chore(client): build against the latest Electron, and stop defining the package twice

Chromium CVEs are fixed in Electron releases, and a client built against
an old one ships those holes to every user. That is a certain harm; a
build that breaks on a new Electron is a repairable one. build-client.sh
now bumps to the latest on every build, prints the comparison, and lets
the build fail if it cannot cope — the failure is the signal to fix, not
a reason to stay behind. It writes package.json and the lockfile on
purpose: the new pin is meant to be committed. A registry it cannot reach
is a warning, not a failure.

Exercised by pinning back to 42.9.2 and building: "==> Electron 42.9.2 ->
44.1.1", exit 0, electron=44.1.1 in the packaged output. Note npm audit
would have said nothing about any of this — Chromium CVEs fixed in
Electron do not reliably reach the npm advisory database.

Separately, package.json declared linux.target [deb, rpm] with its own
deb/rpm depends, so `npm run dist` built a second package under the same
name. The two had drifted: /opt/MeshBay/meshbay-client against
/opt/meshbay-client/meshbay, and Depends: python3-meshbay-common naming
none of the Electron runtime libraries the real DEBIAN/control lists — it
would have installed cleanly and then refused to start. Nothing in the
tree referenced `npm run dist`, which is why the drift was free to
happen. That config is gone, "dist" delegates to build-client.sh, and
test_desktop_shell.py refuses its return.

`--dir` was re-run with no linux block at all: exit 0, same binary
build-client.sh consumes. It needs appId, productName and files, nothing
else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss

1 files changed, 44 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index b82804e..f1dd399 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -13,6 +13,7 @@ Every assertion here corresponds to a sentence in `docs/desktop-client-v1.md`
 person with an installed client is what confirms the rest.
 """
 
+import json
 import re
 from pathlib import Path
 
@@ -332,3 +333,46 @@ def test_a_chosen_folder_that_has_gone_is_not_silently_replaced():
     assert "config.downloadDir && !chosen" in begin, (
         "a chosen-but-missing folder falls through to the default instead of asking")
     assert "showSaveDialog" in begin
+
+
+# ── one definition of the package, not two ───────────────────────────────────
+
+def test_package_json_does_not_define_a_second_linux_package():
+    """
+    `packaging/build/` builds the client's `.deb` and `.rpm`: `build-client.sh`
+    runs electron-builder for `--dir` only, then the tree is assembled by hand
+    and `dpkg-deb`/`rpmbuild` package it from `packaging/deb/meshbay-client/
+    DEBIAN/control` and `packaging/rpm/meshbay-client.spec`.
+
+    `package.json` used to *also* declare `linux.target: [deb, rpm]` with its
+    own `deb.depends`/`rpm.depends`, so `npm run dist` produced a second
+    package under the same name — and the two had already drifted. The
+    electron-builder one installed to `/opt/MeshBay/meshbay-client` (against
+    `/opt/meshbay-client/meshbay`), and declared `Depends:
+    python3-meshbay-common` while naming none of the Electron runtime
+    libraries the real control file lists — so it would have installed
+    cleanly and then refused to start.
+
+    Nothing referenced `npm run dist`, which is why nobody noticed. It now
+    delegates to `build-client.sh`, and this keeps the second definition from
+    growing back.
+    """
+    pkg = json.loads((CLIENT / "package.json").read_text(encoding="utf-8"))
+    build = pkg.get("build", {})
+
+    for key in ("deb", "rpm", "appImage", "snap", "pacman"):
+        assert key not in build, (
+            f"package.json's build.{key} defines packaging that "
+            "packaging/build/ already owns — two definitions of one package "
+            "drift, and the last pair already had")
+
+    targets = build.get("linux", {}).get("target")
+    assert not targets, (
+        f"build.linux.target is {targets!r}: electron-builder is used for "
+        "--dir only. A target list here makes `electron-builder` emit a "
+        "package that competes with the one packaging/build/ ships")
+
+    dist = pkg.get("scripts", {}).get("dist", "")
+    assert "electron-builder" not in dist, (
+        "the dist script builds packages with electron-builder again; it "
+        "should delegate to packaging/build/build-client.sh")