feat(cli): invitations, join, decline, leave, devices, browser access

join accepts an invitation or redeems a link pasted as sent, then has the
node admit a key pair made here, with the invitation's code (a link's code
goes only to the node it names; one for a node that is away is kept for the
next connection). decline, leave and devices revoke ask first, and refuse
without --yes where there is no terminal. devices approve countersigns the
one waiting request a code matches, none when several do. browser-access is
the application's setting, kept per machine and never enabled from the hub's
mirror: on leaves a copy sealed under M on each node, off withdraws it,
unset touches nothing. A key pair made for a first contact is now kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 70 insertions, 0 deletions

diff --git a/packages/meshbay-cli/tests/fake_hub.py b/packages/meshbay-cli/tests/fake_hub.py
index ec1a0c0..15cbdf7 100644
--- a/packages/meshbay-cli/tests/fake_hub.py
+++ b/packages/meshbay-cli/tests/fake_hub.py
@@ -34,6 +34,9 @@ class FakeHub:
         self.refresh_delay = 0.0
         self.groups = [{"id": "g1", "name": "Family", "owner_username": USERNAME,
                         "node_online": True, "visibility": "private", "is_admin": True}]
+        self.pending: list[dict] = []
+        self.links: dict[str, dict] = {}
+        self.prefs: dict[str, str] = {}
 
     def _session(self, family: str | None = None) -> dict:
         family = family or secrets.token_hex(4)
@@ -106,3 +109,70 @@ class FakeHub:
     async def my_groups(self, token):
         self._auth(token)
         return self.groups
+
+    # ── Joining and leaving ──────────────────────────────────────────────────
+    #
+    # `pending` holds invitations (group rows with `invited_by`); `links` maps a
+    # ticket to the group it admits to, and is spent by the first redeem.
+
+    def _group_row(self, g: dict) -> dict:
+        return {k: v for k, v in g.items() if k not in ("invited_by", "created_at")}
+
+    async def invitations(self, token):
+        self._auth(token)
+        return [{"group_id": g["id"], "name": g["name"],
+                 "owner_username": g["owner_username"], "invited_by": g["invited_by"],
+                 "created_at": "2026-10-14T09:30:00+00:00"} for g in self.pending]
+
+    async def accept_invitation(self, token, group_id):
+        self._auth(token)
+        found = [g for g in self.pending if g["id"] == group_id]
+        if not found:
+            raise HubError(404, "No such invitation")
+        self.pending.remove(found[0])
+        self.groups.append(self._group_row(found[0]))
+        return {"status": "joined", "group_id": group_id}
+
+    async def decline_invitation(self, token, group_id):
+        self._auth(token)
+        found = [g for g in self.pending if g["id"] == group_id]
+        if not found:
+            raise HubError(404, "No such invitation")
+        self.pending.remove(found[0])
+        return {"status": "declined", "group_id": group_id}
+
+    async def preview_link(self, token, ticket):
+        self._auth(token)
+        g = self.links.get(ticket)
+        if g is None:
+            raise HubError(404, "invite_not_valid")
+        return {"group_id": g["id"], "group_name": g["name"], "inviter": "bob-test",
+                "expires_at": "2026-10-21T00:00:00+00:00",
+                "already_member": any(m["id"] == g["id"] for m in self.groups)}
+
+    async def redeem_link(self, token, ticket):
+        self._auth(token)
+        g = self.links.pop(ticket, None)
+        if g is None:
+            raise HubError(404, "invite_not_valid")
+        self.groups.append(self._group_row(g))
+        return {"group_id": g["id"], "group_name": g["name"]}
+
+    async def leave_group(self, token, group_id):
+        self._auth(token)
+        g = next((g for g in self.groups if g["id"] == group_id), None)
+        if g is None:
+            raise HubError(404, "You are not a member of this group")
+        if g.get("is_admin"):
+            raise HubError(409, "You own this group, so you cannot leave it")
+        self.groups.remove(g)
+        return {"status": "left", "group_id": group_id}
+
+    async def preferences(self, token):
+        self._auth(token)
+        return dict(self.prefs)
+
+    async def set_preference(self, token, key, value):
+        self._auth(token)
+        self.prefs[key] = value
+        return {"key": key, "value": value}