[ralyodio]

Anthony: "smshub could have a group management feature. that would be good. build that too." (and group.call can optionally send its group texts through it).

• Migration 021_contact_groups.sql (applied on dev2 before merge): contact_groups (name, description, from number, relay, external_ref unique per user) + contact_group_members (contact, opted_out), RLS owner-only.
• src/lib/groups.ts: list/get/save (upsert by external_ref, members replaced)/update/delete, add/remove members, sendToGroup (each member from your own number, filed in the inbox, STOPped skipped, one group send = one against 10/min, 200 members max), onGroupInbound from recordInbound: STOP/START per member, and relay groups pass a member's text to the rest ("Kim: ...").
• sendMessage refactored into sendFromNumber (shared single-text path, no rate limit) so group sends reuse the inbox filing.
• API /api/v1/groups (+ /{id}, /members, /members/{member}, /send), in developer-api.ts (docs, llms.txt, openapi). MCP list_groups/get_group/save_group/add_group_members/send_to_group. CLI 1.8.0 groups / group create|add|remove|send|relay|rm (repeatable --member). Dashboard /groups + Groups tab.

Checks: 322/322 tests (2 new), tsc, lint, next build; lib exercised against the live DB as riotcoder+smshub (create, upsert by ref, add/remove, STOP, refusal without an own number, cross-user 404, delete; test contacts removed).

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 6

Severity	Rule	Location
HIGH	sh-unquoted-expansion-destructive	public/install.sh:67
HIGH	sh-remote-script-execution	public/install.sh:89
MEDIUM	sh-remote-script-execution	public/install.sh:133
MEDIUM	js-open-redirect	src/app/numbers/page.tsx:180
MEDIUM	js-open-redirect	src/components/inbox-client.tsx:35
MEDIUM	js-unescaped-html-sink	src/components/pit-footer.tsx:17
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:24
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:46
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:60
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:78
LOW	secret-generic-credential	supabase/config.toml:287
LOW	secret-generic-credential	supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.