feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/packages/meshbay-cli/tests/test_selftest.py b/packages/meshbay-cli/tests/test_selftest.py
new file mode 100644
index 0000000..ea49fa1
--- /dev/null
+++ b/packages/meshbay-cli/tests/test_selftest.py
@@ -0,0 +1,16 @@
+"""The frozen build's self-test, run here from source so it cannot rot unseen."""
+
+from meshbay_cli import __main__ as cli
+
+
+def test_the_self_test_passes_from_source(monkeypatch, tmp_path, capsys):
+    monkeypatch.setenv("MESHBAY_CLI_SELFTEST", "1")
+    monkeypatch.setenv("MESHBAY_CLI_HOME", str(tmp_path))    # restored after
+    assert cli.main([]) == 0
+    assert "self-test ok" in capsys.readouterr().out
+
+
+def test_it_is_not_reachable_with_arguments(monkeypatch, capsys):
+    monkeypatch.setenv("MESHBAY_CLI_SELFTEST", "1")
+    assert cli.main(["--version"]) == 0
+    assert "self-test" not in capsys.readouterr().out