net-cli 0.37.1

Unified `net-mesh` command-line tool for the Net mesh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181

[package]
name = "net-cli"
version.workspace = true
edition = "2021"
description = "Unified `net-mesh` command-line tool for the Net mesh"
license = "MIT OR Apache-2.0"
repository = "https://github.com/ai-2070/net"
publish = true

[[bin]]
name = "net-mesh"
path = "src/main.rs"

[features]
# Stage 4b: the core's announced `rtc_addr` / `rtc_bootstrap`
# only exist in a `webrtc` build. This feature carries them; the
# `anchor` verbs that READ them live behind `rtc-bootstrap` below.
webrtc = ["net-sdk/webrtc"]
# Stage 4b: `net-mesh anchor serve` runs the browser bootstrap
# listener and `net-mesh anchor ls` reads the anchor directory a
# daemon serves, so both pull the SDK's HTTP surface — both verbs
# require THIS feature, not `webrtc` alone. Off by default: the
# standard CLI stays free of an HTTP server.
rtc-bootstrap = ["webrtc", "net-sdk/rtc-bootstrap"]
# `keychain` turns on the OS-keychain secret value store so `net-mesh
# forwarding set-value` can persist a forwarded secret (it enables
# `net-mesh-mcp`'s own
# `keychain` feature). NOT a default: it pulls the `keyring` dependency and
# needs a keychain-capable host, so the standard build stays lean. The
# `set-value` subcommand is always present; without this feature it returns a
# clear "rebuild with --features keychain" error instead of silently missing.
keychain = ["net-mesh-mcp/keychain"]
# TEST ONLY: compiles the core's crash-injection points at the enrollment
# storage's durable-write transitions (`NET_MESH_FIXTURE_CRASH`), exercised by
# `tests/enrollment_crash.rs`. Never enable it in a shipped build.
fixtures = ["net/fixtures"]

[dependencies]
# The low-level core crate, for the OFFLINE subnet issuance verbs (SSDK
# S3): SubnetGrant/SubnetIssuerGrant/floor/fact `try_issue` are deliberately
# NOT re-exported by the ergonomic SDK — the CLI is the intended issuer.
# Feature set stays inside what `net-sdk` below already unifies.
net = { package = "net-mesh", version = "0.37.1", path = "..", default-features = false, features = [
    "net",
] }
net-sdk = { package = "net-mesh-sdk", version = "0.37.1", path = "../sdk", default-features = false, features = [
    "net",
    "nat-traversal",
    # `up --enroll` asks the router to forward its port (UPnP / NAT-PMP / PCP).
    "port-mapping",
    "cortex",
    "compute",
    "groups",
    "meshos",
    "deck",
    "dataforts",
    "meshdb",
    "aggregator",
    "tool",
] }

# The MCP edge adapter powers `net wrap` (wrap a stdio MCP server as mesh
# capabilities). The CLI is the packaging point — it links the adapter the
# same way it links the SDK; the adapter itself still rides on the SDK only.
net-mesh-mcp = { version = "0.37.1", path = "../adapters/mcp" }

# Clap derives the argv parser from typed structs; `env` enables
# `NET_MESH_*` env-var fallback for global flags (`--profile` etc.).
clap = { version = "4", features = ["derive", "env"] }
# `clap_complete` powers `net-mesh completion <shell>`; `clap_mangen`
# powers `net-mesh man`. Release tarballs run those subcommands
# post-build to capture the output into `share/bash-completion/...`
# and `share/man/man1/net-mesh.1`.
clap_complete = "4"
clap_mangen = "0.3"

# Multi-thread tokio for the SDK; macros for `#[tokio::main]`.
tokio = { version = "1", features = [
    "macros",
    "rt-multi-thread",
    "sync",
    "time",
    "signal",
    "fs",
    "io-std",
    "io-util",
] }

# Serde stack for output dispatch + identity/config file parsing.
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yaml = "0.9"

# Pretty terminal tables for `--output table` (Phase 1: read-only
# views).
comfy-table = "8"

# Progress display for `net transfer recv-blob` / `recv-dir`. The SDK
# fetch is a single await with no per-chunk callback, so this drives a
# steady-tick spinner while the fetch runs, then a final one-line
# summary — live feedback for the directory-transfer demo without
# fabricating per-chunk counts the substrate doesn't surface. Drawn to
# stderr and suppressed under `--quiet` / non-TTY so it never pollutes
# `--output json` on stdout.
indicatif = "0.18"

# Tracing-subscriber wires `-v` / `-vv` / `-vvv` to env-filter
# levels. Format pinned to compact for stderr.
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
tracing = "0.1"

# `net-mesh up` local control: keyed-BLAKE3 mutual authentication of the
# per-run control secret, and CSPRNG for that secret, the run incarnation and
# a generated trust-domain PSK. Both versions are already in the workspace.
blake3 = "1"
getrandom = "0.4"
# The SDK enrollment ledger handle (`SharedLedger`) is a parking_lot mutex.
parking_lot = "0.12"

# XDG paths + TOML for the config + identity stores.
dirs = "7"
toml = "1.0"

# Streaming combinators used by the audit/log/failures ndjson
# outputs and the snapshot watch loop.
futures = "0.3"

# Hex codec for identity material (seed / public key / signature).
hex = "0.4"

# SHA-256 for the operator-visible identity fingerprint. ssh
# uses SHA-256 for the analogous `ssh-keygen -lf` surface; we
# mirror the algorithm so operators recognize the fingerprint
# format at a glance.
sha2 = "0.11"

# Typed errors at the config / identity boundary.
thiserror = "2"

# `cargo binstall net-cli` resolves prebuilt tarballs against the
# `release-binaries-cli.yml` workflow's GitHub Release assets.
# Defaults to the binstall convention except for the tag prefix
# (`cli-v*`, not `net-cli-v*`) and the binary name (the crate is
# `net-cli` but the binary inside is `net-mesh`).
[package.metadata.binstall]
pkg-url = "{ repo }/releases/download/cli-v{ version }/{ name }-v{ version }-{ target }.{ archive-suffix }"
bin-dir = "{ name }-v{ version }-{ target }/net-mesh{ binary-ext }"
pkg-fmt = "tgz"

[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
pkg-fmt = "zip"

[dev-dependencies]
portable-pty = "0.9"
async-trait = "0.1"
postcard = { version = "1", default-features = false, features = ["alloc"] }
# Drive the binary in integration tests.
assert_cmd = "2"
predicates = "3"
tempfile = "3"

# Async test helpers — `#[tokio::test]` + the SDK's in-process
# cluster fixtures.
tokio = { version = "1", features = [
    "rt-multi-thread",
    "macros",
    "time",
    "test-util",
] }

# Boot the aggregator-daemon in-process for the remote-attach
# integration test (`tests/aggregator_remote.rs`). The CLI
# subprocess handshakes against this booted daemon's MeshNode.
#
# Path-only on purpose — net-aggregator-daemon is a binary
# crate that doesn't publish to crates.io, so giving this
# dev-dep a `version = ...` field would make `cargo publish
# --dry-run` (and any real publish) fail at the dependency-
# resolution step. With only `path` set, cargo drops the
# dev-dep entirely when packaging.
net-aggregator-daemon = { path = "../aggregator-daemon" }