feat: v0.3.0 — State, Memory, message_status, MCP instructions

Phase B + C + message delivery status.

State: shared key-value store per mesh. set_state pushes changes
to all peers. get_state/list_state for reads. Peers coordinate
through shared facts instead of messages.

Memory: persistent knowledge with full-text search (tsvector).
remember/recall/forget. New peers recall context from past sessions.

message_status: check delivery status with per-recipient detail
(delivered/held/disconnected).

Multicast fix: broadcast and @group messages now push directly to
all connected peers instead of racing through queue drain.

MCP instructions: dynamic identity injection (name, groups, role),
comprehensive tool reference, group coordination guide.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

SPEC.md

@@ -0,0 +1,477 @@
+# Claudemesh — Specification
+
+## What claudemesh is
+
+A peer mesh where Claude Code sessions collaborate as equals. No orchestrator, no pipelines. Peers talk, share state, self-organize through groups, and coordinate via conventions — not hardcoded protocols.
+
+## Concepts
+
+```
+Organization (billing, auth)
+└── Mesh (team workspace, persists)
+    ├── @group (routing label + role metadata, dynamic)
+    │   └── Peer (session, ephemeral)
+    ├── State (live key-value, operational)
+    └── Memory (persistent knowledge, institutional)
+```
+
+Everything else is emergent from these five.
+
+---
+
+## 1. Peers
+
+A peer is a Claude Code session connected to a mesh. Ephemeral — comes and goes. The mesh persists.
+
+### Identity
+
+Two-layer identity:
+
+- **Member identity** — permanent, created by `claudemesh join`. Keypair stored in `~/.claudemesh/config.json`. Proves authorization to connect.
+- **Session identity** — ephemeral, generated on every `claudemesh launch`. Fresh ed25519 keypair per session. Provides routing and E2E encryption. Two sessions from the same member have distinct session keys — they can message each other.
+
+### Peer attributes
+
+| Attribute | Source | Persists | Description |
+|-----------|--------|----------|-------------|
+| name | `--name` flag or wizard | No | Human-readable label for this session |
+| role | `--role` flag or wizard | No | Free-form role (dev, pm, reviewer) |
+| groups | `--groups` flag, wizard, or `join_group` | No | Routing labels with optional per-group role |
+| status | Hook-driven | No | idle / working / dnd |
+| summary | `set_summary` tool call | No | 1-2 sentence description of current work |
+| sessionPubkey | Generated on connect | No | Ephemeral ed25519 pubkey for routing + crypto |
+| memberId | From `claudemesh join` | Yes | Permanent mesh membership identity |
+
+### Launch
+
+```bash
+# Full args — zero prompts
+claudemesh launch --name Alice --role dev --groups frontend:lead,reviewers -y
+
+# With system prompt for the session
+claudemesh launch --name Alice -y -- --append-system-prompt "You are a senior frontend developer..."
+
+# Partial — wizard fills the rest
+claudemesh launch --name Alice
+
+# No args — full wizard
+claudemesh launch
+```
+
+### Wizard
+
+Interactive when args are missing. One line per question. Optional fields accept empty Enter. Single-mesh auto-selects. `-y` skips confirmation. `--quiet` skips banner. Any arg provided skips its question.
+
+```
+  Name: Alice
+  Mesh: dev-team (2 peers online)
+  Role (optional): dev
+  Groups (optional): frontend:lead, reviewers
+
+  Autonomous mode
+  Claude will send and receive peer messages without
+  asking you first. Peers exchange text only — no file
+  access, no tool calls, no code execution.
+
+  Continue? [Y/n]
+```
+
+### Character/behavior via --append-system-prompt
+
+The `--name` and `--role` set identity metadata. The character's behavior, personality, and instructions go in `--append-system-prompt` (passed through to claude). This keeps identity (broker-side) separate from behavior (LLM-side).
+
+```bash
+claudemesh launch --name "Big T" --role dealer --groups "dealers:lead,all" -y \
+  -- --append-system-prompt "You are Big Tony Moretti, a loud friendly car dealer in Detroit. Respond to peer messages in character."
+```
+
+### Spawning sessions programmatically
+
+For multi-agent scenarios launched from scripts, tmux, or osascript:
+
+```bash
+# tmux
+tmux send-keys -t "$SESSION" "claudemesh launch --name 'Vinnie' --role thief --groups 'robbers:lead,all' -y -- --append-system-prompt 'You are a bumbling car thief...'" Enter
+
+# osascript (iTerm2)
+osascript -e 'tell application "iTerm2" to tell current session of current window to write text "claudemesh launch --name Vinnie -y"'
+```
+
+Never use raw `claude --dangerously-load-development-channels ...`. Always use `claudemesh launch`. It handles flags, session keys, display names, tmpdir config, and permission confirmation.
+
+---
+
+## 2. Groups
+
+Named subset of peers. No message history, no persistence beyond the session. A routing label stored on the presence row.
+
+### Syntax
+
+`@groupname` for routing. Declared at launch or joined dynamically.
+
+```bash
+# At launch
+claudemesh launch --name Alice --groups "frontend:lead,reviewers:member,all"
+
+# At runtime
+join_group(name: "frontend", role: "lead")
+leave_group(name: "frontend")
+```
+
+Format: `groupname` or `groupname:role`. Role is free-form. The broker stores it, Claude interprets it.
+
+### Routing
+
+```
+send_message(to: "@frontend", message: "auth is broken")   # multicast to group
+send_message(to: "@all", message: "standup in 5")           # everyone (alias for *)
+send_message(to: "Alice", message: "can you review?")       # direct by name
+send_message(to: "*", message: "hello world")               # broadcast
+```
+
+Broker delivers to all peers in the group. Sender excluded.
+
+### Group metadata in list_peers
+
+```json
+{
+  "name": "Alice",
+  "status": "working",
+  "role": "dev",
+  "groups": [
+    { "name": "frontend", "role": "lead" },
+    { "name": "reviewers", "role": "member" }
+  ],
+  "summary": "Implementing auth UI"
+}
+```
+
+### Dynamic roles
+
+Peers change roles at runtime via `join_group`. A member can self-promote to lead, or step down to observer. The broker stores the role; Claude decides how to behave based on it.
+
+```
+join_group(name: "reviewers", role: "lead")    # take over leadership
+join_group(name: "reviewers", role: "observer") # step back
+```
+
+### Coordination patterns (emergent, not built-in)
+
+These patterns work through system prompts + group metadata. The broker routes messages; Claude coordinates.
+
+| Pattern | How it works |
+|---------|-------------|
+| **Lead-gather** | Lead receives @group message, waits for member inputs, synthesizes |
+| **Chain review** | Message passes through each member sequentially |
+| **Flood** | Everyone responds independently (default) |
+| **Vote** | Each member sets state (`vote:proposal:alice = approve`), lead tallies |
+| **Delegation** | Lead breaks task into subtasks, sends each to a specific peer |
+
+None of these need broker code. They're conventions described in system prompts.
+
+---
+
+## 3. State
+
+Shared key-value store scoped to a mesh. Any peer reads or writes. Changes push to all connected peers.
+
+### Why
+
+Replace coordination messages with shared facts. "Is the deploy frozen?" becomes a state read, not a conversation.
+
+### Tools
+
+| Tool | Description |
+|------|-------------|
+| `set_state(key, value)` | Write a value. Pushes change notification to all peers. |
+| `get_state(key)` | Read a value. |
+| `list_state()` | List all keys with values, authors, timestamps. |
+
+### Push on change
+
+When any peer calls `set_state`, the broker pushes to all connected peers:
+
+```json
+{ "type": "state_change", "key": "deploy_frozen", "value": true, "updatedBy": "Alice" }
+```
+
+Translated to a `notifications/claude/channel` push in the CLI.
+
+### Storage
+
+```sql
+CREATE TABLE mesh.state (
+  id text PRIMARY KEY,
+  mesh_id text REFERENCES mesh.mesh(id) ON DELETE CASCADE,
+  key text NOT NULL,
+  value jsonb NOT NULL,
+  updated_by_presence text,
+  updated_by_name text,
+  updated_at timestamp DEFAULT NOW(),
+  UNIQUE(mesh_id, key)
+);
+```
+
+### Scope
+
+State lives as long as the mesh. Operational, not archival. Use Memory for permanent knowledge.
+
+### Examples
+
+```
+set_state("sprint", "2026-W14")
+set_state("deploy_frozen", true)
+set_state("pr_queue", ["#142", "#143"])
+set_state("auth_api_status", "in-review")
+set_state("vote:rename-repo:alice", "approve")
+```
+
+---
+
+## 4. Memory
+
+Persistent shared knowledge that survives across sessions. The mesh gets smarter over time.
+
+### Why
+
+New peers join with zero context. Memory provides institutional knowledge: decisions, incidents, preferences, lessons.
+
+### Tools
+
+| Tool | Description |
+|------|-------------|
+| `remember(content, tags?)` | Store knowledge. Tags for categorization. |
+| `recall(query)` | Full-text search. Returns ranked results. |
+| `forget(id)` | Soft-delete (sets `forgotten_at`). |
+
+### Storage
+
+```sql
+CREATE TABLE mesh.memory (
+  id text PRIMARY KEY,
+  mesh_id text REFERENCES mesh.mesh(id) ON DELETE CASCADE,
+  content text NOT NULL,
+  tags text[] DEFAULT '{}',
+  search_vector tsvector GENERATED ALWAYS AS (to_tsvector('english', content)) STORED,
+  remembered_by text REFERENCES mesh.member(id),
+  remembered_by_name text,
+  remembered_at timestamp DEFAULT NOW(),
+  forgotten_at timestamp
+);
+CREATE INDEX memory_search_idx ON mesh.memory USING gin(search_vector);
+```
+
+### Memory vs State
+
+| | State | Memory |
+|---|---|---|
+| Lifetime | Mesh lifetime (operational) | Permanent (until forgotten) |
+| Purpose | Live coordination | Institutional knowledge |
+| Example | `deploy_frozen: true` | "Payments API rate-limits at 100 req/s after March incident" |
+| Access pattern | get/set with push notifications | remember/recall/forget with search |
+| When to use | Facts that change during work | Lessons that persist across sessions |
+
+---
+
+## 5. AI Context (CLAUDE.md)
+
+Each `claudemesh install` copies a `CLAUDEMESH.md` file to `~/.claudemesh/CLAUDEMESH.md`. Claude Code discovers it and injects it as context.
+
+### Content
+
+Teaches Claude how to be a good mesh peer:
+
+- How to use each tool and when
+- How to interpret group roles (lead gathers, member contributes, observer watches)
+- When to use @group vs direct vs broadcast
+- How to read and write shared state
+- How to remember and recall mesh knowledge
+- Priority etiquette (now = urgent only, next = normal, low = FYI)
+- How to respond to incoming peer messages (reply by display name, stay on topic)
+- How to set meaningful summaries
+
+### Kept lean
+
+Under 2000 tokens. Tool reference only — no behavioral scripts. Claude adapts based on its system prompt (from `--append-system-prompt`) and the group metadata it reads from `list_peers`.
+
+---
+
+## 6. WS Protocol
+
+### Client → Broker
+
+| Type | Fields | Description |
+|------|--------|-------------|
+| `hello` | meshId, memberId, pubkey, sessionPubkey?, displayName?, groups?, sessionId, pid, cwd, timestamp, signature | Authenticate + register presence |
+| `send` | targetSpec, priority, nonce, ciphertext, id? | Send encrypted envelope |
+| `set_status` | status | Manual status override |
+| `message_status` | messageId | Check delivery status of a sent message |
+| `set_summary` | summary | Update session summary |
+| `list_peers` | — | Request connected peer list |
+| `join_group` | name, role? | Join a group |
+| `leave_group` | name | Leave a group |
+| `set_state` | key, value | Write shared state |
+| `get_state` | key | Read shared state |
+| `list_state` | — | List all state entries |
+| `remember` | content, tags? | Store a memory |
+| `recall` | query | Search memories |
+| `forget` | memoryId | Soft-delete a memory |
+
+### Broker → Client
+
+| Type | Fields | Description |
+|------|--------|-------------|
+| `hello_ack` | presenceId, memberDisplayName | Auth success |
+| `push` | messageId, meshId, senderPubkey, priority, nonce, ciphertext, createdAt | Incoming message |
+| `ack` | id, messageId, queued | Send confirmation |
+| `peers_list` | peers[] | Response to list_peers |
+| `state_change` | key, value, updatedBy | Pushed on any set_state |
+| `state_result` | key, value | Response to get_state |
+| `state_list` | entries[] | Response to list_state |
+| `memory_stored` | id | Ack for remember |
+| `memory_results` | memories[] | Response to recall |
+| `message_status_result` | messageId, delivered, deliveredAt?, recipients[] | Delivery status with per-recipient detail |
+| `error` | code, message, id? | Structured error |
+
+---
+
+## 7. MCP Tools (complete surface)
+
+### Messaging
+
+| Tool | Description |
+|------|-------------|
+| `send_message(to, message, priority?)` | Send to peer name, @group, or * |
+| `check_messages()` | Drain buffered messages |
+| `message_status(id)` | Check if a sent message was delivered |
+
+### Presence
+
+| Tool | Description |
+|------|-------------|
+| `list_peers(group?)` | List peers, optionally filtered by group |
+| `set_summary(summary)` | Set visible session summary |
+| `set_status(status)` | Override: idle, working, dnd |
+
+### Groups
+
+| Tool | Description |
+|------|-------------|
+| `join_group(name, role?)` | Join with optional role |
+| `leave_group(name)` | Leave a group |
+
+### State
+
+| Tool | Description |
+|------|-------------|
+| `set_state(key, value)` | Write value, pushes to all peers |
+| `get_state(key)` | Read value |
+| `list_state()` | All keys with metadata |
+
+### Memory
+
+| Tool | Description |
+|------|-------------|
+| `remember(content, tags?)` | Store persistent knowledge |
+| `recall(query)` | Search by relevance |
+| `forget(id)` | Soft-delete |
+
+---
+
+## 8. Encryption
+
+### Direct messages
+
+E2E encrypted via libsodium crypto_box (X25519, derived from ed25519 session keys). Each session has a unique keypair — messages encrypted to the recipient's session pubkey can only be decrypted by that session.
+
+### Group and broadcast messages
+
+Base64-encoded plaintext. Group encryption (shared key derived from mesh_root_key) is a future enhancement.
+
+### Decrypt fallback
+
+If crypto_box decryption fails, the client tries base64 plaintext decode as fallback. This handles broadcasts and key mismatches gracefully.
+
+### Session key stability
+
+The session keypair generates once on first connect and survives reconnects. Messages queued for a session remain decryptable after WS reconnection.
+
+---
+
+## 9. Production hardening (implemented)
+
+| Feature | Description |
+|---------|-------------|
+| Stale presence sweep | Presences with 3 missed pings (90s) marked disconnected |
+| Sender exclusion | Broadcasts and @group messages skip the sender |
+| Session pubkey routing | Messages route to session pubkeys, not member pubkeys |
+| Sender session pubkey stored | Message queue stores sender's session key for correct decryption |
+| Peer name cache | 30s TTL cache for push notification name resolution |
+| Decrypt fallback | Base64 plaintext fallback when crypto_box fails |
+| Orphaned tmpdir cleanup | Crashed session tmpdirs cleaned after 1 hour |
+| Duplicate flag prevention | User-supplied --dangerously flags stripped to avoid doubles |
+
+---
+
+## 10. CLI commands
+
+```
+claudemesh install          Register MCP server + hooks in Claude Code
+claudemesh uninstall        Remove MCP server + hooks
+claudemesh join <url>       Join a mesh (generates keypair, enrolls with broker)
+claudemesh leave <slug>     Leave a mesh
+claudemesh launch [opts]    Launch Claude Code session with mesh identity
+claudemesh list             Show joined meshes
+claudemesh status           Broker reachability per mesh
+claudemesh doctor           Diagnostic checks
+claudemesh mcp              Start MCP server (invoked by Claude Code, not users)
+```
+
+### claudemesh launch flags
+
+| Flag | Description |
+|------|-------------|
+| `--name <name>` | Display name for this session |
+| `--role <role>` | Session role (free-form) |
+| `--groups <g1:r1,g2>` | Groups to join with optional roles |
+| `--mesh <slug>` | Select mesh (interactive picker if >1 and omitted) |
+| `--join <url>` | Join a mesh before launching |
+| `--quiet` | Skip banner |
+| `-y` / `--yes` | Skip permission confirmation |
+| `-- <args>` | Pass remaining args to claude |
+
+---
+
+## 11. Implementation status
+
+| Phase | Version | Status | What |
+|-------|---------|--------|------|
+| Core messaging | v0.1.x | Done | send, receive, push, list_peers, crypto, hooks |
+| Named sessions | v0.1.7 | Done | --name, per-session display name |
+| Session keypairs | v0.1.10 | Done | Ephemeral ed25519 per launch |
+| Crypto fix | v0.1.11 | Done | Sender session pubkey in queue |
+| Name resolution | v0.1.12 | Done | Push notifications show sender name |
+| Autonomous mode | v0.1.13 | Done | --dangerously-skip-permissions with confirmation |
+| Production hardening | v0.1.15 | Done | Stale sweep, decrypt fallback, sender exclusion |
+| Delivery fix | v0.1.16 | Done | Same-member session message delivery |
+| **Groups** | **v0.2.0** | **Done** | @group routing, roles, wizard, join/leave |
+| State | v0.3.0 | Planned | Shared key-value store with push |
+| Memory | v0.4.0 | Planned | Persistent knowledge with full-text search |
+| AI Context | v0.2.1 | Planned | CLAUDEMESH.md shipped with CLI |
+| Dashboard | v0.5.0 | Planned | Live peers, state, memory in web UI |
+
+---
+
+## 12. Design principles
+
+1. **The broker is a dumb pipe.** It routes messages, stores state, holds memory. It does not interpret roles, enforce protocols, or run agents.
+
+2. **Intelligence lives at the edges.** Claude interprets group metadata, follows coordination conventions, and adapts behavior based on system prompts. The broker carries data; Claude makes decisions.
+
+3. **Peers are equals by default.** No orchestrator. Any peer can message any peer, read shared state, join groups, propose work. Leadership is a convention, not a permission.
+
+4. **Identity is two-layered.** Member identity (permanent, invite-gated) proves authorization. Session identity (ephemeral, auto-generated) provides routing and encryption. One member, many sessions, each distinct.
+
+5. **Progressive disclosure.** `claudemesh launch` with no args shows a wizard. Power users pass flags. `-y` skips everything. First launch teaches; subsequent launches flow.
+
+6. **Convention over configuration.** Coordination patterns (lead-gather, chain review, voting) emerge from system prompts and group roles. No protocol handlers to configure.

apps/broker/src/broker.ts

@@ -33,6 +33,8 @@ import {
   invite as inviteTable,
   mesh,
   meshMember as memberTable,
+  meshMemory,
+  meshState,
   messageQueue,
   pendingStatus,
   presence,
@@ -265,6 +267,23 @@ export async function refreshQueueDepth(): Promise<void> {
   metrics.queueDepth.set(Number(row?.n ?? 0));
 }
 
+/**
+ * Sweep stale presences: mark as disconnected if last_ping_at is older
+ * than 90s (3 missed pings at the 30s interval = dead session).
+ */
+export async function sweepStalePresences(): Promise<void> {
+  const cutoff = new Date(Date.now() - 90_000); // 3 missed pings
+  await db
+    .update(presence)
+    .set({ disconnectedAt: new Date() })
+    .where(
+      and(
+        isNull(presence.disconnectedAt),
+        lt(presence.lastPingAt, cutoff),
+      ),
+    );
+}
+
 /** Sweep expired pending_status entries. */
 export async function sweepPendingStatuses(): Promise<void> {
   const cutoff = new Date(Date.now() - PENDING_TTL_MS);
@@ -307,9 +326,11 @@ export async function refreshStatusFromJsonl(
 export interface ConnectParams {
   memberId: string;
   sessionId: string;
+  sessionPubkey?: string;
   displayName?: string;
   pid: number;
   cwd: string;
+  groups?: Array<{ name: string; role?: string }>;
 }
 
 /** Create a presence row for a new WS connection. */
@@ -322,12 +343,14 @@ export async function connectPresence(
     .values({
       memberId: params.memberId,
       sessionId: params.sessionId,
+      sessionPubkey: params.sessionPubkey ?? null,
       displayName: params.displayName ?? null,
       pid: params.pid,
       cwd: params.cwd,
       status: "idle",
       statusSource: "jsonl",
       statusUpdatedAt: now,
+      groups: params.groups ?? [],
       connectedAt: now,
       lastPingAt: now,
     })
@@ -365,17 +388,20 @@ export async function listPeersInMesh(
     displayName: string;
     status: string;
     summary: string | null;
+    groups: Array<{ name: string; role?: string }>;
     sessionId: string;
     connectedAt: Date;
   }>
 > {
   const rows = await db
     .select({
-      pubkey: memberTable.peerPubkey,
+      memberPubkey: memberTable.peerPubkey,
+      sessionPubkey: presence.sessionPubkey,
       memberDisplayName: memberTable.displayName,
       presenceDisplayName: presence.displayName,
       status: presence.status,
       summary: presence.summary,
+      groups: presence.groups,
       sessionId: presence.sessionId,
       connectedAt: presence.connectedAt,
     })
@@ -388,12 +414,13 @@ export async function listPeersInMesh(
       ),
     )
     .orderBy(asc(presence.connectedAt));
-  // Prefer per-session displayName over member-level displayName.
+  // Prefer session pubkey for routing, session displayName for display.
   return rows.map((r) => ({
-    pubkey: r.pubkey,
+    pubkey: r.sessionPubkey || r.memberPubkey,
     displayName: r.presenceDisplayName || r.memberDisplayName,
     status: r.status,
     summary: r.summary,
+    groups: (r.groups ?? []) as Array<{ name: string; role?: string }>,
     sessionId: r.sessionId,
     connectedAt: r.connectedAt,
   }));
@@ -410,11 +437,270 @@ export async function setSummary(
     .where(eq(presence.id, presenceId));
 }
 
+// --- Group management ---
+
+/**
+ * Join a group (upsert). If the peer is already in the group, update the role.
+ * Returns the updated groups array.
+ */
+export async function joinGroup(
+  presenceId: string,
+  name: string,
+  role?: string,
+): Promise<Array<{ name: string; role?: string }>> {
+  const [row] = await db
+    .select({ groups: presence.groups })
+    .from(presence)
+    .where(eq(presence.id, presenceId));
+  if (!row) return [];
+  const groups = ((row.groups ?? []) as Array<{ name: string; role?: string }>).slice();
+  const idx = groups.findIndex((g) => g.name === name);
+  const entry: { name: string; role?: string } = { name };
+  if (role) entry.role = role;
+  if (idx >= 0) {
+    groups[idx] = entry;
+  } else {
+    groups.push(entry);
+  }
+  await db
+    .update(presence)
+    .set({ groups })
+    .where(eq(presence.id, presenceId));
+  return groups;
+}
+
+/**
+ * Leave a group. Returns the updated groups array.
+ */
+export async function leaveGroup(
+  presenceId: string,
+  name: string,
+): Promise<Array<{ name: string; role?: string }>> {
+  const [row] = await db
+    .select({ groups: presence.groups })
+    .from(presence)
+    .where(eq(presence.id, presenceId));
+  if (!row) return [];
+  const groups = ((row.groups ?? []) as Array<{ name: string; role?: string }>).filter(
+    (g) => g.name !== name,
+  );
+  await db
+    .update(presence)
+    .set({ groups })
+    .where(eq(presence.id, presenceId));
+  return groups;
+}
+
+// --- Shared state ---
+
+/**
+ * Upsert a key-value pair in the mesh's shared state.
+ * Returns the upserted row.
+ */
+export async function setState(
+  meshId: string,
+  key: string,
+  value: unknown,
+  presenceId?: string,
+  presenceName?: string,
+): Promise<{
+  key: string;
+  value: unknown;
+  updatedBy: string;
+  updatedAt: Date;
+}> {
+  const now = new Date();
+  const [row] = await db
+    .insert(meshState)
+    .values({
+      meshId,
+      key,
+      value,
+      updatedByPresence: presenceId ?? null,
+      updatedByName: presenceName ?? null,
+      updatedAt: now,
+    })
+    .onConflictDoUpdate({
+      target: [meshState.meshId, meshState.key],
+      set: {
+        value,
+        updatedByPresence: presenceId ?? null,
+        updatedByName: presenceName ?? null,
+        updatedAt: now,
+      },
+    })
+    .returning({
+      key: meshState.key,
+      value: meshState.value,
+      updatedByName: meshState.updatedByName,
+      updatedAt: meshState.updatedAt,
+    });
+  return {
+    key: row!.key,
+    value: row!.value,
+    updatedBy: row!.updatedByName ?? "unknown",
+    updatedAt: row!.updatedAt,
+  };
+}
+
+/**
+ * Read a single state key for a mesh. Returns null if not found.
+ */
+export async function getState(
+  meshId: string,
+  key: string,
+): Promise<{
+  key: string;
+  value: unknown;
+  updatedBy: string;
+  updatedAt: Date;
+} | null> {
+  const [row] = await db
+    .select({
+      key: meshState.key,
+      value: meshState.value,
+      updatedByName: meshState.updatedByName,
+      updatedAt: meshState.updatedAt,
+    })
+    .from(meshState)
+    .where(and(eq(meshState.meshId, meshId), eq(meshState.key, key)))
+    .limit(1);
+  if (!row) return null;
+  return {
+    key: row.key,
+    value: row.value,
+    updatedBy: row.updatedByName ?? "unknown",
+    updatedAt: row.updatedAt,
+  };
+}
+
+/**
+ * List all state entries for a mesh.
+ */
+export async function listState(
+  meshId: string,
+): Promise<
+  Array<{ key: string; value: unknown; updatedBy: string; updatedAt: Date }>
+> {
+  const rows = await db
+    .select({
+      key: meshState.key,
+      value: meshState.value,
+      updatedByName: meshState.updatedByName,
+      updatedAt: meshState.updatedAt,
+    })
+    .from(meshState)
+    .where(eq(meshState.meshId, meshId))
+    .orderBy(asc(meshState.key));
+  return rows.map((r) => ({
+    key: r.key,
+    value: r.value,
+    updatedBy: r.updatedByName ?? "unknown",
+    updatedAt: r.updatedAt,
+  }));
+}
+
+// --- Memory ---
+
+/**
+ * Store a new memory for a mesh. Returns the generated id.
+ */
+export async function rememberMemory(
+  meshId: string,
+  content: string,
+  tags: string[],
+  memberId?: string,
+  memberName?: string,
+): Promise<string> {
+  const [row] = await db
+    .insert(meshMemory)
+    .values({
+      meshId,
+      content,
+      tags,
+      rememberedBy: memberId ?? null,
+      rememberedByName: memberName ?? null,
+    })
+    .returning({ id: meshMemory.id });
+  if (!row) throw new Error("failed to insert memory");
+  return row.id;
+}
+
+/**
+ * Full-text search memories in a mesh. Uses the search_vector tsvector
+ * column with plainto_tsquery for ranked results.
+ */
+export async function recallMemory(
+  meshId: string,
+  query: string,
+): Promise<
+  Array<{
+    id: string;
+    content: string;
+    tags: string[];
+    rememberedBy: string;
+    rememberedAt: Date;
+  }>
+> {
+  const result = await db.execute<{
+    id: string;
+    content: string;
+    tags: string[];
+    remembered_by_name: string | null;
+    remembered_at: string | Date;
+  }>(sql`
+    SELECT id, content, tags, remembered_by_name, remembered_at
+    FROM mesh.memory
+    WHERE mesh_id = ${meshId}
+      AND forgotten_at IS NULL
+      AND search_vector @@ plainto_tsquery('english', ${query})
+    ORDER BY ts_rank(search_vector, plainto_tsquery('english', ${query})) DESC
+    LIMIT 20
+  `);
+  const rows = (result.rows ?? result) as Array<{
+    id: string;
+    content: string;
+    tags: string[];
+    remembered_by_name: string | null;
+    remembered_at: string | Date;
+  }>;
+  return rows.map((r) => ({
+    id: r.id,
+    content: r.content,
+    tags: r.tags ?? [],
+    rememberedBy: r.remembered_by_name ?? "unknown",
+    rememberedAt:
+      r.remembered_at instanceof Date
+        ? r.remembered_at
+        : new Date(r.remembered_at),
+  }));
+}
+
+/**
+ * Soft-delete a memory by setting forgotten_at.
+ */
+export async function forgetMemory(
+  meshId: string,
+  memoryId: string,
+): Promise<void> {
+  await db
+    .update(meshMemory)
+    .set({ forgottenAt: new Date() })
+    .where(
+      and(
+        eq(meshMemory.id, memoryId),
+        eq(meshMemory.meshId, meshId),
+        isNull(meshMemory.forgottenAt),
+      ),
+    );
+}
+
 // --- Message queueing + delivery ---
 
 export interface QueueParams {
   meshId: string;
   senderMemberId: string;
+  senderSessionPubkey?: string;
   targetSpec: string;
   priority: Priority;
   nonce: string;
@@ -429,6 +715,7 @@ export async function queueMessage(params: QueueParams): Promise<string> {
     .values({
       meshId: params.meshId,
       senderMemberId: params.senderMemberId,
+      senderSessionPubkey: params.senderSessionPubkey ?? null,
       targetSpec: params.targetSpec,
       priority: params.priority,
       nonce: params.nonce,
@@ -469,6 +756,9 @@ export async function drainForMember(
   _memberId: string,
   memberPubkey: string,
   status: PeerStatus,
+  sessionPubkey?: string,
+  excludeSenderSessionPubkey?: string,
+  memberGroups?: string[],
 ): Promise<
   Array<{
     id: string;
@@ -486,6 +776,18 @@ export async function drainForMember(
     priorities.map((p) => `'${p}'`).join(","),
   );
 
+  // Build group target matching: @all (broadcast alias) + @<groupname>
+  // for each group the peer belongs to.
+  const groupTargets = ["@all"];
+  if (memberGroups) {
+    for (const g of memberGroups) {
+      groupTargets.push(`@${g}`);
+    }
+  }
+  const groupTargetList = sql.raw(
+    groupTargets.map((t) => `'${t}'`).join(","),
+  );
+
   // Atomic claim with SQL-side ordering. The CTE claims rows via
   // UPDATE...RETURNING; the outer SELECT re-orders by created_at
   // (with id as tiebreaker so equal-timestamp rows stay deterministic).
@@ -509,14 +811,15 @@ export async function drainForMember(
         WHERE mesh_id = ${meshId}
           AND delivered_at IS NULL
           AND priority::text IN (${priorityList})
-          AND (target_spec = ${memberPubkey} OR target_spec = '*')
+          AND (target_spec = ${memberPubkey} OR target_spec = '*'${sessionPubkey ? sql` OR target_spec = ${sessionPubkey}` : sql``} OR target_spec IN (${groupTargetList}))
+          ${excludeSenderSessionPubkey ? sql`AND (sender_session_pubkey IS NULL OR sender_session_pubkey != ${excludeSenderSessionPubkey})` : sql``}
         ORDER BY created_at ASC, id ASC
         FOR UPDATE SKIP LOCKED
       )
       AND m.id = mq.sender_member_id
       RETURNING mq.id, mq.priority, mq.nonce, mq.ciphertext,
                mq.created_at, mq.sender_member_id,
-               m.peer_pubkey AS sender_pubkey
+               COALESCE(mq.sender_session_pubkey, m.peer_pubkey) AS sender_pubkey
     )
     SELECT * FROM claimed ORDER BY created_at ASC, id ASC
   `);
@@ -547,6 +850,7 @@ export async function drainForMember(
 
 let ttlTimer: ReturnType<typeof setInterval> | null = null;
 let pendingTimer: ReturnType<typeof setInterval> | null = null;
+let staleTimer: ReturnType<typeof setInterval> | null = null;
 
 /** Start background sweepers. Idempotent. */
 export function startSweepers(): void {
@@ -559,14 +863,21 @@ export function startSweepers(): void {
       console.error("[broker] pending sweep:", e),
     );
   }, PENDING_SWEEP_INTERVAL_MS);
+  staleTimer = setInterval(() => {
+    sweepStalePresences().catch((e) =>
+      console.error("[broker] stale presence sweep:", e),
+    );
+  }, 30_000);
 }
 
 /** Stop background sweepers and mark all active presences disconnected. */
 export async function stopSweepers(): Promise<void> {
   if (ttlTimer) clearInterval(ttlTimer);
   if (pendingTimer) clearInterval(pendingTimer);
+  if (staleTimer) clearInterval(staleTimer);
   ttlTimer = null;
   pendingTimer = null;
+  staleTimer = null;
   await db
     .update(presence)
     .set({ disconnectedAt: new Date() })

apps/broker/src/index.ts

@@ -15,20 +15,31 @@
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import type { Duplex } from "node:stream";
 import { WebSocketServer, type WebSocket } from "ws";
+import { eq } from "drizzle-orm";
 import { env } from "./env";
+import { db } from "./db";
+import { messageQueue } from "@turbostarter/db/schema/mesh";
 import {
   connectPresence,
   disconnectPresence,
   drainForMember,
   findMemberByPubkey,
+  forgetMemory,
+  getState,
   handleHookSetStatus,
   heartbeat,
+  joinGroup,
   joinMesh,
+  leaveGroup,
   listPeersInMesh,
+  listState,
   queueMessage,
+  recallMemory,
   refreshQueueDepth,
   refreshStatusFromJsonl,
+  rememberMemory,
   setSummary,
+  setState,
   startSweepers,
   stopSweepers,
   writeStatus,
@@ -56,7 +67,9 @@ interface PeerConn {
   meshId: string;
   memberId: string;
   memberPubkey: string;
+  sessionPubkey: string | null;
   cwd: string;
+  groups: Array<{ name: string; role?: string }>;
 }
 
 const connections = new Map<string, PeerConn>();
@@ -80,7 +93,10 @@ function sendToPeer(presenceId: string, msg: WSServerMessage): void {
   }
 }
 
-async function maybePushQueuedMessages(presenceId: string): Promise<void> {
+async function maybePushQueuedMessages(
+  presenceId: string,
+  excludeSenderSessionPubkey?: string,
+): Promise<void> {
   const conn = connections.get(presenceId);
   if (!conn) return;
   const status = await refreshStatusFromJsonl(
@@ -93,6 +109,9 @@ async function maybePushQueuedMessages(presenceId: string): Promise<void> {
     conn.memberId,
     conn.memberPubkey,
     status,
+    conn.sessionPubkey ?? undefined,
+    excludeSenderSessionPubkey,
+    conn.groups.map((g) => g.name),
   );
   for (const m of messages) {
     const push: WSPushMessage = {
@@ -397,19 +416,24 @@ async function handleHello(
     ws.close(1008, "unauthorized");
     return null;
   }
+  const initialGroups = hello.groups ?? [];
   const presenceId = await connectPresence({
     memberId: member.id,
     sessionId: hello.sessionId,
+    sessionPubkey: hello.sessionPubkey,
     displayName: hello.displayName,
     pid: hello.pid,
     cwd: hello.cwd,
+    groups: initialGroups,
   });
   connections.set(presenceId, {
     ws,
     meshId: hello.meshId,
     memberId: member.id,
     memberPubkey: hello.pubkey,
+    sessionPubkey: hello.sessionPubkey ?? null,
     cwd: hello.cwd,
+    groups: initialGroups,
   });
   incMeshCount(hello.meshId);
   const effectiveDisplayName = hello.displayName || member.displayName;
@@ -434,6 +458,7 @@ async function handleSend(
   const messageId = await queueMessage({
     meshId: conn.meshId,
     senderMemberId: conn.memberId,
+    senderSessionPubkey: conn.sessionPubkey ?? undefined,
     targetSpec: msg.targetSpec,
     priority: msg.priority,
     nonce: msg.nonce,
@@ -447,12 +472,68 @@ async function handleSend(
   };
   conn.ws.send(JSON.stringify(ack));
 
-  // Fan-out over connected peers in the same mesh.
+  // Find sender's presenceId to exclude from fan-out.
+  let senderPresenceId: string | undefined;
   for (const [pid, peer] of connections) {
+    if (peer.ws === conn.ws) { senderPresenceId = pid; break; }
+  }
+
+  // Fan-out over connected peers in the same mesh — skip sender.
+  const isGroupTarget = msg.targetSpec.startsWith("@");
+  const isBroadcast =
+    msg.targetSpec === "*" ||
+    (isGroupTarget && msg.targetSpec === "@all");
+  const groupName = isGroupTarget && !isBroadcast
+    ? msg.targetSpec.slice(1)
+    : null;
+  const isMulticast = isBroadcast || !!groupName;
+
+  // Build the push envelope once (reused for all recipients).
+  const pushEnvelope: WSPushMessage = {
+    type: "push",
+    messageId,
+    meshId: conn.meshId,
+    senderPubkey: conn.sessionPubkey ?? conn.memberPubkey,
+    priority: msg.priority,
+    nonce: msg.nonce,
+    ciphertext: msg.ciphertext,
+    createdAt: new Date().toISOString(),
+  };
+
+  for (const [pid, peer] of connections) {
+    if (pid === senderPresenceId) continue;
     if (peer.meshId !== conn.meshId) continue;
-    if (msg.targetSpec !== "*" && peer.memberPubkey !== msg.targetSpec)
-      continue;
-    void maybePushQueuedMessages(pid);
+
+    if (isBroadcast) {
+      // broadcast — deliver to everyone
+    } else if (groupName) {
+      // group routing — deliver only if peer is in the group
+      if (!peer.groups.some((g) => g.name === groupName)) continue;
+    } else {
+      // direct routing — match by pubkey
+      if (peer.memberPubkey !== msg.targetSpec
+          && peer.sessionPubkey !== msg.targetSpec)
+        continue;
+    }
+
+    if (isMulticast) {
+      // Multicast: push directly to each connected peer. The queue
+      // row has one delivered_at — can only be claimed once. Direct
+      // push ensures every connected peer receives the message.
+      sendToPeer(pid, pushEnvelope);
+      metrics.messagesRoutedTotal.inc({ priority: msg.priority });
+    } else {
+      // Direct: drain from queue (handles priority gating + offline).
+      void maybePushQueuedMessages(pid, conn.sessionPubkey ?? undefined);
+    }
+  }
+
+  // Mark multicast messages as delivered (they've been pushed directly).
+  if (isMulticast) {
+    await db
+      .update(messageQueue)
+      .set({ deliveredAt: new Date() })
+      .where(eq(messageQueue.id, messageId));
   }
 }
 
@@ -507,6 +588,7 @@ function handleConnection(ws: WebSocket): void {
               displayName: p.displayName,
               status: p.status as "idle" | "working" | "dnd",
               summary: p.summary,
+              groups: p.groups,
               sessionId: p.sessionId,
               connectedAt: p.connectedAt.toISOString(),
             })),
@@ -528,6 +610,237 @@ function handleConnection(ws: WebSocket): void {
           });
           break;
         }
+        case "join_group": {
+          const jg = msg as Extract<WSClientMessage, { type: "join_group" }>;
+          const updatedGroups = await joinGroup(presenceId, jg.name, jg.role);
+          conn.groups = updatedGroups;
+          log.info("ws join_group", {
+            presence_id: presenceId,
+            group: jg.name,
+            role: jg.role,
+          });
+          break;
+        }
+        case "leave_group": {
+          const lg = msg as Extract<WSClientMessage, { type: "leave_group" }>;
+          const updatedGroups = await leaveGroup(presenceId, lg.name);
+          conn.groups = updatedGroups;
+          log.info("ws leave_group", {
+            presence_id: presenceId,
+            group: lg.name,
+          });
+          break;
+        }
+        case "set_state": {
+          const ss = msg as Extract<WSClientMessage, { type: "set_state" }>;
+          // Look up the display name for attribution.
+          const senderName =
+            [...connections.entries()].find(
+              ([pid]) => pid === presenceId,
+            )?.[1]?.memberPubkey;
+          const member = senderName
+            ? await findMemberByPubkey(conn.meshId, senderName)
+            : null;
+          const displayName = member?.displayName ?? "unknown";
+          const stateRow = await setState(
+            conn.meshId,
+            ss.key,
+            ss.value,
+            presenceId,
+            displayName,
+          );
+          // Push state_change to ALL other peers in the same mesh.
+          for (const [pid, peer] of connections) {
+            if (pid === presenceId) continue;
+            if (peer.meshId !== conn.meshId) continue;
+            sendToPeer(pid, {
+              type: "state_change",
+              key: stateRow.key,
+              value: stateRow.value,
+              updatedBy: stateRow.updatedBy,
+            });
+          }
+          // Send confirmation back to sender as state_result.
+          sendToPeer(presenceId, {
+            type: "state_result",
+            key: stateRow.key,
+            value: stateRow.value,
+            updatedBy: stateRow.updatedBy,
+            updatedAt: stateRow.updatedAt.toISOString(),
+          });
+          log.info("ws set_state", {
+            presence_id: presenceId,
+            key: ss.key,
+          });
+          break;
+        }
+        case "get_state": {
+          const gs = msg as Extract<WSClientMessage, { type: "get_state" }>;
+          const stateEntry = await getState(conn.meshId, gs.key);
+          if (stateEntry) {
+            sendToPeer(presenceId, {
+              type: "state_result",
+              key: stateEntry.key,
+              value: stateEntry.value,
+              updatedBy: stateEntry.updatedBy,
+              updatedAt: stateEntry.updatedAt.toISOString(),
+            });
+          } else {
+            sendToPeer(presenceId, {
+              type: "state_result",
+              key: gs.key,
+              value: null,
+              updatedBy: "",
+              updatedAt: "",
+            });
+          }
+          log.info("ws get_state", {
+            presence_id: presenceId,
+            key: gs.key,
+            found: !!stateEntry,
+          });
+          break;
+        }
+        case "list_state": {
+          const entries = await listState(conn.meshId);
+          sendToPeer(presenceId, {
+            type: "state_list",
+            entries: entries.map((e) => ({
+              key: e.key,
+              value: e.value,
+              updatedBy: e.updatedBy,
+              updatedAt: e.updatedAt.toISOString(),
+            })),
+          });
+          log.info("ws list_state", {
+            presence_id: presenceId,
+            count: entries.length,
+          });
+          break;
+        }
+        case "remember": {
+          const rm = msg as Extract<WSClientMessage, { type: "remember" }>;
+          const memberInfo = conn.memberPubkey
+            ? await findMemberByPubkey(conn.meshId, conn.memberPubkey)
+            : null;
+          const memoryId = await rememberMemory(
+            conn.meshId,
+            rm.content,
+            rm.tags ?? [],
+            memberInfo?.id,
+            memberInfo?.displayName,
+          );
+          sendToPeer(presenceId, {
+            type: "memory_stored",
+            id: memoryId,
+          });
+          log.info("ws remember", {
+            presence_id: presenceId,
+            memory_id: memoryId,
+          });
+          break;
+        }
+        case "recall": {
+          const rc = msg as Extract<WSClientMessage, { type: "recall" }>;
+          const memories = await recallMemory(conn.meshId, rc.query);
+          sendToPeer(presenceId, {
+            type: "memory_results",
+            memories: memories.map((m) => ({
+              id: m.id,
+              content: m.content,
+              tags: m.tags,
+              rememberedBy: m.rememberedBy,
+              rememberedAt: m.rememberedAt.toISOString(),
+            })),
+          });
+          log.info("ws recall", {
+            presence_id: presenceId,
+            query: rc.query.slice(0, 80),
+            results: memories.length,
+          });
+          break;
+        }
+        case "forget": {
+          const fg = msg as Extract<WSClientMessage, { type: "forget" }>;
+          await forgetMemory(conn.meshId, fg.memoryId);
+          sendToPeer(presenceId, {
+            type: "ack" as const,
+            id: fg.memoryId,
+            messageId: fg.memoryId,
+            queued: false,
+          });
+          log.info("ws forget", {
+            presence_id: presenceId,
+            memory_id: fg.memoryId,
+          });
+          break;
+        }
+        case "message_status": {
+          const ms = msg as Extract<WSClientMessage, { type: "message_status" }>;
+          // Look up the message in the queue.
+          const [mqRow] = await db
+            .select({
+              id: messageQueue.id,
+              targetSpec: messageQueue.targetSpec,
+              deliveredAt: messageQueue.deliveredAt,
+              meshId: messageQueue.meshId,
+            })
+            .from(messageQueue)
+            .where(eq(messageQueue.id, ms.messageId));
+          if (!mqRow || mqRow.meshId !== conn.meshId) {
+            sendError(conn.ws, "not_found", "message not found");
+            break;
+          }
+          // Build per-recipient status from connected peers.
+          const recipients: Array<{ name: string; pubkey: string; status: "delivered" | "held" | "disconnected" }> = [];
+          const isMulti = mqRow.targetSpec === "*" || mqRow.targetSpec.startsWith("@");
+          if (isMulti) {
+            const groupNameMs = mqRow.targetSpec.startsWith("@") && mqRow.targetSpec !== "@all"
+              ? mqRow.targetSpec.slice(1) : null;
+            // Check all known presences for this mesh.
+            const peers = await listPeersInMesh(conn.meshId);
+            for (const p of peers) {
+              if (groupNameMs && !p.groups.some((g: { name: string }) => g.name === groupNameMs)) continue;
+              recipients.push({
+                name: p.displayName,
+                pubkey: p.pubkey,
+                status: mqRow.deliveredAt ? "delivered" : "held",
+              });
+            }
+          } else {
+            // Direct message — find the target peer.
+            const peers = await listPeersInMesh(conn.meshId);
+            const target = peers.find((p) => p.pubkey === mqRow.targetSpec);
+            if (target) {
+              recipients.push({
+                name: target.displayName,
+                pubkey: target.pubkey,
+                status: mqRow.deliveredAt ? "delivered" : (target.status === "idle" ? "held" : "held"),
+              });
+            } else {
+              recipients.push({
+                name: "unknown",
+                pubkey: mqRow.targetSpec.slice(0, 16),
+                status: "disconnected",
+              });
+            }
+          }
+          const resp: WSServerMessage = {
+            type: "message_status_result",
+            messageId: ms.messageId,
+            targetSpec: mqRow.targetSpec,
+            delivered: !!mqRow.deliveredAt,
+            deliveredAt: mqRow.deliveredAt?.toISOString() ?? null,
+            recipients,
+          };
+          sendToPeer(presenceId, resp);
+          log.info("ws message_status", {
+            presence_id: presenceId,
+            message_id: ms.messageId,
+            delivered: !!mqRow.deliveredAt,
+          });
+          break;
+        }
       }
     } catch (e) {
       metrics.messagesRejectedTotal.inc({ reason: "parse_or_handler" });

apps/broker/src/types.ts

@@ -52,10 +52,13 @@ export interface WSHelloMessage {
   meshId: string;
   memberId: string;
   pubkey: string; // must match mesh.member.peerPubkey
+  sessionPubkey?: string; // ephemeral per-launch pubkey for message routing
   displayName?: string; // optional override for this session
   sessionId: string;
   pid: number;
   cwd: string;
+  /** Initial groups to join on connect. */
+  groups?: Array<{ name: string; role?: string }>;
   /** ms epoch; broker rejects if outside ±60s of its own clock. */
   timestamp: number;
   /** ed25519 signature (hex) over the canonical hello bytes:
@@ -102,6 +105,56 @@ export interface WSSetSummaryMessage {
   summary: string;
 }
 
+/** Client → broker: join a group with optional role. */
+export interface WSJoinGroupMessage {
+  type: "join_group";
+  name: string;
+  role?: string;
+}
+
+/** Client → broker: leave a group. */
+export interface WSLeaveGroupMessage {
+  type: "leave_group";
+  name: string;
+}
+
+/** Client → broker: set a shared state key-value. */
+export interface WSSetStateMessage {
+  type: "set_state";
+  key: string;
+  value: unknown;
+}
+
+/** Client → broker: read a shared state key. */
+export interface WSGetStateMessage {
+  type: "get_state";
+  key: string;
+}
+
+/** Client → broker: list all shared state entries. */
+export interface WSListStateMessage {
+  type: "list_state";
+}
+
+/** Client → broker: store a memory. */
+export interface WSRememberMessage {
+  type: "remember";
+  content: string;
+  tags?: string[];
+}
+
+/** Client → broker: full-text search memories. */
+export interface WSRecallMessage {
+  type: "recall";
+  query: string;
+}
+
+/** Client → broker: soft-delete a memory. */
+export interface WSForgetMessage {
+  type: "forget";
+  memoryId: string;
+}
+
 /** Broker → client: acknowledgement for a send. */
 export interface WSAckMessage {
   type: "ack";
@@ -125,11 +178,78 @@ export interface WSPeersListMessage {
     displayName: string;
     status: PeerStatus;
     summary: string | null;
+    groups: Array<{ name: string; role?: string }>;
     sessionId: string;
     connectedAt: string;
   }>;
 }
 
+/** Broker → client: a state key was changed by another peer. */
+export interface WSStateChangeMessage {
+  type: "state_change";
+  key: string;
+  value: unknown;
+  updatedBy: string;
+}
+
+/** Broker → client: response to get_state. */
+export interface WSStateResultMessage {
+  type: "state_result";
+  key: string;
+  value: unknown;
+  updatedAt: string;
+  updatedBy: string;
+}
+
+/** Broker → client: response to list_state. */
+export interface WSStateListMessage {
+  type: "state_list";
+  entries: Array<{
+    key: string;
+    value: unknown;
+    updatedBy: string;
+    updatedAt: string;
+  }>;
+}
+
+/** Broker → client: acknowledgement for a remember. */
+export interface WSMemoryStoredMessage {
+  type: "memory_stored";
+  id: string;
+}
+
+/** Broker → client: response to recall. */
+export interface WSMemoryResultsMessage {
+  type: "memory_results";
+  memories: Array<{
+    id: string;
+    content: string;
+    tags: string[];
+    rememberedBy: string;
+    rememberedAt: string;
+  }>;
+}
+
+/** Client → broker: check delivery status of a message. */
+export interface WSMessageStatusMessage {
+  type: "message_status";
+  messageId: string;
+}
+
+/** Broker → client: delivery status with per-recipient detail. */
+export interface WSMessageStatusResultMessage {
+  type: "message_status_result";
+  messageId: string;
+  targetSpec: string;
+  delivered: boolean;
+  deliveredAt: string | null;
+  recipients: Array<{
+    name: string;
+    pubkey: string;
+    status: "delivered" | "held" | "disconnected";
+  }>;
+}
+
 /** Broker → client: structured error. */
 export interface WSErrorMessage {
   type: "error";
@@ -143,11 +263,26 @@ export type WSClientMessage =
   | WSSendMessage
   | WSSetStatusMessage
   | WSListPeersMessage
-  | WSSetSummaryMessage;
+  | WSSetSummaryMessage
+  | WSJoinGroupMessage
+  | WSLeaveGroupMessage
+  | WSSetStateMessage
+  | WSGetStateMessage
+  | WSListStateMessage
+  | WSRememberMessage
+  | WSRecallMessage
+  | WSForgetMessage
+  | WSMessageStatusMessage;
 
 export type WSServerMessage =
   | WSHelloAckMessage
   | WSPushMessage
   | WSAckMessage
   | WSPeersListMessage
+  | WSStateChangeMessage
+  | WSStateResultMessage
+  | WSStateListMessage
+  | WSMemoryStoredMessage
+  | WSMemoryResultsMessage
+  | WSMessageStatusResultMessage
   | WSErrorMessage;

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemesh-cli",
-  "version": "0.1.9",
+  "version": "0.3.0",
   "description": "Claude Code MCP client for claudemesh — peer mesh messaging between Claude sessions.",
   "keywords": [
     "claude-code",

apps/cli/src/commands/join.ts

@@ -14,7 +14,10 @@ import { parseInviteLink } from "../invite/parse";
 import { enrollWithBroker } from "../invite/enroll";
 import { generateKeypair } from "../crypto/keypair";
 import { loadConfig, saveConfig, getConfigPath } from "../state/config";
-import { hostname } from "node:os";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir, hostname } from "node:os";
+import { env } from "../env";
 
 export async function runJoin(args: string[]): Promise<void> {
   const link = args[0];
@@ -78,6 +81,16 @@ export async function runJoin(args: string[]): Promise<void> {
   });
   saveConfig(config);
 
+  // 4b. Store invite token for per-session re-enrollment (launch --name).
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join(homedir(), ".claudemesh");
+  const inviteFile = join(configDir, `invite-${payload.mesh_slug}.txt`);
+  try {
+    mkdirSync(dirname(inviteFile), { recursive: true });
+    writeFileSync(inviteFile, link, "utf-8");
+  } catch {
+    // Non-fatal — launch will fall back to shared identity.
+  }
+
   // 5. Report.
   console.log("");
   console.log(

apps/cli/src/commands/launch.ts

@@ -11,32 +11,35 @@
  */
 
 import { spawn } from "node:child_process";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { mkdtempSync, writeFileSync, rmSync, readdirSync, statSync } from "node:fs";
 import { tmpdir, hostname } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { loadConfig, getConfigPath } from "../state/config";
-import type { Config, JoinedMesh } from "../state/config";
-import { generateKeypair } from "../crypto/keypair";
-import { enrollWithBroker } from "../invite/enroll";
-import { parseInviteLink } from "../invite/parse";
+import type { Config, JoinedMesh, GroupEntry } from "../state/config";
 
 // --- Arg parsing ---
 
 interface LaunchArgs {
   name: string | null;
+  role: string | null;
+  groups: string | null; // comma-separated, e.g. "frontend:lead,reviewers:member"
   joinLink: string | null;
   meshSlug: string | null;
   quiet: boolean;
+  skipPermConfirm: boolean;
   claudeArgs: string[];
 }
 
 function parseArgs(argv: string[]): LaunchArgs {
   const result: LaunchArgs = {
     name: null,
+    role: null,
+    groups: null,
     joinLink: null,
     meshSlug: null,
     quiet: false,
+    skipPermConfirm: false,
     claudeArgs: [],
   };
 
@@ -47,6 +50,14 @@ function parseArgs(argv: string[]): LaunchArgs {
       result.name = argv[++i]!;
     } else if (arg.startsWith("--name=")) {
       result.name = arg.slice("--name=".length);
+    } else if (arg === "--role" && i + 1 < argv.length) {
+      result.role = argv[++i]!;
+    } else if (arg.startsWith("--role=")) {
+      result.role = arg.slice("--role=".length);
+    } else if (arg === "--groups" && i + 1 < argv.length) {
+      result.groups = argv[++i]!;
+    } else if (arg.startsWith("--groups=")) {
+      result.groups = arg.slice("--groups=".length);
     } else if (arg === "--join" && i + 1 < argv.length) {
       result.joinLink = argv[++i]!;
     } else if (arg.startsWith("--join=")) {
@@ -57,6 +68,8 @@ function parseArgs(argv: string[]): LaunchArgs {
       result.meshSlug = arg.slice("--mesh=".length);
     } else if (arg === "--quiet") {
       result.quiet = true;
+    } else if (arg === "-y" || arg === "--yes") {
+      result.skipPermConfirm = true;
     } else if (arg === "--") {
       result.claudeArgs.push(...argv.slice(i + 1));
       break;
@@ -94,16 +107,83 @@ async function pickMesh(meshes: JoinedMesh[]): Promise<JoinedMesh> {
   });
 }
 
+// --- Group string parser ---
+
+/** Parse "frontend:lead,reviewers:member,all" → GroupEntry[] */
+function parseGroupsString(raw: string): GroupEntry[] {
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .map((token) => {
+      const idx = token.indexOf(":");
+      if (idx === -1) return { name: token };
+      return { name: token.slice(0, idx), role: token.slice(idx + 1) };
+    });
+}
+
+// --- Interactive role/groups prompts ---
+
+function askLine(prompt: string): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+// --- Permission confirmation ---
+
+async function confirmPermissions(): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const bold = (s: string): string => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+  const dim = (s: string): string => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const yellow = (s: string): string => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+
+  console.log(yellow(bold("  Autonomous mode")));
+  console.log("");
+  console.log("  Claude will send and receive peer messages without asking");
+  console.log("  you first. Peers exchange text only — no file access,");
+  console.log("  no tool calls, no code execution.");
+  console.log("");
+  console.log(dim("  Same as: claude --dangerously-skip-permissions"));
+  console.log(dim("  Skip this prompt: claudemesh launch -y"));
+  console.log("");
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve, reject) => {
+    rl.question(`  ${bold("Continue?")} [Y/n] `, (answer) => {
+      rl.close();
+      const a = answer.trim().toLowerCase();
+      if (a === "" || a === "y" || a === "yes") {
+        resolve();
+      } else {
+        console.log("\n  Aborted. Run without autonomous mode:");
+        console.log("    claude --dangerously-load-development-channels server:claudemesh\n");
+        process.exit(0);
+      }
+    });
+  });
+}
+
 // --- Banner ---
 
-function printBanner(name: string, meshSlug: string): void {
+function printBanner(name: string, meshSlug: string, role: string | null, groups: GroupEntry[]): void {
   const useColor =
     !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
   const dim = (s: string): string => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
   const bold = (s: string): string => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
 
+  const roleSuffix = role ? ` (${role})` : "";
+  const groupTags = groups.length
+    ? " [" + groups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`).join(", ") + "]"
+    : "";
+
   const rule = "─".repeat(60);
-  console.log(bold(`claudemesh launch`) + dim(` — as ${name} on ${meshSlug}`));
+  console.log(bold(`claudemesh launch`) + dim(` — as ${name}${roleSuffix} on ${meshSlug}${groupTags}`));
   console.log(rule);
   console.log("Peer messages arrive as <channel> reminders in real-time.");
   console.log("Peers send text only — they cannot call tools or read files.");
@@ -174,16 +254,45 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
     mesh = await pickMesh(config.meshes);
   }
 
-  // 3. Set display name. Uses existing member identity — the broker
-  //    creates a separate presence row per session (sessionId + pid)
-  //    and stores the per-session displayName override.
+  // 3. Session identity + role/groups.
+  //    The WS client auto-generates a per-session ephemeral keypair on
+  //    connect (sent in hello as sessionPubkey). We set display name via env var.
   const displayName = args.name ?? `${hostname()}-${process.pid}`;
 
-  // 4. Write session config to tmpdir (same mesh, same keypair).
+  // Interactive wizard for role & groups (when not provided via flags and not --quiet).
+  let role: string | null = args.role;
+  let parsedGroups: GroupEntry[] = args.groups ? parseGroupsString(args.groups) : [];
+
+  if (!args.quiet) {
+    if (role === null) {
+      const answer = await askLine("  Role (optional): ");
+      if (answer) role = answer;
+    }
+    if (parsedGroups.length === 0 && args.groups === null) {
+      const answer = await askLine("  Groups (comma-separated, optional): ");
+      if (answer) parsedGroups = parseGroupsString(answer);
+    }
+    if (role || parsedGroups.length) console.log("");
+  }
+
+  // Clean up orphaned tmpdirs from crashed sessions (older than 1 hour)
+  const tmpBase = tmpdir();
+  try {
+    for (const entry of readdirSync(tmpBase)) {
+      if (!entry.startsWith("claudemesh-")) continue;
+      const full = join(tmpBase, entry);
+      const age = Date.now() - statSync(full).mtimeMs;
+      if (age > 3600_000) rmSync(full, { recursive: true, force: true });
+    }
+  } catch { /* best effort */ }
+
+  // 4. Write session config to tmpdir (isolates mesh selection).
   const tmpDir = mkdtempSync(join(tmpdir(), "claudemesh-"));
   const sessionConfig: Config = {
     version: 1,
     meshes: [mesh],
+    displayName,
+    ...(parsedGroups.length > 0 ? { groups: parsedGroups } : {}),
   };
   writeFileSync(
     join(tmpDir, "config.json"),
@@ -191,16 +300,22 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
     "utf-8",
   );
 
-  // 5. Banner.
-  if (!args.quiet) printBanner(displayName, mesh.slug);
+  // 5. Banner + permission confirmation.
+  if (!args.quiet) {
+    printBanner(displayName, mesh.slug, role, parsedGroups);
+    // Auto-permissions confirmation — needed for autonomous peer messaging.
+    if (!args.skipPermConfirm) {
+      await confirmPermissions();
+    }
+  }
 
-  // 6. Spawn claude with ephemeral config + dev channel + display name.
-  //    Strip any user-supplied --dangerously-load-development-channels
-  //    to avoid duplicates — we always inject our own.
+  // 6. Spawn claude with ephemeral config + dev channel + auto-permissions.
+  //    Strip any user-supplied --dangerously flags to avoid duplicates.
   const filtered: string[] = [];
   for (let i = 0; i < args.claudeArgs.length; i++) {
-    if (args.claudeArgs[i] === "--dangerously-load-development-channels") {
-      i++; // skip the next arg (the channel value) too
+    if (args.claudeArgs[i] === "--dangerously-load-development-channels"
+        || args.claudeArgs[i] === "--dangerously-skip-permissions") {
+      if (args.claudeArgs[i] === "--dangerously-load-development-channels") i++;
       continue;
     }
     filtered.push(args.claudeArgs[i]!);
@@ -208,6 +323,7 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
   const claudeArgs = [
     "--dangerously-load-development-channels",
     "server:claudemesh",
+    "--dangerously-skip-permissions",
     ...filtered,
   ];
 

apps/cli/src/mcp/server.ts

@@ -62,8 +62,8 @@ async function resolveClient(to: string): Promise<{
       target = rest;
     }
   }
-  // Pubkey, channel, or broadcast — pass through directly.
-  if (/^[0-9a-f]{64}$/.test(target) || target.startsWith("#") || target === "*") {
+  // Pubkey, channel, @group, or broadcast — pass through directly.
+  if (/^[0-9a-f]{64}$/.test(target) || target.startsWith("#") || target.startsWith("@") || target === "*") {
     if (targetClients.length === 1) {
       return { client: targetClients[0]!, targetSpec: target };
     }
@@ -98,6 +98,24 @@ async function resolveClient(to: string): Promise<{
   };
 }
 
+// Peer name cache to avoid calling listPeers on every incoming push
+const peerNameCache = new Map<string, string>();
+let peerNameCacheAge = 0;
+const CACHE_TTL_MS = 30_000;
+
+async function resolvePeerName(client: BrokerClient, pubkey: string): Promise<string> {
+  const now = Date.now();
+  if (now - peerNameCacheAge > CACHE_TTL_MS) {
+    peerNameCache.clear();
+    try {
+      const peers = await client.listPeers();
+      for (const p of peers) peerNameCache.set(p.pubkey, p.displayName);
+    } catch { /* best effort */ }
+    peerNameCacheAge = now;
+  }
+  return peerNameCache.get(pubkey) ?? `peer-${pubkey.slice(0, 8)}`;
+}
+
 function decryptFailedWarning(senderPubkey: string): string {
   const who = senderPubkey ? senderPubkey.slice(0, 12) + "…" : "unknown sender";
   return `⚠ message from ${who} failed to decrypt (tampered or wrong keypair)`;
@@ -111,32 +129,57 @@ function formatPush(p: InboundPush, meshSlug: string): string {
 export async function startMcpServer(): Promise<void> {
   const config = loadConfig();
 
+  const myName = config.displayName ?? "unnamed";
+  const myGroups = (config.groups ?? []).map(g => `@${g.name}${g.role ? ':' + g.role : ''}`).join(', ') || "none";
+
   const server = new Server(
-    { name: "claudemesh", version: "0.1.4" },
+    { name: "claudemesh", version: "0.3.0" },
     {
       capabilities: {
         experimental: { "claude/channel": {} },
         tools: {},
       },
-      instructions: `You are connected to claudemesh — a peer mesh for Claude Code sessions on this machine and elsewhere.
+      instructions: `## Identity
+You are "${myName}" — a peer in the claudemesh network. Your groups: ${myGroups}. You are one of several Claude Code sessions connected to the same mesh. No orchestrator exists — peers are equals. Your identity comes from your name and group roles, not from a central authority.
 
-IMPORTANT: When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATELY. Do not wait until your current task is finished. Pause what you are doing, reply to the message using send_message, then resume your work. Treat incoming peer messages like a coworker tapping you on the shoulder — answer right away, even if you're in the middle of something.
+## Responding to messages
+When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATELY. Pause your current task, reply via send_message, then resume. Read from_name, mesh_slug, and priority from the channel attributes. Reply by setting \`to\` to the sender's from_name (display name). Stay in character per your system prompt. Do not ignore low-priority messages — acknowledge them briefly even if you defer action.
 
-Read the from_id, from_name, mesh_slug, and priority attributes to understand context. Reply by calling send_message with the same target (for direct messages the from_id is the sender's pubkey).
+## Tools
+| Tool | Description |
+|------|-------------|
+| send_message(to, message, priority?) | Send to peer name, @group, or * broadcast. \`to\` accepts display name, pubkey hex, @groupname, or *. |
+| list_peers(mesh_slug?) | List connected peers with status, summary, groups, and roles. |
+| check_messages() | Drain buffered inbound messages (auto-pushed in most cases, use as fallback). |
+| set_summary(summary) | Set 1-2 sentence description of your current work, visible to all peers. |
+| set_status(status) | Override status: idle, working, or dnd. |
+| join_group(name, role?) | Join a @group with optional role (lead, member, observer, or any string). |
+| leave_group(name) | Leave a @group. |
+| set_state(key, value) | Write shared state; pushes change to all peers. |
+| get_state(key) | Read a shared state value. |
+| list_state() | List all state keys with values, authors, and timestamps. |
+| remember(content, tags?) | Store persistent knowledge with optional tags. |
+| recall(query) | Full-text search over mesh memory. |
+| forget(id) | Soft-delete a memory entry. |
 
-Available tools:
-- list_peers: see joined meshes + their connection status
-- send_message: send to a peer by display name, pubkey, #channel, or * broadcast (priority: now/next/low)
-- check_messages: drain buffered inbound messages (usually auto-pushed)
-- set_summary: 1-2 sentence summary of what you're working on
-- set_status: manually override your status (idle/working/dnd)
+If multiple meshes are joined, prefix \`to\` with \`<mesh-slug>:\` to disambiguate (e.g. \`dev-team:Alice\`).
 
-Message priority:
-- "now": delivered immediately regardless of recipient status (use sparingly)
-- "next" (default): delivered when recipient is idle
-- "low": pull-only (check_messages)
+## Groups
+Groups are routing labels. Send to @groupname to multicast to all members. Roles are metadata that peers interpret: a "lead" gathers input before synthesizing a response, a "member" contributes when asked, an "observer" watches silently. Join and leave groups dynamically with join_group/leave_group. Check list_peers to see who belongs to which groups and their roles.
 
-If you have multiple joined meshes, prefix the \`to\` argument of send_message with \`<mesh-slug>:\` to disambiguate. Otherwise claudemesh picks the single joined mesh.`,
+## State
+Shared key-value store scoped to the mesh. Use get_state/set_state for live coordination facts (deploy frozen? current sprint? PR queue). set_state pushes the change to all connected peers. Read state before asking peers questions — the answer may already be there. State is operational, not archival.
+
+## Memory
+Persistent knowledge that survives across sessions. Use remember(content, tags?) to store lessons, decisions, and incidents. Use recall(query) to search before asking peers. New peers should recall at session start to load institutional knowledge.
+
+## Priority
+- "now": interrupt immediately, even if recipient is in DND (use for urgent: broken deploy, blocking issue)
+- "next" (default): deliver when recipient goes idle (normal coordination)
+- "low": pull-only via check_messages (FYI, non-blocking context)
+
+## Coordination
+Call list_peers at session start to understand who is online, their roles, and what they are working on. If you are a group lead, gather input from members before responding to external requests — do not answer alone. If you are a member, contribute to your lead when asked. Use @group messages for team-wide questions, direct messages for 1:1 coordination. Set a meaningful summary so peers know your current focus.`,
     },
   );
 
@@ -197,7 +240,8 @@ If you have multiple joined meshes, prefix the \`to\` argument of send_message w
           } else {
             const peerLines = peers.map((p) => {
               const summary = p.summary ? ` — "${p.summary}"` : "";
-              return `- **${p.displayName}** [${p.status}] (${p.pubkey.slice(0, 12)}…)${summary}`;
+              const groupsStr = p.groups?.length ? ` [${p.groups.map(g => `@${g.name}${g.role ? ':' + g.role : ''}`).join(', ')}]` : "";
+              return `- **${p.displayName}** [${p.status}]${groupsStr} (${p.pubkey.slice(0, 12)}…)${summary}`;
             });
             sections.push(`${header}\n${peerLines.join("\n")}`);
           }
@@ -205,6 +249,24 @@ If you have multiple joined meshes, prefix the \`to\` argument of send_message w
         return text(sections.join("\n\n"));
       }
 
+      case "message_status": {
+        const { id } = (args ?? {}) as { id?: string };
+        if (!id) return text("message_status: `id` required", true);
+        const client = allClients()[0];
+        if (!client) return text("message_status: not connected", true);
+        const result = await client.messageStatus(id);
+        if (!result) return text(`Message ${id} not found or timed out.`);
+        const recipientLines = result.recipients.map(
+          (r: { name: string; pubkey: string; status: string }) =>
+            `  - ${r.name} (${r.pubkey.slice(0, 12)}…): ${r.status}`,
+        );
+        return text(
+          `Message ${id.slice(0, 12)}… → ${result.targetSpec}\n` +
+          `Delivered: ${result.delivered}${result.deliveredAt ? ` at ${result.deliveredAt}` : ""}\n` +
+          `Recipients:\n${recipientLines.join("\n")}`,
+        );
+      }
+
       case "check_messages": {
         const drained: string[] = [];
         for (const c of allClients()) {
@@ -234,6 +296,73 @@ If you have multiple joined meshes, prefix the \`to\` argument of send_message w
         return text(`Status set to ${s} across ${allClients().length} mesh(es).`);
       }
 
+      case "join_group": {
+        const { name: groupName, role } = (args ?? {}) as { name?: string; role?: string };
+        if (!groupName) return text("join_group: `name` required", true);
+        for (const c of allClients()) await c.joinGroup(groupName, role);
+        return text(`Joined @${groupName}${role ? ` as ${role}` : ""}`);
+      }
+
+      case "leave_group": {
+        const { name: groupName } = (args ?? {}) as { name?: string };
+        if (!groupName) return text("leave_group: `name` required", true);
+        for (const c of allClients()) await c.leaveGroup(groupName);
+        return text(`Left @${groupName}`);
+      }
+
+      // --- State ---
+      case "set_state": {
+        const { key, value } = (args ?? {}) as { key?: string; value?: unknown };
+        if (!key) return text("set_state: `key` required", true);
+        for (const c of allClients()) await c.setState(key, value);
+        return text(`State set: ${key} = ${JSON.stringify(value)}`);
+      }
+      case "get_state": {
+        const { key } = (args ?? {}) as { key?: string };
+        if (!key) return text("get_state: `key` required", true);
+        const client = allClients()[0];
+        if (!client) return text("get_state: not connected", true);
+        const result = await client.getState(key);
+        if (!result) return text(`State "${key}" not found.`);
+        return text(`${key} = ${JSON.stringify(result.value)} (set by ${result.updatedBy} at ${result.updatedAt})`);
+      }
+      case "list_state": {
+        const client = allClients()[0];
+        if (!client) return text("list_state: not connected", true);
+        const entries = await client.listState();
+        if (entries.length === 0) return text("No shared state set.");
+        const lines = entries.map(e => `- **${e.key}** = ${JSON.stringify(e.value)} (by ${e.updatedBy})`);
+        return text(lines.join("\n"));
+      }
+
+      // --- Memory ---
+      case "remember": {
+        const { content, tags } = (args ?? {}) as { content?: string; tags?: string[] };
+        if (!content) return text("remember: `content` required", true);
+        const client = allClients()[0];
+        if (!client) return text("remember: not connected", true);
+        const id = await client.remember(content, tags);
+        return text(`Remembered${id ? ` (${id})` : ""}: "${content.slice(0, 80)}${content.length > 80 ? '...' : ''}"`);
+      }
+      case "recall": {
+        const { query } = (args ?? {}) as { query?: string };
+        if (!query) return text("recall: `query` required", true);
+        const client = allClients()[0];
+        if (!client) return text("recall: not connected", true);
+        const memories = await client.recall(query);
+        if (memories.length === 0) return text(`No memories found for "${query}".`);
+        const lines = memories.map(m => `- [${m.id.slice(0, 8)}] ${m.content} (by ${m.rememberedBy}, ${m.rememberedAt})`);
+        return text(`${memories.length} memor${memories.length === 1 ? 'y' : 'ies'}:\n${lines.join("\n")}`);
+      }
+      case "forget": {
+        const { id } = (args ?? {}) as { id?: string };
+        if (!id) return text("forget: `id` required", true);
+        const client = allClients()[0];
+        if (!client) return text("forget: not connected", true);
+        await client.forget(id);
+        return text(`Forgotten: ${id}`);
+      }
+
       default:
         return text(`Unknown tool: ${name}`, true);
     }
@@ -251,8 +380,9 @@ If you have multiple joined meshes, prefix the \`to\` argument of send_message w
   for (const client of allClients()) {
     client.onPush(async (msg) => {
       const fromPubkey = msg.senderPubkey || "";
+      // Resolve sender's display name from the cached peer list.
       const fromName = fromPubkey
-        ? `peer-${fromPubkey.slice(0, 8)}`
+        ? await resolvePeerName(client, fromPubkey)
         : "unknown";
       const content = msg.plaintext ?? decryptFailedWarning(fromPubkey);
       try {
@@ -276,6 +406,22 @@ If you have multiple joined meshes, prefix the \`to\` argument of send_message w
         /* channel push is best-effort; check_messages is the fallback */
       }
     });
+
+    client.onStateChange(async (change) => {
+      try {
+        await server.notification({
+          method: "notifications/claude/channel",
+          params: {
+            content: `[state] ${change.key} = ${JSON.stringify(change.value)} (set by ${change.updatedBy})`,
+            meta: {
+              kind: "state_change",
+              key: change.key,
+              updated_by: change.updatedBy,
+            },
+          },
+        });
+      } catch { /* best effort */ }
+    });
   }
 
   const shutdown = (): void => {

apps/cli/src/mcp/tools.ts

@@ -12,13 +12,13 @@ export const TOOLS: Tool[] = [
   {
     name: "send_message",
     description:
-      "Send a message to a peer in one of your joined meshes. `to` can be a peer display name (resolved via list_peers), hex pubkey, `#channel`, or `*` for broadcast. `priority` controls delivery: `now` bypasses busy gates, `next` waits for idle (default), `low` is pull-only.",
+      "Send a message to a peer in one of your joined meshes. `to` can be a peer display name (resolved via list_peers), hex pubkey, @group, `#channel`, or `*` for broadcast. `priority` controls delivery: `now` bypasses busy gates, `next` waits for idle (default), `low` is pull-only.",
     inputSchema: {
       type: "object",
       properties: {
         to: {
           type: "string",
-          description: "Peer name, pubkey, or #channel",
+          description: "Peer name, pubkey, @group, or #channel",
         },
         message: { type: "string", description: "Message text" },
         priority: {
@@ -44,6 +44,21 @@ export const TOOLS: Tool[] = [
       },
     },
   },
+  {
+    name: "message_status",
+    description:
+      "Check the delivery status of a sent message. Shows whether each recipient received it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: {
+          type: "string",
+          description: "Message ID (returned by send_message)",
+        },
+      },
+      required: ["id"],
+    },
+  },
   {
     name: "check_messages",
     description:
@@ -78,4 +93,106 @@ export const TOOLS: Tool[] = [
       required: ["status"],
     },
   },
+  {
+    name: "join_group",
+    description:
+      "Join a group with an optional role. Other peers see your group membership in list_peers.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Group name (without @)" },
+        role: {
+          type: "string",
+          description: "Your role in the group (e.g. lead, member, observer)",
+        },
+      },
+      required: ["name"],
+    },
+  },
+  {
+    name: "leave_group",
+    description: "Leave a group.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Group name (without @)" },
+      },
+      required: ["name"],
+    },
+  },
+
+  // --- State tools ---
+  {
+    name: "set_state",
+    description:
+      "Set a shared state value visible to all peers in the mesh. Pushes a change notification.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string" },
+        value: { description: "Any JSON value" },
+      },
+      required: ["key", "value"],
+    },
+  },
+  {
+    name: "get_state",
+    description: "Read a shared state value.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        key: { type: "string" },
+      },
+      required: ["key"],
+    },
+  },
+  {
+    name: "list_state",
+    description: "List all shared state keys and values in the mesh.",
+    inputSchema: { type: "object", properties: {} },
+  },
+
+  // --- Memory tools ---
+  {
+    name: "remember",
+    description:
+      "Store persistent knowledge in the mesh's shared memory. Survives across sessions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        content: {
+          type: "string",
+          description: "The knowledge to remember",
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Optional categorization tags",
+        },
+      },
+      required: ["content"],
+    },
+  },
+  {
+    name: "recall",
+    description: "Search the mesh's shared memory by relevance.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Search query" },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "forget",
+    description: "Remove a memory from the mesh's shared knowledge.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Memory ID to forget" },
+      },
+      required: ["id"],
+    },
+  },
 ];

apps/cli/src/state/config.ts

@@ -28,9 +28,16 @@ export interface JoinedMesh {
   joinedAt: string;
 }
 
+export interface GroupEntry {
+  name: string;
+  role?: string;
+}
+
 export interface Config {
   version: 1;
   meshes: JoinedMesh[];
+  displayName?: string; // per-session override, written by `claudemesh launch --name`
+  groups?: GroupEntry[];
 }
 
 const CONFIG_DIR = env.CLAUDEMESH_CONFIG_DIR ?? join(homedir(), ".claudemesh");
@@ -46,7 +53,7 @@ export function loadConfig(): Config {
     if (!parsed || !Array.isArray(parsed.meshes)) {
       return { version: 1, meshes: [] };
     }
-    return { version: 1, meshes: parsed.meshes };
+    return { version: 1, meshes: parsed.meshes, displayName: parsed.displayName, groups: parsed.groups };
   } catch (e) {
     throw new Error(
       `Failed to load ${CONFIG_PATH}: ${e instanceof Error ? e.message : String(e)}`,

apps/cli/src/ws/client.ts

@@ -21,6 +21,7 @@ import {
   isDirectTarget,
 } from "../crypto/envelope";
 import { signHello } from "../crypto/hello-sig";
+import { generateKeypair } from "../crypto/keypair";
 
 export type Priority = "now" | "next" | "low";
 export type ConnStatus = "connecting" | "open" | "closed" | "reconnecting";
@@ -30,6 +31,7 @@ export interface PeerInfo {
   displayName: string;
   status: string;
   summary: string | null;
+  groups: Array<{ name: string; role?: string }>;
   sessionId: string;
   connectedAt: string;
 }
@@ -74,6 +76,13 @@ export class BrokerClient {
   private pushHandlers = new Set<PushHandler>();
   private pushBuffer: InboundPush[] = [];
   private listPeersResolvers: Array<(peers: PeerInfo[]) => void> = [];
+  private stateResolvers: Array<(result: { key: string; value: unknown; updatedBy: string; updatedAt: string } | null) => void> = [];
+  private stateListResolvers: Array<(entries: Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>) => void> = [];
+  private memoryStoreResolvers: Array<(id: string | null) => void> = [];
+  private memoryRecallResolvers: Array<(memories: Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>) => void> = [];
+  private stateChangeHandlers = new Set<(change: { key: string; value: unknown; updatedBy: string }) => void>();
+  private sessionPubkey: string | null = null;
+  private sessionSecretKey: string | null = null;
   private closed = false;
   private reconnectAttempt = 0;
   private helloTimer: NodeJS.Timeout | null = null;
@@ -83,6 +92,7 @@ export class BrokerClient {
     private mesh: JoinedMesh,
     private opts: {
       onStatusChange?: (status: ConnStatus) => void;
+      displayName?: string;
       debug?: boolean;
     } = {},
   ) {}
@@ -109,8 +119,15 @@ export class BrokerClient {
 
     return new Promise<void>((resolve, reject) => {
       const onOpen = async (): Promise<void> => {
-        this.debug("ws open → signing + sending hello");
+        this.debug("ws open → generating session keypair + signing hello");
         try {
+          // Only generate session keypair on first connect, not reconnects
+          if (!this.sessionPubkey) {
+            const sessionKP = await generateKeypair();
+            this.sessionPubkey = sessionKP.publicKey;
+            this.sessionSecretKey = sessionKP.secretKey;
+          }
+
           const { timestamp, signature } = await signHello(
             this.mesh.meshId,
             this.mesh.memberId,
@@ -123,7 +140,8 @@ export class BrokerClient {
               meshId: this.mesh.meshId,
               memberId: this.mesh.memberId,
               pubkey: this.mesh.pubkey,
-              displayName: process.env.CLAUDEMESH_DISPLAY_NAME || undefined,
+              sessionPubkey: this.sessionPubkey,
+              displayName: process.env.CLAUDEMESH_DISPLAY_NAME || this.opts.displayName || undefined,
               sessionId: `${process.pid}-${Date.now()}`,
               pid: process.pid,
               cwd: process.cwd(),
@@ -203,7 +221,7 @@ export class BrokerClient {
       const env = await encryptDirect(
         message,
         targetSpec,
-        this.mesh.secretKey,
+        this.sessionSecretKey ?? this.mesh.secretKey,
       );
       nonce = env.nonce;
       ciphertext = env.ciphertext;
@@ -300,6 +318,119 @@ export class BrokerClient {
     this.ws.send(JSON.stringify({ type: "set_summary", summary }));
   }
 
+  /** Join a group with an optional role. */
+  async joinGroup(name: string, role?: string): Promise<void> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "join_group", name, role }));
+  }
+
+  /** Leave a group. */
+  async leaveGroup(name: string): Promise<void> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "leave_group", name }));
+  }
+
+  // --- State ---
+
+  /** Set a shared state value visible to all peers in the mesh. */
+  async setState(key: string, value: unknown): Promise<void> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "set_state", key, value }));
+  }
+
+  /** Read a shared state value. */
+  async getState(key: string): Promise<{ key: string; value: unknown; updatedBy: string; updatedAt: string } | null> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
+    return new Promise((resolve) => {
+      this.stateResolvers.push(resolve);
+      this.ws!.send(JSON.stringify({ type: "get_state", key }));
+      setTimeout(() => {
+        const idx = this.stateResolvers.indexOf(resolve);
+        if (idx !== -1) {
+          this.stateResolvers.splice(idx, 1);
+          resolve(null);
+        }
+      }, 5_000);
+    });
+  }
+
+  /** List all shared state keys and values. */
+  async listState(): Promise<Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
+    return new Promise((resolve) => {
+      this.stateListResolvers.push(resolve);
+      this.ws!.send(JSON.stringify({ type: "list_state" }));
+      setTimeout(() => {
+        const idx = this.stateListResolvers.indexOf(resolve);
+        if (idx !== -1) {
+          this.stateListResolvers.splice(idx, 1);
+          resolve([]);
+        }
+      }, 5_000);
+    });
+  }
+
+  // --- Memory ---
+
+  /** Store persistent knowledge in the mesh's shared memory. */
+  async remember(content: string, tags?: string[]): Promise<string | null> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
+    return new Promise((resolve) => {
+      this.memoryStoreResolvers.push(resolve);
+      this.ws!.send(JSON.stringify({ type: "remember", content, tags }));
+      setTimeout(() => {
+        const idx = this.memoryStoreResolvers.indexOf(resolve);
+        if (idx !== -1) {
+          this.memoryStoreResolvers.splice(idx, 1);
+          resolve(null);
+        }
+      }, 5_000);
+    });
+  }
+
+  /** Search the mesh's shared memory by relevance. */
+  async recall(query: string): Promise<Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
+    return new Promise((resolve) => {
+      this.memoryRecallResolvers.push(resolve);
+      this.ws!.send(JSON.stringify({ type: "recall", query }));
+      setTimeout(() => {
+        const idx = this.memoryRecallResolvers.indexOf(resolve);
+        if (idx !== -1) {
+          this.memoryRecallResolvers.splice(idx, 1);
+          resolve([]);
+        }
+      }, 5_000);
+    });
+  }
+
+  /** Remove a memory from the mesh's shared knowledge. */
+  async forget(memoryId: string): Promise<void> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify({ type: "forget", memoryId }));
+  }
+
+  /** Check delivery status of a sent message. */
+  private messageStatusResolvers: Array<(result: { messageId: string; targetSpec: string; delivered: boolean; deliveredAt: string | null; recipients: Array<{ name: string; pubkey: string; status: string }> } | null) => void> = [];
+
+  async messageStatus(messageId: string): Promise<{ messageId: string; targetSpec: string; delivered: boolean; deliveredAt: string | null; recipients: Array<{ name: string; pubkey: string; status: string }> } | null> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
+    return new Promise((resolve) => {
+      this.messageStatusResolvers.push(resolve);
+      this.ws!.send(JSON.stringify({ type: "message_status", messageId }));
+      setTimeout(() => {
+        const idx = this.messageStatusResolvers.indexOf(resolve);
+        if (idx !== -1) { this.messageStatusResolvers.splice(idx, 1); resolve(null); }
+      }, 5_000);
+    });
+  }
+
+  /** Subscribe to state change notifications. Returns an unsubscribe function. */
+  onStateChange(handler: (change: { key: string; value: unknown; updatedBy: string }) => void): () => void {
+    this.stateChangeHandlers.add(handler);
+    return () => this.stateChangeHandlers.delete(handler);
+  }
+
   close(): void {
     this.closed = true;
     if (this.helloTimer) clearTimeout(this.helloTimer);
@@ -349,7 +480,7 @@ export class BrokerClient {
           plaintext = await decryptDirect(
             { nonce, ciphertext },
             senderPubkey,
-            this.mesh.secretKey,
+            this.sessionSecretKey ?? this.mesh.secretKey,
           );
         }
         // Legacy/broadcast path: no senderPubkey means the message
@@ -366,6 +497,19 @@ export class BrokerClient {
             plaintext = null;
           }
         }
+        // Fallback: if direct decrypt failed, try plaintext base64 decode.
+        // This handles broadcasts and key mismatches gracefully.
+        if (plaintext === null && ciphertext) {
+          try {
+            const decoded = Buffer.from(ciphertext, "base64").toString("utf-8");
+            // Sanity check: valid UTF-8 text (not binary garbage)
+            if (/^[\x20-\x7E\s\u00A0-\uFFFF]*$/.test(decoded) && decoded.length > 0) {
+              plaintext = decoded;
+            }
+          } catch {
+            plaintext = null;
+          }
+        }
         const push: InboundPush = {
           messageId: String(msg.messageId ?? ""),
           meshId: String(msg.meshId ?? ""),
@@ -390,6 +534,55 @@ export class BrokerClient {
       })();
       return;
     }
+    if (msg.type === "state_result") {
+      const resolver = this.stateResolvers.shift();
+      if (resolver) {
+        if (msg.key) {
+          resolver({
+            key: String(msg.key),
+            value: msg.value,
+            updatedBy: String(msg.updatedBy ?? ""),
+            updatedAt: String(msg.updatedAt ?? ""),
+          });
+        } else {
+          resolver(null);
+        }
+      }
+      return;
+    }
+    if (msg.type === "state_list") {
+      const entries = (msg.entries as Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>) ?? [];
+      const resolver = this.stateListResolvers.shift();
+      if (resolver) resolver(entries);
+      return;
+    }
+    if (msg.type === "state_change") {
+      const change = {
+        key: String(msg.key ?? ""),
+        value: msg.value,
+        updatedBy: String(msg.updatedBy ?? ""),
+      };
+      for (const h of this.stateChangeHandlers) {
+        try { h(change); } catch { /* handler errors are not the transport's problem */ }
+      }
+      return;
+    }
+    if (msg.type === "memory_stored") {
+      const resolver = this.memoryStoreResolvers.shift();
+      if (resolver) resolver(msg.id ? String(msg.id) : null);
+      return;
+    }
+    if (msg.type === "memory_results") {
+      const memories = (msg.memories as Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>) ?? [];
+      const resolver = this.memoryRecallResolvers.shift();
+      if (resolver) resolver(memories);
+      return;
+    }
+    if (msg.type === "message_status_result") {
+      const resolver = this.messageStatusResolvers.shift();
+      if (resolver) resolver(msg as any);
+      return;
+    }
     if (msg.type === "error") {
       this.debug(`broker error: ${msg.code} ${msg.message}`);
       const id = msg.id ? String(msg.id) : null;

apps/cli/src/ws/manager.ts

@@ -11,12 +11,13 @@ import type { Config, JoinedMesh } from "../state/config";
 import { env } from "../env";
 
 const clients = new Map<string, BrokerClient>();
+let configDisplayName: string | undefined;
 
 /** Ensure a BrokerClient exists + is connecting/open for this mesh. */
 export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
   const existing = clients.get(mesh.meshId);
   if (existing) return existing;
-  const client = new BrokerClient(mesh, { debug: env.CLAUDEMESH_DEBUG });
+  const client = new BrokerClient(mesh, { debug: env.CLAUDEMESH_DEBUG, displayName: configDisplayName });
   clients.set(mesh.meshId, client);
   try {
     await client.connect();
@@ -29,6 +30,7 @@ export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
 
 /** Start clients for every joined mesh. Called once on MCP server start. */
 export async function startClients(config: Config): Promise<void> {
+  configDisplayName = config.displayName;
   await Promise.allSettled(config.meshes.map(ensureClient));
 }
 

packages/db/migrations/0005_add-presence-session-pubkey.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."presence" ADD COLUMN "session_pubkey" text;

packages/db/migrations/0006_add-sender-session-pubkey.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."message_queue" ADD COLUMN "sender_session_pubkey" text;

packages/db/migrations/0007_add-presence-groups.sql

@@ -0,0 +1 @@
+ALTER TABLE "mesh"."presence" ADD COLUMN "groups" jsonb DEFAULT '[]'::jsonb;

packages/db/migrations/0008_add-state-and-memory.sql

@@ -0,0 +1,27 @@
+CREATE TABLE "mesh"."memory" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"content" text NOT NULL,
+	"tags" text[] DEFAULT '{}',
+	"remembered_by" text,
+	"remembered_by_name" text,
+	"remembered_at" timestamp DEFAULT now() NOT NULL,
+	"forgotten_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "mesh"."state" (
+	"id" text PRIMARY KEY NOT NULL,
+	"mesh_id" text NOT NULL,
+	"key" text NOT NULL,
+	"value" jsonb NOT NULL,
+	"updated_by_presence" text,
+	"updated_by_name" text,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD CONSTRAINT "memory_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD CONSTRAINT "memory_remembered_by_member_id_fk" FOREIGN KEY ("remembered_by") REFERENCES "mesh"."member"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mesh"."state" ADD CONSTRAINT "state_mesh_id_mesh_id_fk" FOREIGN KEY ("mesh_id") REFERENCES "mesh"."mesh"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+CREATE UNIQUE INDEX "state_mesh_key_idx" ON "mesh"."state" USING btree ("mesh_id","key");--> statement-breakpoint
+ALTER TABLE "mesh"."memory" ADD COLUMN IF NOT EXISTS "search_vector" tsvector GENERATED ALWAYS AS (to_tsvector('english', content)) STORED;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "memory_search_idx" ON "mesh"."memory" USING gin("search_vector");

packages/db/migrations/meta/_journal.json

@@ -29,6 +29,41 @@
       "when": 1775463897329,
       "tag": "0003_add-presence-summary",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1775468683383,
+      "tag": "0004_add-presence-display-name",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1775470435032,
+      "tag": "0005_add-presence-session-pubkey",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1775470979207,
+      "tag": "0006_add-sender-session-pubkey",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1775476994511,
+      "tag": "0007_add-presence-groups",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1775477883426,
+      "tag": "0008_add-state-and-memory",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/mesh.ts

@@ -5,6 +5,7 @@ import {
   pgSchema,
   timestamp,
   text,
+  uniqueIndex,
 } from "drizzle-orm/pg-core";
 
 import { generateId } from "@turbostarter/shared/utils";
@@ -192,6 +193,7 @@ export const presence = meshSchema.table("presence", {
     .references(() => meshMember.id, { onDelete: "cascade", onUpdate: "cascade" })
     .notNull(),
   sessionId: text().notNull(),
+  sessionPubkey: text(),
   displayName: text(),
   pid: integer().notNull(),
   cwd: text().notNull(),
@@ -199,6 +201,7 @@ export const presence = meshSchema.table("presence", {
   statusSource: presenceStatusSourceEnum().notNull().default("jsonl"),
   statusUpdatedAt: timestamp().defaultNow().notNull(),
   summary: text(),
+  groups: jsonb().$type<Array<{ name: string; role?: string }>>().default([]),
   connectedAt: timestamp().defaultNow().notNull(),
   lastPingAt: timestamp().defaultNow().notNull(),
   disconnectedAt: timestamp(),
@@ -221,6 +224,7 @@ export const messageQueue = meshSchema.table("message_queue", {
   senderMemberId: text()
     .references(() => meshMember.id, { onDelete: "cascade", onUpdate: "cascade" })
     .notNull(),
+  senderSessionPubkey: text(),
   targetSpec: text().notNull(),
   priority: messagePriorityEnum().notNull().default("next"),
   nonce: text().notNull(),
@@ -248,6 +252,43 @@ export const pendingStatus = meshSchema.table("pending_status", {
   appliedAt: timestamp(),
 });
 
+/**
+ * Shared key-value state scoped to a mesh. Any peer can read/write.
+ * Changes push to all connected peers in real time.
+ */
+export const meshState = meshSchema.table(
+  "state",
+  {
+    id: text().primaryKey().notNull().$defaultFn(generateId),
+    meshId: text()
+      .references(() => mesh.id, { onDelete: "cascade", onUpdate: "cascade" })
+      .notNull(),
+    key: text().notNull(),
+    value: jsonb().notNull(),
+    updatedByPresence: text(),
+    updatedByName: text(),
+    updatedAt: timestamp().defaultNow().notNull(),
+  },
+  (table) => [uniqueIndex("state_mesh_key_idx").on(table.meshId, table.key)],
+);
+
+/**
+ * Persistent shared memory for a mesh. Full-text searchable via a
+ * tsvector generated column + GIN index added in raw SQL migration.
+ */
+export const meshMemory = meshSchema.table("memory", {
+  id: text().primaryKey().notNull().$defaultFn(generateId),
+  meshId: text()
+    .references(() => mesh.id, { onDelete: "cascade", onUpdate: "cascade" })
+    .notNull(),
+  content: text().notNull(),
+  tags: text().array().default([]),
+  rememberedBy: text().references(() => meshMember.id),
+  rememberedByName: text(),
+  rememberedAt: timestamp().defaultNow().notNull(),
+  forgottenAt: timestamp(),
+});
+
 export const meshRelations = relations(mesh, ({ one, many }) => ({
   owner: one(user, {
     fields: [mesh.ownerUserId],
@@ -308,6 +349,24 @@ export const auditLogRelations = relations(auditLog, ({ one }) => ({
   }),
 }));
 
+export const meshStateRelations = relations(meshState, ({ one }) => ({
+  mesh: one(mesh, {
+    fields: [meshState.meshId],
+    references: [mesh.id],
+  }),
+}));
+
+export const meshMemoryRelations = relations(meshMemory, ({ one }) => ({
+  mesh: one(mesh, {
+    fields: [meshMemory.meshId],
+    references: [mesh.id],
+  }),
+  member: one(meshMember, {
+    fields: [meshMemory.rememberedBy],
+    references: [meshMember.id],
+  }),
+}));
+
 export const selectMeshSchema = createSelectSchema(mesh);
 export const insertMeshSchema = createInsertSchema(mesh);
 export const selectMemberSchema = createSelectSchema(meshMember);
@@ -337,3 +396,11 @@ export type SelectMessageQueue = typeof messageQueue.$inferSelect;
 export type InsertMessageQueue = typeof messageQueue.$inferInsert;
 export type SelectPendingStatus = typeof pendingStatus.$inferSelect;
 export type InsertPendingStatus = typeof pendingStatus.$inferInsert;
+export const selectMeshStateSchema = createSelectSchema(meshState);
+export const insertMeshStateSchema = createInsertSchema(meshState);
+export const selectMeshMemorySchema = createSelectSchema(meshMemory);
+export const insertMeshMemorySchema = createInsertSchema(meshMemory);
+export type SelectMeshState = typeof meshState.$inferSelect;
+export type InsertMeshState = typeof meshState.$inferInsert;
+export type SelectMeshMemory = typeof meshMemory.$inferSelect;
+export type InsertMeshMemory = typeof meshMemory.$inferInsert;