From c2eade6db582966fa7fc3dd037f952baf3ae1cb5 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 4 Sep 2026 14:33:33 +0200 Subject: fix(packaging): actually ship the TMDB token, on Linux and Windows default.env was empty in every build, for three independent reasons: 1. build-node.sh read QE/node.env, which does not exist. Even pointed at the real file it would have failed: its `grep MESHBAY_TMDB_DEFAULT_TOKEN=` cannot match QE/tmdb.txt, which is a free-form note, not KEY=VALUE. 2. Nothing consumed default.env. packaging/README.md and build-node.sh both claimed `meshbay-node init` copies it to /node.env; grep found the name in exactly two places, the README and the script that writes it. No code implemented the copy, and `EnvironmentFile=-` hid the absence. 3. build-win.ps1 had no env handling at all, so Windows was empty for a different reason than Linux. Now: the build extracts the v4 read token -- tmdb.py sends `Authorization: Bearer`, so it is the JWT, not the 32-char v3 key beside it in the same file -- matching KEY=VALUE first and then by shape, from MESHBAY_TMDB_TOKEN, MESHBAY_TMDB_TOKEN_FILE, QE/node.env, QE/tmdb.txt. It writes default.env 0600 and *fails the build* if no token resolves; MESHBAY_ALLOW_NO_TMDB=1 opts out. An empty default.env is invisible until a user opens Videos and finds no metadata, which is how this shipped empty on two platforms at once. platform.py gains packaged_default_env()/install_node_env()/load_node_env(). init copies the packaged file once, never overwriting an existing node.env, and the daemon loads node.env itself at startup: systemd does this on Linux via EnvironmentFile, but Windows autostart is a Startup-folder .vbs with no equivalent. Already-set variables always win. Also fixes an UnboundLocalError in main(): `config_dir` was assigned at the top of the init branch, which made it function-local for all of main(), while the reset branch calls `config_dir()` as the imported function. init returns before that line, so `meshbay-node reset` could only ever raise. The local is now cfg_dir. Verified end to end on Linux: token baked (239 chars), init writes /node.env 0600 with it. The PowerShell half is written but unrun -- no pwsh on this machine. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DtfG7z6wHWj8RKHCvxQtY1 --- packages/meshbay-node/src/meshbay_node/platform.py | 80 ++++++++++++++++++++++ 1 file changed, 80 insertions(+) (limited to 'packages/meshbay-node/src/meshbay_node/platform.py') diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py index b59418f..3c160a1 100644 --- a/packages/meshbay-node/src/meshbay_node/platform.py +++ b/packages/meshbay-node/src/meshbay_node/platform.py @@ -68,6 +68,86 @@ def state_dir() -> Path: return Path.home() / ".local" / "state" / "meshbay" +# ── Packaged defaults ──────────────────────────────────────────────────────── + + +def packaged_default_env() -> Path | None: + """ + The `default.env` shipped with the package: build-time defaults, currently + the shared read-only TMDB token. `init` copies it to config_dir()/node.env + and nothing reads it in place, so an operator's edits to their own copy + survive an upgrade. + + Frozen (PyInstaller/Windows): beside the executable, where + build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg. + Packaged (Linux): /opt/meshbay-node/share/default.env, from build-node.sh. + None in a source checkout, where no package wrote one. + """ + candidates = [] + if getattr(sys, "frozen", False): + candidates.append(Path(sys.executable).parent / "default.env") + candidates.append(Path("/opt/meshbay-node/share/default.env")) + for path in candidates: + try: + if path.is_file(): + return path + except OSError: + continue + return None + + +def install_node_env(target_dir: Path) -> Path | None: + """ + Copy the packaged default.env to /node.env, once, at init. + + Never overwrites: an existing node.env holds the operator's own values, and + silently replacing a configured token with the packaged one would be worse + than doing nothing. Returns the path when written, None when there was + nothing to copy or a file was already there. + """ + src = packaged_default_env() + if src is None: + return None + dest = target_dir / "node.env" + if dest.exists(): + return None + dest.write_bytes(src.read_bytes()) + chmod_private(dest) + return dest + + +def load_node_env(source_dir: Path) -> int: + """ + Read /node.env into os.environ, returning how many names were + set. + + systemd does this on Linux through `EnvironmentFile=`, but the Windows + autostart is a Startup-folder .vbs with no equivalent, so the daemon reads + the file itself and both platforms behave the same. An existing environment + variable always wins -- an operator exporting a value, or systemd having + already loaded the same file, overrides the packaged default rather than + being overridden by it. + """ + path = source_dir / "node.env" + try: + text = path.read_text(encoding="utf-8") + except (OSError, UnicodeDecodeError): + return 0 + count = 0 + for line in text.splitlines(): + line = line.strip() + if not line or line.startswith("#") or "=" not in line: + continue + name, _, value = line.partition("=") + name = name.strip() + value = value.strip().strip('"').strip("'") + if not name or name in os.environ: + continue + os.environ[name] = value + count += 1 + return count + + # ── File permissions ───────────────────────────────────────────────────────── -- cgit v1.2.3