From 358ca97b8875b020f145fe02f692251374424efa Mon Sep 17 00:00:00 2001
From: Jimmy
 <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Date: Sat, 29 Aug 2026 08:06:47 +1000
Subject: [PATCH] fix(mesh): reject unsuccessful NIP-11 responses

Require a successful HTTP status before accepting supported_nips as relay-mode evidence. Cover a valid-shaped open body returned with 503 so an HTTP failure cannot disable admission.

Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
---
 desktop/src-tauri/src/commands/mesh_llm.rs    |  2 ++
 .../src-tauri/src/commands/mesh_llm_tests.rs  | 32 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/desktop/src-tauri/src/commands/mesh_llm.rs b/desktop/src-tauri/src/commands/mesh_llm.rs
index 447a798ad6..1b7620dcf9 100644
--- a/desktop/src-tauri/src/commands/mesh_llm.rs
+++ b/desktop/src-tauri/src/commands/mesh_llm.rs
@@ -197,6 +197,8 @@ async fn probe_relay_mesh_mode(relay_url: &str) -> Result<mesh_llm::MeshRelayMod
         .send()
         .await
         .map_err(|error| format!("NIP-11 probe failed: {error}"))?
+        .error_for_status()
+        .map_err(|error| format!("NIP-11 probe returned an unsuccessful HTTP status: {error}"))?
         .json()
         .await
         .map_err(|error| format!("NIP-11 document was not JSON: {error}"))?;
diff --git a/desktop/src-tauri/src/commands/mesh_llm_tests.rs b/desktop/src-tauri/src/commands/mesh_llm_tests.rs
index ad6a8d44d1..d89c1b0b73 100644
--- a/desktop/src-tauri/src/commands/mesh_llm_tests.rs
+++ b/desktop/src-tauri/src/commands/mesh_llm_tests.rs
@@ -73,6 +73,38 @@ async fn relay_mode_probe_rechecks_the_same_url_without_caching() {
     server.await.expect("NIP-11 server task");
 }
 
+#[tokio::test]
+async fn relay_mode_probe_rejects_non_success_with_valid_open_body() {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind test NIP-11 server");
+    let addr = listener.local_addr().expect("test server address");
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.expect("accept NIP-11 request");
+        let mut request = vec![0; 2048];
+        let bytes_read = stream.read(&mut request).await.expect("read request");
+        let request = String::from_utf8_lossy(&request[..bytes_read]);
+        assert!(request.starts_with("GET / HTTP/1.1"));
+
+        let body = r#"{"supported_nips":[1,11,42]}"#;
+        let response = format!(
+            "HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/nostr+json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+            body.len()
+        );
+        stream
+            .write_all(response.as_bytes())
+            .await
+            .expect("write response");
+    });
+    let relay_url = format!("ws://{addr}");
+
+    let error = probe_relay_mesh_mode(&relay_url)
+        .await
+        .expect_err("non-success HTTP status must not prove an open relay");
+    assert!(error.contains("503 Service Unavailable"), "{error}");
+    server.await.expect("NIP-11 server task");
+}
+
 #[test]
 fn buzz_mesh_join_uses_the_same_live_member_from_every_other_node() {
     let targets = vec![