fix(packaging): actually ship the TMDB token, on Linux and Windows

default.env was empty in every build, for three independent reasons:

1. build-node.sh read QE/node.env, which does not exist. Even pointed at the
   real file it would have failed: its `grep MESHBAY_TMDB_DEFAULT_TOKEN=`
   cannot match QE/tmdb.txt, which is a free-form note, not KEY=VALUE.

2. Nothing consumed default.env. packaging/README.md and build-node.sh both
   claimed `meshbay-node init` copies it to <config>/node.env; grep found the
   name in exactly two places, the README and the script that writes it. No
   code implemented the copy, and `EnvironmentFile=-` hid the absence.

3. build-win.ps1 had no env handling at all, so Windows was empty for a
   different reason than Linux.

Now: the build extracts the v4 read token -- tmdb.py sends `Authorization:
Bearer`, so it is the JWT, not the 32-char v3 key beside it in the same file --
matching KEY=VALUE first and then by shape, from MESHBAY_TMDB_TOKEN,
MESHBAY_TMDB_TOKEN_FILE, QE/node.env, QE/tmdb.txt. It writes default.env 0600
and *fails the build* if no token resolves; MESHBAY_ALLOW_NO_TMDB=1 opts out.
An empty default.env is invisible until a user opens Videos and finds no
metadata, which is how this shipped empty on two platforms at once.

platform.py gains packaged_default_env()/install_node_env()/load_node_env().
init copies the packaged file once, never overwriting an existing node.env,
and the daemon loads node.env itself at startup: systemd does this on Linux
via EnvironmentFile, but Windows autostart is a Startup-folder .vbs with no
equivalent. Already-set variables always win.

Also fixes an UnboundLocalError in main(): `config_dir` was assigned at the
top of the init branch, which made it function-local for all of main(), while
the reset branch calls `config_dir()` as the imported function. init returns
before that line, so `meshbay-node reset` could only ever raise. The local is
now cfg_dir.

Verified end to end on Linux: token baked (239 chars), init writes
<config>/node.env 0600 with it. The PowerShell half is written but unrun --
no pwsh on this machine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DtfG7z6wHWj8RKHCvxQtY1

1 files changed, 80 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py
index b59418f..3c160a1 100644
--- a/packages/meshbay-node/src/meshbay_node/platform.py
+++ b/packages/meshbay-node/src/meshbay_node/platform.py
@@ -68,6 +68,86 @@ def state_dir() -> Path:
     return Path.home() / ".local" / "state" / "meshbay"
 
 
+# ── Packaged defaults ────────────────────────────────────────────────────────
+
+
+def packaged_default_env() -> Path | None:
+    """
+    The `default.env` shipped with the package: build-time defaults, currently
+    the shared read-only TMDB token. `init` copies it to config_dir()/node.env
+    and nothing reads it in place, so an operator's edits to their own copy
+    survive an upgrade.
+
+    Frozen (PyInstaller/Windows): beside the executable, where
+    build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg.
+    Packaged (Linux): /opt/meshbay-node/share/default.env, from build-node.sh.
+    None in a source checkout, where no package wrote one.
+    """
+    candidates = []
+    if getattr(sys, "frozen", False):
+        candidates.append(Path(sys.executable).parent / "default.env")
+    candidates.append(Path("/opt/meshbay-node/share/default.env"))
+    for path in candidates:
+        try:
+            if path.is_file():
+                return path
+        except OSError:
+            continue
+    return None
+
+
+def install_node_env(target_dir: Path) -> Path | None:
+    """
+    Copy the packaged default.env to <target_dir>/node.env, once, at init.
+
+    Never overwrites: an existing node.env holds the operator's own values, and
+    silently replacing a configured token with the packaged one would be worse
+    than doing nothing. Returns the path when written, None when there was
+    nothing to copy or a file was already there.
+    """
+    src = packaged_default_env()
+    if src is None:
+        return None
+    dest = target_dir / "node.env"
+    if dest.exists():
+        return None
+    dest.write_bytes(src.read_bytes())
+    chmod_private(dest)
+    return dest
+
+
+def load_node_env(source_dir: Path) -> int:
+    """
+    Read <source_dir>/node.env into os.environ, returning how many names were
+    set.
+
+    systemd does this on Linux through `EnvironmentFile=`, but the Windows
+    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
+    the file itself and both platforms behave the same. An existing environment
+    variable always wins -- an operator exporting a value, or systemd having
+    already loaded the same file, overrides the packaged default rather than
+    being overridden by it.
+    """
+    path = source_dir / "node.env"
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return 0
+    count = 0
+    for line in text.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        name, _, value = line.partition("=")
+        name = name.strip()
+        value = value.strip().strip('"').strip("'")
+        if not name or name in os.environ:
+            continue
+        os.environ[name] = value
+        count += 1
+    return count
+
+
 # ── File permissions ─────────────────────────────────────────────────────────