feat(client): the desktop application keeps M and every node identity in its main process

keyring.js derives, opens, mints, seals, signs and agrees there; the page gets
public keys and a handle. Argon2 comes from the page's own WebAssembly build
(Electron's crypto has none). Without OS key storage the page keeps its keys as
a browser does. A node's bundle is settled after connecting, re-sealed when the
key changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/playlists.js b/packages/meshbay-hub/src/meshbay_hub/static/playlists.js
index eec94e8..afcb122 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/playlists.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/playlists.js
@@ -4,6 +4,7 @@ import {
   toStored, fromStored, livePlaylists, repairTracks, indexTracks,
 } from './playlist-merge.js';
 import { derivePlaylistKey, seal, open } from './playlist-crypto.js';
+import * as platform from './platform.js';
 import {
   session, _loadBundleKey, openDB, IDB_PLAYLISTS,
 } from './hub-client.js';
@@ -108,6 +109,16 @@ async function playlistKey(userId) {
     bundleKey = await _loadBundleKey();
     if (bundleKey) session.bundleKey = bundleKey;
   }
+  if (bundleKey && bundleKey.native) {
+    // The desktop application keeps the master key and hands this one key
+    // over: it opens nothing but the playlists this page shows anyway.
+    const raw = await platform.keys.playlistKey(bundleKey.userId);
+    _key = await crypto.subtle.importKey(
+      'raw', Uint8Array.from(atob(raw), c => c.charCodeAt(0)),
+      { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+    _keyFor = userId;
+    return _key;
+  }
   if (!bundleKey || !bundleKey.v3) return null;
   _key = await derivePlaylistKey(bundleKey.v3);
   _keyFor = userId;