feat(client): the desktop application keeps M and every node identity in its main process

keyring.js derives, opens, mints, seals, signs and agrees there; the page gets
public keys and a handle. Argon2 comes from the page's own WebAssembly build
(Electron's crypto has none). Without OS key storage the page keeps its keys as
a browser does. A node's bundle is settled after connecting, re-sealed when the
key changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
index e0ae0fe..8bf884c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
@@ -101,6 +101,22 @@ async function rewrapAllNodes(o) {
           tp.connect(n.node_id, o.token, g.id, null, null, oldKey,
                      o.username, o.userId, null, recoveryKey, undefined, n.pk_node),
           30000, 'connect');
+        if (tp.identity && tp.identity.native) {
+          // The desktop application holds this identity: it seals, and only
+          // for an account with browser access — without it, nothing of the
+          // identity is on the node to re-seal.
+          const P = window.MeshBayPlatform.keys;
+          if (await P.browserAccess(o.userId)) {
+            const sealed = await P.sealBundle(o.userId, tp.nodePk,
+              { pending: Boolean(o.newBundleKey && o.newBundleKey.pending) });
+            const rec = o.recoveryKey
+              ? await P.sealRecovery(o.userId, tp.nodePk, o.recoveryKey, o.username) : null;
+            await tp.storeKeypairBundle(sealed.bundle, rec);
+            await P.markSealed(o.userId, tp.nodePk, sealed.fingerprint);
+          }
+          anyOk = true;
+          continue;
+        }
         if (tp.newNodeBundle) {
           // No identity existed on this node — connect just minted one under
           // the old key. Don't persist it: the next time this group is opened