Two Windows fixes for sym-mesh-channel start:

• Launch: spawnSync('claude', …) did an exact-filename lookup that ignores Windows PATHEXT, so start failed with ENOENT even when claude ran fine in the shell (the CLI there is a .cmd/.ps1 shim or .exe, never bare claude). The launch now routes through a shell on Windows so PATHEXT resolution applies. POSIX path unchanged.
• Identity: start auto-injected --force only on a live entry mismatch, but npx rotates its cached server.js path on every version resolve, so the persisted entry is routinely stale yet still holds the node's name/group. On a re-run, start saw no live entry, pushed no --force, and init's preserve-over-request precedence silently dropped --name — reverting node identity. start now reconciles against the persisted entry stale-or-not and forces the rewrite on a rename. Verified the group is preserved when no --group is passed.

sym-mesh-channel start — one command to a live mesh session.

npx @sym-bot/mesh-channel@latest start

Configures the MCP server if needed, then launches Claude Code with the real-time Channels flag already on — no --dangerously-load-development-channels … to type, no plugin:/server: handle to choose. start --name <node> --group <team> stands up a named mesh agent; start --print is a dry run; everything after -- is forwarded to claude. Co-resident sessions don't collide (auto-suffix since 0.3.10).

Fixed

• CLI dispatch via the published bin: npx … doctor (and now start) no longer falls through and starts the MCP server — init/doctor/start all route to the installer/launcher.
• init --force + an explicit SYM_NODE_NAME now relabels the entry (symmetric with --group).

Community plugin

• Refreshed the plugin's npm pin 0.3.10 → 0.3.14, so the Anthropic community-directory build ships current, secured code (0.3.11 prompt-injection filter + rate limiting; sym 0.7.6).

Track the latest released @sym-bot/sym (^0.7.6).

• deps: bump @sym-bot/sym ^0.7.5 -> ^0.7.6 — pulls in the SVAF decision log (persist + emit every evaluation, admit AND reject) on top of the 0.7.5 replay-storm receive-path dedup. Additive; no mesh-channel API changes.
• chore: lockfile re-resolved to sym 0.7.6; sync plugin manifest version; backfill 0.3.12 changelog entry.

Pull in @sym-bot/sym 0.7.5 (mesh replay-storm receive-path dedup).

• deps: bump @sym-bot/sym to ^0.7.5 — mesh replay-storm receive-path dedup (6d08e69)
• docs: align install + channel-flag handles with the marketplace (#13, 6ef6ba4)
• chore: fix 5 moderate Dependabot vulnerabilities (npm audit fix, a22c55d)

What's new

Four-layer defence before any mesh signal reaches Claude's context:

1. Transport — Ed25519 peer identity + relay-token auth (existing)
2. Protocol — SVAF per-field semantic relevance gate (existing)
3. Safety — prompt-injection filter + rate limiter + payload size cap (new)
4. Application — text-only injection; claude/channel/permission not declared (existing)

Security layer 3 details

• Prompt-injection filter — every CAT7 field and payload is scanned against a curated blocklist covering: instruction-override phrases, role/persona hijacking, system-prompt injection (<system>, [SYSTEM]), tool-call fabrication (<tool_call>, <function_calls>), and privilege-escalation language (jailbreak, DAN mode, override safety filter). Blocked CMBs are audit-logged to stderr — never silent drops.
• Per-peer rate limiting — sliding 60-second window, default 30 CMBs/min (configurable via SYM_RATE_LIMIT). Prevents flood attacks from a compromised or malfunctioning peer.
• Payload size cap — default 8 KB (SYM_MAX_PAYLOAD_BYTES). Prevents oversized-payload attacks that could exhaust the context window.

Also in this release

• Fixed all 5 moderate Dependabot vulnerabilities (hono, qs — transitive via @modelcontextprotocol/sdk).
• README security section updated to document all four layers.
• CHANGELOG backfilled for 0.3.8–0.3.11.

What's fixed

• Live-identity-collision auto-suffix. Two sessions wanting the same SYM_NODE_NAME previously hard-failed with EIDENTITYLOCK. The server now checks whether the name's lock file is held by a live process; if so, it appends -2, -3, … (up to 64) until it finds a free slot. Stale locks (dead holder) are still reclaimed by @sym-bot/sym on start — unchanged. Result: duplicate dev-agent sessions, or any two sessions sharing a fixed SYM_NODE_NAME, coexist instead of failing.

What's fixed

• stdout discipline — fixes -32000 / Connection closed. The MCP JSON-RPC stream runs on stdout. Dependency load banners (e.g. [encoder] Semantic encoder ready) were printing to stdout, intermittently corrupting the handshake and causing Claude Code to log "Ignoring non-JSON line on stdout" or drop the connection with -32000. A stdout guard is now installed before any require(): lines that start with { (JSON-RPC frames) pass through; everything else is redirected to stderr.

What's new

• Per-session node identity. Each Claude Code session gets its own mesh identity derived from the working-directory slug and a session-unique suffix (e.g. claude-symday-webapp-6e174e), instead of all sessions sharing the machine hostname. Enables multiple Claude Code sessions on the same machine to appear as distinct peers on the mesh — confirmed working over loopback via Bonjour with no relay.

• npx launch path. The plugin now launches via npx @sym-bot/mesh-channel rather than a global node path, so marketplace installs work without a prior npm install -g. The npx cache warms on first launch; subsequent sessions start in ~1 s.

Track @sym-bot/sym ^0.7.4 (same-host loopback discovery) and sync the plugin manifest.

• chore(release): track sym ^0.7.4, sync plugin manifest (1525046)

This MCP node now advertises its group on a shared _symgroups._tcp beacon (bonjour-service), so the sym CLI's sym groups lists Claude/MCP nodes alongside CLI-daemon nodes — cross-platform, incl. Windows. Discovery-only; comms stay isolated. Validated on Win11. Restart pre-0.3.6 sessions to begin beaconing. See CHANGELOG.md.