fix(packaging): actually ship the TMDB token, on Linux and Windows

default.env was empty in every build, for three independent reasons:

1. build-node.sh read QE/node.env, which does not exist. Even pointed at the
   real file it would have failed: its `grep MESHBAY_TMDB_DEFAULT_TOKEN=`
   cannot match QE/tmdb.txt, which is a free-form note, not KEY=VALUE.

2. Nothing consumed default.env. packaging/README.md and build-node.sh both
   claimed `meshbay-node init` copies it to <config>/node.env; grep found the
   name in exactly two places, the README and the script that writes it. No
   code implemented the copy, and `EnvironmentFile=-` hid the absence.

3. build-win.ps1 had no env handling at all, so Windows was empty for a
   different reason than Linux.

Now: the build extracts the v4 read token -- tmdb.py sends `Authorization:
Bearer`, so it is the JWT, not the 32-char v3 key beside it in the same file --
matching KEY=VALUE first and then by shape, from MESHBAY_TMDB_TOKEN,
MESHBAY_TMDB_TOKEN_FILE, QE/node.env, QE/tmdb.txt. It writes default.env 0600
and *fails the build* if no token resolves; MESHBAY_ALLOW_NO_TMDB=1 opts out.
An empty default.env is invisible until a user opens Videos and finds no
metadata, which is how this shipped empty on two platforms at once.

platform.py gains packaged_default_env()/install_node_env()/load_node_env().
init copies the packaged file once, never overwriting an existing node.env,
and the daemon loads node.env itself at startup: systemd does this on Linux
via EnvironmentFile, but Windows autostart is a Startup-folder .vbs with no
equivalent. Already-set variables always win.

Also fixes an UnboundLocalError in main(): `config_dir` was assigned at the
top of the init branch, which made it function-local for all of main(), while
the reset branch calls `config_dir()` as the imported function. init returns
before that line, so `meshbay-node reset` could only ever raise. The local is
now cfg_dir.

Verified end to end on Linux: token baked (239 chars), init writes
<config>/node.env 0600 with it. The PowerShell half is written but unrun --
no pwsh on this machine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DtfG7z6wHWj8RKHCvxQtY1

5 files changed, 263 insertions, 17 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index b5a249d..37a2472 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -1634,9 +1634,15 @@ def _systemctl_user(verb: str, unit: str, *, not_running_hint: str,
 def main() -> None:
     import argparse
 
-    from meshbay_node.platform import configure_event_loop, force_utf8_stdio
+    from meshbay_node.platform import (configure_event_loop, force_utf8_stdio,
+                                        load_node_env)
     force_utf8_stdio()
     configure_event_loop()
+    # Before anything reads the environment. On Linux systemd has usually loaded
+    # the same file already via EnvironmentFile=; this is what makes a Windows
+    # run (Startup-folder .vbs, no systemd) and a bare `meshbay-node` behave the
+    # same. Already-set variables are left alone, so it cannot undo either.
+    load_node_env(config_dir())
 
     parser = argparse.ArgumentParser(description="MeshBay Node daemon")
     parser.add_argument("command", nargs="?",
@@ -1698,8 +1704,13 @@ def main() -> None:
 
     if args.command == "init":
         cfg_path = args.config or DEFAULT_CONFIG_PATH
-        config_dir = cfg_path.parent
-        config_dir.mkdir(parents=True, exist_ok=True)
+        cfg_dir = cfg_path.parent
+        cfg_dir.mkdir(parents=True, exist_ok=True)
+
+        from meshbay_node.platform import install_node_env
+        env_written = install_node_env(cfg_dir)
+        if env_written:
+            print(f"Wrote {env_written} (packaged defaults).")
 
         hub_url = args.hub_url
         username = args.username
@@ -1731,7 +1742,7 @@ def main() -> None:
             else:
                 print(f"Config already exists: {cfg_path}")
         else:
-            unlock_file = config_dir / "unlock.key"
+            unlock_file = cfg_dir / "unlock.key"
             toml_lines = [
                 "[hub]",
                 f'url      = "{hub_url}"',
@@ -1752,7 +1763,7 @@ def main() -> None:
             chmod_private(cfg_path)
             print(f"Config written to {cfg_path}")
 
-        unlock_file = config_dir / "unlock.key"
+        unlock_file = cfg_dir / "unlock.key"
         if not unlock_file.exists():
             import secrets
             key = secrets.token_urlsafe(32)
diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py
index b59418f..3c160a1 100644
--- a/packages/meshbay-node/src/meshbay_node/platform.py
+++ b/packages/meshbay-node/src/meshbay_node/platform.py
@@ -68,6 +68,86 @@ def state_dir() -> Path:
     return Path.home() / ".local" / "state" / "meshbay"
 
 
+# ── Packaged defaults ────────────────────────────────────────────────────────
+
+
+def packaged_default_env() -> Path | None:
+    """
+    The `default.env` shipped with the package: build-time defaults, currently
+    the shared read-only TMDB token. `init` copies it to config_dir()/node.env
+    and nothing reads it in place, so an operator's edits to their own copy
+    survive an upgrade.
+
+    Frozen (PyInstaller/Windows): beside the executable, where
+    build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg.
+    Packaged (Linux): /opt/meshbay-node/share/default.env, from build-node.sh.
+    None in a source checkout, where no package wrote one.
+    """
+    candidates = []
+    if getattr(sys, "frozen", False):
+        candidates.append(Path(sys.executable).parent / "default.env")
+    candidates.append(Path("/opt/meshbay-node/share/default.env"))
+    for path in candidates:
+        try:
+            if path.is_file():
+                return path
+        except OSError:
+            continue
+    return None
+
+
+def install_node_env(target_dir: Path) -> Path | None:
+    """
+    Copy the packaged default.env to <target_dir>/node.env, once, at init.
+
+    Never overwrites: an existing node.env holds the operator's own values, and
+    silently replacing a configured token with the packaged one would be worse
+    than doing nothing. Returns the path when written, None when there was
+    nothing to copy or a file was already there.
+    """
+    src = packaged_default_env()
+    if src is None:
+        return None
+    dest = target_dir / "node.env"
+    if dest.exists():
+        return None
+    dest.write_bytes(src.read_bytes())
+    chmod_private(dest)
+    return dest
+
+
+def load_node_env(source_dir: Path) -> int:
+    """
+    Read <source_dir>/node.env into os.environ, returning how many names were
+    set.
+
+    systemd does this on Linux through `EnvironmentFile=`, but the Windows
+    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
+    the file itself and both platforms behave the same. An existing environment
+    variable always wins -- an operator exporting a value, or systemd having
+    already loaded the same file, overrides the packaged default rather than
+    being overridden by it.
+    """
+    path = source_dir / "node.env"
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return 0
+    count = 0
+    for line in text.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        name, _, value = line.partition("=")
+        name = name.strip()
+        value = value.strip().strip('"').strip("'")
+        if not name or name in os.environ:
+            continue
+        os.environ[name] = value
+        count += 1
+    return count
+
+
 # ── File permissions ─────────────────────────────────────────────────────────
 
 
diff --git a/packages/meshbay-node/tests/test_platform.py b/packages/meshbay-node/tests/test_platform.py
index f9464c3..7042afb 100644
--- a/packages/meshbay-node/tests/test_platform.py
+++ b/packages/meshbay-node/tests/test_platform.py
@@ -5,6 +5,7 @@ here by monkeypatching that (and `os.environ`) rather than only on the OS the
 suite happens to run on.
 """
 
+import os
 import asyncio
 import sys
 from pathlib import Path
@@ -177,3 +178,82 @@ def test_autostart_run_refuses_off_windows(monkeypatch):
     monkeypatch.setattr(sys, "platform", "linux")
     with pytest.raises(RuntimeError, match="Windows-only"):
         plat.autostart_run()
+
+
+# ── Packaged defaults ────────────────────────────────────────────────────────
+
+def test_frozen_build_finds_default_env_beside_the_executable(monkeypatch, tmp_path):
+    """Where build-node-runtime.ps1 puts it, alongside ffmpeg."""
+    exe = tmp_path / "meshbay-node.exe"
+    exe.write_bytes(b"")
+    (tmp_path / "default.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJtest\n")
+    monkeypatch.setattr(sys, "frozen", True, raising=False)
+    monkeypatch.setattr(sys, "executable", str(exe))
+    assert plat.packaged_default_env() == tmp_path / "default.env"
+
+
+def test_source_checkout_has_no_packaged_default(monkeypatch, tmp_path):
+    monkeypatch.setattr(sys, "frozen", False, raising=False)
+    monkeypatch.setattr(sys, "executable", str(tmp_path / "python"))
+    monkeypatch.setattr(plat, "Path", Path)
+    # /opt/meshbay-node/share/default.env is absent on a dev machine
+    assert plat.packaged_default_env() is None
+
+
+def test_install_node_env_copies_once(monkeypatch, tmp_path):
+    src = tmp_path / "default.env"
+    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfirst\n")
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
+    cfg = tmp_path / "config"
+    cfg.mkdir()
+
+    written = plat.install_node_env(cfg)
+    assert written == cfg / "node.env"
+    assert "eyJfirst" in written.read_text()
+
+
+def test_install_node_env_never_overwrites_operator_values(monkeypatch, tmp_path):
+    """An existing node.env holds the operator's own token; clobbering it would
+    silently downgrade a configured node to the shared default."""
+    src = tmp_path / "default.env"
+    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n")
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
+    cfg = tmp_path / "config"
+    cfg.mkdir()
+    (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n")
+
+    assert plat.install_node_env(cfg) is None
+    assert "eyJoperator" in (cfg / "node.env").read_text()
+
+
+def test_install_node_env_is_a_noop_without_a_package(monkeypatch, tmp_path):
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: None)
+    assert plat.install_node_env(tmp_path) is None
+    assert not (tmp_path / "node.env").exists()
+
+
+def test_load_node_env_sets_names(monkeypatch, tmp_path):
+    (tmp_path / "node.env").write_text(
+        "# a comment\n"
+        "\n"
+        "MESHBAY_TMDB_DEFAULT_TOKEN=eyJloaded\n"
+        'QUOTED="value"\n'
+    )
+    monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False)
+    monkeypatch.delenv("QUOTED", raising=False)
+    assert plat.load_node_env(tmp_path) == 2
+    assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJloaded"
+    assert os.environ["QUOTED"] == "value"
+
+
+def test_load_node_env_does_not_override_the_environment(monkeypatch, tmp_path):
+    """systemd may have loaded the same file already, and an operator export
+    must win over a packaged default."""
+    (tmp_path / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfromfile\n")
+    monkeypatch.setenv("MESHBAY_TMDB_DEFAULT_TOKEN", "eyJfromenv")
+    assert plat.load_node_env(tmp_path) == 0
+    assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJfromenv"
+
+
+def test_load_node_env_tolerates_a_missing_file(tmp_path):
+    assert plat.load_node_env(tmp_path) == 0
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
index bd81096..8970176 100755
--- a/packaging/build/build-node.sh
+++ b/packaging/build/build-node.sh
@@ -45,26 +45,53 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node"
 # --- Node-specific assets -------------------------------------------------
 mkdir -p "$ROOT/opt/meshbay-node/share"
 
-# Default env with TMDB token (read at build time).
-# Override with MESHBAY_TMDB_TOKEN_FILE; falls back to QE/node.env (gitignored).
-TMDB_TOKEN_FILE="${MESHBAY_TMDB_TOKEN_FILE:-$REPO/QE/node.env}"
-TMDB_TOKEN=""
-if [ -f "$TMDB_TOKEN_FILE" ]; then
-    TMDB_TOKEN=$(grep -oP 'MESHBAY_TMDB_DEFAULT_TOKEN=\K.*' "$TMDB_TOKEN_FILE" || true)
+# Default env with the shared TMDB token, read at build time and copied to
+# <config>/node.env by `meshbay-node init`.
+#
+# tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token*
+# (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same
+# note file. Sources, in order: an explicit variable, an explicit file, the
+# KEY=VALUE form, then QE/tmdb.txt -- which is free-form prose, so the token is
+# matched by shape rather than by a label.
+extract_tmdb_token() {
+    local file="$1" tok=""
+    [ -f "$file" ] || return 0
+    tok=$(sed -n 's/^[[:space:]]*MESHBAY_TMDB_DEFAULT_TOKEN[[:space:]]*=[[:space:]]*//p' \
+          "$file" | head -1)
+    [ -n "$tok" ] || tok=$(grep -oE '^eyJ[A-Za-z0-9._-]{40,}$' "$file" | head -1 || true)
+    printf '%s' "$tok" | tr -d '"'"'"'\r'
+}
+
+TMDB_TOKEN="${MESHBAY_TMDB_TOKEN:-}"
+if [ -z "$TMDB_TOKEN" ] && [ -n "${MESHBAY_TMDB_TOKEN_FILE:-}" ]; then
+    TMDB_TOKEN=$(extract_tmdb_token "$MESHBAY_TMDB_TOKEN_FILE")
 fi
+[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/node.env")
+[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/tmdb.txt")
+
 if [ -n "$TMDB_TOKEN" ]; then
     cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF
 # Default environment for meshbay-node.
-# Copied to ~/.config/meshbay/node.env by 'meshbay-node init' if it does not exist.
+# Copied to <config>/node.env by 'meshbay-node init' if it does not exist.
 # The operator may override any value there or in the systemd EnvironmentFile.
 
 # TMDB API token for the Videos app (read-only, shared across installations)
 MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN
 EOF
-    echo "    TMDB token baked into default.env"
+    chmod 600 "$ROOT/opt/meshbay-node/share/default.env"
+    echo "    TMDB token baked into default.env (${#TMDB_TOKEN} chars)"
+elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then
+    echo "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2
+    : > "$ROOT/opt/meshbay-node/share/default.env"
 else
-    echo "    !! TMDB token not found in QE/node.env — default.env will be empty" >&2
-    touch "$ROOT/opt/meshbay-node/share/default.env"
+    # Failing here is deliberate: an empty default.env is invisible until a user
+    # opens the Videos app and finds no metadata, which is exactly how this
+    # shipped empty on two platforms at once.
+    echo "!! TMDB token not found. Looked at:" >&2
+    echo "     \$MESHBAY_TMDB_TOKEN, \$MESHBAY_TMDB_TOKEN_FILE," >&2
+    echo "     $REPO/QE/node.env, $REPO/QE/tmdb.txt" >&2
+    echo "   Set MESHBAY_ALLOW_NO_TMDB=1 to build without it." >&2
+    exit 1
 fi
 
 # --- Systemd units --------------------------------------------------------
diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1
index c432e01..5097b37 100644
--- a/packaging/win/build-node-runtime.ps1
+++ b/packaging/win/build-node-runtime.ps1
@@ -117,14 +117,62 @@ else {
     Write-Host "    ffmpeg not bundled -- the node will look for it on PATH" -ForegroundColor Yellow
 }
 
-# --- 5. publish ----------------------------------------------------
+# --- 5. default.env (shared TMDB token) ------------------------------
+# Beside the exe, where platform.packaged_default_env() looks for it, and the
+# same placement ffmpeg gets above. `meshbay-node init` copies it to
+# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself:
+# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile.
+function Get-TmdbToken([string]$File) {
+    if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" }
+    $lines = Get-Content -LiteralPath $File
+    foreach ($line in $lines) {
+        if ($line -match '^\s*MESHBAY_TMDB_DEFAULT_TOKEN\s*=\s*(.+)$') {
+            return $Matches[1].Trim().Trim('"').Trim("'")
+        }
+    }
+    # QE\tmdb.txt is free-form prose: match the v4 read token by shape. The
+    # 32-char v3 API key in the same file is NOT what tmdb.py sends (Bearer).
+    foreach ($line in $lines) {
+        if ($line -match '^(eyJ[A-Za-z0-9._-]{40,})\s*$') { return $Matches[1] }
+    }
+    return ""
+}
+
+$tmdb = $env:MESHBAY_TMDB_TOKEN
+if (-not $tmdb) { $tmdb = Get-TmdbToken $env:MESHBAY_TMDB_TOKEN_FILE }
+if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\node.env") }
+if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\tmdb.txt") }
+
+$envFile = Join-Path $frozen "default.env"
+$noBom = New-Object System.Text.UTF8Encoding $false   # a BOM would break parsing
+if ($tmdb) {
+    $body = @(
+        "# Default environment for meshbay-node.",
+        "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.",
+        "",
+        "# TMDB API token for the Videos app (read-only, shared across installations)",
+        "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb"
+    ) -join "`n"
+    [System.IO.File]::WriteAllText($envFile, $body + "`n", $noBom)
+    Step ("TMDB token baked into default.env ({0} chars)" -f $tmdb.Length)
+}
+elseif ($env:MESHBAY_ALLOW_NO_TMDB -eq "1") {
+    [System.IO.File]::WriteAllText($envFile, "", $noBom)
+    Write-Host "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" -ForegroundColor Yellow
+}
+else {
+    throw ("TMDB token not found (MESHBAY_TMDB_TOKEN, MESHBAY_TMDB_TOKEN_FILE, " +
+           "QE\node.env, QE\tmdb.txt). Set MESHBAY_ALLOW_NO_TMDB=1 to build without it.")
+}
+
+# --- 6. publish ----------------------------------------------------
 Move-Item $frozen $OutDir
 Remove-Item -Recurse -Force $pyiWork, $pyiDist -ErrorAction SilentlyContinue
 if ($createdVenv -and -not $KeepBuildVenv) {
     Remove-Item -Recurse -Force $BuildVenv -ErrorAction SilentlyContinue
 }
 
-# --- 6. smoke test -----------------------------------------------
+# --- 7. smoke test -----------------------------------------------
 # Capture, do NOT pipe to Select-Object -First: that stops the native process
 # mid-write and reports a spurious non-zero exit.
 Step "smoke test: meshbay-node --help"