feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 22 deletions

diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js
index 8845b7b..b602950 100644
--- a/packages/meshbay-client/src/main.js
+++ b/packages/meshbay-client/src/main.js
@@ -1687,12 +1687,11 @@ function registerBridge() {
   }
 
   // The daemon is reachable but sitting at 'waiting_for_node_key' /
-  // 'waiting_for_account': its Ed25519 key is not linked to the hub account it
-  // runs as (a fresh node, or that account still carries a previous machine's
-  // node key). Link it with the signed-in user's token, then wait out the
-  // daemon's own 5s hub-auth retry until it reports 'running'. `PUT
-  // /me/node_key` overwrites unconditionally, so this also recovers an account
-  // whose linked key belongs to a node that is gone.
+  // 'waiting_for_account': its Ed25519 key is not among the keys linked to the
+  // hub account it runs as (a fresh node, or one unlinked from the profile
+  // page). Link it with the signed-in user's token, then wait out the daemon's
+  // own hub-auth retry until it reports 'running'. `PUT /me/node_key` adds the
+  // key beside the account's others, so the user's other machines keep theirs.
   //
   // The Linux branch of `node:start` does the same thing inline; Windows went
   // without it, so the daemon never left 'waiting_for_account' and the Create
@@ -2095,9 +2094,9 @@ Its log: ${nodeLogHint()}`);
   // pasted on the profile page (the first Windows beta tester, 2026-10).
   //
   // It never overrides a choice: a node set up for another account or hub is
-  // left alone (node:start asks before changing that), and an account already
-  // linked to another node keeps it -- `PUT /me/node_key` replaces, and the
-  // node it replaced would stop working with nothing said.
+  // left alone (node:start asks before changing that). An account that already
+  // has nodes on other machines keeps them: `PUT /me/node_key` adds this one
+  // beside them, one key per machine.
   let nodeEnsuring = null;
 
   async function ensureNode(opts) {
@@ -2129,16 +2128,6 @@ Its log: ${nodeLogHint()}`);
     }
     if (p.status === 'running') return { state: 'running' };
 
-    let linked = '';
-    try {
-      const r = await fetch(`${hubUrl}/v1/users/${encodeURIComponent(username)}/pubkeys`, {
-        headers: { Authorization: `Bearer ${token}` },
-        signal: AbortSignal.timeout(5000),
-      });
-      if (!r.ok) return { state: 'not_linked' };
-      linked = (await r.json()).pk_node_ed25519 || '';
-    } catch { return { state: 'not_linked' }; }
-    if (linked && linked !== p.pk_node_ed25519) return { state: 'other_node' };
     const ready = await linkNodeKeyAndAwaitRunning({ token, hubUrl }, Date.now() + 90000);
     return { state: ready && ready.status === 'running' ? 'running' : 'not_linked' };
   }
@@ -2207,13 +2196,13 @@ Its log: ${nodeLogHint()}`);
           + `${nodeLogHint()}`);
       }
       if (ready.status !== 'running') {
-        // "Link Node" is on the Settings page, not this one -- pointing here
+        // "Linked nodes" is on the Profile page, not this one -- pointing here
         // at the Node page sent whoever read this hunting for a control that
         // is not on it (reproduced live 2026-09-14).
         throw new Error(
           'the node started but could not link to your hub account. Open '
-          + 'Settings and use "Link Node", or check you are signed in to '
-          + 'the hub this node is configured for.');
+          + 'Profile and paste its key under "Linked nodes", or check you are '
+          + 'signed in to the hub this node is configured for.');
       }
       return { started: true, ...ready };
     }