fix(client): the page names node operations, and the app confirms what widens the node

node:call is replaced by named operations with checked arguments; hosting a
group, sharing an unpicked folder, key rotation, denylist clearing and a change
of node account are confirmed by a native dialog. Every channel checks its
sender, secrets:get/set/clear are gone, node:start writes the app's own hub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 14 insertions, 14 deletions

diff --git a/packages/meshbay-node/tests/test_ops.py b/packages/meshbay-node/tests/test_ops.py
index b011802..9eb8339 100644
--- a/packages/meshbay-node/tests/test_ops.py
+++ b/packages/meshbay-node/tests/test_ops.py
@@ -314,7 +314,7 @@ async def test_reload_config_without_fn_is_refused(tmp_path):
 async def test_start_reload_returns_before_reload_fn_finishes(tmp_path):
     """The loopback route uses this one: a brand-new group's initial scan
     can take minutes, and the Electron bridge caps every loopback call at
-    30s (main.js node:call) — start_reload must not block on it."""
+    30s (main.js node:op) — start_reload must not block on it."""
     state = _state(tmp_path)
     release = asyncio.Event()
     called = []
diff --git a/packages/meshbay-node/tests/test_packaging_win.py b/packages/meshbay-node/tests/test_packaging_win.py
index cc9f8cc..96351db 100644
--- a/packages/meshbay-node/tests/test_packaging_win.py
+++ b/packages/meshbay-node/tests/test_packaging_win.py
@@ -349,7 +349,7 @@ def test_a_service_restart_waits_for_the_old_instance_before_starting_one():
 
 def test_node_start_refuses_a_node_of_another_version():
     main_js = MAIN_JS.read_text(encoding="utf-8")
-    body = main_js.split("ipcMain.handle('node:start'", 1)[1]
+    body = main_js.split("handle('node:start'", 1)[1]
     body = body[:body.index("process.platform !== 'linux'")]
     assert "p.version !== app.getVersion()" in body
     assert body.index("waitForNode(") < body.index("p.version !== app.getVersion()") \
@@ -726,8 +726,8 @@ def test_service_mode_toggle_elevates_the_same_script_the_installer_runs():
     assert "-Verb RunAs" in fn or "'-Verb', 'RunAs'" in fn or "-Verb', 'RunAs'" in fn
     assert "Get-Credential" not in fn
 
-    handler = main_js.split("ipcMain.handle('node:service-mode'", 1)[1]
-    handler = handler[:handler.index("ipcMain.handle(")]
+    handler = main_js.split("handle('node:service-mode'", 1)[1]
+    handler = handler[:handler.index("\n  handle(")]
     assert "winElevateServiceMode" in handler
     assert "'install'" in handler or '"install"' in handler
     assert "'remove'" in handler or '"remove"' in handler
@@ -793,7 +793,7 @@ def test_every_start_stop_and_restart_goes_through_the_cli():
     assert "killNodeProcesses()" in _fn_body(main_js, "async function nodeServiceStop()")
     assert "winNodeStartVia(['restart-daemon'])" in _fn_body(
         main_js, "async function nodeServiceRestart()")
-    start = main_js.split("ipcMain.handle('node:start'", 1)[1]
+    start = main_js.split("handle('node:start'", 1)[1]
     start = start.split("process.platform !== 'linux'", 1)[0]
     assert "winNodeStartVia(['restart-daemon'])" in start
     for gone in ("spawnNodeDetached", "winServiceTaskEnd", "winServiceTaskRun"):
@@ -834,8 +834,8 @@ def test_node_start_provisions_before_it_starts_anything():
     safety if the order were reversed.
     """
     main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
-    body = main_js.split("ipcMain.handle('node:start'", 1)[1]
-    body = body[:body.index("ipcMain.handle(")]
+    body = main_js.split("handle('node:start'", 1)[1]
+    body = body[:body.index("\n  handle(")]
 
     provision_at = body.index("provisionNode(")
     start_at = body.index("winNodeStartVia(")
@@ -857,8 +857,8 @@ def test_node_start_links_the_node_key_on_windows_not_only_linux():
     node started.
     """
     main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
-    body = main_js.split("ipcMain.handle('node:start'", 1)[1]
-    body = body[:body.index("ipcMain.handle(")]
+    body = main_js.split("handle('node:start'", 1)[1]
+    body = body[:body.index("\n  handle(")]
     win_branch = body.split("process.platform === 'win32'", 1)[1]
     win_branch = win_branch[:win_branch.index("process.platform !== 'linux'")]
     assert "linkNodeKeyAndAwaitRunning" in win_branch, (
@@ -1193,7 +1193,7 @@ def test_node_bundled_ipc_channel_exists_end_to_end():
     """main.js handles it, preload.js exposes it, platform.js wraps it --
     the same three-layer shape every other node.* capability already has."""
     main = MAIN_JS.read_text(encoding="utf-8")
-    assert "ipcMain.handle('node:bundled'" in main
+    assert "handle('node:bundled'" in main
     assert "hasBundledNode()" in main
 
     preload = PRELOAD_JS.read_text(encoding="utf-8")
@@ -1588,12 +1588,12 @@ def test_switching_modes_stops_the_node_first_and_brings_it_back():
     """Removing the service left its node running in session 0, unstoppable;
     installing it started a second node that found the port taken and quit."""
     main_js = MAIN_JS.read_text(encoding="utf-8")
-    body = main_js.split("ipcMain.handle('node:service-mode'", 1)[1].split("ipcMain.handle(", 1)[0]
+    body = main_js.split("handle('node:service-mode'", 1)[1].split("\n  handle(", 1)[0]
     assert body.index("killNodeProcesses()") < body.index("winElevateServiceMode(action)")
     after = body.split("winElevateServiceMode(action)", 1)[1]
     assert "wasRunning" in after and "winNodeStartVia(['autostart', 'start'])" in after
-    autostart = main_js.split("ipcMain.handle('node:autostart'", 1)[1]
-    autostart = autostart.split("ipcMain.handle(", 1)[0]
+    autostart = main_js.split("handle('node:autostart'", 1)[1]
+    autostart = autostart.split("\n  handle(", 1)[0]
     assert "winServiceTaskStatus()).installed" in autostart, (
         "the sign-in launcher must refuse while the boot task exists")
 
@@ -1603,7 +1603,7 @@ def test_a_declined_prompt_leaves_the_node_as_it_was():
     answered for two minutes -- used to leave it stopped, groups offline, with
     the mode unchanged. Found by letting the prompt time out on a real install."""
     main_js = MAIN_JS.read_text(encoding="utf-8")
-    body = main_js.split("ipcMain.handle('node:service-mode'", 1)[1].split("ipcMain.handle(", 1)[0]
+    body = main_js.split("handle('node:service-mode'", 1)[1].split("\n  handle(", 1)[0]
     guarded = body.split("await winElevateServiceMode(action);", 1)[1]
     catch = guarded.split("} catch (err) {", 1)[1].split("throw err;", 1)[0]
     assert "wasRunning" in catch and "winNodeStartVia(['restart-daemon'])" in catch