2 files changed, 87 insertions, 12 deletions
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
index bd81096..8970176 100755
--- a/packaging/build/build-node.sh
+++ b/packaging/build/build-node.sh
@@ -45,26 +45,53 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node"
 # --- Node-specific assets -------------------------------------------------
 mkdir -p "$ROOT/opt/meshbay-node/share"
 
-# Default env with TMDB token (read at build time).
-# Override with MESHBAY_TMDB_TOKEN_FILE; falls back to QE/node.env (gitignored).
-TMDB_TOKEN_FILE="${MESHBAY_TMDB_TOKEN_FILE:-$REPO/QE/node.env}"
-TMDB_TOKEN=""
-if [ -f "$TMDB_TOKEN_FILE" ]; then
-    TMDB_TOKEN=$(grep -oP 'MESHBAY_TMDB_DEFAULT_TOKEN=\K.*' "$TMDB_TOKEN_FILE" || true)
+# Default env with the shared TMDB token, read at build time and copied to
+# <config>/node.env by `meshbay-node init`.
+#
+# tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token*
+# (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same
+# note file. Sources, in order: an explicit variable, an explicit file, the
+# KEY=VALUE form, then QE/tmdb.txt -- which is free-form prose, so the token is
+# matched by shape rather than by a label.
+extract_tmdb_token() {
+    local file="$1" tok=""
+    [ -f "$file" ] || return 0
+    tok=$(sed -n 's/^[[:space:]]*MESHBAY_TMDB_DEFAULT_TOKEN[[:space:]]*=[[:space:]]*//p' \
+          "$file" | head -1)
+    [ -n "$tok" ] || tok=$(grep -oE '^eyJ[A-Za-z0-9._-]{40,}$' "$file" | head -1 || true)
+    printf '%s' "$tok" | tr -d '"'"'"'\r'
+}
+
+TMDB_TOKEN="${MESHBAY_TMDB_TOKEN:-}"
+if [ -z "$TMDB_TOKEN" ] && [ -n "${MESHBAY_TMDB_TOKEN_FILE:-}" ]; then
+    TMDB_TOKEN=$(extract_tmdb_token "$MESHBAY_TMDB_TOKEN_FILE")
 fi
+[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/node.env")
+[ -n "$TMDB_TOKEN" ] || TMDB_TOKEN=$(extract_tmdb_token "$REPO/QE/tmdb.txt")
+
 if [ -n "$TMDB_TOKEN" ]; then
     cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF
 # Default environment for meshbay-node.
-# Copied to ~/.config/meshbay/node.env by 'meshbay-node init' if it does not exist.
+# Copied to <config>/node.env by 'meshbay-node init' if it does not exist.
 # The operator may override any value there or in the systemd EnvironmentFile.
 
 # TMDB API token for the Videos app (read-only, shared across installations)
 MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN
 EOF
-    echo "    TMDB token baked into default.env"
+    chmod 600 "$ROOT/opt/meshbay-node/share/default.env"
+    echo "    TMDB token baked into default.env (${#TMDB_TOKEN} chars)"
+elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then
+    echo "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2
+    : > "$ROOT/opt/meshbay-node/share/default.env"
 else
-    echo "    !! TMDB token not found in QE/node.env — default.env will be empty" >&2
-    touch "$ROOT/opt/meshbay-node/share/default.env"
+    # Failing here is deliberate: an empty default.env is invisible until a user
+    # opens the Videos app and finds no metadata, which is exactly how this
+    # shipped empty on two platforms at once.
+    echo "!! TMDB token not found. Looked at:" >&2
+    echo "     \$MESHBAY_TMDB_TOKEN, \$MESHBAY_TMDB_TOKEN_FILE," >&2
+    echo "     $REPO/QE/node.env, $REPO/QE/tmdb.txt" >&2
+    echo "   Set MESHBAY_ALLOW_NO_TMDB=1 to build without it." >&2
+    exit 1
 fi
 
 # --- Systemd units --------------------------------------------------------
diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1
index c432e01..5097b37 100644
--- a/packaging/win/build-node-runtime.ps1
+++ b/packaging/win/build-node-runtime.ps1
@@ -117,14 +117,62 @@ else {
     Write-Host "    ffmpeg not bundled -- the node will look for it on PATH" -ForegroundColor Yellow
 }
 
-# --- 5. publish ----------------------------------------------------
+# --- 5. default.env (shared TMDB token) ------------------------------
+# Beside the exe, where platform.packaged_default_env() looks for it, and the
+# same placement ffmpeg gets above. `meshbay-node init` copies it to
+# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself:
+# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile.
+function Get-TmdbToken([string]$File) {
+    if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" }
+    $lines = Get-Content -LiteralPath $File
+    foreach ($line in $lines) {
+        if ($line -match '^\s*MESHBAY_TMDB_DEFAULT_TOKEN\s*=\s*(.+)$') {
+            return $Matches[1].Trim().Trim('"').Trim("'")
+        }
+    }
+    # QE\tmdb.txt is free-form prose: match the v4 read token by shape. The
+    # 32-char v3 API key in the same file is NOT what tmdb.py sends (Bearer).
+    foreach ($line in $lines) {
+        if ($line -match '^(eyJ[A-Za-z0-9._-]{40,})\s*$') { return $Matches[1] }
+    }
+    return ""
+}
+
+$tmdb = $env:MESHBAY_TMDB_TOKEN
+if (-not $tmdb) { $tmdb = Get-TmdbToken $env:MESHBAY_TMDB_TOKEN_FILE }
+if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\node.env") }
+if (-not $tmdb) { $tmdb = Get-TmdbToken (Join-Path $Repo "QE\tmdb.txt") }
+
+$envFile = Join-Path $frozen "default.env"
+$noBom = New-Object System.Text.UTF8Encoding $false   # a BOM would break parsing
+if ($tmdb) {
+    $body = @(
+        "# Default environment for meshbay-node.",
+        "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.",
+        "",
+        "# TMDB API token for the Videos app (read-only, shared across installations)",
+        "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb"
+    ) -join "`n"
+    [System.IO.File]::WriteAllText($envFile, $body + "`n", $noBom)
+    Step ("TMDB token baked into default.env ({0} chars)" -f $tmdb.Length)
+}
+elseif ($env:MESHBAY_ALLOW_NO_TMDB -eq "1") {
+    [System.IO.File]::WriteAllText($envFile, "", $noBom)
+    Write-Host "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" -ForegroundColor Yellow
+}
+else {
+    throw ("TMDB token not found (MESHBAY_TMDB_TOKEN, MESHBAY_TMDB_TOKEN_FILE, " +
+           "QE\node.env, QE\tmdb.txt). Set MESHBAY_ALLOW_NO_TMDB=1 to build without it.")
+}
+
+# --- 6. publish ----------------------------------------------------
 Move-Item $frozen $OutDir
 Remove-Item -Recurse -Force $pyiWork, $pyiDist -ErrorAction SilentlyContinue
 if ($createdVenv -and -not $KeepBuildVenv) {
     Remove-Item -Recurse -Force $BuildVenv -ErrorAction SilentlyContinue
 }
 
-# --- 6. smoke test -----------------------------------------------
+# --- 7. smoke test -----------------------------------------------
 # Capture, do NOT pipe to Select-Object -First: that stops the native process
 # mid-write and reports a spurious non-zero exit.
 Step "smoke test: meshbay-node --help"