Combines space color scheme selection feature with form-request
and reply chain designs. Resolves totals: 7 Complete, 4 In Progress,
18 Not Started.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

```
## Description

This PR addresses a critical issue where the libp2p network failed to establish connections between daemons running on different machines across the internet, despite working locally. The primary goal is to enable proper NAT traversal and DHT discovery for cross-internet connectivity, and to provide comprehensive debug logging to diagnose future connectivity issues.

**Key Changes:**

1.  **Added Missing Services:**
    *   `@libp2p/dcutr` (Direct Connection Upgrade through Relay): Essential for upgrading relayed connections to direct peer-to-peer connections via hole punching.
    *   `@libp2p/autonat`: Enables the node to determine its external reachability, allowing the Kad-DHT to move out of client mode and store peer records, making the node discoverable.
2.  **Enhanced Address Advertising:** Modified `buildAddresses()` to include public multiaddrs (relay, WebRTC) as `?ma=` query parameters in advertised URLs, reducing reliance on potentially failing DHT lookups.
3.  **Comprehensive Debug Logging:** Integrated detailed logging across all connectivity phases (startup, connection events, peer events, self-address updates, dial attempts, DHT fallback, periodic status, internal libp2p components) to provide deep visibility into the networking stack.

These changes directly address the most likely causes of cross-internet connectivity failure, primarily the inability to perform NAT hole punching and the node remaining undiscoverable in the DHT. The enhanced logging will be crucial for further diagnosis and verification.

### Security Considerations

This change introduces two new libp2p dependencies (`@libp2p/dcutr`, `@libp2p/autonat`). While these are standard libp2p components, any new dependency introduces a minor increase in the attack surface. No new authorities or significant boundary changes are introduced.

### Scaling Considerations

The added services and verbose logging will introduce a slight increase in CPU cycles and RAM consumption. However, these services are fundamental for the intended cross-internet networking functionality and are designed to be efficient. The logging is primarily for debug purposes and can be controlled via environment variables.

### Documentation Considerations

This PR primarily focuses on internal networking improvements and debuggability. No direct user-facing documentation changes are immediately required. Existing deployments will benefit from improved connectivity without requiring specific upgrade instructions.

### Testing Considerations

This PR itself is a prerequisite for effective testing of cross-internet connectivity. The enhanced logging will be invaluable for diagnosing why connections fail or succeed in various NAT environments. Future integration tests should leverage this logging to verify successful hole punching and DHT registration.

### Compatibility Considerations

This change is fully backward-compatible. It enhances the libp2p network's ability to connect across diverse network topologies without breaking existing usage patterns.

### Upgrade Considerations

No specific upgrade steps are required for live production systems beyond updating the daemon to include the new dependencies and code. The changes are additive and improve network robustness.
```

---
<p><a
href="https://cursor.com/agents/bc-a8018a51-f893-4da8-8248-8e2620fcbd61"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-a8018a51-f893-4da8-8248-8e2620fcbd61"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</p>

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Refactor makeContentSha256Store to makeContentStore, wrapping with
  makeSnapshotStore from @endo/platform
- Add readable-tree formula: makeReadableTree, checkinTree on DaemonCore
- Add storeTree on host for checking in remote trees
- Add ReadableTreeInterface guard and help text

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- endo checkin <path> --name <name>: stores a local directory as a
  readable tree via host.storeTree()
- endo checkout <name> <path>: materializes a readable tree to a
  local directory via checkoutTree()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Store, retrieve, nested lookup, persistence across restart, empty tree,
and unknown-name error cases.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The daemon's special name for an agent's own profile was renamed from
AGENT to @agent. Update all --powers flags, help text, and documentation
across cli, lal, fae, genie, daemon network setup, and relay-server.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…message fixes

- Add secret property to FormField type; mask auth token inputs with
  show/hide toggle and copy button in Chat UI
- Remove promise/resolver from definition messages — define() is now
  fire-and-forget, the sender cannot observe submission
- Remove rejection capability from definition messages
- Make definition Submit button reusable (not one-shot)
- Fix conversation filter for self-to-self value messages (deliverValueById)
- Fix adopt() to handle type:'value' messages (not just packages)
- Update lal/fae agent forms to mark authToken as secret
- Update lal define tool description to reflect fire-and-forget semantics

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

snapshotTreeMethods includes a sha256() method, but the
EndoReadableTree interface guard did not allow it, causing
readable-tree formulas to fail on rehydration with
"methods ['sha256'] not guarded by EndoReadableTree".

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Port the CLI checkin/checkout commands to the Chat UI using the
browser File System Access API (showDirectoryPicker). Checkin wraps
a FileSystemDirectoryHandle as Far ReadableTree/ReadableBlob objects
the daemon can walk over CapTP. Checkout walks a remote tree and
writes files via FileSystemFileHandle.createWritable.

New files:
- browser-tree.js: makeBrowserTree() and checkoutToDirectory()
- command-registry.js: /checkin (ci) and /checkout (co) definitions
- command-executor.js: execution cases for both commands

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add a "Prefer Direct Tools Over Code" section to the lal system prompt
explaining that list, lookup, has, send, reply, etc. work without host
approval, while evaluate/define block on permission. The agent should
only propose code when computation is genuinely required.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- browser-tree.test.js: 14 tests covering makeBrowserTree (list, has,
  lookup, streamBase64 iterator protocol, onFile callback) and
  checkoutToDirectory (file writing, subdirectory creation, empty trees)
- command-executor.test.js: 6 tests for checkin/checkout execution,
  alias resolution, path splitting, and showDirectoryPicker fallback
- command-registry.test.js: 7 tests for checkin/checkout definitions,
  aliases, category membership; fix pre-existing select type validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Align with the Chat UI /clear command. The old name is kept as an
alias for backward compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mount snapshots a local directory into the daemon as a readable tree
(same mechanism as checkin). scratch is an alias for mkdir, creating
an empty writable directory.

CLI: endo mount <path> --name <name>, endo scratch <name>
Chat: /mount <name> (directory picker), /scratch <name>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ob detection

Replace try/catch duck-typing (calling list() on blobs) with
__getMethodNames__() introspection in checkin and checkout. This
eliminates noisy CapTP error logging when blobs reject the list() call.

Convert browser-tree.js from Far to makeExo with proper interface guards
so __getMethodNames__ is provided automatically by the Exo framework.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Adds mount and scratch-mount formula types backed by live filesystem
access with confinement. Updates CLI mount to use provideMount instead
of checkin, adds mkscratch command, and updates Chat commands and tests
to match.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

runEndo/runEngo constructed the child env from only configToEnv
(4 path vars) plus explicit overrides. When client.js auto-started
the daemon via start(), ENDO_ADDR was lost, causing the APPS
web-server to bind the default port (8920) instead of the
caller's configured port — colliding with another daemon.

Made-with: Cursor

When the APPS web-server worker crashes (e.g. EADDRINUSE from a
port conflict), lookup('@apps') / getAddress() never settles,
blocking the ready signal indefinitely. Wrap the APPS gateway
check in a 10s timeout with a try/catch so the daemon reports
readiness (or an error) instead of hanging forever.

Applies to both daemon-node.js and daemon-go.js.

Made-with: Cursor

…surface

make() returned the Far('WebletService') without awaiting the
server listen result, trapping EADDRINUSE errors inside an
unobserved promise. The error hit SES_UNCAUGHT_EXCEPTION in the
worker but never reached the daemon, causing the make-unconfined
formula to appear healthy while the gateway was dead.

Await `started` before returning so listen failures reject the
formula itself, propagating cleanly through lookup('@apps') to
the daemon's startup try/catch. Also add a rejection handler to
the fire-and-forget .then() log to prevent unhandled rejections.

Made-with: Cursor

Adds a standalone script (endo-skill.js) that connects to the running
Endo daemon via CapTP and exposes subcommands for inspecting and
interacting with agents, channels, and the inbox.

Commands: names, lookup, inbox, agent-inbox, read-message, send,
agent-send, channel-messages, channel-members, channel-post.

Includes a Claude Code skill definition (.claude/skills/endo/skill.md)
so the skill is available to all contributors in the monorepo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>