feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 7 insertions, 16 deletions

diff --git a/packages/meshbay-cli/src/meshbay_cli/client/hub.py b/packages/meshbay-cli/src/meshbay_cli/client/hub.py
index 5b301f8..5726816 100644
--- a/packages/meshbay-cli/src/meshbay_cli/client/hub.py
+++ b/packages/meshbay-cli/src/meshbay_cli/client/hub.py
@@ -132,10 +132,10 @@ class Hub:
             raise
 
     async def register(self, username: str, email: str, auth_key: str,
-                       recovery_key: str | None, captcha_token: str | None) -> dict:
+                       captcha_token: str | None) -> dict:
+        # Never the recovery key: the hub does not see it and refuses a
+        # register that carries one (docs/MESHBAY_DESIGN.md §3.6).
         body = {"username": username, "email": email, "auth_key": auth_key}
-        if recovery_key:
-            body["recovery_key"] = recovery_key
         if captcha_token:
             body["captcha_token"] = captcha_token
         return await self._call("POST", "/v1/users/register", json=body)
diff --git a/packages/meshbay-cli/src/meshbay_cli/commands/account.py b/packages/meshbay-cli/src/meshbay_cli/commands/account.py
index 2137995..4499f0b 100644
--- a/packages/meshbay-cli/src/meshbay_cli/commands/account.py
+++ b/packages/meshbay-cli/src/meshbay_cli/commands/account.py
@@ -66,9 +66,6 @@ def add_parser(sub, parent) -> None:
     p.add_argument("--recovery-key-file", metavar="FILE",
                    help="reset: read the recovery key from FILE, to restore your keys "
                         "on the nodes")
-    p.add_argument("--email-recovery-key", action="store_true",
-                   help="register: also send the recovery key with the verification "
-                        "e-mail")
     p.add_argument("--no-remember", action="store_true",
                    help="reset: sign in afterwards without storing the session")
     p.add_argument("-y", "--yes", action="store_true",
@@ -206,29 +203,23 @@ async def _register(ctx: Context) -> int:
     raw, mnemonic = generate_recovery()
     try:
         try:
-            reg = await ctx.hub.register(username, email, ak,
-                                         mnemonic if a.email_recovery_key else None,
-                                         await _captcha(ctx))
+            reg = await ctx.hub.register(username, email, ak, await _captcha(ctx))
         except HubError as e:
             if e.detail not in ("captcha_failed", "captcha_required"):
                 raise
             # An answer is spent once checked; a fresh one, once.
-            reg = await ctx.hub.register(username, email, ak,
-                                         mnemonic if a.email_recovery_key else None,
-                                         await _captcha(ctx))
+            reg = await ctx.hub.register(username, email, ak, await _captcha(ctx))
     except HubError as e:
         raise _hub_refusal(e, "Not registered") from e
 
     if ctx.args.json:
         print(json.dumps({"user_id": reg.get("user_id"), "username": username,
                           "recovery_key": mnemonic,
-                          "recovery_key_emailed": bool(a.email_recovery_key),
                           "email_verification_required": True}))
     else:
         print(f"Account {safe(username)} created on {ctx.hub.url}.\n\n"
-              "Your recovery key — shown this once, kept nowhere by MeshBay"
-              + (" (it is also in the verification e-mail)" if a.email_recovery_key
-                 else "") + ":\n\n"
+              "Your recovery key — shown this once, kept nowhere by MeshBay, never "
+              "sent to the hub:\n\n"
               f"    {mnemonic}\n\n"
               "Keep it somewhere safe, apart from your passphrase. If you forget the "
               "passphrase, it is what gives you your groups back.")