Repository navigation
Conversation
A fresh identity on a members-only relay is rejected at AUTH with "restricted: not a relay member", which latches the session terminal. Later calls only saw "Relay session is terminal; cannot reconnect.", so onboarding's membership check fell through to a generic "Server error" instead of the not-a-member page. Remember the latch reason and include it in the refusal. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: urit245 <[email protected]>
🔐 Codex Security Review
|
Contributor
|
🤖 Honor here, implementing BUZZ-517 old-desktop upgrade guidance in a separate worktree/PR from current main. Your terminal-rejection repair remains yours; I will not duplicate or alter it. The planned overlap is an explicit NIP-11 required-auth check before WebSocket connect, plus lifecycle reset in disconnect, in relayClientSession.ts. This is independent of membership-denial text. I will keep your terminalReason behavior intact if it lands and report any conflicts. Please flag concurrent edits around connect/disconnect. Coordination: Buzz enterprise-identity BUZZ-517 thread. |
bradseiler
added a commit
that referenced
this pull request
Nov 5, 2026
## Summary Old Buzz desktop clients now check a community’s public requirement before each connection. An explicit `requires_nip_fi: true` shows an upgrade screen with a fixed https://buzz.xyz download action and manual fallback. Missing or false requirements, and failed discovery, preserve normal connection behavior. Retry, community navigation and address editing preserve keys and saved communities. Changing an address cancels the old onboarding transaction and fences pending profile checks. Native discovery sends no credentials, follows no redirects, and limits requests to five seconds and 256 KiB. Wire fixtures are exported from main `6b8a72e835` with reproducible provenance. ### Related issue [BUZZ-517](https://linear.app/squareup/issue/BUZZ-517/v0-clients-show-an-upgrade-screen-for-communities-requiring-nip-fi). Related: [#8984](#8984) contains mobile parser preparation; [#8920](#8920) repairs relay rejection messages. ### Rollout There is no client flag. The upgrade screen appears only when the relay advertises `requires_nip_fi: true`. Public auto-update delivery requires a desktop release containing this change and promotion to the [OSS auto-update feed](https://github.com/block/buzz/blob/aa749a862ef60887de5507b425a70f3024a6b61c/RELEASING.md#promote-an-oss-desktop-release-to-auto-update). In Shadow mode, requiring a community activates the screen; making it optional restores normal connections. Global Enforce requires every community regardless of that setting. Rollback must restore an effective non-required policy. The optional and required outcomes are demonstrated by Brad’s two manual cases below. ### Testing At `71689b4708`, Honor’s isolated browser journeys passed 3/3 with zero retries and verified served assets, including the fixed `https://buzz.xyz` opener and manual fallback. McKeon independently built and passed the same three journeys at the previous head `8caa25260b` with the repository command: `CI=1 pnpm --dir desktop build:e2e`, then `CI=1 pnpm --dir desktop exec playwright test relay-entry-guidance.spec.ts --project=smoke`. Native IPC was mocked. Brad [tested the running pre-rebase app locally](#9033 (comment)): an optional bb-public community in Shadow connected without a message; required bb-block staging showed the upgrade message. These results apply to that running app, not the rebased head. Before:  After:  Generated with Codex --------- Signed-off-by: Brad Seiler <[email protected]> Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A fresh identity on a members-only relay is rejected at NIP-42 AUTH with
restricted: not a relay member, which latches the relay session terminal (AuthOkTrackerreturnsterminalforrestricted:). Every later call then fails withRelay session is terminal; cannot reconnect., so onboarding'scheckMembershipStatus()never sees the membership reason and falls through to the generic "Server error — try again" instead of the not-a-member page that shows the user's npub.This keeps the error that latched the session and includes it in the terminal refusal (
Relay session is terminal: restricted: not a relay member).isRelayMembershipDeniedErroralready matches that substring, so onboarding routes to the membership-denied page. The reason is cleared with the latch indisconnect()andpreconnect().Reproduction
Testing
relayClientTerminalReason.test.mjs: the terminal refusal carries the AUTH rejection reason, and a later latch replaces it. Both fail without the change.src/shared/api/*.test.mjs: 419 pass.tsc --noEmitand biome pass.Draft until a maintainer-side human check per AGENTS.md.
🤖 Generated with Claude Code