meshbay.git/packages/meshbay-hub, branch 0.6

chore: release 0.6.0

2026-08-23T13:15:47Z

The group UI's applications split, and the two missing-import bugs it surfaced and fixed along the way. MNP goes to 0.4: apps_enabled/apps_enabled_ack, and enabled_apps on the handshake ack, for the group-applications registry. Additive — a node that predates it is never sent the op, and a client that predates it never looks for the field. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

feat(hub): split the group UI into a pluggable "applications" architecture

2026-08-23T13:15:35Z

GroupPage's 6620-line app.js carried Chat and Files wedged in directly, with no way to add another group-level app without touching the shell itself. It is now app.js (routing, non-group pages) plus nine focused files — apps.js (the registry), chat-app.js, files-app.js, video-player.js, group-page.js (the shell), group-settings.js, hub-client.js, icon.js and file-utils.js — with docs/apps.md as the checklist for adding one (Videos/Music/Photos are sketched there, not built). Node side gained the matching enablement mechanism, mirroring member_upload exactly: a roster setting, a signed apps_enabled op enforced by _has_admin_authority, exposed in the handshake ack. Operators toggle applications per group from Settings, which also gained a small reorder: Invite, Pairing, Applications, Shared directories, Uploads, danger zone, Your devices, Members. Two bugs surfaced during the split, both missing an import across the new file boundary and invisible to node --check or a module-load probe since they only throw when the code path actually runs: - group-page.js called onRefreshAuth on a stale-token handshake rejection, but app.js never imported refreshAccessToken from hub-client.js — so a brand new member (including a group's own creator) hit "Not a member of this group" and the retry silently failed, throwing before it could refresh the token. - chat-app.js called getLocale() for message timestamps without importing it from i18n.js. Opening Chat on a group with real messages threw mid- render; uncaught, that appears to wedge Preact's render scheduler, so every button on the page stopped responding until reload. Caught the second class of bug with a proper no-undef audit across all split files (a temporarily installed ESLint 9, since the system one is too old to parse this codebase's syntax) rather than trusting grep. 827 tests pass; 6 new ones cover the apps_enabled policy. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

feat(node): systemd service panel on the Node page, and a clean CLI restart

2026-08-22T16:26:22Z

Add a status panel at the top of the Node page — always visible, even before an MNP connection exists — showing the meshbay-node systemd unit's own state (via `systemctl --user show`, main process only) with Start/Stop/Restart controls. This is the piece the rest of the page cannot provide: it has to work while the daemon is stopped or crash- looping, which the MNP-based sections require the daemon to already answer. While touching node lifecycle: `reload` and `restart-daemon` in the CLI shelled out to pgrep + SIGTERM/SIGHUP and respawned the process by hand, logging to a hardcoded /tmp path. That pattern already SIGHUPed a developer's own running node by accident once (see the old test_cli_dispatch.py comment). Both now delegate to `systemctl --user reload|restart meshbay-node`, which the unit already supports correctly (ExecReload=, Restart=on-failure). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

fix(ui): reset Files navigation state when switching groups

2026-08-22T16:03:57Z

GroupPage keeps the same component instance across a group switch (no key at the router), so currentPath/selected/filter were leaking from the group just left. A directory that exists in one group but not the other (e.g. "outputs") then showed an empty listing after switching. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

fix: first-run wizard reliability and node startup performance

2026-08-22T14:40:54Z

Node daemon no longer blocks startup on slow directory scans — initial indexing runs in the background so the node reaches "running" immediately after transports are up. Fixes the wizard failing to detect the node when large USB/NAS roots take minutes to scan. Also: wizard key-linking deadlock resolved (main.js links during poll), invite form stays in DOM during reconnects (disabled instead of destroyed), pairing code bridges to renderer, and firewall docs for LAN casting added. Co-Authored-By: Claude Opus 4.6

feat: node:start auto-provisions config and unlock key

2026-08-22T10:29:32Z

When the wizard calls node:start with {hubUrl, username}, the handler writes a minimal node.toml and a random unlock.key if they don't exist. The daemon then creates the keystore on first start using the unlock file — fully non-interactive. Existing configs are left untouched: if node.toml or unlock.key already exist, provisioning is skipped and the node starts as before. Co-Authored-By: Claude Opus 4.6

fix: update source-reading tests that drifted from the code

2026-08-22T09:50:35Z

- test_transport_contracts: CreateGroupPage was refactored into a routing wrapper; assertions now read CreateGroupFormSimple - test_task_lifetime: _spawn now uses an _on_done wrapper instead of a bare self._tasks.discard callback; assertion checks both parts - test_video_buffer_ceiling: target the real updateend handler, not the settled() utility; add awaitingInitRef to the MSE harness scope - test_video_seek: silence debug console.log in window_leak harness so it does not pollute the JSON output Co-Authored-By: Claude Opus 4.6

fix: update test_desktop_shell.py for build/ → scripts/ rename

2026-08-22T09:19:24Z

The test reads index.html and sync-ui.js to verify security properties. Update the paths to match the directory rename from the prior commit. Co-Authored-By: Claude Opus 4.6

fix: add 82 missing i18n keys to all 9 non-English locales

2026-08-21T16:20:13Z

node.*, wizard.*, sidebar.node, settings_node.*, and group.retry were present in en.js but missing from fr/es/de/it/nl/pl/pt-BR/zh-CN/ja. All 10 locales now have identical key sets (test_key_sets_match_english passes). Co-Authored-By: Claude Opus 4.6

fix: delete notifications and detach content_reports before deleting a group

2026-08-21T16:10:19Z

The DELETE /v1/groups/{id} endpoint only deleted group_members before removing the group row, causing a FK violation (500) when notifications or content_reports referenced the group. Delete notifications outright and nullify group_id on content_reports to preserve moderation history. Co-Authored-By: Claude Opus 4.6