fix: close Phase 0 acceptance gaps

Author: dhawal-ss

.github/workflows/security.yml

@@ -88,10 +88,14 @@ jobs:
       - name: Audit JavaScript dependencies
         working-directory: mesh
         run: npm audit --audit-level=high
-      - name: Scan repository history for secrets
+      - name: Scan repository history for non-URI secrets
         uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6
         with:
-          extra_args: --results=verified,unknown
+          extra_args: --results=verified,unknown --exclude-detectors=URI
+      - name: Scan repository history for credential-bearing URIs
+        uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6
+        with:
+          extra_args: --results=verified,unknown --include-detectors=URI --exclude-paths=.trufflehog-uri-excludes
 
   sbom:
     runs-on: ubuntu-latest

.trufflehog-uri-excludes

@@ -0,0 +1,2 @@
+^mesh/src/lib/community-invites\.test\.ts$
+^mesh/src-tauri/src/backend/matrix/tests/mod\.rs$

AGENTS.md

@@ -14,14 +14,18 @@ replication.
 
 ## Non-negotiable UX rules
 
-- Ship safe, working defaults for the recommended Mesh service in release
-  builds.
+- Ship a simple, explicit account-service choice in release builds: Matrix.org
+  as a prominent public option, a community-hosted service when an invitation
+  offers one, additional reviewed public options, and "use another service".
+- Do not silently select an account service or imply that an independently
+  operated public service is owned, endorsed, or guaranteed by Mesh.
 - Invitation links must carry or resolve everything needed to reach the
-  service and community.
+  community, but must not force the invitee's account to live on the
+  community's homeserver. Account hosting and community hosting are separate.
 - Use plain product language such as "service", "community", and "voice";
   reserve protocol terminology for diagnostics and advanced settings.
-- Keep "sign in somewhere else" and custom homeserver support available as an
-  advanced path so decentralization does not become lock-in.
+- Keep "use another service" and custom homeserver support as a first-class
+  path so decentralization does not become lock-in.
 - Detect service capabilities and network conditions automatically. Do not ask
   users to make infrastructure decisions that Mesh can make safely.
 - Errors must explain what the user can do next without exposing raw protocol
@@ -34,8 +38,15 @@ replication.
 
 ## Architecture guardrails
 
-- The managed Mesh homeserver is the zero-configuration default, not the only
-  compatible service.
+- Mesh must not require a paid Mesh-operated homeserver. Matrix.org is a
+  prominent independently operated public option; the Mac mini is an optional
+  community-hosted/bring-your-own service with no uptime SLA; and arbitrary
+  compatible homeservers remain supported.
+- Keep the selected account service, community room-routing servers, and any
+  optional community admission/registration service separate in configuration
+  and code.
+- A user whose account is hosted on one compatible service must be able to join
+  a community hosted on another through federation when room policy permits.
 - Keep identity, membership, permissions, text history, encryption state, and
   synchronization on the Matrix-compatible control plane.
 - Treat peer-assisted storage as an optional encrypted data plane with durable

mesh/e2e/authenticated-shell.spec.ts

@@ -30,6 +30,7 @@ async function installAuthenticatedMatrixMock(
     const callbacks = new Map<number, (...args: unknown[]) => void>()
     let nextCallbackId = 1
     let nextListenerId = 1
+    let invitationJoined = false
 
     const community = {
       id: '!mesh-e2e:mesh.test',
@@ -47,6 +48,14 @@ async function installAuthenticatedMatrixMock(
       role: 'member',
       joinedAt: '2026-07-24T00:00:00.000Z',
     }
+    const invitedCommunity = {
+      id: '!invited:mesh.test',
+      name: 'Invited Mesh Community',
+      description: 'Joined from the cold-start invitation',
+      memberCount: 4,
+      role: 'member',
+      joinedAt: '2026-07-29T00:00:00.000Z',
+    }
     const channels = [
       {
         id: '!general:mesh.test',
@@ -159,7 +168,20 @@ async function installAuthenticatedMatrixMock(
             warnings: [],
           }
         case 'matrix_list_communities':
-          return [community, secondCommunity]
+          return invitationJoined
+            ? [community, secondCommunity, invitedCommunity]
+            : [community, secondCommunity]
+        case 'matrix_join_community':
+          if (
+            args.roomOrAlias !== invitedCommunity.id
+            || !Array.isArray(args.via)
+            || args.via.length !== 1
+            || args.via[0] !== 'mesh.test'
+          ) {
+            throw new Error('Cold-start invitation was not forwarded to Matrix correctly')
+          }
+          invitationJoined = true
+          return invitedCommunity
         case 'matrix_room_is_encrypted':
           return true
         case 'matrix_devices':
@@ -217,7 +239,17 @@ async function installAuthenticatedMatrixMock(
           matrixProfile.displayName = String(args.displayName)
           return { ...matrixProfile }
         case 'matrix_list_channels':
-          return args.communityId === secondCommunity.id
+          return args.communityId === invitedCommunity.id
+            ? [
+                {
+                  id: '!invited-general:mesh.test',
+                  communityId: invitedCommunity.id,
+                  name: 'welcome',
+                  channelType: 'text',
+                  unreadCount: 0,
+                },
+              ]
+            : args.communityId === secondCommunity.id
             ? secondCommunityChannels
             : channels
         case 'matrix_list_members':
@@ -360,9 +392,11 @@ async function openAuthenticatedShell(
   await expect(
     page.getByRole('navigation', { name: 'Communities and direct messages' }),
   ).toBeVisible({ timeout: 10_000 })
-  await expect(page.getByRole('log', { name: 'Messages in #general' })).toBeVisible({
-    timeout: 10_000,
-  })
+  if (!currentDeepLinks?.length) {
+    await expect(page.getByRole('log', { name: 'Messages in #general' })).toBeVisible({
+      timeout: 10_000,
+    })
+  }
 }
 
 function ipcCalls(page: Page): Promise<IpcCall[]> {
@@ -395,15 +429,29 @@ test.describe('authenticated desktop shell', () => {
     await expect(page.getByText('Anonymous', { exact: true })).toHaveCount(0)
   })
 
-  test('routes a cold-start Mesh invitation into the prefilled join flow', async ({ page }) => {
+  test('joins a cold-start Mesh invitation through Matrix and opens the community', async ({ page }) => {
     const invite =
       'mesh://join?v=3&kind=matrix&room=!invited:mesh.test&via=mesh.test&service=https%3A%2F%2Fmatrix.mesh.test'
     await openAuthenticatedShell(page, [invite])
 
-    const dialog = page.getByRole('dialog', { name: 'Join a community' })
-    await expect(dialog).toBeVisible()
-    await expect(dialog.getByLabel('Invite code or link')).toHaveValue(invite)
-    await expect(dialog.getByRole('button', { name: 'Join Community' })).toBeEnabled()
+    await expect.poll(async () => (
+      (await ipcCalls(page)).filter((call) => call.command === 'matrix_join_community')
+    )).toEqual([{
+      command: 'matrix_join_community',
+      args: {
+        roomOrAlias: '!invited:mesh.test',
+        via: ['mesh.test'],
+      },
+    }])
+    await expect(
+      page.getByRole('button', { name: 'Invited Mesh Community', exact: true }),
+    ).toHaveAttribute('aria-current', 'true')
+    await expect(page.getByRole('button', { name: 'Text room: welcome' })).toHaveAttribute(
+      'aria-current',
+      'page',
+    )
+    await expect(page.getByRole('dialog', { name: 'Join a community' })).toHaveCount(0)
+
   })
 
   test('@a11y has no automated WCAG A/AA violations in the shell and settings', async ({ page }) => {