feat(mesh): Phase 2 — provider-agnostic IMeshTransport + runtime swap

.agt-sdk/.gitignore

@@ -0,0 +1,2 @@
+*.tgz
+*.tar.gz

.github/workflows/ci.yml

@@ -125,6 +125,11 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
+      - name: "Build mesh-plugin (file: dep of runtime)"
+        working-directory: mesh-plugin
+        run: |
+          cd ../vendor/agentmesh-sdk && npm install --ignore-scripts
+          cd ../../mesh-plugin && npm install && npm run build
       - run: npm install
       - run: npm run typecheck
       - run: npm run lint

cli/src/commands/dev/local-k8s.ts

@@ -51,6 +51,14 @@ export interface LocalK8sOptions {
    * common first-run prompt.
    */
   forceRebuild?: boolean;
+  /**
+   * Mesh stack to deploy in the local kind cluster. 'vendored' (default)
+   * uses the Rust relay + Postgres registry; 'agt' uses the Microsoft
+   * AGT Python relay. The chosen value is forwarded to the helm chart
+   * via --set mesh.provider= so the controller spawns sandboxes with
+   * the matching AZURECLAW_MESH_PROVIDER env var.
+   */
+  meshProvider?: "vendored" | "agt";
 }
 
 /**
@@ -490,6 +498,7 @@ async function helmInstall(
   release: string,
   chartDir: string,
   valuesOverlays: string[],
+  setArgs: string[] = [],
 ): Promise<void> {
   // We render-then-apply (rather than `helm install`) to keep failures
   // visible: `kubectl apply -f -` shows precisely which resources didn't
@@ -506,6 +515,9 @@ async function helmInstall(
   for (const overlay of valuesOverlays) {
     args.push("-f", overlay);
   }
+  for (const kv of setArgs) {
+    args.push("--set", kv);
+  }
   const { stdout } = await execa(helm, args);
   await execa(
     kubectl,
@@ -796,10 +808,11 @@ export async function runLocalK8s(opts: LocalK8sOptions): Promise<void> {
   // rollout (no second restart needed).
   const credsOverlay = await provisionDevCreds(tools.kubectl, creds);
   try {
+    const meshProvider = opts.meshProvider ?? "vendored";
     await helmInstall(tools.helm, tools.kubectl, opts.name, chartDir, [
       valuesOverlay,
       credsOverlay,
-    ]);
+    ], [`mesh.provider=${meshProvider}`]);
   } finally {
     // The overlay only references the API key by name (secretKeyRef);
     // the file itself contains no secret material, but we still clean up

cli/src/commands/mesh.ts

@@ -35,6 +35,7 @@ import {
 import { attachAuthSubcommand } from "./mesh/auth.js";
 import { attachPromoteSubcommand } from "./mesh/promote.js";
 import { attachSetupTrustSubcommand } from "./mesh/setup-trust.js";
+import { attachProviderSubcommand } from "./mesh/provider.js";
 
 export function meshCommand(): Command {
   const cmd = new Command("mesh");
@@ -52,6 +53,11 @@ export function meshCommand(): Command {
   // -----------------------------------------------------------------------
   attachSetupTrustSubcommand(cmd);
 
+  // -----------------------------------------------------------------------
+  // mesh provider — switch a live cluster between vendored ↔ AGT
+  // -----------------------------------------------------------------------
+  attachProviderSubcommand(cmd);
+
   // -----------------------------------------------------------------------
   // mesh status
   // -----------------------------------------------------------------------

cli/src/commands/mesh/health.ts

@@ -61,32 +61,58 @@ export async function findDuplicateListeners(ports: number[]): Promise<Array<{ p
   return results;
 }
 
-/** Check registry health via HTTP /v1/health endpoint. */
+/** Check registry health via HTTP /health endpoint.
+ *
+ * Path compat: AGT registry only exposes `/health`; the vendored Rust
+ * registry exposes both `/health` and `/v1/health`. Hitting `/health`
+ * works against both, so probe that first. We still display the vendored
+ * `agents_registered`/`agents_online` counters when present (AGT returns
+ * just `{status, service}`).
+ */
 export async function checkRegistryHealth(port: number): Promise<boolean> {
-  try {
-    const resp = await fetch(`http://localhost:${port}/v1/health`, {
-      signal: AbortSignal.timeout(5000),
-    });
-    if (resp.ok) {
+  for (const probePath of ["/health", "/v1/health"]) {
+    try {
+      const resp = await fetch(`http://localhost:${port}${probePath}`, {
+        signal: AbortSignal.timeout(5000),
+      });
+      if (!resp.ok) continue;
       const body = await resp.json() as Record<string, unknown>;
-      checkLine(true, `Registry healthy (${body.agents_registered ?? 0} agents, ${body.agents_online ?? 0} online)`);
+      if (typeof body.agents_registered === "number") {
+        checkLine(true, `Registry healthy (${body.agents_registered} agents, ${body.agents_online ?? 0} online)`);
+      } else {
+        checkLine(true, `Registry healthy (${(body.service as string | undefined) ?? "agentmesh-registry"})`);
+      }
       return true;
-    }
-    checkLine(false, `Registry returned HTTP ${resp.status}`);
-    return false;
-  } catch (e: unknown) {
-    checkLine(false, `Registry not reachable: ${e instanceof Error ? e.message : String(e)}`);
-    return false;
+    } catch { /* try next path */ }
   }
+  checkLine(false, `Registry not reachable on localhost:${port}`);
+  return false;
 }
 
-/** Check relay health via WebSocket upgrade (not just TCP connect). */
+/** Check relay health via WebSocket upgrade (not just TCP connect).
+ *
+ * Path compat: AGT relay only accepts WS upgrades on `/ws`; the
+ * vendored Rust relay accepts WS on `/`. Try `/ws` first; if the relay
+ * 404s (vendored), fall back to `/`.
+ */
 export async function checkRelayHealth(port: number): Promise<boolean> {
+  for (const probePath of ["/ws", "/"]) {
+    const ok = await tryWsUpgrade(port, probePath);
+    if (ok) {
+      checkLine(true, `Relay healthy (WebSocket upgrade on localhost:${port}${probePath})`);
+      return true;
+    }
+  }
+  checkLine(false, `Relay not reachable on localhost:${port} (tried /ws and /)`);
+  return false;
+}
+
+function tryWsUpgrade(port: number, probePath: string): Promise<boolean> {
   return new Promise((resolve) => {
     const req = http.request({
       hostname: "127.0.0.1",
       port,
-      path: "/",
+      path: probePath,
       method: "GET",
       headers: {
         "Upgrade": "websocket",
@@ -98,33 +124,16 @@ export async function checkRelayHealth(port: number): Promise<boolean> {
     });
 
     req.on("upgrade", (_res, socket) => {
-      checkLine(true, `Relay healthy (WebSocket upgrade on localhost:${port})`);
       socket.destroy();
       resolve(true);
     });
 
     req.on("response", (res) => {
-      // Got an HTTP response instead of upgrade — relay is serving but not WS
-      if (res.statusCode === 101) {
-        checkLine(true, `Relay healthy (localhost:${port})`);
-        resolve(true);
-      } else {
-        checkLine(false, `Relay returned HTTP ${res.statusCode} (expected WebSocket upgrade)`);
-        resolve(false);
-      }
-    });
-
-    req.on("error", (e) => {
-      checkLine(false, `Relay not reachable: ${e.message}`);
-      resolve(false);
-    });
-
-    req.on("timeout", () => {
-      checkLine(false, `Relay timeout on localhost:${port}`);
-      req.destroy();
-      resolve(false);
+      resolve(res.statusCode === 101);
     });
 
+    req.on("error", () => resolve(false));
+    req.on("timeout", () => { req.destroy(); resolve(false); });
     req.end();
   });
 }

cli/src/commands/mesh/promote.ts

@@ -292,7 +292,7 @@ export function attachPromoteSubcommand(cmd: Command): void {
         console.log(chalk.green("  ✓ ") + chalk.bold("Registry promoted to global (port-forward)."));
         console.log(chalk.dim("    Tunnels are running in the background."));
         console.log(chalk.dim(`    PIDs saved to ${pidFile}`));
-        console.log(chalk.dim(`\n    Test:  curl ${globalRegistryUrl}/v1/health`));
+        console.log(chalk.dim(`\n    Test:  curl ${globalRegistryUrl}/health`));
         console.log(chalk.dim(`    Then:  azureclaw dev --global-registry ${globalRegistryUrl}`));
         console.log(chalk.dim(`    Stop:  azureclaw mesh demote`));
         console.log();
@@ -405,7 +405,7 @@ export function attachPromoteSubcommand(cmd: Command): void {
       console.log(chalk.green("  ✓ ") + chalk.bold("Registry promoted to global."));
       console.log(chalk.dim("    Using sslip.io for DNS (auto-resolved, no setup needed)."));
       console.log(chalk.dim("    HTTP only — secured by LoadBalancer IP allowlist."));
-      console.log(chalk.dim(`\n    Test:  curl ${globalRegistryUrl}/v1/health`));
+      console.log(chalk.dim(`\n    Test:  curl ${globalRegistryUrl}/health`));
       console.log(chalk.dim(`    Then:  azureclaw dev --global-registry ${globalRegistryUrl}`));
       console.log();
     });