feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 69 insertions, 0 deletions

diff --git a/packaging/rpm/meshbay-cli.spec b/packaging/rpm/meshbay-cli.spec
new file mode 100644
index 0000000..5d9aeb6
--- /dev/null
+++ b/packaging/rpm/meshbay-cli.spec
@@ -0,0 +1,69 @@
+Name:           meshbay-cli
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        MeshBay command-line client — a member's groups and files, from a terminal
+# The Python packages only the client needs go with it, each under its own
+# licence: /opt/meshbay-cli/THIRD-PARTY-NOTICES.txt lists them.
+License:        AGPL-3.0-or-later
+URL:            https://meshbay.org
+
+AutoReqProv:    no
+# Not noarch: argon2-cffi's bindings are compiled code, as meshbay-common's are.
+
+Requires:       meshbay-common = %{version}
+
+%description
+meshbay-cli signs in to a MeshBay hub, lists the groups the account belongs
+to and their folders, and downloads and uploads files, directly with the node
+serving each group and end-to-end encrypted. With no argument it opens an
+interactive two-pane view.
+
+Installs into the shared venv at /opt/meshbay-common/venv/, with the Python
+packages only the client needs (Textual, keyring, argon2-cffi).
+
+%install
+cp -a %{_staging_root}/* %{buildroot}/
+install -Dm644 -t %{buildroot}%{_licensedir}/%{name} %{_repo_root}/LICENSE
+
+# After the whole transaction, so that meshbay-common's venv is in place. The
+# client runs as an unprivileged user, who cannot write bytecode into /opt:
+# compiled here once, or every run compiles Textual again in memory.
+%posttrans
+site=$(echo /opt/meshbay-common/venv/lib/python3.*/site-packages)
+while IFS= read -r entry; do
+    [ -d "$site/$entry" ] || continue
+    /opt/meshbay-common/venv/bin/python -m compileall -q "$site/$entry" >/dev/null 2>&1 || true
+done < /opt/meshbay-cli/site-packages.list
+
+# The client's files live in meshbay-common's venv: the bytecode compiled next
+# to them is removed, or rpm cannot remove the directories it sits in. Before
+# an upgrade too, while the list still names what the old version shipped.
+%pre
+if [ "$1" -ge 2 ] && [ -f /opt/meshbay-cli/site-packages.list ]; then
+    site=$(echo /opt/meshbay-common/venv/lib/python3.*/site-packages)
+    while IFS= read -r entry; do
+        [ -n "$entry" ] && [ -d "$site/$entry" ] || continue
+        find "$site/$entry" -depth -type d -name __pycache__ \
+            -exec rm -rf {} + 2>/dev/null || true
+    done < /opt/meshbay-cli/site-packages.list
+fi
+
+%preun
+if [ "$1" -eq 0 ]; then
+    site=$(echo /opt/meshbay-common/venv/lib/python3.*/site-packages)
+    while IFS= read -r entry; do
+        [ -n "$entry" ] && [ -d "$site/$entry" ] || continue
+        find "$site/$entry" -depth -type d -name __pycache__ \
+            -exec rm -rf {} + 2>/dev/null || true
+    done < /opt/meshbay-cli/site-packages.list
+fi
+
+%files -f %{_staging_root}.files
+%license %{_licensedir}/%{name}
+/opt/meshbay-cli
+/usr/bin/meshbay-cli
+%{_mandir}/man1/meshbay-cli.1*
+
+%changelog
+* Wed Oct 14 2026 MeshBay Team <devel@meshbay.org> - %{version}-1
+- First package: the command-line client