The last couple of weeks went inward — plumbing, then polish. This week went the other way: outward. A third AI agent, a whole new screen to run on, connections that reach past your own network, and — quietly — a mesh that gives away less about itself.
A third agent: Gemini
Claude and OpenCode now have company. Gemini's CLI runs as a first-class agent, talking to the daemon over ACP, with its own per-instance API key and an isolated home directory so you can run several without them stepping on each other — streaming output and inline approvals, same as the others. The nice part is how little it took: the driver and session-backend abstractions from the earlier agent work meant adding a third brain was mostly wiring, not surgery. (One honest asterisk: Gemini's MCP support is off for now — its ACP mode hangs when you hand it MCP servers, so that waits for an upstream fix.)
MeshHold on the TV
MeshHold now runs on Android TV, and that's more than a manifest flag. The whole web UI learned to be driven by a remote: D-pad spatial navigation that actually lands on the right thing, a ten-foot layout, a remote-controllable player and Now Playing, and a first-run preset that fits the living room — chat off by default, Network defaulting to a list you can scroll from the couch. Your media library, on the big screen, with nothing but the remote that came with the TV.
Pairing that reaches past the LAN
Last week you could hand a key to a clipboard-less device over the local network by scanning its QR. This week that reach extends past your own Wi-Fi: the receiving node maps its port with UPnP, advertises its public address in the QR, and — on Windows — punches its own hole through the firewall, deleting the stray auto-BLOCK rules Windows likes to add and retrying if a UAC prompt gets missed. So you can pass a key to a box that isn't on your LAN at all, with delivery progress and a graceful fallback when it can't get through.
A quieter mesh
Two changes made the mesh itself give away less. Membership is now encrypted over gossip: the announcements that tell nodes who belongs to a network are sealed and padded, so a passive observer on the wire can't enumerate your mesh — and a peer's overlay IPs stay hidden unless you actually share a network with it. And on multi-hop tunnels, the per-circuit key is now sealed to the exit, so a relay in the middle forwards your traffic without being able to read it. The overlay grew up operationally too: it auto-starts the moment a node holds a mesh key, hot-reloads when you add or remove one (no restart), and moved to a clean 10.x addressing scheme.
That's the week: further out, and harder to watch.
Since last week
- Gemini agent: a third agent alongside Claude and OpenCode, over ACP, with a per-instance API key + isolated home, streaming and inline approvals, a Providers tab, and runtime auth-failure detection with reachable re-authentication
- Android TV: manifest support, D-pad spatial navigation, a ten-foot UI, a remote-controllable player + Now Playing, and a form-factor preset (chat toggle, list-first Network)
- Encrypted mesh membership: key-scoped, sealed-and-padded announce gossip so a passive observer can't enumerate the mesh; a peer's overlay IPs hidden unless you share its network (breaking change)
- Relay confidentiality: the per-circuit tunnel key is sealed to the exit, so relay hops can't read the traffic they forward
- Mesh LAN operations: auto-start when a node holds a mesh key, hot-reload on key add/remove, and a clean
10.0.0.0/8(net / node / device) addressing scheme - Key-paste beyond the LAN: UPnP port mapping + public address carried in the QR + Windows firewall auto-allow, with delivery progress and virtual-NIC filtering
- Daemon priority boost: the daemon raises its own OS scheduling priority at startup to stay responsive under load
- Website: a screenshots gallery for releases (admin inline + release page)