External/buzz

mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

History

769ac70b74 fix(media): require authenticated reads (#4610 )

This change requires a valid signed Blossom authorization request and
current relay membership for every media GET and HEAD request. It
removes the unauthenticated compatibility path and updates desktop reads
to send the required authorization.

This blocks anonymous retrieval and access after relay-membership
revocation. It does not yet bind a blob to its originating channel, so
someone removed from a private channel can still read a known blob while
remaining a relay member. That channel-ACL follow-up remains required
before closing the full finding.

## Testing

- `git diff --check origin/main...codex/security-media-read-auth`
- Rebased onto `origin/main` at `5c98932`
- Full CI pending

Originating Buzz thread:
`buzz://message?channel=3928fe05-df61-4b5d-b9c7-d623b9b10ea1&id=3c6c02312f763fbe0d2bfc33a6c1a362f91d0354f3d18b039cf7a0558c1439d1`

---------

Signed-off-by: Jordan Mecom <jm@squareup.com>
Signed-off-by: Alex Rosenzweig <arosenzweig@squareup.com>
Signed-off-by: Eli Foster <efoster@squareup.com>
Co-authored-by: Eli Foster <efoster@squareup.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

2026-08-07 00:46:42 +00:00

..

Add Devin as a preset ACP harness (#3225 )

2026-07-30 16:58:28 -04:00

feat: ship Buzz Term (#4347 )

2026-08-03 21:51:17 -04:00

fix(desktop): preserve authoritative agent avatars (#4984 )

2026-08-06 17:14:12 -07:00

fix(media): require authenticated reads (#4610 )

2026-08-07 00:46:42 +00:00

fix(desktop): next/back navigation during key creation onboarding (#4978 )

2026-08-06 17:13:55 -07:00

.gitignore

…

biome.json

…

components.json

…

index.html

feat(desktop): remove theme selection from onboarding, default to Buzz + System (#1947 )

2026-07-16 06:54:16 -07:00

package.json

chore(release): release Buzz Desktop version 0.5.5 (#4809 )

2026-08-04 16:54:16 -07:00

playwright.config.ts

fix(desktop): enable message editing in Inbox (#2198 )

2026-08-05 17:00:23 -06:00

playwright.live.config.ts

feat(desktop+acp): spawn a harness per (agent, community) pair at GUI startup — warm sockets, lazy LLM pool (#2122 )

2026-07-22 13:24:46 -07:00

playwright.perf.config.ts

…

postcss.config.js

…

README.md

…

tailwind.config.js

feat(desktop): add focused thread mode (#2108 )

2026-07-19 09:55:39 -06:00

test-loader-hooks.mjs

fix(desktop): make the test loader work on Windows (#2758 )

2026-07-27 13:00:55 -04:00

test-loader.mjs

…

tsconfig.json

…

tsconfig.node.json

…

vite.config.ts

feat(projects): support multiple repositories (#4671 )

2026-08-04 17:30:12 -04:00

README.md

Buzz

Desktop chat shell with:

Tauri + React + TypeScript + Vite
Tailwind CSS
shadcn/ui-ready shared components
Biome (lint/format/check)
Feature-driven frontend structure

Scripts

pnpm dev - run the web frontend
pnpm tauri dev - run the desktop app
pnpm build - typecheck and build frontend
pnpm typecheck - TypeScript checks
pnpm lint - Biome lint
pnpm format - Biome format (write)
pnpm check - Biome check

Structure

src/shared - reusable app-wide code (ui, lib, styles)
src/features - feature modules (vertical slices)
src/app - top-level app composition