feat(cli): invitations, join, decline, leave, devices, browser access

join accepts an invitation or redeems a link pasted as sent, then has the
node admit a key pair made here, with the invitation's code (a link's code
goes only to the node it names; one for a node that is away is kept for the
next connection). decline, leave and devices revoke ask first, and refuse
without --yes where there is no terminal. devices approve countersigns the
one waiting request a code matches, none when several do. browser-access is
the application's setting, kept per machine and never enabled from the hub's
mirror: on leaves a copy sealed under M on each node, off withdraws it,
unset touches nothing. A key pair made for a first contact is now kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 43 insertions, 0 deletions

diff --git a/packages/meshbay-cli/src/meshbay_cli/commands/decline.py b/packages/meshbay-cli/src/meshbay_cli/commands/decline.py
new file mode 100644
index 0000000..23c7bb8
--- /dev/null
+++ b/packages/meshbay-cli/src/meshbay_cli/commands/decline.py
@@ -0,0 +1,43 @@
+"""`decline`: answer an invitation no. Asked first; `--yes` answers for a script."""
+
+import json
+
+from ..client.hub import HubError
+from ..client.paths import handle
+from ..errors import NOT_FOUND, CliError
+from ..output import confirm, safe, sentence
+from .context import Context
+from .invitations import find_invitation
+
+HELP = "decline an invitation"
+
+
+def add_parser(sub, parent) -> None:
+    p = sub.add_parser("decline", parents=[parent], help=HELP, description=sentence(HELP)
+                       + ". Only a new invitation from the group's owner brings it back.")
+    p.add_argument("invitation", metavar="INVITATION",
+                   help="the group, as `invitations` lists it")
+    p.add_argument("-y", "--yes", action="store_true", help="do not ask for confirmation")
+
+
+async def run(ctx: Context) -> int:
+    await ctx.hub.check_version()
+    account = ctx.account()
+    try:
+        group = find_invitation(await account.call(account.hub.invitations),
+                                ctx.args.invitation)
+        name = handle(group)
+        confirm(f"Decline the invitation to {safe(name)}?", ctx.args.yes)
+        try:
+            await account.call(account.hub.decline_invitation, group["id"])
+        except HubError as e:
+            if e.status == 404:
+                raise CliError(NOT_FOUND, "That invitation is no longer waiting.") from e
+            raise
+    finally:
+        await account.close()
+    if ctx.args.json:
+        print(json.dumps({"declined": True, "path": name, "id": group["id"]}))
+    else:
+        print(f"Declined the invitation to {safe(name)}.")
+    return 0