meshbay.git/packages/meshbay-hub, branch 0.1

feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth

2026-08-13T01:56:30Z

Baseline commit capturing in-progress Phase 12 work that was already present in the working tree (uncommitted) before the Phase 11.5 security remediation begins. Committed as-is, without review or modification, so that remediation changes arrive as a separable diff. Contents: BundleStore (P2P GEK + keypair bundles), password split (auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin challenge-response, node local admin UI rewrite, browser key persistence. Not authored in this session — captured to establish a baseline. Co-Authored-By: Claude Opus 5

fix(ui): reduce upload chunk size to 48KB to fit aiortc SCTP limit

2026-08-11T15:25:37Z

aiortc advertises maxMessageSize=65536 in SDP. A 64KB data chunk + msgpack envelope + 4-byte length prefix exceeds this limit, causing "Trying to send message larger than max-message-size" on upload. 48KB data + overhead stays well under 65536 bytes. Co-Authored-By: Claude Opus 4.6

fix(ui): set MediaSource duration from ffprobe and clamp seeks to buffered range

2026-08-11T15:21:22Z

Two fixes for the MSE video player: 1. Set mediaSource.duration from the ffprobe-reported duration on sourceopen, so the seek bar shows the correct video length instead of NaN/infinite. 2. Use SourceBuffer mode='sequence' for sequential append without timestamp gaps. Add a seeking handler that clamps currentTime to the buffered range — seeking beyond buffered data snaps back instead of freezing the video. Co-Authored-By: Claude Opus 4.6

fix(ui): remove duplicate connecting messages and buggy stream progress bar

2026-08-11T15:03:21Z

1. "Connecting..." was shown in 3 places simultaneously (status badge, cached files area, and general status). Now only the badge shows it when cached files are visible — the redundant messages are removed. 2. The floating stream progress bar caused constant re-renders during video streaming (every 256KB segment triggered setState). The fMP4 remux size also differs from the original file size, making the progress inaccurate. Removed the overlay bar entirely — the video element's native buffered range indicator is sufficient. Co-Authored-By: Claude Opus 4.6

feat: Phase 10c — MSE video streaming (real-time playback)

2026-08-11T14:47:01Z

Replace download-then-play VideoPlayer with MSE (MediaSource Extensions) streaming. Node remuxes to fMP4 via ffmpeg, probes codecs with ffprobe, and sends encrypted segments over DataChannel. Browser decrypts and appends to SourceBuffer — playback starts within seconds. Co-Authored-By: Claude Opus 4.6

fix(hub): move _handle_chat_notify before @router.websocket decorator

2026-08-11T14:19:40Z

The function was placed between the decorator and node_websocket, breaking the WebSocket endpoint registration (403 on all WS connects). Co-Authored-By: Claude Opus 4.6

feat: chat notifications via hub, file delete, upload fix, cached display, inline thumbnails

2026-08-11T14:16:32Z

Backend: - Chat store persists sender_name (SQLite migration, no more UUID display) - FILE_DELETE / FILE_DELETE_ACK MNP types — node admin can delete files - Node sends chat_notify to hub WS — hub creates notifications for offline members - Hub revocation.py handles chat_notify, creates per-member notifications Frontend: - Upload chunk size 64KB (was 1MB) — fixes WebRTC DataChannel max-message-size - Show cached files immediately while WebRTC connects - ChatImage component — inline image thumbnails in chat (download+decrypt) - File delete action in menu (group admin, with confirm dialog) - Member panel: "Owner" label instead of confusing "Group admin" - Create group page: hint about needing a node - Refresh index after chat attachment upload Co-Authored-By: Claude Opus 4.6

fix(ui): upload chunk size, cached file display, chat names, file delete, inline thumbnails

2026-08-11T14:12:16Z

- Upload chunks capped at 64KB to avoid WebRTC DataChannel max-message-size - Show cached files immediately while WebRTC connects (tabs visible during connection) - Persist sender_name in chat store (SQLite) — no more UUID display in history - File delete action in menu (node admin only, enforced server-side) - FILE_DELETE / FILE_DELETE_ACK MNP message types - Inline image thumbnails in chat attachments (download+decrypt, Signal-style) - Member panel: "Owner" label instead of "Group admin" to avoid hub/group admin confusion - Create group page: hint about needing a node - Refresh index after chat file attachment upload Co-Authored-By: Claude Opus 4.6

fix(ui): group creation error, chat UUIDs, file preview, action menu

2026-08-11T13:39:09Z

Bug fixes: - Group creation "[object Object]" error: removed dead pkcs8 import code that threw before GEK wrapping, added array detail handling in hubFetch - Chat shows usernames instead of UUIDs (sender_name passed through node) - Join button: navigate to group on "Already a member" instead of error UI improvements: - Loading spinner animation for async states (connecting, fetching) - File action menu (3-dot dropdown: View, Download, Play) - Click filename to preview inline (images, text/code files) - FilePreview overlay for images and text files - Chat file attachment button (upload to node + structured message) - Chat attachment display (icon, filename, size) - Member panel: "Group admin" badge instead of plain "Admin" text Co-Authored-By: Claude Opus 4.6

feat: Phase 10b — Self-service UI (group create/join, upload, IndexedDB, search)

2026-08-11T12:55:52Z

Six self-service features for the web SPA: - Group creation UI with GEK auto-generation (AES-256-GCM ECIES) - Member management + invite by username (GEK wrapping for invitee) - Open group self-join flow (POST /v1/groups/{id}/join) - File upload client→node (FILE_UPLOAD MNP type, .uploads/ staging) - IndexedDB caching of group file indexes (instant display on revisit) - Cross-group file search (SearchPage, pure client-side on cached indexes) 11 new tests (166 total): 8 group self-service + 3 AES GEK wrap/unwrap. Co-Authored-By: Claude Opus 4.6