merge: Phase 11.5 security remediation, invite redesign, per-node identity

Brings in the security remediation branch. Three bodies of work, and what they
changed about what this project may claim.

Phase 11.5 closed the gap between the documents and the code: the unauthenticated
node HTTP API and the TCP transport deleted, one handshake shared by the
remaining two transports, mutual authentication, structured admin transcripts,
upload confinement, group isolation, revocation that reaches nodes. Six critical
and seven high findings closed, bounded, or deferred by decision.

The invite redesign closed H3 and M3 — the last open High. The hub was the key
directory: an inviter fetched the invitee's key from it and wrapped the group key
for whatever came back, so a hub answering with its own key was handed the group
key by an honest member following the protocol exactly. That lookup is gone. The
node holds the group key and wraps it itself, for a key its recipient proves
possession of, bound to an account by a one-time code the hub never sees. M3 fell
out of the same work: node authority comes from a local roster, never from the
hub.

Per-node identity cut what remains of C4 down to one operator. A single keypair
used to be copied to every node its owner joined; each node now gets its own, so
cracking the bundle on one machine yields a key that is a stranger everywhere
else — and on that machine, one that unlocks nothing its holder did not already
serve. The bundle KDF moved to Argon2id 128 MB, and the hub stopped storing or
publishing user keys at all.

What this project may now say: the hub cannot read your content unless it ships
you malicious client code. T3 remains, accepted (D1), and is what the native
client removes. C4 is reduced, not closed, until 13.3. Chat is still plaintext at
rest until Phase 15. Draft-v5 §2 states each claim against the adversary it holds
against, which is the convention this branch exists to keep.

Four defects were found by deploying it and using a browser, none by the test
suite: a node going deaf on its hub socket, a token that predated group
membership, a client reading values before they were assigned, and identity keys
a browser held but never re-read. The lessons are recorded in CLAUDE.md.

Tests: 343 across the three packages, plus QE/deploy/e2e.py — register, pair,
invite, join, download, stream, second browser, revoke — run against the live
deployment on a wiped hub and node.

1 files changed, 249 insertions, 79 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ddff928..3087e0e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -65,9 +65,13 @@ async function getAllCachedIndexes() {
 
 // ── Auth persistence ─────────────────────────────────────────────────────────
 
-let _sessionKeys = null;
+// The key that opens a node's keypair bundle, derived once at sign-in. There is
+// no global identity to keep: identity keys belong to a node and are fetched from
+// it (transport.js), so nothing of that kind lives here.
 let _bundleKey = null;
-let _pendingBundlePush = null;
+// A one-time pairing code the user just typed, consumed by the next connection
+// attempt. Deliberately not persisted: it is single-use and short-lived.
+let _pendingJoinCode = null;
 
 function _openKeyDB() {
   return new Promise((resolve, reject) => {
@@ -105,18 +109,45 @@ async function _clearKeyDB() {
     db.close();
   } catch {}
 }
-function _saveSessionKeys() {
-  try {
-    if (_sessionKeys) sessionStorage.setItem('meshbay_sk', JSON.stringify(_sessionKeys));
-  } catch {}
+/**
+ * Rough passphrase strength, in bits, and what it is up against.
+ *
+ * This number carries more weight here than in most applications. The encrypted
+ * keypair bundle is protected by PBKDF2-SHA512 (600k) and sits on every node
+ * whose group you join, so the people who host your groups can attack it offline
+ * (finding C4). PBKDF2 is memory-light, which is exactly what GPUs are good at.
+ *
+ * The estimate is deliberately conservative — character classes and length, with
+ * a penalty for repetition and for the handful of patterns everyone tries. It is
+ * a guide, not a guarantee, and it says so in the UI.
+ */
+function passwordBits(pw) {
+  if (!pw) return 0;
+  let pool = 0;
+  if (/[a-z]/.test(pw)) pool += 26;
+  if (/[A-Z]/.test(pw)) pool += 26;
+  if (/[0-9]/.test(pw)) pool += 10;
+  if (/[^A-Za-z0-9]/.test(pw)) pool += 32;
+  let bits = pw.length * Math.log2(pool || 1);
+
+  const unique = new Set(pw).size;
+  if (unique < pw.length / 2) bits *= 0.6;          // "aaaaaaaa", "abcabcabc"
+  if (/^[0-9]+$/.test(pw)) bits *= 0.5;             // dates, PINs
+  if (/(password|motdepasse|azerty|qwerty|123456|meshbay)/i.test(pw)) bits *= 0.3;
+  return Math.round(bits);
 }
-function _restoreSessionKeys() {
-  try {
-    if (!_sessionKeys) {
-      const sk = sessionStorage.getItem('meshbay_sk');
-      if (sk) _sessionKeys = JSON.parse(sk);
-    }
-  } catch {}
+
+const PASSWORD_MIN_BITS = 60;   // refuse below this
+const PASSWORD_MIN_LEN = 12;
+
+/** Public X25519 key from our own secret — never read back from the hub. */
+async function _pkXFromSk(skPkcs8B64) {
+  const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0));
+  const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'X25519' }, true, ['deriveBits']);
+  const jwk = await crypto.subtle.exportKey('jwk', sk);
+  const b64 = jwk.x.replace(/-/g, '+').replace(/_/g, '/');
+  const pad = b64.length % 4;
+  return pad ? b64 + '='.repeat(4 - pad) : b64;
 }
 
 function loadAuth() {
@@ -132,11 +163,8 @@ function saveAuth(auth) {
     localStorage.setItem(AUTH_KEY, JSON.stringify(auth));
   } else {
     localStorage.removeItem(AUTH_KEY);
-    _sessionKeys = null;
     _bundleKey = null;
-    _pendingBundlePush = null;
     _clearKeyDB();
-    try { sessionStorage.removeItem('meshbay_sk'); } catch {}
   }
 }
 
@@ -390,7 +418,14 @@ function RegisterPage() {
   const onSubmit = async (e) => {
     e.preventDefault();
     if (password !== confirm) { setError(t('register.err_mismatch')); return; }
-    if (password.length < 8) { setError(t('register.err_min_len')); return; }
+    if (password.length < PASSWORD_MIN_LEN) {
+      setError(t('register.err_min_len', { n: PASSWORD_MIN_LEN })); return;
+    }
+    // The floor can only live here: with the password split (T1) the hub never
+    // sees the password, so it cannot enforce anything about it.
+    if (passwordBits(password) < PASSWORD_MIN_BITS) {
+      setError(t('register.err_too_weak')); return;
+    }
     setError('');
     setLoading(true);
     try {
@@ -438,6 +473,18 @@ function RegisterPage() {
           <input type="password" placeholder="${t('register.password')}" value=${password}
                  onInput=${e => setPassword(e.target.value)}
                  autocomplete="new-password" required minlength="8" />
+          ${password && html`
+            <div style="margin:-4px 0 10px">
+              <div style="height:4px;background:var(--border);border-radius:2px;overflow:hidden">
+                <div style=${`height:100%;width:${Math.min(100, passwordBits(password) / 100 * 100)}%;
+                     background:${passwordBits(password) < PASSWORD_MIN_BITS ? 'var(--error)'
+                       : passwordBits(password) < 80 ? 'var(--yellow, #f59e0b)' : 'var(--success)'}`}></div>
+              </div>
+              <p style="font-size:0.8em;color:var(--text-dim);margin-top:4px">
+                ${t('register.strength', { bits: passwordBits(password) })}
+              </p>
+            </div>
+          `}
           <input type="password" placeholder="${t('register.confirm')}" value=${confirm}
                  onInput=${e => setConfirm(e.target.value)}
                  autocomplete="new-password" required />
@@ -762,7 +809,7 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
   return results;
 }
 
-function GroupPage({ groupId, group, token, username, userId }) {
+function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) {
   const [status, setStatus] = useState('idle');
   const [entries, setEntries] = useState([]);
   const [cached, setCached] = useState(false);
@@ -778,8 +825,25 @@ function GroupPage({ groupId, group, token, username, userId }) {
   const [uploading, setUploading] = useState(false);
   const [menuOpen, setMenuOpen] = useState(null);
   const [isNodeAdmin, setIsNodeAdmin] = useState(false);
+  const [needsCode, setNeedsCode] = useState(false);
+  const [codeInput, setCodeInput] = useState('');
+  const [retryKey, setRetryKey] = useState(0);
   const transportRef = useRef(null);
   const gekRef = useRef(null);
+  // One refresh per mount: if a fresh token still says we are not a member, we
+  // really are not, and retrying forever would hide that.
+  const refreshedRef = useRef(false);
+
+  const submitJoinCode = useCallback((e) => {
+    e.preventDefault();
+    const code = codeInput.trim();
+    if (!code) return;
+    _pendingJoinCode = code;
+    setCodeInput('');
+    setNeedsCode(false);
+    setError('');
+    setRetryKey(k => k + 1);
+  }, [codeInput]);
 
   useEffect(() => {
     if (menuOpen === null) return;
@@ -803,7 +867,6 @@ function GroupPage({ groupId, group, token, username, userId }) {
       setError('');
       gekRef.current = null;
       if (!_bundleKey) _bundleKey = await _loadBundleKey();
-      _restoreSessionKeys();
       try {
         const nodesData = await hubFetch(`/v1/groups/${groupId}/nodes`, { token });
         if (cancelled) return;
@@ -812,11 +875,9 @@ function GroupPage({ groupId, group, token, username, userId }) {
           return;
         }
 
-        // Session keys for P2P GEK bundle fetch (node delivers wrapped GEK)
-        const sessionKeys = _sessionKeys ? {
-          skXB64: _sessionKeys.skXB64,
-          pkXB64: _sessionKeys.pkXB64,
-        } : null;
+        // No keys are carried in: the transport fetches this node's identity
+        // from the node, or creates one there on a first join.
+        const sessionKeys = null;
 
         setStatus('connecting');
         const nodeId = nodesData.nodes[0].node_id;
@@ -824,34 +885,21 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = transport;
 
         const ack = await transport.connect(
-          nodeId, token, groupId, null, sessionKeys, _bundleKey, username);
+          nodeId, token, groupId, null, sessionKeys, _bundleKey, username,
+          userId, _pendingJoinCode);
+        _pendingJoinCode = null;
         if (cancelled) return;
         setIsNodeAdmin(!!ack.is_node_admin);
 
-        // If transport recovered different session keys from node during handshake
-        if (transport.sessionKeys) {
-          const recovered = transport.sessionKeys;
-          if (!_sessionKeys || recovered.skXB64 !== _sessionKeys.skXB64) {
-            _sessionKeys = recovered;
-            if (!_sessionKeys.pkXB64) {
-              const pubkeys = await hubFetch(
-                `/v1/users/${username}/pubkeys`, { token });
-              _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-            }
-            _pendingBundlePush = null;
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _saveSessionKeys();
-          }
-        }
-
-        // Push keypair bundle to node (new registration, localStorage → node)
-        if (_pendingBundlePush && transport.connected) {
+        // A first join to this node generated an identity for it; leave it with
+        // the node so any other browser can become the same person here with the
+        // passphrase. It is this node's key and no other's.
+        if (transport.connected && transport.newNodeBundle) {
           try {
-            await transport.storeKeypairBundle(_pendingBundlePush);
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _pendingBundlePush = null;
+            await transport.storeKeypairBundle(transport.newNodeBundle);
+            transport.newNodeBundle = null;
           } catch (e) {
-            console.warn('[MeshBay] Bundle push to node deferred:', e.message);
+            console.warn('[MeshBay] could not leave our key with the node:', e.message);
           }
         }
 
@@ -880,10 +928,24 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         cacheGroupIndex(groupId, group ? group.name : groupId, freshEntries);
       } catch (err) {
-        if (!cancelled) {
-          setError(err.message);
-          setStatus('error');
+        if (cancelled) return;
+
+        // Our token predates being added to this group. Refresh once and retry
+        // rather than telling someone who was just invited that they are not a
+        // member — which is what the node honestly sees, and is useless to them.
+        if (err.reason === 'not_a_member' && !refreshedRef.current && onRefreshAuth) {
+          refreshedRef.current = true;
+          try {
+            if (await onRefreshAuth()) return;   // new token → effect re-runs
+          } catch { /* fall through to the message below */ }
         }
+
+        // The node has never seen this browser for this account: it needs a
+        // one-time code from the operator before it will hand over the group
+        // key. Not an error to shout about — a step in joining.
+        if (err.reason === 'code_required') setNeedsCode(true);
+        setError(err.message);
+        setStatus('error');
       }
     };
 
@@ -902,7 +964,7 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = null;
       }
     };
-  }, [groupId, token]);
+  }, [groupId, token, retryKey]);
 
   const downloadFile = useCallback(async (entry) => {
     const transport = transportRef.current;
@@ -979,8 +1041,13 @@ function GroupPage({ groupId, group, token, username, userId }) {
     const transport = transportRef.current;
     if (!transport || !transport.connected) return;
     try {
-      const signFn = (_sessionKeys && window.MeshBayKeys)
-        ? (challenge) => window.MeshBayKeys.signChallenge(_sessionKeys.skEdB64, challenge)
+      // Signs an explicit transcript built by transport.js, not opaque bytes from
+      // the node — see MeshBayCrypto.adminTranscript and finding H5.
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
         : null;
       await transport.deleteFile(entry.id, signFn);
       const indexMsg = await transport.fetchIndex();
@@ -1077,6 +1144,17 @@ function GroupPage({ groupId, group, token, username, userId }) {
         `}
       </div>
       ${error && html`<div class="error-msg" style="margin-bottom:12px">${error}</div>`}
+      ${needsCode && html`
+        <form class="invite-form" style="margin-bottom:12px" onSubmit=${submitJoinCode}>
+          <h4>${t('group.join_code_title')}</h4>
+          <p class="settings-hint">${t('group.join_code_hint')}</p>
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${codeInput} onInput=${e => setCodeInput(e.target.value)} required />
+            <button class="admin-btn" type="submit">${t('group.join_code_btn')}</button>
+          </div>
+        </form>
+      `}
       ${dlState && html`
         <div class="dl-bar">
           <span class="dl-name">${dlState.name}</span>
@@ -1222,7 +1300,8 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         ${tab === 'members' && html`
           <${MembersPanel} groupId=${groupId} group=${group} token=${token}
-            transportRef=${transportRef} gekRef=${gekRef} />
+            transportRef=${transportRef} gekRef=${gekRef}
+            isNodeAdmin=${isNodeAdmin} userId=${userId} />
         `}
       `}
       ${status === 'offline' && html`
@@ -1363,13 +1442,41 @@ function _b64ToU8(b64) {
 
 // ── Members Panel ────────────────────────────────────────────────────────
 
-function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
+function MembersPanel({ groupId, group, token, transportRef, gekRef,
+                       isNodeAdmin, userId }) {
   const [members, setMembers] = useState([]);
   const [adminId, setAdminId] = useState('');
   const [loading, setLoading] = useState(true);
   const [inviteUser, setInviteUser] = useState('');
   const [inviting, setInviting] = useState(false);
   const [error, setError] = useState('');
+  const [inviteCode, setInviteCode] = useState(null);
+  const [pairCode, setPairCode] = useState('');
+  const [pairStatus, setPairStatus] = useState('');
+  const [pairing, setPairing] = useState(false);
+
+  // Pairing lives here rather than in Settings because this is where a live
+  // connection to the node exists — and it is offered only when the node itself
+  // says this account is its operator (is_node_admin comes from the authenticated
+  // handshake_ack, not from the hub).
+  const doPair = useCallback(async (e) => {
+    e.preventDefault();
+    const code = pairCode.trim();
+    if (!code) return;
+    setPairing(true);
+    setPairStatus('');
+    try {
+      const transport = transportRef && transportRef.current;
+      if (!transport || !transport.connected) throw new Error('Not connected to the node');
+      await transport.pairOperator(userId, code);
+      setPairCode('');
+      setPairStatus('paired');
+    } catch (err) {
+      setPairStatus(err.message);
+    } finally {
+      setPairing(false);
+    }
+  }, [pairCode, transportRef, userId]);
 
   const loadMembers = useCallback(() => {
     setLoading(true);
@@ -1391,29 +1498,37 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     if (!inviteUser.trim()) return;
     setInviting(true);
     setError('');
+    setInviteCode(null);
     try {
       const transport = transportRef && transportRef.current;
       const username = inviteUser.trim();
-
-      // Fetch invitee's public keys (hub = public key directory)
-      const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-      const pkXBytes = Uint8Array.from(atob(pubkeys.pk_x25519), c => c.charCodeAt(0));
-
-      // Get raw GEK from the active transport connection
-      if (!transport || !transport.connected || !transport.gekRaw) {
-        throw new Error('Not connected to node or no GEK available');
+      if (!transport || !transport.connected) {
+        throw new Error('Not connected to the node — it must be online to invite');
       }
-      const gekBytes = transport.gekRaw;
 
-      // Wrap GEK for invitee and store on node via P2P
-      const bundle = await window.MeshBayCrypto.wrapGEK(gekBytes, pkXBytes);
-      await transport.storeGekBundle(pubkeys.user_id, groupId, bundle);
+      // The hub is asked for the account id, and nothing else. It is no longer
+      // asked for the invitee's public key: the node wraps the group key itself,
+      // for a key the invitee proves possession of when they connect (H3). A hub
+      // that answered with the wrong account here would produce an invite whose
+      // code it never learns — the code goes to a human, out of band.
+      const account = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
 
-      // Add member on hub (membership management only)
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
+        : null;
+      const result = await transport.createInvite(
+        account.user_id, groupId, username, signFn);
+
+      // Membership on the hub is what lets them reach the node at all; the code
+      // is what gets them the key.
       await hubFetch(`/v1/groups/${groupId}/members/${username}`, {
         method: 'POST', token, body: {},
       });
 
+      setInviteCode({ username, code: result.code, expires: result.expires_at });
       setInviteUser('');
       loadMembers();
     } catch (err) {
@@ -1421,7 +1536,7 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     } finally {
       setInviting(false);
     }
-  }, [groupId, token, inviteUser, loadMembers]);
+  }, [groupId, token, inviteUser, loadMembers, transportRef]);
 
   if (loading) return html`<p class="page-message">${t('explore.loading')}</p>`;
 
@@ -1452,6 +1567,15 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
         <form class="invite-form" onSubmit=${doInvite}>
           <h4>${t('members.invite_title')}</h4>
           ${error && html`<p class="error-msg">${error}</p>`}
+          ${inviteCode && html`
+            <div class="success-msg" style="margin-bottom:8px">
+              <p>${t('members.invite_code_ready', { user: inviteCode.username })}</p>
+              <p style="font-family:monospace;font-size:1.4em;letter-spacing:2px;margin:6px 0">
+                ${inviteCode.code}
+              </p>
+              <p>${t('members.invite_code_hint')}</p>
+            </div>
+          `}
           <div style="display:flex;gap:8px">
             <input type="text" placeholder="${t('members.username_placeholder')}"
               value=${inviteUser} onInput=${e => setInviteUser(e.target.value)} required />
@@ -1461,6 +1585,24 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
           </div>
         </form>
       `}
+      ${isNodeAdmin && html`
+        <form class="invite-form" onSubmit=${doPair}>
+          <h4>${t('members.pair_title')}</h4>
+          <p class="settings-hint">${t('members.pair_hint')}</p>
+          ${pairStatus && html`
+            <p class=${pairStatus === 'paired' ? 'success-msg' : 'error-msg'}>
+              ${pairStatus === 'paired' ? t('members.pair_success') : pairStatus}
+            </p>
+          `}
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${pairCode} onInput=${e => setPairCode(e.target.value)} required />
+            <button class="admin-btn" type="submit" disabled=${pairing}>
+              ${pairing ? '...' : t('members.pair_btn')}
+            </button>
+          </div>
+        </form>
+      `}
     </div>
   `;
 }
@@ -1969,6 +2111,15 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
   const [currentNodeKey, setCurrentNodeKey] = useState(null);
   const [nodeKeyStatus, setNodeKeyStatus] = useState('');
   const [nodeKeyLoading, setNodeKeyLoading] = useState(false);
+  const [pinCount, setPinCount] = useState(
+    () => (window.MeshBayTransport?.pinnedNodeCount?.() ?? 0));
+
+  // 11.5.8: node identity pins are refused strictly on change, so users need a
+  // deliberate way to accept a legitimate rotation (operator reinstalled a node).
+  const clearPins = useCallback(() => {
+    window.MeshBayTransport?.clearNodePin?.();
+    setPinCount(window.MeshBayTransport?.pinnedNodeCount?.() ?? 0);
+  }, []);
 
   useEffect(() => {
     hubFetch(`/v1/users/${user.username}/pubkeys`, { token: user.token })
@@ -2060,6 +2211,17 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
       </div>
 
       <div class="settings-section">
+        <h3 class="settings-heading">${t('settings.node_pins')}</h3>
+        <p class="settings-hint">${t('settings.node_pins_hint')}</p>
+        <div class="settings-row">
+          <span class="settings-label">${t('settings.node_pins_count', { n: pinCount })}</span>
+          <button class="btn-secondary" onClick=${clearPins} disabled=${pinCount === 0}>
+            ${t('settings.node_pins_clear')}
+          </button>
+        </div>
+      </div>
+
+      <div class="settings-section">
         <h3 class="settings-heading">${t('settings.appearance')}</h3>
         <div class="settings-row">
           <span class="settings-label">${t('settings.theme')}</span>
@@ -2501,12 +2663,10 @@ function App() {
         const data = await window.MeshBayKeys.loginAndRecover(username, password);
         token = data.accessToken;
         refreshToken = data.refreshToken;
+        // The only thing sign-in produces: the key that opens a node's bundle.
+        // Which identity we use is decided per node, when we get there.
         _bundleKey = data.bundleKey;
         await _storeBundleKey(_bundleKey);
-        if (data.skXB64) {
-          _sessionKeys = { skXB64: data.skXB64, skEdB64: data.skEdB64 };
-          _pendingBundlePush = data.keypairBundleEnc;
-        }
       } else {
         const data = await hubFetch('/v1/users/login', {
           method: 'POST',
@@ -2516,11 +2676,6 @@ function App() {
         refreshToken = data.refresh_token;
       }
       const me = await hubFetch('/v1/users/me', { token });
-      if (_sessionKeys) {
-        const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-        _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-        _saveSessionKeys();
-      }
       const u = { username, userId: me.user_id, token, refreshToken, role: me.role };
       setUser(u);
       saveAuth(u);
@@ -2533,6 +2688,20 @@ function App() {
     },
   };
 
+  // Group membership is baked into the access token at login and the hub does not
+  // push updates, so someone invited after they signed in carries a token that
+  // says they are in nothing. Refreshing re-reads membership from the database.
+  const refreshAuth = useCallback(async () => {
+    if (!user || !user.refreshToken) return null;
+    const data = await hubFetch('/v1/users/token/refresh', {
+      method: 'POST', body: { refresh_token: user.refreshToken },
+    });
+    const u = { ...user, token: data.access_token };
+    setUser(u);
+    saveAuth(u);
+    return data.access_token;
+  }, [user]);
+
   let page;
   if (route === '/login' || route === '/register') {
     page = route === '/register'
@@ -2557,7 +2726,8 @@ function App() {
     const group = groups.find(g => g.id === groupId);
     page = html`<${GroupPage}
       groupId=${groupId} group=${group} token=${user.token}
-      username=${user.username} userId=${user.userId} />`;
+      username=${user.username} userId=${user.userId}
+      onRefreshAuth=${refreshAuth} />`;
   } else if (route === '/admin') {
     page = (user.role === 'moderator' || user.role === 'admin')
       ? html`<${AdminPage} token=${user.token} />`