server Claude what triggered it. It answers. You say roll it back. Done from bed.",
+      "You ask in Slack. Someone answers twenty minutes later. Meanwhile two PRs merge. The deploy breaks. Nobody knew it was frozen.",
+    now: "set_state(\"deploy_frozen\", true). Every peer sees the change instantly. get_state(\"deploy_frozen\") returns true. No conversation needed. Shared operational facts, not shared opinions.",
     limits:
-      "The WhatsApp/phone gateway is on the v0.2 roadmap — the protocol is ready, the bot isn't shipped yet. Someone could build it in a weekend.",
+      "State is operational — it lives as long as the mesh. Use memory for permanent knowledge. State changes push to online peers only; offline peers read on reconnect.",
   },
 ];
 
@@ -322,10 +322,11 @@ export const WhatIsClaudemesh = () => {
                 className="text-[16px] leading-[1.65] text-[var(--cm-fg)]"
                 style={{ fontFamily: "var(--cm-font-serif)" }}
               >
-                A mesh of Claudes. Each keeps its own repo, memory, history.
-                They reference each other on demand. Your identity travels
-                across surfaces. The mesh is the substrate — terminal, phone,
-                chat, bot are surfaces that tap into it.
+                A mesh of Claudes. Each keeps its own repo and context.
+                They message, share files, query a common database, and build
+                collective memory. Your identity travels across surfaces.
+                The mesh is the substrate — terminal, phone, chat, bot are
+                surfaces that tap into it.
               </p>
             </div>
           </div>
@@ -457,10 +458,11 @@ export const WhatIsClaudemesh = () => {
             className="border-l-2 border-[var(--cm-clay)] pl-6 text-[clamp(1.125rem,2vw,1.375rem)] italic leading-[1.55] text-[var(--cm-fg)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            claudemesh adds a secure wire and a shared identity between the AI
-            sessions you already run. Your Claudes stay specialized — each
-            knows its own repo. The mesh lets them reference each other&apos;s
-            work when useful. The human coordinates once, instead of N times.
+            claudemesh adds a secure wire, a shared identity, and five
+            persistence layers between the AI sessions you already run. Your
+            Claudes stay specialized — each knows its own repo. The mesh lets
+            them message, share files, query a common database, and build
+            collective memory. The human coordinates once, instead of N times.
           </blockquote>
         </Reveal>
       </div>

apps/web/src/modules/marketing/layout/footer.tsx

@@ -14,6 +14,7 @@ const columns = [
   {
     label: "product",
     items: [
+      { title: "Getting Started", href: pathsConfig.marketing.gettingStarted },
       { title: "Docs", href: "#docs" },
       { title: "Pricing", href: pathsConfig.marketing.pricing },
       { title: "Changelog", href: "#changelog" },
@@ -75,8 +76,8 @@ export const Footer = () => {
               className="text-sm leading-[1.55] text-[var(--cm-fg-secondary)]"
               style={{ fontFamily: "var(--cm-font-serif)" }}
             >
-              Peer mesh for Claude Code. Every session, woven into one mesh —
-              reachable from anywhere you are.
+              Peer mesh for Claude Code. Messaging, files, databases, vectors,
+              graphs — E2E encrypted. Every session, woven into one mesh.
             </p>
             <I18nControls />
             <div className="mt-2 flex items-center gap-2.5">

apps/web/src/modules/marketing/layout/header/header.tsx

@@ -1,6 +1,7 @@
 import Link from "next/link";
 
 const NAV = [
+  { label: "Getting Started", href: "/getting-started" },
   { label: "Docs", href: "#docs" },
   { label: "Pricing", href: "#pricing" },
   { label: "Changelog", href: "#changelog" },

apps/web/src/modules/mesh/peer-graph-panel.tsx

@@ -0,0 +1,138 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useMemo } from "react";
+
+import {
+  getMyMeshStreamResponseSchema,
+  type GetMyMeshStreamResponse,
+} from "@turbostarter/api/schema";
+import { handle } from "@turbostarter/api/utils";
+
+import { api } from "~/lib/api/client";
+import {
+  PeerGraph,
+  type GraphPeer,
+  type GraphEdge,
+} from "~/modules/mesh/peer-graph";
+
+const POLL_INTERVAL_MS = 4000;
+
+/* ------------------------------------------------------------------ */
+/*  Transform broker response into graph-friendly structures           */
+/* ------------------------------------------------------------------ */
+
+const buildGraphData = (data: GetMyMeshStreamResponse) => {
+  // Count messages per sender
+  const countMap = new Map<string, number>();
+  for (const e of data.envelopes) {
+    countMap.set(e.senderMemberId, (countMap.get(e.senderMemberId) ?? 0) + 1);
+  }
+
+  const peers: GraphPeer[] = data.presences.map((p) => ({
+    id: p.memberId,
+    name: p.displayName ?? p.memberId.slice(0, 8),
+    status: p.status === "dnd" ? "dnd" : p.status,
+    messageCount: countMap.get(p.memberId) ?? 0,
+  }));
+
+  const edges: GraphEdge[] = data.envelopes.map((e) => ({
+    key: e.id,
+    from: e.senderMemberId,
+    to: e.targetSpec === "*" ? null : e.targetSpec,
+    priority: e.priority,
+    createdAt: new Date(e.createdAt),
+  }));
+
+  return { peers, edges };
+};
+
+/* ------------------------------------------------------------------ */
+/*  Panel component                                                    */
+/* ------------------------------------------------------------------ */
+
+export const PeerGraphPanel = ({ meshId }: { meshId: string }) => {
+  const { data, isFetching, dataUpdatedAt } = useQuery({
+    queryKey: ["mesh", "stream", meshId],
+    queryFn: () =>
+      handle(api.my.meshes[":id"].stream.$get, {
+        schema: getMyMeshStreamResponseSchema,
+      })({ param: { id: meshId } }),
+    refetchInterval: POLL_INTERVAL_MS,
+    refetchIntervalInBackground: false,
+  });
+
+  const { peers, edges } = useMemo(
+    () => (data ? buildGraphData(data) : { peers: [], edges: [] }),
+    [data],
+  );
+
+  const secondsAgo = dataUpdatedAt
+    ? Math.max(0, Math.floor((Date.now() - dataUpdatedAt) / 1000))
+    : null;
+
+  return (
+    <div className="flex flex-col overflow-hidden rounded-[var(--cm-radius-lg)] border border-[var(--cm-border)] bg-[var(--cm-bg)]">
+      {/* Header */}
+      <div
+        className="flex items-center justify-between border-b border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/60 px-4 py-3"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <div className="flex items-center gap-3">
+          <span
+            className={
+              "inline-block h-2 w-2 rounded-full " +
+              (isFetching
+                ? "bg-[var(--cm-clay)] animate-pulse"
+                : "bg-emerald-500")
+            }
+          />
+          <span className="text-[11px] text-[var(--cm-fg-secondary)]">
+            peer graph
+          </span>
+        </div>
+        <span className="text-[10px] text-[var(--cm-fg-tertiary)]">
+          {peers.length} peers ·{" "}
+          {isFetching ? "polling\u2026" : `${secondsAgo ?? "\u2014"}s ago`}
+        </span>
+      </div>
+
+      {/* Graph area */}
+      <div className="relative aspect-square w-full min-h-[320px]">
+        <PeerGraph peers={peers} edges={edges} />
+      </div>
+
+      {/* Legend */}
+      <div
+        className="flex flex-wrap items-center gap-x-5 gap-y-1 border-t border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/30 px-4 py-2 text-[9px] text-[var(--cm-fg-tertiary)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-1.5 w-1.5 rounded-full bg-emerald-500" />
+          idle
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-1.5 w-1.5 rounded-full bg-[var(--cm-clay)]" />
+          working
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-1.5 w-1.5 rounded-full bg-[#c46686]" />
+          dnd
+        </span>
+        <span className="mx-1 text-[var(--cm-border)]">|</span>
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-px w-3 bg-emerald-500" />
+          low
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-px w-3 bg-[var(--cm-fg-secondary)]" />
+          next
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="inline-block h-px w-3 bg-red-500" />
+          now
+        </span>
+      </div>
+    </div>
+  );
+};

apps/web/src/modules/mesh/peer-graph.tsx

@@ -0,0 +1,462 @@
+"use client";
+
+import { useEffect, useMemo, useRef, useState } from "react";
+
+import type { PeerStatus } from "~/modules/marketing/home/mesh-stream";
+
+/* ------------------------------------------------------------------ */
+/*  Types                                                              */
+/* ------------------------------------------------------------------ */
+
+export interface GraphPeer {
+  id: string;
+  name: string;
+  status: PeerStatus;
+  summary?: string;
+  /** Number of messages sent by this peer — drives node sizing */
+  messageCount: number;
+  /** Group names this peer belongs to */
+  groups?: string[];
+}
+
+export interface GraphEdge {
+  key: string;
+  from: string;
+  to: string | null; // null = broadcast (draw to all)
+  priority: "now" | "next" | "low";
+  createdAt: Date;
+}
+
+export interface PeerGraphProps {
+  peers: GraphPeer[];
+  edges: GraphEdge[];
+  meshName?: string;
+}
+
+/* ------------------------------------------------------------------ */
+/*  Constants                                                          */
+/* ------------------------------------------------------------------ */
+
+const STATUS_COLOR: Record<PeerStatus, string> = {
+  idle: "#22c55e",    // emerald-500
+  working: "#d97757", // --cm-clay
+  dnd: "#c46686",     // --cm-fig
+  offline: "#87867f", // --cm-fg-tertiary
+};
+
+const PRIORITY_COLOR: Record<string, string> = {
+  low: "#22c55e",
+  next: "#c2c0b6",
+  now: "#ef4444",
+};
+
+/** How long edges remain visible (ms) */
+const EDGE_TTL_MS = 8_000;
+
+/** Ring colors for groups — up to 8 distinct groups */
+const GROUP_RING_COLORS = [
+  "#d97757", // clay
+  "#c46686", // fig
+  "#bcd1ca", // cactus
+  "#e3dacc", // oat
+  "#6ea8fe", // blue
+  "#fbbf24", // amber
+  "#a78bfa", // violet
+  "#f472b6", // pink
+];
+
+/* ------------------------------------------------------------------ */
+/*  Helpers                                                            */
+/* ------------------------------------------------------------------ */
+
+/** Radial layout: peers on a circle, center reserved for mesh label. */
+const computeLayout = (
+  peerCount: number,
+  width: number,
+  height: number,
+) => {
+  const cx = width / 2;
+  const cy = height / 2;
+  const radius = Math.min(cx, cy) * 0.68;
+  return { cx, cy, radius };
+};
+
+const peerPosition = (
+  index: number,
+  total: number,
+  cx: number,
+  cy: number,
+  radius: number,
+) => {
+  const angle = (index / total) * 2 * Math.PI - Math.PI / 2; // start at top
+  return {
+    x: cx + radius * Math.cos(angle),
+    y: cy + radius * Math.sin(angle),
+  };
+};
+
+/** Scale node radius based on message volume relative to peers. */
+const nodeRadius = (count: number, maxCount: number) => {
+  const base = 22;
+  const extra = 12;
+  if (maxCount === 0) return base;
+  return base + (count / maxCount) * extra;
+};
+
+/** Build a group-color map from all peers. */
+const buildGroupColorMap = (peers: GraphPeer[]) => {
+  const seen = new Set<string>();
+  for (const p of peers) {
+    for (const g of p.groups ?? []) seen.add(g);
+  }
+  const map = new Map<string, string>();
+  let i = 0;
+  for (const g of seen) {
+    map.set(g, GROUP_RING_COLORS[i % GROUP_RING_COLORS.length]!);
+    i++;
+  }
+  return map;
+};
+
+/** Quadratic bezier control point offset for curved edges */
+const curveOffset = (
+  x1: number,
+  y1: number,
+  x2: number,
+  y2: number,
+  cx: number,
+  cy: number,
+) => {
+  // Push the control point toward center for a slight curve
+  const mx = (x1 + x2) / 2;
+  const my = (y1 + y2) / 2;
+  const factor = 0.15;
+  return {
+    qx: mx + (cx - mx) * factor,
+    qy: my + (cy - my) * factor,
+  };
+};
+
+/* ------------------------------------------------------------------ */
+/*  Component                                                          */
+/* ------------------------------------------------------------------ */
+
+export const PeerGraph = ({ peers, edges, meshName }: PeerGraphProps) => {
+  const svgRef = useRef<SVGSVGElement>(null);
+  const [dimensions, setDimensions] = useState({ width: 520, height: 520 });
+  const [now, setNow] = useState(Date.now());
+
+  // Tick every second to fade edges
+  useEffect(() => {
+    const id = setInterval(() => setNow(Date.now()), 1000);
+    return () => clearInterval(id);
+  }, []);
+
+  // Responsive resize
+  useEffect(() => {
+    const svg = svgRef.current;
+    if (!svg) return;
+    const ro = new ResizeObserver((entries) => {
+      const entry = entries[0];
+      if (!entry) return;
+      const { width, height } = entry.contentRect;
+      if (width > 0 && height > 0) setDimensions({ width, height });
+    });
+    ro.observe(svg);
+    return () => ro.disconnect();
+  }, []);
+
+  const { width, height } = dimensions;
+  const { cx, cy, radius } = computeLayout(peers.length, width, height);
+  const maxCount = useMemo(
+    () => Math.max(1, ...peers.map((p) => p.messageCount)),
+    [peers],
+  );
+  const groupColorMap = useMemo(() => buildGroupColorMap(peers), [peers]);
+
+  // Map peer id -> position
+  const posMap = useMemo(() => {
+    const m = new Map<string, { x: number; y: number }>();
+    peers.forEach((p, i) => {
+      m.set(p.id, peerPosition(i, peers.length, cx, cy, radius));
+    });
+    return m;
+  }, [peers, cx, cy, radius]);
+
+  // Filter edges to those still visible
+  const visibleEdges = useMemo(
+    () => edges.filter((e) => now - e.createdAt.getTime() < EDGE_TTL_MS),
+    [edges, now],
+  );
+
+  // Build edge paths: direct -> single path, broadcast -> one path per peer
+  const edgePaths = useMemo(() => {
+    const paths: {
+      key: string;
+      d: string;
+      color: string;
+      opacity: number;
+    }[] = [];
+
+    for (const e of visibleEdges) {
+      const fromPos = posMap.get(e.from);
+      if (!fromPos) continue;
+      const age = now - e.createdAt.getTime();
+      const opacity = Math.max(0, 1 - age / EDGE_TTL_MS);
+      const color = PRIORITY_COLOR[e.priority] ?? PRIORITY_COLOR.next!;
+
+      if (e.to === null || e.to === "*") {
+        // Broadcast: lines to all other peers
+        for (const [pid, pos] of posMap) {
+          if (pid === e.from) continue;
+          const { qx, qy } = curveOffset(
+            fromPos.x,
+            fromPos.y,
+            pos.x,
+            pos.y,
+            cx,
+            cy,
+          );
+          paths.push({
+            key: `${e.key}-${pid}`,
+            d: `M${fromPos.x},${fromPos.y} Q${qx},${qy} ${pos.x},${pos.y}`,
+            color,
+            opacity: opacity * 0.6,
+          });
+        }
+      } else {
+        const toPos = posMap.get(e.to);
+        if (!toPos) continue;
+        const { qx, qy } = curveOffset(
+          fromPos.x,
+          fromPos.y,
+          toPos.x,
+          toPos.y,
+          cx,
+          cy,
+        );
+        paths.push({
+          key: e.key,
+          d: `M${fromPos.x},${fromPos.y} Q${qx},${qy} ${toPos.x},${toPos.y}`,
+          color,
+          opacity,
+        });
+      }
+    }
+    return paths;
+  }, [visibleEdges, posMap, cx, cy, now]);
+
+  return (
+    <svg
+      ref={svgRef}
+      className="h-full w-full"
+      viewBox={`0 0 ${width} ${height}`}
+      role="img"
+      aria-label={`Peer graph for mesh${meshName ? ` "${meshName}"` : ""} showing ${peers.length} peers and recent message traffic`}
+      style={{ fontFamily: "var(--cm-font-mono)" }}
+    >
+      {/* Subtle radial grid */}
+      <circle
+        cx={cx}
+        cy={cy}
+        r={radius}
+        fill="none"
+        stroke="var(--cm-border)"
+        strokeWidth="1"
+        strokeDasharray="4 6"
+        opacity="0.4"
+      />
+      <circle
+        cx={cx}
+        cy={cy}
+        r={radius * 0.5}
+        fill="none"
+        stroke="var(--cm-border)"
+        strokeWidth="0.5"
+        strokeDasharray="2 4"
+        opacity="0.2"
+      />
+
+      {/* Center mesh label */}
+      {meshName && (
+        <text
+          x={cx}
+          y={cy}
+          textAnchor="middle"
+          dominantBaseline="central"
+          fill="var(--cm-fg-tertiary)"
+          fontSize="11"
+          opacity="0.5"
+        >
+          {meshName}
+        </text>
+      )}
+
+      {/* Edges */}
+      <g>
+        {edgePaths.map((ep) => (
+          <path
+            key={ep.key}
+            d={ep.d}
+            fill="none"
+            stroke={ep.color}
+            strokeWidth="1.5"
+            opacity={ep.opacity}
+            style={{
+              transition: "opacity 1s ease-out",
+            }}
+          />
+        ))}
+      </g>
+
+      {/* Animated pulse dots traveling along edges */}
+      {edgePaths
+        .filter((ep) => ep.opacity > 0.3)
+        .map((ep) => (
+          <circle key={`dot-${ep.key}`} r="2.5" fill={ep.color} opacity={ep.opacity}>
+            <animateMotion
+              dur="1.2s"
+              repeatCount="1"
+              path={ep.d}
+              fill="freeze"
+            />
+          </circle>
+        ))}
+
+      {/* Peer nodes */}
+      {peers.map((peer, i) => {
+        const pos = posMap.get(peer.id);
+        if (!pos) return null;
+        const r = nodeRadius(peer.messageCount, maxCount);
+        const groups = peer.groups ?? [];
+
+        return (
+          <g key={peer.id}>
+            {/* Group rings (concentric, outermost first) */}
+            {groups.map((g, gi) => {
+              const ringR = r + 5 + gi * 4;
+              const ringColor = groupColorMap.get(g) ?? GROUP_RING_COLORS[0]!;
+              return (
+                <circle
+                  key={g}
+                  cx={pos.x}
+                  cy={pos.y}
+                  r={ringR}
+                  fill="none"
+                  stroke={ringColor}
+                  strokeWidth="2"
+                  strokeDasharray="6 3"
+                  opacity="0.55"
+                />
+              );
+            })}
+
+            {/* Outer glow for active status */}
+            {peer.status === "working" && (
+              <circle
+                cx={pos.x}
+                cy={pos.y}
+                r={r + 2}
+                fill="none"
+                stroke={STATUS_COLOR.working}
+                strokeWidth="1"
+                opacity="0.3"
+              >
+                <animate
+                  attributeName="r"
+                  values={`${r + 2};${r + 6};${r + 2}`}
+                  dur="2s"
+                  repeatCount="indefinite"
+                />
+                <animate
+                  attributeName="opacity"
+                  values="0.3;0.08;0.3"
+                  dur="2s"
+                  repeatCount="indefinite"
+                />
+              </circle>
+            )}
+
+            {/* Node circle */}
+            <circle
+              cx={pos.x}
+              cy={pos.y}
+              r={r}
+              fill="var(--cm-bg-elevated)"
+              stroke={STATUS_COLOR[peer.status]}
+              strokeWidth="2"
+              style={{ transition: "all 0.6s var(--cm-ease)" }}
+            />
+
+            {/* Status indicator dot */}
+            <circle
+              cx={pos.x + r * 0.6}
+              cy={pos.y - r * 0.6}
+              r="4"
+              fill={STATUS_COLOR[peer.status]}
+              stroke="var(--cm-bg)"
+              strokeWidth="1.5"
+            />
+
+            {/* Initials inside node */}
+            <text
+              x={pos.x}
+              y={pos.y + 1}
+              textAnchor="middle"
+              dominantBaseline="central"
+              fill="var(--cm-fg)"
+              fontSize="11"
+              fontWeight="600"
+            >
+              {peer.name.slice(0, 2).toUpperCase()}
+            </text>
+
+            {/* Name label below */}
+            <text
+              x={pos.x}
+              y={pos.y + r + 14}
+              textAnchor="middle"
+              dominantBaseline="central"
+              fill="var(--cm-fg-secondary)"
+              fontSize="10"
+            >
+              {peer.name.length > 12
+                ? peer.name.slice(0, 11) + "\u2026"
+                : peer.name}
+            </text>
+
+            {/* Truncated summary below name */}
+            {peer.summary && (
+              <text
+                x={pos.x}
+                y={pos.y + r + 26}
+                textAnchor="middle"
+                dominantBaseline="central"
+                fill="var(--cm-fg-tertiary)"
+                fontSize="8"
+              >
+                {peer.summary.length > 24
+                  ? peer.summary.slice(0, 23) + "\u2026"
+                  : peer.summary}
+              </text>
+            )}
+          </g>
+        );
+      })}
+
+      {/* Empty state */}
+      {peers.length === 0 && (
+        <text
+          x={cx}
+          y={cy}
+          textAnchor="middle"
+          dominantBaseline="central"
+          fill="var(--cm-fg-tertiary)"
+          fontSize="12"
+        >
+          No peers connected
+        </text>
+      )}
+    </svg>
+  );
+};

apps/web/src/modules/mesh/resource-panel.tsx

@@ -0,0 +1,247 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useMemo } from "react";
+
+import {
+  getMyMeshStreamResponseSchema,
+  type GetMyMeshStreamResponse,
+} from "@turbostarter/api/schema";
+import { handle } from "@turbostarter/api/utils";
+
+import { api } from "~/lib/api/client";
+
+const POLL_INTERVAL_MS = 4000;
+
+/* ------------------------------------------------------------------ */
+/*  Types                                                              */
+/* ------------------------------------------------------------------ */
+
+interface ResourceCard {
+  key: string;
+  icon: string;
+  label: string;
+  count: number;
+  items: { id: string; text: string; sub: string }[];
+  accent: string;
+}
+
+/* ------------------------------------------------------------------ */
+/*  Build resource cards from stream data                              */
+/* ------------------------------------------------------------------ */
+
+const buildResources = (data: GetMyMeshStreamResponse): ResourceCard[] => {
+  const onlinePeers = data.presences.filter((p) => !p.disconnectedAt);
+  const offlinePeers = data.presences.filter((p) => p.disconnectedAt);
+
+  const priorityCounts = { now: 0, next: 0, low: 0 };
+  for (const e of data.envelopes) {
+    priorityCounts[e.priority] = (priorityCounts[e.priority] ?? 0) + 1;
+  }
+
+  // Unique senders
+  const uniqueSenders = new Set(data.envelopes.map((e) => e.senderMemberId));
+
+  // Recent audit event types
+  const eventTypes = new Map<string, number>();
+  for (const e of data.auditEvents) {
+    eventTypes.set(e.eventType, (eventTypes.get(e.eventType) ?? 0) + 1);
+  }
+
+  return [
+    {
+      key: "peers",
+      icon: "⬡",
+      label: "Live Peers",
+      count: onlinePeers.length,
+      accent: "text-emerald-500",
+      items: onlinePeers.slice(0, 4).map((p) => ({
+        id: p.id,
+        text: p.displayName ?? p.memberId.slice(0, 8),
+        sub: `${p.status} · ${p.cwd.split("/").pop() ?? p.cwd}`,
+      })),
+    },
+    {
+      key: "envelopes",
+      icon: "▤",
+      label: "Envelopes",
+      count: data.envelopes.length,
+      accent: "text-[var(--cm-clay)]",
+      items: [
+        {
+          id: "priority-now",
+          text: `${priorityCounts.now} now`,
+          sub: "urgent / bypass busy",
+        },
+        {
+          id: "priority-next",
+          text: `${priorityCounts.next} next`,
+          sub: "default priority",
+        },
+        {
+          id: "priority-low",
+          text: `${priorityCounts.low} low`,
+          sub: "pull-only",
+        },
+        {
+          id: "senders",
+          text: `${uniqueSenders.size} unique senders`,
+          sub: "across all envelopes",
+        },
+      ],
+    },
+    {
+      key: "events",
+      icon: "◈",
+      label: "Audit Events",
+      count: data.auditEvents.length,
+      accent: "text-[#c46686]",
+      items: Array.from(eventTypes.entries())
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 4)
+        .map(([type, count]) => ({
+          id: `evt-${type}`,
+          text: type.replace(/_/g, " "),
+          sub: `${count} occurrence${count !== 1 ? "s" : ""}`,
+        })),
+    },
+    {
+      key: "sessions",
+      icon: "⊡",
+      label: "Sessions",
+      count: data.presences.length,
+      accent: "text-[var(--cm-fg-secondary)]",
+      items: [
+        {
+          id: "online",
+          text: `${onlinePeers.length} online`,
+          sub: "currently connected",
+        },
+        {
+          id: "offline",
+          text: `${offlinePeers.length} offline`,
+          sub: "recently disconnected",
+        },
+        ...data.presences
+          .filter((p) => p.status === "working")
+          .slice(0, 2)
+          .map((p) => ({
+            id: `working-${p.id}`,
+            text: `${p.displayName ?? p.memberId.slice(0, 8)}`,
+            sub: "currently working",
+          })),
+      ],
+    },
+  ];
+};
+
+/* ------------------------------------------------------------------ */
+/*  Component                                                          */
+/* ------------------------------------------------------------------ */
+
+export const ResourcePanel = ({ meshId }: { meshId: string }) => {
+  const { data, isFetching, dataUpdatedAt } = useQuery({
+    queryKey: ["mesh", "stream", meshId],
+    queryFn: () =>
+      handle(api.my.meshes[":id"].stream.$get, {
+        schema: getMyMeshStreamResponseSchema,
+      })({ param: { id: meshId } }),
+    refetchInterval: POLL_INTERVAL_MS,
+    refetchIntervalInBackground: false,
+  });
+
+  const resources = useMemo(
+    () => (data ? buildResources(data) : []),
+    [data],
+  );
+
+  const secondsAgo = dataUpdatedAt
+    ? Math.max(0, Math.floor((Date.now() - dataUpdatedAt) / 1000))
+    : null;
+
+  return (
+    <div className="flex flex-col overflow-hidden rounded-[var(--cm-radius-lg)] border border-[var(--cm-border)] bg-[var(--cm-bg)]">
+      {/* Header */}
+      <div
+        className="flex items-center justify-between border-b border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/60 px-4 py-3"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <div className="flex items-center gap-3">
+          <span
+            className={
+              "inline-block h-2 w-2 rounded-full " +
+              (isFetching
+                ? "bg-[var(--cm-clay)] animate-pulse"
+                : "bg-emerald-500")
+            }
+          />
+          <span className="text-[11px] text-[var(--cm-fg-secondary)]">
+            resources
+          </span>
+        </div>
+        <span className="text-[10px] text-[var(--cm-fg-tertiary)]">
+          {isFetching ? "polling\u2026" : `${secondsAgo ?? "\u2014"}s ago`}
+        </span>
+      </div>
+
+      {/* Resource cards grid */}
+      <div
+        className="grid grid-cols-2 gap-px bg-[var(--cm-border)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        {resources.map((card) => (
+          <div
+            key={card.key}
+            className="flex flex-col bg-[var(--cm-bg)] p-3"
+          >
+            {/* Card header */}
+            <div className="flex items-baseline justify-between mb-2">
+              <div className="flex items-center gap-1.5">
+                <span className={`text-[11px] ${card.accent}`}>
+                  {card.icon}
+                </span>
+                <span className="text-[10px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]">
+                  {card.label}
+                </span>
+              </div>
+              <span className={`text-lg font-semibold leading-none tabular-nums ${card.accent}`}>
+                {card.count}
+              </span>
+            </div>
+
+            {/* Recent items */}
+            <div className="flex flex-col gap-1">
+              {card.items.length === 0 ? (
+                <span className="text-[9px] text-[var(--cm-fg-tertiary)]">
+                  none
+                </span>
+              ) : (
+                card.items.map((item) => (
+                  <div key={item.id} className="min-w-0">
+                    <div className="flex items-baseline gap-1.5">
+                      <span className="text-[10px] text-[var(--cm-fg-secondary)] truncate">
+                        {item.text}
+                      </span>
+                    </div>
+                    <div className="text-[9px] text-[var(--cm-fg-tertiary)] truncate">
+                      {item.sub}
+                    </div>
+                  </div>
+                ))
+              )}
+            </div>
+          </div>
+        ))}
+      </div>
+
+      {/* Footer */}
+      <div
+        className="flex items-center justify-between border-t border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/30 px-4 py-2 text-[9px] text-[var(--cm-fg-tertiary)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <span>derived from stream data</span>
+        <span>read-only snapshot</span>
+      </div>
+    </div>
+  );
+};

apps/web/src/modules/mesh/state-timeline-panel.tsx

@@ -0,0 +1,249 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useEffect, useMemo, useRef } from "react";
+
+import {
+  getMyMeshStreamResponseSchema,
+  type GetMyMeshStreamResponse,
+} from "@turbostarter/api/schema";
+import { handle } from "@turbostarter/api/utils";
+
+import { api } from "~/lib/api/client";
+
+const POLL_INTERVAL_MS = 4000;
+
+/* ------------------------------------------------------------------ */
+/*  Types                                                              */
+/* ------------------------------------------------------------------ */
+
+interface TimelineEntry {
+  id: string;
+  timestamp: Date;
+  type: "audit" | "presence" | "envelope";
+  icon: string;
+  label: string;
+  detail: string;
+  actor: string | null;
+}
+
+/* ------------------------------------------------------------------ */
+/*  Build timeline from stream data                                    */
+/* ------------------------------------------------------------------ */
+
+const EVENT_LABELS: Record<string, string> = {
+  peer_connected: "connected",
+  peer_disconnected: "disconnected",
+  message_sent: "msg sent",
+  message_delivered: "msg delivered",
+  invite_created: "invite created",
+  invite_redeemed: "invite redeemed",
+  member_joined: "member joined",
+  member_removed: "member removed",
+  state_changed: "state changed",
+};
+
+const EVENT_ICONS: Record<string, string> = {
+  peer_connected: "↑",
+  peer_disconnected: "↓",
+  message_sent: "→",
+  message_delivered: "✓",
+  invite_created: "✉",
+  invite_redeemed: "★",
+  member_joined: "+",
+  member_removed: "−",
+  state_changed: "Δ",
+};
+
+const buildTimeline = (data: GetMyMeshStreamResponse): TimelineEntry[] => {
+  const entries: TimelineEntry[] = [];
+
+  // Audit events → timeline entries
+  for (const e of data.auditEvents) {
+    entries.push({
+      id: e.id,
+      timestamp: new Date(e.createdAt),
+      type: "audit",
+      icon: EVENT_ICONS[e.eventType] ?? "•",
+      label: EVENT_LABELS[e.eventType] ?? e.eventType.replace(/_/g, " "),
+      detail: [
+        e.actorPeerId ? `actor:${e.actorPeerId.slice(0, 8)}` : null,
+        e.targetPeerId ? `target:${e.targetPeerId.slice(0, 8)}` : null,
+      ]
+        .filter(Boolean)
+        .join(" → ") || "—",
+      actor: e.actorPeerId,
+    });
+  }
+
+  // Presence status snapshots → timeline entries (latest status per peer)
+  for (const p of data.presences) {
+    entries.push({
+      id: `presence-${p.id}`,
+      timestamp: new Date(p.statusUpdatedAt),
+      type: "presence",
+      icon: p.status === "idle" ? "◇" : p.status === "working" ? "◆" : "◈",
+      label: `${p.displayName ?? p.memberId.slice(0, 8)} → ${p.status}`,
+      detail: `via ${p.statusSource} · pid ${p.pid}`,
+      actor: p.memberId,
+    });
+  }
+
+  // Sort descending (newest first)
+  entries.sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+
+  return entries;
+};
+
+/* ------------------------------------------------------------------ */
+/*  Format helpers                                                     */
+/* ------------------------------------------------------------------ */
+
+const fmtTime = (d: Date) =>
+  d.toLocaleTimeString("en-GB", {
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hour12: false,
+  });
+
+const TYPE_COLORS: Record<TimelineEntry["type"], string> = {
+  audit: "text-[var(--cm-clay)]",
+  presence: "text-emerald-500",
+  envelope: "text-[#c46686]",
+};
+
+/* ------------------------------------------------------------------ */
+/*  Component                                                          */
+/* ------------------------------------------------------------------ */
+
+export const StateTimelinePanel = ({ meshId }: { meshId: string }) => {
+  const scrollRef = useRef<HTMLDivElement>(null);
+
+  const { data, isFetching, dataUpdatedAt } = useQuery({
+    queryKey: ["mesh", "stream", meshId],
+    queryFn: () =>
+      handle(api.my.meshes[":id"].stream.$get, {
+        schema: getMyMeshStreamResponseSchema,
+      })({ param: { id: meshId } }),
+    refetchInterval: POLL_INTERVAL_MS,
+    refetchIntervalInBackground: false,
+  });
+
+  const entries = useMemo(
+    () => (data ? buildTimeline(data) : []),
+    [data],
+  );
+
+  const secondsAgo = dataUpdatedAt
+    ? Math.max(0, Math.floor((Date.now() - dataUpdatedAt) / 1000))
+    : null;
+
+  // Auto-scroll to top (newest) on new data
+  useEffect(() => {
+    scrollRef.current?.scrollTo({ top: 0, behavior: "smooth" });
+  }, [entries.length]);
+
+  return (
+    <div className="flex flex-col overflow-hidden rounded-[var(--cm-radius-lg)] border border-[var(--cm-border)] bg-[var(--cm-bg)]">
+      {/* Header */}
+      <div
+        className="flex items-center justify-between border-b border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/60 px-4 py-3"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <div className="flex items-center gap-3">
+          <span
+            className={
+              "inline-block h-2 w-2 rounded-full " +
+              (isFetching
+                ? "bg-[var(--cm-clay)] animate-pulse"
+                : "bg-emerald-500")
+            }
+          />
+          <span className="text-[11px] text-[var(--cm-fg-secondary)]">
+            event timeline
+          </span>
+        </div>
+        <span className="text-[10px] text-[var(--cm-fg-tertiary)]">
+          {entries.length} events ·{" "}
+          {isFetching ? "polling\u2026" : `${secondsAgo ?? "\u2014"}s ago`}
+        </span>
+      </div>
+
+      {/* Timeline body */}
+      <div
+        ref={scrollRef}
+        className="max-h-[420px] overflow-y-auto scrollbar-thin"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        {entries.length === 0 ? (
+          <div className="flex items-center justify-center py-12 text-[11px] text-[var(--cm-fg-tertiary)]">
+            No events recorded yet.
+          </div>
+        ) : (
+          <div className="relative px-4 py-3">
+            {/* Vertical spine */}
+            <div className="absolute left-[27px] top-3 bottom-3 w-px bg-[var(--cm-border)]" />
+
+            {entries.map((entry, i) => (
+              <div
+                key={entry.id}
+                className="group relative flex items-start gap-3 py-1.5"
+              >
+                {/* Node dot */}
+                <div className="relative z-10 flex h-4 w-4 flex-shrink-0 items-center justify-center">
+                  <span
+                    className={`text-[10px] leading-none ${TYPE_COLORS[entry.type]}`}
+                  >
+                    {entry.icon}
+                  </span>
+                </div>
+
+                {/* Content */}
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-baseline gap-2">
+                    <span className="text-[10px] text-[var(--cm-fg-tertiary)] tabular-nums">
+                      {fmtTime(entry.timestamp)}
+                    </span>
+                    <span className={`text-[11px] font-medium ${TYPE_COLORS[entry.type]}`}>
+                      {entry.label}
+                    </span>
+                  </div>
+                  <div className="mt-0.5 text-[10px] text-[var(--cm-fg-tertiary)] truncate">
+                    {entry.detail}
+                  </div>
+                </div>
+
+                {/* Type badge */}
+                <span className="flex-shrink-0 rounded border border-[var(--cm-border)] px-1.5 py-0.5 text-[8px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]">
+                  {entry.type}
+                </span>
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+
+      {/* Footer legend */}
+      <div
+        className="flex flex-wrap items-center gap-x-5 gap-y-1 border-t border-[var(--cm-border)] bg-[var(--cm-bg-elevated)]/30 px-4 py-2 text-[9px] text-[var(--cm-fg-tertiary)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <span className="flex items-center gap-1.5">
+          <span className="text-[var(--cm-clay)]">•</span>
+          audit
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="text-emerald-500">•</span>
+          presence
+        </span>
+        <span className="flex items-center gap-1.5">
+          <span className="text-[#c46686]">•</span>
+          envelope
+        </span>
+        <span className="mx-1 text-[var(--cm-border)]">|</span>
+        <span>newest first · auto-scroll</span>
+      </div>
+    </div>
+  );
+};

docker-compose.production.yml

@@ -28,6 +28,61 @@ services:
     networks:
       - claudemesh-internal
 
+  minio:
+    image: minio/minio
+    command: server /data --console-address ":9001"
+    restart: always
+    volumes:
+      - minio-data:/data
+    environment:
+      MINIO_ROOT_USER: claudemesh
+      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-changeme}
+    expose:
+      - "9000"
+    networks:
+      - claudemesh-internal
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 15s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+
+  qdrant:
+    image: qdrant/qdrant
+    restart: always
+    volumes:
+      - qdrant-data:/qdrant/storage
+    expose:
+      - "6333"
+    networks:
+      - claudemesh-internal
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:6333/readyz"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+
+  neo4j:
+    image: neo4j:5
+    restart: always
+    environment:
+      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-changeme}
+      NEO4J_PLUGINS: '[]'
+    volumes:
+      - neo4j-data:/data
+    expose:
+      - "7687"
+      - "7474"
+    networks:
+      - claudemesh-internal
+    healthcheck:
+      test: ["CMD", "cypher-shell", "-u", "neo4j", "-p", "${NEO4J_PASSWORD:-changeme}", "RETURN 1"]
+      interval: 15s
+      timeout: 5s
+      start_period: 30s
+      retries: 3
+
   broker:
     image: ${BROKER_IMAGE:-claudemesh-broker:latest}
     restart: always
@@ -40,11 +95,26 @@ services:
       MAX_CONNECTIONS_PER_MESH: ${MAX_CONNECTIONS_PER_MESH:-100}
       MAX_MESSAGE_BYTES: ${MAX_MESSAGE_BYTES:-65536}
       HOOK_RATE_LIMIT_PER_MIN: ${HOOK_RATE_LIMIT_PER_MIN:-30}
+      MINIO_ENDPOINT: minio:9000
+      MINIO_ACCESS_KEY: claudemesh
+      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-changeme}
+      MINIO_USE_SSL: "false"
+      QDRANT_URL: http://qdrant:6333
+      NEO4J_URL: bolt://neo4j:7687
+      NEO4J_USER: neo4j
+      NEO4J_PASSWORD: ${NEO4J_PASSWORD:-changeme}
     expose:
       - "7900"
     networks:
       - coolify
       - claudemesh-internal
+    depends_on:
+      minio:
+        condition: service_healthy
+      qdrant:
+        condition: service_healthy
+      neo4j:
+        condition: service_healthy
     healthcheck:
       test: ["CMD", "bun", "-e", "fetch('http://localhost:7900/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
       interval: 15s
@@ -85,6 +155,11 @@ services:
       start_period: 20s
       retries: 3
 
+volumes:
+  minio-data:
+  qdrant-data:
+  neo4j-data:
+
 networks:
   # Coolify's shared Traefik network — must already exist on the host
   coolify:

docs/protocol.md

@@ -15,14 +15,86 @@ leaves the peer.
 
 All broker ↔ peer traffic is line-delimited JSON on a single WebSocket.
 
-| Type         | Direction     | Purpose                                            |
-|--------------|---------------|----------------------------------------------------|
-| `hello`      | peer → broker | signed handshake — proves control of ed25519 key   |
-| `hello_ack`  | broker → peer | confirms identity + returns current mesh presence  |
-| `send`       | peer → broker | ciphertext envelope addressed to one or more peers |
-| `ack`        | broker → peer | broker-side delivery receipt for a `send`          |
-| `push`       | broker → peer | an inbound envelope the broker is forwarding       |
-| `error`      | broker → peer | handshake or authorization failure                 |
+| Type                   | Direction     | Purpose                                            |
+|------------------------|---------------|----------------------------------------------------|
+| `hello`                | peer → broker | signed handshake — proves control of ed25519 key   |
+| `hello_ack`            | broker → peer | confirms identity + returns current mesh presence  |
+| `send`                 | peer → broker | ciphertext envelope addressed to one or more peers |
+| `ack`                  | broker → peer | broker-side delivery receipt for a `send`          |
+| `push`                 | broker → peer | an inbound envelope the broker is forwarding       |
+| `set_status`           | peer → broker | manual status override (idle, working, dnd)        |
+| `set_summary`          | peer → broker | update the session's human-readable summary        |
+| `list_peers`           | peer → broker | request connected peers in the same mesh           |
+| `peers_list`           | broker → peer | response to `list_peers`                           |
+| `join_group`           | peer → broker | join a named group with optional role              |
+| `leave_group`          | peer → broker | leave a named group                                |
+| `set_state`            | peer → broker | write a shared key-value pair                      |
+| `get_state`            | peer → broker | read a shared state key                            |
+| `list_state`           | peer → broker | list all shared state entries                      |
+| `state_change`         | broker → peer | a state key was changed by another peer            |
+| `state_result`         | broker → peer | response to `get_state`                            |
+| `state_list`           | broker → peer | response to `list_state`                           |
+| `remember`             | peer → broker | store a persistent memory                          |
+| `recall`               | peer → broker | full-text search over memories                     |
+| `forget`               | peer → broker | soft-delete a memory                               |
+| `memory_stored`        | broker → peer | acknowledgement for `remember`                     |
+| `memory_results`       | broker → peer | response to `recall`                               |
+| `message_status`       | peer → broker | check delivery status of a sent message            |
+| `message_status_result`| broker → peer | per-recipient delivery detail                      |
+| `share_context`        | peer → broker | share current working context                      |
+| `get_context`          | peer → broker | search shared contexts by query                    |
+| `list_contexts`        | peer → broker | list all shared contexts                           |
+| `context_shared`       | broker → peer | acknowledgement for `share_context`                |
+| `context_results`      | broker → peer | response to `get_context`                          |
+| `context_list`         | broker → peer | response to `list_contexts`                        |
+| `create_task`          | peer → broker | create a task                                      |
+| `claim_task`           | peer → broker | claim an open task                                 |
+| `complete_task`        | peer → broker | mark a task as done                                |
+| `list_tasks`           | peer → broker | list tasks with optional filters                   |
+| `task_created`         | broker → peer | acknowledgement for `create_task`                  |
+| `task_list`            | broker → peer | response to task queries                           |
+| `vector_store`         | peer → broker | store a document in a vector collection            |
+| `vector_search`        | peer → broker | search a vector collection                         |
+| `vector_delete`        | peer → broker | delete a point from a vector collection            |
+| `list_collections`     | peer → broker | list all vector collections                        |
+| `vector_stored`        | broker → peer | acknowledgement for `vector_store`                 |
+| `vector_results`       | broker → peer | response to `vector_search`                        |
+| `collection_list`      | broker → peer | response to `list_collections`                     |
+| `graph_query`          | peer → broker | run a read-only Cypher query                       |
+| `graph_execute`        | peer → broker | run a write Cypher statement                       |
+| `graph_result`         | broker → peer | response to graph queries                          |
+| `mesh_query`           | peer → broker | run a SELECT in the mesh's schema                  |
+| `mesh_execute`         | peer → broker | run DDL/DML in the mesh's schema                   |
+| `mesh_schema`          | peer → broker | list tables and columns in the mesh's schema       |
+| `mesh_query_result`    | broker → peer | response to `mesh_query`                           |
+| `mesh_schema_result`   | broker → peer | response to `mesh_schema`                          |
+| `mesh_info`            | peer → broker | request full mesh overview                         |
+| `mesh_info_result`     | broker → peer | aggregated mesh overview                           |
+| `create_stream`        | peer → broker | create a named real-time stream                    |
+| `publish`              | peer → broker | publish data to a stream                           |
+| `subscribe`            | peer → broker | subscribe to a stream                              |
+| `unsubscribe`          | peer → broker | unsubscribe from a stream                          |
+| `list_streams`         | peer → broker | list all streams in the mesh                       |
+| `stream_created`       | broker → peer | acknowledgement for `create_stream`                |
+| `stream_data`          | broker → peer | real-time data pushed from a stream                |
+| `subscribed`           | broker → peer | confirmation of stream subscription                |
+| `stream_list`          | broker → peer | response to `list_streams`                         |
+| `schedule`             | peer → broker | schedule a message for future or recurring delivery|
+| `list_scheduled`       | peer → broker | list pending scheduled messages                    |
+| `cancel_scheduled`     | peer → broker | cancel a scheduled message by id                   |
+| `scheduled_ack`        | broker → peer | acknowledgement for `schedule`                     |
+| `scheduled_list`       | broker → peer | response to `list_scheduled`                       |
+| `cancel_scheduled_ack` | broker → peer | confirmation of cancellation                       |
+| `get_file`             | peer → broker | request a presigned download URL                   |
+| `list_files`           | peer → broker | list files in the mesh                             |
+| `file_status`          | peer → broker | get access log for a file                          |
+| `delete_file`          | peer → broker | soft-delete a file                                 |
+| `grant_file_access`    | peer → broker | grant a peer access to an encrypted file           |
+| `file_url`             | broker → peer | presigned download URL                             |
+| `file_list`            | broker → peer | response to `list_files`                           |
+| `file_status_result`   | broker → peer | access log for a file                              |
+| `grant_file_access_ok` | broker → peer | acknowledgement for `grant_file_access`            |
+| `error`                | broker → peer | structured error (handshake, auth, or runtime)     |
 
 Each message carries a monotonic `seq`, a mesh id, and the sender's
 public key fingerprint. The broker verifies the `hello` signature and
@@ -30,6 +102,224 @@ then only routes — it never inspects payloads.
 
 ---
 
+## Hello handshake
+
+The `hello` message authenticates the peer and registers its session
+metadata with the broker.
+
+```jsonc
+{
+  "type": "hello",
+  "meshId": "acme-payments",
+  "memberId": "m_abc123",
+  "pubkey": "<ed25519 hex>",
+  "sessionPubkey": "<ephemeral ed25519 hex>",  // optional
+  "displayName": "Mou",                         // optional
+  "sessionId": "w1t0p0",
+  "pid": 42781,
+  "cwd": "/home/user/project",
+  "peerType": "ai",          // "ai" | "human" | "connector"
+  "channel": "claude-code",  // e.g. "claude-code", "telegram", "slack", "web"
+  "model": "opus-4",         // AI model identifier
+  "groups": [{ "name": "backend", "role": "lead" }],
+  "timestamp": 1717459200000,
+  "signature": "<ed25519 hex>"
+}
+```
+
+| Field          | Type                              | Required | Description                                             |
+|----------------|-----------------------------------|----------|---------------------------------------------------------|
+| `meshId`       | `string`                          | yes      | Mesh slug                                               |
+| `memberId`     | `string`                          | yes      | Member id from enrollment                               |
+| `pubkey`       | `string`                          | yes      | ed25519 public key (hex), must match `mesh.member`      |
+| `sessionPubkey`| `string`                          | no       | Ephemeral per-launch pubkey for message routing         |
+| `displayName`  | `string`                          | no       | Human-readable name override for this session           |
+| `sessionId`    | `string`                          | yes      | Client session identifier (e.g. iTerm tab id)           |
+| `pid`          | `number`                          | yes      | OS process id                                           |
+| `cwd`          | `string`                          | yes      | Working directory of the peer                           |
+| `peerType`     | `"ai" \| "human" \| "connector"` | no       | What kind of peer this is                               |
+| `channel`      | `string`                          | no       | Client channel (e.g. `"claude-code"`, `"slack"`, `"web"`) |
+| `model`        | `string`                          | no       | AI model identifier (e.g. `"opus-4"`, `"sonnet-4"`)    |
+| `groups`       | `Array<{name, role?}>`            | no       | Groups to join on connect                               |
+| `timestamp`    | `number`                          | yes      | ms epoch; broker rejects if outside ±60 s of its clock  |
+| `signature`    | `string`                          | yes      | ed25519 signature over `${meshId}\|${memberId}\|${pubkey}\|${timestamp}` |
+
+---
+
+## Peer list
+
+The `peers_list` response includes session metadata for each connected
+peer, mirroring the fields sent in `hello`.
+
+```jsonc
+{
+  "type": "peers_list",
+  "peers": [
+    {
+      "pubkey": "<ed25519 hex>",
+      "displayName": "Mou",
+      "status": "working",
+      "summary": "Refactoring the scheduler",
+      "groups": [{ "name": "backend", "role": "lead" }],
+      "sessionId": "w1t0p0",
+      "connectedAt": "2025-06-04T10:30:00Z",
+      "cwd": "/home/user/project",
+      "peerType": "ai",
+      "channel": "claude-code",
+      "model": "opus-4"
+    }
+  ]
+}
+```
+
+| Field         | Type                              | Required | Description                                  |
+|---------------|-----------------------------------|----------|----------------------------------------------|
+| `pubkey`      | `string`                          | yes      | Peer's ed25519 public key (hex)              |
+| `displayName` | `string`                          | yes      | Human-readable name                          |
+| `status`      | `PeerStatus`                      | yes      | `"idle"`, `"working"`, or `"dnd"`            |
+| `summary`     | `string \| null`                  | yes      | Session summary set by the peer              |
+| `groups`      | `Array<{name, role?}>`            | yes      | Groups the peer belongs to                   |
+| `sessionId`   | `string`                          | yes      | Client session identifier                    |
+| `connectedAt` | `string`                          | yes      | ISO 8601 timestamp                           |
+| `cwd`         | `string`                          | no       | Working directory                            |
+| `peerType`    | `"ai" \| "human" \| "connector"` | no       | Peer kind                                    |
+| `channel`     | `string`                          | no       | Client channel                               |
+| `model`       | `string`                          | no       | AI model identifier                          |
+
+---
+
+## System notifications
+
+The broker broadcasts topology events as `push` messages with
+`subtype: "system"`. These are not encrypted — the broker generates
+them directly.
+
+```jsonc
+{
+  "type": "push",
+  "messageId": "msg_xyz",
+  "meshId": "acme-payments",
+  "senderPubkey": "<broker pubkey>",
+  "priority": "low",
+  "nonce": "",
+  "ciphertext": "",
+  "createdAt": "2025-06-04T10:30:00Z",
+  "subtype": "system",
+  "event": "peer_joined",
+  "eventData": {
+    "pubkey": "<ed25519 hex>",
+    "displayName": "Mou",
+    "peerType": "ai"
+  }
+}
+```
+
+| Field       | Type                       | Required | Description                                        |
+|-------------|----------------------------|----------|----------------------------------------------------|
+| `subtype`   | `"reminder" \| "system"`   | no       | `"system"` for topology events, `"reminder"` for scheduled deliveries |
+| `event`     | `string`                   | no       | Machine-readable event name (e.g. `"peer_joined"`, `"peer_left"`) |
+| `eventData` | `Record<string, unknown>`  | no       | Structured payload for the event                   |
+
+The standard `push` fields (`messageId`, `meshId`, `senderPubkey`,
+`priority`, `nonce`, `ciphertext`, `createdAt`) are always present.
+For system notifications, `nonce` and `ciphertext` are empty strings.
+
+---
+
+## Scheduled messages
+
+Peers can schedule one-shot or recurring messages for future delivery.
+When a scheduled message fires, the recipient receives a standard
+`push` with `subtype: "reminder"`.
+
+### `schedule` (peer → broker)
+
+```jsonc
+{
+  "type": "schedule",
+  "to": "<pubkey or display name>",
+  "message": "Stand-up in 5 minutes",
+  "deliverAt": 1717459200000,
+  "subtype": "reminder",
+  "cron": "0 9 * * 1-5",
+  "recurring": true
+}
+```
+
+| Field       | Type         | Required | Description                                                      |
+|-------------|--------------|----------|------------------------------------------------------------------|
+| `to`        | `string`     | yes      | Recipient — member pubkey or display name                        |
+| `message`   | `string`     | yes      | Plaintext message body                                           |
+| `deliverAt` | `number`     | yes      | Unix timestamp (ms). Ignored when `cron` is set.                 |
+| `subtype`   | `"reminder"` | no       | Semantic tag — surfaces differently to the receiver              |
+| `cron`      | `string`     | no       | Standard 5-field cron expression for recurring delivery          |
+| `recurring` | `boolean`    | no       | Whether this is a recurring schedule. Implied `true` when `cron` is set. |
+
+### `scheduled_ack` (broker → peer)
+
+```jsonc
+{
+  "type": "scheduled_ack",
+  "scheduledId": "sched_abc",
+  "deliverAt": 1717459200000,
+  "cron": "0 9 * * 1-5"
+}
+```
+
+| Field         | Type     | Required | Description                               |
+|---------------|----------|----------|-------------------------------------------|
+| `scheduledId` | `string` | yes      | Assigned id for the scheduled entry       |
+| `deliverAt`   | `number` | yes      | Resolved delivery time (ms epoch)         |
+| `cron`        | `string` | no       | Echoed cron expression for recurring entries |
+
+### `list_scheduled` (peer → broker)
+
+No payload fields beyond `type`.
+
+### `scheduled_list` (broker → peer)
+
+```jsonc
+{
+  "type": "scheduled_list",
+  "messages": [
+    {
+      "id": "sched_abc",
+      "to": "<pubkey>",
+      "message": "Stand-up in 5 minutes",
+      "deliverAt": 1717459200000,
+      "createdAt": 1717372800000,
+      "cron": "0 9 * * 1-5",
+      "firedCount": 3
+    }
+  ]
+}
+```
+
+| Field        | Type     | Required | Description                                   |
+|--------------|----------|----------|-----------------------------------------------|
+| `id`         | `string` | yes      | Scheduled entry id                            |
+| `to`         | `string` | yes      | Recipient                                     |
+| `message`    | `string` | yes      | Message body                                  |
+| `deliverAt`  | `number` | yes      | Next delivery time (ms epoch)                 |
+| `createdAt`  | `number` | yes      | When the entry was created (ms epoch)         |
+| `cron`       | `string` | no       | Cron expression, present for recurring entries|
+| `firedCount` | `number` | no       | Times the cron entry has fired so far         |
+
+### `cancel_scheduled` (peer → broker)
+
+| Field         | Type     | Required | Description                 |
+|---------------|----------|----------|-----------------------------|
+| `scheduledId` | `string` | yes      | Id of the entry to cancel   |
+
+### `cancel_scheduled_ack` (broker → peer)
+
+| Field         | Type      | Required | Description                     |
+|---------------|-----------|----------|---------------------------------|
+| `scheduledId` | `string`  | yes      | Echoed id                       |
+| `ok`          | `boolean` | yes      | Whether cancellation succeeded  |
+
+---
+
 ## Crypto
 
 - **Signing** — ed25519 (libsodium `crypto_sign`). One keypair per peer

docs/vision-20260407.md

@@ -0,0 +1,407 @@
+# claudemesh — Vision & Feature Brainstorm
+
+**Date:** 2026-04-07 23:01 CEST
+**Author:** Alejandro Gutiérrez + Claude (Opus 4.6)
+**Status:** Internal brainstorm — not committed to public roadmap
+**Last updated:** 2026-04-08 00:09 CEST
+
+---
+
+## Tier 1 — High impact, buildable now
+
+### 1. Session path (pwd) sharing — DONE
+
+Add `cwd` to the WS hello handshake. Broker stores it in the peer record, `list_peers` returns it. Peers on the same machine see each other's working directories — lets AI reference files across sessions without guessing paths.
+
+**Effort:** 30 min. One field in hello + peer list.
+
+> **Implemented:** 2026-04-07 23:30 · `810f372` · CLI 0.6.9 + broker deployed
+
+### 2. Peer metadata: human vs AI, channel type, model — DONE
+
+Extend the hello handshake with `peerType: "ai" | "human" | "connector"`, `channel?: "claude-code" | "telegram" | "slack" | "web"`, `model?: "opus-4" | "sonnet-4" | "gpt-5" | ...`. Broker stores and broadcasts it. `list_peers` shows it.
+
+**Why:** Foundation for connectors, human peers, and smart routing (send complex analysis to the Opus peer, quick tasks to Sonnet).
+
+**Effort:** 1 hour.
+
+> **Implemented:** 2026-04-07 23:30 · `810f372` · Shipped with item 1 (same commit)
+
+### 3. System notifications (join/leave/resource events) — DONE
+
+Broker pushes system-level messages when peers connect/disconnect, files get shared, state changes, tasks get created. Same `subtype` pattern as reminders: `{ type: "push", subtype: "system", event: "peer_joined", ... }`.
+
+**Why:** Mesh feels alive. AI can react to topology changes without polling.
+
+**Effort:** 2 hours.
+
+> **Implemented:** 2026-04-07 23:20 · `453705a` · peer_joined + peer_left broadcasts, system subtype in push
+
+### 4. Cron-based reminders — DONE
+
+Replace `setTimeout` with a persistent cron scheduler (broker-side). AI sends `schedule_reminder --cron "0 */2 * * *" --message "check deploy status"`. Broker uses `node-cron` or Drizzle-backed scheduler. Survives broker restarts.
+
+**Why:** Current reminders die if the broker restarts. Cron syntax is already familiar to AI.
+
+**Effort:** 2 hours (+ DB migration for persistence).
+
+> **Implemented:** 2026-04-07 23:35 · `e873807` · DB-persisted schedules, zero-dep cron parser, restart recovery, `--cron` CLI flag
+
+### 5. Heartbeats / session supervisor + simulation clock — DONE
+
+**Keepalive layer:** WebSocket ping/pong for connection health. A CLI-side supervisor monitors the WS connection and relaunches Claude Code if it drops. Broker marks peers as disconnected on WS close.
+
+**Simulation clock layer:** Heartbeats become a broker-driven clock that peers can subscribe to. The broker broadcasts periodic `{ subtype: "heartbeat", tick: 42, simTime: "2026-04-08T14:30:00Z", speed: "x10" }` messages at a configurable rate.
+
+**Time multiplier for load testing:**
+- `mesh_set_clock(speed: "x1")` — real-time, normal operation
+- `mesh_set_clock(speed: "x10")` — 1 hour of simulated activity in 6 minutes
+- `mesh_set_clock(speed: "x100")` — 1 day of simulated activity in ~15 minutes
+
+**Use case — infrastructure stress testing:** Spawn 10 AI peers, each simulating a real user persona (sales rep, admin, customer). Set the clock to x10. Each peer receives heartbeat ticks and acts according to the simulated time: "it's 9am, log in and check dashboard", "it's 11am, process 5 orders", "it's 3pm, run reports". The infrastructure sees realistic usage patterns at 10x speed.
+
+**What peers see:**
+```
+> mesh_clock()
+Simulation clock: x10 | sim time: 2026-04-08 14:30 | tick: 42/480
+
+> [heartbeat tick 43 — sim time: 14:36]
+  AI peer "Sales-Rep-1": creates 3 orders, searches inventory
+  AI peer "Admin-1": approves pending orders, checks stock levels
+  AI peer "Customer-1": browses catalog, adds to cart, checks out
+```
+
+**Components:**
+- Broker: clock state + periodic broadcast to all peers
+- MCP tools: `mesh_set_clock(speed)`, `mesh_clock()`, `mesh_pause_clock()`, `mesh_resume_clock()`
+- Peer behavior: AI reads tick + simTime from heartbeat, decides actions based on its persona and the simulated time of day
+- Reporting: broker collects action counts per tick, produces load profile after the run
+
+**Why this is powerful:** Unlike synthetic load testers (k6, Locust), AI peers exercise the *full stack* — UI flows, API sequences, edge cases, realistic data entry. They find bugs that scripted tests miss because they improvise like real users.
+
+**Effort:** 1 day (heartbeat + clock), 1 day (simulation framework + personas).
+
+> **Implemented:** 2026-04-07 · `05d9b56` · Per-mesh clock state, configurable speed x1-x100, auto-pause on empty mesh, heartbeat ticks via system push
+
+---
+
+## Tier 2 — Strong ideas, needs design
+
+### 6. Mesh webhooks / REST API / external WebSocket — PARTIAL (webhooks done)
+
+Three surfaces for external integration:
+
+- **Inbound webhooks:** `POST https://ic.claudemesh.com/hook/<mesh-id>/<secret>` → broker injects as a push to all peers or a specific group. GitHub, CI/CD, monitoring alerts become mesh messages.
+- **REST API:** Authenticated endpoints to send messages, read state, list peers from outside. Makes the mesh programmable from any language.
+- **External WS:** Non-Claude clients connect via WS with an API key (not a session keypair). Same protocol, different auth.
+
+**Prerequisite:** API keys per mesh (not ephemeral session keypairs).
+
+**Effort:** Half day (webhooks alone), 2-3 days (full API surface).
+
+> **Partial:** 2026-04-07 · `b55cf26` · Inbound webhooks implemented (POST /hook/:meshId/:secret → push to mesh). REST API and external WS remain.
+
+### 7. Connectors: Slack, Telegram as peers — DONE
+
+**Approach 1 — Connector-as-peer (recommended start):** A bridge process joins the mesh as a peer named "Slack-#general" and relays messages bidirectionally. Peers see it in `list_peers` with `peerType: "connector"`. One connector per channel.
+
+**Approach 2 — Connector-as-router:** Broker-level integration — messages to `#slack:general` route through a registered connector. More elegant, but complex.
+
+Ship as `claudemesh-connector-slack`, `claudemesh-connector-telegram`.
+
+**Effort:** 1-2 days each.
+
+> **Implemented:** 2026-04-07 · Slack: `5563f90` (Socket Mode, echo prevention, auto-reconnect) · Telegram: `fe92853` (zero-dep Bot API, long polling)
+
+### 8. Humans in the mesh
+
+Humans connect via the web dashboard or mobile app using the same WS protocol. `peerType: "human"` metadata tells AI to adjust communication style. The push system works natively in browsers (WS is bidirectional).
+
+**Challenge:** UX. Humans need a chat interface with typing indicators, read receipts, message history — not raw JSON. The dashboard already exists at claudemesh.com; extend it with a chat panel.
+
+**Effort:** 2-3 days (web chat panel).
+
+### 9. Connecting non-Claude-Code AI — DONE
+
+Any process that speaks the WS protocol can join. The barrier isn't the protocol — it's the MCP tool surface that makes Claude Code sessions first-class. For other LLMs:
+
+- **SDK approach:** `npm install claudemesh-sdk` — a JS/Python library that handles WS connection, crypto, and message parsing. Wrap any LLM's function-calling interface around it.
+- **Push delivery:** The push system works over WS. Non-Claude clients receive pushes the same way. The challenge is injecting them into the LLM's context — each platform has a different mechanism (OpenAI function results, Gemini tool responses, etc.).
+- **Adapter pattern:** `claudemesh-adapter-openai`, `claudemesh-adapter-cursor`, etc.
+
+**Effort:** 1 day (SDK), 1 day per adapter.
+
+> **Implemented:** 2026-04-07 · `7e102a2` · `@claudemesh/sdk` — standalone TypeScript SDK with libsodium crypto_box, EventEmitter API, auto-reconnect
+
+### 10. Mesh skills catalog — DONE
+
+Peers publish skills: `share_skill({ name: "pdf-generation", description: "...", instructions: "..." })`. Other peers `list_skills()` and `get_skill("pdf-generation")` to load instructions into their context. Broker stores skills like memory/state.
+
+**Why:** A mesh becomes a capability marketplace. One session installs a skill, all peers benefit. Skills can include tool definitions, system prompts, reference docs, and example workflows.
+
+**This is the killer feature.** It turns claudemesh from a messaging layer into a knowledge-sharing platform.
+
+**Effort:** 1 day.
+
+> **Implemented:** 2026-04-07 · `c8cb1e3` · Full CRUD (share/get/list/remove), upsert by name, ILIKE search, Drizzle schema
+
+### 11. Shared project files across peers — DONE
+
+When a peer connects, it registers accessible paths (opt-in per directory). Other peers request files: `get_peer_file(peer: "Alice", path: "src/auth.ts")`. The owning peer reads the file and returns it over the mesh.
+
+**Security scoping options:**
+- Opt-in per directory: `claudemesh launch --share-dir ./src`
+- Same-machine only (detect via hostname/IP)
+- Approval per request
+
+**Effort:** 1 day.
+
+> **Implemented:** 2026-04-07 · `504111c` · Broker relay (never reads content), CLI file serving with 1MB cap, path traversal rejection, hidden files excluded, 2-level dir listing. Plus hostname-based local/remote detection (`2c9c8c7`) and filesystem shortcut hint (`a92cf6b`).
+
+### 12. Peer stats (context consumption, token usage) — DONE
+
+Peers self-report: `set_status` extended with `contextUsed: 85000, contextMax: 200000, tokensIn: 12000, tokensOut: 8000`. Dashboard shows burn rate. Useful for load balancing — route work to the peer with the most context headroom.
+
+**Limitation:** Claude Code doesn't expose context usage via API. Would need estimation from conversation length or `/cost` command parsing.
+
+**Effort:** Half day (reporting infrastructure), unknown (accurate context measurement).
+
+> **Implemented:** 2026-04-07 · `b3b9972` · Auto-reporting every 60s (messagesIn/Out, toolCalls, uptime, errors), mesh_stats MCP tool, stats in list_peers
+
+---
+
+## Tier 3 — Big bets, needs careful thought
+
+### 13. Mesh blockchain / signed audit log — DONE (audit log)
+
+**Honest assessment:** A full blockchain is overkill for a cooperative mesh. What's actually valuable is the useful parts:
+
+- **Signed append-only log:** Immutable record of all decisions, state changes, and messages. Merkle tree integrity. Useful for compliance, debugging, and "who decided what."
+- **Conflict resolution:** Vector clocks or CRDTs for state, instead of last-write-wins.
+- **Reputation:** Track which peers deliver on tasks, respond promptly, produce quality work.
+
+**Reframe as:** Signed audit trail with integrity proofs. Not a blockchain, but the valuable properties of one.
+
+**Effort:** 3-5 days.
+
+> **Implemented:** 2026-04-07 · `86a2583` · SHA-256 hash chain audit log, append-only, no message content logged, chain verification endpoint, paginated query
+
+### 14. Mesh of meshes / bridge
+
+A meta-broker that routes between meshes. Use case: `dev-team` mesh and `ops-team` mesh coordinate on deploys.
+
+**Simple version:** A bridge peer joins both meshes and relays tagged messages. No broker changes needed. Already feasible with today's protocol.
+
+**Federation version:** Broker-to-broker peering protocol. Brokers exchange presence and route ciphertext across organizations.
+
+**Effort:** 1 day (bridge peer), 1-2 weeks (federation protocol).
+
+### 15. Mesh templates on creation — DONE
+
+Predefined mesh configurations: roles, groups, state keys, system prompts, skills, and governance rules. Examples:
+
+- `dev-team`: @frontend, @backend, @devops groups; lead/member roles; state keys for sprint/deploy-frozen
+- `research`: @analysis, @writing groups; shared memory focus; context-sharing optimized
+- `ops-incident`: @oncall, @comms groups; high-urgency defaults; auto-escalation rules
+
+Templates are JSON files. `claudemesh create --template dev-team` applies them at mesh creation. Templates are editable post-creation by mesh admin (or anyone, depending on governance).
+
+**Effort:** Half day.
+
+> **Implemented:** 2026-04-07 · `69e93d4` · 5 templates (dev-team, research, ops-incident, simulation, personal) + `claudemesh create` command
+
+### 16. Default private mesh per user — DONE
+
+On `claudemesh install`, auto-create a personal mesh with the user as sole member. All their Claude Code sessions join by default. Zero-config — instant value without understanding meshes.
+
+**Effort:** Half day.
+
+> **Implemented:** 2026-04-07 · `b0dc538` · Install detects empty meshes, shows join guidance. Local-only mesh deferred (requires broker enrollment).
+
+### 17. Mesh MCP proxy (dynamic tools without session restart) — DONE
+
+**Problem:** Claude Code loads MCP servers at startup. You can't inject new tool definitions into a running session.
+
+**Solution:** Route through the existing claudemesh MCP connection. A generic `mesh_tool_call` tool proxies to MCP servers registered in the mesh at runtime — no restart needed.
+
+**Flow:**
+1. A peer registers an MCP server: `mesh_mcp_register(name: "github", transport: "stdio", command: "npx @github/mcp")`
+2. Broker stores the registration
+3. Any peer calls `mesh_tool_call(server: "github", tool: "list_repos", args: {...})`
+4. Broker routes to the hosting peer or a shared sidecar process
+5. That host invokes the actual MCP server, returns the result through the mesh
+6. Calling peer gets the response — all through the existing claudemesh WS connection
+
+**Two hosting models:**
+- **Peer-hosted:** The registering peer runs the MCP server locally. Other peers proxy through them. If that peer disconnects, the MCP goes offline.
+- **Broker-hosted:** The broker spawns the MCP server as a sidecar. Always available. Better for shared tools (database, GitHub, Jira).
+
+**What AI sees:**
+```
+> mesh_mcp_list()
+Available mesh MCP servers:
+- github (hosted by: Alice) — tools: list_repos, create_issue, ...
+- jira (hosted by: broker) — tools: search_issues, create_ticket, ...
+- postgres-prod (hosted by: broker) — tools: query, execute
+
+> mesh_tool_call(server: "github", tool: "create_issue", args: {repo: "...", title: "..."})
+Issue #42 created.
+```
+
+**Limitation:** Claude Code won't see these as first-class tools in its tool list — AI needs to know to use `mesh_tool_call`. MCP server instructions document the proxy pattern.
+
+**New MCP tools needed:** `mesh_mcp_register`, `mesh_mcp_list`, `mesh_tool_call`, `mesh_mcp_remove`
+
+**Effort:** 2-3 days.
+
+> **Implemented:** 2026-04-07 · `08e289a` · Full round-trip: register → list → call → forward → execute → result. In-memory registry, 30s call timeout, auto-cleanup on disconnect.
+
+### 18. Sandbox for code execution
+
+Each mesh gets optional compute sandboxes (Docker containers, Firecracker VMs, or E2B-style). Peers request: `execute_code(lang: "python", code: "...")`. Broker provisions a sandbox, runs the code, returns stdout/stderr. Resources scale on demand as peers need sandboxes.
+
+**Build vs integrate:**
+- **Build:** Docker-in-Docker on the broker host. Simple but security-sensitive.
+- **Integrate:** E2B, Modal, or Fly Machines as the sandbox backend. claudemesh MCP tool is a thin client. Scales naturally.
+
+**Effort:** 2-3 days (E2B integration), 1-2 weeks (self-hosted sandboxes).
+
+### 19. Mesh dashboard (real-time situational awareness) — DONE
+
+Live web UI at claudemesh.com/dashboard showing:
+- **Peer graph:** Who's connected, status, groups, roles — nodes and edges
+- **Message flow:** Animated edges showing real-time traffic between peers
+- **State/memory timeline:** When values changed and who changed them
+- **Resource panel:** Files shared, tasks active, skills available
+- **Peer detail:** Click a peer → see summary, context usage, message history
+
+Broker already tracks everything needed. Dashboard subscribes via WS and renders with D3/React.
+
+**Effort:** 2-3 days (functional), 1 week (polished).
+
+> **Implemented:** 2026-04-07 · `59332dc` peer graph (radial SVG, animated edges, group rings) + `7d432b3` state timeline + resource panel. Peer detail view remains.
+
+### 20. Peer visibility and spatial topology — DONE (visibility + profiles)
+
+Control which peers can see each other. Instead of a flat mesh where everyone sees everyone, the broker filters `list_peers` responses and message routing based on visibility rules.
+
+**Three visibility models:**
+
+- **Proximity-based (simulation):** Each peer has coordinates `(x, y)` and a visibility radius. Only peers within range appear in `list_peers`. `set_position(x, y)` changes who you can see — spatial fog of war. Combined with the simulation clock, this creates emergent behavior: a "customer" peer walks into a "store zone", suddenly sees "sales rep" peers, initiates interaction.
+- **Scope-based (organizational):** Visibility follows group membership. Peers in `@frontend` see each other and `@leads`, but not `@backend` internals. Org-chart visibility without exposing every department.
+- **Manual/dynamic:** Peers or admins explicitly show/hide. `set_visible(false)` to go stealth (connected but invisible). Admin can force visibility/invisibility.
+
+**Who controls visibility:**
+- **Broker rules** — mesh-wide policy set at creation or via template (e.g., "proximity" mode for simulations, "scope" for orgs)
+- **Peer self-control** — `set_visible(false)` to go stealth, `set_position(x, y)` to move in proximity mode
+- **Admin override** — mesh admin force-shows or force-hides peers
+- **Dynamic conditions** — broker changes visibility based on state keys, clock ticks, or events
+
+**Notifications:** Peers receive `{ subtype: "system", event: "peer_visible" }` when a new peer enters their visibility and `peer_hidden` when one leaves. Different from join/leave — the peer is still connected, just not visible to you.
+
+**Peer public profile (outside image):** Each peer has a public-facing profile that other peers see — a curated view separate from internal state. Fields: `avatar` (emoji or URL), `title` (short role label), `bio` (one-liner), `capabilities` (what I can help with). Set via `set_profile({ avatar: "🔧", title: "DevOps Lead", bio: "Infrastructure and deploys" })`. This is what appears on the peer graph node and in `list_peers`. Peers choose how they present themselves to the mesh.
+
+**MCP tools:** `set_visible(visible)`, `set_position(x, y)`, `set_profile(profile)`, `get_visible_peers()`, `set_visibility_mode(mode)` (admin only)
+
+**Effort:** 2-3 days.
+
+> **Partial:** 2026-04-07 · Visibility toggle (set_visible), public profiles (set_profile), hidden peer filtering in list_peers, peer_visible/peer_hidden system events, direct messages still reach hidden peers. Remaining: proximity-based (x,y coordinates), scope-based (group visibility rules).
+
+### 21. Semantic peer search
+
+In large meshes (50+ peers), scanning `list_peers` output is noise. A `search_peers` tool that filters and ranks by multiple dimensions:
+
+- **Structured filters:** name, group, role, status, peerType, channel, model, cwd
+- **Free-text search:** matches against peer summaries, profile bios, capabilities, and shared skills
+- **Capability matching:** "find a peer that knows about database migrations" searches across profile capabilities + skills catalog + recent summaries
+- **Ranking:** peers with more matching dimensions rank higher; active (idle/working) peers rank above DND/offline
+
+**MCP tool:** `search_peers(query, filters?)` — returns a ranked list of matching peers with relevance scores.
+
+**Implementation:** Broker-side — accepts a `search_peers` message, runs multi-field matching against the in-memory peer list + skills table. No external search engine needed for <500 peers; for larger meshes, wire into the existing Qdrant vector store (already available via `vector_search`).
+
+**Effort:** Half day.
+
+### 22. Mesh telemetry and debugging
+
+A structured logging system where peers report errors, warnings, and debug info to the broker. Goes beyond the audit log (which tracks events) — this tracks operational health.
+
+**What peers report:**
+- Errors: tool failures, connection drops, unhandled exceptions
+- Warnings: high context usage, slow responses, retry patterns
+- Debug: decision traces, task reasoning, why a particular approach was chosen
+- Performance: response latency per tool call, message round-trip times
+
+**Broker storage:** Structured logs indexed by mesh, peer, timestamp, severity. Retained for N days (configurable). Queryable via WS messages.
+
+**AI self-analysis:** Peers query their own logs to identify patterns: "I've hit this error 3 times in the last hour — what's common?" The mesh becomes self-diagnosing. Leads can query team-wide logs: "Which peers are seeing errors in the deploy flow?"
+
+**Reporting:** Aggregated metrics per peer, per mesh, per time window. Error rates, common failure modes, response time percentiles. Surfaced in the dashboard or via `mesh_report(timeframe: "24h")`.
+
+**MCP tools:**
+- `mesh_log(level, message, data?)` — report a log entry
+- `mesh_logs(query?, peer?, level?, last?)` — query logs
+- `mesh_report(timeframe?)` — aggregated health report
+
+**Effort:** 1-2 days.
+
+### 23. Peer session persistence ("welcome back")
+
+When a peer disconnects, their state is lost (groups, profile, visibility, stats, summary). On reconnect they start blank. Persist peer state so returning peers resume where they left off.
+
+**What persists (keyed by meshId + memberId):**
+- Groups and roles
+- Profile (avatar, title, bio, capabilities)
+- Visibility setting
+- Last summary
+- Cumulative stats (messages, tool calls across all sessions)
+- Last seen timestamp
+
+**What resets:** status (always "idle" on connect), WebSocket/presenceId (ephemeral).
+
+**Reconnect flow:**
+1. Peer sends hello with same `memberId`
+2. Broker looks up `peer_state` table for (meshId, memberId)
+3. If found: restore groups, profile, visibility, stats — hello fields take precedence if explicitly set
+4. Enriched `hello_ack` includes `restored: true` and previous summary
+5. System notification: `"Welcome back, Alice! Last seen 2h ago. Restored: @frontend:lead, @devops:member"`
+6. On disconnect: upsert current state to `peer_state`
+
+**Why:** AI sessions restart often (context limits, crashes, new tasks). Without persistence, every reconnect requires manual group joins and profile setup. With it, the mesh remembers who you are.
+
+**Effort:** Half day.
+
+---
+
+## Suggested build order
+
+| # | Feature | Effort | Unlocks | Status |
+|---|---------|--------|---------|--------|
+| 1 | Session path sharing | 30 min | File referencing across sessions | **DONE** `810f372` |
+| 2 | Peer metadata (type/channel/model) | 1 hour | Connectors, humans, smart routing | **DONE** `810f372` |
+| 3 | System notifications | 2 hours | Reactive mesh, awareness | **DONE** `453705a` |
+| 4 | Cron reminders | 2 hours | Persistent scheduling | **DONE** `e873807` |
+| 5 | Mesh templates | Half day | Better onboarding | **DONE** `69e93d4` |
+| 6 | Default personal mesh | Half day | Zero-config start | **DONE** `b0dc538` |
+| 7 | Inbound webhooks | Half day | External integrations | **DONE** `b55cf26` |
+| 8 | Skills catalog | 1 day | Knowledge marketplace | **DONE** `c8cb1e3` |
+| 9 | Shared project files | 1 day | Cross-session file access | **DONE** `504111c` |
+| 10 | Slack connector | 1-2 days | Reach beyond Claude Code | **DONE** `5563f90` |
+| 11 | Mesh MCP proxy | 2-3 days | Dynamic tools without restart | **DONE** `08e289a` |
+| 12 | Dashboard (real-time) | 2-3 days | Visual situational awareness | **DONE** `59332dc` + `7d432b3` |
+| 13 | Human peers (web chat) | 2-3 days | Humans in the loop | |
+| 14 | Simulation clock (heartbeat x1-x100) | 2 days | AI-driven load testing | **DONE** `05d9b56` |
+| 15 | Sandboxes (E2B) | 2-3 days | Shared compute | |
+| 16 | Signed audit log | 3-5 days | Trust, compliance | **DONE** `86a2583` |
+| 17 | Bridge / federation | 1-2 weeks | Multi-mesh coordination | |
+| 18 | Peer visibility + profiles | 2-3 days | Simulation fog-of-war, org scoping | **DONE** (types.ts/index.ts) |
+| 19 | Semantic peer search | Half day | Discovery in large meshes | |
+| 20 | Peer stats reporting | Half day | Resource awareness, load balancing | **DONE** `b3b9972` |
+| 21 | SDK (@claudemesh/sdk) | 1 day | Non-Claude-Code clients | **DONE** `7e102a2` |
+| 22 | Telegram connector | 1-2 days | Reach beyond Claude Code | **DONE** `fe92853` |
+| 23 | Mesh telemetry + debugging | 1-2 days | Self-diagnosing mesh | |
+| 24 | Peer session persistence | Half day | "Welcome back" on reconnect | |
+
+---
+
+*This document captures a brainstorming session. Items are not commitments. Priorities will shift as we build and learn.*

marketing/COPY.md

@@ -30,14 +30,16 @@ The work doubles. The context dies on every restart.
 
 ## What claudemesh does
 
-claudemesh is a self-hosted broker that connects Claude Code sessions across machines into one live mesh.
+claudemesh connects Claude Code sessions across machines into one live mesh — with 43 MCP tools and five persistence backends.
 
-- Every session announces what it is working on.
-- Any session can message another — by human name, by repo, by machine.
-- Messages route through a local WebSocket broker you run yourself.
-- Presence, priority, and status are tracked automatically from each session's activity.
+- **Messaging:** Send by name, @group, or broadcast. Three priority tiers. E2E encrypted (crypto_box). Scheduled messages and reminders.
+- **Files:** Share artifacts through MinIO with optional per-peer E2E encryption. Grant access later. Audit trail.
+- **Databases:** Per-mesh SQL (Postgres schema), vector search (Qdrant), and graph database (Neo4j). Agents create tables, store embeddings, and run Cypher queries.
+- **State & Memory:** Shared key-value state with instant push. Full-text searchable memory that survives across sessions.
+- **Streams & Tasks:** Real-time pub/sub data streams. Lightweight task board with claim/complete workflow.
+- **Presence:** Status detected automatically from Claude Code hooks. Three-source priority model. DND gates.
 
-No cloud account. No training on your code. Your mesh, your machines, your rules.
+No training on your code. The broker routes ciphertext — it never reads your messages.
 
 ---
 
@@ -67,11 +69,12 @@ Release Claude opens a PR. Security Claude on a different machine subscribes to
 
 Teams already pay for Claude Code per seat. claudemesh multiplies what those seats do together.
 
-- **Context survives handoffs.** One agent hands work to the next with full history. No rebuilding.
+- **Context survives handoffs.** Shared memory, files, and databases carry forward. No rebuilding.
 - **Decisions stay in the tool.** No copy-paste into Slack, Jira, or a meeting that did not need to happen.
-- **Work parallelises.** Six agents on six machines can coordinate on the same release without humans playing telephone.
-- **Your data stays local.** Self-hosted broker. Messages never leave your network.
-- **Audit trail by default.** Every message, every status, every handoff, logged.
+- **Work parallelises.** Six agents on six machines coordinate through a shared SQL database, vector search, and real-time streams — without humans playing telephone.
+- **Your data stays encrypted.** E2E crypto_box on messages and files. The broker routes ciphertext.
+- **Five persistence layers.** KV state, full-text memory, SQL, vectors, graphs — agents pick the right tool.
+- **Audit trail by default.** Every message, every status, every file access, logged.
 
 claudemesh does not replace the engineer. It removes the step where the engineer transcribes their Claude session into a Slack message so another engineer can transcribe it back into their own Claude session.
 

package.json

@@ -47,16 +47,50 @@
       "duckdb",
       "better-sqlite3",
       "sharp"
-    ],
-    "overrides": {
-      "csstype": "3.1.3",
-      "@types/react": "19.2.7"
-    }
+    ]
   },
   "engines": {
     "node": ">=22.17.0"
   },
   "dependencies": {
     "react": "19.2.3"
+  },
+  "overrides": {
+    "csstype": "3.1.3",
+    "@types/react": "19.2.7"
+  },
+  "workspaces": {
+    "packages": [
+      "apps/*",
+      "packages/**",
+      "tooling/*"
+    ],
+    "catalog": {
+      "@tanstack/react-query": "5.90.6",
+      "@tanstack/react-query-devtools": "5.90.2",
+      "@tanstack/react-table": "8.21.3",
+      "@vitest/coverage-v8": "4.0.14",
+      "@ai-sdk/react": "2.0.94",
+      "ai": "5.0.94",
+      "envin": "1.1.10",
+      "eslint": "9.39.0",
+      "prettier": "3.6.2",
+      "react-hook-form": "7.66.0",
+      "react-native": "0.81.5",
+      "typescript": "5.9.3",
+      "vitest": "4.0.14",
+      "zod": "4.1.13"
+    },
+    "catalogs": {
+      "node22": {
+        "@types/node": "22.16.0"
+      },
+      "react19": {
+        "@types/react": "19.1.14",
+        "@types/react-dom": "19.1.9",
+        "react": "19.1.0",
+        "react-dom": "19.1.0"
+      }
+    }
   }
 }

packages/connector-slack/README.md

@@ -0,0 +1,102 @@
+# @claudemesh/connector-slack
+
+Slack connector for claudemesh -- relay messages between a Slack channel and mesh peers.
+
+The connector joins the mesh as a peer with `peerType: "connector"` and `channel: "slack"`, bridging messages bidirectionally:
+
+- **Slack -> Mesh**: Messages from the Slack channel are broadcast to all mesh peers, formatted as `[SlackUser via Slack #channel] message`.
+- **Mesh -> Slack**: Push messages received from mesh peers are posted to the Slack channel, formatted as `*[MeshPeerName]*: message`.
+
+## Prerequisites
+
+### 1. Create a Slack App
+
+1. Go to [api.slack.com/apps](https://api.slack.com/apps) and click **Create New App** > **From scratch**.
+2. Name it (e.g. "claudemesh bridge") and select your workspace.
+
+### 2. Configure Bot Token Scopes
+
+Under **OAuth & Permissions** > **Bot Token Scopes**, add:
+
+- `chat:write` -- post messages to channels
+- `channels:read` -- list public channels
+- `channels:history` -- read message history in public channels
+- `users:read` -- resolve user IDs to display names
+
+### 3. Enable Socket Mode
+
+Under **Socket Mode**, toggle it **on**. This generates an **App-Level Token** (`xapp-...`). You'll need this for the `SLACK_APP_TOKEN` env var.
+
+Socket Mode means no public URL is required -- the connector connects outbound to Slack's WebSocket servers.
+
+### 4. Subscribe to Events
+
+Under **Event Subscriptions**, enable events and add the following **Bot Events**:
+
+- `message.channels` -- listen for messages in public channels
+
+### 5. Install the App
+
+Under **Install App**, click **Install to Workspace** and authorize. Copy the **Bot User OAuth Token** (`xoxb-...`) for the `SLACK_BOT_TOKEN` env var.
+
+### 6. Invite the Bot
+
+Invite the bot to the channel you want to bridge:
+```
+/invite @claudemesh-bridge
+```
+
+### 7. Get the Channel ID
+
+Right-click the channel name in Slack > **View channel details** > copy the Channel ID at the bottom (e.g. `C0123456789`).
+
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `SLACK_BOT_TOKEN` | Yes | Bot User OAuth Token (`xoxb-...`) |
+| `SLACK_APP_TOKEN` | Yes | App-Level Token for Socket Mode (`xapp-...`) |
+| `SLACK_CHANNEL_ID` | Yes | Channel ID to bridge (e.g. `C0123456789`) |
+| `MESH_BROKER_URL` | Yes | Broker WebSocket URL (e.g. `wss://ic.claudemesh.com/ws`) |
+| `MESH_ID` | Yes | Mesh UUID |
+| `MESH_MEMBER_ID` | Yes | Member UUID for this connector's membership |
+| `MESH_PUBKEY` | Yes | Ed25519 public key (64 hex chars) |
+| `MESH_SECRET_KEY` | Yes | Ed25519 secret key (128 hex chars) |
+| `MESH_DISPLAY_NAME` | No | Display name visible to peers (default: `"Slack-connector"`) |
+
+## Running
+
+```bash
+# Install dependencies
+npm install
+
+# Build
+npm run build
+
+# Run
+SLACK_BOT_TOKEN=xoxb-... \
+SLACK_APP_TOKEN=xapp-... \
+SLACK_CHANNEL_ID=C0123456789 \
+MESH_BROKER_URL=wss://ic.claudemesh.com/ws \
+MESH_ID=your-mesh-uuid \
+MESH_MEMBER_ID=your-member-uuid \
+MESH_PUBKEY=your-pubkey-hex \
+MESH_SECRET_KEY=your-secret-key-hex \
+MESH_DISPLAY_NAME="Slack-#general" \
+npm start
+```
+
+## Architecture
+
+```
+Slack (Socket Mode)          Connector               claudemesh Broker
+     |                          |                          |
+     |-- message event -------->|                          |
+     |                          |-- send (broadcast) ----->|
+     |                          |                          |-- push --> peers
+     |                          |                          |
+     |                          |<---- push (from peer) ---|
+     |<-- chat.postMessage -----|                          |
+```
+
+The connector uses Socket Mode for Slack (outbound WebSocket, no public URL needed) and a standard claudemesh WS client for the mesh connection. Both connections auto-reconnect on failure.

packages/connector-slack/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@claudemesh/connector-slack",
+  "version": "0.1.0",
+  "description": "Slack connector for claudemesh — relay messages between Slack channels and mesh peers",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@slack/socket-mode": "^2.0.0",
+    "@slack/web-api": "^7.0.0",
+    "tweetnacl": "^1.0.3",
+    "tweetnacl-util": "^0.15.1",
+    "ws": "8.20.0"
+  },
+  "devDependencies": {
+    "@types/ws": "8.5.13",
+    "typescript": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT"
+}

packages/connector-slack/src/bridge.ts

@@ -0,0 +1,97 @@
+/**
+ * Bridge — bidirectional message relay between Slack and a claudemesh mesh.
+ *
+ * Slack -> Mesh: messages from the Slack channel are broadcast to mesh peers.
+ * Mesh -> Slack: push messages addressed to this connector (or broadcast)
+ *                are posted to the Slack channel.
+ */
+
+import type { SlackClient } from "./slack";
+import type { MeshClient } from "./mesh-client";
+import type { SlackConnectorConfig } from "./config";
+
+export class Bridge {
+  private slack: SlackClient;
+  private mesh: MeshClient;
+  private config: SlackConnectorConfig;
+  private unsubSlack: (() => void) | null = null;
+  private unsubMesh: (() => void) | null = null;
+  /** Track message IDs we've relayed to avoid echo loops. */
+  private recentRelayed = new Set<string>();
+  private cleanupTimer: NodeJS.Timeout | null = null;
+
+  constructor(
+    slack: SlackClient,
+    mesh: MeshClient,
+    config: SlackConnectorConfig,
+  ) {
+    this.slack = slack;
+    this.mesh = mesh;
+    this.config = config;
+  }
+
+  /**
+   * Start the bidirectional relay.
+   */
+  start(): void {
+    // --- Slack -> Mesh ---
+    this.unsubSlack = this.slack.onMessage((msg) => {
+      const channelName = this.config.slackChannelId;
+      const formatted = `[${msg.displayName} via Slack #${channelName}] ${msg.text}`;
+
+      // Broadcast to all mesh peers
+      this.mesh.broadcast(formatted).catch((err) => {
+        console.error("[bridge] Failed to relay Slack->Mesh:", err);
+      });
+    });
+
+    // --- Mesh -> Slack ---
+    this.unsubMesh = this.mesh.onPush((push) => {
+      // Skip messages we ourselves sent (echo prevention)
+      if (this.recentRelayed.has(push.messageId)) {
+        this.recentRelayed.delete(push.messageId);
+        return;
+      }
+
+      // Skip system events (peer_joined, peer_left) — too noisy for Slack
+      if (push.subtype === "system") return;
+
+      const plaintext = push.plaintext;
+      if (!plaintext) return;
+
+      // Resolve sender name from the push metadata
+      const senderName = push.senderName || push.senderPubkey.slice(0, 8);
+      const formatted = `*[${senderName}]*: ${plaintext}`;
+
+      this.slack.postMessage(formatted).catch((err) => {
+        console.error("[bridge] Failed to relay Mesh->Slack:", err);
+      });
+    });
+
+    // Periodically clean the echo-prevention set to prevent memory leaks
+    this.cleanupTimer = setInterval(() => {
+      this.recentRelayed.clear();
+    }, 60_000);
+
+    console.log("[bridge] Relay started");
+  }
+
+  /**
+   * Stop the relay and clean up subscriptions.
+   */
+  stop(): void {
+    if (this.unsubSlack) {
+      this.unsubSlack();
+      this.unsubSlack = null;
+    }
+    if (this.unsubMesh) {
+      this.unsubMesh();
+      this.unsubMesh = null;
+    }
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+    console.log("[bridge] Relay stopped");
+  }
+}

packages/connector-slack/src/config.ts

@@ -0,0 +1,71 @@
+/**
+ * Configuration types for the Slack connector.
+ *
+ * All values are loaded from environment variables in index.ts.
+ */
+
+export interface SlackConnectorConfig {
+  // Slack
+  /** Bot User OAuth Token (xoxb-...) */
+  slackBotToken: string;
+  /** App-Level Token for Socket Mode (xapp-...) */
+  slackAppToken: string;
+  /** Channel ID to bridge (e.g. C0123456789) */
+  slackChannelId: string;
+
+  // Mesh
+  /** WebSocket URL of the claudemesh broker (wss://...) */
+  brokerUrl: string;
+  /** Mesh UUID */
+  meshId: string;
+  /** Member UUID (this connector's membership) */
+  memberId: string;
+  /** Ed25519 public key, hex-encoded (64 chars) */
+  pubkey: string;
+  /** Ed25519 secret key, hex-encoded (128 chars) */
+  secretKey: string;
+  /** Display name visible to mesh peers (e.g. "Slack-#general") */
+  displayName: string;
+}
+
+/**
+ * Load config from environment variables, throwing on any missing required var.
+ */
+export function loadConfigFromEnv(): SlackConnectorConfig {
+  const required: Array<[keyof SlackConnectorConfig, string]> = [
+    ["slackBotToken", "SLACK_BOT_TOKEN"],
+    ["slackAppToken", "SLACK_APP_TOKEN"],
+    ["slackChannelId", "SLACK_CHANNEL_ID"],
+    ["brokerUrl", "MESH_BROKER_URL"],
+    ["meshId", "MESH_ID"],
+    ["memberId", "MESH_MEMBER_ID"],
+    ["pubkey", "MESH_PUBKEY"],
+    ["secretKey", "MESH_SECRET_KEY"],
+  ];
+
+  const missing: string[] = [];
+  const values: Record<string, string> = {};
+
+  for (const [key, envVar] of required) {
+    const val = process.env[envVar];
+    if (!val) {
+      missing.push(envVar);
+    } else {
+      values[key] = val;
+    }
+  }
+
+  if (missing.length > 0) {
+    throw new Error(
+      `Missing required environment variables: ${missing.join(", ")}`,
+    );
+  }
+
+  return {
+    ...(values as unknown as Omit<SlackConnectorConfig, "displayName">),
+    displayName:
+      process.env.MESH_DISPLAY_NAME ??
+      process.env.DISPLAY_NAME ??
+      "Slack-connector",
+  };
+}

packages/connector-slack/src/index.ts

@@ -0,0 +1,77 @@
+/**
+ * @claudemesh/connector-slack — entry point.
+ *
+ * Bridges a Slack channel to a claudemesh mesh, relaying messages
+ * bidirectionally. The connector joins the mesh as a peer with
+ * peerType: "connector" and channel: "slack".
+ *
+ * Usage:
+ *   SLACK_BOT_TOKEN=xoxb-... \
+ *   SLACK_APP_TOKEN=xapp-... \
+ *   SLACK_CHANNEL_ID=C0123456789 \
+ *   MESH_BROKER_URL=wss://ic.claudemesh.com/ws \
+ *   MESH_ID=... \
+ *   MESH_MEMBER_ID=... \
+ *   MESH_PUBKEY=... \
+ *   MESH_SECRET_KEY=... \
+ *   MESH_DISPLAY_NAME="Slack-#general" \
+ *   node dist/index.js
+ */
+
+import { loadConfigFromEnv } from "./config";
+import { SlackClient } from "./slack";
+import { MeshClient } from "./mesh-client";
+import { Bridge } from "./bridge";
+
+async function main(): Promise<void> {
+  console.log("[connector-slack] Loading configuration...");
+  const config = loadConfigFromEnv();
+
+  // --- Connect to mesh ---
+  console.log(
+    `[connector-slack] Connecting to mesh ${config.meshId} at ${config.brokerUrl}...`,
+  );
+  const mesh = new MeshClient(config);
+  await mesh.connect();
+  console.log(
+    `[connector-slack] Mesh connected as "${config.displayName}" (peerType: connector, channel: slack)`,
+  );
+  mesh.setSummary(
+    `Slack connector bridging channel ${config.slackChannelId} to this mesh`,
+  );
+
+  // --- Connect to Slack ---
+  console.log("[connector-slack] Connecting to Slack via Socket Mode...");
+  const slack = new SlackClient(
+    config.slackBotToken,
+    config.slackAppToken,
+    config.slackChannelId,
+  );
+  await slack.connect();
+  console.log(
+    `[connector-slack] Slack connected, listening on channel ${config.slackChannelId}`,
+  );
+
+  // --- Start bridge ---
+  const bridge = new Bridge(slack, mesh, config);
+  bridge.start();
+  console.log("[connector-slack] Bridge active. Relaying messages...");
+
+  // --- Graceful shutdown ---
+  const shutdown = async (signal: string): Promise<void> => {
+    console.log(`\n[connector-slack] Received ${signal}, shutting down...`);
+    bridge.stop();
+    await slack.disconnect();
+    mesh.close();
+    console.log("[connector-slack] Goodbye.");
+    process.exit(0);
+  };
+
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+
+main().catch((err) => {
+  console.error("[connector-slack] Fatal:", err);
+  process.exit(1);
+});

packages/connector-slack/src/mesh-client.ts

@@ -0,0 +1,405 @@
+/**
+ * Minimal WebSocket client for the claudemesh broker.
+ *
+ * Handles:
+ *   - hello handshake with ed25519 signature (peerType: "connector")
+ *   - send / ack message flow
+ *   - broadcast (targetSpec: "*")
+ *   - inbound push messages
+ *   - auto-reconnect with exponential backoff
+ *
+ * Kept intentionally standalone — no dependency on the CLI's BrokerClient
+ * so this package can be installed and run independently.
+ */
+
+import WebSocket from "ws";
+import nacl from "tweetnacl";
+import naclUtil from "tweetnacl-util";
+import { randomBytes } from "node:crypto";
+import type { SlackConnectorConfig } from "./config";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export type Priority = "now" | "next" | "low";
+
+export interface InboundPush {
+  messageId: string;
+  meshId: string;
+  senderPubkey: string;
+  senderName: string;
+  priority: Priority;
+  nonce: string;
+  ciphertext: string;
+  createdAt: string;
+  receivedAt: string;
+  plaintext: string | null;
+  kind: "direct" | "broadcast" | "channel" | "unknown";
+  subtype?: "reminder" | "system";
+  event?: string;
+  eventData?: Record<string, unknown>;
+}
+
+type PushHandler = (push: InboundPush) => void;
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function randomId(): string {
+  return randomBytes(12).toString("hex");
+}
+
+/**
+ * Sign the hello handshake.
+ *
+ * Canonical bytes: `${meshId}|${memberId}|${pubkey}|${timestamp}`
+ * Must match the broker's canonicalHello() exactly.
+ */
+function signHello(
+  meshId: string,
+  memberId: string,
+  pubkey: string,
+  secretKeyHex: string,
+): { timestamp: number; signature: string } {
+  const timestamp = Date.now();
+  const canonical = `${meshId}|${memberId}|${pubkey}|${timestamp}`;
+  const messageBytes = naclUtil.decodeUTF8(canonical);
+  const secretKey = Buffer.from(secretKeyHex, "hex");
+  const sig = nacl.sign.detached(messageBytes, secretKey);
+  return {
+    timestamp,
+    signature: Buffer.from(sig).toString("hex"),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// MeshClient
+// ---------------------------------------------------------------------------
+
+const HELLO_ACK_TIMEOUT_MS = 5_000;
+const BACKOFF_CAPS = [1_000, 2_000, 4_000, 8_000, 16_000, 30_000];
+
+export class MeshClient {
+  private ws: WebSocket | null = null;
+  private config: SlackConnectorConfig;
+  private closed = false;
+  private reconnectAttempt = 0;
+  private reconnectTimer: NodeJS.Timeout | null = null;
+  private helloTimer: NodeJS.Timeout | null = null;
+  private pushHandlers = new Set<PushHandler>();
+  private pushBuffer: InboundPush[] = [];
+  private pendingAcks = new Map<
+    string,
+    { resolve: (v: { ok: boolean; messageId?: string; error?: string }) => void }
+  >();
+  private outbound: Array<() => void> = [];
+  private _status: "connecting" | "open" | "closed" | "reconnecting" = "closed";
+
+  /** Generate a fresh ed25519 session keypair for this process. */
+  private sessionKeypair = nacl.sign.keyPair();
+  private sessionPubkeyHex = Buffer.from(this.sessionKeypair.publicKey).toString("hex");
+
+  constructor(config: SlackConnectorConfig) {
+    this.config = config;
+  }
+
+  get status(): string {
+    return this._status;
+  }
+
+  // -----------------------------------------------------------------------
+  // Connection
+  // -----------------------------------------------------------------------
+
+  async connect(): Promise<void> {
+    if (this.closed) throw new Error("client is closed");
+    this._status = "connecting";
+
+    const ws = new WebSocket(this.config.brokerUrl);
+    this.ws = ws;
+
+    return new Promise<void>((resolve, reject) => {
+      ws.on("open", () => {
+        const { timestamp, signature } = signHello(
+          this.config.meshId,
+          this.config.memberId,
+          this.config.pubkey,
+          this.config.secretKey,
+        );
+
+        ws.send(
+          JSON.stringify({
+            type: "hello",
+            meshId: this.config.meshId,
+            memberId: this.config.memberId,
+            pubkey: this.config.pubkey,
+            sessionPubkey: this.sessionPubkeyHex,
+            displayName: this.config.displayName,
+            sessionId: `connector-${process.pid}-${Date.now()}`,
+            pid: process.pid,
+            cwd: process.cwd(),
+            peerType: "connector" as const,
+            channel: "slack",
+            timestamp,
+            signature,
+          }),
+        );
+
+        this.helloTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("hello_ack timeout"));
+        }, HELLO_ACK_TIMEOUT_MS);
+      });
+
+      ws.on("message", (raw: WebSocket.RawData) => {
+        let msg: Record<string, unknown>;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+
+        if (msg.type === "hello_ack") {
+          if (this.helloTimer) clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+          this._status = "open";
+          this.reconnectAttempt = 0;
+          this.flushOutbound();
+          resolve();
+          return;
+        }
+
+        this.handleServerMessage(msg);
+      });
+
+      ws.on("close", () => {
+        if (this.helloTimer) clearTimeout(this.helloTimer);
+        this.helloTimer = null;
+        this.ws = null;
+        if (this._status !== "open" && this._status !== "reconnecting") {
+          reject(new Error("ws closed before hello_ack"));
+        }
+        if (!this.closed) this.scheduleReconnect();
+        else this._status = "closed";
+      });
+
+      ws.on("error", (err: Error) => {
+        console.error("[mesh-client] ws error:", err.message);
+      });
+    });
+  }
+
+  /** Gracefully close the connection. */
+  close(): void {
+    this.closed = true;
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    if (this.helloTimer) clearTimeout(this.helloTimer);
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+        /* ignore */
+      }
+    }
+    this._status = "closed";
+  }
+
+  // -----------------------------------------------------------------------
+  // Sending
+  // -----------------------------------------------------------------------
+
+  /**
+   * Send a message to a targetSpec ("*" for broadcast, pubkey hex for
+   * direct, "@group" for group).
+   */
+  async send(
+    targetSpec: string,
+    message: string,
+    priority: Priority = "next",
+  ): Promise<{ ok: boolean; messageId?: string; error?: string }> {
+    const id = randomId();
+    // Connectors send broadcasts/channels as base64 plaintext.
+    // Direct crypto_box encryption is not implemented here to keep
+    // the connector simple — mesh peers can still identify the sender
+    // by the connector's pubkey.
+    const nonce = randomBytes(24).toString("base64");
+    const ciphertext = Buffer.from(message, "utf-8").toString("base64");
+
+    return new Promise((resolve) => {
+      this.pendingAcks.set(id, { resolve });
+
+      const dispatch = (): void => {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+        this.ws.send(
+          JSON.stringify({
+            type: "send",
+            id,
+            targetSpec,
+            priority,
+            nonce,
+            ciphertext,
+          }),
+        );
+      };
+
+      if (this._status === "open") {
+        dispatch();
+      } else {
+        this.outbound.push(dispatch);
+      }
+
+      // Ack timeout
+      setTimeout(() => {
+        if (this.pendingAcks.has(id)) {
+          this.pendingAcks.delete(id);
+          resolve({ ok: false, error: "ack timeout" });
+        }
+      }, 10_000);
+    });
+  }
+
+  /** Broadcast a message to all mesh peers. */
+  async broadcast(
+    message: string,
+    priority: Priority = "next",
+  ): Promise<{ ok: boolean; messageId?: string; error?: string }> {
+    return this.send("*", message, priority);
+  }
+
+  // -----------------------------------------------------------------------
+  // Push subscriptions
+  // -----------------------------------------------------------------------
+
+  /** Subscribe to inbound push messages. Returns an unsubscribe function. */
+  onPush(handler: PushHandler): () => void {
+    this.pushHandlers.add(handler);
+    return () => this.pushHandlers.delete(handler);
+  }
+
+  /** Drain buffered pushes (for polling). */
+  drainPushBuffer(): InboundPush[] {
+    const drained = this.pushBuffer.slice();
+    this.pushBuffer.length = 0;
+    return drained;
+  }
+
+  // -----------------------------------------------------------------------
+  // Set summary / status (fire-and-forget)
+  // -----------------------------------------------------------------------
+
+  setSummary(summary: string): void {
+    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "set_summary", summary }));
+  }
+
+  setStatus(status: "idle" | "working" | "dnd"): void {
+    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "set_status", status }));
+  }
+
+  // -----------------------------------------------------------------------
+  // Internal
+  // -----------------------------------------------------------------------
+
+  private handleServerMessage(msg: Record<string, unknown>): void {
+    if (msg.type === "ack") {
+      const pending = this.pendingAcks.get(String(msg.id ?? ""));
+      if (pending) {
+        pending.resolve({ ok: true, messageId: String(msg.messageId ?? "") });
+        this.pendingAcks.delete(String(msg.id ?? ""));
+      }
+      return;
+    }
+
+    if (msg.type === "push") {
+      const nonce = String(msg.nonce ?? "");
+      const ciphertext = String(msg.ciphertext ?? "");
+      const senderPubkey = String(msg.senderPubkey ?? "");
+
+      // Decode plaintext — connector receives broadcasts as base64 UTF-8.
+      // Direct (crypto_box) messages from peers will fail to decrypt here
+      // since we don't implement crypto_box_open. That's acceptable —
+      // the connector is meant for broadcast/channel relay, not private DMs.
+      let plaintext: string | null = null;
+      if (ciphertext) {
+        try {
+          const decoded = Buffer.from(ciphertext, "base64").toString("utf-8");
+          // Sanity: check it looks like valid UTF-8 text
+          if (/^[\x20-\x7E\s\u00A0-\uFFFF]*$/.test(decoded) && decoded.length > 0) {
+            plaintext = decoded;
+          }
+        } catch {
+          plaintext = null;
+        }
+      }
+
+      const push: InboundPush = {
+        messageId: String(msg.messageId ?? ""),
+        meshId: String(msg.meshId ?? ""),
+        senderPubkey,
+        senderName: String(
+          (msg as Record<string, unknown>).senderName ??
+            (msg as Record<string, unknown>).displayName ??
+            senderPubkey.slice(0, 8),
+        ),
+        priority: (msg.priority as Priority) ?? "next",
+        nonce,
+        ciphertext,
+        createdAt: String(msg.createdAt ?? ""),
+        receivedAt: new Date().toISOString(),
+        plaintext,
+        kind: senderPubkey ? "direct" : "unknown",
+        ...(msg.subtype
+          ? { subtype: msg.subtype as "reminder" | "system" }
+          : {}),
+        ...(msg.event ? { event: String(msg.event) } : {}),
+        ...(msg.eventData
+          ? { eventData: msg.eventData as Record<string, unknown> }
+          : {}),
+      };
+
+      this.pushBuffer.push(push);
+      if (this.pushBuffer.length > 500) this.pushBuffer.shift();
+
+      for (const h of this.pushHandlers) {
+        try {
+          h(push);
+        } catch {
+          /* handler errors are not our problem */
+        }
+      }
+      return;
+    }
+
+    // Other message types (peers_list, state_result, etc.) are ignored
+    // by the connector — it only needs send/ack + push.
+  }
+
+  private flushOutbound(): void {
+    const queued = this.outbound.splice(0);
+    for (const fn of queued) {
+      try {
+        fn();
+      } catch {
+        /* best effort */
+      }
+    }
+  }
+
+  private scheduleReconnect(): void {
+    this._status = "reconnecting";
+    const delay =
+      BACKOFF_CAPS[Math.min(this.reconnectAttempt, BACKOFF_CAPS.length - 1)];
+    this.reconnectAttempt++;
+    console.log(
+      `[mesh-client] reconnecting in ${delay}ms (attempt ${this.reconnectAttempt})`,
+    );
+    this.reconnectTimer = setTimeout(() => {
+      this.connect().catch((err) => {
+        console.error("[mesh-client] reconnect failed:", err.message);
+      });
+    }, delay);
+  }
+}

packages/connector-slack/src/slack.ts

@@ -0,0 +1,132 @@
+/**
+ * Slack client — Socket Mode connection + Web API helpers.
+ *
+ * Uses Socket Mode so users do not need a public URL for Events API.
+ * Listens for messages in a single configured channel and provides
+ * a method to post formatted messages back.
+ */
+
+import { WebClient } from "@slack/web-api";
+import { SocketModeClient } from "@slack/socket-mode";
+
+export interface SlackMessage {
+  /** Slack user ID (e.g. U0123456789) */
+  userId: string;
+  /** Resolved display name (falls back to userId if lookup fails) */
+  displayName: string;
+  /** Message text */
+  text: string;
+  /** Slack channel ID */
+  channelId: string;
+  /** Message timestamp (Slack's unique ID for the message) */
+  ts: string;
+}
+
+export type SlackMessageHandler = (msg: SlackMessage) => void;
+
+export class SlackClient {
+  private web: WebClient;
+  private socket: SocketModeClient;
+  private channelId: string;
+  private userCache = new Map<string, string>();
+  private handlers = new Set<SlackMessageHandler>();
+
+  constructor(botToken: string, appToken: string, channelId: string) {
+    this.web = new WebClient(botToken);
+    this.socket = new SocketModeClient({ appToken });
+    this.channelId = channelId;
+  }
+
+  /**
+   * Connect to Slack via Socket Mode and start listening for messages.
+   */
+  async connect(): Promise<void> {
+    // Verify the bot token works and cache the bot's own user ID
+    // so we can ignore messages from ourselves.
+    const authResult = await this.web.auth.test();
+    const botUserId = authResult.user_id as string;
+
+    this.socket.on("message", async ({ event, ack }) => {
+      // Always acknowledge the event to Slack
+      await ack();
+
+      // Only process messages from the configured channel
+      if (event.channel !== this.channelId) return;
+
+      // Ignore bot's own messages, message_changed edits, and subtypes
+      // like channel_join, channel_leave, etc.
+      if (event.user === botUserId) return;
+      if (event.subtype) return;
+      if (!event.text) return;
+
+      const displayName = await this.resolveUserName(event.user);
+      const msg: SlackMessage = {
+        userId: event.user,
+        displayName,
+        text: event.text,
+        channelId: event.channel,
+        ts: event.ts,
+      };
+
+      for (const handler of this.handlers) {
+        try {
+          handler(msg);
+        } catch {
+          // Handler errors should not break the event loop
+        }
+      }
+    });
+
+    await this.socket.start();
+  }
+
+  /**
+   * Post a message to the configured Slack channel.
+   */
+  async postMessage(text: string): Promise<void> {
+    await this.web.chat.postMessage({
+      channel: this.channelId,
+      text,
+      // Use mrkdwn so mesh peer names can be bolded
+      mrkdwn: true,
+    });
+  }
+
+  /**
+   * Register a handler for incoming Slack messages.
+   * Returns an unsubscribe function.
+   */
+  onMessage(handler: SlackMessageHandler): () => void {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+
+  /**
+   * Resolve a Slack user ID to a display name.
+   * Results are cached for the lifetime of the process.
+   */
+  async resolveUserName(userId: string): Promise<string> {
+    const cached = this.userCache.get(userId);
+    if (cached) return cached;
+
+    try {
+      const result = await this.web.users.info({ user: userId });
+      const name =
+        result.user?.profile?.display_name ||
+        result.user?.real_name ||
+        result.user?.name ||
+        userId;
+      this.userCache.set(userId, name);
+      return name;
+    } catch {
+      return userId;
+    }
+  }
+
+  /**
+   * Disconnect from Socket Mode.
+   */
+  async disconnect(): Promise<void> {
+    await this.socket.disconnect();
+  }
+}

packages/connector-slack/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "dist"]
+}

packages/connector-telegram/README.md

@@ -0,0 +1,79 @@
+# @claudemesh/connector-telegram
+
+Bridges a Telegram chat and a claudemesh mesh, relaying messages bidirectionally. Joins the mesh as `peerType: "connector"`, `channel: "telegram"`.
+
+## Setup
+
+### 1. Create a Telegram bot
+
+1. Open Telegram, search for **@BotFather**
+2. Send `/newbot`, follow the prompts
+3. Copy the bot token (e.g. `123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11`)
+
+### 2. Get the chat ID
+
+1. Add your bot to a group chat (or start a DM with it)
+2. Send a message in the chat
+3. Fetch updates to find the chat ID:
+   ```bash
+   curl https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates | jq '.result[0].message.chat.id'
+   ```
+   Group IDs are negative numbers (e.g. `-1001234567890`). DM IDs are positive.
+
+### 3. Get mesh credentials
+
+You need a claudemesh membership. Use the CLI to join a mesh and note the credentials, or check your mesh config file (`~/.config/claudemesh/config.json`).
+
+### 4. Configure environment variables
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `TELEGRAM_BOT_TOKEN` | Bot token from @BotFather | `123456:ABC-DEF...` |
+| `TELEGRAM_CHAT_ID` | Target chat ID | `-1001234567890` |
+| `BROKER_URL` | Broker WebSocket URL | `wss://ic.claudemesh.com/ws` |
+| `MESH_ID` | Mesh UUID | `abc123-...` |
+| `MEMBER_ID` | Member UUID | `def456-...` |
+| `PUBKEY` | Ed25519 public key (hex) | `a1b2c3...` |
+| `SECRET_KEY` | Ed25519 secret key (hex) | `d4e5f6...` |
+| `DISPLAY_NAME` | Peer display name (optional) | `Telegram-DevChat` |
+
+### 5. Run
+
+```bash
+# Build
+npm run build
+
+# Start
+TELEGRAM_BOT_TOKEN=... TELEGRAM_CHAT_ID=... BROKER_URL=wss://ic.claudemesh.com/ws \
+  MESH_ID=... MEMBER_ID=... PUBKEY=... SECRET_KEY=... DISPLAY_NAME=Telegram-DevChat \
+  npm start
+```
+
+Or with npx (once published):
+```bash
+TELEGRAM_BOT_TOKEN=... npx @claudemesh/connector-telegram
+```
+
+## How it works
+
+- **Telegram -> Mesh**: Text messages from Telegram are formatted as `[SenderName] message` and broadcast to all mesh peers.
+- **Mesh -> Telegram**: Messages from mesh peers are formatted as `<b>[PeerName]</b> message` (HTML) and posted to the Telegram chat.
+- Non-text messages (photos, stickers, etc.) are skipped with a log note.
+- The connector uses long polling (no webhooks needed, no public URL required).
+- Auto-reconnects to the mesh broker with exponential backoff.
+
+## Architecture
+
+```
+Telegram Chat  <--long poll-->  TelegramClient
+                                     |
+                                  Bridge (relay)
+                                     |
+Mesh Broker   <----WebSocket---->  MeshClient
+```
+
+- `src/config.ts` — Configuration types and env loader
+- `src/telegram.ts` — Telegram Bot API client (fetch + long polling)
+- `src/mesh-client.ts` — Minimal claudemesh WS client (tweetnacl for ed25519 signing)
+- `src/bridge.ts` — Bidirectional message relay
+- `src/index.ts` — Entry point, wires everything together

packages/connector-telegram/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@claudemesh/connector-telegram",
+  "version": "0.1.0",
+  "description": "Telegram connector for claudemesh — relay messages between Telegram chats and mesh peers",
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "tweetnacl": "^1.0.3",
+    "tweetnacl-util": "^0.15.1",
+    "ws": "8.20.0"
+  },
+  "devDependencies": {
+    "@types/ws": "8.5.13",
+    "typescript": "^5.0.0"
+  }
+}

packages/connector-telegram/src/bridge.ts

@@ -0,0 +1,96 @@
+/**
+ * Bidirectional bridge between Telegram and a claudemesh mesh.
+ *
+ * Telegram -> Mesh: incoming Telegram messages are formatted as
+ *   "[TelegramUser] message" and broadcast to the mesh.
+ *
+ * Mesh -> Telegram: inbound mesh pushes are formatted as
+ *   "[MeshPeerName] message" and posted to the Telegram chat.
+ */
+
+import type { TelegramClient, TelegramMessage } from "./telegram.js";
+import type { MeshClient, InboundPush } from "./mesh-client.js";
+
+export class Bridge {
+  constructor(
+    private telegram: TelegramClient,
+    private mesh: MeshClient,
+  ) {}
+
+  /** Wire up both directions. Call once after both clients are connected. */
+  start(): void {
+    // Telegram -> Mesh
+    this.telegram.onMessage((msg: TelegramMessage) => {
+      this.handleTelegramMessage(msg);
+    });
+
+    // Mesh -> Telegram
+    this.mesh.onPush((push: InboundPush) => {
+      this.handleMeshPush(push);
+    });
+
+    console.log("[bridge] relay active");
+  }
+
+  private handleTelegramMessage(msg: TelegramMessage): void {
+    if (!msg.text) {
+      // Skip non-text messages (photos, stickers, etc.)
+      const type = msg.from
+        ? "non-text content"
+        : "system message";
+      console.log(`[bridge] skipping ${type} from Telegram`);
+      return;
+    }
+
+    const senderName = formatTelegramSender(msg);
+    const meshMessage = `[${senderName}] ${msg.text}`;
+
+    console.log(`[bridge] tg->mesh: ${meshMessage.slice(0, 80)}...`);
+
+    // Broadcast to all mesh peers
+    this.mesh.send("*", meshMessage).catch((err) => {
+      console.error(`[bridge] failed to relay to mesh:`, err);
+    });
+  }
+
+  private handleMeshPush(push: InboundPush): void {
+    // Decode the message content
+    const plaintext = push.plaintext ?? tryDecodeBase64(push.ciphertext);
+    if (!plaintext) return;
+
+    // Skip messages that originated from this connector (prevent echo)
+    if (push.senderPubkey === this.mesh.pubkey) return;
+
+    // Find the sender's display name from the push metadata
+    const senderName = push.senderDisplayName || push.senderPubkey.slice(0, 8);
+    const telegramMessage = `<b>[${escapeHtml(senderName)}]</b> ${escapeHtml(plaintext)}`;
+
+    console.log(`[bridge] mesh->tg: [${senderName}] ${plaintext.slice(0, 60)}...`);
+
+    this.telegram.sendMessage(telegramMessage).catch((err) => {
+      console.error(`[bridge] failed to relay to Telegram:`, err);
+    });
+  }
+}
+
+function formatTelegramSender(msg: TelegramMessage): string {
+  if (!msg.from) return "Unknown";
+  const parts = [msg.from.first_name];
+  if (msg.from.last_name) parts.push(msg.from.last_name);
+  return parts.join(" ");
+}
+
+function tryDecodeBase64(b64: string): string | null {
+  try {
+    return Buffer.from(b64, "base64").toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+
+function escapeHtml(text: string): string {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}

packages/connector-telegram/src/config.ts

@@ -0,0 +1,32 @@
+export interface TelegramConnectorConfig {
+  // Telegram
+  telegramBotToken: string; // from @BotFather
+  telegramChatId: string; // group chat or user chat ID
+
+  // Mesh
+  brokerUrl: string;
+  meshId: string;
+  memberId: string;
+  pubkey: string;
+  secretKey: string;
+  displayName: string; // e.g. "Telegram-DevChat"
+}
+
+export function loadConfigFromEnv(): TelegramConnectorConfig {
+  const required = (key: string): string => {
+    const val = process.env[key];
+    if (!val) throw new Error(`Missing required env var: ${key}`);
+    return val;
+  };
+
+  return {
+    telegramBotToken: required("TELEGRAM_BOT_TOKEN"),
+    telegramChatId: required("TELEGRAM_CHAT_ID"),
+    brokerUrl: required("BROKER_URL"),
+    meshId: required("MESH_ID"),
+    memberId: required("MEMBER_ID"),
+    pubkey: required("PUBKEY"),
+    secretKey: required("SECRET_KEY"),
+    displayName: process.env.DISPLAY_NAME || "Telegram",
+  };
+}

packages/connector-telegram/src/index.ts

@@ -0,0 +1,66 @@
+/**
+ * @claudemesh/connector-telegram — Entry point
+ *
+ * Bridges a Telegram chat and a claudemesh mesh, relaying messages
+ * bidirectionally. Joins the mesh as peerType: "connector", channel: "telegram".
+ *
+ * Configuration via environment variables:
+ *   TELEGRAM_BOT_TOKEN  — Bot token from @BotFather
+ *   TELEGRAM_CHAT_ID    — Target chat ID (group or user)
+ *   BROKER_URL           — claudemesh broker WebSocket URL
+ *   MESH_ID              — Mesh UUID
+ *   MEMBER_ID            — Member UUID
+ *   PUBKEY               — Ed25519 public key (hex)
+ *   SECRET_KEY           — Ed25519 secret key (hex)
+ *   DISPLAY_NAME         — Peer display name (default: "Telegram")
+ */
+
+import { loadConfigFromEnv } from "./config.js";
+import { TelegramClient } from "./telegram.js";
+import { MeshClient } from "./mesh-client.js";
+import { Bridge } from "./bridge.js";
+
+async function main(): Promise<void> {
+  console.log("[connector-telegram] starting...");
+
+  // Load configuration
+  const config = loadConfigFromEnv();
+  console.log(`[connector-telegram] display name: ${config.displayName}`);
+  console.log(`[connector-telegram] chat ID: ${config.telegramChatId}`);
+  console.log(`[connector-telegram] broker: ${config.brokerUrl}`);
+
+  // Initialize clients
+  const telegram = new TelegramClient(config.telegramBotToken, config.telegramChatId);
+  const mesh = new MeshClient(config);
+
+  // Connect to mesh broker
+  console.log("[connector-telegram] connecting to mesh...");
+  await mesh.connect();
+  console.log("[connector-telegram] mesh connected");
+
+  // Start Telegram long polling
+  telegram.start();
+  console.log("[connector-telegram] Telegram polling started");
+
+  // Wire up bidirectional relay
+  const bridge = new Bridge(telegram, mesh);
+  bridge.start();
+
+  console.log("[connector-telegram] bridge active — relaying messages");
+
+  // Graceful shutdown
+  const shutdown = (): void => {
+    console.log("\n[connector-telegram] shutting down...");
+    telegram.stop();
+    mesh.close();
+    process.exit(0);
+  };
+
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+main().catch((err) => {
+  console.error("[connector-telegram] fatal:", err);
+  process.exit(1);
+});

packages/connector-telegram/src/mesh-client.ts

@@ -0,0 +1,259 @@
+/**
+ * Minimal WebSocket client for connecting to a claudemesh broker.
+ * Uses tweetnacl for ed25519 signing (hello handshake).
+ * Stripped down from apps/cli/src/ws/client.ts — hello + send/receive only.
+ */
+
+import WebSocket from "ws";
+import nacl from "tweetnacl";
+import { decodeUTF8, encodeBase64 } from "tweetnacl-util";
+import type { TelegramConnectorConfig } from "./config.js";
+
+export interface InboundPush {
+  messageId: string;
+  meshId: string;
+  senderPubkey: string;
+  senderDisplayName?: string;
+  priority: "now" | "next" | "low";
+  nonce: string;
+  ciphertext: string;
+  createdAt: string;
+  receivedAt: string;
+  plaintext: string | null;
+  kind: "direct" | "broadcast" | "channel" | "unknown";
+  subtype?: "reminder" | "system";
+  event?: string;
+  eventData?: Record<string, unknown>;
+}
+
+type PushHandler = (msg: InboundPush) => void;
+
+const HELLO_ACK_TIMEOUT_MS = 5_000;
+const BACKOFF_CAPS = [1_000, 2_000, 4_000, 8_000, 16_000, 30_000];
+
+export class MeshClient {
+  private ws: WebSocket | null = null;
+  private pushHandlers = new Set<PushHandler>();
+  private closed = false;
+  private reconnectAttempt = 0;
+  private helloTimer: NodeJS.Timeout | null = null;
+  private reconnectTimer: NodeJS.Timeout | null = null;
+  private connected = false;
+  private outbound: Array<() => void> = [];
+  private peerNames = new Map<string, string>(); // pubkey -> displayName
+
+  readonly pubkey: string;
+
+  constructor(private config: TelegramConnectorConfig) {
+    this.pubkey = config.pubkey;
+  }
+
+  onPush(handler: PushHandler): void {
+    this.pushHandlers.add(handler);
+  }
+
+  /** Open WS, send hello, resolve when hello_ack received. */
+  async connect(): Promise<void> {
+    if (this.closed) throw new Error("client is closed");
+
+    return new Promise<void>((resolve, reject) => {
+      const ws = new WebSocket(this.config.brokerUrl);
+      this.ws = ws;
+
+      ws.on("open", () => {
+        console.log("[mesh] ws open, sending hello");
+
+        const timestamp = Date.now();
+        const canonical = `${this.config.meshId}|${this.config.memberId}|${this.config.pubkey}|${timestamp}`;
+        const secretKey = hexToUint8(this.config.secretKey);
+        const sigBytes = nacl.sign.detached(decodeUTF8(canonical), secretKey);
+        const signature = uint8ToHex(sigBytes);
+
+        ws.send(
+          JSON.stringify({
+            type: "hello",
+            meshId: this.config.meshId,
+            memberId: this.config.memberId,
+            pubkey: this.config.pubkey,
+            displayName: this.config.displayName,
+            sessionId: `connector-tg-${Date.now()}`,
+            pid: process.pid,
+            cwd: process.cwd(),
+            peerType: "connector",
+            channel: "telegram",
+            timestamp,
+            signature,
+          }),
+        );
+
+        this.helloTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("hello_ack timeout"));
+        }, HELLO_ACK_TIMEOUT_MS);
+      });
+
+      ws.on("message", (raw: WebSocket.RawData) => {
+        let msg: Record<string, unknown>;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+
+        if (msg.type === "hello_ack") {
+          if (this.helloTimer) clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+          this.connected = true;
+          this.reconnectAttempt = 0;
+          this.flushOutbound();
+          console.log("[mesh] connected to broker");
+          resolve();
+          return;
+        }
+
+        this.handleServerMessage(msg);
+      });
+
+      ws.on("close", () => {
+        if (this.helloTimer) clearTimeout(this.helloTimer);
+        this.helloTimer = null;
+        this.ws = null;
+        const wasConnected = this.connected;
+        this.connected = false;
+        if (!wasConnected) {
+          reject(new Error("ws closed before hello_ack"));
+        }
+        if (!this.closed) this.scheduleReconnect();
+      });
+
+      ws.on("error", (err: Error) => {
+        console.error(`[mesh] ws error: ${err.message}`);
+      });
+    });
+  }
+
+  /** Send a message to the mesh. targetSpec: "*" for broadcast, pubkey for direct. */
+  async send(
+    targetSpec: string,
+    message: string,
+    priority: "now" | "next" | "low" = "next",
+  ): Promise<{ ok: boolean; error?: string }> {
+    const id = randomId();
+    // Connectors send plaintext broadcasts (base64 encoded) —
+    // direct crypto_box encryption is omitted for simplicity.
+    const nonce = encodeBase64(nacl.randomBytes(24));
+    const ciphertext = Buffer.from(message, "utf-8").toString("base64");
+
+    return new Promise((resolve) => {
+      const dispatch = (): void => {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+        this.ws.send(
+          JSON.stringify({
+            type: "send",
+            id,
+            targetSpec,
+            priority,
+            nonce,
+            ciphertext,
+          }),
+        );
+      };
+
+      if (this.connected) {
+        dispatch();
+      } else {
+        this.outbound.push(dispatch);
+      }
+
+      // Ack timeout
+      setTimeout(() => {
+        resolve({ ok: false, error: "ack timeout" });
+      }, 10_000);
+    });
+  }
+
+  /** Gracefully close. */
+  close(): void {
+    this.closed = true;
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    if (this.ws) {
+      this.ws.close();
+      this.ws = null;
+    }
+  }
+
+  private handleServerMessage(msg: Record<string, unknown>): void {
+    if (msg.type === "push") {
+      const push = msg as unknown as InboundPush & { senderDisplayName?: string };
+
+      // Decode plaintext for broadcasts/channel messages
+      if (!push.plaintext && push.ciphertext) {
+        try {
+          push.plaintext = Buffer.from(push.ciphertext, "base64").toString("utf-8");
+        } catch {
+          // leave null
+        }
+      }
+
+      // Cache peer display name if provided
+      if (push.senderDisplayName && push.senderPubkey) {
+        this.peerNames.set(push.senderPubkey, push.senderDisplayName);
+      }
+
+      for (const handler of this.pushHandlers) {
+        try {
+          handler(push);
+        } catch (err) {
+          console.error("[mesh] push handler error:", err);
+        }
+      }
+    }
+
+    if (msg.type === "peers") {
+      // Cache peer names from peer list responses
+      const peers = (msg as Record<string, unknown>).peers as Array<{ pubkey: string; displayName: string }> | undefined;
+      if (peers) {
+        for (const p of peers) {
+          this.peerNames.set(p.pubkey, p.displayName);
+        }
+      }
+    }
+  }
+
+  private flushOutbound(): void {
+    const fns = this.outbound.splice(0);
+    for (const fn of fns) fn();
+  }
+
+  private scheduleReconnect(): void {
+    const delay = BACKOFF_CAPS[Math.min(this.reconnectAttempt, BACKOFF_CAPS.length - 1)]!;
+    this.reconnectAttempt++;
+    console.log(`[mesh] reconnecting in ${delay}ms (attempt ${this.reconnectAttempt})`);
+    this.reconnectTimer = setTimeout(() => {
+      this.connect().catch((err) => {
+        console.error(`[mesh] reconnect failed:`, err);
+      });
+    }, delay);
+  }
+}
+
+// --- Hex helpers (avoid libsodium dependency) ---
+
+function hexToUint8(hex: string): Uint8Array {
+  const len = hex.length / 2;
+  const arr = new Uint8Array(len);
+  for (let i = 0; i < len; i++) {
+    arr[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return arr;
+}
+
+function uint8ToHex(arr: Uint8Array): string {
+  return Array.from(arr)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+function randomId(): string {
+  return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}

packages/connector-telegram/src/telegram.ts

@@ -0,0 +1,148 @@
+/**
+ * Minimal Telegram Bot API client using fetch + long polling.
+ * Zero external dependencies.
+ */
+
+const POLL_TIMEOUT_SECS = 30;
+
+export interface TelegramMessage {
+  message_id: number;
+  from?: {
+    id: number;
+    first_name: string;
+    last_name?: string;
+    username?: string;
+  };
+  chat: { id: number; type: string; title?: string };
+  date: number;
+  text?: string;
+}
+
+interface Update {
+  update_id: number;
+  message?: TelegramMessage;
+}
+
+interface GetUpdatesResponse {
+  ok: boolean;
+  result: Update[];
+  description?: string;
+}
+
+interface SendMessageResponse {
+  ok: boolean;
+  description?: string;
+}
+
+export type MessageHandler = (msg: TelegramMessage) => void;
+
+export class TelegramClient {
+  private baseUrl: string;
+  private offset = 0;
+  private running = false;
+  private abortController: AbortController | null = null;
+  private handlers = new Set<MessageHandler>();
+
+  constructor(
+    private botToken: string,
+    private chatId: string,
+  ) {
+    this.baseUrl = `https://api.telegram.org/bot${botToken}`;
+  }
+
+  onMessage(handler: MessageHandler): void {
+    this.handlers.add(handler);
+  }
+
+  /** Send a text message to the configured chat. */
+  async sendMessage(text: string): Promise<boolean> {
+    try {
+      const res = await fetch(`${this.baseUrl}/sendMessage`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          chat_id: this.chatId,
+          text,
+          parse_mode: "HTML",
+        }),
+      });
+      const data = (await res.json()) as SendMessageResponse;
+      if (!data.ok) {
+        console.error(`[telegram] sendMessage failed: ${data.description}`);
+      }
+      return data.ok;
+    } catch (err) {
+      console.error(`[telegram] sendMessage error:`, err);
+      return false;
+    }
+  }
+
+  /** Start long-polling loop. Non-blocking — runs in background. */
+  start(): void {
+    if (this.running) return;
+    this.running = true;
+    this.pollLoop();
+  }
+
+  /** Stop the polling loop gracefully. */
+  stop(): void {
+    this.running = false;
+    this.abortController?.abort();
+  }
+
+  private async pollLoop(): Promise<void> {
+    while (this.running) {
+      try {
+        this.abortController = new AbortController();
+        const url = new URL(`${this.baseUrl}/getUpdates`);
+        url.searchParams.set("offset", String(this.offset));
+        url.searchParams.set("timeout", String(POLL_TIMEOUT_SECS));
+        url.searchParams.set("allowed_updates", JSON.stringify(["message"]));
+
+        const res = await fetch(url.toString(), {
+          signal: this.abortController.signal,
+          // Allow enough time for the long-poll plus network overhead
+        });
+
+        const data = (await res.json()) as GetUpdatesResponse;
+
+        if (!data.ok) {
+          console.error(`[telegram] getUpdates failed: ${data.description}`);
+          await sleep(5_000);
+          continue;
+        }
+
+        for (const update of data.result) {
+          this.offset = update.update_id + 1;
+          if (update.message) {
+            this.dispatchMessage(update.message);
+          }
+        }
+      } catch (err: unknown) {
+        if (err instanceof Error && err.name === "AbortError") {
+          // Expected on stop()
+          break;
+        }
+        console.error(`[telegram] poll error:`, err);
+        await sleep(5_000);
+      }
+    }
+  }
+
+  private dispatchMessage(msg: TelegramMessage): void {
+    // Only relay messages from the configured chat
+    if (String(msg.chat.id) !== this.chatId) return;
+
+    for (const handler of this.handlers) {
+      try {
+        handler(msg);
+      } catch (err) {
+        console.error(`[telegram] handler error:`, err);
+      }
+    }
+  }
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

packages/connector-telegram/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

packages/db/migrations/0004_add-presence-display-name.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."presence" ADD COLUMN "display_name" text;

packages/db/migrations/0005_add-presence-session-pubkey.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."presence" ADD COLUMN "session_pubkey" text;

packages/db/migrations/0006_add-sender-session-pubkey.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."message_queue" ADD COLUMN "sender_session_pubkey" text;

packages/db/migrations/0007_add-presence-groups.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."presence" ADD COLUMN "groups" jsonb DEFAULT '[]'::jsonb;

packages/db/migrations/0008_add-state-and-memory.sql

@@ -0,0 +1,27 @@
+CREATE TABLE "mesh"."memory" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"content" text NOT NULL,
+	"tags" text[] DEFAULT '{}',
+	"remembered_by" text,
+	"remembered_by_name" text,
+	"remembered_at" timestamp DEFAULT now() NOT NULL,
+	"forgotten_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "mesh"."state" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"key" text NOT NULL,
+	"value" jsonb NOT NULL,
+	"updated_by_presence" text,
+	"updated_by_name" text,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD CONSTRAINT "memory_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD CONSTRAINT "memory_remembered_by_member_id_fk" FOREIGN KEY ("remembered_by") REFERENCES "mesh"."member"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mesh"."state" ADD CONSTRAINT "state_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+CREATE UNIQUE INDEX "state_mesh_key_idx" ON "mesh"."state" USING btree ("mesh_id","key");--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD COLUMN IF NOT EXISTS "search_vector" tsvector GENERATED ALWAYS AS (to_tsvector('english', content)) STORED;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "memory_search_idx" ON "mesh"."memory" USING gin("search_vector");

packages/db/migrations/0009_add-file-tables.sql

@@ -0,0 +1,28 @@
+CREATE TABLE "mesh"."file" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"name" text NOT NULL,
+	"size_bytes" integer NOT NULL,
+	"mime_type" text,
+	"minio_key" text NOT NULL,
+	"tags" text[] DEFAULT '{}',
+	"persistent" boolean DEFAULT true NOT NULL,
+	"uploaded_by_name" text,
+	"uploaded_by_member" text,
+	"target_spec" text,
+	"uploaded_at" timestamp DEFAULT now() NOT NULL,
+	"expires_at" timestamp,
+	"deleted_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "mesh"."file_access" (
+	"id" text PRIMARY KEY NOT NULL,
+	"file_id" text NOT NULL,
+	"peer_session_pubkey" text,
+	"peer_name" text,
+	"accessed_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."file" ADD CONSTRAINT "file_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+ALTER TABLE "mesh"."file" ADD CONSTRAINT "file_uploaded_by_member_member_id_fk" FOREIGN KEY ("uploaded_by_member") REFERENCES "mesh"."member"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mesh"."file_access" ADD CONSTRAINT "file_access_file_id_file_id_fk" FOREIGN KEY ("file_id") REFERENCES "mesh"."file"("id") ON DELETE cascade ON UPDATE no action;

packages/db/migrations/0010_add-context-and-tasks.sql

@@ -0,0 +1,33 @@
+CREATE TABLE "mesh"."context" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"presence_id" text,
+	"peer_name" text,
+	"summary" text NOT NULL,
+	"files_read" text[] DEFAULT '{}',
+	"key_findings" text[] DEFAULT '{}',
+	"tags" text[] DEFAULT '{}',
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mesh"."task" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"title" text NOT NULL,
+	"assignee" text,
+	"claimed_by_name" text,
+	"claimed_by_presence" text,
+	"priority" text DEFAULT 'normal' NOT NULL,
+	"status" text DEFAULT 'open' NOT NULL,
+	"tags" text[] DEFAULT '{}',
+	"result" text,
+	"created_by_name" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"claimed_at" timestamp,
+	"completed_at" timestamp
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."context" ADD CONSTRAINT "context_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+ALTER TABLE "mesh"."context" ADD CONSTRAINT "context_presence_id_presence_id_fk" FOREIGN KEY ("presence_id") REFERENCES "mesh"."presence"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mesh"."task" ADD CONSTRAINT "task_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+ALTER TABLE "mesh"."task" ADD CONSTRAINT "task_claimed_by_presence_presence_id_fk" FOREIGN KEY ("claimed_by_presence") REFERENCES "mesh"."presence"("id") ON DELETE no action ON UPDATE no action;

packages/db/migrations/0011_add-streams.sql

@@ -0,0 +1,10 @@
+CREATE TABLE "mesh"."stream" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"name" text NOT NULL,
+	"created_by_name" text,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."stream" ADD CONSTRAINT "stream_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+CREATE UNIQUE INDEX "stream_mesh_name_idx" ON "mesh"."stream" USING btree ("mesh_id","name");

packages/db/migrations/0012_add-file-encryption.sql

@@ -0,0 +1,13 @@
+ALTER TABLE "mesh"."file" ADD COLUMN "encrypted" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "mesh"."file" ADD COLUMN "owner_pubkey" text;--> statement-breakpoint
+CREATE TABLE "mesh"."file_key" (
+	"id" text PRIMARY KEY NOT NULL,
+	"file_id" text NOT NULL,
+	"peer_pubkey" text NOT NULL,
+	"sealed_key" text NOT NULL,
+	"granted_at" timestamp DEFAULT now() NOT NULL,
+	"granted_by_pubkey" text
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."file_key" ADD CONSTRAINT "file_key_file_id_fkey" FOREIGN KEY ("file_id") REFERENCES "mesh"."file"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "file_key_file_peer_idx" ON "mesh"."file_key" ("file_id","peer_pubkey");

packages/db/migrations/0013_context-stable-member-key.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "mesh"."context" ADD COLUMN "member_id" text;--> statement-breakpoint
+ALTER TABLE "mesh"."context" ADD CONSTRAINT "context_member_id_member_id_fk" FOREIGN KEY ("member_id") REFERENCES "mesh"."member"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+CREATE UNIQUE INDEX "context_mesh_member_idx" ON "mesh"."context" ("mesh_id","member_id");