From 422647e7898b8df67cd11f8fb060aec23dec84aa Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 14 Oct 2026 22:20:15 +0200
Subject: feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/meshbay-client/build/appx-manifest.xml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

(limited to 'packages/meshbay-client/build/appx-manifest.xml')

diff --git a/packages/meshbay-client/build/appx-manifest.xml b/packages/meshbay-client/build/appx-manifest.xml
index a8dba41..c097fdd 100644
--- a/packages/meshbay-client/build/appx-manifest.xml
+++ b/packages/meshbay-client/build/appx-manifest.xml
@@ -44,10 +44,11 @@
       ${extensions}
     </Application>
   </Applications>
-  <!-- The node accepts connections from peers (WebRTC, QUIC, casting). Rules
-       declared here are created by Windows at install with no administrator
-       prompt, follow the executable's versioned path on every update, and go
-       with the package. A rule the app made itself named that path and was
+  <!-- The node accepts connections from peers (WebRTC, QUIC, casting), and
+       the command-line client does during a transfer (WebRTC). Rules declared
+       here are created by Windows at install with no administrator prompt,
+       follow the executable's versioned path on every update, and go with the
+       package. A rule the app made itself named that path and was
        stale after the next update; the network capabilities create rules for
        sandboxed apps only, which a full-trust process is not. Both measured
        on a real install. -->
@@ -64,5 +65,10 @@
         <desktop2:Rule Direction="in" IPProtocol="UDP" Profile="all" />
       </desktop2:FirewallRules>
     </desktop2:Extension>
+    <desktop2:Extension Category="windows.firewallRules">
+      <desktop2:FirewallRules Executable="app\resources\node-runtime\meshbay-cli.exe">
+        <desktop2:Rule Direction="in" IPProtocol="UDP" Profile="all" />
+      </desktop2:FirewallRules>
+    </desktop2:Extension>
   </Extensions>
 </Package>
-- 
cgit v1.2.3