fix(node): read the packaged TMDB token in place

A node onboarded by the desktop client never ran `init`, so default.env was
never copied to node.env; and default.env was 0600 root, unreadable to a
per-user node anyway. The daemon now loads it beneath node.env, 0644.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 28 insertions, 41 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/cli/setup.py b/packages/meshbay-node/src/meshbay_node/cli/setup.py
index b2a8e83..48a55ef 100644
--- a/packages/meshbay-node/src/meshbay_node/cli/setup.py
+++ b/packages/meshbay-node/src/meshbay_node/cli/setup.py
@@ -33,11 +33,6 @@ def init(args) -> None:
     cfg_dir = cfg_path.parent
     cfg_dir.mkdir(parents=True, exist_ok=True)
 
-    from meshbay_node.platform import install_node_env
-    env_written = install_node_env(cfg_dir)
-    if env_written:
-        print(f"Wrote {env_written} (packaged defaults).")
-
     hub_url = args.hub_url
     username = args.username
 
diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py
index 7e840ad..7db251b 100644
--- a/packages/meshbay-node/src/meshbay_node/platform.py
+++ b/packages/meshbay-node/src/meshbay_node/platform.py
@@ -80,9 +80,10 @@ def state_dir() -> Path:
 def packaged_default_env() -> Path | None:
     """
     The `default.env` shipped with the package: build-time defaults, currently
-    the shared read-only TMDB token. `init` copies it to config_dir()/node.env
-    and nothing reads it in place, so an operator's edits to their own copy
-    survive an upgrade.
+    the shared read-only TMDB token. The daemon reads it in place, beneath
+    <config>/node.env, so it reaches every node however that node was set up --
+    `meshbay-node init` and the desktop client's onboarding alike -- and an
+    operator's own node.env still wins.
 
     Frozen (PyInstaller/Windows): beside the executable, where
     build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg.
@@ -102,39 +103,7 @@ def packaged_default_env() -> Path | None:
     return None
 
 
-def install_node_env(target_dir: Path) -> Path | None:
-    """
-    Copy the packaged default.env to <target_dir>/node.env, once, at init.
-
-    Never overwrites: an existing node.env holds the operator's own values, and
-    silently replacing a configured token with the packaged one would be worse
-    than doing nothing. Returns the path when written, None when there was
-    nothing to copy or a file was already there.
-    """
-    src = packaged_default_env()
-    if src is None:
-        return None
-    dest = target_dir / "node.env"
-    if dest.exists():
-        return None
-    dest.write_bytes(src.read_bytes())
-    chmod_private(dest)
-    return dest
-
-
-def load_node_env(source_dir: Path) -> int:
-    """
-    Read <source_dir>/node.env into os.environ, returning how many names were
-    set.
-
-    systemd does this on Linux through `EnvironmentFile=`, but the Windows
-    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
-    the file itself and both platforms behave the same. An existing environment
-    variable always wins -- an operator exporting a value, or systemd having
-    already loaded the same file, overrides the packaged default rather than
-    being overridden by it.
-    """
-    path = source_dir / "node.env"
+def _load_env_file(path: Path) -> int:
     try:
         text = path.read_text(encoding="utf-8")
     except (OSError, UnicodeDecodeError):
@@ -154,6 +123,29 @@ def load_node_env(source_dir: Path) -> int:
     return count
 
 
+def load_node_env(source_dir: Path) -> int:
+    """
+    Read <source_dir>/node.env, then the packaged default.env, into
+    os.environ, returning how many names were set.
+
+    systemd does the first through `EnvironmentFile=`, but the Windows
+    autostart is a Startup-folder .vbs with no equivalent, so the daemon reads
+    the file itself and both platforms behave the same. An existing environment
+    variable always wins, and node.env wins over the packaged default -- an
+    operator exporting a value, or systemd having already loaded the same file,
+    overrides the packaged default rather than being overridden by it.
+
+    The packaged default used to reach a node only as a copy made by
+    `meshbay-node init`; a node onboarded by the desktop client never ran it and
+    ran with no TMDB token at all.
+    """
+    count = _load_env_file(source_dir / "node.env")
+    packaged = packaged_default_env()
+    if packaged is not None:
+        count += _load_env_file(packaged)
+    return count
+
+
 # ── File permissions ─────────────────────────────────────────────────────────