feat(hub): split the group UI into a pluggable "applications" architecture

GroupPage's 6620-line app.js carried Chat and Files wedged in directly, with
no way to add another group-level app without touching the shell itself. It
is now app.js (routing, non-group pages) plus nine focused files — apps.js
(the registry), chat-app.js, files-app.js, video-player.js, group-page.js
(the shell), group-settings.js, hub-client.js, icon.js and file-utils.js —
with docs/apps.md as the checklist for adding one (Videos/Music/Photos are
sketched there, not built).

Node side gained the matching enablement mechanism, mirroring
member_upload exactly: a roster setting, a signed apps_enabled op enforced
by _has_admin_authority, exposed in the handshake ack. Operators toggle
applications per group from Settings, which also gained a small reorder:
Invite, Pairing, Applications, Shared directories, Uploads, danger zone,
Your devices, Members.

Two bugs surfaced during the split, both missing an import across the new
file boundary and invisible to node --check or a module-load probe since
they only throw when the code path actually runs:

- group-page.js called onRefreshAuth on a stale-token handshake rejection,
  but app.js never imported refreshAccessToken from hub-client.js — so a
  brand new member (including a group's own creator) hit "Not a member of
  this group" and the retry silently failed, throwing before it could
  refresh the token.
- chat-app.js called getLocale() for message timestamps without importing
  it from i18n.js. Opening Chat on a group with real messages threw mid-
  render; uncaught, that appears to wedge Preact's render scheduler, so
  every button on the page stopped responding until reload.

Caught the second class of bug with a proper no-undef audit across all
split files (a temporarily installed ESLint 9, since the system one is too
old to parse this codebase's syntax) rather than trusting grep. 827 tests
pass; 6 new ones cover the apps_enabled policy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

1 files changed, 30 insertions, 21 deletions

diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
index d859125..9290a94 100644
--- a/packages/meshbay-hub/tests/test_upload_controls_hidden.py
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -17,7 +17,15 @@ from pathlib import Path
 import pytest
 
 STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+# The group-page refactor split what used to be one app.js into one file per
+# "application" plus the group shell. mayUpload itself is still derived once,
+# in the shell (group-page.js) — Files and Chat each moved to their own file
+# and receive it as a prop, the same shape ChatPanel already took.
 APP = STATIC / "app.js"
+GROUP_PAGE = STATIC / "group-page.js"
+FILES_APP = STATIC / "files-app.js"
+CHAT_APP = STATIC / "chat-app.js"
+GROUP_SETTINGS = STATIC / "group-settings.js"
 TRANSPORT = STATIC / "transport.js"
 
 pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
@@ -25,7 +33,7 @@ pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailabl
 
 @pytest.fixture(scope="module")
 def app() -> str:
-    return APP.read_text(encoding="utf-8")
+    return GROUP_PAGE.read_text(encoding="utf-8")
 
 
 def _component(app: str, name: str) -> str:
@@ -36,15 +44,15 @@ def _component(app: str, name: str) -> str:
 
 # ── Both controls ───────────────────────────────────────────────────────────
 
-def test_the_files_toolbar_hides_its_upload_button(app):
-    page = _component(app, "GroupPage")
+def test_the_files_toolbar_hides_its_upload_button():
+    page = _component(FILES_APP.read_text(encoding="utf-8"), "FilesPanel")
     toolbar = page[page.index("file-toolbar"):]
     toolbar = toolbar[:toolbar.index("group.mkdir")]
     assert "mayUpload &&" in toolbar, "the Upload button is offered regardless"
 
 
-def test_the_chat_composer_hides_its_paperclip(app):
-    chat = _component(app, "ChatPanel")
+def test_the_chat_composer_hides_its_paperclip():
+    chat = _component(CHAT_APP.read_text(encoding="utf-8"), "ChatPanel")
     composer = chat[chat.index("chat-input-row"):]
     assert "mayUpload &&" in composer, (
         "the chat attachment is the second way in and is still offered")
@@ -53,15 +61,19 @@ def test_the_chat_composer_hides_its_paperclip(app):
 def test_both_read_the_same_answer(app):
     """Two derivations would eventually disagree, and the disagreement would
     be one of them offering an upload the node refuses."""
-    page = _component(app, "GroupPage")
-    assert re.search(r"const mayUpload = memberUpload \|\| isNodeAdmin;", page), (
+    assert re.search(r"const mayUpload = memberUpload \|\| isNodeAdmin;", app), (
         "mayUpload is no longer derived in one place")
-    assert "mayUpload=${mayUpload}" in page, "the chat panel is told separately"
+    # Files and Chat both receive it from the same `commonProps` object the
+    # shell spreads into whichever app tab is active — one derivation feeding
+    # one object, rather than two hand-written prop attributes that could
+    # drift apart.
+    props = app[app.index("const commonProps = {"):app.index("return html`")]
+    assert "mayUpload," in props or "mayUpload:" in props, (
+        "mayUpload is not in the shared props object every app receives")
 
 
 def test_the_operator_keeps_their_own_controls(app):
-    page = _component(app, "GroupPage")
-    assert "memberUpload || isNodeAdmin" in page, (
+    assert "memberUpload || isNodeAdmin" in app, (
         "turning uploads off would hide the operator's own upload button")
 
 
@@ -70,27 +82,24 @@ def test_the_operator_keeps_their_own_controls(app):
 def test_the_answer_comes_from_the_node(app):
     """Not from the hub, which has no say in what may be written to someone
     else's disk, and no way to be believed about it."""
-    page = _component(app, "GroupPage")
-    assert "ack.member_upload !== false" in page, (
+    assert "ack.member_upload !== false" in app, (
         "the handshake ack is what carries this")
-    assert "hubFetch" not in page[page.index("ack.member_upload") - 400:
-                                  page.index("ack.member_upload")]
+    assert "hubFetch" not in app[app.index("ack.member_upload") - 400:
+                                 app.index("ack.member_upload")]
 
 
 def test_an_older_node_is_treated_as_permissive(app):
     """A node that predates the setting sends no such field. Reading a missing
     field as "off" would close every group on the older half of the network."""
-    page = _component(app, "GroupPage")
-    assert "!== false" in page[page.index("ack.member_upload"):
-                               page.index("ack.member_upload") + 60]
+    assert "!== false" in app[app.index("ack.member_upload"):
+                              app.index("ack.member_upload") + 60]
 
 
 def test_a_change_reaches_people_already_connected(app):
     """The operator may be someone else entirely, changing it while you have
     the group open. A button that survives until the next reconnection is a
     button somebody presses."""
-    page = _component(app, "GroupPage")
-    assert "transport.onUploadPolicy" in page
+    assert "transport.onUploadPolicy" in app
     transport = TRANSPORT.read_text(encoding="utf-8")
     assert "member_upload_ack" in transport, "nothing routes the node's notice"
 
@@ -115,8 +124,8 @@ def test_changing_it_is_signed(app):
         "an unsigned instruction would let any member turn uploads back on")
 
 
-def test_only_the_operator_is_offered_the_setting(app):
-    panel = _component(app, "GroupSettingsPanel")
+def test_only_the_operator_is_offered_the_setting():
+    panel = _component(GROUP_SETTINGS.read_text(encoding="utf-8"), "GroupSettingsPanel")
     section = panel[panel.index("members.uploads_title") - 400:
                     panel.index("members.uploads_title")]
     assert "isNodeAdmin && connected" in section