feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 32 insertions, 6 deletions

diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1
index c6a8af1..28b96e8 100644
--- a/packaging/win/build-node-runtime.ps1
+++ b/packaging/win/build-node-runtime.ps1
@@ -1,10 +1,12 @@
 <#
 .SYNOPSIS
-    Freeze the MeshBay node daemon into a relocatable Windows binary.
+    Freeze the MeshBay node daemon, and the command-line client beside it,
+    into relocatable Windows binaries.
 
 .DESCRIPTION
-    Produces packages/meshbay-client/node-runtime/meshbay-node.exe (+ its
-    onedir payload) with PyInstaller. electron-builder then carries that tree
+    Produces packages/meshbay-client/node-runtime/meshbay-node.exe,
+    meshbay-nodew.exe and meshbay-cli.exe (+ their shared onedir payload)
+    with PyInstaller. electron-builder then carries that tree
     into the NSIS installer as an extraResource (see package.json build.win).
 
     The frozen binary is what the desktop client spawns and what the W3
@@ -76,11 +78,12 @@ if ($verMajor -lt 3 -or ($verMajor -eq 3 -and $verMinor -lt 12)) {
 Step "python $verMajor.$verMinor  ($Python)"
 
 # --- 2. dependencies -----------------------------------------------------
-Step "installing meshbay-common, meshbay-node and PyInstaller"
+Step "installing meshbay-common, meshbay-node, meshbay-cli and PyInstaller"
 & $Python -m pip install --upgrade pip --quiet
 & $Python -m pip install --quiet `
     (Join-Path $Repo "packages\meshbay-common") `
     (Join-Path $Repo "packages\meshbay-node") `
+    (Join-Path $Repo "packages\meshbay-cli") `
     "pyinstaller>=6.10" `
     "tzdata"
 # tzdata: Windows ships no IANA zone database, so zoneinfo (pulled in
@@ -105,7 +108,7 @@ finally {
 }
 
 $frozen = Join-Path $pyiDist "meshbay-node"
-foreach ($name in "meshbay-node.exe", "meshbay-nodew.exe") {
+foreach ($name in "meshbay-node.exe", "meshbay-nodew.exe", "meshbay-cli.exe") {
     if (-not (Test-Path (Join-Path $frozen $name))) {
         throw "PyInstaller did not produce $name at $frozen"
     }
@@ -124,7 +127,7 @@ Copy-Item (Join-Path $Repo "packages\meshbay-common\COPYING.LESSER") (Join-Path
 Copy-Item (Join-Path $Repo "packages\meshbay-common\COPYING") (Join-Path $frozen "LICENSE-GPL-3.0.txt")
 & $Python (Join-Path $Repo "packaging\third_party_notices.py") `
     -o (Join-Path $frozen "THIRD-PARTY-NOTICES.txt") `
-    meshbay-node tzdata --extra pyinstaller --with-python
+    meshbay-node meshbay-cli tzdata --extra pyinstaller --with-python
 if ($LASTEXITCODE -ne 0) { throw "third_party_notices.py failed" }
 
 # --- 4. ffmpeg (bundled by default) -----------------------------------
@@ -198,6 +201,29 @@ Step "smoke test: the frozen node as a connection process"
 & $Python (Join-Path $WinDir "smoke-connection-process.py") $exe (Join-Path $OutDir "meshbay-nodew.exe")
 if ($LASTEXITCODE -ne 0) { throw "a frozen connection process did not carry a connection" }
 
+# The client is frozen from its own analysis, so what the daemon's checks
+# proved says nothing about it: a module PyInstaller missed fails at run time
+# only. --version and `groups --help` build the parser, which imports every
+# action and the client library; the self-test loads what the parser does not
+# -- the interactive mode drawn off-screen (Textual, Rich), keyring's backends
+# (Windows Credential Manager), an aiortc offer. The CLI has the node's version
+# (all packages share one).
+Step "smoke test: meshbay-cli"
+$cli = Join-Path $OutDir "meshbay-cli.exe"
+$out = (& $cli --version 2>&1) -join "`n"
+if ($LASTEXITCODE -ne 0 -or $out -notmatch "meshbay-cli $expect") {
+    throw "frozen meshbay-cli --version exited $LASTEXITCODE`n$out"
+}
+$out = (& $cli groups --help 2>&1) -join "`n"
+if ($LASTEXITCODE -ne 0 -or $out -notmatch "List the groups") {
+    throw "frozen meshbay-cli groups --help exited $LASTEXITCODE`n$out"
+}
+$env:MESHBAY_CLI_SELFTEST = "1"
+try { $out = (& $cli 2>&1) -join "`n" } finally { Remove-Item Env:MESHBAY_CLI_SELFTEST }
+if ($LASTEXITCODE -ne 0 -or $out -notmatch "self-test ok") {
+    throw "frozen meshbay-cli self-test exited $LASTEXITCODE`n$out"
+}
+
 if ($createdVenv -and -not $KeepBuildVenv) {
     Remove-Item -Recurse -Force $BuildVenv -ErrorAction SilentlyContinue
 }