feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 32 insertions, 6 deletions

diff --git a/packaging/README.md b/packaging/README.md
index 6081fc7..55cc39a 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -1,12 +1,13 @@
 # MeshBay — Packaging
 
-Four packages, installed under `/opt/<PACKAGE_NAME>/`:
+Five packages, installed under `/opt/<PACKAGE_NAME>/`:
 
 | Package | RPM spec | DEB control | Description |
 |---|---|---|---|
 | `meshbay-common` | `rpm/meshbay-common.spec` | `deb/meshbay-common/` | Shared Python venv + all pip deps |
 | `meshbay-hub` | `rpm/meshbay-hub.spec` | `deb/meshbay-hub/` | Hub server (FastAPI + PostgreSQL) |
 | `meshbay-node` | `rpm/meshbay-node.spec` | `deb/meshbay-node/` | Node daemon + local UI |
+| `meshbay-cli` | `rpm/meshbay-cli.spec` | `deb/meshbay-cli/` | Command-line client (a member's files from a terminal) + its man page |
 | `meshbay-client` | `rpm/meshbay-client.spec` | `deb/meshbay-client/` | Electron desktop app |
 
 ## Building packages
@@ -22,7 +23,7 @@ bash packaging/build/build-packages.sh rpm
 bash packaging/build/build-packages.sh deb --arm64
 ```
 
-Output: `meshbay-{common,hub,node,client}_<version>_{arch}.{deb,rpm}` in
+Output: `meshbay-{common,hub,node,cli,client}_<version>_{arch}.{deb,rpm}` in
 `/tmp/meshbay-build/out/` (override with `MESHBAY_BUILD_DIR`). The version comes
 from each package's `pyproject.toml`.
 
@@ -33,12 +34,12 @@ Always install `meshbay-common` first (owns the shared Python venv).
 ```bash
 # Ubuntu/Debian
 sudo dpkg -i meshbay-common_*.deb
-sudo dpkg -i meshbay-hub_*.deb meshbay-node_*.deb
+sudo dpkg -i meshbay-hub_*.deb meshbay-node_*.deb meshbay-cli_*.deb
 sudo dpkg -i meshbay-client_*.deb
 
 # Fedora
 sudo rpm -ivh meshbay-common-*.rpm
-sudo rpm -ivh meshbay-hub-*.rpm meshbay-node-*.rpm
+sudo rpm -ivh meshbay-hub-*.rpm meshbay-node-*.rpm meshbay-cli-*.rpm
 sudo rpm -ivh meshbay-client-*.rpm
 ```
 
@@ -75,8 +76,33 @@ already remembers the hub address — under `videoDecodeProbe`, and
 ## Architecture
 
 meshbay-common owns the shared Python virtual environment at
-`/opt/meshbay-common/venv/`. Hub and node install their code into that venv.
-The client is a standalone Electron app at `/opt/meshbay-client/`.
+`/opt/meshbay-common/venv/`. Hub, node and command-line client install their
+code into that venv. The client is a standalone Electron app at
+`/opt/meshbay-client/`.
+
+### meshbay-cli
+
+The command-line client is its own package, for a desktop that wants it and a
+server that does not. `build-common.sh` installs it into the venv last, after
+listing what the hub and the node need (`servers-site.txt`,
+`servers-bin.txt` in the staging directory); `build-cli.sh` moves whatever that
+install added — the client and the packages only it uses (Textual, Rich,
+keyring, argon2-cffi, ...) — into `meshbay-cli`, so a server carries none of
+them. The list of what moved is installed as `/opt/meshbay-cli/site-packages.list`:
+the maintainer scripts compile those files once at install (an unprivileged
+user cannot write bytecode into `/opt`, and Textual is slow to compile on every
+run) and remove that bytecode before removal. The rpm's `%files` takes the
+same entries from a list `build-cli.sh` writes (`meshbay-cli-root.files`),
+since they change with every dependency upgrade.
+
+Its architecture is the machine's, not `all`: argon2-cffi's bindings are
+compiled code. Its licence notices are in
+`/opt/meshbay-cli/THIRD-PARTY-NOTICES.txt`.
+
+The man page, `meshbay-cli(1)`, is generated at build time from the client's
+own argument parser (`python -m meshbay_cli.manpage`), so it lists the options
+the program has; `tests/test_manpage.py` fails when an action or option misses
+its section, and checks that troff reads it without a warning.
 
 No pip runs at install time — everything is pre-built.