feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 52 insertions, 0 deletions

diff --git a/packaging/deb/meshbay-cli/DEBIAN/control b/packaging/deb/meshbay-cli/DEBIAN/control
new file mode 100644
index 0000000..6c64c09
--- /dev/null
+++ b/packaging/deb/meshbay-cli/DEBIAN/control
@@ -0,0 +1,17 @@
+Package: meshbay-cli
+Version: __VERSION__
+Section: net
+Priority: optional
+Architecture: __ARCH__
+Maintainer: MeshBay Team <devel@meshbay.org>
+Homepage: https://meshbay.org
+Depends: meshbay-common (= __VERSION__)
+Description: MeshBay command-line client — a member's groups and files, from a terminal
+ meshbay-cli signs in to a MeshBay hub, lists the groups the account belongs
+ to and their folders, and downloads and uploads files, directly with the
+ node serving each group and end-to-end encrypted. With no argument it opens
+ an interactive two-pane view.
+ .
+ Installs into the shared venv at /opt/meshbay-common/venv/, with the Python
+ packages only the client needs (Textual, keyring, argon2-cffi). Administering
+ a node is meshbay-node's business, not this package's.
diff --git a/packaging/deb/meshbay-cli/DEBIAN/postinst b/packaging/deb/meshbay-cli/DEBIAN/postinst
new file mode 100755
index 0000000..e09d713
--- /dev/null
+++ b/packaging/deb/meshbay-cli/DEBIAN/postinst
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+# The client runs as an unprivileged user, who cannot write bytecode into
+# /opt: compiled here once, or every run compiles Textual again in memory.
+case "$1" in
+    configure)
+        if command -v py3compile >/dev/null 2>&1; then
+            site=$(echo /opt/meshbay-common/venv/lib/python3.*/site-packages)
+            while IFS= read -r entry; do
+                [ -d "$site/$entry" ] && py3compile "$site/$entry" 2>/dev/null || true
+            done < /opt/meshbay-cli/site-packages.list
+        fi
+        ;;
+esac
+
+#DEBHELPER#
diff --git a/packaging/deb/meshbay-cli/DEBIAN/prerm b/packaging/deb/meshbay-cli/DEBIAN/prerm
new file mode 100755
index 0000000..96e5930
--- /dev/null
+++ b/packaging/deb/meshbay-cli/DEBIAN/prerm
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+# The client's files live in meshbay-common's venv, whose own cleanup runs only
+# after this package is gone: the bytecode compiled next to them is removed
+# here, or dpkg cannot remove the directories it sits in.
+case "$1" in
+    remove|upgrade|deconfigure)
+        site=$(echo /opt/meshbay-common/venv/lib/python3.*/site-packages)
+        while IFS= read -r entry; do
+            [ -n "$entry" ] && [ -d "$site/$entry" ] || continue
+            find "$site/$entry" -depth -type d -name __pycache__ \
+                -exec rm -rf {} + 2>/dev/null || true
+        done < /opt/meshbay-cli/site-packages.list
+        ;;
+esac
+
+#DEBHELPER#