fix(node): read the packaged TMDB token in place

A node onboarded by the desktop client never ran `init`, so default.env was
never copied to node.env; and default.env was 0600 root, unreadable to a
per-user node anyway. The daemon now loads it beneath node.env, 0644.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

6 files changed, 69 insertions, 84 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/cli/setup.py b/packages/meshbay-node/src/meshbay_node/cli/setup.py
index b2a8e83..48a55ef 100644
--- a/packages/meshbay-node/src/meshbay_node/cli/setup.py
+++ b/packages/meshbay-node/src/meshbay_node/cli/setup.py
@@ -33,11 +33,6 @@ def init(args) -> None:
     cfg_dir = cfg_path.parent
     cfg_dir.mkdir(parents=True, exist_ok=True)
 
-    from meshbay_node.platform import install_node_env
-    env_written = install_node_env(cfg_dir)
-    if env_written:
-        print(f"Wrote {env_written} (packaged defaults).")
-
     hub_url = args.hub_url
     username = args.username
 
diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py
index 7e840ad..7db251b 100644
--- a/packages/meshbay-node/src/meshbay_node/platform.py
+++ b/packages/meshbay-node/src/meshbay_node/platform.py
@@ -80,9 +80,10 @@ def state_dir() -> Path:
 def packaged_default_env() -> Path | None:
     """
     The `default.env` shipped with the package: build-time defaults, currently
-    the shared read-only TMDB token. `init` copies it to config_dir()/node.env
-    and nothing reads it in place, so an operator's edits to their own copy
-    survive an upgrade.
+    the shared read-only TMDB token. The daemon reads it in place, beneath
+    <config>/node.env, so it reaches every node however that node was set up --
+    `meshbay-node init` and the desktop client's onboarding alike -- and an
+    operator's own node.env still wins.
 
     Frozen (PyInstaller/Windows): beside the executable, where
     build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg.
@@ -102,39 +103,7 @@ def packaged_default_env() -> Path | None:
     return None
 
 
-def install_node_env(target_dir: Path) -> Path | None:
-    """
-    Copy the packaged default.env to <target_dir>/node.env, once, at init.
-
-    Never overwrites: an existing node.env holds the operator's own values, and
-    silently replacing a configured token with the packaged one would be worse
-    than doing nothing. Returns the path when written, None when there was
-    nothing to copy or a file was already there.
-    """
-    src = packaged_default_env()
-    if src is None:
-        return None
-    dest = target_dir / "node.env"
-    if dest.exists():
-        return None
-    dest.write_bytes(src.read_bytes())
-    chmod_private(dest)
-    return dest
-
-
-def load_node_env(source_dir: Path) -> int:
-    """
-    Read <source_dir>/node.env into os.environ, returning how many names were
-    set.
-
-    systemd does this on Linux through `EnvironmentFile=`, but the Windows
-    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
-    the file itself and both platforms behave the same. An existing environment
-    variable always wins -- an operator exporting a value, or systemd having
-    already loaded the same file, overrides the packaged default rather than
-    being overridden by it.
-    """
-    path = source_dir / "node.env"
+def _load_env_file(path: Path) -> int:
     try:
         text = path.read_text(encoding="utf-8")
     except (OSError, UnicodeDecodeError):
@@ -154,6 +123,29 @@ def load_node_env(source_dir: Path) -> int:
     return count
 
 
+def load_node_env(source_dir: Path) -> int:
+    """
+    Read <source_dir>/node.env, then the packaged default.env, into
+    os.environ, returning how many names were set.
+
+    systemd does the first through `EnvironmentFile=`, but the Windows
+    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
+    the file itself and both platforms behave the same. An existing environment
+    variable always wins, and node.env wins over the packaged default -- an
+    operator exporting a value, or systemd having already loaded the same file,
+    overrides the packaged default rather than being overridden by it.
+
+    The packaged default used to reach a node only as a copy made by
+    `meshbay-node init`; a node onboarded by the desktop client never ran it and
+    ran with no TMDB token at all.
+    """
+    count = _load_env_file(source_dir / "node.env")
+    packaged = packaged_default_env()
+    if packaged is not None:
+        count += _load_env_file(packaged)
+    return count
+
+
 # ── File permissions ─────────────────────────────────────────────────────────
 
 
diff --git a/packages/meshbay-node/tests/test_platform.py b/packages/meshbay-node/tests/test_platform.py
index 5c80c5b..bebe8d9 100644
--- a/packages/meshbay-node/tests/test_platform.py
+++ b/packages/meshbay-node/tests/test_platform.py
@@ -427,39 +427,8 @@ def test_source_checkout_has_no_packaged_default(monkeypatch, tmp_path):
     assert plat.packaged_default_env() is None
 
 
-def test_install_node_env_copies_once(monkeypatch, tmp_path):
-    src = tmp_path / "default.env"
-    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfirst\n")
-    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
-    cfg = tmp_path / "config"
-    cfg.mkdir()
-
-    written = plat.install_node_env(cfg)
-    assert written == cfg / "node.env"
-    assert "eyJfirst" in written.read_text()
-
-
-def test_install_node_env_never_overwrites_operator_values(monkeypatch, tmp_path):
-    """An existing node.env holds the operator's own token; clobbering it would
-    silently downgrade a configured node to the shared default."""
-    src = tmp_path / "default.env"
-    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n")
-    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
-    cfg = tmp_path / "config"
-    cfg.mkdir()
-    (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n")
-
-    assert plat.install_node_env(cfg) is None
-    assert "eyJoperator" in (cfg / "node.env").read_text()
-
-
-def test_install_node_env_is_a_noop_without_a_package(monkeypatch, tmp_path):
-    monkeypatch.setattr(plat, "packaged_default_env", lambda: None)
-    assert plat.install_node_env(tmp_path) is None
-    assert not (tmp_path / "node.env").exists()
-
-
 def test_load_node_env_sets_names(monkeypatch, tmp_path):
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: None)
     (tmp_path / "node.env").write_text(
         "# a comment\n"
         "\n"
@@ -482,5 +451,33 @@ def test_load_node_env_does_not_override_the_environment(monkeypatch, tmp_path):
     assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJfromenv"
 
 
-def test_load_node_env_tolerates_a_missing_file(tmp_path):
+def test_load_node_env_tolerates_a_missing_file(monkeypatch, tmp_path):
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: None)
     assert plat.load_node_env(tmp_path) == 0
+
+
+def test_load_node_env_reads_the_packaged_default_without_a_node_env(monkeypatch, tmp_path):
+    """A node onboarded by the desktop client has no node.env: nothing ran
+    `init` to copy one. The packaged token must reach it anyway."""
+    src = tmp_path / "default.env"
+    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n")
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
+    monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False)
+    cfg = tmp_path / "config"
+    cfg.mkdir()
+
+    assert plat.load_node_env(cfg) == 1
+    assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJpackaged"
+
+
+def test_load_node_env_prefers_the_operator_node_env(monkeypatch, tmp_path):
+    src = tmp_path / "default.env"
+    src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n")
+    monkeypatch.setattr(plat, "packaged_default_env", lambda: src)
+    monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False)
+    cfg = tmp_path / "config"
+    cfg.mkdir()
+    (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n")
+
+    plat.load_node_env(cfg)
+    assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJoperator"
diff --git a/packaging/README.md b/packaging/README.md
index b65d0ed..6081fc7 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -95,7 +95,7 @@ no key-generation step to run by hand.
 ## Post-install (node)
 
 ```bash
-meshbay-node init                   # copies default.env (with TMDB token)
+meshbay-node init
 nano ~/.config/meshbay/node.toml
 systemctl --user enable --now meshbay-node
 ```
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
index 8970176..fde67a5 100755
--- a/packaging/build/build-node.sh
+++ b/packaging/build/build-node.sh
@@ -45,8 +45,10 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node"
 # --- Node-specific assets -------------------------------------------------
 mkdir -p "$ROOT/opt/meshbay-node/share"
 
-# Default env with the shared TMDB token, read at build time and copied to
-# <config>/node.env by `meshbay-node init`.
+# Default env with the shared TMDB token, read at build time. The daemon reads
+# it in place, beneath <config>/node.env, so it must be readable by whoever runs
+# the node -- 0600 root made it unreadable to every per-user node. It is the
+# same token in every copy of the package, so 0644 hides nothing.
 #
 # tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token*
 # (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same
@@ -72,13 +74,12 @@ fi
 if [ -n "$TMDB_TOKEN" ]; then
     cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF
 # Default environment for meshbay-node.
-# Copied to <config>/node.env by 'meshbay-node init' if it does not exist.
-# The operator may override any value there or in the systemd EnvironmentFile.
+# Read by the daemon beneath <config>/node.env; set a value there to override it.
 
 # TMDB API token for the Videos app (read-only, shared across installations)
 MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN
 EOF
-    chmod 600 "$ROOT/opt/meshbay-node/share/default.env"
+    chmod 644 "$ROOT/opt/meshbay-node/share/default.env"
     echo "    TMDB token baked into default.env (${#TMDB_TOKEN} chars)"
 elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then
     echo "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2
diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1
index 20eacc8..28c4061 100644
--- a/packaging/win/build-node-runtime.ps1
+++ b/packaging/win/build-node-runtime.ps1
@@ -120,9 +120,9 @@ else {
 
 # --- 5. default.env (shared TMDB token) ------------------------------
 # Beside the exe, where platform.packaged_default_env() looks for it, and the
-# same placement ffmpeg gets above. `meshbay-node init` copies it to
-# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself:
-# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile.
+# same placement ffmpeg gets above. The daemon reads it in place, beneath
+# %LOCALAPPDATA%\meshbay\node.env: Windows autostart is a Startup-folder .vbs,
+# with no systemd EnvironmentFile.
 function Get-TmdbToken([string]$File) {
     if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" }
     $lines = Get-Content -LiteralPath $File
@@ -149,7 +149,7 @@ $noBom = New-Object System.Text.UTF8Encoding $false   # a BOM would break parsin
 if ($tmdb) {
     $body = @(
         "# Default environment for meshbay-node.",
-        "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.",
+        "# Read by the daemon beneath <config>\node.env; set a value there to override it.",
         "",
         "# TMDB API token for the Videos app (read-only, shared across installations)",
         "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb"