feat(client): the platform seam, and an Electron shell that has never been run

Stage D, and the honest half of it.

D1 — the seam (done, and verified)
----------------------------------
`static/platform.js`. `HUB` becomes `platform.hubBase()` and the transport is
built with the same base, so one address has one source. In a browser it returns
'' and every path stays relative to the origin that served the page — the
acceptance criterion for this split was "the browser SPA behaves identically",
and it does. `platform.js` joins `_ASSETS`, or a change to it would not move the
content hash and a cached browser would never ask for it.

D2 — the shell (written, never launched)
-----------------------------------------
**There is no npm on this machine. Electron was never installed and
`packages/meshbay-client/` has not been run once.** That is stated here rather
than discovered later.

What is there: a main process serving the packaged interface over a privileged
`app://` scheme (`secure` and `standard` are not cosmetic — without them the
service worker refuses to register and streamed downloads break silently), a
preload exposing an enumerated bridge that never passes a filesystem path, a
window with `sandbox`, `contextIsolation` and no node integration, navigation
away from the package refused, and a CSP where the hub is reachable over
connect-src and is not a script source. The hub address arrives as a process
argument because `platform.hubBase()` runs before anything can await.

`test_desktop_shell.py` pins each of those by reading the source — the treatment
`test_downloads.py` already gives the three browser save paths. It catches a
property being removed and proves nothing about the application running. Two
were checked by breaking them.

The interface is *copied* into the package by `build/sync-ui.js` from the hub's
static directory, and `ui/` is gitignored: a silent fork is the only real way to
end up maintaining the interface twice.

D3 — partial
------------
The bridge, and the part worth having now: safeStorage's backend is reported
rather than assumed. On Linux it falls back to a fixed key when no keyring is
running, silently — someone who believes the OS is holding their keys is told
when it is not. The native key lifecycle belongs with D4 and needs a running
application to mean anything.

D8 — partial, and a real defect found
--------------------------------------
`meshbay-node.spec` installed the SYSTEM template — the one carrying `User=%i` —
into `%{_userunitdir}`. A user unit already runs as its owner and cannot carry
`User=`; systemd refuses the file, so the packaged unit could never have
started. Nothing noticed because nobody had built and installed the RPM.

Two units now: the template to `%{_unitdir}`, and a new `meshbay-node-user.service`
that a person enables themselves without a password — which is what lets the
desktop client install a node without asking for one. It carries ExecReload, so
`meshbay-node reload` does not have to stop a service somebody is streaming from,
and documents the drop-in for a drive outside the home, RequiresMountsFor
included.

798 tests pass; e2e.py still passes end to end. Nothing here was built or
launched: no npm, no rpmbuild.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 66 insertions, 0 deletions

diff --git a/packages/meshbay-client/src/preload.js b/packages/meshbay-client/src/preload.js
new file mode 100644
index 0000000..9c273e2
--- /dev/null
+++ b/packages/meshbay-client/src/preload.js
@@ -0,0 +1,66 @@
+/**
+ * The bridge, and the whole of it.
+ *
+ * `contextIsolation` puts this in its own world, so what is exposed here is all
+ * the page can reach — page script cannot read the closure, cannot replace
+ * these functions for other code, and cannot call an IPC channel that is not
+ * named below. That is what makes the enumeration meaningful rather than
+ * decorative.
+ *
+ * The rule for anything added here: **the renderer never names a path, a file
+ * handle or a process.** It asks for a dialog and receives an opaque id. The
+ * renderer parses decrypted content from nodes — video, images, filenames —
+ * which is attacker-controlled input, so it is treated as hostile even though
+ * it is our own code.
+ */
+
+'use strict';
+
+const { contextBridge, ipcRenderer } = require('electron');
+
+const HUB_BASE = (process.argv.find(a => a.startsWith('--meshbay-hub=')) || '')
+  .slice('--meshbay-hub='.length);
+
+contextBridge.exposeInMainWorld('meshbay', {
+  // Where the hub is. The interface prefixes every API path with this; in a
+  // browser the same function returns '' and relative paths go to the origin
+  // that served the page.
+  //
+  // Read from a process argument, not over IPC: the interface asks for this
+  // while its modules are still loading, before anything can await, and
+  // synchronous IPC would block the renderer for a value that cannot change
+  // within a run.
+  hubBase: () => HUB_BASE,
+  setHubBase: (base) => ipcRenderer.invoke('hub:set', base),
+
+  // What this build can do that a browser cannot. The interface renders
+  // features gated on these nowhere at all in a browser, rather than offering
+  // something that fails when clicked.
+  capabilities: {
+    nodeAdmin: true,
+    localFolders: true,
+    nativeSave: true,
+  },
+
+  secrets: {
+    get: (name) => ipcRenderer.invoke('secrets:get', name),
+    set: (name, value) => ipcRenderer.invoke('secrets:set', name, value),
+    clear: (name) => ipcRenderer.invoke('secrets:clear', name),
+    // 'unprotected_fallback' means safeStorage found no keyring and is using a
+    // fixed key. Encrypted on disk, by a key that is not a secret — the
+    // interface says so rather than letting someone believe otherwise.
+    backend: () => ipcRenderer.invoke('secrets:backend'),
+  },
+
+  // A save dialog and a write that never passes back through the page. The
+  // renderer holds an id, not a path.
+  saveFile: async (suggestedName) => {
+    const handle = await ipcRenderer.invoke('save:begin', suggestedName);
+    if (!handle) return null;
+    return {
+      name: handle.name,
+      write: (chunk) => ipcRenderer.invoke('save:write', handle.id, chunk),
+      close: () => ipcRenderer.invoke('save:end', handle.id),
+    };
+  },
+});