feat(cli): stream — a film or a song played in a media player

`meshbay-cli stream PATH` serves one video or sound file over HTTP on
127.0.0.1 for VLC, mpv or any player that reads HTTP; `--player PROGRAM`
starts the player, and closing it stops the stream, as Ctrl+C does.

The file goes as the node stores it: no remux, no transcode, no stream
slot on the node. Byte ranges are answered from leaseless file_req chunks
decrypted in memory, eight ahead and the last 24 kept. Loopback only, a
random token in the address, a foreign Host refused (DNS rebinding), an
audio or video type with nosniff. The connection is pinged and reopened
when it dies; a refusal by the node stops the stream (exit 5).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 28 insertions, 0 deletions

diff --git a/packages/meshbay-cli/tests/test_cli_actions.py b/packages/meshbay-cli/tests/test_cli_actions.py
index 240ac67..bcbe0c4 100644
--- a/packages/meshbay-cli/tests/test_cli_actions.py
+++ b/packages/meshbay-cli/tests/test_cli_actions.py
@@ -8,6 +8,8 @@ to the parser without a run below.
 
 import io
 import json
+import os
+import sys
 
 import pytest
 from fake_hub import PASSPHRASE, USERNAME, FakeHub
@@ -568,6 +570,32 @@ def test_chat_reads_the_last_messages_and_posts(node, monkeypatch, capsys):
     assert main("chat", "-0", "Family") == 1
 
 
+def test_stream_serves_a_film_to_the_player_it_starts(node, tmp_path, monkeypatch, capsys):
+    from meshbay_cli.commands import stream
+
+    async def open_group(account, group):
+        return node.session()
+    monkeypatch.setattr(stream, "open_group", open_group)
+    film = os.urandom(1024 * 1024 + 7)
+    node.add("share/films", "Night Drive.mkv", film)["type"] = "video"
+    node.add("share", "notes.txt", b"hello")
+
+    assert main("stream", "Family/share/notes.txt") == 1
+    assert "not a video or a sound file" in capsys.readouterr().err
+    if sys.platform == "win32":
+        return                                  # a script is not a program there
+    played = tmp_path / "played"
+    player = tmp_path / "player"
+    player.write_text(f"#!{sys.executable}\nimport sys, urllib.request\n"
+                      "opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))\n"
+                      f"open({str(played)!r}, 'wb').write(opener.open(sys.argv[1]).read())\n")
+    player.chmod(0o755)
+    assert main("stream", "--player", str(player), "Family/share/films/Night Drive.mkv") == 0
+    assert played.read_bytes() == film
+    out = capsys.readouterr()
+    assert out.out.startswith("http://127.0.0.1:") and "player was closed" in out.err
+
+
 def test_every_action_is_run_here():
     """Runs last in this module: every action the parser knows was run above."""
     assert RUN == set(cli.ACTIONS), f"never run: {set(cli.ACTIONS) - RUN}"