fix(spa): say when the device refuses the local network

Android 17 makes the local network a permission of the application, and
Chrome 155 targets it: without it the node's LAN addresses are dropped
and a group on the phone's own Wi-Fi failed with "DataChannel closed".
The transport now names that refusal and the group page says what to
allow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
index 422d90b9..5972e000 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
@@ -703,6 +703,13 @@ function GroupPage({ groupId, group, token, username, userId, userPrefs,
         if (err.reason === 'no_keys') setNeedsPass(true);
         // An identity sealed before the pepper: only the operator can clear it.
         if (err.reason === 'bundle_format_retired') err.message = t('group.bundle_format_retired');
+        // This device dropped the node's local addresses (transport.js
+        // localNetworkRefused): a setting to change here, not a node to wait
+        // for. Android 17 gates it per application, Chrome from 155.
+        if (err.reason === 'local_network_blocked') {
+          err.message = t(/Android/i.test(navigator.userAgent)
+            ? 'group.lan_blocked_android' : 'group.lan_blocked_browser');
+        }
         // A key this node has never pinned, for an account it knows. The way in
         // is a device already trusted here, not an operator — which is the
         // whole point of device linking: a second browser or a native client