Merge branch 'refactor/groups-phase1'

Groups refactor, phases 1-3.

The root model replaces the old `upload` flag and group-wide `member_upload`
with per-root `writable`/`removable`/`ejected`, carried by a `RootSet` that
both front doors — the loopback API and signed MNP — reach through the same
`ops` functions. MNP goes to 1.1, additively: the roots table now rides on
`index_delta`, so a root added, removed, ejected or plugged reaches every
connected client instead of only whoever reloaded.

The group UI becomes a plugin architecture: an application is a registry
entry in `apps.js` plus its own files, with directories stored generically
by `ops.set_app_directories` under whatever the app is called. A reference
application, hidden behind `?dev=1`, is what makes that claim testable —
adding it is what found the two places still naming apps by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

1 files changed, 139 insertions, 62 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
index c78281b..af87f92 100644
--- a/packages/meshbay-node/src/meshbay_node/roster.py
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -31,6 +31,8 @@ from pathlib import Path
 
 import aiosqlite
 
+from meshbay_common.paths import fold
+
 log = logging.getLogger(__name__)
 
 # Crockford base32 without I, L, O and U: no character pair a human can confuse
@@ -543,10 +545,40 @@ class Roster:
 
     # ── Group settings ──────────────────────────────────────────────────────
 
-    # Whether members who are not the operator may upload. Default is yes: a
-    # group that nobody may add to is the unusual case, and an existing node
-    # must not change behaviour because a table was added under it.
-    SETTING_MEMBER_UPLOAD = "member_upload"
+    # Whether a root is ejected. Runtime state, one key per root, keyed by the
+    # *folded* name so it agrees with the case-insensitive comparison the rest
+    # of the root code makes. It lives here rather than in node.toml because it
+    # is not configuration — an operator's hand-written config file should not
+    # be rewritten because a USB drive was unplugged — and it has to survive a
+    # restart, or the rescan that follows reads an empty mount point as an
+    # erased library, which is the whole thing eject exists to prevent.
+    SETTING_ROOT_EJECTED_PREFIX = "root_ejected:"
+
+    @classmethod
+    def root_ejected_key(cls, root_name: str) -> str:
+        return cls.SETTING_ROOT_EJECTED_PREFIX + fold(root_name)
+
+    async def set_root_ejected(self, group_id: str, root_name: str,
+                               ejected: bool, set_by: str = "") -> None:
+        await self.set_setting(group_id, self.root_ejected_key(root_name),
+                               "1" if ejected else "0", set_by)
+
+    async def ejected_roots(self, group_id: str) -> set[str]:
+        """
+        The folded names of this group's ejected roots.
+
+        Matched in Python rather than with `LIKE 'root_ejected:%'`: `_` is a
+        single-character wildcard there, so that pattern also matches keys this
+        does not own. A group has a handful of settings rows, so reading them
+        all costs nothing and the prefix test is then exact.
+        """
+        prefix = self.SETTING_ROOT_EJECTED_PREFIX
+        async with self._db.execute(
+                "SELECT key, value FROM group_settings WHERE group_id = ?",
+                (group_id,)) as cur:
+            rows = await cur.fetchall()
+        return {r["key"][len(prefix):] for r in rows
+                if r["key"].startswith(prefix) and r["value"] == "1"}
 
     async def get_setting(self, group_id: str, key: str,
                           default: str | None = None) -> str | None:
@@ -567,17 +599,6 @@ class Roster:
             (group_id, key, value, set_by, _now()))
         await self._db.commit()
 
-    async def member_upload_allowed(self, group_id: str) -> bool:
-        """Whether an ordinary member may upload to this group."""
-        value = await self.get_setting(group_id, self.SETTING_MEMBER_UPLOAD, "1")
-        return value != "0"
-
-    async def set_member_upload(self, group_id: str, allowed: bool,
-                                set_by: str = "") -> bool:
-        await self.set_setting(group_id, self.SETTING_MEMBER_UPLOAD,
-                               "1" if allowed else "0", set_by)
-        return allowed
-
     # Which group "applications" (Chat, Files, and whatever registers later in
     # apps.js) are shown to members. Unset means every app that exists — an
     # existing group's tabs must not disappear because a node was upgraded.
@@ -587,11 +608,15 @@ class Roster:
     async def enabled_apps(self, group_id: str) -> list[str]:
         value = await self.get_setting(group_id, self.SETTING_ENABLED_APPS)
         if value is None:
-            return list(self.DEFAULT_APPS)
-        try:
-            return list(json.loads(value))
-        except (ValueError, TypeError):
-            return list(self.DEFAULT_APPS)
+            apps = list(self.DEFAULT_APPS)
+        else:
+            try:
+                apps = list(json.loads(value))
+            except (ValueError, TypeError):
+                apps = list(self.DEFAULT_APPS)
+        if "files" not in apps:
+            apps.insert(0, "files")
+        return apps
 
     async def set_enabled_apps(self, group_id: str, apps: list[str],
                                set_by: str = "") -> list[str]:
@@ -605,7 +630,7 @@ class Roster:
     # user_id)` authorizing the operator node-wide (desktop-client-v1.md
     # §6.3). Unset means "the shipped default token, TMDB's own default
     # language" — the same "absent means the old behaviour" discipline
-    # member_upload/enabled_apps already follow.
+    # enabled_apps already follows.
     #
     # Whether TMDB is used *at all*, though, is per-group (moved off the
     # node-wide sentinel below, 2026-08-24): an operator running a real media
@@ -636,58 +661,110 @@ class Roster:
             await self.set_setting(self.NODE_WIDE_GROUP_ID, self.SETTING_TMDB_LANGUAGE,
                                    language, set_by)
 
-    # Which folder is the Videos app's entry point for this group — per-group
-    # (unlike the token/language above), since different groups share
-    # different trees. Empty/unset means the whole group index, exactly as
-    # today.
-    SETTING_VIDEO_ROOT = "video_root"
-
-    async def video_root(self, group_id: str) -> str:
-        return await self.get_setting(group_id, self.SETTING_VIDEO_ROOT, "") or ""
+    # ── App directories ─────────────────────────────────────────────────────
+    #
+    # Which folder(s) inside the group's shared roots each application uses as
+    # its entry point. One storage shape for every app, keyed by the app's own
+    # name, so adding an application needs no change here at all — that is the
+    # whole point of the plugin architecture (docs/refactor-groups.md §1.6).
+    #
+    # Always a JSON list, even for an app that only ever wants one directory.
+    # Two shapes for one idea is how `video_root` (scalar) and `photo_roots`
+    # (list) ended up needing separate ops, separate MNP messages and separate
+    # settings widgets to say the same thing.
+    #
+    # Empty/unset means nothing configured yet, and every app reads that as
+    # "show nothing until an operator has chosen" rather than "the whole group
+    # index" — the discipline video_root established, kept.
+    SETTING_APP_DIRS_SUFFIX = "_directories"
 
-    async def set_video_root(self, group_id: str, path: str, set_by: str = "") -> str:
-        await self.set_setting(group_id, self.SETTING_VIDEO_ROOT, path or "", set_by)
-        return path or ""
+    # What each app's directories used to be stored under, before they were
+    # one shape. Read as a fallback so an existing node keeps working with no
+    # migration step: the legacy key is never written again, and the first
+    # save through the new path leaves it behind.
+    # Keyed by the *registry* name the app is known by everywhere else
+    # (apps.js, ALLOWED_APPS, enabled_apps) — which for Music is "music", while
+    # its old setting was called `audio_root`. One identifier per app, and the
+    # place the two names meet is this table and nowhere else.
+    LEGACY_DIR_KEYS = {
+        "video": ("video_root", "scalar"),
+        "music": ("audio_root", "scalar"),
+        "photo": ("photo_roots", "list"),
+    }
 
-    # Same shape as SETTING_VIDEO_ROOT — the Music app's own entry point,
-    # added later (docs/musicbay.md's original "no root, works over the
-    # whole shared tree" simplification turned out not to hold up against a
-    # real messy library: the operator asked for the same scoping Videos
-    # already had). Empty/unset means Music shows nothing yet, exactly like
-    # an unset video_root — see daemon.py's enrichment gate.
-    SETTING_AUDIO_ROOT = "audio_root"
+    # The name each app's directories are *also* published under, for readers
+    # that predate the list — the handshake ack's `video_root`, and the group
+    # context the ack builds from. Derived from the list, never stored beside
+    # it, so the two cannot disagree; the shape says how to derive it.
+    CTX_ALIASES = {
+        "video": ("video_root", "scalar"),
+        "music": ("audio_root", "scalar"),
+        "photo": ("photo_roots", "list"),
+        "chat": ("chat_directory", "scalar"),
+    }
 
-    async def audio_root(self, group_id: str) -> str:
-        return await self.get_setting(group_id, self.SETTING_AUDIO_ROOT, "") or ""
+    @classmethod
+    def app_dirs_key(cls, app_key: str) -> str:
+        return f"{app_key}{cls.SETTING_APP_DIRS_SUFFIX}"
 
-    async def set_audio_root(self, group_id: str, path: str, set_by: str = "") -> str:
-        await self.set_setting(group_id, self.SETTING_AUDIO_ROOT, path or "", set_by)
-        return path or ""
+    @classmethod
+    def ctx_alias(cls, app_key: str, directories: list[str]) -> tuple[str, object] | None:
+        """The (name, value) an app's directories are also published under."""
+        alias = cls.CTX_ALIASES.get(app_key)
+        if not alias:
+            return None
+        name, shape = alias
+        if shape == "list":
+            return name, list(directories)
+        return name, (directories[0] if directories else "")
 
-    # Which folder(s) are the Photos app's entry points for this group —
-    # a *set*, unlike video_root/audio_root above: a photo library is
-    # routinely scattered across several unrelated folders (docs/photos.md
-    # §2.1), so there is no single natural root to pick. Stored the same way
-    # `enabled_apps` already is (json.dumps(sorted(...))). Empty/unset means
-    # nothing configured yet — same "show nothing until an operator has
-    # chosen" discipline video_root/audio_root already established, not
-    # "the whole group index".
-    SETTING_PHOTO_ROOTS = "photo_roots"
+    async def app_directories(self, group_id: str, app_key: str) -> list[str]:
+        value = await self.get_setting(group_id, self.app_dirs_key(app_key))
+        if value is not None:
+            try:
+                return [str(p) for p in json.loads(value)]
+            except (ValueError, TypeError):
+                return []
 
-    async def photo_roots(self, group_id: str) -> list[str]:
-        value = await self.get_setting(group_id, self.SETTING_PHOTO_ROOTS)
-        if value is None:
+        legacy = self.LEGACY_DIR_KEYS.get(app_key)
+        if not legacy:
             return []
+        key, shape = legacy
+        raw = await self.get_setting(group_id, key)
+        if raw is None:
+            return []
+        if shape == "scalar":
+            return [raw] if raw else []
         try:
-            return list(json.loads(value))
+            return [str(p) for p in json.loads(raw)]
         except (ValueError, TypeError):
             return []
 
-    async def set_photo_roots(self, group_id: str, roots: list[str],
-                              set_by: str = "") -> list[str]:
-        await self.set_setting(group_id, self.SETTING_PHOTO_ROOTS,
-                               json.dumps(sorted(roots)), set_by)
-        return roots
+    async def set_app_directories(self, group_id: str, app_key: str,
+                                  paths: list[str], set_by: str = "") -> list[str]:
+        clean = sorted({str(p).strip("/") for p in paths if str(p).strip("/")})
+        await self.set_setting(group_id, self.app_dirs_key(app_key),
+                               json.dumps(clean), set_by)
+        return clean
+
+    # ── Chat ────────────────────────────────────────────────────────────────
+
+    # Whether the node fetches a page's title/preview when a member posts a
+    # link. Outbound third-party traffic on the operator's connection, from a
+    # message they did not write, so it is theirs to switch off — the same
+    # reasoning as the per-group TMDB switch. Unset means on, because that is
+    # what the node did before this existed.
+    SETTING_CHAT_LINK_PREVIEW = "chat_link_preview"
+
+    async def chat_link_preview(self, group_id: str) -> bool:
+        value = await self.get_setting(group_id, self.SETTING_CHAT_LINK_PREVIEW, "1")
+        return value != "0"
+
+    async def set_chat_link_preview(self, group_id: str, enabled: bool,
+                                    set_by: str = "") -> bool:
+        await self.set_setting(group_id, self.SETTING_CHAT_LINK_PREVIEW,
+                               "1" if enabled else "0", set_by)
+        return enabled
 
     # Whether TMDB lookups run for this group at all — per-group, unlike the
     # token/language above: one node process can share a real media library