feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 38 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/ui/app.py b/packages/meshbay-node/src/meshbay_node/ui/app.py
index a068a8d..b505f25 100644
--- a/packages/meshbay-node/src/meshbay_node/ui/app.py
+++ b/packages/meshbay-node/src/meshbay_node/ui/app.py
@@ -295,6 +295,44 @@ def create_ui_app(state: dict) -> FastAPI:
     async def init_gek(group_id: str, rotate: bool = False):
         return await _op(lambda: ops.set_gek(state, group_id, rotate=rotate))
 
+    # ── Roots management (operator only, localhost) ────────────────────────
+
+    @app.post("/api/groups/{group_id}/roots")
+    async def add_root(group_id: str, payload: dict):
+        result = await _op(lambda: ops.add_root(
+            state, group_id,
+            (payload.get("path") or "").strip(),
+            name=(payload.get("name") or "").strip(),
+            kind=(payload.get("kind") or "generic").strip(),
+            upload=bool(payload.get("upload", False)),
+        ))
+        reload_fn = state.get("reload_fn")
+        if reload_fn:
+            asyncio.ensure_future(reload_fn())
+        return result
+
+    @app.delete("/api/groups/{group_id}/roots/{root_name}")
+    async def remove_root(group_id: str, root_name: str):
+        result = await _op(lambda: ops.remove_root(state, group_id, root_name))
+        reload_fn = state.get("reload_fn")
+        if reload_fn:
+            asyncio.ensure_future(reload_fn())
+        return result
+
+    # ── Upload toggle (operator only, localhost) ─────────────────────────
+
+    @app.put("/api/groups/{group_id}/member-upload")
+    async def set_member_upload(group_id: str, payload: dict):
+        return await _op(lambda: ops.set_member_upload(
+            state, group_id, bool(payload.get("allowed", False)),
+        ))
+
+    # ── Reload config ────────────────────────────────────────────────────
+
+    @app.post("/api/reload")
+    async def reload_config():
+        return await _op(lambda: ops.reload_config(state))
+
     # ── Chat endpoints ───────────────────────────────────────────────────────
 
     _chat_subscribers: list[WebSocket] = []