1896 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
3 people	e28707f6b2	fix(mobile): retry channel-sections startup sync when relay rate-limits cold start (#3004) ... **Category:** fix **User Impact:** Channel groups created on desktop now reliably appear on Android and iOS on cold start, instead of falling back to the default ungrouped list. **Problem:** On mobile cold start, ChannelsNotifier fires ~25 per-channel REQs at once, exhausting the relay's per-connection rate-limit quota. `ChannelSectionsManager` then gets BOTH its one-shot history fetch and its live subscription rejected with `rate-limited: quota exceeded` — and both errors were silently swallowed (`catch (_)`) with no retry, so the manager kept the local (empty/default) store forever. Restarting the app repeats the same storm, so Android reliably lost the race every launch. Captured live on the emulator with instrumentation. **Solution:** Track whether the startup fetch and the live subscription have each succeeded, and retry `_syncWithRelay` with exponential backoff (2s base, shift-capped, 30s max) until both land. The retry timer is cancelled on dispose, and previously-swallowed errors are now logged. Based directly on `main` — independent of #2829 (which fixes the *write* path: unpublished local edits being clobbered). The analogous retry for `ChannelSortManager` lives in #2829, since that manager is introduced there. <details> <summary>File changes</summary> **mobile/lib/features/channels/channel_sections/channel_sections_manager.dart** Extract the startup fetch + live-subscription into `_syncWithRelay`, track success of each step, and schedule a backoff retry until both succeed. `_fetchAndMerge` and `_startLiveSubscription` now report success; swallowed errors are logged; retry timer cancelled on dispose. `startupRetryBaseDelay` ctor param is test-visible. **mobile/test/features/channels/channel_sections/channel_sections_manager_test.dart** New regression tests with a rate-limiting relay fake: remote sections are adopted after retries; retry stops once fetch + subscription succeed; dispose cancels pending retries. </details> ## Reproduction Steps 1. On desktop, create channel groups (sections) for an account. 2. Cold-start the Android app for the same account on a relay with per-connection rate limiting and enough joined channels to trigger the REQ burst (~25 channels reproduced it reliably). 3. Before this fix: logs show `fetch FAILED: Exception: rate-limited: quota exceeded` and the live subscription failing, then silence — the channel list renders the default ungrouped list forever, surviving app restarts. 4. With this fix: logs show `startup sync incomplete; retrying in 2000ms (attempt 1)`, the retry succeeds, and the desktop-created groups render. ## Verification - Live on emulator-5554 (earlier stacked build of the same logic): cold start reproduced the manager being rate-limited, then a single 2s retry succeeding and groups rendering, matching desktop channel-for-channel. - Full mobile suite run at this exact head (c5f1d9a38): 654 passing; the 4 failures (3× `compose_bar_test`, 1× `channels_page_test`) reproduce on unmodified `main` (74b63e184) — pre-existing, unrelated. `flutter analyze` clean on both touched files. Originating thread: Buzz channel ed3994af-0949-447c-be00-29f03965b52e, root 4bf7cbfd48bf. --------- Signed-off-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> mobile-v0.5.0-rc.3	2026-07-27 10:43:21 -07:00
Will PflegerandGitHub	b92a1f4bf4	chore(desktop): add AgentCreationPreview file-size override to unblock main CI (#3154) ... `Desktop Core` is currently red on `main`, and every open PR that picks up current main inherits the failure. [#2630](https://github.com/block/buzz/pull/2630) added a shadow-root search-input autofocus effect to `AgentCreationPreview.tsx`, taking the file from 999 to 1026 lines. It sat one line under the 1000-line default beforehand, so that PR's own CI was green while the merged file crossed the cap with no override entry in `desktop/scripts/check-file-sizes.mjs`. This adds the missing entry at 1026, following the pattern the rest of the overrides list uses. The split stays queued along with the others. ``` - src/features/agents/ui/AgentCreationPreview.tsx: 1026 lines (limit 1000) ``` The override is tight in both directions: at `1026` the gate passes, and at `1025` it reproduces the failure above. Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-07-27 13:18:44 -04:00
3 people	c3084b36d9	fix(cli,relay): resolve agents by verified owner (#2615) ... ## Context `buzz users get --name Honey` searches relay-wide profiles and returns up to 100 identically named results without verified ownership metadata. An agent resolving “my Honey” cannot distinguish the requesting human's agent from another owner's agent, and the owned match can be excluded by the result limit. This caused the wrong Honey and Bumble pubkeys to be added to a channel. ## Summary This bug fix makes personal-agent resolution owner-aware. Callers can filter profiles by a verified owner identity before result limits are applied, and all profile results expose enough ownership context to diagnose duplicate names. ## Changes - Adds `buzz users get --owner me|<hex>|<npub>` for name and pubkey lookups. - Resolves `me` to the NIP-OA owner identity when the CLI runs as an agent. - Filters profiles by the relay's verified `agent_owner_pubkey` relationship before applying the result limit. - Returns `owner_pubkey`, `owner_display_name`, and client-relative `owned_by_me` in compact and JSON output. - Returns an empty result when no owned profile matches instead of removing the ownership constraint. - Rejects malformed owner values instead of silently running an unscoped query; explicit `null` remains equivalent to no owner filter for ordinary CLI lookups. - Rejects owner constraints on specialized channel-window, feed, and thread filters that cannot enforce author filtering. - Scopes owner filtering and enrichment to the active community. - Adds a partial `(community_id, agent_owner_pubkey)` index for owner lookups. - Documents the safe `users get --name Honey --owner me` lookup. ## Reviewer-reproducible examples The relay-backed test creates two same-name agents with different verified owners, queries through the HTTP `/query` route, verifies only the selected owner's agent is returned with verified owner metadata, and verifies a missing owner returns `[]`. ```bash cargo test -p buzz-relay query_agent_owner_returns_only_verified_owner_matches --lib -- --ignored ``` The owner/author intersection and unsupported-specialized-filter contracts also have infrastructure-free relay tests: ```bash cargo test -p buzz-relay agent_owner --lib ``` The CLI surface is visible in command help: ```bash cargo run -q -p buzz-cli -- users get --help | grep -- --owner ``` ```text --owner <OWNER> Filter agents by verified owner (`me`, 64-char hex, or npub) ``` ## Validation - `cargo test -p buzz-cli` (252 passed) - `cargo test -p buzz-db` (84 passed, 122 infrastructure tests ignored) - `cargo test -p buzz-relay --lib` (owner-filter tests pass; the full local suite is blocked by unrelated Postgres pool timeouts in media/admin tests) - `cargo test -p buzz-relay query_agent_owner_returns_only_verified_owner_matches --lib -- --ignored` (passed) - `cargo check --workspace --all-targets` - `cargo fmt --all -- --check` - Pre-push Rust, Desktop, and Desktop Tauri suites passed - Pre-push mobile suite could not start because `flutter` is not installed - `pnpm check:file-sizes` (passed after rebasing onto current `main`) --------- Signed-off-by: npub1qye6rec0htgg3np8yt6plpyyg8cyffaq66emt3kmk05eylckkzhq0hnf2k <0133a1e70fbad088cc2722f41f848441f044a7a0d6b3b5c6dbb3e9927f16b0ae@buzz.block.builderlab.xyz> Co-authored-by: npub1qye6rec0htgg3np8yt6plpyyg8cyffaq66emt3kmk05eylckkzhq0hnf2k <0133a1e70fbad088cc2722f41f848441f044a7a0d6b3b5c6dbb3e9927f16b0ae@buzz.block.builderlab.xyz>	2026-07-27 13:10:42 -04:00
4 people	8bb43d5191	fix(desktop): make the test loader work on Windows (#2758) ... The resolve hook hands nextResolve absolute filesystem paths. Node's ESM resolver requires URLs or relative specifiers: POSIX absolute paths happen to be coerced, but a Windows path like C:\... parses as a URL with protocol 'c:', so every desktop unit-test run on Windows dies immediately with ERR_UNSUPPORTED_ESM_URL_SCHEME - on a clean tree, before any test executes. CI never sees it (Linux runners). Convert absolute paths to file:// URLs (pathToFileURL) at the three nextResolve call sites. On POSIX the resulting URL is identical to what node coerced before; on Windows the loader now works. With this change the full desktop suite (318 files, 3487 tests) passes on Windows 11 / node 24.14.1. Independently reported by another Windows contributor in #2634's testing notes. Claude-Session: https://claude.ai/code/session_01YFkHsUe1UUBBuvL81Zoe3n --------- Signed-off-by: technicallybrantley <77166260+technicallybrantley@users.noreply.github.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com>	2026-07-27 13:00:55 -04:00
3 people	545bb46b82	fix(desktop): make lint and unit-test gates work on Windows (#2943) ... ## Summary On a Windows checkout the desktop quality gate does not work. This fixes four defects in it. Two checks report success without examining anything, one fails on every file, and one reports violations that its own allowlist already covers. **1. `pnpm test` finds no tests and still exits 0.** The `test` script quotes the glob with single quotes. On Windows pnpm runs scripts through `cmd.exe`, which does not strip single quotes, so node receives them as part of the pattern and matches nothing. The run prints `# tests 0` and exits 0 — a silent green. Double quotes are stripped by `cmd.exe` and by POSIX shells alike, so Linux CI behaviour is unchanged. **2. Every text file is checked out as CRLF.** There is no `.gitattributes`, and `core.autocrlf=true` is the Git for Windows default. Biome formats with LF, so `biome check .` fails on 1632 of 1633 files. `desktop/src/features/messages/ui/virtuaWheelModePatch.test.mjs` fails too, because it matches `patches/*.patch` with `\n`-joined patterns. The stored blobs are already LF, so `eol=lf` adds no renormalisation churn — `git status` stays clean after the change. **3. `check:px-text` never finds its own allowlist.** `scripts/check-px-text-core.mjs` builds the key from `path.relative`, which returns `\` separators on Windows, while the allowlist in `desktop/scripts/check-px-text.mjs` is written with `/`. Nothing matches, so the check reports 5 false violations on a clean tree. **4. `check:file-sizes` examines nothing at all.** `findRule` compares against `` `${rule.root}${path.sep}` ``. The roots are multi-segment (`src/app`, `src/features`, `src-tauri/src`), so on Windows `src/app\` never matches `src\app\...`. No rule matches any file: the check walks 0 of 1097 files and exits 0. `scripts/check-pubkey-truncation-core.mjs` already normalises paths this way (`relativePath.split(path.sep).join("/")`). This applies the same idiom to the other two. ### Related issue None found — no open issue covers this. The closest open PR is #2758, which fixes a fifth Windows defect in `desktop/test-loader-hooks.mjs`; it is required before the desktop unit tests can pass here, and it does not overlap with these files. I checked the changed-file list of every open PR: none touch `.gitattributes`, `desktop/package.json`, `scripts/check-px-text-core.mjs` or `scripts/check-file-sizes-core.mjs`. ### Testing Windows 11 (10.0.26200), node 22.17.1, pnpm 11.4.0, clean checkout with the default `core.autocrlf=true`. | Command | Before | After | | --- | --- | --- | | `pnpm test` | `# tests 0`, exit 0 | 374 test files discovered, exit 1 | | `biome check .` | 1632 of 1633 files fail | 1633 checked, 0 errors | | `pnpm check:px-text` | 5 false violations | passes | | `pnpm check:file-sizes` | 0 of 1097 files examined, exit 0 | 1097 examined | `check:file-sizes` now reports `src-tauri/src/managed_agents/runtime.rs: 2220 lines (limit 2216)`. That violation is pre-existing and not introduced here — `main` currently fails on the same line in CI (Desktop Core, run 30185213010, commit c2a4ee7). Before this change Windows reported success while CI was red; now the Windows result agrees with CI. Desktop unit tests still fail on Windows until #2758 lands. With #2758 applied on top of this branch the full suite passes: 3515 tests, 0 failures. This change stops hiding those failures rather than fixing them. Signed-off-by: Seydi Charyyev <seydi.charyev@gmail.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com>	2026-07-27 13:00:25 -04:00
4 people	9d36778c37	feat(mobile): refactor Activity behavior and ui (#2889) ... **Category:** improvement **User Impact:** Mobile users can scan Activity as a focused conversation inbox and open the exact unread message or thread represented by each item. ## Context Mobile's Activity tab had not kept pace with Desktop: it presented isolated event headlines, advertised categories that were often empty, and opened a channel without clearly landing on the selected item. This PR brings the Mobile surface toward the conversation-oriented direction explored in Clay Delk's Desktop [Inbox refactor PR #2045](https://github.com/block/buzz/pull/2045), while adapting it to Mobile rather than copying the Desktop split-pane implementation. The related product/UX discussion is captured in the originating [Buzz thread](buzz://message?channel=a9bbc0e5-d25d-4740-849c-93c34bb578a4&id=a7d9a4d33dcd8c6bf0dc67d81c328892b9e38dedaa8548920224ef388301b6ab). ## UX decisions in this PR - **Conversation-oriented, not event-oriented:** related updates collapse into one row per thread/DM conversation, represented by the latest update and ordered by latest activity. Separate top-level conversations in the same channel remain separate rows. - **Resume at the oldest unread:** tapping a grouped row opens the represented canonical message/thread/DM at its oldest unread item, rather than merely opening the channel at an arbitrary position. - **Desktop-aligned row hierarchy:** rows lead with a full avatar and sender, followed by contextual location/type metadata, unread dot + time, and a two-line preview. A **New** boundary separates unread and read content. - **Mobile-native navigation:** Mobile keeps a single-column `Activity → canonical conversation → Back` flow. It does not introduce Desktop's persistent detail pane. - **Compact filtering:** the old horizontal chip rail becomes a compact filter menu so the source set fits a phone viewport without horizontal scanning. Filters are All, Mentions, Threads, Needs Action, Activity, Agents, Reminders, and Drafts. - **Focused source semantics:** All covers personally relevant work—DMs, mentions, thread replies, needs-action events, owned-agent activity, due reminders, and active drafts—rather than becoming a generic stream of every channel message. Mobile's standalone Activity source is currently limited to DM traffic because it does not have Desktop's aggregated channel-activity feed. - **Shared read behavior:** rows project canonical channel/thread/message markers, support unread-only and mark-all-read, and use local overrides only where canonical markers cannot represent an item. - **Reminders and drafts are real data:** reminders use the same encrypted NIP-ER events as Desktop. Drafts persist device-local composer state, restore on return, survive failed sends, and clear after successful sends. - **Explain navigation failures:** an unavailable destination produces an explanatory message rather than silently doing nothing or falling back to an unrelated channel position. ## Implementation summary - Adds a Mobile inbox model for conversation grouping, category priority, contextual labels, sorting, filtering, and oldest-unread targets. - Expands relay-backed sources for mentions, approvals, owned-agent lifecycle events, and DM traffic. - Adds fail-closed NIP-ER reminder decryption and device-local compose-draft persistence. - Redesigns Activity rows, boundaries, filters, unread controls, and empty/loading states. - Routes rows through Mobile's existing canonical channel/thread screens with precise target IDs. - Adds model, provider, widget, reminder, read-state, draft-lifecycle, and deep-link coverage. ## Reproduction steps 1. Run Mobile and open **Activity**. 2. Confirm full avatars, sender-first rows, context labels, unread indicators, timestamps, two-line previews, and the compact filter control. 3. Open the filter menu and verify All, Mentions, Threads, Needs Action, Activity, Agents, Reminders, and Drafts. 4. Tap a grouped thread row and confirm the canonical conversation opens at its oldest unread message. 5. Mark rows read/unread, enable unread-only mode, and use mark-all-read; confirm state agrees with the channel/thread destination. 6. Type without sending in a channel or thread, leave, and confirm the draft appears in Activity and restores in the composer. ## Screenshots | Before — merge-base `dd222a509` | After — PR head `52ad40aee` | |---|---| | <img width="1206" height="2622" alt="image" src="https://github.com/user-attachments/assets/ae961b08-bf8a-4bd5-b487-f6321ae8d85b" /> | <img width="1206" height="2622" alt="image" src="https://github.com/user-attachments/assets/bcbe7ab0-552a-417c-9e85-7a85eb4592ee" /> | Recaptured on the same authenticated iPhone 17 simulator, account, theme, and Activity view, at this PR's current merge-base (`dd222a509`) and head (`52ad40aee`). Both frames were taken within a few minutes on the same live feed, so the visible conversation set overlaps closely (the recent Ned/Bart/Tommy items appear in both). The compared change is the row *structure*: Before leads with an `@ Mention` headline over a small inline avatar and a horizontal chip rail; After leads with a full avatar, a compact `labelMedium` sender label, contextual "Mentioned in" metadata, and a filter menu. The sender username now renders at the same compact scale the old `@ Mention` label used. ## Verification - Current rebased head: `5bd87f4f4` on `origin/main` at `dd222a509`; GitHub reports the PR mergeable. - `flutter analyze` — clean at `5bd87f4f4`. - Full Mobile suite — 698 passed, 1 skipped, 4 failed; all four failures reproduce identically on clean `origin/main` (`channels_page_test` create-channel sheet and three `compose_bar_test` agent-mention cases). - The prior PR-specific `home_page_test` failures were fixed by providing the Activity local-state dependency in that harness. - Independent code and simulator UI review — approved. - Post-rebase GitHub checks are running. --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Signed-off-by: npub14vtk7pvazqrq9639qu7e560wnqtl0d53ca4gjuvq6jzf3k2el23qqlwa7f <ab176f059d100602ea25073d9a69ee9817f7b691c76a897180d48498d959faa2@buzz.block.builderlab.xyz> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> Co-authored-by: npub14vtk7pvazqrq9639qu7e560wnqtl0d53ca4gjuvq6jzf3k2el23qqlwa7f <ab176f059d100602ea25073d9a69ee9817f7b691c76a897180d48498d959faa2@buzz.block.builderlab.xyz>	2026-07-27 16:55:24 +00:00
Luke TornquistandGitHub	313f793c87	feat(desktop): add search to agent emoji picker (#2630) ... ## Why The agent avatar picker disables Emoji Mart search, making emojis difficult to find when creating or editing an agent. ## What - Enable sticky search in the shared agent avatar picker - Focus the search field when the Emoji tab opens - Add end-to-end coverage for search, focus, and selection ## Risk Assessment Low — this is limited to the desktop agent avatar picker and does not change avatar persistence or agent configuration. ## References - `pnpm --dir desktop test` — 3,448 passed - `pnpm --dir desktop typecheck` — passed - `pnpm --dir desktop exec playwright test tests/e2e/agents.spec.ts` — 20 passed --- **Update Jul 24, 16:28 EDT:** Completed `CONTRIBUTING.md` validation. ### Manual test 1. Create an agent and open Add avatar → Emoji. 2. Confirm the search field is focused and filters results. 3. Select an emoji and confirm it becomes the avatar. 4. Repeat while editing an existing agent. ### Validation - `just ci` — passed - `just test` — passed ### Follow-up work None. Generated with Codex	2026-07-27 09:47:31 -07:00
mikeyandGitHub	be275cfc6c	fix(desktop): keep identity key help dialog readable in dark mode (#2854) ... ## Problem With macOS in dark mode (the default for fresh profiles is to follow the system scheme), the onboarding "What's an identity key?" help dialog renders its title in near-white on the always-white textured card, making it unreadable. The body paragraphs stay readable because they use the fixed olive `--buzz-onboarding-backup-ink`; only the `text-foreground` title (and the close button's hover color) flip with the theme. ## Cause The dialog's `DialogContent` carries `buzz-onboarding-neutral-theme` but is portaled outside the `buzz-startup-shell` subtree, so in dark mode it matches `.dark .buzz-onboarding-neutral-theme:not(.buzz-startup-shell)` (`components.css`), which flips `--foreground` to `0 0% 98%`. The textured powder card (`buzz-card-textured`) has no dark variant — it is baked light — so the near-white title disappears against it. ## Fix One attribute: pin the dialog to the light neutral theme with `data-system-color-scheme="light"`. This is the established pattern for always-light onboarding dialogs (`HostedCommunityOnboarding.tsx`, the `CommunityOnboardingFlow.tsx` avatar dialog), and the pinned-light CSS rule already exists and out-specifies the dark-mode flip. No new CSS. ## Testing - Added a dark-mode regression test to `tests/e2e/identity-key-help.spec.ts` (already registered in the Playwright smoke project): emulates `prefers-color-scheme: dark`, opens the dialog, and asserts the title resolves to the pinned light-neutral ink `rgb(23, 23, 23)`. Before the fix it rendered `rgb(250, 250, 250)`. - Manual repro: macOS appearance set to Dark → fresh profile → machine onboarding → click "What's an identity key?". Before/after screenshots are in the comment below. Signed-off-by: Michael Pfister <pfista@gmail.com>	2026-07-27 09:47:02 -07:00
Will PflegerandGitHub	f2fe3b63c2	feat(acp): title agent sessions from the agent and channel name (#3028) ... ACP harnesses that name a session from the first text they receive all land in the same place: every managed Buzz agent opens with the identical `[Base] You are operating inside the Buzz platform…` framing, so the harness session list shows a wall of indistinguishable rows. Because sessions are keyed per channel, one agent active in several channels produces several of them. This sends the name out of band instead. `session/new` carries `_meta.sessionTitle` with `Agent · #channel`, composed from the agent's `display_name` (or its unique `name` handle) and the channel it is serving. The prompt is untouched — no tokens spent, no perturbation of the prompt contract, and nothing new for the desktop observer's section parsing to handle. The mechanism is harness-agnostic: Buzz sends the field on every ACP `session/new` regardless of which harness is behind it, and adapters that don't read it ignore it per spec. ## Inert until a consuming adapter ships ACP adapters ignore `_meta` members they do not recognize, so against an adapter with no reader a Buzz session gets no title and nothing else changes. Three adapter halves consume it — Codex, Goose, and Claude Code (linked below); this half and each reader are only useful together, and each reader lands independently. No version floor is added. `codex_adapter_is_outdated_with_path` already gates codex-acp on major version `>= 1` (`desktop/src-tauri/src/managed_agents/discovery.rs:1276-1284`) and this feature needs nothing above that — an older adapter is not broken by the extra member, it simply ignores it. ## What changes **`crates/buzz-acp`** owns sanitization and composition. `sanitize_session_title` collapses whitespace, drops control characters, and caps at `SESSION_TITLE_MAX_CHARS` (80) by character, not byte, so a multi-byte character cannot be split. `compose_session_title` truncates only the channel part against that cap, so the agent name always survives; when the agent name alone fills the cap the channel is dropped rather than the name. `session_new_full` sets `_meta.sessionTitle` when a title exists and omits `_meta` entirely when it does not, since an adapter may distinguish an absent member from a null one. **`desktop/src-tauri`** only resolves and exports. `resolve_session_title` picks `display_name` or falls back to `name`, and `spawn_agent_child` writes it to `BUZZ_ACP_SESSION_TITLE` — or removes the variable when neither candidate yields anything printable. DMs, unresolved channels, and heartbeat sessions get the bare agent name with no channel suffix. ## Four properties that are easy to remove by accident **Control characters are stripped at the desktop boundary, not in the harness.** An interior NUL cannot cross the environment boundary at all — `Command::env` fails the entire spawn rather than passing it through. Deferring the strip to `buzz-acp` would let a corrupted display name turn display chrome into a spawn failure. A display name that is *only* control characters falls back to `name`. **The title is hashed into `spawn_config_hash`.** Without it, renaming an agent left the running process with a stale title and no restart badge. The hash runs the same `resolve_session_title` the spawn writes, and skips it when a user env override shadows `BUZZ_ACP_SESSION_TITLE` — spawn writes the title *before* the layered user env, so the override is what actually runs, and it already reaches the hash through `descriptor.env`. Hashing the record-derived value under an override would badge a rename that changes nothing. **One channel resolve serves both consumers.** `resolve_new_session_channel_context` returns `(is_dm, title_channel)` from a single metadata lookup, feeding both the canvas block's DM check and the title. `ChannelInfoResolver` caches only `Some`, so two independent calls against an unresolvable channel pay the full `fetch_channel_info` retry sequence twice — two timeouts plus a retry delay each — directly in front of `session/new`, precisely when the relay is already degraded. **The `"unknown"` channel name is treated as absent.** `fetch_channel_info` substitutes the literal `"unknown"` for a metadata event with no `name` tag. Composing that sentinel would title every unnamed channel `Agent · #unknown`, reintroducing the exact collision the suffix exists to remove while naming a channel something it isn't. The startup cache already refuses `channel_type == "unknown"` for the same reason. Closes #2334 Related — the adapter halves that consume `_meta.sessionTitle`: - [codex-acp#338](https://github.com/agentclientprotocol/codex-acp/pull/338) — Codex - [aaif-goose/goose#10712](https://github.com/aaif-goose/goose/pull/10712) — Goose - [claude-agent-acp#920](https://github.com/agentclientprotocol/claude-agent-acp/pull/920) — Claude Code --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-07-27 12:46:43 -04:00
3 people	68f39f3697	feat(mobile): bring message actions to desktop parity (#3070) ... **Category:** new-feature **User Impact:** Mobile users can copy permalinks, revisit, follow, and manage messages through a clearer long-press menu that matches desktop capabilities. **Problem:** The mobile message menu exposed only a small subset of desktop actions, and important workflows such as copying a permalink or scheduling a reminder were unavailable or hard to discover. **Solution:** Bring applicable desktop actions to mobile using native patterns, promote Reply, Copy link, and Remind me above the fold, and group the remaining actions by intent in a scrollable sheet. **Intentional behavior changes (per review):** - The quick-reaction row goes from 6 emojis to 4 (👀 and 🙏 dropped) to make room for larger 52px tap targets alongside the `+` picker, which still offers the full set. - **Copy link — not a native share sheet — is the permalink path.** An earlier revision shipped a `share_plus` Share message row; it was removed in review since Copy link covers the job and custom-scheme `buzz://` URIs are handled inconsistently by share targets. Native share can return as a follow-up with an https fallback. - Mark unread is message-scoped and session-local: it forces just that message unread (surfacing its channel as unread), and message-level Mark read can never clear a channel-level unread set from the channel tile. <details> <summary>File changes</summary> **mobile/lib/features/channels/channels_provider.dart** Feeds followed thread roots into unread and notification evaluation so following a thread has meaningful behavior. **mobile/lib/features/channels/message_actions.dart** Reworks the long-press sheet with promoted fast actions, message links, reminders, read state, thread following, and clearer action grouping while preserving existing guards. Quick-reaction circles share one extracted widget. **mobile/lib/features/channels/read_state/message_read_state.dart** Centralizes message-level unread evaluation across channel, message, and thread markers; channel-level forced unread deliberately does not leak into message state. **mobile/lib/features/channels/read_state/read_state_provider.dart** Forced-unread flags are per-context (channel id or `msg:` key) mapped to their channel, so message- and channel-level unread choices round-trip independently. **mobile/lib/features/channels/thread_follows/thread_follows_provider.dart** Exposes per-identity thread follow state to the message menu and notification pipeline. **mobile/lib/features/channels/thread_follows/thread_follows_storage.dart** Persists a bounded, validated set of followed thread roots on the device. **mobile/lib/shared/reminders/remind_me_later_sheet.dart** Adds reminder presets and a native custom date/time flow for deferring a message. Lives under `shared/` so the channels feature never imports another feature module. Cancelling the custom picker keeps the preset sheet open; submission failures show stable copy and log the underlying error. **mobile/lib/shared/reminders/reminder_service.dart** Creates desktop-compatible, self-encrypted kind-30300 reminder events. **mobile/lib/shared/reminders/reminder_time_presets.dart** Defines reminder choices that match the desktop experience. **mobile/lib/shared/deeplink/deep_link.dart** Builds canonical Buzz message links, including thread context when present. **mobile/lib/shared/relay/nostr_models.dart** Adds the reminder event kind to the shared Nostr model constants. **mobile/lib/shared/widgets/sheet_divider.dart** Shared bottom-sheet section divider used by the message actions and reminder sheets. **mobile/test/features/channels/message_actions_test.dart** Covers action visibility and guards, promoted actions, read/unread round-tripping (including channel- vs message-level force isolation), thread follows, and canonical links. **mobile/test/features/channels/read_state/message_read_state_test.dart** Covers unread precedence for channel, message, and thread contexts. **mobile/test/features/channels/thread_follows/thread_follows_storage_test.dart** Covers follow persistence, identity separation, validation, and storage bounds. **mobile/test/shared/reminders/reminder_service_test.dart** Covers reminder payloads, tags, crypto round-tripping, and preset behavior. **mobile/test/features/channels/read_state/read_state_provider_test.dart** Drives the production ReadStateNotifier/ReadStateManager (no fake bookkeeping) through message unread → read → unread round-trips, explicit channel-level Mark read clearing forced messages, and automatic channel-open reads preserving them. **mobile/test/shared/reminders/remind_me_later_sheet_test.dart** Covers custom-picker cancel keeping the sheet open, stable failure copy without the raw error, and the happy preset path. **mobile/test/shared/deeplink/deep_link_test.dart** Covers canonical top-level and threaded message-link generation. </details> ## Reproduction steps 1. Run the mobile app with a signed-in identity and open a channel containing regular messages and threads. 2. Long-press a message and confirm reactions plus Reply, Copy link, and Remind me appear as fast actions above the fold. 3. Use Copy link; confirm the resulting `buzz://message` link opens the correct channel and thread context. 4. Toggle Mark unread/Mark read and Follow thread/Unfollow thread, reopening the sheet to confirm each state changes correctly. Force a channel unread from the channel tile, then mark a message read — the channel stays unread. 5. Choose a reminder preset and a custom date/time; confirm the reminder is created and appears in the desktop reminder experience. Cancel the custom date picker and confirm the reminder sheet stays open. 6. Long-press a system message and a message you cannot manage; confirm utility and destructive actions remain appropriately hidden. ## Screenshots / demos <img width="1206" height="2622" alt="image" src="https://github.com/user-attachments/assets/81096cd6-329b-408f-bcff-712e23b268a4" /> --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-07-27 09:45:09 -07:00
3 people	18eef633d8	feat(git): use agent display name as git author name (#3040) ... Agent commits were authored by a raw 63-character npub, which makes `git log`, `git blame`, and GitHub's author column effectively unreadable. This uses the agent's display name for `user.name` instead, while leaving the pubkey where it does real work. ## What changes `build_git_env` in `crates/buzz-dev-mcp/src/shim.rs` now reads `BUZZ_ACP_DISPLAY_NAME`, sanitizes it, and uses the result as `user.name`. When the variable is absent or unusable it falls back to `info.npub` — byte-identical to today's behavior. `user.email`, `user.signingkey`, and the whole credential/signing block are untouched. The pubkey is what NIP-98 auth, NIP-GS signing, and contributor matching key on, and it stays in the email verbatim. `crates/buzz-acp/src/lib.rs` forwards the variable into the dev-mcp server's declared env, mirroring the existing `BUZZ_AUTH_TAG` block. It reads `std::env::var` directly rather than going through `Config`, so the variable is picked up whenever the process has it. `crates/buzz-agent/src/mcp.rs` adds one `PASSTHROUGH_ENV` entry so ACP clients that spawn `buzz-agent` without declaring the variable on the wire still propagate it. ## Why a dedicated variable `BUZZ_ACP_DISPLAY_NAME` is its own contract rather than a reuse of the ACP session title. Commits outlive sessions: a session title is per-session UI chrome and may be composed downstream into `Agent · #channel`, and if that composed form ever reached the env var, git attribution would change silently with no test able to catch it. Git identity gets a variable whose contract is "bare agent display name, never channel-qualified." Nothing writes it yet — a one-line Desktop write lands as a follow-up. Until then `std::env::var` returns `Err`, the npub fallback fires, and behavior is byte-for-byte current `main`. ## Sanitizing Strip control characters, Unicode format characters, and angle brackets; collapse whitespace runs, trim, cap at 80 characters (by `chars()`, so a multi-byte name is never split mid-UTF-8). Angle brackets go because git drops them silently rather than erroring: `Duncan <evil@x.com>` renders as `Duncan evil@x.com <hex@relay>`. It forges nothing, but it reads as though it might. The empty result also has to cover more than literal emptiness. git's `ident.c` treats a set of characters as "crud" — stripped from both ends, and fatal when a name is *nothing but* those characters: ``` $ git -c user.name=';;' commit -m t fatal: name consists only of disallowed characters: ;; ``` Verified against git 2.54.0 by committing with each ASCII byte 32..=126 as the entire `user.name`: exactly space, `"`, `'`, `,`, `:`, `;`, `<`, `>`, `\` abort, plus all control characters (the predicate is `c <= 32`). `.` is not crud in this version, despite older lore. Names that merely *contain* crud are fine — `O'Brien` and `Smith, Jr.` both commit cleanly — so the check is "at least one non-crud character survives," not "no crud present." Without it, a display name of `;;` or `""` would abort every commit that agent makes. ## Unicode format characters `char::is_control` covers only category `Cc`. Category `Cf` — zero-width spaces and joiners, bidi embedding and override marks, invisible math operators, tag characters — is neither control, nor whitespace, nor git crud, so those characters survived every one of the checks above. A display name of nothing but U+200B ZERO WIDTH SPACE therefore satisfied "at least one non-crud character survives" and git accepted the commit with a visually blank author: ``` # pre-fix, BUZZ_ACP_DISPLAY_NAME set to two U+200B $ git log -1 --format='%an' | xxd -p e2808be2808b0a ``` Embedded marks were the other half: a trailing U+202E RIGHT-TO-LEFT OVERRIDE reorders everything after it, so a stored author line renders as something other than what it stores — the same confusion class the angle-bracket filtering exists to prevent. `is_unicode_format` rejects the whole `Cf` category rather than the known-bad marks, because the boundary that matters is "invisible or reorders text", not "the codepoint someone thought of". The 21 ranges come from the UCD's `DerivedGeneralCategory.txt` (17.0.0), cross-checked against Python's `unicodedata` (16.0.0); both yield exactly the same set. They are inlined as a `matches!` rather than pulling in a Unicode-tables crate for one predicate, and a test asserts both endpoints of every range plus the codepoints immediately outside them — including U+2065, which sits inside the U+2060 block but is unassigned rather than `Cf`. Filtering happens inside the existing per-word filter, so a format-only name collapses to empty and falls out through the same `None` → npub path as a crud-only name. No new fallback logic. And because filtering precedes truncation, invisible padding cannot eat the 80-character budget. ## NUL is handled one layer up An interior NUL is a sibling constraint that cannot be fixed here: it makes `Command::env` fail the entire spawn before this code runs, so it has to die at the writer. #3028 establishes that pattern for the session title in `resolve_session_title` via `filter(|c| !c.is_control())`, and the Desktop follow-up that writes `BUZZ_ACP_DISPLAY_NAME` inherits it. The shim sanitizer is a second line of defense for values that arrive from somewhere other than Desktop. ## Verified end to end Driving the real `buzz-dev-mcp` binary over stdio MCP and committing inside its shimmed environment: ``` # BUZZ_ACP_DISPLAY_NAME="Duncan Idaho" Duncan Idaho <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 # BUZZ_ACP_DISPLAY_NAME unset npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 # BUZZ_ACP_DISPLAY_NAME=";;" (crud-only; would otherwise be fatal) npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 # BUZZ_ACP_DISPLAY_NAME=U+200B U+200B (format-only; would otherwise be blank) npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 # BUZZ_ACP_DISPLAY_NAME="Duncan" + U+202E (bidi override stripped) Duncan <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 # BUZZ_ACP_DISPLAY_NAME="Dun" + U+200B + "can" (zero-width removed, word not split) Duncan <dcfd242e...0f95@buzz.block.builderlab.xyz> verify_exit=0 ``` Signature verification passes in every case — the signing identity is unchanged. `Related: #3028` — it establishes the Desktop-side env plumbing this builds beside; the one-line Desktop follow-up that writes `BUZZ_ACP_DISPLAY_NAME` alongside the session title ships after it merges. Not a dependency: with the variable absent, `std::env::var` returns `Err` and the npub fallback keeps current behavior exactly. --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-27 12:28:32 -04:00
4 people	e2e0079101	fix(security): enforce durable community ban on NIP-43 relay-admin kinds 9030-9033 (#3128) ... ## Summary `ingest_event`'s durable write-path restriction gate exempts NIP-43 relay-admin kinds **9030–9033**, so that a *timed-out* admin keeps administrative capability. That exemption was ban-blind, and `handle_relay_admin_event` performed no restriction check of its own. A **banned** admin or owner could still add members, remove members, change member roles, and set the workspace icon by posting a signed NIP-98 request to `POST /events`. No open WebSocket required. Reported externally by **Bilal Syed** (also filed publicly as #3020 before he read `SECURITY.md`). Verified true, reproduced live, and found slightly worse than reported. Same class as BUZZ-SEC-007, which PR #1915 closed for moderation command kinds 9040–9044. That fix was never extended to the 9030 range. ## Why it worked - `handlers/ingest.rs:1639` skipped the restriction check when `is_relay_admin_kind(kind)` was true. - `handlers/relay_admin.rs` did a freshness check and a role lookup only — zero restriction reads in the file. - A ban does not remove the role: `ban_member` (`buzz-db/src/moderation.rs:314`) writes only `community_bans`, so the `relay_members` admin row survives. - The HTTP path never consulted ban state — `enforce_relay_membership` is a bare `SELECT 1 FROM relay_members`. - The ban was enforced only at the NIP-42 auth seam, which an HTTP request never crosses. **Worse than reported:** the report covered remove (9031) and icon (9033). Add (**9030**) works too, so a banned admin can *plant* new members. That matters because `moderation_authz.rs:163-170` derives "an admin cannot ban an owner or fellow admin" from `relay_members` — the very table 9030/9031 mutate. A banned admin could seed accomplices into the roster the ban was meant to stop them touching. Also of note: `moderation_authz.rs:158-165` already asserts in a comment that *"The command handler separately rejects a banned actor on every transport."* `relay_admin.rs` was the one command handler not holding that invariant. ## The fix Enforce the durable ban **inside `handle_relay_admin_event`** — the reporter's own suggested shape, and the `moderation_commands.rs:99-108` precedent. Deliberately **not** the one-token alternative of dropping `&& !is_relay_admin_kind(kind_u32)` at `ingest.rs:1639`: that would also start blocking *timed-out* admins, silently changing policy. Bans are refused; timeouts still administer, which is the entire reason the exemption exists. `handle_relay_admin_event` becomes a thin admission wrapper around an unchanged `execute_relay_admin_command` body, so no future early return inside that body can precede the check. The check therefore also necessarily precedes the freshness check. **The refusal category is part of the security contract**, so this returns a typed `RelayAdminError` rather than a string. A `blocked:` string would have kept the right wire text but returned **400** instead of **403** (`api/bridge.rs:845` vs `:858`), and would have reported a restriction-DB outage as a client error: | Variant | Ingest | Wire | HTTP | |---|---|---|---| | `Banned` | `AuthFailed` | `blocked: you are banned from this community` | **403** | | `Rejected(..)` | `Rejected` | `invalid: …` | 400 (unchanged) | | `Internal(..)` | `Internal` | `error: …` (sanitized) | **500** | ## Verification Live over real HTTP against an isolated relay, all four exempt kinds refused, DB checked after each for non-mutation: ``` [banned] 9031 remove -> 403 blocked: you are banned from this community [banned] 9030 add -> 403 blocked: you are banned from this community [banned] 9032 change role -> 403 blocked: you are banned from this community [banned] 9033 set icon -> 403 blocked: you are banned from this community ``` Victim still `member`, planted key absent, role target unchanged, icon still NULL. 9032 required a banned **owner** to be a real test, since it is owner-only. - **Mutation-tested.** The admission decision is the pure `admits_relay_admin_command(&RestrictionState)`, covered by the *default* suite. Neutering it fails `banned_actor_is_not_admitted_to_a_relay_admin_command`. The first version of this patch would have stayed green if someone deleted the check — that gap is closed. The unit test does not prove handler *wiring*; the `#[ignore]`d live E2E is what checks linkage. - **Fail-closed proven empirically**, by manual fault injection rather than assertion: renaming `community_bans.banned` out from under the running relay yields 500, no mutation, and no schema detail leaked to the client. - Negative/positive controls: timed-out admin still administers *and* is still content-write-blocked; clean admin unaffected with mutation confirmed; non-admin still gets `invalid:`/400. - Reviewed iteratively by **@Mari** over three rounds; final approval at 9/10+ on minimalness, elegance, and correctness. She also ran an independent deep regression pass on an isolated stack (odd port 44391) covering channel lifecycle, membership, messages/replies/search/edit/delete, reactions, canvas, DMs, and moderation transitions — no regressions. - `cargo fmt --all --check`, `cargo clippy -p buzz-relay --all-targets -D warnings`, `buzz-core` 229/229, `buzz-cli` 250/250, `run-tests.sh unit` all five packages green. - `buzz-relay --lib`: **756 passed / 1 failed**. The sole failure `api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo` (504 vs 200) is **pre-existing** — reproduced identically in a detached worktree at merge base `00ecf2c`. ## Notes for the reviewer - Merged `origin/main` in as a merge commit rather than rebasing, per instruction. No conflicts; the eight incoming commits touch none of the three files here. Closest neighbour is `00ecf2c` (kind:9000 NIP-29 *channel* role authz) — disjoint from this NIP-43 *relay-admin* fix. - **This does not close the class.** Two separate items remain open, deliberately excluded to keep an externally-known security fix reviewable: 1. **Command kinds dispatch before the gate.** `is_command_kind` fires at `ingest.rs:1561`, ~80 lines *before* the restriction gate, and `command_executor.rs` has no restriction read. Measured live: a banned member can still open a DM (41010 → 200). 41011/41012/30620/46030/46031 unprobed. Needs per-kind semantics enumerated first (reports allowed while banned; moderation commands allow timeouts but reject bans; ordinary writes reject both). 2. **`moderation_commands.rs` maps its own restriction-DB failure to 400, not 500**, and leaks the raw Postgres message to the client. - One correction for the public issue: its repro step 1 says `kind:9041`, which is **unban**. The ban is **9040** (`KIND_MODERATION_BAN`, `buzz-core/src/kind.rs:298`). Following the steps verbatim yields a false negative. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> --------- Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell <tlongwell@block.xyz>	2026-07-27 12:17:14 -04:00
3 people	fe84274d21	chore(deps): update react monorepo to v19.2.8 (#3064) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react)) | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.7/19.2.8) |  |  | | [react-dom](https://react.dev/) ([source](https://redirect.github.com/react/react/tree/HEAD/packages/react-dom)) | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.7/19.2.8) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/1) for more information. --- ### Release Notes <details> <summary>react/react (react)</summary> ### [`v19.2.8`](https://redirect.github.com/react/react/compare/v19.2.7...1dd4ecbdabf826f527fc9a58c05ea70375b7d170) [Compare Source](https://redirect.github.com/react/react/compare/v19.2.7...v19.2.8) </details> <details> <summary>react/react (react-dom)</summary> ### [`v19.2.8`](https://redirect.github.com/react/react/compare/v19.2.7...1dd4ecbdabf826f527fc9a58c05ea70375b7d170) [Compare Source](https://redirect.github.com/react/react/compare/v19.2.7...v19.2.8) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/block/buzz). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-27 12:05:43 -04:00
4 people	31e2de1966	fix(deps): bump nostr to 0.44.6 for RUSTSEC-2026-0216 (NIP-44 remote DoS) (#3135) ... ## Summary `cargo-deny` started failing on **every** PR and on `main` when **RUSTSEC-2026-0216** was published mid-afternoon today. Nothing in the tree changed — cargo-deny fetches the advisory DB at run time, so main's own `Security` job passed at `00ecf2c` and then began failing on the same commit. ``` error[vulnerability]: Remote Denial of Service via malformed NIP-44 v2 payload Cargo.lock:432 nostr 0.44.3 — RUSTSEC-2026-0216 advisories FAILED, bans ok, licenses ok, sources ok ``` The `nostr` NIP-44 v2 decrypt path reads a 2-byte unpadded-length prefix via `buffer[0..2]` **after** the HMAC check passes, without verifying the decrypted buffer holds 2 bytes. A sender who holds the conversation key — i.e. any DM sender — can craft a payload that decrypts to 0 or 1 bytes and panic the receiver. Remote DoS through any relay that delivers the event. No key material, plaintext, or memory corruption. Affects `0.26.0` through `0.44.4`. Fixed in `0.44.5`. ## The change Lockfiles only, 6 insertions / 6 deletions. The manifest already declares `nostr = "0.44"` — a caret range — so `0.44.6` needs no `Cargo.toml` edit. | Lockfile | Before | After | |---|---|---| | `Cargo.lock` | 0.44.3 | 0.44.6 | | `desktop/src-tauri/Cargo.lock` | **0.44.4** | 0.44.6 | **The desktop lockfile is the part worth reviewing.** `desktop/src-tauri` is excluded from the root workspace (`Cargo.toml:31`), and the `Security` job runs `cargo-deny check` at the repo root — so it never sees that lockfile. It was pinning a vulnerable *and* yanked `0.44.4` that no CI check would ever have flagged. Desktop calls `nip44::decrypt` at `commands/identity.rs:495`. Credit to @Eva for catching this; I'd have shipped the root-only fix and left it sitting there. **This isn't optional maintenance.** `0.44.0` through `0.44.4` are all yanked on crates.io. `0.44.5` and `0.44.6` are the only live versions in our range — staying put isn't an available option. ### On the two extra lines in the desktop lockfile The desktop bump also repoints two existing dependency edges: ``` nostr-derive: syn 2.0.118 -> syn 1.0.109 tempfile: getrandom 0.4.3 -> getrandom 0.3.4 ``` I checked these rather than waving them through: **no packages are added or removed** — both versions were already present in the graph, so only which edge points where changed. The resolution is stable across repeated re-resolves, and a plain re-resolve without the bump produces zero diff, so this isn't pre-existing lockfile staleness leaking in. ## Verification At this commit, in a clean worktree off `origin/main`: - `cargo-deny check advisories` → **`advisories ok`**, exit 0. The same tree before the bump reported `advisories FAILED` with this advisory, so the check is doing real work, not passing vacuously. - `./scripts/run-tests.sh unit` → all five packages pass. - `cargo test -p buzz-core` 229/229, `-p buzz-cli` 250/250, `-p buzz-relay --lib` 750 pass / 1 fail — the sole failure `api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo` is pre-existing and reproduces identically at unmodified `00ecf2c`. - `desktop-tauri-test` passed in the pre-push hook, which exercises the crate whose lockfile changed. ## Why not a `deny.toml` ignore Considered and rejected. This is a reachable panic triggerable by any DM sender, and buzz-acp agents decrypt DMs from arbitrary senders. Suppressing it would ship a live remote-DoS to every agent and client in order to make a dashboard green. ## Note on `spin` The yanked `spin 0.9.8` / `0.10.0` warnings in the same job are **not** what fails CI — the log has exactly one hard error, this one. They're `warning[yanked]`, and warnings don't fail the build. `spin` is also three levels transitive (`mesh-llm-host-runtime → mdns-sd → flume → spin`) under a dev-dependency, so it isn't ours to bump. Left alone deliberately. ## Follow-up Unblocks #3128 (relay-admin ban gate), which has a zero dependency-file delta and will inherit this cleanly once main is merged in. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell <tlongwell@block.xyz>	2026-07-27 12:04:23 -04:00
Will PflegerandGitHub	4ef5f10ce4	docs(contributing): set PR expectations and require UI screenshots (#3140) ... ## Summary Follows up on the `CONTRIBUTING.md` refresh in #2780. With contributor volume up, the guide describes what a good PR looks like but never says what won't land or what happens after you open one. This closes those gaps in three additions, keeping the welcoming tone of the refresh: - **UI screenshot requirement** — a new item under "What a Good PR Looks Like": PRs changing desktop or mobile UI must include before/after screenshots (or a short recording). Also adds a one-line prompt to the PR template's Testing section. - **"PRs We're Unlikely to Merge"** — a short, positively-framed list (large refactors/dependency swaps without a prior issue, style-only churn, undiscussed new features, drive-by bundled changes) with a pointer to open an issue first. - **"What to Expect After You Open a PR"** — replaces the "Review Process" section: best-effort triage cadence, guide-skipping PRs may be closed with a pointer here, and a close isn't a rejection — address the gaps and reopen anytime. Retains the existing no-force-push and squash-merge guidance. ### Related issue N/A — follow-up to #2780; no duplicate PRs found. Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-07-27 11:57:09 -04:00
3 people	654f384906	fix(desktop): read the newest pair-scoped harness log (#3134) ... Harnesses became per (agent, relay) pair in #2122 and now write `agents/logs/{pubkey}__{sha256(relay_url)}.log` via `managed_agent_runtime_log_path`. `get_managed_agent_log` was never updated and still read the legacy `agents/logs/{pubkey}.log`, so agent profile → Runtime → Harness Log froze at each agent's last single-runtime line while live output accumulated in files the reader never opened. The reader now resolves the log through `latest_managed_agent_log_path`, which picks the most recently modified file belonging to the agent — pair-scoped `{pubkey}__*.log` or legacy `{pubkey}.log` — and falls back to the legacy path when the agent has no log on disk at all. Agents that have not restarted since the update keep working, and the panel follows whichever harness is currently writing. The response already carried `log_path`, so the panel header names the file being shown. Selection is deterministic: equal mtimes break toward the higher filename, and files belonging to other agents or without a `.log` extension are never candidates. `storage.rs`'s inline test module moves to a `#[path]`-included sibling `storage_tests.rs`, matching the existing pattern in `teams.rs` and `archive/mod.rs`. This drops both halves under the desktop file-size limit (1383 → 826 / 701), so the ratchet entries tighten instead of growing. Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-27 11:45:03 -04:00
3 people	00ecf2cac7	fix(security): authorize kind:9000 role changes in both directions (#3017) ... ## Summary NIP-29 `kind:9000` (PUT_USER) role changes were only authorized when the **new** role was elevated. Demotions were unauthorized, so any authenticated user could strip a channel owner to `member` with a single event — and the demotion was unrecoverable, since the ex-owner then lacked the privilege to restore themselves. Reported by @Tyler in `#buzz-security`. Verified true, plus two adjacent defects the report flagged and one it did not. ## The defects 1. **Demotion unauthorized.** The actor check only fired when the *requested* role was elevated. Lowering someone's role skipped it entirely. 2. **Open channels skipped the actor check.** It was nested under `visibility == "private"`. 3. **`add_member` had no last-owner guard** while `remove_member` did — so a channel could be left with zero owners. 4. **(Not in the report.)** An absent `role` tag defaulted to `Member`, so a bare self-targeted PUT_USER silently demoted the sender. No attacker required. ## The fix **`crates/buzz-db/src/channel.rs`** — the authority, because it also covers the desktop/admin callers that bypass the relay validator: - Changing an **active** member's role requires an elevated actor **in both directions**. Re-adding at the same role stays unguarded and idempotent (the huddle bot-add and `kind:9021` join paths depend on this). - Last-owner guard in `add_member`, mirroring `remove_member`. - Keyed on the **active** role (`removed_at IS NULL`). A soft-removed row's role is history, not live authority — otherwise soft-deleted ownership becomes a resurrection token: a kicked owner self-rejoins via `9021` and silently regains ownership. - New `pg_advisory_xact_lock` on a channel-membership namespace, taken as the first statement in both `add_member` and `remove_member`. Both read an owner `COUNT` and then write a *different* row, so READ COMMITTED alone lets two concurrent demotions each observe 2 owners and together leave 0. - `remove_member`'s `is_agent_owner` lookup moved before the transaction opens — it borrows a second pool connection, and issuing it while holding the lock could self-deadlock on a small pool. Safe because `agent_owner_pubkey` is immutable (first-mint-wins). **`crates/buzz-relay/src/handlers/side_effects.rs`**: - Role tag is now `Option` — absent means "no role change requested" rather than defaulting to `Member`. - Actor-role lookup hoisted out of the `visibility == "private"` block, so open channels are covered. - Role-change and last-owner guards on every visibility. Rejecting here *as well as* in the DB means clients get a real error instead of an `OK` whose side effect then fails silently. ## Verification **Mutation tested — every guard stubbed individually to confirm a test actually dies.** Three of eight guards were originally uncovered and survived being disabled with the suite fully green: | Guard | Dying test | |---|---| | DB actor-auth | *survived* → **new** `unprivileged_member_cannot_demote_a_co_owner` | | DB last-owner | `owner_can_still_manage_roles_after_demotion_guard` | | DB active-role (soft-remove) | `kicked_owner_rejoins_as_member_not_owner` + 3 | | `add_member` advisory lock | `membership_writes_serialize_on_the_shared_channel_lock` | | `remove_member` advisory lock | + `remove_member_rejects_an_actor_demoted_while_it_waited` | | relay no-role-tag preservation | `test_nip29_put_user_without_role_tag_preserves_role` | | relay actor-auth | *survived* → **new** `test_nip29_relay_rejects_role_change_by_unprivileged_actor` | | relay last-owner | *survived* → **new** `test_nip29_relay_rejects_last_owner_self_demotion` | The three gaps shared one cause: every existing test asserts resulting **state** ("the role did not change"), and the DB guards enforce that state, masking every layer above them. With a relay guard stubbed the relay answers `accepted:true` and logs `Side effect failed: access denied: ...` while the state assertion still passes — the entire relay validator could be deleted unnoticed. The new relay tests assert `accepted == false` instead, the one observable only the validator controls. Each new test is verified in both directions: green against the real fix, failing with its intended message when its guard alone is stubbed. **Test runs** (at `9461eedb`): - `buzz-db`, serial: **210 passed / 3 failed** — the same 3 failures as clean `main` (202/3), which are pre-existing and unrelated (`concurrent_same_owner_create…`, `create_community_with_owner_is_atomic…`, `test_usage_metrics_lock_has_single_owner…`). +8 = the new tests. - `e2e_relay --ignored`: **40 passed / 3 failed**. Clean `main` on the same relay is 35/6 — the same 3 infra failures (`test_invite_mint_and_claim…`, `test_subscription_limit_enforced`, `test_unarchive_emits_member_added_notification`) plus the 3 security tests that fail unpatched and pass here. - `cargo fmt`, `clippy`, `git diff --check` all clean. **Live manual drive** against a locally running relay, using raw `nak`-signed events (the `buzz` CLI refuses malformed `kind:9000`, so the guards have to be exercised directly): - *Rejected:* member demotes owner; member demotes admin; self-promote to owner; self-promote to admin; admin demotes the last owner; sole owner self-demote; demoted ex-owner demotes last owner; private-channel member demotes owner; non-member demotes owner in private. - *Allowed:* bare PUT_USER with no role tag (owner keeps role); idempotent re-add at same role; owner promotes admin→owner, then owner2 legitimately demotes owner1. - *Resurrection defeated:* owner promotes attacker to admin → kicks them (`9001`) → attacker self-rejoins (`9021`) → returns as **member**, not admin, and cannot demote the owner. - Normal ops unaffected throughout: channel creation, messaging, member listing, and legitimate governance all work. ## Behavior change to be aware of Huddle bot-add sends `role="bot"`. If the target is **already an active member at a different role**, that is now a role change and requires an elevated actor. Previously it silently re-roled them — the same privesc primitive through a different door, so narrowing it is intended. This does not break the huddle flow in the path that matters: the ephemeral channel add (the one that fails hard) is performed by the host, who *created* that channel and is therefore its owner — verified live. The parent-channel add is already explicitly best-effort, capturing the error into `parent_error` with a comment anticipating "may already be member"; adding a non-member agent there still works. Flagging it rather than burying it. ## Notes - Commit is **signoff-only, not cryptographically signed** — `-S` fails in this environment (git tries to load the agent npub as an SSH key file). DCO trailers are present and correct. - Branch was merged with `origin/main` via `--no-ff` (not rebased). Upstream had 17 commits, none touching these files, no migration changes. --------- Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>	2026-07-27 10:24:19 -04:00
thomaspblockandGitHub	c5c4f390b6	feat(desktop): handle project work from Inbox (#3117) ... ## Summary Pull requests and issues that mention you now appear as repository-scoped Inbox conversations, so project work can be reviewed without first navigating to Projects. Opening a project item resolves its current canonical state and reuses the existing review, comment, merge, and issue actions. Repository-aware grouping keeps identical event IDs from different repositories separate, while loading, missing-data, and partial-query states avoid exposing stale actions. ### Related issue None found. ### Testing - `node --import ./test-loader.mjs --experimental-strip-types --test src/features/home/lib/projectInbox.test.mjs` — 6 tests passed - `CI=1 pnpm exec playwright test tests/e2e/project-inbox.spec.ts --project=smoke` — passed - Pre-push desktop, mobile, Tauri, and Rust checks — passed --------- Signed-off-by: Thomas Petersen <thomasp@squareup.com>	2026-07-27 15:14:22 +01:00
3 people	87b3fcd3c0	fix(desktop): clarify identity key button when key exists (#2357) ... ## Summary - backing out of the backup step and clicking the CTA again reuses the existing key - the button still said "Create a new identity key", which is misleading for a security-sensitive action - when a key is already loaded, label it "Continue with existing identity key" Closes #2318 ## Test plan - [ ] first-run: button still says "Create a new identity key" - [ ] create key → backup → back: button says "Continue with existing identity key" and shows the same key Made with [Cursor](https://cursor.com) --------- Signed-off-by: Taksh <takshkothari09@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-27 08:47:39 -04:00
morgmartandGitHub	7fc0cc82db	Restore Goose and Buzz Agent to onboarding harness selection (#2731) ... > [!NOTE] > **Part 1 of a multi-PR onboarding rework.** This PR only restores the hidden harnesses, adjusts the card layout, and gates onboarding completion on valid config. A follow-up PR (stacked on this branch) restructures the flow: the harness page becomes a single-choice "pick your default harness" step, and install/sign-in/provider setup moves to the following page. Review this one on its own terms — the flow rework is intentionally not here. ## Summary - Restore **Goose** and **Buzz Agent** to onboarding harness selection, reverting the launch-only restriction from #2233 - The restore is the single centralized allowlist (`ONBOARDING_RUNTIME_ORDER` in `onboardingRuntimeSelection.ts`) that #2233 deliberately set up for this moment — setup cards, readiness handoff, and the defaults harness picker all derive from it - Lay the four harness cards out as a single row at `lg` and above (`lg:grid-cols-4`); below 1024px (including the app's 800px minimum window width) the grid is 2×2, and 1-up on narrow viewports - **Gate onboarding Finish on actual config validity** (review finding): the defaults page rendered provider/model/credential fields for provider-required harnesses but Finish only checked that a harness was selected — a fresh user picking Buzz Agent could persist a default that fails at first spawn. The Finish gate now consumes `AgentConfigFields`' existing `onValidityChange` signal. Baked build env and runtime-file config satisfy the gate, so internal builds and existing Goose users are never blocked - Update the unit + E2E specs that pinned the hidden behavior, plus two new E2E cases pinning the Finish gate (blocked-until-configured, and baked-env never blocked) - AGENTS.md rule 7 updated to document the completion gate ## Testing - `onboardingRuntimeSelection.test.mjs` — 4 passed - `pnpm typecheck` — clean - `pnpm exec playwright test tests/e2e/onboarding-agent-defaults.spec.ts --project=smoke` — 21 passed - `onboarding-docked-cta-screenshots.spec.ts` — 3 passed - Biome — clean ## Known cosmetic issue (deferred to PR 2) At the app's minimum window size (800×500) the 2×2 grid extends past the visible area and the footer CTA overlaps card space. Next still hit-tests correctly. PR 2 redesigns this page entirely (cards become a single-choice chooser with no inline setup), so this is deferred rather than patched twice. --------- Signed-off-by: morgmart <98432065+morgmart@users.noreply.github.com>	2026-07-27 07:56:40 -04:00
3 people	3742076434	fix(mobile): mitigate message-post delay with optimistic rendering (#3037) ... ### What changed? Adds optimistic rendering for newly locally posted messages in channels and threads. - Messages appear immediately - Relay echoes and history are deduplicated by event ID - Rejected or timed-out publishes erase the optimistic rendering. The implementation covers reconnect and hydration races, channel-window and legacy WebSocket paths, thread-local overlays, and rapid concurrent sends. ### Why? This is a valuable partial mitigation for [BOT-1449](https://linear.app/squareup/issue/BOT-1449/buzz-mobile-posted-messages-dont-appear-until-leavingre-entering-the): senders no longer depend on receiving a relay echo before seeing their own post. It does not address the likely primary cause of stale channels. Mobile currently does not recover live subscriptions after a rate-limited relay `CLOSED`; that recovery is being handled separately. ### How is it tested? Full mobile suite: 676 passed, 1 skipped. Added regression coverage for optimistic insertion, authoritative deduplication, rollback, reconnect and hydration, thread replies, rapid and equal-time sends, never-echoed successful sends, and legacy WebSocket retirement. --------- Signed-off-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> Co-authored-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz>	2026-07-27 07:16:33 -04:00
thomaspblockandGitHub	afb272bb7b	fix(desktop): render rich project work item content (#3100) ... ## Summary Project issues, pull requests, reviews, and commit details no longer flatten rich content into inert or plain text. They now share the message markdown and media pipeline, preserving NIP-92 `imeta` metadata so links, images, and videos render consistently. Commit bodies are fetched only when a single-commit detail view is opened, keeping list queries lightweight while exposing full context beside the diff. ### Related issue None found. ### Testing - Pre-push suite: `desktop-check`, `desktop-test`, `desktop-tauri-test`, `rust-tests`, and `mobile-test` - Project issue and pull request regression tests cover preserving attachment metadata on roots, updates, and comments - The project commit detail smoke scenario verifies linked text, images, and video in commit bodies Signed-off-by: Thomas Petersen <thomasp@squareup.com>	2026-07-27 12:22:05 +02:00
3 people	070fb6a161	chore(deps): update radix-ui-primitives monorepo (#3063) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@radix-ui/react-alert-dialog](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog)) | [`1.1.19` → `1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-alert-dialog/1.1.19/1.1.23) |  |  | | [@radix-ui/react-checkbox](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox)) | [`1.3.7` → `1.3.11`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-checkbox/1.3.7/1.3.11) |  |  | | [@radix-ui/react-dialog](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog)) | [`1.1.19` → `1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dialog/1.1.19/1.1.23) |  |  | | [@radix-ui/react-dismissable-layer](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dismissable-layer)) | [`1.1.15` → `1.1.19`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dismissable-layer/1.1.15/1.1.19) |  |  | | [@radix-ui/react-dropdown-menu](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu)) | [`2.1.20` → `2.1.24`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dropdown-menu/2.1.20/2.1.24) |  |  | | [@radix-ui/react-focus-scope](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/focus-scope)) | [`1.1.12` → `1.1.16`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-focus-scope/1.1.12/1.1.16) |  |  | | [@radix-ui/react-popover](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/popover)) | [`1.1.19` → `1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-popover/1.1.19/1.1.23) |  |  | | [@radix-ui/react-separator](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/separator)) | [`1.1.11` → `1.1.15`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-separator/1.1.11/1.1.15) |  |  | | [@radix-ui/react-slot](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/slot)) | [`1.3.0` → `1.3.3`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-slot/1.3.0/1.3.3) |  |  | | [@radix-ui/react-tabs](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs)) | [`1.1.17` → `1.1.21`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-tabs/1.1.17/1.1.21) |  |  | | [@radix-ui/react-toggle](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/toggle)) | [`1.1.14` → `1.1.18`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-toggle/1.1.14/1.1.18) |  |  | | [@radix-ui/react-tooltip](https://radix-ui.com/primitives) ([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip)) | [`1.2.12` → `1.2.16`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-tooltip/1.2.12/1.2.16) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/1) for more information. --- ### Release Notes <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-alert-dialog)</summary> ### [`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1123) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-dialog@1.1.23`, `@radix-ui/react-primitive@2.1.10` ### [`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1122) - Updated dependencies: `@radix-ui/react-dialog@1.1.22`, `@radix-ui/react-primitive@2.1.9` ### [`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1121) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-dialog@1.1.21`, `@radix-ui/react-primitive@2.1.8` ### [`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1120) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-dialog@1.1.20`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-primitive@2.1.7` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-checkbox)</summary> ### [`v1.3.11`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#1311) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-use-controllable-state@1.2.6`, `@radix-ui/react-use-size@1.1.4` ### [`v1.3.10`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#1310) - Updated dependencies: `@radix-ui/react-primitive@2.1.9` ### [`v1.3.9`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#139) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-use-controllable-state@1.2.5`, `@radix-ui/react-use-size@1.1.3` ### [`v1.3.8`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#138) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Fixed a bug where updating a `Checkbox`, `Switch`, or `RadioGroup` value programmatically (eg. a "select all" control) while inside a `<form>` would dispatch a `click` event from the hidden bubble input that propagated to ancestor `onClick` handlers. - Updated dependencies: `@radix-ui/react-presence@1.1.8`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-use-size@1.1.2` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-dialog)</summary> ### [`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1123) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-dismissable-layer@1.1.19`, `@radix-ui/react-focus-guards@1.1.6`, `@radix-ui/react-focus-scope@1.1.16`, `@radix-ui/react-id@1.1.4`, `@radix-ui/react-portal@1.1.17`, `@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-slot@1.3.3`, `@radix-ui/react-use-controllable-state@1.2.6`, `@radix-ui/react-use-layout-effect@1.1.4` ### [`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1122) - Updated dependencies: `@radix-ui/react-slot@1.3.2`, `@radix-ui/react-primitive@2.1.9`, `@radix-ui/react-dismissable-layer@1.1.18`, `@radix-ui/react-focus-scope@1.1.15`, `@radix-ui/react-portal@1.1.16` ### [`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1121) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-dismissable-layer@1.1.17`, `@radix-ui/react-focus-guards@1.1.5`, `@radix-ui/react-focus-scope@1.1.14`, `@radix-ui/react-id@1.1.3`, `@radix-ui/react-portal@1.1.15`, `@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-slot@1.3.1`, `@radix-ui/react-use-controllable-state@1.2.5`, `@radix-ui/react-use-layout-effect@1.1.3` ### [`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1120) - Fixed broken ARIA references in Dialogs where a title or description elements are not rendered. - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-dismissable-layer@1.1.16`, `@radix-ui/react-focus-scope@1.1.13`, `@radix-ui/react-portal@1.1.14`, `@radix-ui/react-presence@1.1.8`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-focus-guards@1.1.4`, `@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-slot@1.3.0`, `@radix-ui/react-use-layout-effect@1.1.2` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-dismissable-layer)</summary> ### [`v1.1.19`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1119) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-use-callback-ref@1.1.4`, `@radix-ui/react-use-effect-event@0.0.5` ### [`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1118) - Updated dependencies: `@radix-ui/react-primitive@2.1.9` ### [`v1.1.17`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1117) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-use-callback-ref@1.1.3`, `@radix-ui/react-use-effect-event@0.0.4` ### [`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1116) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-use-callback-ref@1.1.2`, `@radix-ui/react-use-effect-event@0.0.3` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-dropdown-menu)</summary> ### [`v2.1.24`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2124) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-id@1.1.4`, `@radix-ui/react-menu@2.1.24`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-use-controllable-state@1.2.6` ### [`v2.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2123) - Updated dependencies: `@radix-ui/react-menu@2.1.23`, `@radix-ui/react-primitive@2.1.9` ### [`v2.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2122) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-id@1.1.3`, `@radix-ui/react-menu@2.1.22`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-use-controllable-state@1.2.5` ### [`v2.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2121) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-menu@2.1.21`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-focus-scope)</summary> ### [`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1116) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-use-callback-ref@1.1.4` ### [`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1115) - Updated dependencies: `@radix-ui/react-primitive@2.1.9` ### [`v1.1.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1114) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-use-callback-ref@1.1.3` ### [`v1.1.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1113) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-use-callback-ref@1.1.2` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-popover)</summary> ### [`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1123) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-dismissable-layer@1.1.19`, `@radix-ui/react-focus-guards@1.1.6`, `@radix-ui/react-focus-scope@1.1.16`, `@radix-ui/react-id@1.1.4`, `@radix-ui/react-popper@1.3.7`, `@radix-ui/react-portal@1.1.17`, `@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-slot@1.3.3`, `@radix-ui/react-use-controllable-state@1.2.6` ### [`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1122) - Updated dependencies: `@radix-ui/react-slot@1.3.2`, `@radix-ui/react-primitive@2.1.9`, `@radix-ui/react-dismissable-layer@1.1.18`, `@radix-ui/react-focus-scope@1.1.15`, `@radix-ui/react-popper@1.3.6`, `@radix-ui/react-portal@1.1.16` ### [`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1121) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-dismissable-layer@1.1.17`, `@radix-ui/react-focus-guards@1.1.5`, `@radix-ui/react-focus-scope@1.1.14`, `@radix-ui/react-id@1.1.3`, `@radix-ui/react-popper@1.3.5`, `@radix-ui/react-portal@1.1.15`, `@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-slot@1.3.1`, `@radix-ui/react-use-controllable-state@1.2.5`, `@radix-ui/react-use-layout-effect@1.1.3` ### [`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1120) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-popper@1.3.4`, `@radix-ui/react-dismissable-layer@1.1.16`, `@radix-ui/react-focus-scope@1.1.13`, `@radix-ui/react-portal@1.1.14`, `@radix-ui/react-presence@1.1.8`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-focus-guards@1.1.4`, `@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-slot@1.3.0` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-separator)</summary> ### [`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1115) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-primitive@2.1.10` ### [`v1.1.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1114) - Updated dependencies: `@radix-ui/react-primitive@2.1.9` ### [`v1.1.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1113) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/react-primitive@2.1.8` ### [`v1.1.12`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1112) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-primitive@2.1.7` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-slot)</summary> ### [`v1.3.3`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#132-133) - Reverted breaking changes that caused compatibility issues with React Server Components. ### [`v1.3.2`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#132-133) - Reverted breaking changes that caused compatibility issues with React Server Components. ### [`v1.3.1`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#131) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-tabs)</summary> ### [`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1121) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-context@1.2.2`, `@radix-ui/react-direction@1.1.4`, `@radix-ui/react-id@1.1.4`, `@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-roving-focus@1.1.19`, `@radix-ui/react-use-controllable-state@1.2.6` ### [`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1120) - Updated dependencies: `@radix-ui/react-primitive@2.1.9`, `@radix-ui/react-roving-focus@1.1.18` ### [`v1.1.19`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1119) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-direction@1.1.3`, `@radix-ui/react-id@1.1.3`, `@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-roving-focus@1.1.17`, `@radix-ui/react-use-controllable-state@1.2.5` ### [`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1118) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-presence@1.1.8`, `@radix-ui/react-roving-focus@1.1.16`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-direction@1.1.2`, `@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-toggle)</summary> ### [`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1118) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-use-controllable-state@1.2.6` ### [`v1.1.17`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1117) - Updated dependencies: `@radix-ui/react-primitive@2.1.9` ### [`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1116) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-use-controllable-state@1.2.5` ### [`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1115) - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-primitive@2.1.7` </details> <details> <summary>radix-ui/primitives (@&#8203;radix-ui/react-tooltip)</summary> ### [`v1.2.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1216) - Reverted breaking changes that caused compatibility issues with React Server Components. - Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`, `@radix-ui/react-context@1.2.2`, `@radix-ui/react-dismissable-layer@1.1.19`, `@radix-ui/react-id@1.1.4`, `@radix-ui/react-popper@1.3.7`, `@radix-ui/react-portal@1.1.17`, `@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-slot@1.3.3`, `@radix-ui/react-use-controllable-state@1.2.6`, `@radix-ui/react-use-layout-effect@1.1.4`, `@radix-ui/react-visually-hidden@1.2.11` ### [`v1.2.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1215) - Updated dependencies: `@radix-ui/react-slot@1.3.2`, `@radix-ui/react-primitive@2.1.9`, `@radix-ui/react-dismissable-layer@1.1.18`, `@radix-ui/react-popper@1.3.6`, `@radix-ui/react-portal@1.1.16`, `@radix-ui/react-visually-hidden@1.2.10` ### [`v1.2.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1214) - Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation. - Updated dependencies: `@radix-ui/primitive@1.1.7`, `@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`, `@radix-ui/react-dismissable-layer@1.1.17`, `@radix-ui/react-id@1.1.3`, `@radix-ui/react-popper@1.3.5`, `@radix-ui/react-portal@1.1.15`, `@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-slot@1.3.1`, `@radix-ui/react-use-controllable-state@1.2.5`, `@radix-ui/react-use-layout-effect@1.1.3`, `@radix-ui/react-visually-hidden@1.2.9` ### [`v1.2.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1213) - Fixed a bug where `Tooltip.Content` children were mounted to the DOM twice. - Improved tree-shaking so bundlers can drop unused components. Component parts are now marked `/* @&#8203;__PURE__ */` and use named render functions instead of `Component.displayName = ...` assignments, which previously prevented dead-code elimination with some bundlers. - Updated dependencies: `@radix-ui/react-popper@1.3.4`, `@radix-ui/react-dismissable-layer@1.1.16`, `@radix-ui/react-portal@1.1.14`, `@radix-ui/react-presence@1.1.8`, `@radix-ui/react-visually-hidden@1.2.8`, `@radix-ui/react-use-controllable-state@1.2.4`, `@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-context@1.2.0`, `@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-slot@1.3.0`, `@radix-ui/react-use-layout-effect@1.1.2` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/block/buzz). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-27 01:09:48 -07:00
3 people	63c62fcf3e	chore(deps): update dependency @tanstack/react-virtual to v3.14.8 (#3057) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@tanstack/react-virtual](https://tanstack.com/virtual) ([source](https://redirect.github.com/TanStack/virtual/tree/HEAD/packages/react-virtual)) | [`3.14.6` → `3.14.8`](https://renovatebot.com/diffs/npm/@tanstack%2freact-virtual/3.14.6/3.14.8) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/1) for more information. --- ### Release Notes <details> <summary>TanStack/virtual (@&#8203;tanstack/react-virtual)</summary> ### [`v3.14.8`](https://redirect.github.com/TanStack/virtual/blob/HEAD/packages/react-virtual/CHANGELOG.md#3148) [Compare Source](https://redirect.github.com/TanStack/virtual/compare/@tanstack/react-virtual@3.14.7...@tanstack/react-virtual@3.14.8) ##### Patch Changes - [#&#8203;1237](https://redirect.github.com/TanStack/virtual/pull/1237) [`aa536e7`](https://redirect.github.com/TanStack/virtual/commit/aa536e7746a88d9f55ca8a4b50d2f548a888fea6) - Fix a gap at the top of the list after an end-anchored prepend in `directDomUpdates` mode. The prepend grows the total size and bumps `scrollOffset` to the new bottom in the same pass, but the size container's height was written *after* `_willUpdate` synced the scroll position — so the browser clamped the `scrollTop` write to the stale (shorter) `scrollHeight`, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected `directDomUpdates` mode (React-rendered sizers receive their height during render). - Updated dependencies \[[`7ae32b5`](https://redirect.github.com/TanStack/virtual/commit/7ae32b55887fd044a48c788546cd940279b338e0)]: - [@&#8203;tanstack/virtual-core](https://redirect.github.com/tanstack/virtual-core)@&#8203;3.17.6 ### [`v3.14.7`](https://redirect.github.com/TanStack/virtual/blob/HEAD/packages/react-virtual/CHANGELOG.md#3147) [Compare Source](https://redirect.github.com/TanStack/virtual/compare/@tanstack/react-virtual@3.14.6...@tanstack/react-virtual@3.14.7) ##### Patch Changes - Updated dependencies \[[`1e3b908`](https://redirect.github.com/TanStack/virtual/commit/1e3b908705e04e45be2615f2277580cb09f5cdef), [`7dcfc07`](https://redirect.github.com/TanStack/virtual/commit/7dcfc07b877479697124157d3124c09537b87a75)]: - [@&#8203;tanstack/virtual-core](https://redirect.github.com/tanstack/virtual-core)@&#8203;3.17.5 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/block/buzz). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-27 02:17:14 +00:00
7 people	95fdf97880	feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery (#2773) ... ## What Implements a "bring your own harness" (BYOH) generic ACP mechanism — replacing per-harness backend code with a data-driven 3-tier system: - **Tier 1 (compiled-in builtins):** goose, claude, codex, buzz-agent — unchanged behavior - **Tier 2 (bundled presets):** cursor, omp, grok, opencode, kimi, amp, hermes, openclaw, and any future additions — defined in `PRESET_HARNESSES`, no code duplication, icons stay TerminalSquare/bundled-asset-only - **Tier 3 (user-defined custom):** JSON definitions saved to `custom_harnesses/` under app data; managed via Settings → Agents UI ## Changes ### Core data model - `HarnessDefinition` — id, label, command, args, env, install URL/hint - `PRESET_HARNESSES` static table — single source of truth for all presets; `preset_harness_ids()` derives reserved IDs (D-11: no hand-maintained copy) - `source: "builtin" | "preset" | "custom"` tagging on every catalog entry ### Persistence (B-4, B-6) - `save_custom_harness_to_dir(dir, definition, rename_old_id)` — backup-swap atomic write (backs up target → .bak, commits temp → target, restores .bak on failure, removes .bak on success); safe on Windows where `fs::rename` over an existing file is "access denied" - `save_and_warm` / `delete_and_warm` — hold `PERSIST_MUTEX` for the write + registry-warm pair, eliminating the lost-update race (B-6) where two concurrent saves could interleave their warm calls and leave a stale registry snapshot - Validate-before-mutate: both IDs and env validated before any filesystem mutation ### Env validation boundary (B-3) - `validate_harness_definition_pub` calls `validate_user_env_keys` on definition env at save AND load - Rejects malformed keys (BUZZ_AUTH_TAG=x forgery shape), reserved keys (BUZZ_MANAGED_AGENT etc.), NUL bytes, oversized values ### TypeScript boundary (B-2 / Thufir CRITICAL) - `RawAcpRuntimeCatalogEntry` now declares `definition_env?: Record<string,string>` and `source: "builtin" | "preset" | "custom"` - `fromRawAcpRuntimeCatalogEntry` maps `definition_env → definitionEnv` (camelCase); absent field defaults to `{}` - Edit form reads `entry.definitionEnv` — env no longer erased on save-then-edit cycle ### Unified descriptor (Phase A / Thufir F4) - `EffectiveHarnessDescriptor { command, args, env }` in `readiness.rs` - `resolve_effective_harness_descriptor()` — single resolver used by spawn, spawn_hash, summary, get_agent_models (both saved and unsaved), and readiness - No competing arg-resolution forms ### Other fixes - B-5: stop freezing `runtime.defaultArgs` into `record.agent_args` on normal create paths - B-7: readiness exec-check — `MissingBinary` variant for custom commands not found on PATH - B-8: onboarding transition — `setTimeout(0)` removed, parent-owned route intent via `navigateAfterComplete` prop - C-9: collector-discriminating sweep tests with injectable filters - C-10: `HarnessManagementCard` uses `harnessGalleryLogic` helpers (killed duplicate filter/sort) - D-11: `BUILTIN_IDS` derived from `PRESET_HARNESSES` (no hand-maintained copy) - D-12: `mobile/pubspec.lock` churn reverted - D-13: false ownership fast-path comment fixed - D-14: URL scheme validation for `installInstructionsUrl` - D-15: OpenClaw Gateway env-locus README line ### Tests added **B-4 persistence (6 tests):** `save_to_dir_create_writes_file_and_loads_back`, `save_to_dir_same_id_edit_replaces_content`, `save_to_dir_backup_is_cleaned_up_after_same_id_edit`, `save_to_dir_rename_removes_old_file_and_creates_new`, `save_to_dir_rename_nonexistent_old_id_is_non_fatal`, `save_to_dir_roundtrip_with_env_preserves_values` **B-3 env validation (6 tests):** `validate_rejects_malformed_key_with_equals_sign`, `validate_rejects_reserved_key_buzz_managed_agent`, `validate_rejects_reserved_key_case_insensitive`, `validate_rejects_nul_byte_in_value`, `validate_rejects_value_over_per_value_size_limit`, `validate_accepts_well_formed_env` **B-2 API boundary (4 TS tests in tauri.test.mjs):** `fromRawAcpRuntimeCatalogEntry maps definition_env to definitionEnv`, `defaults definitionEnv to {} when absent`, `preserves source preset`, `env round-trips through edit payload shape` ## Preset catalog | ID | Label | Command | |----|-------|---------| | `cursor` | Cursor | `cursor-agent acp` | | `omp` | Oh My Pi | `omp acp` | | `grok` | Grok Build | `grok agent --always-approve stdio` | | `opencode` | OpenCode | `opencode acp` | | `kimi` | Kimi Code | `kimi acp` | | `amp` | Amp | `amp-acp` | | `hermes` | Hermes Agent | `hermes-acp` | | `openclaw` | OpenClaw | `openclaw acp` | ## Review-fix pass (2026-07-26, Eva) Fixes from the three-way review (Wren / Dawn / Eva) in the buzz-generic-acp-harnesses thread, pushed as new commits (no rewrite): 1. **installHint edit round-trip** — form seeding extracted to `formValuesFromCatalogEntry` (single source of truth), input rendered, full-definition lossless round-trip regression. 2. **Dangling-delete coherence** — delete allowed; confirm counts referencing agents (direct pin + persona-inherited); summary rows render `harness (deleted): <id>`; spawn errors become actionable sentences (`user_facing_harness_error`); composed delete→summary→start test. 3. **Comma-in-args** — rejected at `validate_harness_definition` (shared by save AND disk load), mirrored inline in the form. 4. **Registry publish race** — collision/dup filtering moved into `load_custom_harnesses` (both loaders inherit shadowing rules); discovery publishes by re-reading the dir under `persist_mutex` (lock scoped to publish only); deterministic interleaving regressions for save-during-discovery and delete-during-discovery. 5. **Mechanical** — discarded `belongs_to_us` sweep arg deleted, `load_global_agent_config` hoisted out of the per-record summary loop, duplicated doc paragraph + stray SAFETY comment removed. 6. **PGID test de-flaked** — leader kept alive through the assertion. Known follow-up (filed in review, not blocking): file-size split-outs queued in `check-file-sizes.mjs` entries. ## Gate table — head `bf53f1d60` | Gate | Result | |------|--------| | `cargo test --lib` (desktop/src-tauri) | **1701 passed**, 0 failed, 14 ignored | | desktop JS suite (`pnpm test`) | **3605 passed**, 0 failed | | `tsc --noEmit` | clean | | `biome check` + file-size/px/pubkey checks | clean | | `cargo clippy --lib -- -D warnings` | clean | | `cargo fmt --check` | clean | PR head: `bf53f1d60e3cbd07392e1287b83bb37ba90d0d33` — includes merge of origin/main (`c2a4ee711`, conflicts in agent_models composed with #2890's live Databricks discovery) --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>	2026-07-26 20:06:20 -04:00
5 people	16d4ec335e	feat(desktop): use collective mesh routing for Auto (#2825) ... Uses MeshLLM built-in `mesh` collective intelligence / Mixture of Agents when Buzz Auto sees two or more distinct physical models. With zero or one model, Auto remains ordinary `auto`. This is an alternative way to improve tool responses, accuracy, and resistance to hallucination when a high-latency distributed mesh contains diverse models. Models and members may come and go: collective routing enables only after stable capacity, drops on confirmed contraction, and can recover later. Mesh-specific failures retry once through ordinary Auto. This update also pins MeshLLM to a v0.73.1-compatible backport of [MeshLLM #1074](https://github.com/Mesh-LLM/mesh-llm/pull/1074), so client-only Buzz nodes cannot enter model election or download a remote provider model. Buzz preserves the selected local sharing model and switches an existing client to sharing across a controlled app restart, retaining one runtime and one `:9337` / `:3131` pair per machine. Validation: - Full local `just ci` passes on the cleaned branch. - MeshLLM host-runtime suite: 1,568 passed, 0 failed; strict Clippy passes. - Buzz desktop Tauri suite with `mesh-llm`: 1,721 passed, 0 failed; strict feature Clippy passes. - Playwright covers client-to-share using the saved local model and no destructive stop. - Packaged two-machine testing proved single-model routing, dual-model collective routing, tool-markup fallback, and runtime reuse. - Packaged client-only recheck routed a real Mini Buzz turn through M5 while Mini stayed `is_client=true`, `is_host=false`, hosted no models, and created no Gemma cache. Builds on the recovery work merged in #2823; this PR does not duplicate it. --------- Signed-off-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: Michael Neale <michael.neale@gmail.com> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell <tlongwell@block.xyz>	2026-07-26 19:46:13 -04:00
3 people	aee6314484	fix(desktop): strip legacy baked team instructions from stored prompts (#3035) ... Agents in a team receive two `Team Instructions` blocks per turn, and the observer feed renders two Team Instructions cards for them. There are two producers. `with_team()` in `crates/buzz-acp/src/pool.rs` appends the LIVE `[Team Instructions]` block from the runtime `TeamRecord` — that one is correct. The second is baked into the stored `system_prompt` itself: records written before the runtime framing landed were composed by the now-removed `compose_prompt()` in `buzz-persona`, which appended `"\n\n---\n# Team Instructions\n"` plus a frozen copy of the team instructions. So an affected agent is fed a stale roster ahead of the current one, and the transcript parser — correctly — reports both. Fixing this in `parseSystemPromptSections` would hide the symptom while the agent kept receiving the stale bytes, so the suffix is removed at rest by a boot migration. `strip_baked_team_instructions` splits each stored `system_prompt` at the LAST occurrence of the exact delimiter and keeps the text before it. Last-occurrence matches the parser's own `lastIndexOf` guard: a persona body may quote a delimiter-shaped passage, and only the final one is the producer boundary. The match is byte-exact — a bare `---`, a `# Team Instructions` heading at a different position, or a single preceding newline are author content and are left alone. It applies to every record regardless of `team_id` / `persona_id` / `pubkey`: the key-less definition records carry the suffix exactly as the instances minted from them do. A prompt that was nothing but the suffix becomes `None`, not `Some("")`, matching the absent-prompt convention in `AgentDefinition::into_agent_record`. Stripping a definition's prompt changes its `persona_content_hash`, which is the drift basis behind the Agents-menu "out of date" badge. Left alone, every linked instance would light up stale for a change the user never made. The migration therefore advances the pin of instances whose `persona_source_version` still equals the definition's PRE-strip hash — the same conditional `refresh_builtin_agent_avatars` already uses. An instance that had genuinely drifted keeps its stale pin, and its badge. The migration runs after `fold_personas_into_agent_store` so definitions lifted out of the legacy `personas.json` are cleaned in the same boot, and before `backfill_standalone_agents` so a manufactured definition never snapshots a suffix about to be removed. It writes only when at least one record changed, so a second boot is a true no-op, and takes a create-if-absent backup at `managed-agents.json.pre-team-suffix-strip.bak` following the `pre-backfill.bak` contract — a re-run after a partial failure cannot replace the pristine backup with a half-migrated snapshot. An unparseable store errors without writing and without taking a backup, leaving the file for manual recovery. Pass 5's legacy branch in `agentSessionTranscriptHelpers.ts` is deliberately untouched: un-migrated installs and snapshot imports still need it. --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-26 19:33:43 -04:00
klopez4212andGitHub	871a3b3772	Refine mobile community switching and discovery (#2967) ... ## Summary - Redesign community switching with relay-provided avatars, selected-state checks, edit-to-remove controls, and confirmation. - Bring desktop-inspired pairing onboarding to mobile with QR scanning as the primary action, an expandable pairing-code flow, and a tappable flapping bee. - Polish Search and Activity headers, filter chips, typography, keyboard stability, and Android adaptive-icon sizing. ## Validation - `just mobile-check` - `just mobile-test` — 661 passed, 1 skipped - Pixel 10 snapshot review mobile-v0.5.0-rc.2	2026-07-26 15:05:57 -07:00
4 people	5d8ede446f	feat(agents): lower default agent parallelism from 24 to 10 (#3038) ... ## What One-line default change: `DEFAULT_AGENT_PARALLELISM` 24 → 10 (`desktop/src-tauri/src/managed_agents/types.rs`), requested by Tyler in [buzz-generic-acp-harnesses](buzz://message?channel=d6d84fdc-47fe-4e41-acf5-a08a4a013e6b&id=a047ead3a34ba804c376bf79f29e355d304162a88c7b2a7121e092547c572022). ## Why Each unit of parallelism is a **full agent subprocess** per agent × community pair, spawned eagerly and serially at create/start before the harness connects to the relay: - At 24, a desktop with a few dozen agent×community pairs carries >1,000 potential idle subprocesses. - Slow-starting harnesses (OpenClaw measured at 4–10s per worker) take minutes to create, and messages sent during that window can be permanently missed (the startup watermark is captured only after eager pool init). - Parallelism is per-channel concurrency — a channel never uses more than one worker — so 10 still covers concurrent-channel fan-out for typical agents. Context: verified RCA + live 1-worker/3-mention experiment in the same thread. Demand-driven pool growth (seed 1, grow on contention up to the cap) is agreed as a follow-up; this is the interim risk reduction. ## Scope / blast radius - Existing agent records keep their persisted `parallelism` value — only new records and unset defaults change. - Per-agent override unchanged (1..=32 via agent editor / `BUZZ_ACP_AGENTS`). - Readers of the constant (`team_snapshot`, `personas/snapshot/import`, `commands/agents` mint path) all take the new default transitively; no other code pins 24. - `activeAgentTurnsStore.test.mjs` comments updated so the 24-turn eviction case is framed against the harness cap (32) instead of the default — coverage unchanged, no assertion touched. ## Verification At 63bb0c1c4, same shell: desktop Rust `cargo test --lib` 1693/0 (14 ignored) · JS suite 3523/3523 · tsc clean · biome clean on touched file · cargo fmt clean. Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell <tlongwell@block.xyz>	2026-07-26 18:05:53 -04:00
3 people	1a56b7cc9e	feat(mobile): add worktree-aware debug identities (#2858) ... **Category:** improvement **User Impact:** Developers can identify which worktree produced a mobile debug app, keep a bounded set of worktree builds installed side by side, and preserve each worktree app's login and local state while switching branches. **Problem:** Mobile debug builds from every checkout currently appear as the same “Buzz” app and share one application identity, so the running source is ambiguous and one worktree build replaces another. A branch-keyed identity would avoid replacement but create stale installs and fresh app state on every branch switch. **Solution:** Give each linked worktree a stable Debug-only application identity derived from its sanitized directory name. Show the sanitized branch name (or short commit SHA when detached) in the display label, persist generated native overrides for direct IDE builds, and leave Release/Profile identities unchanged. Worktree defaults remain lower precedence than a developer's iOS `AppOverrides.xcconfig`. `just mobile-clean` provides a safe cleanup path for suffixed worktree installs while preserving production Buzz. <details> <summary>File changes</summary> **.github/workflows/ci.yml** Runs the expanded worktree override contract when relevant mobile or native configuration changes. **AGENTS.md** Documents worktree-aware mobile development and cleanup for contributors and agents. **Justfile** Generates overrides before mobile development and Android debug builds, and exposes `just mobile-clean`. **mobile/README.md** Explains stable per-worktree identities, branch/SHA labels, direct IDE usage, cleanup, and Release/Profile guarantees. **mobile/android/.gitignore** Ignores generated worktree properties. **mobile/android/app/build.gradle.kts** Loads and validates generated properties, then applies the application ID suffix and display label to Android Debug only. **mobile/android/app/src/main/AndroidManifest.xml** Resolves the Android app label through an overridable string resource. **mobile/ios/.gitignore** Ignores generated iOS worktree settings. **mobile/ios/Flutter/Debug.xcconfig** Loads generated worktree defaults before developer `AppOverrides`, so personal signing overrides retain precedence. **mobile/ios/Flutter/Release.xcconfig** Pins the production display name and bundle identifier for Release/Profile builds. **mobile/ios/Runner/Info.plist** Resolves the visible iOS app name from build settings. **scripts/mobile-worktree-overrides.sh** Detects linked worktrees, derives a stable directory-keyed identity, sanitizes branch/SHA display context, writes native Debug overrides, and removes stale overrides in the main checkout. **scripts/mobile-worktree-clean.sh** Lists or removes suffixed Buzz worktree installs from booted iOS simulators and connected Android emulators without matching production IDs; supports `--dry-run`. **scripts/test-mobile-worktree-overrides.sh** Covers worktree detection, branch-switch identity stability, detached HEAD fallback, special-character sanitization, iOS override precedence, brace-aware Release/Profile purity, cleanup safety, ignores, and command integration. </details> ## Reproduction steps 1. From a linked worktree, activate the repository toolchain and run `just mobile-dev`. 2. Inspect the running app: its label should be `Buzz (<sanitized-branch>)`, while its application ID suffix is derived from the worktree directory. 3. Switch branches in the same worktree, rerun the override script, and confirm the application ID remains stable while the display label updates. In detached HEAD, confirm the label uses a short SHA. 4. Build Debug from a second worktree and confirm both apps remain installed side by side with independent state. 5. Build from Xcode after setting `AppOverrides.xcconfig` and confirm developer overrides still win over generated worktree defaults. 6. Run `just mobile-clean --dry-run`, then `just mobile-clean`, and confirm suffixed worktree installs are targeted while the production app is preserved. 7. Build Release/Profile and confirm the production name and application identity remain unchanged. 8. Run `scripts/test-mobile-worktree-overrides.sh`, `just mobile-check`, `just mobile-test`, and `just mobile-build-android`. ## Screenshots / demos | iOS — labeled app switcher | iOS — side-by-side installs | | --- | --- | | <img width="360" alt="Buzz worktree label in the iOS app switcher" src="https://github.com/user-attachments/assets/4bcae067-7ce5-4333-bb11-2803c4107663" /> | <img width="360" alt="Buzz production and worktree debug apps installed side by side on iOS" src="https://github.com/user-attachments/assets/08a107b5-fdf2-463a-8a4c-81d41d7bf5e7" /> | | Android — side-by-side installs | Android — labeled app switcher | | --- | --- | | <img width="360" alt="Buzz production and worktree debug apps installed side by side on Android" src="https://github.com/user-attachments/assets/4f5841a1-adae-42da-ae84-47c09ec85fb9" /> | <img width="360" alt="Buzz worktree label in the Android app switcher" src="https://github.com/user-attachments/assets/0546ff51-efcc-4cb6-a4bd-2a3af26cd60f" /> | --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-07-26 13:47:35 -07:00
klopez4212andGitHub	e6c90bb7c4	Polish community rail and mobile pairing (#2972) ... ## Summary - align the multi-community rail with the content surface and balance its visible 10px side gutters - center Mobile pairing, start sessions on demand, and keep retry states inside the QR area - reveal the QR code and copy action with 250ms motion and use the standard loading spinner The rail was centered within its own box, but the adjacent sidebar added another 11px to the visible right gap. Mobile pairing also started before user intent, which could leave an idle session waiting for EOSE. ## Validation - `pnpm -C desktop build:e2e` - `pnpm -C desktop test` — 3,516 passed - `pnpm -C desktop exec playwright test tests/e2e/community-rail.spec.ts --project=smoke` — 19 passed - `pnpm -C desktop exec playwright test tests/e2e/mobile-pairing-qr.spec.ts --project=smoke` — 1 passed `pnpm -C desktop check` is currently blocked by the existing `src-tauri/src/managed_agents/runtime.rs` file-size baseline (2,220 lines; limit 2,216).	2026-07-26 13:20:26 -07:00
Taksh KothariandGitHub	a31fc4d2f3	fix(desktop): remove bundled libsystemd from AppImage (#2353) ... ## Summary - AppImage bundles an older `libsystemd.so.0` that shadows the system copy after `libmount` is already removed - on systemd ≥ 251 (Arch, Fedora 41+, etc.) launch fails with `LIBSYSTEMD_251` not found - add `libsystemd.so*` to the existing removal list in `fix-appimage.sh` Closes #2335 ## Test plan - [ ] rebuild / repack an AppImage with the updated script - [ ] launch on a distro with systemd ≥ 251 without `LD_PRELOAD` workaround Made with [Cursor](https://cursor.com) Signed-off-by: Taksh <takshkothari09@gmail.com>	2026-07-26 13:54:59 -04:00
3 people	dc1646fcb9	docs: document required DCO sign-off and add commit-msg sign-off hook (#2993) ... `DCO Check` is a required status check on this repo and the top failing check on open contributor PRs, but nothing documented it and nothing surfaced it locally — a missing `Signed-off-by` trailer only showed up as a red check after the PR was already open. ## `lefthook.yml` New `commit-msg` hook that appends the `Signed-off-by` trailer: ```yaml commit-msg: commands: signoff: run: 'git interpret-trailers --if-exists doNothing --trailer "Signed-off-by: $(git var GIT_COMMITTER_IDENT | sed ''s/ [0-9]* [+-][0-9]*$//'')" --in-place {1}' ``` `GIT_COMMITTER_IDENT` is the identity that performed the commit, which is what a DCO sign-off certifies and what native `git commit -s` uses. Committing someone else's work with `--author` or `git commit -C` therefore signs off as you, not as the original author. `--if-exists doNothing` makes it idempotent: `git commit -s` still yields exactly one trailer, and an existing sign-off from a different signer is preserved rather than supplemented. An empty commit message still aborts — the hook does not turn one into a commit body containing only a trailer. Git runs `commit-msg` for `git commit` and `git merge` only. Other flows bypass it and need their own sign-off flag — `git rebase --signoff`, `git cherry-pick -s`. Note `-s` is `--strategy` on `git rebase`, so only the long flag works there. The header comment and both docs state the scope rather than promising blanket coverage. Installed by `just hooks`; `commit-msg` carries no `glob` because it rewrites the message, not files. ## `CONTRIBUTING.md` `Before You Open a PR` gains a paragraph on sign-off: commit with `git commit -s`, what the trailer certifies, that the required `DCO Check` blocks merge without it, `git rebase --signoff main` to repair already-pushed commits, and what the hook does and does not cover. `CI Gate` gains one sentence pointing at `just fix-all` for formatting-only failures. ## `AGENTS.md` `Quality Gates` gains the same requirement framed for agents, including the sequencer caveat and the reminder to include `-s` in programmatically built commit commands. ## Related issue none found --------- Signed-off-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-26 13:43:06 -04:00
3 people	8c0e8cb165	fix(desktop): make agent definition authoritative for model/provider/prompt (#1968) ... ## Summary Introduces a single effective-config resolver that makes agent definitions authoritative for model, provider, system prompt, and relay-mesh routing on linked instances. Stale materialized record bytes are never consulted at spawn, deploy, readiness, hash, card summary, or mesh preflight. **Resolution semantics (field-specific):** - **model/provider (linked):** definition → global. `None` = inherit global default. Record value never consulted. - **model/provider (definition-less):** instance → global. - **system_prompt (linked):** strictly from definition; blank = no prompt. No global tier for prompt. - **system_prompt (definition-less):** from the instance. - **relay-mesh preflight (both):** driven by the same `resolve_effective_config` resolution spawn's mesh env consults. For a linked instance the record's own `provider`/`model`/`relay_mesh` bytes are never consulted; for a definition-less instance with no provider of its own, the legacy marker and env preset are the last fallback (see below). - **Orphaned (linked record, definition missing):** spawn, deploy, and mesh preflight blocked with actionable user-facing error. **Changes:** - New `effective_config` resolver module with `ConfigSource` metadata (`definition`, `global`, `instance_legacy`) - All consumers routed through the single resolver: local spawn, deploy, readiness, spawn hash, card summary, relay-mesh preflight (interactive start and restore-on-launch) - `apply_persona_snapshot` no longer preserves stale record model/provider when definition is blank - Backend `update_managed_agent` blocks model/provider/prompt writes for linked records - Frontend omits model/provider/systemPrompt submission for linked instances; system prompt override hidden - `model_source` field added to `ManagedAgentSummary` so card labels distinguish inherited (`Default model (X)`) from explicit - Spawn hash now digests resolved model/provider (not raw record fields) so global default changes trip the restart badge even for runtimes without `model_env_var` - Orphan spawn/deploy/mesh-preflight blocked with jargon-free error ("This agent's configuration is missing — it may still be syncing or was deleted on another device") - `EffectiveAgentConfig::relay_mesh_model_id()` and `resolve_effective_relay_mesh_model_id()` added; both mesh preflights (`start_local_agent_with_preflight`, `restore_managed_agents_on_launch`) call this instead of the deleted `relay_mesh_config`/`relay_mesh_model_id` record-byte sniffs - Legacy relay-mesh records keep their mesh routing. Two shipped generations predate `provider: "relay-mesh"` and are never rewritten on load: the typed `relay_mesh` marker (added when `ManagedAgentRecord` had no `provider` field), and before it the mesh preset written directly into `env_vars`. `resolve_definition_less` falls back to the marker, then to the env preset, so these records still resolve to mesh instead of silently misrouting to an unrelated provider while their stale env bytes reach the child. The fallback is skipped when the record carries an explicit `provider` — that states current intent, including a switch away from mesh — and `resolve_linked` has no legacy fallback at all - The env discriminator accepts both spellings of the two sentinels renamed in the Jun-11 window without a record migration: the provider env key (`BUZZ_AGENT_PROVIDER`, previously `SPROUT_AGENT_PROVIDER`) and the api-key value (`buzz-mesh-local`, previously `sprout-mesh-local`). Each is independent, since a record can straddle the window; the current provider-key spelling wins when both are present - Dead `persona_field_with_record_fallback` and wrapper `persona_snapshot_with_agent_config_fallback` deleted; callers use `persona_snapshot` directly - New resolver/deploy/hash/write-guard/mesh-preflight tests, including switch-away and global-inheritance regressions for both mesh preflight call sites, per-class legacy-mesh resolution (typed marker and env preset, in every rename-window spelling combination), and the paired assertions that a linked instance's legacy mesh bytes stay inert --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-26 12:30:33 -04:00
Will PflegerandGitHub	8e67cf399d	chore(desktop): delete dead persona catalog UI cluster (#2886) ... ## Summary - Deletes 6 orphaned files in `desktop/src/features/agents/ui/` (556 lines) that formed a closed cluster with zero imports from the reachable module graph — orphaned by the 1B dialog consolidation (`PersonaCatalogSurface`, `PersonaCatalogSection`, `PersonaCatalogDetailsSheet`, `PersonaCatalogSelectionBadge`, `PersonaIdentity`, `PersonaLibraryEntryPoints`). - Removes a stale `check-file-sizes.mjs` override entry for the no-longer-existent `PersonaDialog.tsx`. Verified dead two ways: import-graph reachability walk from all entry points puts all six outside the reachable set, and `tsc --noEmit` passes clean after deletion. Their `data-testid`s have zero references outside the cluster. `PersonaCatalogDialog.tsx` is alive (`AgentsView` imports it) and stays. Independent of #1968 — pure dead code removal, no behavioral change.	2026-07-26 12:30:13 -04:00
3 people	166c6655e8	fix(desktop): surface install failures hidden by curl-pipe exit codes (#2892) ... Ubuntu Doctor reports `Install failed at verify: The installer finished, but Buzz still could not use claude-code (observed: CLI missing)` while the `cli` step shows success. The `cli` step is lying. ## The masking Every CLI install command is a pipe — `curl -fsSL https://claude.ai/install.sh | bash` (`managed_agents/discovery.rs:109`), `… | sh` for Codex (`:141`), `… | CONFIGURE=false bash` for Goose (`:75`). `install_shell_command` ran them through `bash -l -c` with no `pipefail`, so the pipeline's exit status was the **right-hand** side's. A `curl` that fails — or that isn't on the child's PATH at all — feeds `bash` an empty stdin, and `bash` with nothing to run exits 0: ``` $ /bin/bash -l -c 'curl -fsSL https://nonexistent.invalid/x.sh | bash'; echo $? curl: (6) Could not resolve host: nonexistent.invalid 0 $ PATH=/tmp/empty /bin/bash -l -c 'curl -fsSL https://claude.ai/install.sh | bash'; echo $? bash: line 1: curl: command not found 0 ``` `run_install_command` records exit 0 as `success: true`, the adapter step then installs fine (it uses Buzz's own bundled Node, no system PATH needed), and `post_install_verification` correctly reports the CLI is absent. The user is handed a `verify` riddle instead of curl's error, which is why diagnosing this required three rounds of guessing. Install commands now run under `set -o pipefail`, so the left-hand side's failure is the step's failure and `InstallStepResult.stderr` carries the vendor's own message. `SHELLOPTS` is not exported by either shell, so the piped-to vendor script still runs with its default options. The Windows PowerShell install path (`install_powershell_command`) bypasses this shell and is untouched. ## The PATH collapse it was hiding `install_shell_command` composes the child's PATH and calls `cmd.env("PATH", …)`, which **replaces** rather than extends. `should_use_inherited` was `is_windows && !had_shell_path && has_local_context`, so on Unix the inherited process PATH was never appended. When `login_shell_path()` returns `None` — a login shell that exits non-zero or prints nothing, which a GUI-launched process can easily hit via `~/.profile` — the child's entire PATH becomes Buzz's two managed Node dirs. There is no `curl`, `sh`, `sha256sum`, or `tar` in either, so every curl-pipe install fails, and before this PR it failed invisibly. The `is_windows` requirement is dropped: the inherited PATH is the floor whenever no login-shell PATH was obtained, on every OS. Both existing suppressions are kept — a login-shell PATH present still suppresses it (no doubling), and no home/exe context still suppresses it (never manufacture a PATH from ambient state alone). Inherited entries stay **last**, so managed dirs keep precedence. The other caller, `build_augmented_path` (`runtime/path.rs:148`, feeding agent spawns and CLI probes), reads correctly under the new rule for the same reason: it only gains the inherited PATH in the case where it would otherwise hand a child a PATH with no native entries. When a login-shell PATH exists — the normal case on macOS and Linux — its output is unchanged, which `unix_shell_path_suppresses_inherited_fallback` pins. ## Scope This fixes the reporting defect and the PATH floor. The specific environment failure on the affected Ubuntu box is still being diagnosed and is deliberately not addressed here; the point of this change is that the next attempt produces the real error instead of a `verify` riddle. One interaction worth noting: `install_failure_is_retryable` retries any failure that carries an exit code, so a pipefail-surfaced curl failure now gets 3 attempts with backoff — correct for transient network blips, and harmless for hard failures. `desktop/scripts/check-file-sizes.mjs` ratchets the `agent_discovery.rs` ceiling 1836 → 1895 for the added tests. --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-26 12:28:30 -04:00
3 people	c9a73726be	fix(mobile): validate invite relay destinations (#2986) ... ## Summary - require invite relay destinations to be secure public origins in production - reject non-public and ambiguous IP literals before confirmation and again before the claim request - disable redirects for invite claims so a validated relay cannot redirect the request elsewhere - preserve explicit debug-only localhost support ## Validation - pre-commit `dart format` and `flutter analyze` - pre-push full mobile test suite: 666 passed, 1 skipped - independent source reviews from Princess Donut and Mongo found no remaining blockers ## Scope and residual risk This fixes the mobile invite trust boundary without changing NIP-98 or NIP-42. Hostnames are not resolved and pinned by this patch, so DNS rebinding remains a networking-layer residual risk requiring connect-time resolution/pinning. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@sprout-oss.stage.blox.sqprod.co>	2026-07-26 09:16:36 -07:00
4 people	74b63e1846	Refactor managed-agent runtime into cohesive modules (#2974) ... ## Summary - split the managed-agent runtime warehouse into cohesive modules for process ownership/termination, orphan sweeping, dead-instance reaping, lifecycle synchronization, and runtime metadata - preserve the existing `runtime` API through narrow re-exports; helper bodies and platform `cfg` branches are unchanged apart from module-qualified visibility - reduce `runtime.rs` from 2,220 lines on `main` to 908 lines and remove its temporary file-size override, restoring the standard 1,000-line ceiling ## Why `main` failed after stale successful PR checks allowed independent growth to combine above `runtime.rs`'s 2,216-line override. The earlier fix in #2974 extracted only 55 lines and left the monolith on a special ratchet. This replacement includes that extraction but establishes responsibility boundaries and removes the exception entirely. ## Module boundaries - `process.rs` — process identity, ownership markers, receipt validation, and termination primitives - `orphan_sweep.rs` — same-instance orphan discovery and cleanup - `instance_reaper.rs` — foreign/dead desktop instance detection and agent reaping - `lifecycle.rs` — tracked runtime synchronization and stale record cleanup - `metadata.rs` — model/provider metadata resolution - `runtime.rs` — summary/config/spawn orchestration and composition ## Validation At `a824fda31eff6ecc0d39ca1b8ea5602a108897e6`: - pre-push `desktop-check` - pre-push `desktop-test` - pre-push full `desktop-tauri-test`: 1,637 passed, 0 failed, 14 ignored; integration + doc tests passed - `cargo check --manifest-path desktop/src-tauri/Cargo.toml --lib` - `cargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all -- --check` - `node desktop/scripts/check-file-sizes.mjs` Supersedes #2974 and #2930. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Princess Donut <68157ebd23b3897c1991015c3038658ea916200c67d3a54620b0754d1b92f6e0@buzz.block.builderlab.xyz>	2026-07-26 15:34:00 +00:00
klopez4212andGitHub	dd222a509b	Refine mobile settings and themes (#2844) ... ## Summary - reorganize mobile settings around profile, appearance, and connection cards - add System/Light/Dark theme pairing, accent selection, and the Buzz gradient theme - align avatar badges, status editing, and supporting mobile chrome ## Test plan - `just mobile-check` - `just mobile-test`	2026-07-26 08:57:31 +01:00
Matthew SweeneyandGitHub	c2a4ee711e	Fix formatting in README.md diagram (#2284)	2026-07-26 02:51:09 +00:00
Daniel CadenasandGitHub	cc6c4d3471	fix(desktop): make Linux AppImage GStreamer work on non-Debian distros (#2176)	2026-07-25 19:49:30 -07:00
WesandGitHub	5d1233e841	refactor(desktop): remove Agent directory section from Agents page (#2290)	2026-07-25 19:46:07 -07:00
Shawn YeagerandGitHub	ab7aa8b120	fix(desktop): enable arboard Wayland backend so Linux copies reach the Wayland clipboard (#2904) ... Fixes #2896 **Root cause:** `arboard = "3"` compiles with default features only (`image-data`), so the Linux build has no Wayland backend. In a Wayland session every copy lands on the XWayland clipboard; the compositor only mirrors X11 selections while an XWayland window holds focus, and arboard's clipboard client is windowless, so Wayland-native apps read nothing. `set_text` still returns `Ok`, which is why the invite dialog shows "Copied" with an empty clipboard. **Fix:** enable arboard's `wayland-data-control` feature. Under Wayland it uses the `zwlr-data-control` protocol; when `WAYLAND_DISPLAY` is absent it falls back to X11 as before. The `wl-clipboard-rs` dependency is target-gated inside arboard, so macOS and Windows builds are unchanged. **Verified:** `cargo check` passes on the desktop crate; wl-clipboard-rs now resolves in the lockfile. Signed-off-by: Shawn Yeager <shawn@shawnyeager.com>	2026-07-26 02:29:50 +00:00
4 people	aa51dab9da	fix(desktop): supervise and re-arm relay-mesh runtime (#2823) ... Refs #2062 This carries forward the relay-mesh recovery work from #2304 by @Bartok9 (cherry-picked with original authorship/sign-offs) and adds the startup/readiness supervision and packaging fixes found while validating it against a real two-machine Buzz setup. ## From #2304 - Watch the local OpenAI ingress (`:9337`) after launch and re-arm a stale relay-mesh runtime. - Require consecutive failed probes before eviction so a transient inference stall does not cause a cold restart. - Bound stale-runtime shutdown, preserve runtime identity across the asynchronous probe, and never evict a concurrent replacement. - Re-arm only for agents that are actually running; deliberately stopped agents stay stopped. - Persist an actionable sentinel error under the managed-agent store lock and clear only that error after recovery. - Treat serve-to-client fallback as an intentional fail-safe; configured serve restoration remains on its existing path. ## Added here - Use the inference ingress (`:9337`), rather than management port `:3131`, as Buzz's client-readiness boundary. A usable client no longer fails or holds agent-save open merely because management startup is still pending. - Supervise the embedded SDK startup asynchronously, publish a pending status while management is unavailable, and keep its mesh identity alive. - Avoid racing a replacement while SDK startup still owns the embedded runtime. If that pending startup later loses ingress while a running agent still needs it, request a controlled Buzz restart to reclaim the otherwise-unreachable SDK thread. - Defer roster-driven replacement while client management startup is pending. - Keep post-launch recovery in a dedicated module so the mesh entry point remains within the desktop file-size gate. - Explicitly mark generated Unix sidecars executable. On macOS, copying over an existing non-executable destination preserved its old mode, causing packaged `buzz-acp`, `buzz-agent`, and tool sidecars to be reported as missing. ## Validation Automated: - `just ci` — passed, including formatting, Clippy with warnings denied, desktop/web/mobile checks and tests, and builds. - Full Tauri mesh-feature suite — 1,702 passed, 0 failed, 15 ignored. - Mesh-feature Clippy with `-D warnings` — passed. - Release macOS app bundle with `mesh-llm` — built successfully; every bundled sidecar passed executable-mode and deep code-signature verification. Live two-machine E2E: - M5: released Buzz serving `unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_M`. - Mac mini: this branch's packaged Buzz running a saved `buzz-agent`/relay-mesh agent. - Confirmed `:9337` accepted inference and the saved ACP harness started with no error while `:3131` was still unavailable. - Exact inference succeeded before restart (`CORRECTED-MINI-E2E-OK`). - Bespoke Buzz shut down cleanly in 2.3s, then restored ingress and the saved harness in 18.8s while `:3131` was still unavailable. - Exact inference succeeded after restart (`AFTER-RESTART-E2E-OK`). - A real Buzz `@C55` message traversed desktop → `buzz-acp` → `buzz-agent` → mini `:9337` → M5 compute and published the requested reply successfully. --------- Signed-off-by: Bartok9 <danielrpike9@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com> Co-authored-by: Bartok9 <danielrpike9@gmail.com> Co-authored-by: Michael Neale <michael.neale@gmail.com>	2026-07-25 22:13:51 -04:00
3 people	8eb6e3eb60	fix(agents): run live Databricks discovery instead of the fallback list (#2890) ... ## Problem The Databricks model dropdown offers a handful of stale models — and there's no way to tell that list apart from the real one. The AI Gateway exposes **66** chat/embedding endpoints on `block-lakehouse-production`, but the picker was showing a short list that includes models the gateway no longer serves and embedding endpoints that can't chat at all. Three independent defects, all on the discovery path: **1. Live discovery never ran for agents with no saved provider.** `get_agent_models` gates every in-process discovery attempt on the provider (`is_openai_compatible_provider` / `is_anthropic_provider` / `is_databricks_provider`), reading it straight from `record.provider`. That field is `null` for every agent record created before provider persistence — and for any agent that inherits its provider from the build. So all three gates saw `None`, no HTTP discovery ran, and the request fell through to the `buzz-acp models` subprocess. On the Databricks path that subprocess returns `discovery_failure_fallback` — the small hardcoded `DATABRICKS_V2_KNOWN_MODELS` catalog — which the frontend renders exactly like a live catalog. An internal DMG that bakes `BUZZ_AGENT_PROVIDER=databricks_v2` and a `DATABRICKS_HOST` still got the fallback. **2. The fallback list couldn't represent the running model.** When discovery genuinely fails, the picker should at minimum be able to show what the agent is actually configured with. For `DatabricksV2` it couldn't: the fallback returned only the hardcoded slate, so a model like `databricks-gpt-5-5` wasn't selectable in its own picker. **3. Embedding endpoints were offered as chat models.** `databricks-bge-large-en` was selectable (visible in the dialog today). The v2 endpoints payload carries no `task` or `state` field, so there is nothing to filter on but the name. ## Changes - **`effective_discovery_provider`** (new, `desktop/src-tauri/src/commands/agent_models_env.rs`) — an explicit provider (saved record value, or the create/edit dialog's current form value) still always wins; when there is none, discovery falls back to the runtime's own provider env var (`GOOSE_PROVIDER`, `BUZZ_AGENT_PROVIDER`, …) read off the merged env, which by that point already carries the baked build floor and the process env. Wired into both `get_agent_models` and `discover_agent_models`. `SavedAgentModelDiscoveryConfig` now carries `provider_env_var` from `known_acp_runtime`, so each runtime reads *its own* key rather than a shared guess. - The relay-mesh branches in `discover_agent_models` deliberately keep using `input.provider`: those key off a deliberate provider selection, never a baked default. - **Asserted vs inferred matters for missing credentials.** The OpenAI and Anthropic gates error on a missing API key, while the Databricks gate falls through; an inferred provider hitting the first two would have replaced a working subprocess catalog with `config: ANTHROPIC_API_KEY required` (`export GOOSE_PROVIDER=anthropic` is goose's documented way to pick a provider, and it keeps the key in its own keyring). So `effective_discovery_provider` returns a `DiscoveryProvider` that remembers how the value was resolved, and `required_env` only reports a missing credential for an asserted provider. A wrong guess declines and lets the subprocess answer. - **`is_chat_capable_endpoint`** (new, `crates/buzz-agent/src/catalog.rs`) — applied in `parse_v2_endpoints_page`. Drops `*embedding*` and segment-matched `bge` / `gte` endpoints; keeps everything unrecognised (fail-open, so a new model family is never hidden). Segment matching is why it's `split('-')` and not `contains`: a substring check would swallow legitimate names. - **`discovery_failure_fallback`** for `Provider::DatabricksV2` now leads with the configured model (deduped against the known slate, blank-tolerant), so a failed discovery still yields a picker that can show the running model. The configured model is trimmed once up front — `resolve_model` doesn't trim, so a padded `DATABRICKS_MODEL` used to slip past the dedupe and appear twice. - **`sort_v2_endpoints_newest_first`** (new, second commit) — the catalog is now ordered newest-first on each endpoint's `created_timestamp`, ties broken by name. Previously Buzz sorted nothing, so the gateway's own order reached the picker: it pages in two phases (Databricks-managed, then workspace-created — the page token decodes to `{"phase":"user"}`), each alphabetical, which buried `databricks-claude-opus-5` 8th behind five older Claude endpoints and `goose-claude-opus-5` — the newest endpoint in the catalog — 55th of 63. Sorting in `fetch_v2_models` means both discovery paths inherit it with no wire or type changes, and the combobox filter preserves incoming order. Endpoints with an absent or unparseable timestamp sort last rather than first, so a wire-shape change degrades to "unordered at the bottom" instead of "shuffled to the top". - The name tiebreak is load-bearing: eleven managed endpoints share one placeholder timestamp (`1699610000000`), so without it their relative order would vary between runs. That placeholder is also not always accurate — a few genuinely recent endpoints (`databricks-kimi-k2-7-code`, `databricks-llama-4-maverick`) land at the bottom with the 2023 batch. The gateway offers nothing better to sort on. - Env/provider lookup helpers moved out of `agent_models.rs` into `agent_models_env.rs`. This keeps the command module under the file-size limit **without ratcheting the override up** — the existing 1079 entry is untouched (file is now 1066 lines). ## Verification Live against `block-lakehouse-production`, release build: ``` BUZZ_ACP_AGENT_COMMAND=$PWD/target/release/buzz-agent \ BUZZ_AGENT_PROVIDER=databricks_v2 \ DATABRICKS_HOST=https://block-lakehouse-production.cloud.databricks.com \ DATABRICKS_MODEL=databricks-gpt-5-5 \ ./target/release/buzz-acp models --json ``` - before: 66 endpoints, including `databricks-bge-large-en`, `databricks-gte-large-en`, `databricks-qwen3-embedding-0-6b` - after: **63** endpoints, `[.models[] | select(.id | test("embedding|-bge-|-gte-"))]` → `[]` Top of the list after the sort commit: ``` goose-claude-opus-5 2026-07-24 databricks-claude-opus-5 2026-07-23 databricks-gemini-3-6-flash 2026-07-20 databricks-gemini-3-5-flash-lite 2026-07-20 databricks-inkling 2026-07-14 ``` Tests: 15 new (8 in `catalog.rs` — including the two-wire-shape timestamp parse, the sort's tiebreak/no-timestamp cases, and the padded-model dedupe — and 7 plus one assertion in `agent_models_tests.rs`, 3 of them covering the asserted/inferred credential split), two existing tests updated. `just check`, `just test-unit`, and `just desktop-tauri-test` all pass (1636 desktop-tauri tests, 274 buzz-agent lib tests). Not run locally: the Docker-backed integration suite (`just test`) — this diff touches neither `buzz-relay`, `buzz-db`, nor `buzz-auth`. ## Follow-ups (deliberately out of scope) Two inference-path defects found while investigating, both reproduced live against the gateway and both independent of discovery: 1. **Gemini thought signatures are dropped.** The gateway returns a bare `thoughtSignature` on tool calls; the external-model serving endpoints return it nested as `extra_content.google.thought_signature`. Neither shape is round-tripped, so multi-turn tool use on `databricks-gemini-*` fails with a 400 on the second turn. 2. **Array-shaped `content` is silently discarded.** Some models return OpenAI `content` as a block array rather than a string; `parse_openai`'s `str_field` returns `None` and the text is dropped. The legacy `serving-endpoints` path does not work around either one, and costs reasoning support on the GPT-5 family. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 00:56:18 +00:00
3 people	07d0265cfc	fix(desktop): retire prepend mode on every reader wheel (#2913) ... ## Summary - retire Virtua prepend reconciliation on every ordinary reader wheel event, including events suppressed from its separate wheel-timing heuristic - keep Ctrl+wheel browser zoom excluded from reader ownership - arm the Ctrl+wheel prepend probe before pagination begins so it cannot miss the commit - preserve ESM/CJS patch parity and update the patch lock hash ## Why main was red PR #2855 added the reader-wheel retirement action after Virtua's existing suppression guard. Once the first event set that guard, later events in the same wheel burst returned before retiring prepend mode. A late ResizeObserver correction could then pull the viewport backward by 20–40px. The same test had failed twice on #2855 but passed its final retry, so the PR job appeared green; the merge commit lost all three retries. The separate Ctrl+wheel failure was a test race: its MutationObserver was registered after the request had already been triggered and could miss the prepend commit. ## Validation - desktop full unit suite: 3,515 passed - pre-push desktop check: passed - `git diff --check`: passed - CI is the E2E verification; no local E2E was run Fixes the main-branch failure in CI run 30180099007. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>	2026-07-25 17:22:15 -07:00
4 people	25e7864b35	fix(desktop): consolidate prepend scroll correction (#2855) ... ## Summary - make Virtua the sole prepend geometry/correction owner by accumulating active prepend ResizeObserver corrections from the live DOM offset - retire prepend reconciliation on ordinary reader wheel input, while preserving it for Ctrl+wheel browser zoom - remove Buzz's competing three-second semantic-anchor watcher and corrective `scrollBy` loop - keep ESM/CJS Virtua patch behavior equivalent and update the patch lock hash ## Why Buzz admitted prepended rows using seeded estimates, then Virtua received multiple measurement corrections for the same transaction. Each correction was based on the same stale model offset, so a later write replaced an earlier correction instead of accumulating it. In the reproduced first page, that resurrected 452px of anchor drift; the app-level watcher merely corrected the lost virtualizer write afterward. This fixes the correction inside Virtua and deletes the competing app writer, following the single-owner geometry invariant used by Berd rather than copying its spacer implementation. ## Validation - watcher-off desktop virtualization matrix: 11/11 passed, including 15 cascading prepends, continued wheel input, detached rich-row growth, channel switching, bottom follow, and buffered live arrivals - focused cascading prepend/Ctrl+wheel regression passed - desktop typecheck passed - desktop unit suite passed: 3,495 tests - Biome passed on changed desktop files - `git diff --check` clean ## Manual behavior Load older history repeatedly while scrolling upward, then wheel downward during/after a prepend. The visible anchor should stay within the existing 5px contract during reconciliation, and deliberate reader movement should not be pulled back. Ctrl+wheel during the prepend commit must not cancel reconciliation. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>	2026-07-25 16:49:56 -07:00
MagerandGitHub	c7089d3b52	docs(buzz-acp): correct agent key generation instructions (#2875)	2026-07-25 15:22:18 -07:00
3 people	20bff59102	fix(desktop): track concurrent agent turns up to the harness maximum (#2882) ... Desktop's active-turn store capped tracked concurrent turns per agent at `4` while the harness runs `DEFAULT_AGENT_PARALLELISM = 24` parallel agent subprocesses and accepts up to `32` (`--agents` / `BUZZ_ACP_AGENTS`, `value_parser range(1..=32)`). Turns above the cap were silently evicted, so a genuinely-running turn lost its working badge in the sidebar and the agents popover. The eviction also caused the badge set to rotate indefinitely. Evicted turns are still alive, so their hosts keep emitting `turn_liveness` every 10s; `recordActivity` can't find the evicted turn, `resurrectTurn` recreates it, and that eviction drops one of the surviving turns. With two live turns above the cap the visible set churned every 10 seconds. `MAX_TURNS_PER_AGENT` exists only to bound map growth, so it now sits at the harness's hard upper bound of `32` — unreachable for any legitimately-configured agent while still keeping the per-agent map bounded. `MAX_TERMINAL_TOMBSTONES` derives from it (`* 4`), so the tombstone cap moves from 16 to 128. Two regressions cover the reported symptom: a default-parallelism agent working in 24 channels keeps all 24 badges, and the tracked channel set stays stable as `turn_liveness` arrives for turns that previously would have been evicted. Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-25 16:13:41 -04:00
3 people	c0d7b52af8	docs(contributing): trim to goose-scale minimal intake surface (#2780) ... Replace the 5-file, ~180-line template surface with a 4-file, ~54-line goose-modeled set. ## What changed **`.github/PULL_REQUEST_TEMPLATE.md`** — rewritten to 8 lines: Summary, Related issue (with inline duplicate-check prompt), Testing. Checklist and AI-disclosure section removed. **`.github/ISSUE_TEMPLATE/bug-report.yml` → `bug-report.md`** — replaced YAML form with plain-markdown template (goose-style frontmatter). Fields: describe the bug, repro steps, expected behavior, version + OS, logs/context. Version guidance retained: Settings sidebar footer, "unknown" accepted. **`.github/ISSUE_TEMPLATE/feature-request.yml` → `feature-request.md`** — replaced YAML form with plain-markdown template. Fields: motivation, proposed solution, alternatives, additional context. Duplicate-check line at the bottom (goose-style). **`.github/ISSUE_TEMPLATE/question.yml`** — deleted. `config.yml` updated to `blank_issues_enabled: true` so questions have somewhere to go. **`CONTRIBUTING.md`** — "Before You Open a PR" compressed to four prose sentences: duplicate search, issue-first recommendation, AI ownership (absorbs the dropped PR-template field), review cadence. Intro link updated from the removed question form to plain `/issues/new`. ## Related issue none found --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-07-25 14:01:28 -04:00