feat(hub): one account, several linked nodes

An account links up to MAX_NODES_PER_ACCOUNT node keys (node_keys table)
instead of the one users.pk_node_ed25519; the migration carries each
account's key over and the downgrade keeps the last one linked.
/v1/nodes/auth accepts any linked key, and its token names the key that
won it (nk). PUT /me/node_key adds a key, idempotently, 409 past the
limit; DELETE /me/node_key names the key: a browser session any of its
own, a node only its own. Unlinking a key closes that node's socket and
refuses its tokens at once, on REST and on the socket; the account's other
nodes are untouched. /pubkeys no longer gives a node key to other accounts,
and gives the caller its last linked one, which installed desktop apps read.

The node reports waiting_for_node_key while its key is unlinked and signs
in again as soon as the hub says so, so a key linked again is back within
seconds; unlinking itself signs in first to hold a token naming its key.

Profile -> Linked nodes lists each node (connected, last seen, IP, linked
since, This machine in the desktop app) with Copy and Unlink, and adds a
key by hand. The Node page banner, Create group and the desktop app add
this machine's key instead of replacing another's. Messages that pointed
at Settings -> Link Node point at Profile -> Linked nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index 557b523..46b4ae1 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -645,8 +645,15 @@ class NodeDaemon(EnrichmentMixin):
                         log.warning("Invalid revocation token: %s", e)
 
             async def on_connected():
+                # Back from an unlink: the key was linked again and the hub let
+                # this node in, so it is serving once more.
+                if self._state.get("status") == "waiting_for_node_key":
+                    self._state["status"] = "running"
                 await self._sync_blocklist(hub)
 
+            def on_unlinked():
+                self._state["status"] = "waiting_for_node_key"
+
             ws_task = asyncio.create_task(hub.maintain_ws(
                 on_incoming=on_incoming,
                 on_revocation=on_revocation,
@@ -654,6 +661,7 @@ class NodeDaemon(EnrichmentMixin):
                 group_ids=lambda: list((self._state.get("groups_ctx") or {}).keys()),
                 on_connected=on_connected,
                 on_blocklist=self._on_blocklist_update,
+                on_unlinked=on_unlinked,
             ))
             self._tasks.append(ws_task)
             log.info("Hub WS task started")
@@ -1043,7 +1051,7 @@ class NodeDaemon(EnrichmentMixin):
                         self._state["status"] = "waiting_for_node_key"
                         log.warning(
                             "Node key not linked. Get it from `meshbay-node "
-                            "status` and paste it in Settings > Link Node on %s "
+                            "status` and paste it in Profile > Linked nodes on %s "
                             "(the desktop client links it automatically). "
                             "Retrying in %ds...",
                             self._config.hub.url, self.LINK_WAIT_S,