feat: config fields, module pages, key verification, telemetry capture

Incorporates the firmware-current feature work onto the protobuf foundation: new config fields (Display message bubbles; LoRa fem_lna_mode + serial_hal_only; Telemetry air_quality_screen_enabled); 4 new ModuleConfig pages (TrafficManagement, StatusMessage, TAK, RemoteHardware); the manual Key Verification flow (sendKeyVerification + ClientNotificationDialog stages + Verify Key button); live telemetry capture (nodeDB addDeviceMetrics) and admin hardening (toggleMutedNode, graceful PortNum default); plus the sdk-preview ConfigEditor demo and store/config tests. Build + lint + format + 131 tests green.

Author: thebentern

PR-NOTES.md

@@ -0,0 +1,65 @@
+# Protobuf catch-up to firmware-current
+
+> Draft PR description + the one decision for maintainers. This file is **untracked** —
+> use it as the PR body, then delete it (or leave it, it won't be committed).
+
+## What this does
+
+- Syncs the vendored `.proto` sources in `packages/protobufs/meshtastic/` from ~v2.7.20 to
+  **firmware-current (v2.7.25 + 48 commits)** — +2 new files (`deviceonly_legacy`, `serial_hal`)
+  and additions across `config` / `module_config` / `mesh` / `admin` / `portnums` / `telemetry`.
+- Regenerates the v2 TS bindings (`buf generate`).
+- Makes the app consume the **workspace** protobufs (`workspace:*`) instead of the stale JSR
+  `@meshtastic/protobufs@2.7.20`, finishing the monorepo migration that was half-done
+  (`@meshtastic/core` was already `workspace:*`; protobufs was still on JSR).
+- One breaking-change fix: `admin.proto` `nodedb_reset` changed `int32 → bool`, so
+  `MeshDevice.resetNodes()` now sends `value: true` (the oneof-case presence triggers the
+  reset; `true` preserves favorites through it).
+
+## Free wins (dynamic enum dropdowns — no UI code)
+
+New LoRa regions (ITU/EU amateur bands), modem presets (LONG_TURBO, LITE/NARROW/TINY_*),
+~25 hardware names, `OLED_SH1107_ROTATED`, serial `LOG`/`LOGTEXT` — they flow into the
+existing enum-bound `<select>`s automatically once the bindings regenerate.
+
+## Breaking proto changes that DON'T break us (verified)
+
+- `deviceonly.proto` `NodeInfoLite` restructure — core never imports `NodeInfoLite`.
+- `channel.proto` `is_client_muted → is_muted` + `mute` removed — neither web nor core
+  references those fields yet.
+
+## The one decision for maintainers — how to consume the protobufs
+
+This changeset takes **Option A (workspace consumption):** rename the workspace package
+`@meshtastic/protobufs-ws → @meshtastic/protobufs` (still `private`), point its `exports` at the
+TS source, and depend on it via `workspace:*` from root + core.
+
+- ✅ Monorepo is self-consuming and always firmware-current; no publish round-trip; matches
+  the already-migrated `@meshtastic/core`.
+- ⚠️ Diverges from the JSR publish flow; the published JSR `@meshtastic/protobufs`
+  (latest 2.7.23) is no longer what the app builds against.
+
+**Option B (canonical publish flow):** keep the package JSR-published — sync the `.proto`
+sources here, publish a new `@meshtastic/protobufs` to JSR, then bump the root range.
+
+- ✅ Stays on the established pipeline; one source of truth on JSR.
+- ⚠️ Needs a JSR publish, and can't reach firmware-current until that release lands
+  (JSR tops out at 2.7.23, still behind firmware).
+
+If you prefer **B**, everything except the 3 dependency-wiring edits still applies — the
+`.proto` sync, the regen, and the `nodedbReset` fix are identical; only the root dep, the core
+dep, and the protobufs `package.json` name/exports get swapped for a JSR publish + range bump.
+
+## Regenerating bindings
+
+```
+pnpm --filter @meshtastic/protobufs gen
+```
+
+Output lands in `packages/protobufs/packages/ts/dist/` (gitignored).
+
+## Verified in isolation (this branch only — no feature/demo code)
+
+- `packages/core` typecheck: clean except 2 **pre-existing** `queue.ts` strict-catch errors.
+- `packages/web` `vite build`: green.
+- 36 config/module validation tests: pass.

apps/web/package.json

@@ -38,6 +38,8 @@
     "@meshtastic/transport-web-bluetooth": "workspace:*",
     "@meshtastic/transport-web-serial": "workspace:*",
     "@noble/curves": "^1.9.2",
+    "@preact/signals-core": "^1.8.0",
+    "better-result": "^1.0.0",
     "@radix-ui/react-accordion": "^1.2.12",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-checkbox": "^1.3.3",

apps/web/public/i18n/locales/en/config.json

@@ -118,6 +118,10 @@
     "wakeOnTapOrMotion": {
       "description": "Wake the device on tap or motion",
       "label": "Wake on Tap or Motion"
+    },
+    "enableMessageBubbles": {
+      "label": "Message Bubbles",
+      "description": "Display incoming messages as bubbles on the device screen"
     }
   },
   "lora": {
@@ -198,6 +202,14 @@
     "radioSettings": {
       "label": "Radio Settings",
       "description": "Settings for the LoRa radio"
+    },
+    "femLnaMode": {
+      "label": "FEM/LNA Mode",
+      "description": "Control an external RF front-end module / low-noise amplifier (only on boards that have one)"
+    },
+    "serialHalOnly": {
+      "label": "Serial HAL Only",
+      "description": "Communicate with the radio exclusively over the serial hardware abstraction layer"
     }
   },
   "network": {

apps/web/public/i18n/locales/en/dialog.json

@@ -128,7 +128,8 @@
     "publicKey": "Public Key: ",
     "messageable": "Messageable: ",
     "KeyManuallyVerifiedTrue": "Public Key has been manually verified",
-    "KeyManuallyVerifiedFalse": "Public Key is not manually verified"
+    "KeyManuallyVerifiedFalse": "Public Key is not manually verified",
+    "verifyKey": "Verify Key"
   },
   "pkiBackup": {
     "loseKeysWarning": "If you lose your keys, you will need to reset your device.",
@@ -234,5 +235,25 @@
     "description": "This will factory reset the configuration on the connected device, erasing all configurations on the device. This cannot be undone. Are you sure you want to continue?",
     "confirm": "Factory Reset Config",
     "failedTitle": "There was an error performing the factory reset. Please try again."
+  },
+  "keyVerification": {
+    "continue": "Continue",
+    "cancel": "Cancel",
+    "inform": {
+      "title": "Key Verification",
+      "description": "Share this security number with {{name}} so they can enter it on their device:"
+    },
+    "request": {
+      "title": "Key Verification",
+      "description": "Enter the security number shown on {{name}}'s device:",
+      "placeholder": "Security number",
+      "submit": "Submit"
+    },
+    "final": {
+      "title": "Verify Key",
+      "description": "Confirm these characters match the ones shown on {{name}}'s device:",
+      "verify": "Verify",
+      "reject": "Don't Verify"
+    }
   }
 }

apps/web/public/i18n/locales/en/moduleConfig.json

@@ -11,7 +11,11 @@
     "tabRangeTest": "Range Test",
     "tabSerial": "Serial",
     "tabStoreAndForward": "S&F",
-    "tabTelemetry": "Telemetry"
+    "tabTelemetry": "Telemetry",
+    "tabRemoteHardware": "Remote Hardware",
+    "tabTrafficManagement": "Traffic Management",
+    "tabStatusMessage": "Status Message",
+    "tabTak": "TAK"
   },
   "ambientLighting": {
     "title": "Ambient Lighting Settings",
@@ -443,6 +447,102 @@
     "powerScreenEnabled": {
       "label": "Power Screen Enabled",
       "description": "Enable the Power Telemetry Screen"
+    },
+    "airQualityScreenEnabled": {
+      "label": "Air Quality Screen Enabled",
+      "description": "Show the Air Quality telemetry on the device screen"
+    }
+  },
+  "remoteHardware": {
+    "title": "Remote Hardware Settings",
+    "description": "Settings for the Remote Hardware module",
+    "enabled": {
+      "label": "Module Enabled",
+      "description": "Enable the Remote Hardware module"
+    },
+    "allowUndefinedPinAccess": {
+      "label": "Allow Undefined Pin Access",
+      "description": "Allow reading/writing GPIO pins not defined in the available pins list"
+    }
+  },
+  "statusMessage": {
+    "title": "Status Message Settings",
+    "description": "Periodically rebroadcast a short status message for this node",
+    "nodeStatus": {
+      "label": "Status Message",
+      "description": "The status string this node broadcasts on change and on a timer"
+    }
+  },
+  "tak": {
+    "title": "TAK Settings",
+    "description": "Settings for the ATAK (Team Awareness Kit) plugin module",
+    "team": {
+      "label": "Team",
+      "description": "Team color / designation reported to ATAK"
+    },
+    "role": {
+      "label": "Role",
+      "description": "Member role reported to ATAK"
+    }
+  },
+  "trafficManagement": {
+    "title": "Traffic Management Settings",
+    "description": "Packet inspection and traffic shaping to reduce channel utilization",
+    "enabled": {
+      "label": "Module Enabled",
+      "description": "Enable traffic management packet inspection and shaping"
+    },
+    "positionDedupEnabled": {
+      "label": "Position Deduplication",
+      "description": "Drop redundant position broadcasts"
+    },
+    "positionPrecisionBits": {
+      "label": "Position Precision Bits",
+      "description": "Bits of precision used for position deduplication (0-32)"
+    },
+    "positionMinIntervalSecs": {
+      "label": "Position Min Interval",
+      "description": "Minimum seconds between position updates from the same node"
+    },
+    "nodeinfoDirectResponse": {
+      "label": "NodeInfo Direct Response",
+      "description": "Answer NodeInfo requests directly from the local cache"
+    },
+    "nodeinfoDirectResponseMaxHops": {
+      "label": "NodeInfo Response Max Hops",
+      "description": "Minimum hop distance from the requester before responding to NodeInfo requests"
+    },
+    "rateLimitEnabled": {
+      "label": "Rate Limiting",
+      "description": "Throttle chatty nodes with per-node rate limiting"
+    },
+    "rateLimitWindowSecs": {
+      "label": "Rate Limit Window",
+      "description": "Time window in seconds for rate-limit calculations"
+    },
+    "rateLimitMaxPackets": {
+      "label": "Rate Limit Max Packets",
+      "description": "Maximum packets allowed per node within the rate-limit window"
+    },
+    "dropUnknownEnabled": {
+      "label": "Drop Unknown Packets",
+      "description": "Drop undecryptable packets per rate-limit window"
+    },
+    "unknownPacketThreshold": {
+      "label": "Unknown Packet Threshold",
+      "description": "Number of unknown packets before dropping from a node"
+    },
+    "exhaustHopTelemetry": {
+      "label": "Exhaust Hop (Telemetry)",
+      "description": "Set hop limit to 0 for relayed telemetry broadcasts"
+    },
+    "exhaustHopPosition": {
+      "label": "Exhaust Hop (Position)",
+      "description": "Set hop limit to 0 for relayed position broadcasts"
+    },
+    "routerPreserveHops": {
+      "label": "Preserve Router Hops",
+      "description": "Preserve hop limit for router-to-router traffic"
     }
   }
 }