feat(reticulum): local PN hosting, LXMF delivery, and audit/security hardening

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.rs]
+indent_size = 4

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.icns binary
+*.woff binary
+*.woff2 binary
+*.wasm binary

.githooks/pre-commit

@@ -147,6 +147,12 @@ else
   printf 'pre-commit: skip check:reticulum-interface-modes (no interface-mode paths staged)\n' >&2
 fi
 
+if staged_match '^(reticulum-sidecar/src/stack/pn_hosting_policy\.rs|src/shared/pnHostingPolicy\.ts|scripts/check-pn-hosting-policy\.mjs)'; then
+  pnpm run check:pn-hosting-policy || fail 'pnpm run check:pn-hosting-policy'
+else
+  printf 'pre-commit: skip check:pn-hosting-policy (no pn-hosting-policy paths staged)\n' >&2
+fi
+
 if staged_match '^(reticulum-sidecar/src/stack/config\.rs|src/shared/reticulumDecommissionedHubs\.ts|scripts/check-reticulum-decommissioned-hubs\.mjs)'; then
   pnpm run check:reticulum-decommissioned-hubs || fail 'pnpm run check:reticulum-decommissioned-hubs'
 else

.github/dependabot.yml

@@ -1,5 +1,9 @@
 version: 2
 updates:
+  # Dependabot PRs intentionally disabled (limit 0) — the project manages npm
+  # and Actions updates via `pnpm run update` (scripts/update.sh) which runs
+  # dedupe, patch checks, and Ratspeak/rsReticulum verification in one pass.
+  # See AGENTS.md §6 and docs/ci-cd.md.
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:

.github/workflows/ci.yaml

@@ -32,9 +32,29 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Format check
+        run: pnpm run format:check
+
+      - name: Markdown lint
+        run: pnpm run lint:md
+
       - name: Lint
         run: pnpm run lint
 
+      - name: License check
+        run: pnpm run check:licenses
+
+      - name: Install actionlint
+        run: pnpm run setup:actionlint
+
+      - name: Actionlint
+        run: |
+          export PATH="${GITHUB_WORKSPACE}/.githooks/bin:${PATH}"
+          actionlint
+
+      - name: pnpm audit (high+)
+        run: pnpm audit --audit-level=high
+
       - name: Install yamllint
         run: pip install yamllint
 

.github/workflows/reticulum-sidecar.yaml

@@ -14,15 +14,15 @@ on:
       - 'scripts/build-reticulum-sidecar-release.mjs'
       - 'scripts/clone-ratspeak-stack.sh'
       - 'scripts/ensure-rsReticulum-patches.sh'
-      - 'scripts/apply-rsLXMF-propagation-sync-peering.sh'
+      - 'scripts/apply-rsLXMF-*.sh'
   pull_request:
     paths:
       - 'reticulum-sidecar/**'
       - '.github/workflows/reticulum-sidecar.yaml'
       - 'scripts/build-reticulum-sidecar-release.mjs'
       - 'scripts/clone-ratspeak-stack.sh'
       - 'scripts/ensure-rsReticulum-patches.sh'
-      - 'scripts/apply-rsLXMF-propagation-sync-peering.sh'
+      - 'scripts/apply-rsLXMF-*.sh'
 
 jobs:
   lint:

.markdownlint-cli2.jsonc

@@ -2,9 +2,10 @@
   "ignores": [
     "node_modules/**",
     ".cursor/**",
+    ".hermes/**",
     "site/**",
     "release/**",
     "dist/**",
-    "out/**"
+    "out/**",
   ],
-}
+}

.markdownlint.json

@@ -2,7 +2,9 @@
   "MD001": false,
   "MD013": false,
   "MD022": false,
-  "MD024": false,
+  "MD024": {
+    "siblings_only": true
+  },
   "MD025": false,
   "MD031": false,
   "MD032": false,

.prettierignore

@@ -14,6 +14,8 @@ tmp/
 
 # Files unsupported by prettier parser
 .npmrc
+.editorconfig
+.gitattributes
 patches/
 *.plist
 *.txt

.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "dbaeumer.vscode-eslint",
+    "davidanson.vscode-markdownlint",
+    "rust-lang.rust-analyzer"
+  ]
+}

.vscode/settings.json

@@ -7,7 +7,7 @@
   "eslint.validate": ["javascript", "typescript", "javascriptreact", "typescriptreact"],
   "eslint.format.enable": true,
   "[typescript]": {
-    "editor.defaultFormatter": "vscode.typescript-language-features"
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": "explicit"
@@ -19,6 +19,6 @@
     "editor.defaultFormatter": "vscode.json-language-features"
   },
   "[typescriptreact]": {
-    "editor.defaultFormatter": "vscode.typescript-language-features"
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
   }
 }

docs/accessibility-checklist.md

@@ -46,6 +46,7 @@ This is a living document. Check items against VoiceOver (macOS), NVDA (Windows)
   - [ ] **Setting on — still allowed (essential feedback)**: Loading spinners (`animate-spin`, `Loader`), connection header status pulses (`animate-pulse` on MQTT/device labels and status dots).
   - [ ] Toggle persists across restart (SQLite + localStorage reconcile on mount, same pattern as `locale` / `chatCompactMode`).
   - [x] Optional first-run: if `reduceMotion` key is absent, initializer may default from `matchMedia('(prefers-reduced-motion: reduce)')` once; thereafter only the App toggle applies (not live-synced to OS changes). Implemented by `initReduceMotionDefaultIfAbsent()` in `reduceMotionPreference.ts` (called from `main.tsx` before React mount).
+- [ ] **24-hour time (in-app setting)**: **App → Appearance → Use 24-hour time** (`use24HourTime` via `timeFormatStore` / `formatDisplayTime`; SQLite + localStorage, same bundle as Reduce motion). When on, chat and other display clocks force 24-hour format; when off, follow the system locale.
 
 ---
 

docs/ci-cd.md

@@ -20,19 +20,24 @@ Mesh-Client uses GitHub Actions for continuous integration and deployment.
 
 ## CI Build (`ci.yaml`)
 
-Runs on every push and pull request to `main`:
+Runs on every push and pull request to `main` (and `workflow_dispatch`):
 
 1. Checkout code
 2. Setup pnpm
 3. Setup Node 22
 4. Install dependencies (`pnpm install --frozen-lockfile`)
-5. Run lint (`pnpm run lint`)
-6. Run typecheck (`pnpm run typecheck`)
-7. Run build (`pnpm run build`)
-8. Run `yamllint` on workflow/config YAML
-9. Run `check:flatpak`, `check:flatpak-offline-pnpm` (needs `flatpak-node-generator`), `desktop-file-validate`, and `appstreamcli validate` on Flatpak metadata
-
-All steps must pass before a PR can be merged.
+5. Format check (`pnpm run format:check`)
+6. Markdown lint (`pnpm run lint:md`)
+7. Run lint (`pnpm run lint`)
+8. License check (`pnpm run check:licenses`)
+9. actionlint (via `pnpm run setup:actionlint`)
+10. `pnpm audit --audit-level=high` (non-blocking warning)
+11. Run `yamllint` on workflow/config YAML
+12. Run typecheck (`pnpm run typecheck`)
+13. Run build (`pnpm run build`)
+14. Run `check:flatpak`, `check:flatpak-offline-pnpm` (needs `flatpak-node-generator`), `desktop-file-validate`, and `appstreamcli validate` on Flatpak metadata
+
+All blocking steps must pass before a PR can be merged.
 
 ---
 
@@ -119,7 +124,9 @@ Automated dependency updates are configured in `.github/dependabot.yml`:
 - **Schedule:** Weekly on Saturdays
 - **npm dependencies:** Grouped PRs (Electron separate, all other deps together)
 - **GitHub Actions:** Grouped into one PR
-- **Limit:** 10 open PRs maximum
+- **Open PRs:** `open-pull-requests-limit: 0` — Dependabot scans but does **not** open PRs.
+  Dependency bumps are applied manually via `pnpm run update` (`scripts/update.sh`), which
+  also runs dedupe and Ratspeak/rsReticulum patch checks. See AGENTS.md §6.
 
 ### Testing Dependabot PRs locally
 

docs/reticulum-sidecar-ipc.md

@@ -91,16 +91,42 @@ The Connection tab UI edits a subset: **name** and **mode** for all types; **hos
 **WS `rmap.discovery`:** sidecar polls DiscoveryStore every **10s**; emits full `{ discovered: [...] }` snapshot when JSON fingerprint changes. Stub builds return `{ discovered: [] }`.
 | GET | `/api/v1/packets` | `?limit=500` (1–2500) | `{ packets: [] }` — recent wire tap ring buffer |
 | DELETE | `/api/v1/packets` | | `{ ok }` — clear wire tap buffer |
-| GET | `/api/v1/propagation` | | `{ propagation, preferred_id, auto_sync_interval_sec }` — `local-prop` rows include `message_count`, `storage_bytes` when live |
+| GET | `/api/v1/propagation` | | `{ propagation, preferred_id, auto_sync_interval_sec, pn_hosting_policy }` — `local-prop` rows include `message_count`, `storage_bytes` when live |
 | GET | `/api/v1/propagation/discovered` | | `{ discovered: DiscoveredPropagationRow[] }` — heard `lxmf.propagation` announces (not auto-configured) |
-| POST | `/api/v1/propagation/add` | `{ destination_hash, name? }` | `{ ok, node }` — add a remote propagation node by hash |
+| POST | `/api/v1/propagation/add` | `{ destination_hash, name?, skip_probe? }` | `{ ok, node }` or `{ ok: false, error }` — probes `/offer` unless `skip_probe`; may return `PROPAGATION_OFFER_UNSUPPORTED`, `PROPAGATION_PEER_COST_EXCEEDS_MAX`, identity/path errors |
+| POST | `/api/v1/propagation/hosting-policy` | `PnHostingPolicy` | `{ ok }` — persist + apply local PN hosting / peering policy |
 | PUT | `/api/v1/propagation/{id}` | `{ name }` | `{ ok }` — rename a remote node (`local-prop` rejected) |
 | DELETE | `/api/v1/propagation/{id}` | | `{ ok }` — remove a remote node (`local-prop` rejected; clears preferred if that id) |
-| POST | `/api/v1/propagation/{id}/enable` | | `{ ok }` |
-| POST | `/api/v1/propagation/{id}/disable` | | `{ ok }` |
+| POST | `/api/v1/propagation/{id}/enable` | | `{ ok }` — for `local-prop`, starts PN serve + announce |
+| POST | `/api/v1/propagation/{id}/disable` | | `{ ok }` — for `local-prop`, stops PN serve + announce |
 | POST | `/api/v1/propagation/{id}/preferred` | | `{ ok }` |
 | POST | `/api/v1/propagation/sync` | | `{ ok }` |
 | POST | `/api/v1/propagation/sync/cancel` | | `{ ok }` |
+| POST | `/api/v1/propagation/auto-sync-interval` | `{ interval_sec }` | `{ ok }` — `0` disables periodic sync; persists with stack |
+
+**`PnHostingPolicy`** (mirrored in `src/shared/pnHostingPolicy.ts` / sidecar `pn_hosting_policy.rs`):
+
+| Field                      | Default | Notes                                           |
+| -------------------------- | ------- | ----------------------------------------------- |
+| `peering_cost`             | `18`    | Must be ≤ `max_peering_cost`                    |
+| `max_peering_cost`         | `26`    |                                                 |
+| `autopeer`                 | `true`  |                                                 |
+| `autopeer_maxdepth`        | `4`     | Cap 64                                          |
+| `max_peers`                | `20`    | 1–256                                           |
+| `propagation_stamp_cost`   | `16`    |                                                 |
+| `propagation_stamp_flex`   | `3`     | Must be ≤ stamp cost                            |
+| `message_storage_limit_mb` | `256`   | 1–10240                                         |
+| `propagation_limit_kb`     | `256`   | 1–102400                                        |
+| `sync_limit_kb`            | `10240` | 1–102400                                        |
+| `delivery_limit_kb`        | `1000`  | 1–102400                                        |
+| `from_static_only`         | `false` |                                                 |
+| `auth_required`            | `false` |                                                 |
+| `enforce_stamps`           | `false` |                                                 |
+| `enforce_ratchets`         | `false` |                                                 |
+| `static_peers`             | `[]`    | Lowercase 32-hex hashes (max 256)               |
+| `node_name`                | `null`  | Trimmed; max 128 scalar chars; no control chars |
+| `pn_announce_interval_sec` | `360`   | Cap 86400                                       |
+| `announce_at_start`        | `true`  |                                                 |
 
 ### Nomad Network
 
@@ -226,7 +252,7 @@ Renderer calls `electronAPI.reticulum.*`; main process proxies to this API (sand
 
 `getStatus` / `onStatus` may include `interfaceIssueAlert` (TCP connect failures, TX queue drops, link-delivery timeouts, transport saturation / slow queries, **`bleBondRemoved`** stale RNode bonds, **`blePairingTimedOut`** OS passkey / TX-read timeouts). Per-entry latch timestamps use a **5-minute** stale window (`RETICULUM_INTERFACE_ISSUE_ALERT_STALE_MS`). Connection syncs **enabled** interface names via `syncInterfaceIssueScope` so disabling or removing an interface clears that name immediately and rejects re-latch from lagging log lines. Stopping the stack (or unexpected process exit) clears the tracker.
 
-**`propagation_sync` WebSocket payload:** `{ active: boolean, progress: number, message: string | null }`. Progress uses 0–100 (Establishing ≈10, Offering ≈25, …, Complete ≈100). Sticky success after HaveAll emits `active:false, progress:100`; cancel/stall/failure emit `active:false, progress:0` (and must not emit a trailing 100). Sync `POST /api/v1/propagation/sync` may return `PROPAGATION_IDENTITY_UNKNOWN`, `PROPAGATION_TARGET_NOT_PN`, `PROPAGATION_PEERING_STAMP_FAILED`, or `LOCAL_PROPAGATION_SYNC_UNSUPPORTED`.
+**`propagation_sync` WebSocket payload:** `{ active: boolean, progress: number, message: string | null }`. Progress uses 0–100 (Establishing ≈10, Offering ≈25, …, Complete ≈100). Sticky success after HaveAll emits `active:false, progress:100`; cancel/stall/failure emit `active:false, progress:0` (and must not emit a trailing 100). Sync `POST /api/v1/propagation/sync` may return `PROPAGATION_IDENTITY_UNKNOWN`, `PROPAGATION_TARGET_NOT_PN`, `PROPAGATION_PEERING_STAMP_FAILED`, `PROPAGATION_PEER_COST_EXCEEDS_MAX`, or `LOCAL_PROPAGATION_SYNC_UNSUPPORTED`. Add may return `PROPAGATION_OFFER_UNSUPPORTED` / probe timeout failures.
 
 SQLite chat history uses separate `db:*` handlers (`getReticulumMessages`, `saveReticulumMessage`, `searchReticulumMessages`, `deleteReticulumMessage`, destination upserts), not sidecar HTTP. Remote saved addresses / inbound policy and RRC room history also use dedicated `db:*` handlers (not sidecar HTTP).