feat(web): update landing page copy for full feature surface, add getting started + mesh vs MCP

Landing page copy was stuck at the v0.1 feature set (messaging + state + memory + groups).
The CLI now ships 43 MCP tools across 5 persistence backends. This commit brings the site
copy in sync with what's actually built.

Changes:
- Hero, features, pricing, FAQ, CTA, footer: reflect 43 tools, files, SQL, vectors, graphs
- Features section: expanded from 4 tabs to 7 (added Files, Database, Vectors)
- New /getting-started page: full install guide with correct 4-step flow
- New Mesh vs MCP section: side-by-side diagrams + 8-row comparison table
- Fix: install-toggle on /join page had `npx claudemesh@latest init` (init doesn't exist)
  → replaced with `curl -fsSL https://claudemesh.com/install | bash`
- Navigation: added Getting Started to header, footer, hero link
- COPY.md synced with all 6 capability areas

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/broker/src/broker.ts

@@ -34,6 +34,7 @@ import {
   mesh,
   meshFile,
   meshFileAccess,
+  meshFileKey,
   meshContext,
   meshMember as memberTable,
   meshMemory,
@@ -717,6 +718,8 @@ export async function uploadFile(args: {
   uploadedByMember?: string;
   targetSpec?: string;
   expiresAt?: Date;
+  encrypted?: boolean;
+  ownerPubkey?: string;
 }): Promise<string> {
   const [row] = await db
     .insert(meshFile)
@@ -732,6 +735,8 @@ export async function uploadFile(args: {
       uploadedByMember: args.uploadedByMember ?? null,
       targetSpec: args.targetSpec ?? null,
       expiresAt: args.expiresAt ?? null,
+      encrypted: args.encrypted ?? false,
+      ownerPubkey: args.ownerPubkey ?? null,
     })
     .returning({ id: meshFile.id });
   if (!row) throw new Error("failed to insert file row");
@@ -755,6 +760,8 @@ export async function getFile(
   uploadedByName: string | null;
   targetSpec: string | null;
   uploadedAt: Date;
+  encrypted: boolean;
+  ownerPubkey: string | null;
 } | null> {
   const [row] = await db
     .select({
@@ -768,6 +775,8 @@ export async function getFile(
       uploadedByName: meshFile.uploadedByName,
       targetSpec: meshFile.targetSpec,
       uploadedAt: meshFile.uploadedAt,
+      encrypted: meshFile.encrypted,
+      ownerPubkey: meshFile.ownerPubkey,
     })
     .from(meshFile)
     .where(
@@ -782,6 +791,8 @@ export async function getFile(
   return {
     ...row,
     tags: (row.tags ?? []) as string[],
+    encrypted: row.encrypted,
+    ownerPubkey: row.ownerPubkey,
   };
 }
 
@@ -801,6 +812,7 @@ export async function listFiles(
     uploadedBy: string;
     uploadedAt: Date;
     persistent: boolean;
+    encrypted: boolean;
   }>
 > {
   const conditions = [
@@ -822,6 +834,7 @@ export async function listFiles(
       uploadedByName: meshFile.uploadedByName,
       uploadedAt: meshFile.uploadedAt,
       persistent: meshFile.persistent,
+      encrypted: meshFile.encrypted,
     })
     .from(meshFile)
     .where(and(...conditions))
@@ -835,6 +848,7 @@ export async function listFiles(
     uploadedBy: r.uploadedByName ?? "unknown",
     uploadedAt: r.uploadedAt,
     persistent: r.persistent,
+    encrypted: r.encrypted,
   }));
 }
 
@@ -892,11 +906,62 @@ export async function deleteFile(
     );
 }
 
+/** Insert encrypted key blobs for a newly uploaded E2E file. */
+export async function insertFileKeys(
+  fileId: string,
+  keys: Array<{ peerPubkey: string; sealedKey: string; grantedByPubkey?: string }>,
+): Promise<void> {
+  if (keys.length === 0) return;
+  await db.insert(meshFileKey).values(
+    keys.map((k) => ({
+      fileId,
+      peerPubkey: k.peerPubkey,
+      sealedKey: k.sealedKey,
+      grantedByPubkey: k.grantedByPubkey ?? null,
+    })),
+  );
+}
+
+/** Get the sealed key for a specific peer, or null if not authorized. */
+export async function getFileKey(
+  fileId: string,
+  peerPubkey: string,
+): Promise<string | null> {
+  const [row] = await db
+    .select({ sealedKey: meshFileKey.sealedKey })
+    .from(meshFileKey)
+    .where(
+      and(eq(meshFileKey.fileId, fileId), eq(meshFileKey.peerPubkey, peerPubkey)),
+    );
+  return row?.sealedKey ?? null;
+}
+
+/** Grant a peer access to an encrypted file (upsert their key blob). */
+export async function grantFileKey(
+  fileId: string,
+  peerPubkey: string,
+  sealedKey: string,
+  grantedByPubkey: string,
+): Promise<void> {
+  await db
+    .insert(meshFileKey)
+    .values({ fileId, peerPubkey, sealedKey, grantedByPubkey })
+    .onConflictDoUpdate({
+      target: [meshFileKey.fileId, meshFileKey.peerPubkey],
+      set: { sealedKey, grantedByPubkey, grantedAt: new Date() },
+    });
+}
+
 // --- Context sharing ---
 
 /**
- * Upsert a context snapshot for a peer. Each (meshId, presenceId) pair
+ * Upsert a context snapshot for a peer. When `memberId` is provided the
- * has at most one context row — repeated calls update it in place.
+ * row is keyed on (meshId, memberId) — a stable identifier that survives
+ * reconnects. This prevents stale rows from accumulating every time a
+ * session reconnects with a fresh ephemeral presenceId.
+ *
+ * Falls back to (meshId, presenceId) lookup when memberId is absent
+ * (e.g. legacy callers or anonymous connections).
  */
 export async function shareContext(
   meshId: string,
@@ -906,24 +971,27 @@ export async function shareContext(
   filesRead?: string[],
   keyFindings?: string[],
   tags?: string[],
+  memberId?: string,
 ): Promise<string> {
   const now = new Date();
-  // Try to find existing context for this presence in this mesh.
+
+  // Build the WHERE clause: prefer stable memberId, fall back to presenceId.
+  const lookupWhere = memberId
+    ? and(eq(meshContext.meshId, meshId), eq(meshContext.memberId, memberId))
+    : and(eq(meshContext.meshId, meshId), eq(meshContext.presenceId, presenceId));
+
   const [existing] = await db
     .select({ id: meshContext.id })
     .from(meshContext)
-    .where(
+    .where(lookupWhere)
-      and(
-        eq(meshContext.meshId, meshId),
-        eq(meshContext.presenceId, presenceId),
-      ),
-    )
     .limit(1);
 
   if (existing) {
     await db
       .update(meshContext)
       .set({
+        // Keep presenceId current so it reflects the latest connection.
+        presenceId,
         peerName: peerName ?? null,
         summary,
         filesRead: filesRead ?? [],
@@ -939,6 +1007,7 @@ export async function shareContext(
     .insert(meshContext)
     .values({
       meshId,
+      memberId: memberId ?? null,
       presenceId,
       peerName: peerName ?? null,
       summary,
@@ -1188,16 +1257,22 @@ export async function createStream(
   name: string,
   createdByName: string,
 ): Promise<string> {
-  const existing = await db
+  // Atomic upsert: INSERT ... ON CONFLICT DO NOTHING to avoid TOCTOU race
+  // when two callers concurrently attempt to create the same stream.
+  const [inserted] = await db
+    .insert(meshStream)
+    .values({ meshId, name, createdByName })
+    .onConflictDoNothing()
+    .returning({ id: meshStream.id });
+
+  if (inserted) return inserted.id;
+
+  // Row already existed — fetch the id.
+  const [existing] = await db
     .select({ id: meshStream.id })
     .from(meshStream)
     .where(and(eq(meshStream.meshId, meshId), eq(meshStream.name, name)));
-  if (existing.length > 0) return existing[0]!.id;
+  return existing!.id;
-  const [row] = await db
-    .insert(meshStream)
-    .values({ meshId, name, createdByName })
-    .returning({ id: meshStream.id });
-  return row!.id;
 }
 
 /**
@@ -1302,11 +1377,28 @@ export async function drainForMember(
   );
 
   // Build group target matching: @all (broadcast alias) + @<groupname>
-  // for each group the peer belongs to.
+  // for each group the peer belongs to, expanded to all ancestor paths.
+  //
+  // Hierarchical routing (downward propagation):
+  //   A peer in "flexicar/core" also matches messages sent to "@flexicar".
+  //   A peer in "flexicar/core/backend" matches "@flexicar/core" and "@flexicar".
+  //   This lets leads send to a parent group and reach all sub-teams.
+  //
+  // Resolution happens at drain time (pull model) — no duplicates stored,
+  // no schema changes, fully backward-compatible.
   const groupTargets = ["@all"];
   if (memberGroups) {
+    const seen = new Set<string>();
     for (const g of memberGroups) {
-      groupTargets.push(`@${g}`);
+      const parts = g.split("/");
+      // Add the group itself + every ancestor prefix.
+      for (let depth = parts.length; depth > 0; depth--) {
+        const ancestor = parts.slice(0, depth).join("/");
+        if (!seen.has(ancestor)) {
+          seen.add(ancestor);
+          groupTargets.push(`@${ancestor}`);
+        }
+      }
     }
   }
   const groupTargetList = sql.raw(
@@ -1337,7 +1429,7 @@ export async function drainForMember(
           AND delivered_at IS NULL
           AND priority::text IN (${priorityList})
           AND (target_spec = ${memberPubkey} OR target_spec = '*'${sessionPubkey ? sql` OR target_spec = ${sessionPubkey}` : sql``} OR target_spec IN (${groupTargetList}))
-          ${excludeSenderSessionPubkey ? sql`AND (sender_session_pubkey IS NULL OR sender_session_pubkey != ${excludeSenderSessionPubkey})` : sql``}
+          ${excludeSenderSessionPubkey ? sql`AND NOT (target_spec IN ('*') AND sender_session_pubkey = ${excludeSenderSessionPubkey})` : sql``}
         ORDER BY created_at ASC, id ASC
         FOR UPDATE SKIP LOCKED
       )

apps/broker/src/env.ts

@@ -23,7 +23,7 @@ const envSchema = z.object({
   MINIO_ENDPOINT: z.string().default("minio:9000"),
   MINIO_ACCESS_KEY: z.string().default("claudemesh"),
   MINIO_SECRET_KEY: z.string().default("changeme"),
-  MINIO_USE_SSL: z.coerce.boolean().default(false),
+  MINIO_USE_SSL: z.enum(["true", "false", ""]).transform(v => v === "true").default("false"),
   QDRANT_URL: z.string().default("http://qdrant:6333"),
   NEO4J_URL: z.string().default("bolt://neo4j:7687"),
   NEO4J_USER: z.string().default("neo4j"),

apps/broker/src/index.ts

@@ -31,10 +31,13 @@ import {
   forgetMemory,
   getContext,
   getFile,
+  getFileKey,
   getFileStatus,
   getState,
+  grantFileKey,
   handleHookSetStatus,
   heartbeat,
+  insertFileKeys,
   joinGroup,
   joinMesh,
   leaveGroup,
@@ -99,6 +102,20 @@ const connectionsPerMesh = new Map<string, number>();
 
 // Stream subscriptions: "meshId:streamName" → Set of presenceIds
 const streamSubscriptions = new Map<string, Set<string>>();
+
+/// Scheduled messages: meshId → Map<scheduledId, entry>
+interface ScheduledEntry {
+  id: string;
+  meshId: string;
+  presenceId: string;
+  to: string;
+  message: string;
+  deliverAt: number;
+  createdAt: number;
+  subtype?: "reminder";
+  timer: ReturnType<typeof setTimeout>;
+}
+const scheduledMessages = new Map<string, ScheduledEntry>(); // keyed by scheduledId
 const hookRateLimit = new TokenBucket(
   env.HOOK_RATE_LIMIT_PER_MIN,
   env.HOOK_RATE_LIMIT_PER_MIN,
@@ -123,7 +140,10 @@ async function maybePushQueuedMessages(
   excludeSenderSessionPubkey?: string,
 ): Promise<void> {
   const conn = connections.get(presenceId);
-  if (!conn) return;
+  if (!conn) {
+    log.debug("maybePush: no connection for presence", { presence_id: presenceId });
+    return;
+  }
   const status = await refreshStatusFromJsonl(
     presenceId,
     conn.cwd,
@@ -138,6 +158,13 @@ async function maybePushQueuedMessages(
     excludeSenderSessionPubkey,
     conn.groups.map((g) => g.name),
   );
+  log.info("maybePush", {
+    presence_id: presenceId,
+    status,
+    session_pubkey: conn.sessionPubkey?.slice(0, 12),
+    exclude: excludeSenderSessionPubkey?.slice(0, 12),
+    drained: messages.length,
+  });
   for (const m of messages) {
     const push: WSPushMessage = {
       type: "push",
@@ -368,6 +395,9 @@ function handleUploadPost(
   const tagsRaw = req.headers["x-tags"] as string | undefined;
   const persistentRaw = req.headers["x-persistent"] as string | undefined;
   const targetSpec = req.headers["x-target-spec"] as string | undefined;
+  const encryptedRaw = req.headers["x-encrypted"] as string | undefined;
+  const ownerPubkey = req.headers["x-owner-pubkey"] as string | undefined;
+  const fileKeysRaw = req.headers["x-file-keys"] as string | undefined;
 
   if (!meshId || !memberId || !fileName) {
     writeJson(res, 400, {
@@ -435,19 +465,44 @@ function handleUploadPost(
           : undefined,
       );
 
-      // Insert DB row
+      // Insert DB row — normalise tags to a real JS Array (Drizzle PgArray
+      // mapper calls .map() on the value; non-Array iterables break it).
+      // Skip uploadedByMember FK — memberId from the client header is the
+      // mesh slug, not a mesh.member primary key.
+      const encrypted = encryptedRaw === "true";
+      let fileKeys: Array<{ peerPubkey: string; sealedKey: string }> = [];
+      if (encrypted && fileKeysRaw) {
+        try {
+          fileKeys = JSON.parse(fileKeysRaw);
+        } catch { /* ignore */ }
+      }
+
       const dbFileId = await uploadFile({
         meshId,
         name: fileName,
         sizeBytes: body.length,
         mimeType: (req.headers["content-type"] as string) || undefined,
         minioKey,
-        tags,
+        tags: Array.isArray(tags) ? tags : [],
         persistent,
-        uploadedByMember: memberId,
+        uploadedByName: memberId || undefined,
+        uploadedByMember: undefined,
         targetSpec: targetSpec || undefined,
+        encrypted: encrypted || false,
+        ownerPubkey: ownerPubkey || undefined,
       });
 
+      if (encrypted && fileKeys.length > 0) {
+        await insertFileKeys(
+          dbFileId,
+          fileKeys.map((k) => ({
+            peerPubkey: k.peerPubkey,
+            sealedKey: k.sealedKey,
+            grantedByPubkey: ownerPubkey,
+          })),
+        );
+      }
+
       writeJson(res, 200, { ok: true, fileId: dbFileId });
       log.info("upload", {
         route: "POST /upload",
@@ -506,8 +561,9 @@ function sendError(
   code: string,
   message: string,
   id?: string,
+  reqId?: string,
 ): void {
-  const err: WSServerMessage = { type: "error", code, message, id };
+  const err: WSServerMessage = { type: "error", code, message, id, ...(reqId ? { _reqId: reqId } : {}) };
   try {
     ws.send(JSON.stringify(err));
   } catch {
@@ -597,6 +653,7 @@ async function handleHello(
 async function handleSend(
   conn: PeerConn,
   msg: Extract<WSClientMessage, { type: "send" }>,
+  subtype?: "reminder",
 ): Promise<void> {
   const messageId = await queueMessage({
     meshId: conn.meshId,
@@ -641,6 +698,7 @@ async function handleSend(
     nonce: msg.nonce,
     ciphertext: msg.ciphertext,
     createdAt: new Date().toISOString(),
+    ...(subtype ? { subtype } : {}),
   };
 
   for (const [pid, peer] of connections) {
@@ -686,6 +744,7 @@ function handleConnection(ws: WebSocket): void {
   ws.on("message", async (raw) => {
     try {
       const msg = JSON.parse(raw.toString()) as WSClientMessage;
+      const _reqId = (msg as any)._reqId as string | undefined;
       if (msg.type === "hello") {
         const result = await handleHello(ws, msg);
         if (!result) return;
@@ -735,6 +794,7 @@ function handleConnection(ws: WebSocket): void {
               sessionId: p.sessionId,
               connectedAt: p.connectedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           };
           conn.ws.send(JSON.stringify(resp));
           log.info("ws list_peers", {
@@ -803,14 +863,8 @@ function handleConnection(ws: WebSocket): void {
               updatedBy: stateRow.updatedBy,
             });
           }
-          // Send confirmation back to sender as state_result.
+          // Fire-and-forget: no state_result sent back to sender.
-          sendToPeer(presenceId, {
+          // The client (server.ts) returns success immediately without waiting.
-            type: "state_result",
-            key: stateRow.key,
-            value: stateRow.value,
-            updatedBy: stateRow.updatedBy,
-            updatedAt: stateRow.updatedAt.toISOString(),
-          });
           log.info("ws set_state", {
             presence_id: presenceId,
             key: ss.key,
@@ -827,6 +881,7 @@ function handleConnection(ws: WebSocket): void {
               value: stateEntry.value,
               updatedBy: stateEntry.updatedBy,
               updatedAt: stateEntry.updatedAt.toISOString(),
+              ...(_reqId ? { _reqId } : {}),
             });
           } else {
             sendToPeer(presenceId, {
@@ -835,6 +890,7 @@ function handleConnection(ws: WebSocket): void {
               value: null,
               updatedBy: "",
               updatedAt: "",
+              ...(_reqId ? { _reqId } : {}),
             });
           }
           log.info("ws get_state", {
@@ -854,6 +910,7 @@ function handleConnection(ws: WebSocket): void {
               updatedBy: e.updatedBy,
               updatedAt: e.updatedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws list_state", {
             presence_id: presenceId,
@@ -876,6 +933,7 @@ function handleConnection(ws: WebSocket): void {
           sendToPeer(presenceId, {
             type: "memory_stored",
             id: memoryId,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws remember", {
             presence_id: presenceId,
@@ -895,6 +953,7 @@ function handleConnection(ws: WebSocket): void {
               rememberedBy: m.rememberedBy,
               rememberedAt: m.rememberedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws recall", {
             presence_id: presenceId,
@@ -911,6 +970,7 @@ function handleConnection(ws: WebSocket): void {
             id: fg.memoryId,
             messageId: fg.memoryId,
             queued: false,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws forget", {
             presence_id: presenceId,
@@ -922,7 +982,7 @@ function handleConnection(ws: WebSocket): void {
           const gf = msg as Extract<WSClientMessage, { type: "get_file" }>;
           const file = await getFile(conn.meshId, gf.fileId);
           if (!file) {
-            sendError(conn.ws, "not_found", "file not found");
+            sendError(conn.ws, "not_found", "file not found", undefined, _reqId);
             break;
           }
           // Access control: if targetSpec is set, verify peer matches
@@ -932,7 +992,20 @@ function handleConnection(ws: WebSocket): void {
               file.targetSpec === conn.sessionPubkey ||
               file.targetSpec === "*";
             if (!matches) {
-              sendError(conn.ws, "forbidden", "file not targeted at you");
+              sendError(conn.ws, "forbidden", "file not targeted at you", undefined, _reqId);
+              break;
+            }
+          }
+          // E2E: for encrypted files, fetch the sealed key for this peer.
+          // Owners are not blocked if their key is missing (edge case), but
+          // they still get it returned so the CLI can decrypt normally.
+          let sealedKey: string | null = null;
+          if (file.encrypted) {
+            const peerPubkey = conn.sessionPubkey ?? conn.memberPubkey;
+            const isOwner = !!(file.ownerPubkey && peerPubkey === file.ownerPubkey);
+            sealedKey = peerPubkey ? await getFileKey(gf.fileId, peerPubkey) : null;
+            if (!sealedKey && !isOwner) {
+              sendError(conn.ws, "forbidden", "no decryption key for this file", undefined, _reqId);
               break;
             }
           }
@@ -957,6 +1030,9 @@ function handleConnection(ws: WebSocket): void {
             fileId: gf.fileId,
             url: presignedUrl,
             name: file.name,
+            encrypted: file.encrypted,
+            sealedKey: sealedKey ?? undefined,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws get_file", {
             presence_id: presenceId,
@@ -977,7 +1053,9 @@ function handleConnection(ws: WebSocket): void {
               uploadedBy: f.uploadedBy,
               uploadedAt: f.uploadedAt.toISOString(),
               persistent: f.persistent,
+              encrypted: f.encrypted,
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws list_files", {
             presence_id: presenceId,
@@ -996,6 +1074,7 @@ function handleConnection(ws: WebSocket): void {
               peerName: a.peerName,
               accessedAt: a.accessedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws file_status", {
             presence_id: presenceId,
@@ -1003,6 +1082,23 @@ function handleConnection(ws: WebSocket): void {
           });
           break;
         }
+        case "grant_file_access": {
+          const gfa = msg as { type: "grant_file_access"; fileId: string; peerPubkey: string; sealedKey: string };
+          const file = await getFile(conn.meshId, gfa.fileId);
+          if (!file) {
+            sendError(conn.ws, "not_found", "file not found", undefined, _reqId);
+            break;
+          }
+          const requestorPubkey = conn.sessionPubkey ?? conn.memberPubkey;
+          if (file.ownerPubkey && file.ownerPubkey !== requestorPubkey) {
+            sendError(conn.ws, "forbidden", "only the file owner can grant access", undefined, _reqId);
+            break;
+          }
+          await grantFileKey(gfa.fileId, gfa.peerPubkey, gfa.sealedKey, requestorPubkey ?? undefined);
+          sendToPeer(presenceId, { type: "grant_file_access_ok", fileId: gfa.fileId, peerPubkey: gfa.peerPubkey, ...(_reqId ? { _reqId } : {}) });
+          log.info("ws grant_file_access", { presence_id: presenceId, file_id: gfa.fileId, peer: gfa.peerPubkey });
+          break;
+        }
         case "delete_file": {
           const df = msg as Extract<WSClientMessage, { type: "delete_file" }>;
           await deleteFile(conn.meshId, df.fileId);
@@ -1011,6 +1107,7 @@ function handleConnection(ws: WebSocket): void {
             id: df.fileId,
             messageId: df.fileId,
             queued: false,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws delete_file", {
             presence_id: presenceId,
@@ -1031,7 +1128,7 @@ function handleConnection(ws: WebSocket): void {
             .from(messageQueue)
             .where(eq(messageQueue.id, ms.messageId));
           if (!mqRow || mqRow.meshId !== conn.meshId) {
-            sendError(conn.ws, "not_found", "message not found");
+            sendError(conn.ws, "not_found", "message not found", undefined, _reqId);
             break;
           }
           // Build per-recipient status from connected peers.
@@ -1075,6 +1172,7 @@ function handleConnection(ws: WebSocket): void {
             delivered: !!mqRow.deliveredAt,
             deliveredAt: mqRow.deliveredAt?.toISOString() ?? null,
             recipients,
+            ...(_reqId ? { _reqId } : {}),
           };
           sendToPeer(presenceId, resp);
           log.info("ws message_status", {
@@ -1097,6 +1195,7 @@ function handleConnection(ws: WebSocket): void {
             sc.filesRead,
             sc.keyFindings,
             sc.tags,
+            conn.memberId,
           );
           sendToPeer(presenceId, {
             type: "context_shared",
@@ -1132,6 +1231,7 @@ function handleConnection(ws: WebSocket): void {
               tags: c.tags,
               updatedAt: c.updatedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws get_context", {
             presence_id: presenceId,
@@ -1150,6 +1250,7 @@ function handleConnection(ws: WebSocket): void {
               tags: c.tags,
               updatedAt: c.updatedAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws list_contexts", {
             presence_id: presenceId,
@@ -1174,6 +1275,7 @@ function handleConnection(ws: WebSocket): void {
           sendToPeer(presenceId, {
             type: "task_created",
             id: taskId,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws create_task", {
             presence_id: presenceId,
@@ -1194,7 +1296,7 @@ function handleConnection(ws: WebSocket): void {
             memberInfo?.displayName,
           );
           if (!claimed) {
-            sendError(conn.ws, "task_not_claimable", "task is not open or does not exist");
+            sendError(conn.ws, "task_not_claimable", "task is not open or does not exist", undefined, _reqId);
             break;
           }
           // Return updated task list so caller sees the change.
@@ -1212,6 +1314,7 @@ function handleConnection(ws: WebSocket): void {
               tags: t.tags,
               createdAt: t.createdAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws claim_task", {
             presence_id: presenceId,
@@ -1227,7 +1330,7 @@ function handleConnection(ws: WebSocket): void {
             cpt.result,
           );
           if (!completed) {
-            sendError(conn.ws, "task_not_found", "task not found in this mesh");
+            sendError(conn.ws, "task_not_found", "task not found in this mesh", undefined, _reqId);
             break;
           }
           // Return updated task list.
@@ -1245,6 +1348,7 @@ function handleConnection(ws: WebSocket): void {
               tags: t.tags,
               createdAt: t.createdAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws complete_task", {
             presence_id: presenceId,
@@ -1268,6 +1372,7 @@ function handleConnection(ws: WebSocket): void {
               tags: t.tags,
               createdAt: t.createdAt.toISOString(),
             })),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws list_tasks", {
             presence_id: presenceId,
@@ -1293,6 +1398,7 @@ function handleConnection(ws: WebSocket): void {
             type: "stream_created",
             id: streamId,
             name: cs.name,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws create_stream", {
             presence_id: presenceId,
@@ -1307,6 +1413,7 @@ function handleConnection(ws: WebSocket): void {
           if (!streamSubscriptions.has(key))
             streamSubscriptions.set(key, new Set());
           streamSubscriptions.get(key)!.add(presenceId);
+          sendToPeer(presenceId, { type: "subscribed", stream: sub.stream, ...(_reqId ? { _reqId } : {}) });
           log.info("ws subscribe", {
             presence_id: presenceId,
             stream: sub.stream,
@@ -1365,6 +1472,7 @@ function handleConnection(ws: WebSocket): void {
                 subscriberCount: streamSubscriptions.get(key)?.size ?? 0,
               };
             }),
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws list_streams", {
             presence_id: presenceId,
@@ -1379,40 +1487,43 @@ function handleConnection(ws: WebSocket): void {
         case "vector_store": {
           const vs = msg as Extract<WSClientMessage, { type: "vector_store" }>;
           const collName = meshCollectionName(conn.meshId, vs.collection);
-          await ensureCollection(collName);
+          try {
-          const { generateId } = await import("@turbostarter/shared/utils");
+            await ensureCollection(collName);
-          const pointId = generateId();
+            const { generateId } = await import("@turbostarter/shared/utils");
-          // Store text + metadata as payload. Use a zero vector as placeholder
+            const pointId = generateId();
-          // — real embeddings should be computed client-side and sent directly
+            // Store text + metadata as payload. Use a zero vector as placeholder
-          // to Qdrant in a future version.
+            // — real embeddings should be computed client-side and sent directly
-          const zeroVector = new Array(1536).fill(0) as number[];
+            // to Qdrant in a future version.
-          await qdrant.upsert(collName, {
+            const zeroVector = new Array(1536).fill(0) as number[];
-            wait: true,
+            await qdrant.upsert(collName, {
-            points: [
+              wait: true,
-              {
+              points: [
-                id: pointId,
+                {
-                vector: zeroVector,
+                  id: pointId,
-                payload: {
+                  vector: zeroVector,
-                  text: vs.text,
+                  payload: {
-                  mesh_id: conn.meshId,
+                    text: vs.text,
-                  stored_by: conn.memberPubkey,
+                    mesh_id: conn.meshId,
-                  stored_at: new Date().toISOString(),
+                    stored_by: conn.memberPubkey,
-                  ...(vs.metadata ?? {}),
+                    stored_at: new Date().toISOString(),
+                    ...(vs.metadata ?? {}),
+                  },
                 },
-              },
+              ],
-            ],
+            });
-          });
+            sendToPeer(presenceId, {
-          sendToPeer(presenceId, {
+              type: "vector_stored",
-            type: "ack" as const,
+              id: pointId,
-            id: pointId,
+              ...(_reqId ? { _reqId } : {}),
-            messageId: pointId,
+            });
-            queued: false,
+            log.info("ws vector_store", {
-          });
+              presence_id: presenceId,
-          log.info("ws vector_store", {
+              collection: vs.collection,
-            presence_id: presenceId,
+              point_id: pointId,
-            collection: vs.collection,
+            });
-            point_id: pointId,
+          } catch (e) {
-          });
+            sendError(conn.ws, "vector_error", e instanceof Error ? e.message : String(e), undefined, _reqId);
+          }
           break;
         }
         case "vector_search": {
@@ -1446,12 +1557,14 @@ function handleConnection(ws: WebSocket): void {
             sendToPeer(presenceId, {
               type: "vector_results",
               results: matches,
+              ...(_reqId ? { _reqId } : {}),
             });
           } catch {
             // Collection may not exist yet — return empty results.
             sendToPeer(presenceId, {
               type: "vector_results",
               results: [],
+              ...(_reqId ? { _reqId } : {}),
             });
           }
           log.info("ws vector_search", {
@@ -1477,6 +1590,7 @@ function handleConnection(ws: WebSocket): void {
             id: vd.id,
             messageId: vd.id,
             queued: false,
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws vector_delete", {
             presence_id: presenceId,
@@ -1496,11 +1610,13 @@ function handleConnection(ws: WebSocket): void {
             sendToPeer(presenceId, {
               type: "collection_list",
               collections: meshCollections,
+              ...(_reqId ? { _reqId } : {}),
             });
           } catch {
             sendToPeer(presenceId, {
               type: "collection_list",
               collections: [],
+              ...(_reqId ? { _reqId } : {}),
             });
           }
           log.info("ws list_collections", {
@@ -1535,9 +1651,10 @@ function handleConnection(ws: WebSocket): void {
             sendToPeer(presenceId, {
               type: "graph_result",
               records: gqRecords,
+              ...(_reqId ? { _reqId } : {}),
             });
           } catch (gqErr) {
-            sendError(conn.ws, "graph_error", gqErr instanceof Error ? gqErr.message : String(gqErr));
+            sendError(conn.ws, "graph_error", gqErr instanceof Error ? gqErr.message : String(gqErr), undefined, _reqId);
           } finally {
             await gqSession.close();
           }
@@ -1569,9 +1686,10 @@ function handleConnection(ws: WebSocket): void {
             sendToPeer(presenceId, {
               type: "graph_result",
               records: geRecords,
+              ...(_reqId ? { _reqId } : {}),
             });
           } catch (geErr) {
-            sendError(conn.ws, "graph_error", geErr instanceof Error ? geErr.message : String(geErr));
+            sendError(conn.ws, "graph_error", geErr instanceof Error ? geErr.message : String(geErr), undefined, _reqId);
           } finally {
             await geSession.close();
           }
@@ -1588,12 +1706,14 @@ function handleConnection(ws: WebSocket): void {
           const mq = msg as Extract<WSClientMessage, { type: "mesh_query" }>;
           try {
             const result = await meshQuery(conn.meshId, mq.sql);
-            sendToPeer(presenceId, { type: "mesh_query_result", ...result });
+            sendToPeer(presenceId, { type: "mesh_query_result", ...result, ...(_reqId ? { _reqId } : {}) });
           } catch (e) {
             sendError(
               conn.ws,
               "query_error",
               e instanceof Error ? e.message : String(e),
+              undefined,
+              _reqId,
             );
           }
           log.info("ws mesh_query", {
@@ -1611,12 +1731,15 @@ function handleConnection(ws: WebSocket): void {
               columns: [],
               rows: [],
               rowCount: result.rowCount,
+              ...(_reqId ? { _reqId } : {}),
             });
           } catch (e) {
             sendError(
               conn.ws,
               "execute_error",
               e instanceof Error ? e.message : String(e),
+              undefined,
+              _reqId,
             );
           }
           log.info("ws mesh_execute", {
@@ -1628,12 +1751,14 @@ function handleConnection(ws: WebSocket): void {
         case "mesh_schema": {
           try {
             const tables = await meshSchema(conn.meshId);
-            sendToPeer(presenceId, { type: "mesh_schema_result", tables });
+            sendToPeer(presenceId, { type: "mesh_schema_result", tables, ...(_reqId ? { _reqId } : {}) });
           } catch (e) {
             sendError(
               conn.ws,
               "schema_error",
               e instanceof Error ? e.message : String(e),
+              undefined,
+              _reqId,
             );
           }
           log.info("ws mesh_schema", { presence_id: presenceId });
@@ -1656,7 +1781,6 @@ function handleConnection(ws: WebSocket): void {
           ]);
           const allGroups = new Set<string>();
           for (const p of peers) for (const g of p.groups) allGroups.add(`@${g.name}`);
-          const myPresence = peers.find(p => p.sessionId === [...connections.entries()].find(([pid]) => pid === presenceId)?.[1]?.sessionPubkey);
           const peerConn = connections.get(presenceId);
           // Find own display name: match sessionPubkey from the peer list
           const selfPubkey = peerConn?.sessionPubkey ?? peerConn?.memberPubkey;
@@ -1675,10 +1799,99 @@ function handleConnection(ws: WebSocket): void {
             collections: [],
             yourName: selfPeer?.displayName ?? "unknown",
             yourGroups: peerConn?.groups ?? [],
+            ...(_reqId ? { _reqId } : {}),
           });
           log.info("ws mesh_info", { presence_id: presenceId });
           break;
         }
+
+        // --- Scheduled messages ---
+
+        case "schedule": {
+          const sm = msg as Extract<WSClientMessage, { type: "schedule" }>;
+          const scheduledId = crypto.randomUUID();
+          const now = Date.now();
+          const delay = Math.max(0, sm.deliverAt - now);
+
+          const deliver = (): void => {
+            scheduledMessages.delete(scheduledId);
+            // Deliver via the normal send path by constructing a WSSendMessage
+            // and routing it through handleSend so encryption + push logic applies.
+            const conn2 = connections.get(presenceId);
+            if (!conn2) return; // session gone — drop
+            const fakeMsg: Extract<WSClientMessage, { type: "send" }> = {
+              type: "send",
+              id: crypto.randomUUID(),
+              targetSpec: sm.to,
+              priority: "now",
+              nonce: "",
+              ciphertext: Buffer.from(sm.message, "utf-8").toString("base64"),
+            };
+            handleSend(conn2, fakeMsg, sm.subtype).catch((e) =>
+              log.warn("scheduled delivery error", { scheduled_id: scheduledId, error: String(e) }),
+            );
+            log.info("ws schedule deliver", { scheduled_id: scheduledId, to: sm.to });
+          };
+
+          const entry: ScheduledEntry = {
+            id: scheduledId,
+            meshId: conn.meshId,
+            presenceId,
+            to: sm.to,
+            message: sm.message,
+            deliverAt: sm.deliverAt,
+            createdAt: now,
+            ...(sm.subtype ? { subtype: sm.subtype } : {}),
+            timer: setTimeout(deliver, delay),
+          };
+          scheduledMessages.set(scheduledId, entry);
+
+          sendToPeer(presenceId, {
+            type: "scheduled_ack",
+            scheduledId,
+            deliverAt: sm.deliverAt,
+            ...(_reqId ? { _reqId } : {}),
+          });
+          log.info("ws schedule", {
+            presence_id: presenceId,
+            scheduled_id: scheduledId,
+            delay_ms: delay,
+            to: sm.to,
+          });
+          break;
+        }
+
+        case "list_scheduled": {
+          const mine = [...scheduledMessages.values()]
+            .filter((e) => e.meshId === conn.meshId && e.presenceId === presenceId)
+            .map((e) => ({ id: e.id, to: e.to, message: e.message, deliverAt: e.deliverAt, createdAt: e.createdAt }));
+          sendToPeer(presenceId, {
+            type: "scheduled_list",
+            messages: mine,
+            ...(_reqId ? { _reqId } : {}),
+          });
+          log.info("ws list_scheduled", { presence_id: presenceId, count: mine.length });
+          break;
+        }
+
+        case "cancel_scheduled": {
+          const cs = msg as Extract<WSClientMessage, { type: "cancel_scheduled" }>;
+          const entry = scheduledMessages.get(cs.scheduledId);
+          let ok = false;
+          if (entry && entry.meshId === conn.meshId && entry.presenceId === presenceId) {
+            clearTimeout(entry.timer);
+            scheduledMessages.delete(cs.scheduledId);
+            ok = true;
+          }
+          sendToPeer(presenceId, {
+            type: "cancel_scheduled_ack",
+            scheduledId: cs.scheduledId,
+            ok,
+            ...(_reqId ? { _reqId } : {}),
+          });
+          log.info("ws cancel_scheduled", { presence_id: presenceId, scheduled_id: cs.scheduledId, ok });
+          break;
+        }
       }
     } catch (e) {
       metrics.messagesRejectedTotal.inc({ reason: "parse_or_handler" });

apps/broker/src/types.ts

@@ -86,6 +86,8 @@ export interface WSPushMessage {
   nonce: string;
   ciphertext: string;
   createdAt: string;
+  /** Optional semantic tag — "reminder" when delivered by the scheduler. */
+  subtype?: "reminder";
 }
 
 /** Client → broker: manual status override (dnd, forced idle). */
@@ -161,6 +163,7 @@ export interface WSAckMessage {
   id: string; // echoes client-side correlation id
   messageId: string;
   queued: boolean;
+  _reqId?: string;
 }
 
 /** Broker → client: hello handshake acknowledgement. */
@@ -182,6 +185,7 @@ export interface WSPeersListMessage {
     sessionId: string;
     connectedAt: string;
   }>;
+  _reqId?: string;
 }
 
 /** Broker → client: a state key was changed by another peer. */
@@ -199,6 +203,7 @@ export interface WSStateResultMessage {
   value: unknown;
   updatedAt: string;
   updatedBy: string;
+  _reqId?: string;
 }
 
 /** Broker → client: response to list_state. */
@@ -210,12 +215,14 @@ export interface WSStateListMessage {
     updatedBy: string;
     updatedAt: string;
   }>;
+  _reqId?: string;
 }
 
 /** Broker → client: acknowledgement for a remember. */
 export interface WSMemoryStoredMessage {
   type: "memory_stored";
   id: string;
+  _reqId?: string;
 }
 
 /** Broker → client: response to recall. */
@@ -228,6 +235,7 @@ export interface WSMemoryResultsMessage {
     rememberedBy: string;
     rememberedAt: string;
   }>;
+  _reqId?: string;
 }
 
 // --- Vector storage messages ---
@@ -295,6 +303,13 @@ export interface WSMeshSchemaMessage {
 
 // --- Vector/Graph response messages ---
 
+/** Broker → client: confirmation that a vector point was stored. */
+export interface WSVectorStoredMessage {
+  type: "vector_stored";
+  id: string;
+  _reqId?: string;
+}
+
 /** Broker → client: vector search results. */
 export interface WSVectorResultsMessage {
   type: "vector_results";
@@ -304,18 +319,21 @@ export interface WSVectorResultsMessage {
     score: number;
     metadata?: Record<string, unknown>;
   }>;
+  _reqId?: string;
 }
 
 /** Broker → client: list of vector collections. */
 export interface WSCollectionListMessage {
   type: "collection_list";
   collections: string[];
+  _reqId?: string;
 }
 
 /** Broker → client: graph query results. */
 export interface WSGraphResultMessage {
   type: "graph_result";
   records: Array<Record<string, unknown>>;
+  _reqId?: string;
 }
 
 /** Broker → client: mesh SQL query results. */
@@ -324,6 +342,7 @@ export interface WSMeshQueryResultMessage {
   columns: string[];
   rows: Array<Record<string, unknown>>;
   rowCount: number;
+  _reqId?: string;
 }
 
 /** Broker → client: mesh schema introspection results. */
@@ -333,6 +352,7 @@ export interface WSMeshSchemaResultMessage {
     name: string;
     columns: Array<{ name: string; type: string; nullable: boolean }>;
   }>;
+  _reqId?: string;
 }
 
 /** Client → broker: get full mesh overview. */
@@ -355,6 +375,7 @@ export interface WSMeshInfoResultMessage {
   collections: string[];
   yourName: string;
   yourGroups: Array<{ name: string; role?: string }>;
+  _reqId?: string;
 }
 
 /** Client → broker: check delivery status of a message. */
@@ -375,6 +396,7 @@ export interface WSMessageStatusResultMessage {
     pubkey: string;
     status: "delivered" | "held" | "disconnected";
   }>;
+  _reqId?: string;
 }
 
 // --- File sharing messages ---
@@ -404,12 +426,23 @@ export interface WSDeleteFileMessage {
   fileId: string;
 }
 
+/** Client → broker: grant a peer access to an encrypted file. */
+export interface WSGrantFileAccessMessage {
+  type: "grant_file_access";
+  fileId: string;
+  peerPubkey: string;
+  sealedKey: string;
+}
+
 /** Broker → client: presigned URL for downloading a file. */
 export interface WSFileUrlMessage {
   type: "file_url";
   fileId: string;
   url: string;
   name: string;
+  encrypted?: boolean;
+  sealedKey?: string;
+  _reqId?: string;
 }
 
 /** Broker → client: list of files in the mesh. */
@@ -423,7 +456,17 @@ export interface WSFileListMessage {
     uploadedBy: string;
     uploadedAt: string;
     persistent: boolean;
+    encrypted: boolean;
   }>;
+  _reqId?: string;
+}
+
+/** Broker → client: acknowledgement for grant_file_access. */
+export interface WSGrantFileAccessOkMessage {
+  type: "grant_file_access_ok";
+  fileId: string;
+  peerPubkey: string;
+  _reqId?: string;
 }
 
 /** Broker → client: access log for a file. */
@@ -434,6 +477,7 @@ export interface WSFileStatusResultMessage {
     peerName: string;
     accessedAt: string;
   }>;
+  _reqId?: string;
 }
 
 // --- Context sharing messages ---
@@ -475,6 +519,7 @@ export interface WSContextResultsMessage {
     tags: string[];
     updatedAt: string;
   }>;
+  _reqId?: string;
 }
 
 /** Broker → client: response to list_contexts. */
@@ -486,6 +531,7 @@ export interface WSContextListMessage {
     tags: string[];
     updatedAt: string;
   }>;
+  _reqId?: string;
 }
 
 // --- Task messages ---
@@ -523,6 +569,7 @@ export interface WSListTasksMessage {
 export interface WSTaskCreatedMessage {
   type: "task_created";
   id: string;
+  _reqId?: string;
 }
 
 /** Broker → client: response to list_tasks, claim_task, complete_task. */
@@ -539,6 +586,7 @@ export interface WSTaskListMessage {
     tags: string[];
     createdAt: string;
   }>;
+  _reqId?: string;
 }
 
 // --- Stream messages ---
@@ -578,6 +626,7 @@ export interface WSStreamCreatedMessage {
   type: "stream_created";
   id: string;
   name: string;
+  _reqId?: string;
 }
 
 /** Broker → client: real-time data pushed from a stream. */
@@ -588,6 +637,13 @@ export interface WSStreamDataMessage {
   publishedBy: string;
 }
 
+/** Broker → client: confirmation that a stream subscription was registered. */
+export interface WSSubscribedMessage {
+  type: "subscribed";
+  stream: string;
+  _reqId?: string;
+}
+
 /** Broker → client: response to list_streams. */
 export interface WSStreamListMessage {
   type: "stream_list";
@@ -598,6 +654,7 @@ export interface WSStreamListMessage {
     createdAt: string;
     subscriberCount: number;
   }>;
+  _reqId?: string;
 }
 
 /** Broker → client: structured error. */
@@ -606,6 +663,63 @@ export interface WSErrorMessage {
   code: string;
   message: string;
   id?: string;
+  _reqId?: string;
+}
+
+// --- Scheduled messages ---
+
+/** Client → broker: schedule a message for future delivery. */
+export interface WSScheduleMessage {
+  type: "schedule";
+  to: string;
+  message: string;
+  /** Unix timestamp (ms) when to deliver. */
+  deliverAt: number;
+  /** Optional semantic tag — "reminder" surfaces differently to the receiver. */
+  subtype?: "reminder";
+  _reqId?: string;
+}
+
+/** Client → broker: list pending scheduled messages for this member. */
+export interface WSListScheduledMessage {
+  type: "list_scheduled";
+  _reqId?: string;
+}
+
+/** Client → broker: cancel a scheduled message by id. */
+export interface WSCancelScheduledMessage {
+  type: "cancel_scheduled";
+  scheduledId: string;
+  _reqId?: string;
+}
+
+/** Broker → client: acknowledgement for schedule, carries the assigned id. */
+export interface WSScheduledAckMessage {
+  type: "scheduled_ack";
+  scheduledId: string;
+  deliverAt: number;
+  _reqId?: string;
+}
+
+/** Broker → client: list of pending scheduled messages. */
+export interface WSScheduledListMessage {
+  type: "scheduled_list";
+  messages: Array<{
+    id: string;
+    to: string;
+    message: string;
+    deliverAt: number;
+    createdAt: number;
+  }>;
+  _reqId?: string;
+}
+
+/** Broker → client: cancel confirmation. */
+export interface WSCancelScheduledAckMessage {
+  type: "cancel_scheduled_ack";
+  scheduledId: string;
+  ok: boolean;
+  _reqId?: string;
 }
 
 export type WSClientMessage =
@@ -627,6 +741,7 @@ export type WSClientMessage =
   | WSListFilesMessage
   | WSFileStatusMessage
   | WSDeleteFileMessage
+  | WSGrantFileAccessMessage
   | WSShareContextMessage
   | WSGetContextMessage
   | WSListContextsMessage
@@ -648,7 +763,10 @@ export type WSClientMessage =
   | WSSubscribeMessage
   | WSUnsubscribeMessage
   | WSListStreamsMessage
-  | WSMeshInfoMessage;
+  | WSMeshInfoMessage
+  | WSScheduleMessage
+  | WSListScheduledMessage
+  | WSCancelScheduledMessage;
 
 export type WSServerMessage =
   | WSHelloAckMessage
@@ -664,11 +782,13 @@ export type WSServerMessage =
   | WSFileUrlMessage
   | WSFileListMessage
   | WSFileStatusResultMessage
+  | WSGrantFileAccessOkMessage
   | WSContextSharedMessage
   | WSContextResultsMessage
   | WSContextListMessage
   | WSTaskCreatedMessage
   | WSTaskListMessage
+  | WSVectorStoredMessage
   | WSVectorResultsMessage
   | WSCollectionListMessage
   | WSGraphResultMessage
@@ -676,6 +796,10 @@ export type WSServerMessage =
   | WSMeshSchemaResultMessage
   | WSStreamCreatedMessage
   | WSStreamDataMessage
+  | WSSubscribedMessage
   | WSStreamListMessage
   | WSMeshInfoResultMessage
+  | WSScheduledAckMessage
+  | WSScheduledListMessage
+  | WSCancelScheduledAckMessage
   | WSErrorMessage;

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemesh-cli",
-  "version": "0.5.9",
+  "version": "0.6.8",
   "description": "Claude Code MCP client for claudemesh — peer mesh messaging between Claude sessions.",
   "keywords": [
     "claude-code",
@@ -47,6 +47,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.27.1",
+    "citty": "0.2.2",
     "libsodium-wrappers": "0.7.15",
     "ws": "8.20.0",
     "zod": "4.1.13"

apps/cli/src/commands/connect.ts

@@ -0,0 +1,59 @@
+/**
+ * Short-lived WS connection helper for CLI commands (peers, send, inbox, state).
+ *
+ * Opens a connection to one mesh, runs a callback, then closes cleanly.
+ * The caller never deals with connect/close lifecycle.
+ */
+
+import { hostname } from "node:os";
+import { BrokerClient } from "../ws/client";
+import { loadConfig } from "../state/config";
+import type { JoinedMesh } from "../state/config";
+
+export interface ConnectOpts {
+  /** Mesh slug to connect to. Auto-selects if only one mesh joined. */
+  meshSlug?: string | null;
+  /** Display name for this session. Defaults to hostname-pid. */
+  displayName?: string;
+}
+
+export async function withMesh<T>(
+  opts: ConnectOpts,
+  fn: (client: BrokerClient, mesh: JoinedMesh) => Promise<T>,
+): Promise<T> {
+  const config = loadConfig();
+  if (config.meshes.length === 0) {
+    console.error("No meshes joined. Run `claudemesh join <url>` first.");
+    process.exit(1);
+  }
+
+  let mesh: JoinedMesh;
+  if (opts.meshSlug) {
+    const found = config.meshes.find((m) => m.slug === opts.meshSlug);
+    if (!found) {
+      console.error(
+        `Mesh "${opts.meshSlug}" not found. Joined: ${config.meshes.map((m) => m.slug).join(", ")}`,
+      );
+      process.exit(1);
+    }
+    mesh = found;
+  } else if (config.meshes.length === 1) {
+    mesh = config.meshes[0]!;
+  } else {
+    console.error(
+      `Multiple meshes joined. Specify one with --mesh <slug>.\nJoined: ${config.meshes.map((m) => m.slug).join(", ")}`,
+    );
+    process.exit(1);
+  }
+
+  const displayName = opts.displayName ?? config.displayName ?? `${hostname()}-${process.pid}`;
+  const client = new BrokerClient(mesh, { displayName });
+
+  try {
+    await client.connect();
+    const result = await fn(client, mesh);
+    return result;
+  } finally {
+    client.close();
+  }
+}

apps/cli/src/commands/inbox.ts

@@ -0,0 +1,60 @@
+/**
+ * `claudemesh inbox` — read pending peer messages.
+ *
+ * Connects, waits briefly for push delivery, drains the buffer, prints.
+ * Works best when message-mode is "inbox" or "off" (messages held at broker).
+ */
+
+import { withMesh } from "./connect";
+import type { InboundPush } from "../ws/client";
+
+export interface InboxFlags {
+  mesh?: string;
+  json?: boolean;
+  wait?: number;
+}
+
+function formatMessage(msg: InboundPush, useColor: boolean): string {
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const text = msg.plaintext ?? `[encrypted: ${msg.ciphertext.slice(0, 32)}…]`;
+  const from = msg.senderPubkey.slice(0, 8);
+  const time = new Date(msg.createdAt).toLocaleTimeString();
+  const kindTag = msg.kind === "direct" ? "→ direct" : msg.kind;
+
+  return `  ${bold(from)} ${dim(`[${kindTag}] ${time}`)}\n  ${text}`;
+}
+
+export async function runInbox(flags: InboxFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const waitMs = (flags.wait ?? 1) * 1000;
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    // Wait briefly for broker to push any held messages.
+    await new Promise<void>((resolve) => setTimeout(resolve, waitMs));
+
+    const messages = client.drainPushBuffer();
+
+    if (flags.json) {
+      console.log(JSON.stringify(messages, null, 2));
+      return;
+    }
+
+    if (messages.length === 0) {
+      console.log(dim(`No messages on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    console.log(bold(`Inbox — ${mesh.slug}`) + dim(` (${messages.length} message${messages.length === 1 ? "" : "s"})`));
+    console.log("");
+    for (const msg of messages) {
+      console.log(formatMessage(msg, useColor));
+      console.log("");
+    }
+  });
+}

apps/cli/src/commands/info.ts

@@ -0,0 +1,58 @@
+/**
+ * `claudemesh info` — show mesh overview: slug, broker URL, peer count, state count.
+ *
+ * Useful for AI agents to orient themselves in a mesh via bash.
+ */
+
+import { withMesh } from "./connect";
+import { loadConfig } from "../state/config";
+
+export interface InfoFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runInfo(flags: InfoFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const config = loadConfig();
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const [brokerInfo, peers, state] = await Promise.all([
+      client.meshInfo(),
+      client.listPeers(),
+      client.listState(),
+    ]);
+
+    const output = {
+      slug: mesh.slug,
+      meshId: mesh.meshId,
+      memberId: mesh.memberId,
+      brokerUrl: mesh.brokerUrl,
+      displayName: config.displayName ?? null,
+      peerCount: peers.length,
+      stateCount: state.length,
+      ...(brokerInfo ?? {}),
+    };
+
+    if (flags.json) {
+      console.log(JSON.stringify(output, null, 2));
+      return;
+    }
+
+    console.log(bold(mesh.slug) + dim(` · ${mesh.brokerUrl}`));
+    console.log(dim(`  mesh:   ${mesh.meshId}`));
+    console.log(dim(`  member: ${mesh.memberId}`));
+    console.log(`  peers:  ${peers.length} connected`);
+    console.log(`  state:  ${state.length} keys`);
+    if (brokerInfo && typeof brokerInfo === "object") {
+      for (const [k, v] of Object.entries(brokerInfo)) {
+        if (["slug", "meshId", "brokerUrl"].includes(k)) continue;
+        console.log(dim(`  ${k}: ${JSON.stringify(v)}`));
+      }
+    }
+  });
+}

apps/cli/src/commands/install.ts

@@ -212,6 +212,88 @@ function writeClaudeSettings(obj: Record<string, unknown>): void {
   );
 }
 
+/**
+ * All claudemesh MCP tool names, prefixed for allowedTools.
+ * These let Claude Code use claudemesh tools without --dangerously-skip-permissions.
+ */
+const CLAUDEMESH_TOOLS = [
+  "mcp__claudemesh__send_message",
+  "mcp__claudemesh__list_peers",
+  "mcp__claudemesh__check_messages",
+  "mcp__claudemesh__set_summary",
+  "mcp__claudemesh__set_status",
+  "mcp__claudemesh__join_group",
+  "mcp__claudemesh__leave_group",
+  "mcp__claudemesh__get_state",
+  "mcp__claudemesh__set_state",
+  "mcp__claudemesh__list_state",
+  "mcp__claudemesh__remember",
+  "mcp__claudemesh__recall",
+  "mcp__claudemesh__forget",
+  "mcp__claudemesh__share_file",
+  "mcp__claudemesh__get_file",
+  "mcp__claudemesh__list_files",
+  "mcp__claudemesh__file_status",
+  "mcp__claudemesh__delete_file",
+  "mcp__claudemesh__vector_store",
+  "mcp__claudemesh__vector_search",
+  "mcp__claudemesh__vector_delete",
+  "mcp__claudemesh__list_collections",
+  "mcp__claudemesh__graph_query",
+  "mcp__claudemesh__graph_execute",
+  "mcp__claudemesh__mesh_info",
+  "mcp__claudemesh__ping_mesh",
+  "mcp__claudemesh__message_status",
+  "mcp__claudemesh__share_context",
+  "mcp__claudemesh__get_context",
+  "mcp__claudemesh__list_contexts",
+  "mcp__claudemesh__create_task",
+  "mcp__claudemesh__claim_task",
+  "mcp__claudemesh__complete_task",
+  "mcp__claudemesh__list_tasks",
+  "mcp__claudemesh__create_stream",
+  "mcp__claudemesh__publish",
+  "mcp__claudemesh__subscribe",
+  "mcp__claudemesh__list_streams",
+  "mcp__claudemesh__mesh_execute",
+  "mcp__claudemesh__mesh_query",
+  "mcp__claudemesh__mesh_schema",
+];
+
+/**
+ * Pre-approve all claudemesh MCP tools in allowedTools.
+ * Merges into any existing list — never overwrites other entries.
+ * Returns which tools were added vs already present.
+ */
+function installAllowedTools(): { added: string[]; unchanged: number } {
+  const settings = readClaudeSettings();
+  const existing = new Set<string>((settings.allowedTools as string[] | undefined) ?? []);
+  const toAdd = CLAUDEMESH_TOOLS.filter((t) => !existing.has(t));
+  if (toAdd.length > 0) {
+    settings.allowedTools = [...Array.from(existing), ...toAdd];
+    writeClaudeSettings(settings);
+  }
+  return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
+}
+
+/**
+ * Remove claudemesh tools from allowedTools.
+ * Leaves all other entries intact. Returns count removed.
+ */
+function uninstallAllowedTools(): number {
+  if (!existsSync(CLAUDE_SETTINGS)) return 0;
+  const settings = readClaudeSettings();
+  const existing = (settings.allowedTools as string[] | undefined) ?? [];
+  const toolSet = new Set(CLAUDEMESH_TOOLS);
+  const kept = existing.filter((t) => !toolSet.has(t));
+  const removed = existing.length - kept.length;
+  if (removed > 0) {
+    settings.allowedTools = kept;
+    writeClaudeSettings(settings);
+  }
+  return removed;
+}
+
 /**
  * Add a Stop + UserPromptSubmit hook entry to ~/.claude/settings.json,
  * idempotent on the command string. Returns counts for reporting.
@@ -321,6 +403,26 @@ export function runInstall(args: string[] = []): void {
     ),
   );
 
+  // allowedTools — pre-approve claudemesh MCP tools so peers don't need
+  // --dangerously-skip-permissions just to call mesh tools.
+  try {
+    const { added, unchanged } = installAllowedTools();
+    if (added.length > 0) {
+      console.log(
+        `✓ allowedTools: ${added.length} claudemesh tools pre-approved${unchanged > 0 ? `, ${unchanged} already present` : ""}`,
+      );
+      console.log(dim(`  This lets claudemesh tools run without --dangerously-skip-permissions.`));
+      console.log(dim(`  Your existing allowedTools entries were preserved.`));
+    } else {
+      console.log(`✓ allowedTools: all ${unchanged} claudemesh tools already pre-approved`);
+    }
+    console.log(dim(`  config:  ${CLAUDE_SETTINGS}`));
+  } catch (e) {
+    console.error(
+      `⚠  allowedTools update failed: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+
   // Hooks — status accuracy (Stop/UserPromptSubmit → POST /hook/set-status).
   if (!skipHooks) {
     try {
@@ -375,6 +477,20 @@ export function runUninstall(): void {
     console.log(`· MCP server "${MCP_NAME}" not present`);
   }
 
+  // allowedTools
+  try {
+    const removed = uninstallAllowedTools();
+    if (removed > 0) {
+      console.log(`✓ allowedTools: ${removed} claudemesh tools removed`);
+    } else {
+      console.log("· No claudemesh allowedTools to remove");
+    }
+  } catch (e) {
+    console.error(
+      `⚠  allowedTools removal failed: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+
   // Hooks
   try {
     const removed = uninstallHooks();

apps/cli/src/commands/launch.ts

@@ -1,9 +1,12 @@
 /**
  * `claudemesh launch` — spawn `claude` with peer mesh identity.
  *
+ * Flags are defined in index.ts (citty command) — that is the source of
+ * truth. This file receives already-parsed flags and rawArgs.
+ *
  * Flow:
- *   1. Parse --name, --join, --mesh, --quiet flags
+ *   1. Receive parsed flags from citty + rawArgs for -- passthrough
- *   2. If --join: run join flow first (accepts token or URL)
+ *   2. If --join: run join flow first
  *   3. Load config → pick mesh (auto if 1, interactive picker if >1)
  *   4. Write per-session config to tmpdir (isolates mesh selection)
  *   5. Spawn claude with CLAUDEMESH_CONFIG_DIR + CLAUDEMESH_DISPLAY_NAME
@@ -18,73 +21,17 @@ import { createInterface } from "node:readline";
 import { loadConfig, getConfigPath } from "../state/config";
 import type { Config, JoinedMesh, GroupEntry } from "../state/config";
 
-// --- Arg parsing ---
+// Flags as parsed by citty (index.ts is the source of truth for definitions).
-
+export interface LaunchFlags {
-interface LaunchArgs {
+  name?: string;
-  name: string | null;
+  role?: string;
-  role: string | null;
+  groups?: string;
-  groups: string | null; // comma-separated, e.g. "frontend:lead,reviewers:member"
+  join?: string;
-  joinLink: string | null;
+  mesh?: string;
-  meshSlug: string | null;
+  "message-mode"?: string;
-  messageMode: "push" | "inbox" | "off" | null;
+  "system-prompt"?: string;
-  quiet: boolean;
+  yes?: boolean;
-  skipPermConfirm: boolean;
+  quiet?: boolean;
-  claudeArgs: string[];
-}
-
-function parseArgs(argv: string[]): LaunchArgs {
-  const result: LaunchArgs = {
-    name: null,
-    role: null,
-    groups: null,
-    joinLink: null,
-    meshSlug: null,
-    messageMode: null,
-    quiet: false,
-    skipPermConfirm: false,
-    claudeArgs: [],
-  };
-
-  let i = 0;
-  while (i < argv.length) {
-    const arg = argv[i]!;
-    if (arg === "--name" && i + 1 < argv.length) {
-      result.name = argv[++i]!;
-    } else if (arg.startsWith("--name=")) {
-      result.name = arg.slice("--name=".length);
-    } else if (arg === "--role" && i + 1 < argv.length) {
-      result.role = argv[++i]!;
-    } else if (arg.startsWith("--role=")) {
-      result.role = arg.slice("--role=".length);
-    } else if (arg === "--groups" && i + 1 < argv.length) {
-      result.groups = argv[++i]!;
-    } else if (arg.startsWith("--groups=")) {
-      result.groups = arg.slice("--groups=".length);
-    } else if (arg === "--join" && i + 1 < argv.length) {
-      result.joinLink = argv[++i]!;
-    } else if (arg.startsWith("--join=")) {
-      result.joinLink = arg.slice("--join=".length);
-    } else if (arg === "--mesh" && i + 1 < argv.length) {
-      result.meshSlug = argv[++i]!;
-    } else if (arg.startsWith("--mesh=")) {
-      result.meshSlug = arg.slice("--mesh=".length);
-    } else if (arg === "--inbox") {
-      result.messageMode = "inbox";
-    } else if (arg === "--no-messages") {
-      result.messageMode = "off";
-    } else if (arg === "--quiet") {
-      result.quiet = true;
-    } else if (arg === "-y" || arg === "--yes") {
-      result.skipPermConfirm = true;
-    } else if (arg === "--") {
-      result.claudeArgs.push(...argv.slice(i + 1));
-      break;
-    } else {
-      result.claudeArgs.push(arg);
-    }
-    i++;
-  }
-  return result;
 }
 
 // --- Interactive mesh picker ---
@@ -151,12 +98,12 @@ async function confirmPermissions(): Promise<void> {
 
   console.log(yellow(bold("  Autonomous mode")));
   console.log("");
-  console.log("  Claude will send and receive peer messages without asking");
+  console.log("  Claude will run with --dangerously-skip-permissions, bypassing");
-  console.log("  you first. Peers exchange text only — no file access,");
+  console.log("  ALL permission prompts — not just claudemesh tools.");
-  console.log("  no tool calls, no code execution.");
+  console.log("  Peers exchange text only — no file access, no tool calls.");
   console.log("");
-  console.log(dim("  Same as: claude --dangerously-skip-permissions"));
+  console.log(dim("  Without -y: only claudemesh tools are pre-approved (via allowedTools)."));
-  console.log(dim("  Skip this prompt: claudemesh launch -y"));
+  console.log(dim("  Use -y for autonomous agents. Omit it for shared/multi-person meshes."));
   console.log("");
 
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -206,8 +153,26 @@ function printBanner(name: string, meshSlug: string, role: string | null, groups
 
 // --- Main ---
 
-export async function runLaunch(extraArgs: string[]): Promise<void> {
+export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<void> {
-  const args = parseArgs(extraArgs);
+  // Extract args that follow "--" — passed straight through to claude.
+  const dashIdx = rawArgs.indexOf("--");
+  const claudePassthrough = dashIdx >= 0 ? rawArgs.slice(dashIdx + 1) : [];
+
+  // Normalise flags into the internal shape used below.
+  const args = {
+    name: flags.name ?? null,
+    role: flags.role ?? null,
+    groups: flags.groups ?? null,
+    joinLink: flags.join ?? null,
+    meshSlug: flags.mesh ?? null,
+    messageMode: (["push", "inbox", "off"].includes(flags["message-mode"] ?? "")
+      ? flags["message-mode"] as "push" | "inbox" | "off"
+      : null),
+    systemPrompt: flags["system-prompt"] ?? null,
+    quiet: flags.quiet ?? false,
+    skipPermConfirm: flags.yes ?? false,
+    claudeArgs: claudePassthrough,
+  };
 
   // 1. If --join, run join flow first.
   if (args.joinLink) {
@@ -318,6 +283,7 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
     version: 1,
     meshes: [mesh],
     displayName,
+    ...(role ? { role } : {}),
     ...(parsedGroups.length > 0 ? { groups: parsedGroups } : {}),
     messageMode,
   };
@@ -347,10 +313,15 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
     }
     filtered.push(args.claudeArgs[i]!);
   }
+  // --dangerously-skip-permissions is only added when the user explicitly
+  // passes -y / --yes. Without it, claudemesh tools still work because
+  // `claudemesh install` pre-approves them via allowedTools in settings.json.
+  // This keeps permissions tight for multi-person meshes.
   const claudeArgs = [
     "--dangerously-load-development-channels",
     "server:claudemesh",
-    "--dangerously-skip-permissions",
+    ...(args.skipPermConfirm ? ["--dangerously-skip-permissions"] : []),
+    ...(args.systemPrompt ? ["--system-prompt", args.systemPrompt] : []),
     ...filtered,
   ];
 
@@ -362,6 +333,7 @@ export async function runLaunch(extraArgs: string[]): Promise<void> {
       ...process.env,
       CLAUDEMESH_CONFIG_DIR: tmpDir,
       CLAUDEMESH_DISPLAY_NAME: displayName,
+      ...(role ? { CLAUDEMESH_ROLE: role } : {}),
     },
   });
 

apps/cli/src/commands/memory.ts

@@ -0,0 +1,63 @@
+/**
+ * `claudemesh remember <text> [--tags tag1,tag2]` — store a memory in the mesh.
+ * `claudemesh recall <query>`                      — search mesh memory.
+ *
+ * Useful for AI agents using bash when the MCP server isn't active.
+ */
+
+import { withMesh } from "./connect";
+
+export interface MemoryFlags {
+  mesh?: string;
+  tags?: string;
+  json?: boolean;
+}
+
+export async function runRemember(flags: MemoryFlags, content: string): Promise<void> {
+  const tags = flags.tags
+    ? flags.tags.split(",").map((t) => t.trim()).filter(Boolean)
+    : undefined;
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const id = await client.remember(content, tags);
+    if (flags.json) {
+      console.log(JSON.stringify({ id, content, tags }));
+      return;
+    }
+    if (id) {
+      console.log(`✓ Remembered (${id.slice(0, 8)})`);
+    } else {
+      console.error("✗ Failed to store memory");
+      process.exit(1);
+    }
+  });
+}
+
+export async function runRecall(flags: MemoryFlags, query: string): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const memories = await client.recall(query);
+
+    if (flags.json) {
+      console.log(JSON.stringify(memories, null, 2));
+      return;
+    }
+
+    if (memories.length === 0) {
+      console.log(dim("No memories found."));
+      return;
+    }
+
+    for (const m of memories) {
+      const tags = m.tags.length ? dim(` [${m.tags.join(", ")}]`) : "";
+      console.log(`${bold(m.id.slice(0, 8))}${tags}`);
+      console.log(`  ${m.content}`);
+      console.log(dim(`  ${m.rememberedBy} · ${new Date(m.rememberedAt).toLocaleString()}`));
+      console.log("");
+    }
+  });
+}

apps/cli/src/commands/peers.ts

@@ -0,0 +1,48 @@
+/**
+ * `claudemesh peers` — list connected peers in the mesh.
+ *
+ * Connects, fetches the peer list, prints it, disconnects.
+ */
+
+import { withMesh } from "./connect";
+
+export interface PeersFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runPeers(flags: PeersFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+  const green = (s: string) => (useColor ? `\x1b[32m${s}\x1b[39m` : s);
+  const yellow = (s: string) => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const peers = await client.listPeers();
+
+    if (flags.json) {
+      console.log(JSON.stringify(peers, null, 2));
+      return;
+    }
+
+    if (peers.length === 0) {
+      console.log(dim(`No peers connected on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    console.log(bold(`Peers on ${mesh.slug}`) + dim(` (${peers.length})`));
+    console.log("");
+    for (const p of peers) {
+      const groups = p.groups.length
+        ? " [" + p.groups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`).join(", ") + "]"
+        : "";
+      const statusIcon = p.status === "working" ? yellow("●") : green("●");
+      const name = bold(p.displayName);
+      const summary = p.summary ? dim(`  ${p.summary}`) : "";
+      console.log(`  ${statusIcon} ${name}${groups}${summary}`);
+    }
+    console.log("");
+  });
+}

apps/cli/src/commands/remind.ts

@@ -0,0 +1,134 @@
+/**
+ * `claudemesh remind <message> --in <duration> | --at <time>`
+ * `claudemesh remind list`
+ * `claudemesh remind cancel <id>`
+ *
+ * Human-facing interface to the broker's scheduled message delivery.
+ */
+
+import { withMesh } from "./connect";
+
+export interface RemindFlags {
+  mesh?: string;
+  in?: string;       // e.g. "2h", "30m", "90s"
+  at?: string;       // ISO or HH:MM
+  to?: string;       // default: self
+  json?: boolean;
+}
+
+function parseDuration(raw: string): number | null {
+  const m = raw.trim().match(/^(\d+(?:\.\d+)?)\s*(s|sec|m|min|h|hr|d|day)?$/i);
+  if (!m) return null;
+  const n = parseFloat(m[1]!);
+  const unit = (m[2] ?? "s").toLowerCase();
+  if (unit.startsWith("d")) return n * 86_400_000;
+  if (unit.startsWith("h")) return n * 3_600_000;
+  if (unit.startsWith("m")) return n * 60_000;
+  return n * 1_000;
+}
+
+function parseDeliverAt(flags: RemindFlags): number | null {
+  if (flags.in) {
+    const ms = parseDuration(flags.in);
+    if (ms === null) return null;
+    return Date.now() + ms;
+  }
+  if (flags.at) {
+    // Try HH:MM first
+    const hm = flags.at.match(/^(\d{1,2}):(\d{2})$/);
+    if (hm) {
+      const now = new Date();
+      const target = new Date(now);
+      target.setHours(parseInt(hm[1]!, 10), parseInt(hm[2]!, 10), 0, 0);
+      if (target <= now) target.setDate(target.getDate() + 1); // next occurrence
+      return target.getTime();
+    }
+    const ts = Date.parse(flags.at);
+    return isNaN(ts) ? null : ts;
+  }
+  return null;
+}
+
+export async function runRemind(
+  flags: RemindFlags,
+  positional: string[],
+): Promise<void> {
+  const useColor = !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  const action = positional[0];
+
+  // claudemesh remind list
+  if (action === "list") {
+    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+      const scheduled = await client.listScheduled();
+      if (flags.json) { console.log(JSON.stringify(scheduled, null, 2)); return; }
+      if (scheduled.length === 0) { console.log(dim("No pending reminders.")); return; }
+      for (const m of scheduled) {
+        const when = new Date(m.deliverAt).toLocaleString();
+        const to = m.to === client.getSessionPubkey() ? dim("(self)") : m.to;
+        console.log(`  ${bold(m.id.slice(0, 8))} → ${to} at ${when}`);
+        console.log(`  ${dim(m.message.slice(0, 80))}`);
+        console.log("");
+      }
+    });
+    return;
+  }
+
+  // claudemesh remind cancel <id>
+  if (action === "cancel") {
+    const id = positional[1];
+    if (!id) { console.error("Usage: claudemesh remind cancel <id>"); process.exit(1); }
+    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+      const ok = await client.cancelScheduled(id);
+      if (ok) console.log(`✓ Cancelled ${id}`);
+      else { console.error(`✗ Not found or already fired: ${id}`); process.exit(1); }
+    });
+    return;
+  }
+
+  // claudemesh remind <message> --in <duration> | --at <time>
+  const message = action ?? positional.join(" ");
+  if (!message) {
+    console.error("Usage: claudemesh remind <message> --in <duration>");
+    console.error("       claudemesh remind <message> --at <time>");
+    console.error("       claudemesh remind list");
+    console.error("       claudemesh remind cancel <id>");
+    process.exit(1);
+  }
+
+  const deliverAt = parseDeliverAt(flags);
+  if (deliverAt === null) {
+    console.error('Specify when: --in <duration> (e.g. "2h", "30m") or --at <time> (e.g. "15:00")');
+    process.exit(1);
+  }
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    // Determine target: --to flag or self
+    let targetSpec: string;
+    if (flags.to && flags.to !== "self") {
+      if (flags.to.startsWith("@") || flags.to === "*" || /^[0-9a-f]{64}$/i.test(flags.to)) {
+        targetSpec = flags.to;
+      } else {
+        const peers = await client.listPeers();
+        const match = peers.find((p) => p.displayName.toLowerCase() === flags.to!.toLowerCase());
+        if (!match) {
+          console.error(`Peer "${flags.to}" not found. Online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`);
+          process.exit(1);
+        }
+        targetSpec = match.pubkey;
+      }
+    } else {
+      targetSpec = client.getSessionPubkey() ?? "*";
+    }
+
+    const result = await client.scheduleMessage(targetSpec, message, deliverAt);
+    if (!result) { console.error("✗ Broker did not acknowledge — check connection"); process.exit(1); }
+
+    if (flags.json) { console.log(JSON.stringify(result)); return; }
+    const when = new Date(result.deliverAt).toLocaleString();
+    const toLabel = !flags.to || flags.to === "self" ? "yourself" : flags.to;
+    console.log(`✓ Reminder set (${result.scheduledId.slice(0, 8)}): "${message}" → ${toLabel} at ${when}`);
+  });
+}

apps/cli/src/commands/send.ts

@@ -0,0 +1,51 @@
+/**
+ * `claudemesh send <to> <message>` — send a message to a peer or group.
+ *
+ * <to> can be:
+ *   - a display name  ("Mou")
+ *   - a pubkey hex    ("abc123...")
+ *   - @group          ("@flexicar")
+ *   - *               (broadcast to all)
+ */
+
+import { withMesh } from "./connect";
+import type { Priority } from "../ws/client";
+
+export interface SendFlags {
+  mesh?: string;
+  priority?: string;
+}
+
+export async function runSend(flags: SendFlags, to: string, message: string): Promise<void> {
+  const priority: Priority =
+    flags.priority === "now" ? "now"
+    : flags.priority === "low" ? "low"
+    : "next";
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    // Resolve display name → pubkey for direct messages.
+    // If `to` starts with @, *, or looks like a hex pubkey, use as-is.
+    let targetSpec = to;
+    if (!to.startsWith("@") && to !== "*" && !/^[0-9a-f]{64}$/i.test(to)) {
+      // Treat as display name — look up pubkey via list_peers.
+      const peers = await client.listPeers();
+      const match = peers.find(
+        (p) => p.displayName.toLowerCase() === to.toLowerCase(),
+      );
+      if (!match) {
+        const names = peers.map((p) => p.displayName).join(", ");
+        console.error(`Peer "${to}" not found. Online: ${names || "(none)"}`);
+        process.exit(1);
+      }
+      targetSpec = match.pubkey;
+    }
+
+    const result = await client.send(targetSpec, message, priority);
+    if (result.ok) {
+      console.log(`✓ Sent to ${to}${result.messageId ? ` (${result.messageId.slice(0, 8)})` : ""}`);
+    } else {
+      console.error(`✗ Send failed: ${result.error ?? "unknown error"}`);
+      process.exit(1);
+    }
+  });
+}

apps/cli/src/commands/state.ts

@@ -0,0 +1,75 @@
+/**
+ * `claudemesh state get <key>`    — read a shared state value
+ * `claudemesh state set <key> <value>` — write a shared state value
+ * `claudemesh state list`          — list all state entries
+ */
+
+import { withMesh } from "./connect";
+
+export interface StateFlags {
+  mesh?: string;
+  json?: boolean;
+}
+
+export async function runStateGet(flags: StateFlags, key: string): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    const entry = await client.getState(key);
+    if (!entry) {
+      console.log(dim(`(not set)`));
+      return;
+    }
+    if (flags.json) {
+      console.log(JSON.stringify(entry, null, 2));
+      return;
+    }
+    const val = typeof entry.value === "string" ? entry.value : JSON.stringify(entry.value);
+    console.log(val);
+    console.log(dim(`  set by ${entry.updatedBy} at ${new Date(entry.updatedAt).toLocaleString()}`));
+  });
+}
+
+export async function runStateSet(flags: StateFlags, key: string, value: string): Promise<void> {
+  // Try to parse as JSON so numbers/booleans/objects work; fall back to string.
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    parsed = value;
+  }
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    await client.setState(key, parsed);
+    console.log(`✓ ${key} = ${JSON.stringify(parsed)}`);
+  });
+}
+
+export async function runStateList(flags: StateFlags): Promise<void> {
+  const useColor =
+    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
+  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
+  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
+
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
+    const entries = await client.listState();
+
+    if (flags.json) {
+      console.log(JSON.stringify(entries, null, 2));
+      return;
+    }
+
+    if (entries.length === 0) {
+      console.log(dim(`No state on mesh "${mesh.slug}".`));
+      return;
+    }
+
+    for (const e of entries) {
+      const val = typeof e.value === "string" ? e.value : JSON.stringify(e.value);
+      console.log(`${bold(e.key)}: ${val}`);
+      console.log(dim(`  ${e.updatedBy} · ${new Date(e.updatedAt).toLocaleString()}`));
+    }
+  });
+}

apps/cli/src/crypto/file-crypto.ts

@@ -0,0 +1,90 @@
+/**
+ * File encryption for claudemesh E2E file sharing.
+ *
+ * Symmetric: crypto_secretbox_easy with random Kf (32-byte key).
+ * Key wrapping: crypto_box_seal to recipient's X25519 pub (converted from ed25519).
+ * Key opening: crypto_box_seal_open with own X25519 keypair.
+ */
+
+import { ensureSodium } from "./keypair";
+
+export interface EncryptedFile {
+  ciphertext: Uint8Array;  // secretbox ciphertext (includes MAC)
+  nonce: string;           // base64 24-byte nonce
+  key: Uint8Array;         // 32-byte symmetric Kf (keep in memory only)
+}
+
+/**
+ * Encrypt file bytes with a fresh random symmetric key.
+ * Returns ciphertext, nonce (base64), and the plaintext Kf.
+ */
+export async function encryptFile(plaintext: Uint8Array): Promise<EncryptedFile> {
+  const sodium = await ensureSodium();
+  const key = sodium.randombytes_buf(sodium.crypto_secretbox_KEYBYTES);
+  const nonce = sodium.randombytes_buf(sodium.crypto_secretbox_NONCEBYTES);
+  const ciphertext = sodium.crypto_secretbox_easy(plaintext, nonce, key);
+  return {
+    ciphertext,
+    nonce: sodium.to_base64(nonce, sodium.base64_variants.ORIGINAL),
+    key,
+  };
+}
+
+/**
+ * Decrypt file bytes with the symmetric key Kf.
+ * Returns null if decryption fails.
+ */
+export async function decryptFile(
+  ciphertext: Uint8Array,
+  nonceB64: string,
+  key: Uint8Array,
+): Promise<Uint8Array | null> {
+  const sodium = await ensureSodium();
+  try {
+    const nonce = sodium.from_base64(nonceB64, sodium.base64_variants.ORIGINAL);
+    return sodium.crypto_secretbox_open_easy(ciphertext, nonce, key);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Seal Kf for a recipient using crypto_box_seal (ephemeral sender key).
+ * recipientPubkeyHex: ed25519 pubkey of recipient (64 hex chars).
+ * Returns base64 sealed box.
+ */
+export async function sealKeyForPeer(
+  kf: Uint8Array,
+  recipientPubkeyHex: string,
+): Promise<string> {
+  const sodium = await ensureSodium();
+  const recipientCurve = sodium.crypto_sign_ed25519_pk_to_curve25519(
+    sodium.from_hex(recipientPubkeyHex),
+  );
+  const sealed = sodium.crypto_box_seal(kf, recipientCurve);
+  return sodium.to_base64(sealed, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Open a sealed key blob using own ed25519 keypair (converted to X25519).
+ * Returns the 32-byte Kf or null if decryption fails.
+ */
+export async function openSealedKey(
+  sealedB64: string,
+  myPubkeyHex: string,
+  mySecretKeyHex: string,
+): Promise<Uint8Array | null> {
+  const sodium = await ensureSodium();
+  try {
+    const myCurvePub = sodium.crypto_sign_ed25519_pk_to_curve25519(
+      sodium.from_hex(myPubkeyHex),
+    );
+    const myCurveSec = sodium.crypto_sign_ed25519_sk_to_curve25519(
+      sodium.from_hex(mySecretKeyHex),
+    );
+    const sealed = sodium.from_base64(sealedB64, sodium.base64_variants.ORIGINAL);
+    return sodium.crypto_box_seal_open(sealed, myCurvePub, myCurveSec);
+  } catch {
+    return null;
+  }
+}

apps/cli/src/index.ts

@@ -1,13 +1,15 @@
 /**
  * claudemesh-cli entry point.
  *
+ * Uses citty to define commands and flags. --help is generated from
+ * the command definitions — the flag list here IS the documentation.
+ *
  * Dispatches between two modes:
  *   - `claudemesh mcp`           → MCP server (stdio transport)
  *   - `claudemesh <subcommand>`  → CLI subcommand
- *
- * Claude Code invokes the `mcp` mode via stdio. Humans use all others.
  */
 
+import { defineCommand, runMain } from "citty";
 import { startMcpServer } from "./mcp/server";
 import { runInstall, runUninstall } from "./commands/install";
 import { runJoin } from "./commands/join";
@@ -19,98 +21,258 @@ import { runLaunch } from "./commands/launch";
 import { runStatus } from "./commands/status";
 import { runDoctor } from "./commands/doctor";
 import { runWelcome } from "./commands/welcome";
+import { runPeers } from "./commands/peers";
+import { runSend } from "./commands/send";
+import { runInbox } from "./commands/inbox";
+import { runStateGet, runStateSet, runStateList } from "./commands/state";
+import { runRemember, runRecall } from "./commands/memory";
+import { runInfo } from "./commands/info";
+import { runRemind } from "./commands/remind";
 import { VERSION } from "./version";
 
-const HELP = `claudemesh v${VERSION} — peer mesh for Claude Code sessions
+const launch = defineCommand({
-
+  meta: {
-Usage:
+    name: "launch",
-  claudemesh <command> [args]
+    description: "Launch Claude Code connected to a mesh with real-time peer messaging",
-
+  },
-Commands:
+  args: {
-  install         Register MCP + Stop/UserPromptSubmit status hooks
+    name: {
-                  (add --no-hooks for bare MCP registration)
+      type: "string",
-  uninstall       Remove MCP server + hooks
+      description: "Display name for this session",
-  launch [opts]   Launch Claude Code with real-time push messages
+    },
-                  --name <name>   Display name for this session
+    role: {
-                  --mesh <slug>   Select mesh (picker if >1, omitted)
+      type: "string",
-                  --join <url>    Join a mesh before launching
+      description: "Role tag (dev, lead, analyst — free-form)",
-                  --quiet         Skip the info banner
+    },
-                  -- <args>       Pass remaining args to claude
+    groups: {
-  join <url>      Join a mesh via https://claudemesh.com/join/... URL
+      type: "string",
-  list            Show all joined meshes
+      description: 'Groups to join: "group:role,group2" — colon sets role. Hierarchy via slash: "eng/frontend:lead"',
-  leave <slug>    Leave a joined mesh
+    },
-  status          Health report: broker reachability per joined mesh
+    mesh: {
-  doctor          Diagnostic checks (install, config, keypairs, PATH)
+      type: "string",
-  seed-test-mesh  Dev-only: inject a mesh into config (skips invite flow)
+      description: "Select mesh by slug (interactive picker if omitted and >1 joined)",
-  mcp             Start MCP server (stdio) — invoked by Claude Code
+    },
-  --help, -h      Show this help
+    join: {
-  --version, -v   Show the CLI version
+      type: "string",
-
+      description: "Join a mesh via invite URL before launching",
-Environment:
+    },
-  CLAUDEMESH_BROKER_URL    Override broker URL (default: wss://ic.claudemesh.com/ws)
+    "message-mode": {
-  CLAUDEMESH_CONFIG_DIR    Override config directory (default: ~/.claudemesh/)
+      type: "string",
-  CLAUDEMESH_DEBUG=1       Verbose logging
+      description: "push (default) | inbox | off — controls how peer messages are delivered",
-`;
+    },
-
+    "system-prompt": {
-const cmd = process.argv[2];
+      type: "string",
-const args = process.argv.slice(3);
+      description: "Set Claude's system prompt for this session",
-
+    },
-async function main(): Promise<void> {
+    yes: {
-  switch (cmd) {
+      type: "boolean",
-    case "mcp":
+      alias: "y",
-      await startMcpServer();
+      description: "Skip permission confirmation",
-      return;
+      default: false,
-    case "install":
+    },
-      runInstall(args);
+    quiet: {
-      return;
+      type: "boolean",
-    case "uninstall":
+      description: "Skip banner and all interactive prompts",
-      runUninstall();
+      default: false,
-      return;
+    },
-    case "hook":
+  },
-      await runHook(args);
+  run({ args, rawArgs }) {
-      return;
+    // Forward to the existing launch runner, preserving -- passthrough to claude.
-    case "launch":
+    return runLaunch(args, rawArgs);
-      await runLaunch(args);
+  },
-      return;
-    case "join":
-      await runJoin(args);
-      return;
-    case "list":
-      runList();
-      return;
-    case "leave":
-      runLeave(args);
-      return;
-    case "status":
-      await runStatus();
-      return;
-    case "doctor":
-      await runDoctor();
-      return;
-    case "seed-test-mesh":
-      runSeedTestMesh(args);
-      return;
-    case "--version":
-    case "-v":
-    case "version":
-      console.log(VERSION);
-      return;
-    case "--help":
-    case "-h":
-    case "help":
-      console.log(HELP);
-      return;
-    case undefined:
-      runWelcome();
-      return;
-    default:
-      console.error(`Unknown command: ${cmd}`);
-      console.error("Run `claudemesh --help` for usage.");
-      process.exit(1);
-  }
-}
-
-main().catch((e) => {
-  console.error(`claudemesh: ${e instanceof Error ? e.message : String(e)}`);
-  process.exit(1);
 });
+
+const install = defineCommand({
+  meta: {
+    name: "install",
+    description: "Register MCP server + status hooks with Claude Code",
+  },
+  args: {
+    "no-hooks": {
+      type: "boolean",
+      description: "Register MCP server only, skip hooks",
+      default: false,
+    },
+  },
+  run({ rawArgs }) {
+    runInstall(rawArgs);
+  },
+});
+
+const join = defineCommand({
+  meta: {
+    name: "join",
+    description: "Join a mesh via invite URL",
+  },
+  args: {
+    url: {
+      type: "positional",
+      description: "Invite URL (https://claudemesh.com/join/...)",
+      required: true,
+    },
+  },
+  run({ args }) {
+    return runJoin([args.url]);
+  },
+});
+
+const leave = defineCommand({
+  meta: {
+    name: "leave",
+    description: "Leave a joined mesh",
+  },
+  args: {
+    slug: {
+      type: "positional",
+      description: "Mesh slug to leave",
+      required: true,
+    },
+  },
+  run({ args }) {
+    runLeave([args.slug]);
+  },
+});
+
+const main = defineCommand({
+  meta: {
+    name: "claudemesh",
+    version: VERSION,
+    description: "Peer mesh for Claude Code sessions",
+  },
+  subCommands: {
+    launch,
+    install,
+    uninstall: defineCommand({
+      meta: { name: "uninstall", description: "Remove MCP server and hooks" },
+      run() { runUninstall(); },
+    }),
+    join,
+    list: defineCommand({
+      meta: { name: "list", description: "Show joined meshes and identities" },
+      run() { runList(); },
+    }),
+    leave,
+    peers: defineCommand({
+      meta: { name: "peers", description: "List connected peers in the mesh" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runPeers(args); },
+    }),
+    send: defineCommand({
+      meta: { name: "send", description: "Send a message to a peer, group, or broadcast" },
+      args: {
+        to: { type: "positional", description: "Recipient: display name, @group, pubkey, or *", required: true },
+        message: { type: "positional", description: "Message text", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        priority: { type: "string", description: "now | next (default) | low" },
+      },
+      async run({ args }) { await runSend(args, args.to, args.message); },
+    }),
+    inbox: defineCommand({
+      meta: { name: "inbox", description: "Read pending peer messages" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+        wait: { type: "string", description: "Seconds to wait for broker delivery (default: 1)" },
+      },
+      async run({ args }) {
+        await runInbox({ ...args, wait: args.wait ? parseInt(args.wait, 10) : undefined });
+      },
+    }),
+    state: defineCommand({
+      meta: { name: "state", description: "Read or write shared mesh state" },
+      args: {
+        action: { type: "positional", description: "get | set | list", required: true },
+        key: { type: "positional", description: "State key (required for get/set)" },
+        value: { type: "positional", description: "Value to set (required for set)" },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) {
+        if (args.action === "list") {
+          await runStateList(args);
+        } else if (args.action === "get") {
+          if (!args.key) { console.error("Usage: claudemesh state get <key>"); process.exit(1); }
+          await runStateGet(args, args.key);
+        } else if (args.action === "set") {
+          if (!args.key || !args.value) { console.error("Usage: claudemesh state set <key> <value>"); process.exit(1); }
+          await runStateSet(args, args.key, args.value);
+        } else {
+          console.error(`Unknown action "${args.action}". Use: get, set, list`);
+          process.exit(1);
+        }
+      },
+    }),
+    info: defineCommand({
+      meta: { name: "info", description: "Show mesh overview: slug, broker, peer count, state keys" },
+      args: {
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runInfo(args); },
+    }),
+    remember: defineCommand({
+      meta: { name: "remember", description: "Store a memory in the mesh (accessible to all peers)" },
+      args: {
+        content: { type: "positional", description: "Text to remember", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        tags: { type: "string", description: "Comma-separated tags (e.g. task,context)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runRemember(args, args.content); },
+    }),
+    recall: defineCommand({
+      meta: { name: "recall", description: "Search mesh memory by keyword or phrase" },
+      args: {
+        query: { type: "positional", description: "Search query", required: true },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args }) { await runRecall(args, args.query); },
+    }),
+    remind: defineCommand({
+      meta: { name: "remind", description: "Schedule a reminder or delayed message via the broker" },
+      args: {
+        message: { type: "positional", description: "Message text, or: list | cancel <id>", required: false },
+        extra: { type: "positional", description: "Additional positional args", required: false },
+        in: { type: "string", description: 'Deliver after duration: "2h", "30m", "90s"' },
+        at: { type: "string", description: 'Deliver at time: "15:00" or ISO timestamp' },
+        to: { type: "string", description: "Recipient (default: self). Name, @group, pubkey, or *" },
+        mesh: { type: "string", description: "Mesh slug (auto-selected if only one joined)" },
+        json: { type: "boolean", description: "Output as JSON", default: false },
+      },
+      async run({ args, rawArgs }) {
+        // Collect positional args from rawArgs (before any flags)
+        const positionals = rawArgs.filter((a) => !a.startsWith("-"));
+        await runRemind(args, positionals);
+      },
+    }),
+    status: defineCommand({
+      meta: { name: "status", description: "Check broker reachability for each joined mesh" },
+      async run() { await runStatus(); },
+    }),
+    doctor: defineCommand({
+      meta: { name: "doctor", description: "Diagnose install, config, keypairs, and PATH" },
+      async run() { await runDoctor(); },
+    }),
+    mcp: defineCommand({
+      meta: { name: "mcp", description: "Start MCP server (stdio — invoked by Claude Code, not users)" },
+      async run() { await startMcpServer(); },
+    }),
+    "seed-test-mesh": defineCommand({
+      meta: { name: "seed-test-mesh", description: "Dev only: inject a mesh into config (skips invite flow)" },
+      run({ rawArgs }) { runSeedTestMesh(rawArgs); },
+    }),
+    hook: defineCommand({
+      meta: { name: "hook", description: "Internal hook handler (invoked by Claude Code hooks)" },
+      async run({ rawArgs }) { await runHook(rawArgs); },
+    }),
+  },
+  run() {
+    runWelcome();
+  },
+});
+
+runMain(main);

apps/cli/src/mcp/server.ts

@@ -123,13 +123,15 @@ function decryptFailedWarning(senderPubkey: string): string {
 
 function formatPush(p: InboundPush, meshSlug: string): string {
   const body = p.plaintext ?? decryptFailedWarning(p.senderPubkey);
-  return `[${meshSlug}] from ${p.senderPubkey.slice(0, 12)}… (${p.priority}, ${p.createdAt}):\n${body}`;
+  const tag = p.subtype === "reminder" ? " [REMINDER]" : "";
+  return `[${meshSlug}]${tag} from ${p.senderPubkey.slice(0, 12)}… (${p.priority}, ${p.createdAt}):\n${body}`;
 }
 
 export async function startMcpServer(): Promise<void> {
   const config = loadConfig();
 
   const myName = config.displayName ?? "unnamed";
+  const myRole = config.role ?? process.env.CLAUDEMESH_ROLE ?? null;
   const myGroups = (config.groups ?? []).map(g => `@${g.name}${g.role ? ':' + g.role : ''}`).join(', ') || "none";
   const messageMode = config.messageMode ?? "push";
 
@@ -141,11 +143,13 @@ export async function startMcpServer(): Promise<void> {
         tools: {},
       },
       instructions: `## Identity
-You are "${myName}" — a peer in the claudemesh network. Your groups: ${myGroups}. You are one of several Claude Code sessions connected to the same mesh. No orchestrator exists — peers are equals. Your identity comes from your name and group roles, not from a central authority.
+You are "${myName}"${myRole ? ` (${myRole})` : ""} — a peer in the claudemesh network. Your groups: ${myGroups}. You are one of several Claude Code sessions connected to the same mesh. No orchestrator exists — peers are equals. Your identity comes from your name and group roles, not from a central authority.
 
 ## Responding to messages
 When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATELY. Pause your current task, reply via send_message, then resume. Read from_name, mesh_slug, and priority from the channel attributes. Reply by setting \`to\` to the sender's from_name (display name). Stay in character per your system prompt. Do not ignore low-priority messages — acknowledge them briefly even if you defer action.
 
+If the channel meta contains \`subtype: reminder\`, this is a scheduled reminder you set for yourself — act on it immediately (no reply needed).
+
 ## Tools
 | Tool | Description |
 |------|-------------|
@@ -187,6 +191,9 @@ When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATEL
 | claim_task(id) | Claim an unclaimed task. |
 | complete_task(id, result?) | Mark task done with optional result. |
 | list_tasks(status?, assignee?) | List tasks filtered by status/assignee. |
+| schedule_reminder(message, in_seconds?, deliver_at?, to?) | Schedule a reminder to yourself (no \`to\`) or a delayed message to a peer/group. Delivered as a push with \`subtype: reminder\` in the channel meta. |
+| list_scheduled() | List pending scheduled reminders and messages. |
+| cancel_scheduled(id) | Cancel a pending scheduled item. |
 
 If multiple meshes are joined, prefix \`to\` with \`<mesh-slug>:\` to disambiguate (e.g. \`dev-team:Alice\`).
 
@@ -326,9 +333,15 @@ Your message mode is "${messageMode}".
       case "message_status": {
         const { id } = (args ?? {}) as { id?: string };
         if (!id) return text("message_status: `id` required", true);
-        const client = allClients()[0];
+        const clients = allClients();
-        if (!client) return text("message_status: not connected", true);
+        if (!clients.length) return text("message_status: not connected", true);
-        const result = await client.messageStatus(id);
+        // Try each connected mesh client — we don't know which mesh the
+        // messageId belongs to, so query all and return the first hit.
+        let result = null;
+        for (const c of clients) {
+          result = await c.messageStatus(id);
+          if (result) break;
+        }
         if (!result) return text(`Message ${id} not found or timed out.`);
         const recipientLines = result.recipients.map(
           (r: { name: string; pubkey: string; status: string }) =>
@@ -437,14 +450,141 @@ Your message mode is "${messageMode}".
         return text(`Forgotten: ${id}`);
       }
 
+      // --- Scheduled messages ---
+      case "schedule_reminder": {
+        const sArgs = (args ?? {}) as {
+          message?: string;
+          to?: string;
+          deliver_at?: number;
+          in_seconds?: number;
+        };
+        if (!sArgs.message) return text("schedule_reminder: `message` required", true);
+
+        let deliverAt: number;
+        if (sArgs.deliver_at) {
+          deliverAt = Number(sArgs.deliver_at);
+        } else if (sArgs.in_seconds) {
+          deliverAt = Date.now() + Number(sArgs.in_seconds) * 1_000;
+        } else {
+          return text("schedule_reminder: provide `deliver_at` (ms timestamp) or `in_seconds`", true);
+        }
+
+        const isSelf = !sArgs.to;
+        let targetSpec: string;
+        if (isSelf) {
+          // Self-reminder: target own session pubkey
+          targetSpec = client.getSessionPubkey() ?? "*";
+        } else {
+          const to = sArgs.to!;
+          // Resolve display name → pubkey if not a raw spec
+          if (!to.startsWith("@") && to !== "*" && !/^[0-9a-f]{64}$/i.test(to)) {
+            const peers = await client.listPeers();
+            const match = peers.find((p) => p.displayName.toLowerCase() === to.toLowerCase());
+            if (!match) {
+              const names = peers.map((p) => p.displayName).join(", ");
+              return text(`schedule_reminder: peer "${to}" not found. Online: ${names || "(none)"}`, true);
+            }
+            targetSpec = match.pubkey;
+          } else {
+            targetSpec = to;
+          }
+        }
+
+        const result = await client.scheduleMessage(targetSpec, sArgs.message, deliverAt, true);
+        if (!result) return text("schedule_reminder: broker did not acknowledge — check connection", true);
+        const when = new Date(result.deliverAt).toISOString();
+        return text(
+          isSelf
+            ? `Self-reminder scheduled (${result.scheduledId.slice(0, 8)}): "${sArgs.message.slice(0, 60)}" at ${when}`
+            : `Reminder to "${sArgs.to}" scheduled (${result.scheduledId.slice(0, 8)}) for ${when}`,
+        );
+      }
+      case "list_scheduled": {
+        const scheduled = await client.listScheduled();
+        if (scheduled.length === 0) return text("No pending scheduled messages.");
+        const lines = scheduled.map((m) =>
+          `- [${m.id.slice(0, 8)}] → ${m.to === client.getSessionPubkey() ? "self (reminder)" : m.to} at ${new Date(m.deliverAt).toISOString()}: "${m.message.slice(0, 60)}${m.message.length > 60 ? "…" : ""}"`,
+        );
+        return text(`${scheduled.length} scheduled:\n${lines.join("\n")}`);
+      }
+      case "cancel_scheduled": {
+        const { id: schedId } = (args ?? {}) as { id?: string };
+        if (!schedId) return text("cancel_scheduled: `id` required", true);
+        const ok = await client.cancelScheduled(schedId);
+        return text(ok ? `Cancelled: ${schedId}` : `Not found or already fired: ${schedId}`, !ok);
+      }
+
       // --- Files ---
       case "share_file": {
-        const { path: filePath, name: fileName, tags } = (args ?? {}) as { path?: string; name?: string; tags?: string[] };
+        const { path: filePath, name: fileName, tags, to: fileTo } = (args ?? {}) as { path?: string; name?: string; tags?: string[]; to?: string };
         if (!filePath) return text("share_file: `path` required", true);
         const { existsSync } = await import("node:fs");
         if (!existsSync(filePath)) return text(`share_file: file not found: ${filePath}`, true);
         const client = allClients()[0];
         if (!client) return text("share_file: not connected", true);
+
+        // If 'to' specified, do E2E encryption
+        if (fileTo) {
+          const { encryptFile, sealKeyForPeer } = await import("../crypto/file-crypto");
+          const { readFileSync, writeFileSync, mkdtempSync, unlinkSync, rmdirSync } = await import("node:fs");
+          const { tmpdir } = await import("node:os");
+          const { join, basename } = await import("node:path");
+
+          // Resolve target peer pubkey
+          const peers = await client.listPeers();
+          const targetPeer = peers.find(p => p.pubkey === fileTo || p.displayName === fileTo);
+          if (!targetPeer) {
+            return text(`share_file: peer not found: ${fileTo}`, true);
+          }
+
+          // Read and encrypt file
+          const plaintext = readFileSync(filePath);
+          const { ciphertext, nonce, key } = await encryptFile(new Uint8Array(plaintext));
+
+          // Seal Kf for target peer
+          const sealedForTarget = await sealKeyForPeer(key, targetPeer.pubkey);
+
+          // Seal Kf for ourselves (owner)
+          const myPubkey = client.getSessionPubkey();
+          const sealedForSelf = myPubkey ? await sealKeyForPeer(key, myPubkey) : null;
+
+          const fileKeys = [
+            { peerPubkey: targetPeer.pubkey, sealedKey: sealedForTarget },
+            ...(sealedForSelf && myPubkey ? [{ peerPubkey: myPubkey, sealedKey: sealedForSelf }] : []),
+          ];
+
+          // Build combined buffer: nonce (24 bytes) + ciphertext
+          const { ensureSodium } = await import("../crypto/keypair");
+          const sodium = await ensureSodium();
+          const nonceBytes = sodium.from_base64(nonce, sodium.base64_variants.ORIGINAL);
+          const combined = new Uint8Array(nonceBytes.length + ciphertext.length);
+          combined.set(nonceBytes, 0);
+          combined.set(ciphertext, nonceBytes.length);
+
+          const baseName = fileName ?? basename(filePath);
+          const tmpDir = mkdtempSync(join(tmpdir(), "cm-"));
+          const tmpPath = join(tmpDir, baseName);
+          writeFileSync(tmpPath, combined);
+
+          try {
+            const fileId = await client.uploadFile(tmpPath, client.meshId, client.meshSlug, {
+              name: baseName,
+              tags,
+              persistent: true,
+              encrypted: true,
+              ownerPubkey: myPubkey ?? undefined,
+              fileKeys,
+            });
+            return text(`Shared (E2E encrypted): ${baseName} → ${targetPeer.displayName} (${fileId})`);
+          } catch (e) {
+            return text(`share_file: upload failed — ${e instanceof Error ? e.message : String(e)}`, true);
+          } finally {
+            try { unlinkSync(tmpPath); } catch { /* ignore */ }
+            try { rmdirSync(tmpDir); } catch { /* ignore */ }
+          }
+        }
+
+        // Plain (unencrypted) upload — existing code
         try {
           const fileId = await client.uploadFile(filePath, client.meshId, client.meshSlug, {
             name: fileName, tags, persistent: true,
@@ -462,6 +602,43 @@ Your message mode is "${messageMode}".
         if (!client) return text("get_file: not connected", true);
         const result = await client.getFile(id);
         if (!result) return text(`get_file: file ${id} not found`, true);
+
+        if (result.encrypted) {
+          if (!result.sealedKey) return text("get_file: encrypted file — no decryption key available for your session", true);
+          const { openSealedKey, decryptFile } = await import("../crypto/file-crypto");
+          const { ensureSodium } = await import("../crypto/keypair");
+          const myPubkey = client.getSessionPubkey();
+          const mySecret = client.getSessionSecretKey();
+
+          if (!myPubkey || !mySecret) {
+            return text("get_file: no session keypair — cannot decrypt", true);
+          }
+
+          const kf = await openSealedKey(result.sealedKey, myPubkey, mySecret);
+          if (!kf) return text("get_file: failed to open sealed key", true);
+
+          // Download file bytes from presigned URL
+          const resp = await fetch(result.url, { signal: AbortSignal.timeout(30_000) });
+          if (!resp.ok) return text(`get_file: download failed (${resp.status})`, true);
+          const buf = new Uint8Array(await resp.arrayBuffer());
+
+          // Wire format: first 24 bytes = nonce, rest = ciphertext
+          const sodium = await ensureSodium();
+          const NONCE_BYTES = sodium.crypto_secretbox_NONCEBYTES; // 24
+          const nonce = sodium.to_base64(buf.slice(0, NONCE_BYTES), sodium.base64_variants.ORIGINAL);
+          const ciphertext = buf.slice(NONCE_BYTES);
+
+          const plaintext = await decryptFile(ciphertext, nonce, kf);
+          if (!plaintext) return text("get_file: decryption failed", true);
+
+          const { writeFileSync, mkdirSync } = await import("node:fs");
+          const { dirname } = await import("node:path");
+          mkdirSync(dirname(save_to), { recursive: true });
+          writeFileSync(save_to, plaintext);
+          return text(`Downloaded and decrypted: ${result.name} → ${save_to}`);
+        }
+
+        // Unencrypted — existing download logic
         const res = await fetch(result.url, { signal: AbortSignal.timeout(30_000) });
         if (!res.ok) return text(`get_file: download failed (${res.status})`, true);
         const { writeFileSync, mkdirSync } = await import("node:fs");
@@ -760,6 +937,36 @@ Your message mode is "${messageMode}".
         return text(results.join("\n"));
       }
 
+      case "grant_file_access": {
+        const { fileId, to: grantTo } = (args ?? {}) as { fileId?: string; to?: string };
+        if (!fileId || !grantTo) return text("grant_file_access: `fileId` and `to` required", true);
+        const client = allClients()[0];
+        if (!client) return text("grant_file_access: not connected", true);
+
+        const peers = await client.listPeers();
+        const targetPeer = peers.find(p => p.pubkey === grantTo || p.displayName === grantTo);
+        if (!targetPeer) return text(`grant_file_access: peer not found: ${grantTo}`, true);
+
+        const result = await client.getFile(fileId);
+        if (!result) return text("grant_file_access: file not found", true);
+        if (!result.encrypted) return text("grant_file_access: file is not encrypted", true);
+        if (!result.sealedKey) return text("grant_file_access: no key available (are you the owner?)", true);
+
+        const { openSealedKey, sealKeyForPeer } = await import("../crypto/file-crypto");
+        const myPubkey = client.getSessionPubkey();
+        const mySecret = client.getSessionSecretKey();
+        if (!myPubkey || !mySecret) return text("grant_file_access: no session keypair", true);
+
+        const kf = await openSealedKey(result.sealedKey, myPubkey, mySecret);
+        if (!kf) return text("grant_file_access: cannot decrypt your own key", true);
+
+        const sealedForPeer = await sealKeyForPeer(kf, targetPeer.pubkey);
+        const ok = await client.grantFileAccess(fileId, targetPeer.pubkey, sealedForPeer);
+
+        if (!ok) return text("grant_file_access: broker did not confirm", true);
+        return text(`Access granted: ${targetPeer.displayName} can now download file ${fileId}`);
+      }
+
       default:
         return text(`Unknown tool: ${name}`, true);
     }
@@ -817,6 +1024,7 @@ Your message mode is "${messageMode}".
               sent_at: msg.createdAt,
               delivered_at: msg.receivedAt,
               kind: msg.kind,
+              ...(msg.subtype ? { subtype: msg.subtype } : {}),
             },
           },
         });

apps/cli/src/mcp/tools.ts

@@ -203,7 +203,7 @@ export const TOOLS: Tool[] = [
   {
     name: "share_file",
     description:
-      "Share a persistent file with the mesh. All current and future peers can access it.",
+      "Share a persistent file with the mesh. All current and future peers can access it. If `to` is specified, the file is E2E encrypted and only accessible to that peer (and you).",
     inputSchema: {
       type: "object",
       properties: {
@@ -217,6 +217,10 @@ export const TOOLS: Tool[] = [
           items: { type: "string" },
           description: "Tags for categorization",
         },
+        to: {
+          type: "string",
+          description: "Peer display name or pubkey hex — if set, file is E2E encrypted for this peer only",
+        },
       },
       required: ["path"],
     },
@@ -269,6 +273,18 @@ export const TOOLS: Tool[] = [
       required: ["id"],
     },
   },
+  {
+    name: "grant_file_access",
+    description: "Grant a peer access to an E2E encrypted file you shared. You must be the owner.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        fileId: { type: "string", description: "File ID" },
+        to: { type: "string", description: "Peer display name or pubkey hex to grant access to" },
+      },
+      required: ["fileId", "to"],
+    },
+  },
 
   // --- Vector tools ---
   {
@@ -548,6 +564,42 @@ export const TOOLS: Tool[] = [
     },
   },
 
+  // --- Scheduled messages ---
+  {
+    name: "schedule_reminder",
+    description:
+      "Schedule a message for future delivery. Without `to`, it fires back to yourself (a self-reminder). With `to`, it delivers to a peer, @group, or * broadcast. The broker holds it and delivers when the time arrives. Receivers see `subtype: reminder` in the push envelope.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        message: { type: "string", description: "Message or reminder text" },
+        deliver_at: { type: "number", description: "Unix timestamp (ms) when to deliver" },
+        in_seconds: { type: "number", description: "Alternative to deliver_at: fire after N seconds" },
+        to: {
+          type: "string",
+          description: "Recipient: display name, pubkey hex, @group, or * (omit for self-reminder)",
+        },
+      },
+      required: ["message"],
+    },
+  },
+  {
+    name: "list_scheduled",
+    description: "List all your pending scheduled messages: id, recipient, preview, and delivery time.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "cancel_scheduled",
+    description: "Cancel a pending scheduled message before it fires.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "Scheduled message ID" },
+      },
+      required: ["id"],
+    },
+  },
+
   // --- Mesh info ---
   {
     name: "mesh_info",

apps/cli/src/state/config.ts

@@ -37,6 +37,7 @@ export interface Config {
   version: 1;
   meshes: JoinedMesh[];
   displayName?: string; // per-session override, written by `claudemesh launch --name`
+  role?: string;        // per-session role tag (display + hello)
   groups?: GroupEntry[];
   messageMode?: "push" | "inbox" | "off";
 }
@@ -54,7 +55,7 @@ export function loadConfig(): Config {
     if (!parsed || !Array.isArray(parsed.meshes)) {
       return { version: 1, meshes: [] };
     }
-    return { version: 1, meshes: parsed.meshes, displayName: parsed.displayName, groups: parsed.groups, messageMode: parsed.messageMode };
+    return { version: 1, meshes: parsed.meshes, displayName: parsed.displayName, role: parsed.role, groups: parsed.groups, messageMode: parsed.messageMode };
   } catch (e) {
     throw new Error(
       `Failed to load ${CONFIG_PATH}: ${e instanceof Error ? e.message : String(e)}`,

apps/cli/src/ws/client.ts

@@ -51,6 +51,8 @@ export interface InboundPush {
   /** Hint for UI: "direct" (crypto_box), "channel"/"broadcast"
    *  (plaintext for now). */
   kind: "direct" | "broadcast" | "channel" | "unknown";
+  /** Optional semantic tag — "reminder" when fired by the scheduler. */
+  subtype?: "reminder";
 }
 
 type PushHandler = (msg: InboundPush) => void;
@@ -75,14 +77,15 @@ export class BrokerClient {
   private outbound: Array<() => void> = []; // closures that send once ws is open
   private pushHandlers = new Set<PushHandler>();
   private pushBuffer: InboundPush[] = [];
-  private listPeersResolvers: Array<(peers: PeerInfo[]) => void> = [];
+  private listPeersResolvers = new Map<string, { resolve: (peers: PeerInfo[]) => void; timer: NodeJS.Timeout }>();
-  private stateResolvers: Array<(result: { key: string; value: unknown; updatedBy: string; updatedAt: string } | null) => void> = [];
+  private stateResolvers = new Map<string, { resolve: (result: { key: string; value: unknown; updatedBy: string; updatedAt: string } | null) => void; timer: NodeJS.Timeout }>();
-  private stateListResolvers: Array<(entries: Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>) => void> = [];
+  private stateListResolvers = new Map<string, { resolve: (entries: Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>) => void; timer: NodeJS.Timeout }>();
-  private memoryStoreResolvers: Array<(id: string | null) => void> = [];
+  private memoryStoreResolvers = new Map<string, { resolve: (id: string | null) => void; timer: NodeJS.Timeout }>();
-  private memoryRecallResolvers: Array<(memories: Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>) => void> = [];
+  private memoryRecallResolvers = new Map<string, { resolve: (memories: Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>) => void; timer: NodeJS.Timeout }>();
   private stateChangeHandlers = new Set<(change: { key: string; value: unknown; updatedBy: string }) => void>();
   private sessionPubkey: string | null = null;
   private sessionSecretKey: string | null = null;
+  private grantFileAccessResolvers = new Map<string, { resolve: (ok: boolean) => void; timer: NodeJS.Timeout }>();
   private closed = false;
   private reconnectAttempt = 0;
   private helloTimer: NodeJS.Timeout | null = null;
@@ -110,6 +113,15 @@ export class BrokerClient {
     return this.pushBuffer;
   }
 
+  /** Session public key hex (null before first connection). */
+  getSessionPubkey(): string | null { return this.sessionPubkey; }
+  /** Session secret key hex (null before first connection). */
+  getSessionSecretKey(): string | null { return this.sessionSecretKey; }
+
+  private makeReqId(): string {
+    return Math.random().toString(36).slice(2) + Date.now().toString(36);
+  }
+
   /** Open WS, send hello, resolve when hello_ack received. */
   async connect(): Promise<void> {
     if (this.closed) throw new Error("client is closed");
@@ -299,16 +311,11 @@ export class BrokerClient {
   async listPeers(): Promise<PeerInfo[]> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.listPeersResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_peers" }));
+      this.listPeersResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      // Timeout after 5s — return empty list rather than hang.
+        if (this.listPeersResolvers.delete(reqId)) resolve([]);
-      setTimeout(() => {
+      }, 5_000) });
-        const idx = this.listPeersResolvers.indexOf(resolve);
+      this.ws!.send(JSON.stringify({ type: "list_peers", _reqId: reqId }));
-        if (idx !== -1) {
-          this.listPeersResolvers.splice(idx, 1);
-          resolve([]);
-        }
-      }, 5_000);
     });
   }
 
@@ -342,15 +349,11 @@ export class BrokerClient {
   async getState(key: string): Promise<{ key: string; value: unknown; updatedBy: string; updatedAt: string } | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.stateResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "get_state", key }));
+      this.stateResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.stateResolvers.delete(reqId)) resolve(null);
-        const idx = this.stateResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "get_state", key, _reqId: reqId }));
-          this.stateResolvers.splice(idx, 1);
-          resolve(null);
-        }
-      }, 5_000);
     });
   }
 
@@ -358,15 +361,11 @@ export class BrokerClient {
   async listState(): Promise<Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.stateListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_state" }));
+      this.stateListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.stateListResolvers.delete(reqId)) resolve([]);
-        const idx = this.stateListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "list_state", _reqId: reqId }));
-          this.stateListResolvers.splice(idx, 1);
-          resolve([]);
-        }
-      }, 5_000);
     });
   }
 
@@ -376,15 +375,11 @@ export class BrokerClient {
   async remember(content: string, tags?: string[]): Promise<string | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.memoryStoreResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "remember", content, tags }));
+      this.memoryStoreResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.memoryStoreResolvers.delete(reqId)) resolve(null);
-        const idx = this.memoryStoreResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "remember", content, tags, _reqId: reqId }));
-          this.memoryStoreResolvers.splice(idx, 1);
-          resolve(null);
-        }
-      }, 5_000);
     });
   }
 
@@ -392,15 +387,11 @@ export class BrokerClient {
   async recall(query: string): Promise<Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.memoryRecallResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "recall", query }));
+      this.memoryRecallResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.memoryRecallResolvers.delete(reqId)) resolve([]);
-        const idx = this.memoryRecallResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "recall", query, _reqId: reqId }));
-          this.memoryRecallResolvers.splice(idx, 1);
-          resolve([]);
-        }
-      }, 5_000);
     });
   }
 
@@ -410,52 +401,100 @@ export class BrokerClient {
     this.ws.send(JSON.stringify({ type: "forget", memoryId }));
   }
 
+  // --- Scheduled messages ---
+
+  /** Schedule a message for future delivery. Returns { scheduledId, deliverAt } or null on timeout. */
+  async scheduleMessage(
+    to: string,
+    message: string,
+    deliverAt: number,
+    isReminder = false,
+  ): Promise<{ scheduledId: string; deliverAt: number } | null> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
+    return new Promise((resolve) => {
+      const reqId = this.makeReqId();
+      this.scheduledAckResolvers.set(reqId, { resolve, timer: setTimeout(() => {
+        if (this.scheduledAckResolvers.delete(reqId)) resolve(null);
+      }, 8_000) });
+      this.ws!.send(JSON.stringify({
+        type: "schedule",
+        to,
+        message,
+        deliverAt,
+        ...(isReminder ? { subtype: "reminder" } : {}),
+        _reqId: reqId,
+      }));
+    });
+  }
+
+  /** List all pending scheduled messages for this session. */
+  async listScheduled(): Promise<Array<{ id: string; to: string; message: string; deliverAt: number; createdAt: number }>> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
+    return new Promise((resolve) => {
+      const reqId = this.makeReqId();
+      this.scheduledListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
+        if (this.scheduledListResolvers.delete(reqId)) resolve([]);
+      }, 5_000) });
+      this.ws!.send(JSON.stringify({ type: "list_scheduled", _reqId: reqId }));
+    });
+  }
+
+  /** Cancel a scheduled message by id. Returns true if found and cancelled. */
+  async cancelScheduled(scheduledId: string): Promise<boolean> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return false;
+    return new Promise((resolve) => {
+      const reqId = this.makeReqId();
+      this.cancelScheduledResolvers.set(reqId, { resolve, timer: setTimeout(() => {
+        if (this.cancelScheduledResolvers.delete(reqId)) resolve(false);
+      }, 5_000) });
+      this.ws!.send(JSON.stringify({ type: "cancel_scheduled", scheduledId, _reqId: reqId }));
+    });
+  }
+
   /** Check delivery status of a sent message. */
-  private messageStatusResolvers: Array<(result: { messageId: string; targetSpec: string; delivered: boolean; deliveredAt: string | null; recipients: Array<{ name: string; pubkey: string; status: string }> } | null) => void> = [];
+  private messageStatusResolvers = new Map<string, { resolve: (result: { messageId: string; targetSpec: string; delivered: boolean; deliveredAt: string | null; recipients: Array<{ name: string; pubkey: string; status: string }> } | null) => void; timer: NodeJS.Timeout }>();
-  private fileUrlResolvers: Array<(result: { url: string; name: string } | null) => void> = [];
+  private fileUrlResolvers = new Map<string, { resolve: (result: { url: string; name: string; encrypted?: boolean; sealedKey?: string } | null) => void; timer: NodeJS.Timeout }>();
-  private fileListResolvers: Array<(files: Array<{ id: string; name: string; size: number; tags: string[]; uploadedBy: string; uploadedAt: string; persistent: boolean }>) => void> = [];
+  private fileListResolvers = new Map<string, { resolve: (files: Array<{ id: string; name: string; size: number; tags: string[]; uploadedBy: string; uploadedAt: string; persistent: boolean }>) => void; timer: NodeJS.Timeout }>();
-  private fileStatusResolvers: Array<(accesses: Array<{ peerName: string; accessedAt: string }>) => void> = [];
+  private fileStatusResolvers = new Map<string, { resolve: (accesses: Array<{ peerName: string; accessedAt: string }>) => void; timer: NodeJS.Timeout }>();
-  private vectorStoredResolvers: Array<(id: string | null) => void> = [];
+  private vectorStoredResolvers = new Map<string, { resolve: (id: string | null) => void; timer: NodeJS.Timeout }>();
-  private vectorResultsResolvers: Array<(results: Array<{ id: string; text: string; score: number; metadata?: Record<string, unknown> }>) => void> = [];
+  private vectorResultsResolvers = new Map<string, { resolve: (results: Array<{ id: string; text: string; score: number; metadata?: Record<string, unknown> }>) => void; timer: NodeJS.Timeout }>();
-  private collectionListResolvers: Array<(collections: string[]) => void> = [];
+  private collectionListResolvers = new Map<string, { resolve: (collections: string[]) => void; timer: NodeJS.Timeout }>();
-  private graphResultResolvers: Array<(rows: Array<Record<string, unknown>>) => void> = [];
+  private graphResultResolvers = new Map<string, { resolve: (rows: Array<Record<string, unknown>>) => void; timer: NodeJS.Timeout }>();
-  private contextListResolvers: Array<(contexts: Array<{ peerName: string; summary: string; tags: string[]; updatedAt: string }>) => void> = [];
+  private contextListResolvers = new Map<string, { resolve: (contexts: Array<{ peerName: string; summary: string; tags: string[]; updatedAt: string }>) => void; timer: NodeJS.Timeout }>();
-  private contextResultsResolvers: Array<(contexts: Array<{ peerName: string; summary: string; filesRead: string[]; keyFindings: string[]; tags: string[]; updatedAt: string }>) => void> = [];
+  private contextResultsResolvers = new Map<string, { resolve: (contexts: Array<{ peerName: string; summary: string; filesRead: string[]; keyFindings: string[]; tags: string[]; updatedAt: string }>) => void; timer: NodeJS.Timeout }>();
-  private taskCreatedResolvers: Array<(id: string | null) => void> = [];
+  private taskCreatedResolvers = new Map<string, { resolve: (id: string | null) => void; timer: NodeJS.Timeout }>();
-  private taskListResolvers: Array<(tasks: Array<{ id: string; title: string; assignee: string; status: string; priority: string; createdBy: string }>) => void> = [];
+  private taskListResolvers = new Map<string, { resolve: (tasks: Array<{ id: string; title: string; assignee: string; status: string; priority: string; createdBy: string }>) => void; timer: NodeJS.Timeout }>();
-  private meshQueryResolvers: Array<(result: { columns: string[]; rows: Array<Record<string, unknown>>; rowCount: number } | null) => void> = [];
+  private meshQueryResolvers = new Map<string, { resolve: (result: { columns: string[]; rows: Array<Record<string, unknown>>; rowCount: number } | null) => void; timer: NodeJS.Timeout }>();
-  private meshSchemaResolvers: Array<(tables: Array<{ name: string; columns: Array<{ name: string; type: string; nullable: boolean }> }>) => void> = [];
+  private meshSchemaResolvers = new Map<string, { resolve: (tables: Array<{ name: string; columns: Array<{ name: string; type: string; nullable: boolean }> }>) => void; timer: NodeJS.Timeout }>();
-  private streamCreatedResolvers: Array<(id: string | null) => void> = [];
+  private streamCreatedResolvers = new Map<string, { resolve: (id: string | null) => void; timer: NodeJS.Timeout }>();
-  private streamListResolvers: Array<(streams: Array<{ id: string; name: string; createdBy: string; subscriberCount: number }>) => void> = [];
+  private streamListResolvers = new Map<string, { resolve: (streams: Array<{ id: string; name: string; createdBy: string; subscriberCount: number }>) => void; timer: NodeJS.Timeout }>();
   private streamDataHandlers = new Set<(data: { stream: string; data: unknown; publishedBy: string }) => void>();
+  private scheduledAckResolvers = new Map<string, { resolve: (result: { scheduledId: string; deliverAt: number } | null) => void; timer: NodeJS.Timeout }>();
+  private scheduledListResolvers = new Map<string, { resolve: (messages: Array<{ id: string; to: string; message: string; deliverAt: number; createdAt: number }>) => void; timer: NodeJS.Timeout }>();
+  private cancelScheduledResolvers = new Map<string, { resolve: (ok: boolean) => void; timer: NodeJS.Timeout }>();
 
   async messageStatus(messageId: string): Promise<{ messageId: string; targetSpec: string; delivered: boolean; deliveredAt: string | null; recipients: Array<{ name: string; pubkey: string; status: string }> } | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.messageStatusResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "message_status", messageId }));
+      this.messageStatusResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.messageStatusResolvers.delete(reqId)) resolve(null);
-        const idx = this.messageStatusResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.messageStatusResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "message_status", messageId, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
   // --- Files ---
 
   /** Get a download URL for a shared file. */
-  async getFile(fileId: string): Promise<{ url: string; name: string } | null> {
+  async getFile(fileId: string): Promise<{ url: string; name: string; encrypted?: boolean; sealedKey?: string } | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.fileUrlResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "get_file", fileId }));
+      this.fileUrlResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.fileUrlResolvers.delete(reqId)) resolve(null);
-        const idx = this.fileUrlResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "get_file", fileId, _reqId: reqId }));
-          this.fileUrlResolvers.splice(idx, 1);
-          resolve(null);
-        }
-      }, 5_000);
     });
   }
 
@@ -463,15 +502,11 @@ export class BrokerClient {
   async listFiles(query?: string, from?: string): Promise<Array<{ id: string; name: string; size: number; tags: string[]; uploadedBy: string; uploadedAt: string; persistent: boolean }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.fileListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_files", query, from }));
+      this.fileListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.fileListResolvers.delete(reqId)) resolve([]);
-        const idx = this.fileListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "list_files", query, from, _reqId: reqId }));
-          this.fileListResolvers.splice(idx, 1);
-          resolve([]);
-        }
-      }, 5_000);
     });
   }
 
@@ -479,15 +514,11 @@ export class BrokerClient {
   async fileStatus(fileId: string): Promise<Array<{ peerName: string; accessedAt: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.fileStatusResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "file_status", fileId }));
+      this.fileStatusResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.fileStatusResolvers.delete(reqId)) resolve([]);
-        const idx = this.fileStatusResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) {
+      this.ws!.send(JSON.stringify({ type: "file_status", fileId, _reqId: reqId }));
-          this.fileStatusResolvers.splice(idx, 1);
-          resolve([]);
-        }
-      }, 5_000);
     });
   }
 
@@ -497,10 +528,11 @@ export class BrokerClient {
     this.ws.send(JSON.stringify({ type: "delete_file", fileId }));
   }
 
-  /** Upload a file to the broker via HTTP POST. Returns file ID or null. */
+  /** Upload a file to the broker via HTTP POST. Returns file ID. */
   async uploadFile(filePath: string, meshId: string, memberId: string, opts: {
     name?: string; tags?: string[]; persistent?: boolean; targetSpec?: string;
-  }): Promise<string | null> {
+    encrypted?: boolean; ownerPubkey?: string; fileKeys?: Array<{ peerPubkey: string; sealedKey: string }>;
+  }): Promise<string> {
     const { readFileSync } = await import("node:fs");
     const { basename } = await import("node:path");
     const data = readFileSync(filePath);
@@ -522,6 +554,9 @@ export class BrokerClient {
         "X-Tags": JSON.stringify(opts.tags ?? []),
         "X-Persistent": String(opts.persistent ?? true),
         "X-Target-Spec": opts.targetSpec ?? "",
+        ...(opts.encrypted ? { "X-Encrypted": "true" } : {}),
+        ...(opts.ownerPubkey ? { "X-Owner-Pubkey": opts.ownerPubkey } : {}),
+        ...(opts.fileKeys?.length ? { "X-File-Keys": JSON.stringify(opts.fileKeys) } : {}),
       },
       body: data,
       signal: AbortSignal.timeout(30_000),
@@ -533,18 +568,29 @@ export class BrokerClient {
     return body.fileId;
   }
 
+  /** Grant a peer access to an encrypted file (owner only). */
+  async grantFileAccess(fileId: string, peerPubkey: string, sealedKey: string): Promise<boolean> {
+    if (!this.ws || this.ws.readyState !== this.ws.OPEN) return false;
+    return new Promise((resolve) => {
+      const reqId = this.makeReqId();
+      this.grantFileAccessResolvers.set(reqId, { resolve, timer: setTimeout(() => {
+        if (this.grantFileAccessResolvers.delete(reqId)) resolve(false);
+      }, 5_000) });
+      this.ws!.send(JSON.stringify({ type: "grant_file_access", fileId, peerPubkey, sealedKey, _reqId: reqId }));
+    });
+  }
+
   // --- Vectors ---
 
   /** Store an embedding in a per-mesh Qdrant collection. */
   async vectorStore(collection: string, text: string, metadata?: Record<string, unknown>): Promise<string | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.vectorStoredResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "vector_store", collection, text, metadata }));
+      this.vectorStoredResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.vectorStoredResolvers.delete(reqId)) resolve(null);
-        const idx = this.vectorStoredResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.vectorStoredResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "vector_store", collection, text, metadata, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -552,12 +598,11 @@ export class BrokerClient {
   async vectorSearch(collection: string, query: string, limit?: number): Promise<Array<{ id: string; text: string; score: number; metadata?: Record<string, unknown> }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.vectorResultsResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "vector_search", collection, query, limit }));
+      this.vectorResultsResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.vectorResultsResolvers.delete(reqId)) resolve([]);
-        const idx = this.vectorResultsResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.vectorResultsResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "vector_search", collection, query, limit, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -571,12 +616,11 @@ export class BrokerClient {
   async listCollections(): Promise<string[]> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.collectionListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_collections" }));
+      this.collectionListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.collectionListResolvers.delete(reqId)) resolve([]);
-        const idx = this.collectionListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.collectionListResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "list_collections", _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -586,12 +630,11 @@ export class BrokerClient {
   async graphQuery(cypher: string): Promise<Array<Record<string, unknown>>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.graphResultResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "graph_query", cypher }));
+      this.graphResultResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.graphResultResolvers.delete(reqId)) resolve([]);
-        const idx = this.graphResultResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.graphResultResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "graph_query", cypher, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -599,12 +642,11 @@ export class BrokerClient {
   async graphExecute(cypher: string): Promise<Array<Record<string, unknown>>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.graphResultResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "graph_execute", cypher }));
+      this.graphResultResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.graphResultResolvers.delete(reqId)) resolve([]);
-        const idx = this.graphResultResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.graphResultResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "graph_execute", cypher, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -620,12 +662,11 @@ export class BrokerClient {
   async getContext(query: string): Promise<Array<{ peerName: string; summary: string; filesRead: string[]; keyFindings: string[]; tags: string[]; updatedAt: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.contextResultsResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "get_context", query }));
+      this.contextResultsResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.contextResultsResolvers.delete(reqId)) resolve([]);
-        const idx = this.contextResultsResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.contextResultsResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "get_context", query, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -633,12 +674,11 @@ export class BrokerClient {
   async listContexts(): Promise<Array<{ peerName: string; summary: string; tags: string[]; updatedAt: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.contextListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_contexts" }));
+      this.contextListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.contextListResolvers.delete(reqId)) resolve([]);
-        const idx = this.contextListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.contextListResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "list_contexts", _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -648,37 +688,35 @@ export class BrokerClient {
   async createTask(title: string, assignee?: string, priority?: string, tags?: string[]): Promise<string | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.taskCreatedResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "create_task", title, assignee, priority, tags }));
+      this.taskCreatedResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.taskCreatedResolvers.delete(reqId)) resolve(null);
-        const idx = this.taskCreatedResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.taskCreatedResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "create_task", title, assignee, priority, tags, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
   /** Claim an unclaimed task. */
   async claimTask(id: string): Promise<void> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
-    this.ws.send(JSON.stringify({ type: "claim_task", id }));
+    this.ws.send(JSON.stringify({ type: "claim_task", taskId: id }));
   }
 
   /** Mark a task done with optional result. */
   async completeTask(id: string, result?: string): Promise<void> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return;
-    this.ws.send(JSON.stringify({ type: "complete_task", id, result }));
+    this.ws.send(JSON.stringify({ type: "complete_task", taskId: id, result }));
   }
 
   /** List tasks filtered by status/assignee. */
   async listTasks(status?: string, assignee?: string): Promise<Array<{ id: string; title: string; assignee: string; status: string; priority: string; createdBy: string }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.taskListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_tasks", status, assignee }));
+      this.taskListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.taskListResolvers.delete(reqId)) resolve([]);
-        const idx = this.taskListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.taskListResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "list_tasks", status, assignee, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -688,12 +726,11 @@ export class BrokerClient {
   async meshQuery(sql: string): Promise<{ columns: string[]; rows: Array<Record<string, unknown>>; rowCount: number } | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.meshQueryResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "mesh_query", sql }));
+      this.meshQueryResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.meshQueryResolvers.delete(reqId)) resolve(null);
-        const idx = this.meshQueryResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.meshQueryResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "mesh_query", sql, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -707,12 +744,11 @@ export class BrokerClient {
   async meshSchema(): Promise<Array<{ name: string; columns: Array<{ name: string; type: string; nullable: boolean }> }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.meshSchemaResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "mesh_schema" }));
+      this.meshSchemaResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.meshSchemaResolvers.delete(reqId)) resolve([]);
-        const idx = this.meshSchemaResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.meshSchemaResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "mesh_schema", _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -722,12 +758,11 @@ export class BrokerClient {
   async createStream(name: string): Promise<string | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.streamCreatedResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "create_stream", name }));
+      this.streamCreatedResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.streamCreatedResolvers.delete(reqId)) resolve(null);
-        const idx = this.streamCreatedResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.streamCreatedResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "create_stream", name, _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -753,12 +788,11 @@ export class BrokerClient {
   async listStreams(): Promise<Array<{ id: string; name: string; createdBy: string; subscriberCount: number }>> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return [];
     return new Promise((resolve) => {
-      this.streamListResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "list_streams" }));
+      this.streamListResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.streamListResolvers.delete(reqId)) resolve([]);
-        const idx = this.streamListResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.streamListResolvers.splice(idx, 1); resolve([]); }
+      this.ws!.send(JSON.stringify({ type: "list_streams", _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -775,17 +809,16 @@ export class BrokerClient {
   }
 
   // --- Mesh info ---
-  private meshInfoResolvers: Array<(result: Record<string, unknown> | null) => void> = [];
+  private meshInfoResolvers = new Map<string, { resolve: (result: Record<string, unknown> | null) => void; timer: NodeJS.Timeout }>();
 
   async meshInfo(): Promise<Record<string, unknown> | null> {
     if (!this.ws || this.ws.readyState !== this.ws.OPEN) return null;
     return new Promise((resolve) => {
-      this.meshInfoResolvers.push(resolve);
+      const reqId = this.makeReqId();
-      this.ws!.send(JSON.stringify({ type: "mesh_info" }));
+      this.meshInfoResolvers.set(reqId, { resolve, timer: setTimeout(() => {
-      setTimeout(() => {
+        if (this.meshInfoResolvers.delete(reqId)) resolve(null);
-        const idx = this.meshInfoResolvers.indexOf(resolve);
+      }, 5_000) });
-        if (idx !== -1) { this.meshInfoResolvers.splice(idx, 1); resolve(null); }
+      this.ws!.send(JSON.stringify({ type: "mesh_info", _reqId: reqId }));
-      }, 5_000);
     });
   }
 
@@ -805,7 +838,33 @@ export class BrokerClient {
 
   // --- Internals ---
 
+  private resolveFromMap<T>(
+    map: Map<string, { resolve: (v: T) => void; timer: NodeJS.Timeout }>,
+    reqId: string | undefined,
+    value: T,
+  ): boolean {
+    let entry = reqId ? map.get(reqId) : undefined;
+    if (!entry) {
+      // Fallback: oldest pending (FIFO, for brokers that don't echo _reqId)
+      const first = map.entries().next().value as [string, { resolve: (v: T) => void; timer: NodeJS.Timeout }] | undefined;
+      if (first) {
+        entry = first[1];
+        map.delete(first[0]);
+      }
+    } else {
+      map.delete(reqId!);
+    }
+    if (entry) {
+      clearTimeout(entry.timer);
+      entry.resolve(value);
+      return true;
+    }
+    return false;
+  }
+
   private handleServerMessage(msg: Record<string, unknown>): void {
+    const msgReqId = msg._reqId as string | undefined;
+
     if (msg.type === "ack") {
       const pending = this.pendingSends.get(String(msg.id ?? ""));
       if (pending) {
@@ -819,8 +878,7 @@ export class BrokerClient {
     }
     if (msg.type === "peers_list") {
       const peers = (msg.peers as PeerInfo[]) ?? [];
-      const resolver = this.listPeersResolvers.shift();
+      this.resolveFromMap(this.listPeersResolvers, msgReqId, peers);
-      if (resolver) resolver(peers);
       return;
     }
     if (msg.type === "push") {
@@ -879,6 +937,7 @@ export class BrokerClient {
           receivedAt: new Date().toISOString(),
           plaintext,
           kind,
+          ...(msg.subtype ? { subtype: msg.subtype as "reminder" } : {}),
         };
         this.pushBuffer.push(push);
         if (this.pushBuffer.length > 500) this.pushBuffer.shift();
@@ -893,25 +952,26 @@ export class BrokerClient {
       return;
     }
     if (msg.type === "state_result") {
-      const resolver = this.stateResolvers.shift();
+      // DEPENDENCY: The broker must NOT send state_result for set_state
-      if (resolver) {
+      // operations (only for get_state). If the broker sends state_result for
-        if (msg.key) {
+      // both, it would be consumed here by the next pending get_state resolver,
-          resolver({
+      // returning the wrong value (cross-contamination). The broker's set_state
-            key: String(msg.key),
+      // handler was fixed to omit state_result; only get_state sends it.
-            value: msg.value,
+      if (msg.key) {
-            updatedBy: String(msg.updatedBy ?? ""),
+        this.resolveFromMap(this.stateResolvers, msgReqId, {
-            updatedAt: String(msg.updatedAt ?? ""),
+          key: String(msg.key),
-          });
+          value: msg.value,
-        } else {
+          updatedBy: String(msg.updatedBy ?? ""),
-          resolver(null);
+          updatedAt: String(msg.updatedAt ?? ""),
-        }
+        });
+      } else {
+        this.resolveFromMap(this.stateResolvers, msgReqId, null);
       }
       return;
     }
     if (msg.type === "state_list") {
       const entries = (msg.entries as Array<{ key: string; value: unknown; updatedBy: string; updatedAt: string }>) ?? [];
-      const resolver = this.stateListResolvers.shift();
+      this.resolveFromMap(this.stateListResolvers, msgReqId, entries);
-      if (resolver) resolver(entries);
       return;
     }
     if (msg.type === "state_change") {
@@ -926,120 +986,108 @@ export class BrokerClient {
       return;
     }
     if (msg.type === "memory_stored") {
-      const resolver = this.memoryStoreResolvers.shift();
+      this.resolveFromMap(this.memoryStoreResolvers, msgReqId, msg.id ? String(msg.id) : null);
-      if (resolver) resolver(msg.id ? String(msg.id) : null);
       return;
     }
     if (msg.type === "memory_results") {
       const memories = (msg.memories as Array<{ id: string; content: string; tags: string[]; rememberedBy: string; rememberedAt: string }>) ?? [];
-      const resolver = this.memoryRecallResolvers.shift();
+      this.resolveFromMap(this.memoryRecallResolvers, msgReqId, memories);
-      if (resolver) resolver(memories);
       return;
     }
     if (msg.type === "message_status_result") {
-      const resolver = this.messageStatusResolvers.shift();
+      this.resolveFromMap(this.messageStatusResolvers, msgReqId, msg as any);
-      if (resolver) resolver(msg as any);
       return;
     }
     if (msg.type === "file_url") {
-      const resolver = this.fileUrlResolvers.shift();
+      if (msg.url) {
-      if (resolver) {
+        this.resolveFromMap(this.fileUrlResolvers, msgReqId, {
-        if (msg.url) {
+          url: String(msg.url),
-          resolver({ url: String(msg.url), name: String(msg.name ?? "") });
+          name: String(msg.name ?? ""),
-        } else {
+          encrypted: msg.encrypted ? true : undefined,
-          resolver(null);
+          sealedKey: msg.sealedKey ? String(msg.sealedKey) : undefined,
-        }
+        });
+      } else {
+        this.resolveFromMap(this.fileUrlResolvers, msgReqId, null);
       }
       return;
     }
     if (msg.type === "file_list") {
       const files = (msg.files as Array<{ id: string; name: string; size: number; tags: string[]; uploadedBy: string; uploadedAt: string; persistent: boolean }>) ?? [];
-      const resolver = this.fileListResolvers.shift();
+      this.resolveFromMap(this.fileListResolvers, msgReqId, files);
-      if (resolver) resolver(files);
       return;
     }
     if (msg.type === "file_status_result") {
       const accesses = (msg.accesses as Array<{ peerName: string; accessedAt: string }>) ?? [];
-      const resolver = this.fileStatusResolvers.shift();
+      this.resolveFromMap(this.fileStatusResolvers, msgReqId, accesses);
-      if (resolver) resolver(accesses);
+      return;
+    }
+    if (msg.type === "grant_file_access_ok") {
+      this.resolveFromMap(this.grantFileAccessResolvers, msgReqId, true);
       return;
     }
     if (msg.type === "vector_stored") {
-      const resolver = this.vectorStoredResolvers.shift();
+      this.resolveFromMap(this.vectorStoredResolvers, msgReqId, msg.id ? String(msg.id) : null);
-      if (resolver) resolver(msg.id ? String(msg.id) : null);
       return;
     }
     if (msg.type === "vector_results") {
       const results = (msg.results as Array<{ id: string; text: string; score: number; metadata?: Record<string, unknown> }>) ?? [];
-      const resolver = this.vectorResultsResolvers.shift();
+      this.resolveFromMap(this.vectorResultsResolvers, msgReqId, results);
-      if (resolver) resolver(results);
       return;
     }
     if (msg.type === "collection_list") {
       const collections = (msg.collections as string[]) ?? [];
-      const resolver = this.collectionListResolvers.shift();
+      this.resolveFromMap(this.collectionListResolvers, msgReqId, collections);
-      if (resolver) resolver(collections);
       return;
     }
     if (msg.type === "graph_result") {
-      const rows = (msg.rows as Array<Record<string, unknown>>) ?? [];
+      // Broker sends { type: "graph_result", records: [...] }
-      const resolver = this.graphResultResolvers.shift();
+      const rows = (msg.records as Array<Record<string, unknown>>) ?? [];
-      if (resolver) resolver(rows);
+      this.resolveFromMap(this.graphResultResolvers, msgReqId, rows);
       return;
     }
     if (msg.type === "context_list") {
       const contexts = (msg.contexts as Array<{ peerName: string; summary: string; tags: string[]; updatedAt: string }>) ?? [];
-      const resolver = this.contextListResolvers.shift();
+      this.resolveFromMap(this.contextListResolvers, msgReqId, contexts);
-      if (resolver) resolver(contexts);
       return;
     }
     if (msg.type === "context_results") {
       const contexts = (msg.contexts as Array<{ peerName: string; summary: string; filesRead: string[]; keyFindings: string[]; tags: string[]; updatedAt: string }>) ?? [];
-      const resolver = this.contextResultsResolvers.shift();
+      this.resolveFromMap(this.contextResultsResolvers, msgReqId, contexts);
-      if (resolver) resolver(contexts);
       return;
     }
     if (msg.type === "task_created") {
-      const resolver = this.taskCreatedResolvers.shift();
+      this.resolveFromMap(this.taskCreatedResolvers, msgReqId, msg.id ? String(msg.id) : null);
-      if (resolver) resolver(msg.id ? String(msg.id) : null);
       return;
     }
     if (msg.type === "task_list") {
       const tasks = (msg.tasks as Array<{ id: string; title: string; assignee: string; status: string; priority: string; createdBy: string }>) ?? [];
-      const resolver = this.taskListResolvers.shift();
+      this.resolveFromMap(this.taskListResolvers, msgReqId, tasks);
-      if (resolver) resolver(tasks);
       return;
     }
     if (msg.type === "mesh_query_result") {
-      const resolver = this.meshQueryResolvers.shift();
+      if (msg.columns) {
-      if (resolver) {
+        this.resolveFromMap(this.meshQueryResolvers, msgReqId, {
-        if (msg.columns) {
+          columns: (msg.columns as string[]) ?? [],
-          resolver({
+          rows: (msg.rows as Array<Record<string, unknown>>) ?? [],
-            columns: (msg.columns as string[]) ?? [],
+          rowCount: (msg.rowCount as number) ?? 0,
-            rows: (msg.rows as Array<Record<string, unknown>>) ?? [],
+        });
-            rowCount: (msg.rowCount as number) ?? 0,
+      } else {
-          });
+        this.resolveFromMap(this.meshQueryResolvers, msgReqId, null);
-        } else {
-          resolver(null);
-        }
       }
       return;
     }
     if (msg.type === "mesh_schema_result") {
       const tables = (msg.tables as Array<{ name: string; columns: Array<{ name: string; type: string; nullable: boolean }> }>) ?? [];
-      const resolver = this.meshSchemaResolvers.shift();
+      this.resolveFromMap(this.meshSchemaResolvers, msgReqId, tables);
-      if (resolver) resolver(tables);
       return;
     }
     if (msg.type === "stream_created") {
-      const resolver = this.streamCreatedResolvers.shift();
+      this.resolveFromMap(this.streamCreatedResolvers, msgReqId, msg.id ? String(msg.id) : null);
-      if (resolver) resolver(msg.id ? String(msg.id) : null);
       return;
     }
     if (msg.type === "stream_list") {
       const streams = (msg.streams as Array<{ id: string; name: string; createdBy: string; subscriberCount: number }>) ?? [];
-      const resolver = this.streamListResolvers.shift();
+      this.resolveFromMap(this.streamListResolvers, msgReqId, streams);
-      if (resolver) resolver(streams);
       return;
     }
     if (msg.type === "stream_data") {
@@ -1054,13 +1102,29 @@ export class BrokerClient {
       return;
     }
     if (msg.type === "mesh_info_result") {
-      const resolver = this.meshInfoResolvers.shift();
+      this.resolveFromMap(this.meshInfoResolvers, msgReqId, msg as Record<string, unknown>);
-      if (resolver) resolver(msg as Record<string, unknown>);
+      return;
+    }
+    if (msg.type === "scheduled_ack") {
+      this.resolveFromMap(this.scheduledAckResolvers, msgReqId, {
+        scheduledId: String(msg.scheduledId ?? ""),
+        deliverAt: Number(msg.deliverAt ?? 0),
+      });
+      return;
+    }
+    if (msg.type === "scheduled_list") {
+      const messages = (msg.messages as Array<{ id: string; to: string; message: string; deliverAt: number; createdAt: number }>) ?? [];
+      this.resolveFromMap(this.scheduledListResolvers, msgReqId, messages);
+      return;
+    }
+    if (msg.type === "cancel_scheduled_ack") {
+      this.resolveFromMap(this.cancelScheduledResolvers, msgReqId, Boolean(msg.ok));
       return;
     }
     if (msg.type === "error") {
       this.debug(`broker error: ${msg.code} ${msg.message}`);
       const id = msg.id ? String(msg.id) : null;
+      let handledByPendingSend = false;
       if (id) {
         const pending = this.pendingSends.get(id);
         if (pending) {
@@ -1069,6 +1133,49 @@ export class BrokerClient {
             error: `${msg.code}: ${msg.message}`,
           });
           this.pendingSends.delete(id);
+          handledByPendingSend = true;
+        }
+      }
+      if (!handledByPendingSend) {
+        // Best-effort: unblock the first waiting resolver so callers don't
+        // hang for 5s. We don't know which tool triggered the error, so we
+        // pop the first non-empty resolver map in priority order.
+        const allMaps: Array<[Map<string, { resolve: (v: any) => void; timer: NodeJS.Timeout }>, unknown]> = [
+          [this.stateResolvers, null],
+          [this.stateListResolvers, []],
+          [this.memoryStoreResolvers, null],
+          [this.memoryRecallResolvers, []],
+          [this.fileUrlResolvers, null],
+          [this.fileListResolvers, []],
+          [this.fileStatusResolvers, []],
+          [this.graphResultResolvers, []],
+          [this.vectorStoredResolvers, null],
+          [this.vectorResultsResolvers, []],
+          [this.taskListResolvers, []],
+          [this.meshQueryResolvers, null],
+          [this.contextResultsResolvers, []],
+          [this.contextListResolvers, []],
+          [this.streamListResolvers, []],
+          [this.scheduledAckResolvers, null],
+          [this.scheduledListResolvers, []],
+          [this.cancelScheduledResolvers, false],
+          [this.messageStatusResolvers, null],
+          [this.grantFileAccessResolvers, false],
+          [this.collectionListResolvers, []],
+          [this.meshSchemaResolvers, []],
+          [this.taskCreatedResolvers, null],
+          [this.streamCreatedResolvers, null],
+          [this.listPeersResolvers, []],
+          [this.meshInfoResolvers, null],
+        ];
+        for (const [map, defaultVal] of allMaps) {
+          const first = (map as Map<string, any>).entries().next().value as [string, { resolve: (v: unknown) => void; timer: NodeJS.Timeout }] | undefined;
+          if (first) {
+            (map as Map<string, any>).delete(first[0]);
+            clearTimeout(first[1].timer);
+            first[1].resolve(defaultVal);
+            break; // only pop one
+          }
         }
       }
     }

apps/cli/src/ws/manager.ts

@@ -12,6 +12,7 @@ import { env } from "../env";
 
 const clients = new Map<string, BrokerClient>();
 let configDisplayName: string | undefined;
+let configGroups: Config["groups"] = [];
 
 /** Ensure a BrokerClient exists + is connecting/open for this mesh. */
 export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
@@ -21,6 +22,10 @@ export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
   clients.set(mesh.meshId, client);
   try {
     await client.connect();
+    // Auto-join groups declared at launch time (--groups flag or config).
+    for (const g of configGroups ?? []) {
+      try { await client.joinGroup(g.name, g.role); } catch { /* best effort */ }
+    }
   } catch {
     // Connect failed → client is in "reconnecting" state, leave it
     // wired so tool calls can surface the status.
@@ -31,6 +36,7 @@ export async function ensureClient(mesh: JoinedMesh): Promise<BrokerClient> {
 /** Start clients for every joined mesh. Called once on MCP server start. */
 export async function startClients(config: Config): Promise<void> {
   configDisplayName = config.displayName;
+  configGroups = config.groups ?? [];
   await Promise.allSettled(config.meshes.map(ensureClient));
 }
 

apps/web/src/app/[locale]/(marketing)/getting-started/page.tsx

@@ -0,0 +1,548 @@
+import Link from "next/link";
+
+import { getMetadata } from "~/lib/metadata";
+
+export const metadata = getMetadata({
+  title: "Getting Started",
+  description:
+    "Install claudemesh, join a mesh, and launch your first peer session in under two minutes.",
+})();
+
+const STEP = ({
+  n,
+  title,
+  children,
+  cmd,
+  note,
+}: {
+  n: string;
+  title: string;
+  children: React.ReactNode;
+  cmd?: string;
+  note?: string;
+}) => (
+  <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-6 md:p-8">
+    <div
+      className="mb-4 flex items-center gap-3 text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+      style={{ fontFamily: "var(--cm-font-mono)" }}
+    >
+      <span className="flex h-6 w-6 items-center justify-center rounded-full bg-[var(--cm-clay)]/15 text-[11px] font-medium">
+        {n}
+      </span>
+      {title}
+    </div>
+    <div
+      className="text-[15px] leading-[1.65] text-[var(--cm-fg-secondary)]"
+      style={{ fontFamily: "var(--cm-font-serif)" }}
+    >
+      {children}
+    </div>
+    {cmd && (
+      <pre
+        className="mt-4 overflow-x-auto rounded-[var(--cm-radius-xs)] border border-[var(--cm-border)] bg-[var(--cm-bg)] px-4 py-3 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        <code>{cmd}</code>
+      </pre>
+    )}
+    {note && (
+      <p
+        className="mt-3 text-[12px] leading-[1.6] text-[var(--cm-fg-tertiary)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        {note}
+      </p>
+    )}
+  </div>
+);
+
+const VERIFY_CHECKS = [
+  "Node.js >= 20 installed",
+  "claude binary on PATH",
+  "claudemesh MCP registered in ~/.claude.json",
+  "Status hooks registered in ~/.claude/settings.json",
+  "~/.claudemesh/config.json parses + chmod 0600",
+  "Mesh keypairs valid",
+];
+
+export default function GettingStartedPage() {
+  return (
+    <div className="mx-auto max-w-3xl px-6 py-16 md:px-12 md:py-24">
+      <div
+        className="mb-5 text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+        style={{ fontFamily: "var(--cm-font-mono)" }}
+      >
+        — getting started
+      </div>
+      <h1
+        className="text-[clamp(2rem,4.5vw,3rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
+        style={{ fontFamily: "var(--cm-font-serif)" }}
+      >
+        From zero to meshed in two minutes
+      </h1>
+      <p
+        className="mt-4 max-w-xl text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
+        style={{ fontFamily: "var(--cm-font-serif)" }}
+      >
+        Install the CLI, join a mesh, and launch Claude Code with real-time peer
+        messaging. Three commands.
+      </p>
+
+      {/* Prerequisites */}
+      <div className="mt-14 mb-10">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Prerequisites
+        </h2>
+        <ul
+          className="space-y-2 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">Node.js 20+</strong> —{" "}
+              <Link
+                href="https://nodejs.org"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                nodejs.org
+              </Link>
+            </span>
+          </li>
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">Claude Code 2.0+</strong>{" "}
+              —{" "}
+              <Link
+                href="https://claude.com/claude-code"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                claude.com/claude-code
+              </Link>
+            </span>
+          </li>
+          <li className="flex items-start gap-2">
+            <span className="mt-[6px] block h-[6px] w-[6px] shrink-0 rounded-full bg-[var(--cm-clay)]" />
+            <span>
+              <strong className="text-[var(--cm-fg)]">An invite link</strong> —
+              from a mesh owner, or{" "}
+              <Link
+                href="/auth/register"
+                className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+              >
+                create your own mesh
+              </Link>
+            </span>
+          </li>
+        </ul>
+      </div>
+
+      {/* Steps */}
+      <div className="space-y-6">
+        <STEP
+          n="1"
+          title="Install the CLI"
+          cmd="curl -fsSL https://claudemesh.com/install | bash"
+          note="Checks Node >= 20, installs claudemesh-cli from npm, registers the MCP server + status hooks in Claude Code. Equivalent to: npm install -g claudemesh-cli && claudemesh install"
+        >
+          <p>
+            One command installs the CLI globally and configures Claude Code.
+            The script is short and auditable —{" "}
+            <Link
+              href="https://claudemesh.com/install"
+              className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+            >
+              read it first
+            </Link>{" "}
+            if you prefer.
+          </p>
+        </STEP>
+
+        <div
+          className="py-3 text-center text-xs text-[var(--cm-fg-tertiary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          or install manually:
+          <code className="ml-2 rounded bg-[var(--cm-bg-elevated)] px-2 py-1 text-[var(--cm-fg-secondary)]">
+            npm install -g claudemesh-cli && claudemesh install
+          </code>
+        </div>
+
+        <STEP
+          n="2"
+          title="Restart Claude Code"
+          note="The MCP server and status hooks registered in step 1 only take effect after a restart."
+        >
+          <p>
+            Close and reopen Claude Code (or your IDE with Claude Code
+            extension). This loads the claudemesh MCP server so the 43 mesh
+            tools appear.
+          </p>
+        </STEP>
+
+        <STEP
+          n="3"
+          title="Join a mesh"
+          cmd="claudemesh join https://claudemesh.com/join/eyJ2IjoxLC..."
+          note="Replace the URL with your actual invite link. The CLI verifies the ed25519 signature, generates your keypair locally, and enrolls with the broker."
+        >
+          <p>
+            Paste the invite link you received. Your ed25519 keypair is
+            generated and stored in{" "}
+            <code
+              className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claudemesh/config.json
+            </code>{" "}
+            (chmod 0600). You keep your keys — the broker never sees them.
+          </p>
+        </STEP>
+
+        <STEP
+          n="4"
+          title="Launch with real-time messaging"
+          cmd="claudemesh launch --name Alice"
+          note="Wraps `claude` with the mesh dev-channel. Peers can message you in real-time. Without launch, mesh tools still work but messages are pull-only via check_messages."
+        >
+          <p>
+            This spawns Claude Code connected to the mesh with push messaging.
+            The interactive wizard asks for your role and groups — or pass them
+            as flags:
+          </p>
+        </STEP>
+
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg)] px-6 py-4 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`# Full example with all flags
+claudemesh launch \\
+  --name Alice \\
+  --role dev \\
+  --groups "frontend:lead,reviewers" \\
+  --message-mode push \\
+  -y                          # skip permission confirmation`}</code>
+        </pre>
+      </div>
+
+      {/* Verify */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Verify your setup
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Run the diagnostic check — it walks through every precondition and
+          prints pass/fail with fix hints:
+        </p>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.7] text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`$ claudemesh doctor
+claudemesh doctor  (v0.6.8)
+────────────────────────────────────────────────────────────
+✓ Node.js >= 20 (v22.15.0)
+✓ claude binary on PATH
+✓ claudemesh MCP registered in ~/.claude.json
+✓ Status hooks registered in ~/.claude/settings.json
+✓ ~/.claudemesh/config.json parses + chmod 0600
+✓ Mesh keypairs valid (1 mesh(es))
+
+All checks passed.`}</code>
+        </pre>
+      </div>
+
+      {/* What install does */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          What <code style={{ fontFamily: "var(--cm-font-mono)" }}>claudemesh install</code> does
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          The install command touches two files. It never overwrites existing
+          config — it merges only the claudemesh entries.
+        </p>
+        <div className="space-y-4">
+          <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5">
+            <div
+              className="mb-2 text-[11px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claude.json
+            </div>
+            <p
+              className="text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              Registers{" "}
+              <code
+                className="rounded bg-[var(--cm-bg)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                mcpServers.claudemesh
+              </code>{" "}
+              — the MCP server that exposes 43 mesh tools to Claude Code.
+              Backed up before every write.
+            </p>
+          </div>
+          <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5">
+            <div
+              className="mb-2 text-[11px] uppercase tracking-wider text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              ~/.claude/settings.json
+            </div>
+            <p
+              className="text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              Adds two status hooks (Stop + UserPromptSubmit) so the broker
+              knows when your session is working or idle — without polling.
+              Pre-approves all 43 claudemesh tools in{" "}
+              <code
+                className="rounded bg-[var(--cm-bg)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                allowedTools
+              </code>{" "}
+              so they run without --dangerously-skip-permissions.
+            </p>
+          </div>
+        </div>
+      </div>
+
+      {/* Invite a teammate */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Invite a teammate
+        </h2>
+        <p
+          className="mb-6 text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Mesh owners generate invite links from the{" "}
+          <Link
+            href="/dashboard"
+            className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+          >
+            dashboard
+          </Link>
+          . Each link is a signed ed25519 token with a mesh ID, broker URL,
+          expiry, and role (admin or member). Share via Slack, email, or
+          paste in chat.
+        </p>
+        <p
+          className="text-[14px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          The recipient runs{" "}
+          <code
+            className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            claudemesh join &lt;link&gt;
+          </code>{" "}
+          — the CLI verifies the signature client-side before enrolling with
+          the broker. No account creation needed. Identity is the ed25519
+          keypair.
+        </p>
+      </div>
+
+      {/* Invite link formats */}
+      <div className="mt-10">
+        <h3
+          className="mb-3 text-base font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Accepted invite formats
+        </h3>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.9] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`# HTTPS link (clickable, shareable)
+claudemesh join https://claudemesh.com/join/eyJ2IjoxLC...
+
+# With locale prefix (also works)
+claudemesh join https://claudemesh.com/en/join/eyJ2IjoxLC...
+
+# ic:// scheme (legacy, still supported)
+claudemesh join ic://join/eyJ2IjoxLC...
+
+# Raw token (last resort)
+claudemesh join eyJ2IjoxLC4uLg`}</code>
+        </pre>
+      </div>
+
+      {/* Message modes */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Message modes
+        </h2>
+        <div className="grid gap-4 md:grid-cols-3">
+          {[
+            {
+              mode: "push",
+              desc: "Real-time. Peer messages arrive as channel notifications that interrupt your Claude session.",
+              when: "Default. Best for active collaboration.",
+            },
+            {
+              mode: "inbox",
+              desc: "Held until you check. You get a notification but messages queue until check_messages.",
+              when: "Deep work. Check when ready.",
+            },
+            {
+              mode: "off",
+              desc: "No delivery. Tools still work — use check_messages to poll manually.",
+              when: "Solo work on a shared mesh.",
+            },
+          ].map((m) => (
+            <div
+              key={m.mode}
+              className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] p-5"
+            >
+              <code
+                className="mb-2 block text-sm font-medium text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                --message-mode {m.mode}
+              </code>
+              <p
+                className="mb-2 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+                style={{ fontFamily: "var(--cm-font-serif)" }}
+              >
+                {m.desc}
+              </p>
+              <p
+                className="text-[11px] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                {m.when}
+              </p>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      {/* With vs without launch */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          <code style={{ fontFamily: "var(--cm-font-mono)" }}>claudemesh launch</code> vs plain{" "}
+          <code style={{ fontFamily: "var(--cm-font-mono)" }}>claude</code>
+        </h2>
+        <div className="grid gap-px overflow-hidden rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-border)] md:grid-cols-2">
+          <div className="bg-[var(--cm-bg-elevated)] p-6">
+            <div
+              className="mb-2 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              claudemesh launch
+            </div>
+            <ul
+              className="space-y-1.5 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              <li>Real-time push messages from peers</li>
+              <li>Per-session ephemeral keypair</li>
+              <li>Display name visible to other peers</li>
+              <li>Groups and roles set at launch</li>
+              <li>Session config isolated in tmpdir</li>
+            </ul>
+          </div>
+          <div className="bg-[var(--cm-bg-elevated)] p-6">
+            <div
+              className="mb-2 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-fg-tertiary)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              plain claude
+            </div>
+            <ul
+              className="space-y-1.5 text-[13px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+              style={{ fontFamily: "var(--cm-font-serif)" }}
+            >
+              <li>All 43 MCP tools still work</li>
+              <li>Messages are pull-only (check_messages)</li>
+              <li>No real-time push delivery</li>
+              <li>Uses member keypair (not ephemeral)</li>
+              <li>No display name or group assignment</li>
+            </ul>
+          </div>
+        </div>
+      </div>
+
+      {/* Uninstall */}
+      <div className="mt-16">
+        <h2
+          className="mb-4 text-xl font-medium text-[var(--cm-fg)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Uninstall
+        </h2>
+        <pre
+          className="overflow-x-auto rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-4 text-[13px] leading-[1.9] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-mono)" }}
+        >
+          <code>{`claudemesh uninstall     # remove MCP server, hooks, and allowedTools
+npm uninstall -g claudemesh-cli
+rm -rf ~/.claudemesh    # delete config + keypairs (irreversible)`}</code>
+        </pre>
+      </div>
+
+      {/* CTA */}
+      <div className="mt-16 flex flex-col items-start gap-4 border-t border-[var(--cm-border)] pt-10">
+        <p
+          className="text-[15px] leading-[1.6] text-[var(--cm-fg-secondary)]"
+          style={{ fontFamily: "var(--cm-font-serif)" }}
+        >
+          Need help? Run{" "}
+          <code
+            className="rounded bg-[var(--cm-bg-elevated)] px-1.5 py-0.5 text-[12px] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            claudemesh doctor
+          </code>{" "}
+          to diagnose issues, or{" "}
+          <Link
+            href="https://github.com/alezmad/claudemesh-cli/issues"
+            className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 hover:text-[var(--cm-fg)]"
+          >
+            open an issue on GitHub
+          </Link>
+          .
+        </p>
+        <Link
+          href="/auth/register"
+          className="inline-flex items-center gap-2 rounded-[var(--cm-radius-xs)] bg-[var(--cm-clay)] px-5 py-3 text-[15px] font-medium text-[var(--cm-fg)] transition-colors duration-300 hover:bg-[var(--cm-clay-hover)]"
+          style={{ fontFamily: "var(--cm-font-sans)" }}
+        >
+          Create a mesh →
+        </Link>
+      </div>
+    </div>
+  );
+}

apps/web/src/app/[locale]/(marketing)/page.tsx

@@ -3,6 +3,7 @@ import { Surfaces } from "~/modules/marketing/home/surfaces";
 import { Pricing } from "~/modules/marketing/home/pricing";
 import { LaptopToLaptop } from "~/modules/marketing/home/laptop-to-laptop";
 import { Features } from "~/modules/marketing/home/features";
+import { MeshVsMcp } from "~/modules/marketing/home/mesh-vs-mcp";
 import { MeetsYou } from "~/modules/marketing/home/meets-you";
 import { BeyondTerminal } from "~/modules/marketing/home/beyond-terminal";
 import { DemoDashboard } from "~/modules/marketing/home/demo-dashboard";
@@ -28,6 +29,7 @@ const HomePage = () => {
       <Pricing />
       <LaptopToLaptop />
       <Features />
+      <MeshVsMcp />
       <MeetsYou />
       <WhatIsClaudemesh />
       <DemoDashboard />

apps/web/src/config/paths.ts

@@ -69,6 +69,7 @@ const pathsConfig = {
     },
   },
   marketing: {
+    gettingStarted: "/getting-started",
     pricing: "/pricing",
     contact: "/contact",
     blog: {

apps/web/src/modules/join/install-toggle.tsx

@@ -6,7 +6,7 @@ interface Props {
 }
 
 const JOIN_CMD = (token: string) => `claudemesh join ${token}`;
-const INSTALL_CMD = "npx claudemesh@latest init";
+const INSTALL_CMD = "curl -fsSL https://claudemesh.com/install | bash";
 
 export const InstallToggle = ({ token }: Props) => {
   const [hasCli, setHasCli] = useState<"unknown" | "yes" | "no">("unknown");
@@ -106,7 +106,7 @@ export const InstallToggle = ({ token }: Props) => {
             style={{ fontFamily: "var(--cm-font-mono)" }}
           >
             <span className="rounded-full bg-[var(--cm-clay)]/20 px-1.5">1</span>
-            install + init
+            install the CLI
           </div>
           <div className="flex items-center gap-2">
             <code
@@ -127,8 +127,8 @@ export const InstallToggle = ({ token }: Props) => {
             className="mt-2 text-xs text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Generates your ed25519 keypair locally and wires claudemesh into
+            Installs the CLI, registers the MCP server + status hooks in
-            your Claude Code config. You own the keys.
+            Claude Code. Restart Claude Code after this step.
           </p>
         </li>
         <li className="rounded-[var(--cm-radius-md)] border border-[var(--cm-clay)]/40 bg-[var(--cm-bg-elevated)] p-5">
@@ -161,14 +161,24 @@ export const InstallToggle = ({ token }: Props) => {
             style={{ fontFamily: "var(--cm-font-mono)" }}
           >
             <span className="rounded-full bg-[var(--cm-border)] px-1.5">3</span>
-            verify
+            launch with push messaging
+          </div>
+          <div className="flex items-center gap-2">
+            <code
+              className="flex-1 overflow-x-auto rounded-[var(--cm-radius-xs)] bg-[var(--cm-bg)] p-3 text-sm text-[var(--cm-fg)]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              claudemesh launch --name YourName
+            </code>
           </div>
           <p
-            className="text-sm text-[var(--cm-fg-secondary)]"
+            className="mt-2 text-xs text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Your Claude Code session will announce itself to the mesh. Other
+            Restart Claude Code first, then launch. Peers see you appear on
-            peers see you appear as a green dot in their dashboard.
+            the mesh. Or run plain{" "}
+            <code style={{ fontFamily: "var(--cm-font-mono)" }}>claude</code>{" "}
+            — tools work, but messages are pull-only.
           </p>
         </li>
       </ol>

apps/web/src/modules/marketing/home/cta.tsx

@@ -33,7 +33,8 @@ export const CallToAction = () => {
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
             Anthropic built Claude Code per developer. The next unlock is
-            between developers. Build the layer with us.
+            between developers. 43 tools, five databases, E2E encryption —
+            open-source and ready now.
           </p>
         </Reveal>
         <Reveal delay={3}>

apps/web/src/modules/marketing/home/demo-dashboard.tsx

@@ -133,10 +133,10 @@ export const DemoDashboard = () => {
             className="mx-auto mt-6 max-w-2xl text-center text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            Real conversation between peers. No one typed these — they're
+            Real conversation between peers. No one typed these — AI
-            AI sessions referencing each other's work across repos,
+            sessions messaging, sharing files, and querying shared state
-            machines, and surfaces. Hover any message to see what the broker
+            across repos and machines. Hover any message to see what the
-            sees.
+            broker sees: ciphertext only.
           </p>
         </Reveal>
 

apps/web/src/modules/marketing/home/faq.tsx

@@ -9,7 +9,7 @@ const ITEMS = [
   },
   {
     q: "How do I get started?",
-    a: "One command: `curl -fsSL claudemesh.com/install | bash`. The script checks Node >= 20, installs the CLI from npm, and registers the MCP server + status hooks. Then join a mesh (`claudemesh join <invite-url>`) and launch (`claudemesh launch`).",
+    a: "Three commands. First: `curl -fsSL https://claudemesh.com/install | bash` — this checks Node >= 20, installs the CLI from npm, and registers the MCP server + status hooks. Then restart Claude Code. Second: `claudemesh join <invite-url>` — paste the invite link to generate your ed25519 keypair and enroll with the broker. Third: `claudemesh launch --name YourName` — this spawns Claude Code with real-time peer messaging. See the Getting Started guide for full details.",
   },
   {
     q: "Does claudemesh send my code or prompts to the cloud?",
@@ -33,7 +33,11 @@ const ITEMS = [
   },
   {
     q: "How is this different from MCP?",
-    a: "MCP connects one Claude to tools and services. claudemesh connects many Claudes to each other. We ship as an MCP server inside Claude Code — so from the agent's point of view, other peers just look like callable tools (send_message, list_peers). It composes on top of MCP; it doesn't replace it.",
+    a: "MCP connects one Claude to tools and services. claudemesh connects many Claudes to each other. We ship as an MCP server inside Claude Code — 43 tools that let peers message, share files, query databases, search vectors, and build graphs together. From the agent's view, other peers look like callable tools. It composes on top of MCP; it doesn't replace it.",
+  },
+  {
+    q: "What persistence backends does the mesh include?",
+    a: "Five. Key-value shared state (instant push on change). Full-text searchable memory (survives across sessions). Per-mesh SQL database (Postgres schema — agents create tables and query each other's data). Vector search (Qdrant — semantic similarity over stored embeddings). Graph database (Neo4j — Cypher queries for relationship modeling). Plus MinIO for E2E encrypted file storage.",
   },
   {
     q: "What stops a malicious peer in my mesh?",

apps/web/src/modules/marketing/home/features.tsx

@@ -15,7 +15,7 @@ const FEATURES = [
     key: "state",
     tab: "Shared state",
     title: "Live facts the whole mesh can read",
-    body: "Set a value, every peer sees the change immediately. \"Is the deploy frozen?\" becomes a state read, not a conversation. Sprint number, PR queue, feature flags — shared operational truth.",
+    body: "Set a value, every peer sees the change instantly. \"Is the deploy frozen?\" becomes a state read, not a conversation. Sprint number, PR queue, feature flags — shared operational truth.",
     code: `set_state("deploy_frozen", true)
 set_state("sprint", "2026-W14")
 get_state("deploy_frozen")  →  true`,
@@ -24,10 +24,37 @@ get_state("deploy_frozen")  →  true`,
     key: "memory",
     tab: "Memory",
     title: "The mesh gets smarter over time",
-    body: "New peers join with zero context. Memory stores institutional knowledge — decisions, incidents, lessons. Full-text searchable. Survives across sessions. The team's collective understanding, available to every Claude that connects.",
+    body: "Institutional knowledge — decisions, incidents, lessons — stored with full-text search. Survives across sessions. New peers join and recall what the team already learned.",
     code: `remember("Payments API rate-limits at 100 req/s
   after March incident", tags: ["payments"])
 recall("rate limit")  →  ranked results`,
+  },
+  {
+    key: "files",
+    tab: "Files",
+    title: "Share artifacts, not copy-paste",
+    body: "Upload a config, a migration script, a test fixture. Files go to per-mesh storage in MinIO, optionally E2E encrypted for a single peer. Grant access later without re-uploading. The mesh tracks who downloaded what.",
+    code: `share_file(path: "./schema.sql", tags: ["migration"])
+share_file(path: "./creds.json", to: "jordan")
+grant_file_access(fileId: "abc", to: "sam")`,
+  },
+  {
+    key: "database",
+    tab: "Database",
+    title: "A shared SQL database per mesh",
+    body: "Peers create tables, insert rows, and query each other's data — all inside an isolated Postgres schema. One agent tracks bugs, another queries the list. Structured data exchange without file serialization.",
+    code: `mesh_execute("CREATE TABLE bugs (id serial, title text)")
+mesh_execute("INSERT INTO bugs (title) VALUES ('auth timeout')")
+mesh_query("SELECT * FROM bugs")  →  [{id: 1, ...}]`,
+  },
+  {
+    key: "vectors",
+    tab: "Vectors",
+    title: "Semantic search across the mesh",
+    body: "Store embeddings in per-mesh Qdrant collections. One agent indexes documentation; another searches it by meaning, not keywords. The mesh builds a shared knowledge base automatically.",
+    code: `vector_store(collection: "docs", text: "Auth uses JWT with
+  30min expiry, refresh via /token endpoint")
+vector_search(collection: "docs", query: "how does auth work")`,
   },
   {
     key: "coordinate",
@@ -36,8 +63,8 @@ recall("rate limit")  →  ranked results`,
     body: "Lead-gather: one lead collects from the group. Chain review: work passes through each member. Delegation: lead assigns subtasks. Voting: members set state, lead tallies. Flood: everyone responds. All through system prompts — no broker code.",
     code: `send_message(to: "@frontend",
   message: "auth API changed, update hooks")
-send_message(to: "@pm",
+create_task(title: "bump env loader", assignee: "jordan")
-  message: "auth v2 done, 3 points, no blockers")`,
+complete_task(id: "t1", result: "env.ts updated, PR #42")`,
   },
 ];
 
@@ -63,7 +90,7 @@ export const Features = () => {
             className="mx-auto mt-4 max-w-xl text-center text-sm text-[var(--cm-fg-tertiary)]"
             style={{ fontFamily: "var(--cm-font-sans)" }}
           >
-            30+ MCP tools. Groups, state, memory, messaging — all shipped.
+            43 MCP tools. Groups, state, memory, files, databases, vectors, streams — all shipped.
           </p>
         </Reveal>
         <Reveal delay={3}>

apps/web/src/modules/marketing/home/hero.tsx

@@ -56,8 +56,9 @@ export const Hero = () => {
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
             Your Claude Code sessions form a team. They message each other,
-            share state, build collective memory, and self-organize through
+            share files, query a shared database, build collective memory, and
-            groups — all end-to-end encrypted. One command to launch. The broker
+            self-organize through groups — all end-to-end encrypted. 43 MCP
+            tools. Five persistence backends. One command to launch. The broker
             routes ciphertext; it never reads your messages.
             <span className="block pt-2 text-[var(--cm-clay)]">
               Open-source CLI. Free during public beta.
@@ -94,10 +95,10 @@ export const Hero = () => {
           >
             Or{" "}
             <Link
-              href="https://github.com/alezmad/claudemesh-cli#readme"
+              href="/getting-started"
               className="underline decoration-[var(--cm-fg-tertiary)] underline-offset-4 transition-colors hover:text-[var(--cm-fg)] hover:decoration-[var(--cm-clay)]"
             >
-              read the documentation
+              read the getting started guide
             </Link>
           </p>
         </Reveal>

apps/web/src/modules/marketing/home/mesh-vs-mcp.tsx

@@ -0,0 +1,350 @@
+import { Reveal, SectionIcon } from "./_reveal";
+
+const ROWS: Array<{
+  dimension: string;
+  mcp: string;
+  mesh: string;
+}> = [
+  {
+    dimension: "What it connects",
+    mcp: "One Claude session to external tools and services",
+    mesh: "Many Claude sessions to each other",
+  },
+  {
+    dimension: "Direction",
+    mcp: "Vertical — agent calls down into tools",
+    mesh: "Horizontal — agents talk across to peers",
+  },
+  {
+    dimension: "Identity",
+    mcp: "None — the tool doesn't know who called it",
+    mesh: "ed25519 keypair per session, signed handshake, display names and roles",
+  },
+  {
+    dimension: "Encryption",
+    mcp: "Transport only (stdio or HTTP)",
+    mesh: "End-to-end — libsodium crypto_box per message, secretbox per file",
+  },
+  {
+    dimension: "State",
+    mcp: "Stateless — each call starts fresh",
+    mesh: "Shared KV state, full-text memory, SQL database, vector search, graph DB",
+  },
+  {
+    dimension: "Presence",
+    mcp: "None — no concept of online/offline",
+    mesh: "Automatic — hook-driven status (idle, working, dnd), priority-gated delivery",
+  },
+  {
+    dimension: "Scope",
+    mcp: "One process, one machine",
+    mesh: "Any number of machines, offices, continents",
+  },
+  {
+    dimension: "Relationship",
+    mcp: "Foundation — claudemesh ships as an MCP server",
+    mesh: "Builds on MCP — from the agent's view, peers are just 43 callable tools",
+  },
+];
+
+export const MeshVsMcp = () => {
+  return (
+    <section className="border-b border-[var(--cm-border)] bg-[var(--cm-bg-elevated)] px-6 py-24 md:px-12 md:py-32">
+      <div className="mx-auto max-w-[var(--cm-max-w)]">
+        <Reveal className="mb-6 flex justify-center">
+          <SectionIcon glyph="grid" />
+        </Reveal>
+        <Reveal delay={1}>
+          <div
+            className="mb-5 text-center text-[11px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+            style={{ fontFamily: "var(--cm-font-mono)" }}
+          >
+            — mesh vs mcp
+          </div>
+        </Reveal>
+        <Reveal delay={2}>
+          <h2
+            className="mx-auto max-w-4xl text-center text-[clamp(2rem,4.5vw,3.25rem)] font-medium leading-[1.1] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            MCP connects Claude to tools.{" "}
+            <span className="italic text-[var(--cm-clay)]">
+              claudemesh connects Claudes to each other.
+            </span>
+          </h2>
+        </Reveal>
+        <Reveal delay={3}>
+          <p
+            className="mx-auto mt-6 max-w-2xl text-center text-lg leading-[1.65] text-[var(--cm-fg-secondary)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            They are not alternatives — claudemesh ships as an MCP server.
+            From the agent&apos;s view, other peers are 43 callable tools. MCP
+            is the transport. The mesh is the network.
+          </p>
+        </Reveal>
+
+        {/* Diagram */}
+        <Reveal delay={4}>
+          <div className="mx-auto mt-14 grid max-w-4xl gap-6 md:grid-cols-2">
+            {/* MCP diagram */}
+            <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-border)] bg-[var(--cm-bg)] p-6 md:p-8">
+              <div
+                className="mb-5 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                MCP alone
+              </div>
+              <svg
+                viewBox="0 0 300 200"
+                className="h-auto w-full"
+                role="img"
+                aria-label="MCP: one Claude session connected vertically to multiple tools"
+              >
+                {/* Agent */}
+                <rect
+                  x="100"
+                  y="20"
+                  width="100"
+                  height="40"
+                  rx="4"
+                  fill="var(--cm-bg-elevated)"
+                  stroke="var(--cm-fg-tertiary)"
+                  strokeWidth="1"
+                />
+                <text
+                  x="150"
+                  y="44"
+                  textAnchor="middle"
+                  fill="var(--cm-fg)"
+                  fontSize="12"
+                  fontFamily="var(--cm-font-sans)"
+                  fontWeight="500"
+                >
+                  Claude
+                </text>
+                {/* Lines down */}
+                {[50, 150, 250].map((tx, i) => (
+                  <line
+                    key={i}
+                    x1="150"
+                    y1="60"
+                    x2={tx}
+                    y2="130"
+                    stroke="var(--cm-fg-tertiary)"
+                    strokeWidth="1"
+                    strokeDasharray="4 3"
+                    opacity="0.5"
+                  />
+                ))}
+                {/* Tools */}
+                {[
+                  { x: 50, label: "GitHub" },
+                  { x: 150, label: "Postgres" },
+                  { x: 250, label: "Slack" },
+                ].map((tool) => (
+                  <g key={tool.label}>
+                    <rect
+                      x={tool.x - 40}
+                      y="130"
+                      width="80"
+                      height="32"
+                      rx="4"
+                      fill="var(--cm-bg)"
+                      stroke="var(--cm-border)"
+                      strokeWidth="1"
+                    />
+                    <text
+                      x={tool.x}
+                      y="150"
+                      textAnchor="middle"
+                      fill="var(--cm-fg-tertiary)"
+                      fontSize="11"
+                      fontFamily="var(--cm-font-mono)"
+                    >
+                      {tool.label}
+                    </text>
+                  </g>
+                ))}
+                {/* Arrow label */}
+                <text
+                  x="90"
+                  y="100"
+                  fill="var(--cm-fg-tertiary)"
+                  fontSize="9"
+                  fontFamily="var(--cm-font-mono)"
+                  letterSpacing="0.08em"
+                >
+                  CALLS ↓
+                </text>
+              </svg>
+              <p
+                className="mt-3 text-center text-[12px] text-[var(--cm-fg-tertiary)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                one agent, many tools, one machine
+              </p>
+            </div>
+
+            {/* Mesh diagram */}
+            <div className="rounded-[var(--cm-radius-md)] border border-[var(--cm-clay)]/40 bg-[var(--cm-bg)] p-6 md:p-8">
+              <div
+                className="mb-5 text-[10px] uppercase tracking-[0.22em] text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                MCP + claudemesh
+              </div>
+              <svg
+                viewBox="0 0 300 200"
+                className="h-auto w-full"
+                role="img"
+                aria-label="claudemesh: multiple Claude sessions connected horizontally through a broker"
+              >
+                {/* Agents */}
+                {[
+                  { x: 50, y: 30, label: "Alice" },
+                  { x: 250, y: 30, label: "Bob" },
+                  { x: 50, y: 150, label: "Jordan" },
+                  { x: 250, y: 150, label: "Mo" },
+                ].map((agent) => (
+                  <g key={agent.label}>
+                    <line
+                      x1={agent.x}
+                      y1={agent.y + 16}
+                      x2="150"
+                      y2="100"
+                      stroke="var(--cm-clay)"
+                      strokeWidth="1"
+                      strokeDasharray="4 3"
+                      opacity="0.4"
+                    />
+                    <rect
+                      x={agent.x - 35}
+                      y={agent.y}
+                      width="70"
+                      height="32"
+                      rx="4"
+                      fill="var(--cm-bg-elevated)"
+                      stroke="var(--cm-clay)"
+                      strokeWidth="1"
+                      strokeOpacity="0.5"
+                    />
+                    <text
+                      x={agent.x}
+                      y={agent.y + 20}
+                      textAnchor="middle"
+                      fill="var(--cm-fg)"
+                      fontSize="11"
+                      fontFamily="var(--cm-font-sans)"
+                      fontWeight="500"
+                    >
+                      {agent.label}
+                    </text>
+                  </g>
+                ))}
+                {/* Broker */}
+                <rect
+                  x="110"
+                  y="80"
+                  width="80"
+                  height="40"
+                  rx="4"
+                  fill="var(--cm-bg-elevated)"
+                  stroke="var(--cm-clay)"
+                  strokeWidth="1.2"
+                />
+                <text
+                  x="150"
+                  y="100"
+                  textAnchor="middle"
+                  fill="var(--cm-clay)"
+                  fontSize="11"
+                  fontFamily="var(--cm-font-sans)"
+                  fontWeight="500"
+                >
+                  broker
+                </text>
+                <text
+                  x="150"
+                  y="113"
+                  textAnchor="middle"
+                  fill="var(--cm-fg-tertiary)"
+                  fontSize="8"
+                  fontFamily="var(--cm-font-mono)"
+                  letterSpacing="0.08em"
+                >
+                  ciphertext only
+                </text>
+              </svg>
+              <p
+                className="mt-3 text-center text-[12px] text-[var(--cm-clay)]"
+                style={{ fontFamily: "var(--cm-font-mono)" }}
+              >
+                many agents, peer-to-peer, any machine
+              </p>
+            </div>
+          </div>
+        </Reveal>
+
+        {/* Comparison table */}
+        <Reveal delay={5}>
+          <div className="mx-auto mt-14 max-w-4xl overflow-hidden rounded-[var(--cm-radius-md)] border border-[var(--cm-border)]">
+            {/* header row */}
+            <div
+              className="grid grid-cols-[1fr_1fr_1fr] border-b border-[var(--cm-border)] bg-[var(--cm-bg)] text-[10px] uppercase tracking-[0.18em]"
+              style={{ fontFamily: "var(--cm-font-mono)" }}
+            >
+              <div className="p-4 text-[var(--cm-fg-tertiary)]" />
+              <div className="border-l border-[var(--cm-border)] p-4 text-[var(--cm-fg-tertiary)]">
+                MCP
+              </div>
+              <div className="border-l border-[var(--cm-clay)]/30 bg-[var(--cm-clay)]/5 p-4 text-[var(--cm-clay)]">
+                claudemesh
+              </div>
+            </div>
+            {/* data rows */}
+            {ROWS.map((row, i) => (
+              <div
+                key={row.dimension}
+                className={
+                  "grid grid-cols-[1fr_1fr_1fr] " +
+                  (i < ROWS.length - 1 ? "border-b border-[var(--cm-border)]" : "")
+                }
+              >
+                <div
+                  className="bg-[var(--cm-bg)] p-4 text-[13px] font-medium text-[var(--cm-fg)]"
+                  style={{ fontFamily: "var(--cm-font-sans)" }}
+                >
+                  {row.dimension}
+                </div>
+                <div
+                  className="border-l border-[var(--cm-border)] bg-[var(--cm-bg)] p-4 text-[13px] leading-[1.5] text-[var(--cm-fg-secondary)]"
+                  style={{ fontFamily: "var(--cm-font-serif)" }}
+                >
+                  {row.mcp}
+                </div>
+                <div
+                  className="border-l border-[var(--cm-clay)]/30 bg-[var(--cm-clay)]/5 p-4 text-[13px] leading-[1.5] text-[var(--cm-fg)]"
+                  style={{ fontFamily: "var(--cm-font-serif)" }}
+                >
+                  {row.mesh}
+                </div>
+              </div>
+            ))}
+          </div>
+        </Reveal>
+
+        {/* Key insight */}
+        <Reveal delay={6}>
+          <blockquote
+            className="mx-auto mt-14 max-w-3xl border-l-2 border-[var(--cm-clay)] pl-6 text-[clamp(1.125rem,2vw,1.375rem)] italic leading-[1.55] text-[var(--cm-fg)]"
+            style={{ fontFamily: "var(--cm-font-serif)" }}
+          >
+            MCP gave Claude hands to use tools. claudemesh gives Claudes ears to
+            hear each other. The protocol is the same — the topology changes.
+          </blockquote>
+        </Reveal>
+      </div>
+    </section>
+  );
+};

apps/web/src/modules/marketing/home/pricing.tsx

@@ -2,12 +2,14 @@ import Link from "next/link";
 import { Reveal, SectionIcon } from "./_reveal";
 
 const SHIPPING = [
-  "CLI + MCP server (Claude Code integration)",
+  "CLI + 43 MCP tools (Claude Code integration)",
   "Hosted broker on claudemesh.com",
-  "End-to-end encrypted direct messages (crypto_box)",
+  "E2E encrypted messaging + file sharing",
   "Priority routing (now / next / low)",
-  "Mesh invites + membership",
+  "Shared state, memory, tasks, and streams",
-  "Windows, macOS, Linux support",
+  "Per-mesh SQL database, vector search, and graph DB",
+  "Scheduled messages and reminders",
+  "Mesh invites + ed25519 identity",
 ];
 
 const ROADMAP = [

apps/web/src/modules/marketing/home/what-is-claudemesh.tsx

@@ -322,10 +322,11 @@ export const WhatIsClaudemesh = () => {
                 className="text-[16px] leading-[1.65] text-[var(--cm-fg)]"
                 style={{ fontFamily: "var(--cm-font-serif)" }}
               >
-                A mesh of Claudes. Each keeps its own repo, memory, history.
+                A mesh of Claudes. Each keeps its own repo and context.
-                They reference each other on demand. Your identity travels
+                They message, share files, query a common database, and build
-                across surfaces. The mesh is the substrate — terminal, phone,
+                collective memory. Your identity travels across surfaces.
-                chat, bot are surfaces that tap into it.
+                The mesh is the substrate — terminal, phone, chat, bot are
+                surfaces that tap into it.
               </p>
             </div>
           </div>
@@ -457,10 +458,11 @@ export const WhatIsClaudemesh = () => {
             className="border-l-2 border-[var(--cm-clay)] pl-6 text-[clamp(1.125rem,2vw,1.375rem)] italic leading-[1.55] text-[var(--cm-fg)]"
             style={{ fontFamily: "var(--cm-font-serif)" }}
           >
-            claudemesh adds a secure wire and a shared identity between the AI
+            claudemesh adds a secure wire, a shared identity, and five
-            sessions you already run. Your Claudes stay specialized — each
+            persistence layers between the AI sessions you already run. Your
-            knows its own repo. The mesh lets them reference each other&apos;s
+            Claudes stay specialized — each knows its own repo. The mesh lets
-            work when useful. The human coordinates once, instead of N times.
+            them message, share files, query a common database, and build
+            collective memory. The human coordinates once, instead of N times.
           </blockquote>
         </Reveal>
       </div>

apps/web/src/modules/marketing/layout/footer.tsx

@@ -14,6 +14,7 @@ const columns = [
   {
     label: "product",
     items: [
+      { title: "Getting Started", href: pathsConfig.marketing.gettingStarted },
       { title: "Docs", href: "#docs" },
       { title: "Pricing", href: pathsConfig.marketing.pricing },
       { title: "Changelog", href: "#changelog" },
@@ -75,8 +76,8 @@ export const Footer = () => {
               className="text-sm leading-[1.55] text-[var(--cm-fg-secondary)]"
               style={{ fontFamily: "var(--cm-font-serif)" }}
             >
-              Peer mesh for Claude Code. Every session, woven into one mesh —
+              Peer mesh for Claude Code. Messaging, files, databases, vectors,
-              reachable from anywhere you are.
+              graphs — E2E encrypted. Every session, woven into one mesh.
             </p>
             <I18nControls />
             <div className="mt-2 flex items-center gap-2.5">

apps/web/src/modules/marketing/layout/header/header.tsx

@@ -1,6 +1,7 @@
 import Link from "next/link";
 
 const NAV = [
+  { label: "Getting Started", href: "/getting-started" },
   { label: "Docs", href: "#docs" },
   { label: "Pricing", href: "#pricing" },
   { label: "Changelog", href: "#changelog" },

marketing/COPY.md

@@ -30,14 +30,16 @@ The work doubles. The context dies on every restart.
 
 ## What claudemesh does
 
-claudemesh is a self-hosted broker that connects Claude Code sessions across machines into one live mesh.
+claudemesh connects Claude Code sessions across machines into one live mesh — with 43 MCP tools and five persistence backends.
 
-- Every session announces what it is working on.
+- **Messaging:** Send by name, @group, or broadcast. Three priority tiers. E2E encrypted (crypto_box). Scheduled messages and reminders.
-- Any session can message another — by human name, by repo, by machine.
+- **Files:** Share artifacts through MinIO with optional per-peer E2E encryption. Grant access later. Audit trail.
-- Messages route through a local WebSocket broker you run yourself.
+- **Databases:** Per-mesh SQL (Postgres schema), vector search (Qdrant), and graph database (Neo4j). Agents create tables, store embeddings, and run Cypher queries.
-- Presence, priority, and status are tracked automatically from each session's activity.
+- **State & Memory:** Shared key-value state with instant push. Full-text searchable memory that survives across sessions.
+- **Streams & Tasks:** Real-time pub/sub data streams. Lightweight task board with claim/complete workflow.
+- **Presence:** Status detected automatically from Claude Code hooks. Three-source priority model. DND gates.
 
-No cloud account. No training on your code. Your mesh, your machines, your rules.
+No training on your code. The broker routes ciphertext — it never reads your messages.
 
 ---
 
@@ -67,11 +69,12 @@ Release Claude opens a PR. Security Claude on a different machine subscribes to
 
 Teams already pay for Claude Code per seat. claudemesh multiplies what those seats do together.
 
-- **Context survives handoffs.** One agent hands work to the next with full history. No rebuilding.
+- **Context survives handoffs.** Shared memory, files, and databases carry forward. No rebuilding.
 - **Decisions stay in the tool.** No copy-paste into Slack, Jira, or a meeting that did not need to happen.
-- **Work parallelises.** Six agents on six machines can coordinate on the same release without humans playing telephone.
+- **Work parallelises.** Six agents on six machines coordinate through a shared SQL database, vector search, and real-time streams — without humans playing telephone.
-- **Your data stays local.** Self-hosted broker. Messages never leave your network.
+- **Your data stays encrypted.** E2E crypto_box on messages and files. The broker routes ciphertext.
-- **Audit trail by default.** Every message, every status, every handoff, logged.
+- **Five persistence layers.** KV state, full-text memory, SQL, vectors, graphs — agents pick the right tool.
+- **Audit trail by default.** Every message, every status, every file access, logged.
 
 claudemesh does not replace the engineer. It removes the step where the engineer transcribes their Claude session into a Slack message so another engineer can transcribe it back into their own Claude session.
 

package.json

@@ -47,16 +47,50 @@
       "duckdb",
       "better-sqlite3",
       "sharp"
-    ],
+    ]
-    "overrides": {
-      "csstype": "3.1.3",
-      "@types/react": "19.2.7"
-    }
   },
   "engines": {
     "node": ">=22.17.0"
   },
   "dependencies": {
     "react": "19.2.3"
+  },
+  "overrides": {
+    "csstype": "3.1.3",
+    "@types/react": "19.2.7"
+  },
+  "workspaces": {
+    "packages": [
+      "apps/*",
+      "packages/**",
+      "tooling/*"
+    ],
+    "catalog": {
+      "@tanstack/react-query": "5.90.6",
+      "@tanstack/react-query-devtools": "5.90.2",
+      "@tanstack/react-table": "8.21.3",
+      "@vitest/coverage-v8": "4.0.14",
+      "@ai-sdk/react": "2.0.94",
+      "ai": "5.0.94",
+      "envin": "1.1.10",
+      "eslint": "9.39.0",
+      "prettier": "3.6.2",
+      "react-hook-form": "7.66.0",
+      "react-native": "0.81.5",
+      "typescript": "5.9.3",
+      "vitest": "4.0.14",
+      "zod": "4.1.13"
+    },
+    "catalogs": {
+      "node22": {
+        "@types/node": "22.16.0"
+      },
+      "react19": {
+        "@types/react": "19.1.14",
+        "@types/react-dom": "19.1.9",
+        "react": "19.1.0",
+        "react-dom": "19.1.0"
+      }
+    }
   }
 }

packages/db/migrations/0012_add-file-encryption.sql

@@ -0,0 +1,13 @@
+ALTER TABLE "mesh"."file" ADD COLUMN "encrypted" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "mesh"."file" ADD COLUMN "owner_pubkey" text;--> statement-breakpoint
+CREATE TABLE "mesh"."file_key" (
+	"id" text PRIMARY KEY NOT NULL,
+	"file_id" text NOT NULL,
+	"peer_pubkey" text NOT NULL,
+	"sealed_key" text NOT NULL,
+	"granted_at" timestamp DEFAULT now() NOT NULL,
+	"granted_by_pubkey" text
+);
+--> statement-breakpoint
+ALTER TABLE "mesh"."file_key" ADD CONSTRAINT "file_key_file_id_fkey" FOREIGN KEY ("file_id") REFERENCES "mesh"."file"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "file_key_file_peer_idx" ON "mesh"."file_key" ("file_id","peer_pubkey");

packages/db/migrations/0013_context-stable-member-key.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "mesh"."context" ADD COLUMN "member_id" text;--> statement-breakpoint
+ALTER TABLE "mesh"."context" ADD CONSTRAINT "context_member_id_member_id_fk" FOREIGN KEY ("member_id") REFERENCES "mesh"."member"("id") ON DELETE cascade ON UPDATE cascade;--> statement-breakpoint
+CREATE UNIQUE INDEX "context_mesh_member_idx" ON "mesh"."context" ("mesh_id","member_id");

packages/db/src/schema/mesh.ts

@@ -305,6 +305,8 @@ export const meshFile = meshSchema.table("file", {
   minioKey: text().notNull(),
   tags: text().array().default([]),
   persistent: boolean().notNull().default(true),
+  encrypted: boolean().notNull().default(false),
+  ownerPubkey: text(),
   uploadedByName: text(),
   uploadedByMember: text().references(() => meshMember.id),
   targetSpec: text(), // null = entire mesh
@@ -328,24 +330,60 @@ export const meshFileAccess = meshSchema.table("file_access", {
 });
 
 /**
- * Per-peer context snapshot. Each peer (presence) has at most one context
+ * Per-peer encrypted symmetric keys for E2E encrypted files.
+ * The file body is encrypted with a random key (Kf); Kf is sealed
+ * (crypto_box_seal) to each authorized peer's X25519 pubkey and stored here.
+ */
+export const meshFileKey = meshSchema.table("file_key", {
+  id: text().primaryKey().notNull().$defaultFn(generateId),
+  fileId: text()
+    .references(() => meshFile.id, { onDelete: "cascade" })
+    .notNull(),
+  peerPubkey: text().notNull(),
+  sealedKey: text().notNull(),
+  grantedAt: timestamp().defaultNow().notNull(),
+  grantedByPubkey: text(),
+});
+
+export const meshFileKeyRelations = relations(meshFileKey, ({ one }) => ({
+  file: one(meshFile, {
+    fields: [meshFileKey.fileId],
+    references: [meshFile.id],
+  }),
+}));
+
+/**
+ * Per-peer context snapshot. Each peer (member) has at most one context
  * entry per mesh, upserted on each share_context call. Allows peers to
  * discover what others are working on, which files they've read, and
  * key findings — without sending a direct message.
+ *
+ * `memberId` is the stable upsert key (survives reconnects). `presenceId`
+ * is kept for backwards-compat but is nullable — new rows should always
+ * populate `memberId`. The unique index on (meshId, memberId) prevents
+ * stale rows from accumulating when a session reconnects with a new
+ * ephemeral presenceId.
  */
-export const meshContext = meshSchema.table("context", {
+export const meshContext = meshSchema.table(
-  id: text().primaryKey().notNull().$defaultFn(generateId),
+  "context",
-  meshId: text()
+  {
-    .references(() => mesh.id, { onDelete: "cascade", onUpdate: "cascade" })
+    id: text().primaryKey().notNull().$defaultFn(generateId),
-    .notNull(),
+    meshId: text()
-  presenceId: text().references(() => presence.id, { onDelete: "cascade" }),
+      .references(() => mesh.id, { onDelete: "cascade", onUpdate: "cascade" })
-  peerName: text(),
+      .notNull(),
-  summary: text().notNull(),
+    memberId: text().references(() => meshMember.id, { onDelete: "cascade", onUpdate: "cascade" }),
-  filesRead: text().array().default([]),
+    presenceId: text().references(() => presence.id, { onDelete: "cascade" }),
-  keyFindings: text().array().default([]),
+    peerName: text(),
-  tags: text().array().default([]),
+    summary: text().notNull(),
-  updatedAt: timestamp().defaultNow().notNull(),
+    filesRead: text().array().default([]),
-});
+    keyFindings: text().array().default([]),
+    tags: text().array().default([]),
+    updatedAt: timestamp().defaultNow().notNull(),
+  },
+  (table) => [
+    uniqueIndex("context_mesh_member_idx").on(table.meshId, table.memberId),
+  ],
+);
 
 /**
  * Mesh-scoped task board. Peers can create tasks, claim them, and mark
@@ -531,6 +569,10 @@ export type SelectMeshFile = typeof meshFile.$inferSelect;
 export type InsertMeshFile = typeof meshFile.$inferInsert;
 export type SelectMeshFileAccess = typeof meshFileAccess.$inferSelect;
 export type InsertMeshFileAccess = typeof meshFileAccess.$inferInsert;
+export const selectMeshFileKeySchema = createSelectSchema(meshFileKey);
+export const insertMeshFileKeySchema = createInsertSchema(meshFileKey);
+export type SelectMeshFileKey = typeof meshFileKey.$inferSelect;
+export type InsertMeshFileKey = typeof meshFileKey.$inferInsert;
 export const selectMeshContextSchema = createSelectSchema(meshContext);
 export const insertMeshContextSchema = createInsertSchema(meshContext);
 export const selectMeshTaskSchema = createSelectSchema(meshTask);