fix(client): the page names node operations, and the app confirms what widens the node

node:call is replaced by named operations with checked arguments; hosting a
group, sharing an unpicked folder, key rotation, denylist clearing and a change
of node account are confirmed by a native dialog. Every channel checks its
sender, secrets:get/set/clear are gone, node:start writes the app's own hub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 8 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/create-group-page.js b/packages/meshbay-hub/src/meshbay_hub/static/create-group-page.js
index 7556010..d4c2ab8 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/create-group-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/create-group-page.js
@@ -253,11 +253,11 @@ function CreateGroupWizard({ token, username, onCreated, onNodeLinked, allowPubl
       const mainRoot = roots[0];
       const attachBody = {
         name: name.trim(),
-        shared_dir: mainRoot.path,
+        path: mainRoot.path,
         writable: mainRoot.writable !== false,
       };
-      await platform.node.call('POST', '/api/groups/attach', attachBody);
-      await platform.node.call('POST', '/api/reload');
+      await platform.node.op('attachGroup', attachBody);
+      await platform.node.op('reload');
       update('done');
       advance();
 
@@ -272,8 +272,9 @@ function CreateGroupWizard({ token, username, onCreated, onNodeLinked, allowPubl
         update('running');
         for (let i = 1; i < roots.length; i++) {
           const r = roots[i];
-          await withRetry(() => platform.node.call('POST', `/api/groups/${gid}/roots`, {
-            path: r.path, name: r.name, writable: !!r.writable, removable: !!r.removable,
+          await withRetry(() => platform.node.op('addRoot', {
+            groupId: gid, path: r.path, name: r.name,
+            writable: !!r.writable, removable: !!r.removable,
           }));
         }
         await platform.waitForRootsIndexed(gid, setIndexProgress);
@@ -283,20 +284,20 @@ function CreateGroupWizard({ token, username, onCreated, onNodeLinked, allowPubl
 
       // 5. GEK init
       update('running');
-      await withRetry(() => platform.node.call('POST', `/api/groups/${gid}/gek`));
+      await withRetry(() => platform.node.op('initGek', { groupId: gid }));
       update('done');
       advance();
 
       // 6. Generate pairing code
       update('running');
-      const pairResult = await platform.node.call('POST', '/api/operator/pair');
+      const pairResult = await platform.node.op('pairOperator');
       if (pairResult && pairResult.code) {
         await platform.node.setPairingCode(pairResult.code);
         session.pendingJoinCode = pairResult.code;
       }
       update('done');
 
-      try { await platform.node.call('POST', '/api/reload'); } catch { /* best effort */ }
+      try { await platform.node.op('reload'); } catch { /* best effort */ }
 
       setStep(3);
       if (onCreated) onCreated();