Skip to content

fix(cli): pair for the active community, skip stopped desktops, accept a bare relay host - #9417

Merged
wpfleger96 merged 4 commits into
mainfrom
hayt/cli-pair-relay-defaults
Nov 13, 2026
Merged

wpfleger96 merged 4 commits into
mainfrom
hayt/cli-pair-relay-defaults

Conversation

@wpfleger96

@wpfleger96 wpfleger96 commented Nov 12, 2026 •

Copy link
Copy Markdown
Member

Summary

Fixes to buzz auth desktop pair and relay selection:

  • pair skips desktops that aren't running. A desktop that exited without removing its advertisement no longer counts toward "several Buzz desktops are running". It uses the same running test as probe, where only a transport failure means not running.
  • --relay is global, so buzz auth desktop pair --relay … works and the flag shows in subcommand help.
  • A bare host means https:// for --relay and BUZZ_RELAY_URL. An explicit http://, ws:// or wss:// stays as typed.
  • pair with no relay sends [client]. The desktop pairs for its active community and returns the bound relays, which the CLI stores. An older desktop answers invalid_request, which the CLI reports as "this Buzz can't pick a community; pass --relay".
  • docs/local-credential-provider.md: covers the one-parameter pair, unavailable when no community is active, the older-provider fallback, skipping stale advertisements, and a lapsed sign-in keeping the pairing instead of revoking it.
  • The existing concurrent_pair_and_unpair… test now fails after 60s instead of hanging when the held pair request never reaches the mock desktop.
  • The CLI tests that run the real lsof same-user check now take turns. A nextest test group, desktop-same-user-check, serializes the whole desktop_provider:: module for the pre-push hook. Most of its tests reach the check, and the few that don't run serially too. A test-only lock around the check does the same in cargo test. Waiting for a turn doesn't count against the request timeout. The check and its 5s limit are unchanged. list_tells_a_stale_advertisement_from_a_rejection keeps the in-cap retry_after of 30 and times from the desktop's first answer, so waiting for a turn isn't counted.

The desktop half is block/buzz-app#3386.

Testing

  • New tests: pair_skips_a_desktop_that_is_not_running, an_older_desktop_asks_for_a_relay, relay_flag_is_global_and_a_bare_host_means_https, plus updated relay-selection cases.
  • cargo test -p buzz-cli --locked -- --test-threads=4 passes: 689 tests, both with default threads and with --test-threads=4, and under the pre-push hook's nextest run.

@wpfleger96
wpfleger96 requested a review from a team as a code owner November 12, 2026 20:19
@wpfleger96
wpfleger96 deployed to codex-review November 12, 2026 20:19 — with GitHub Actions Active
@github-actions github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 12, 2026
@github-actions

github-actions Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

  • Exact PR diff: a314975ce7bf9aa00baebfef874b6e69474a95cf...5361a075bad1a4b3a8ded05ef885faeb1e637e63
  • Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.


Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings were identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

  • Review used read-only static inspection; builds and tests were not run.
  • The reference desktop provider is maintained outside this checkout, so its handling of pairing without a relay could not be independently verified.

Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run

@github-actions github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 12, 2026
@wpfleger96
wpfleger96 deployed to codex-review November 12, 2026 20:48 — with GitHub Actions Active
@wpfleger96
wpfleger96 marked this pull request as draft November 12, 2026 20:48
@github-actions github-actions Bot added codex-security-review-current The posted Codex security review matches its recorded range. and removed codex-security-review-current The posted Codex security review matches its recorded range. labels Nov 12, 2026
wpfleger96 and others added 4 commits November 12, 2026 17:36
…t a bare relay host

- pair counts only desktops that answer, so a stale advertisement is skipped
- --relay is global, so it works after the subcommand
- a bare host in --relay or BUZZ_RELAY_URL means https://
- pair with no relay sends [client]; an older desktop's invalid_request says to pass --relay
- document community-less pairing and the kept pairing on a lapsed sign-in

Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
Run all at once on a busy Mac, the desktop provider tests' lsof same-user
checks starve each other past their 5-second limit. A nextest test group
serializes those tests; in cargo test, a test-only lock does the same around
the check, outside the request timeout. The check itself is unchanged.

Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
Restore the in-cap retry_after of 30 and time from the desktop's first
answer, so waiting for a same-user turn is not counted. Say that the nextest
group serializes the whole desktop_provider module.

Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
@wpfleger96
wpfleger96 force-pushed the hayt/cli-pair-relay-defaults branch from e58748b to 5361a07 Compare November 12, 2026 22:47
@wpfleger96
wpfleger96 marked this pull request as ready for review November 12, 2026 22:50
@wpfleger96
wpfleger96 deployed to codex-review November 12, 2026 22:51 — with GitHub Actions Active
@github-actions github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 12, 2026

@kazemek21 kazemek21 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kyle reviewed the PR and the Nexus review-tracker notes and approves.

Posted by Codex (gpt-6.1-sol) on behalf of kylez

@wpfleger96
wpfleger96 merged commit 630922a into main Nov 13, 2026
97 checks passed
@wpfleger96
wpfleger96 deleted the hayt/cli-pair-relay-defaults branch November 13, 2026 00:29
wpfleger96 added a commit to block/buzz-app that referenced this pull request Nov 13, 2026
Pins block/buzz at the merge of block/buzz#9417, so the bundled CLI pairs
for the open community, skips stopped desktops, takes --relay after the
subcommand and reads a bare host as https://. The help and the buzz link's
doc comment describe the new behaviour.

Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
wpfleger96 added a commit to block/buzz-app that referenced this pull request Nov 13, 2026
…ty, and put buzz on PATH (#3386)

## Summary

**Keep pairings when the sign-in lapses.** If the Builderlab sign-in
expired and Buzz restarted before you signed back in, the next CLI call
deleted its pairing for good. With no saved session, Buzz reads you as
signed out with no email, and that never matched the email the pairing
was approved under (`admit` in `credential_service/pairing.rs`). A real
sign-out or account change already revokes every pairing on its own, so
that mismatch now answers "sign in again in Buzz" and keeps the pairing.
Other mismatches still revoke.

**`pair` without a relay uses the open community.** `pair` with
`[client]` alone pairs for the community open in Buzz. The page now
reports that community along with the saved ones
(`credential_pairing_communities` gains `active`). With none open, the
tool is refused without asking: "open one in Buzz, or pass --relay".
`[client, relay]` works as before, and the Allow prompt still shows the
community.

**`buzz` on PATH.** At every start, the installed app links
`~/.local/bin/buzz` to its bundled CLI at its real path. It replaces a
symlink that dangles or points at a Buzz app's CLI, and leaves any other
symlink, file or directory alone. Dev builds (`tauri::is_dev()` or a
non-release identifier), AppImages, and apps run from a mounted disk
image (`/Volumes/…`) or App Translocation skip it. On Windows, the NSIS
hooks add `$INSTDIR\bin` to the user PATH on install and remove it on
uninstall. PowerShell edits the registry value in place, so a long PATH
isn't truncated, unexpanded entries survive and nothing is added twice,
and then the change is broadcast. The README's command-line step is
updated to match.

## Testing

- New `a_pairing_survives_a_lapsed_sign_in_and_a_restart`: pair while
signed in with an email, relaunch signed out with no sign-out recorded,
probe. The pairing is kept, the probe answers "sign in again", and the
token works once signed back in.
- New `a_pairing_without_a_relay_uses_the_open_community`: refused with
no open community, then approved for it once one is set.
- New `cli_link` unit test: creates the link, relinks dangling and
Buzz-CLI links, and leaves a link to a custom CLI, files and directories
alone.
- The NSIS hook was not run locally; Windows CI builds the installer.

**Bundled CLI.** Pins block/buzz (`src-tauri/Cargo.toml`, `Cargo.lock`)
at `630922a9`, the merge of buzz#9417, which contains the previous pin
`0e6037c7`. The bundled `buzz` then pairs for the open community when no
relay is given, skips stopped desktops, accepts `--relay` after the
subcommand and reads a bare host as `https://`. `docs/buzz-help.md`
describes this, plus a lapsed sign-in keeping its pairings.

Related: [buzz#9417](block/buzz#9417)

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
bostonaholic added a commit that referenced this pull request Nov 13, 2026
Co-authored-by: mboston.Engineer <932d3b6ebea6cc83e091551ae46d1c7e7f8f7d0fa8e9cef5e6facc8544af413b@buzz.block.builderlab.xyz>

* origin/main:
  fix(mobile): require Builderlab consent for existing identities (#8823)
  feat(mobile): use HTTP/2 on iOS through app-wide URLSessions (#8897)
  fix(relay): publish a git push only when refs changed; check the protocol by refinement (#9425)
  fix(mobile): show shared chats under Solo (#9348)
  chore(release): release Buzz Desktop version 0.5.29 (#9456)
  feat(mobile): render messages with gpt_markdown 1.3.4 plusparse (#8945)
  fix(acp): bound observer retention by bytes (#7987) (#9436)
  Tune release codegen for faster/smaller binaries (#9434)
  feat(desktop): add dismissible banner pointing to the new buzz app (#9379)
  fix(mobile): keep publishing presence while the app is open (#9441)
  feat(mobile): share into Buzz from the iOS share sheet (#9433)
  fix(mobile): qualify every namesake mention and keep authored mention casing (#9325)
  fix(mobile): match browser GIF timing in the iOS reaction sheet (#9437)
  fix(mobile): play short-delay animation frames at browser speed (#9432)
  buzz-search: read profile names without the profile_name_fields function (#9397)
  buzz-db: build the community deletion lock key in Rust (#9396)
  fix(cli): pair for the active community, skip stopped desktops, accept a bare relay host (#9417)
  test(mobile): run push tests without a gateway dart-define (#9423)
  fix(mobile): never pop Home when archiving from channel settings (#9387)
  perf(acp): reduce observer CPU and lock overhead (#9381)

Signed-off-by: Matthew Boston <[email protected]>
bostonaholic added a commit that referenced this pull request Nov 13, 2026
…count-backfill

Co-authored-by: mboston.Engineer <932d3b6ebea6cc83e091551ae46d1c7e7f8f7d0fa8e9cef5e6facc8544af413b@buzz.block.builderlab.xyz>

* bostonaholic--agent-reply-count:
  fix(mobile): require Builderlab consent for existing identities (#8823)
  feat(mobile): use HTTP/2 on iOS through app-wide URLSessions (#8897)
  fix(relay): publish a git push only when refs changed; check the protocol by refinement (#9425)
  fix(mobile): show shared chats under Solo (#9348)
  chore(release): release Buzz Desktop version 0.5.29 (#9456)
  feat(mobile): render messages with gpt_markdown 1.3.4 plusparse (#8945)
  fix(acp): bound observer retention by bytes (#7987) (#9436)
  Tune release codegen for faster/smaller binaries (#9434)
  feat(desktop): add dismissible banner pointing to the new buzz app (#9379)
  fix(mobile): keep publishing presence while the app is open (#9441)
  feat(mobile): share into Buzz from the iOS share sheet (#9433)
  fix(mobile): qualify every namesake mention and keep authored mention casing (#9325)
  fix(mobile): match browser GIF timing in the iOS reaction sheet (#9437)
  fix(mobile): play short-delay animation frames at browser speed (#9432)
  buzz-search: read profile names without the profile_name_fields function (#9397)
  buzz-db: build the community deletion lock key in Rust (#9396)
  fix(cli): pair for the active community, skip stopped desktops, accept a bare relay host (#9417)
  test(mobile): run push tests without a gateway dart-define (#9423)
  fix(mobile): never pop Home when archiving from channel settings (#9387)
  perf(acp): reduce observer CPU and lock overhead (#9381)

Signed-off-by: Matthew Boston <[email protected]>

This branch was successfully deployed

1 active deployment
codex-review — 5361a075 Deployed Nov 12, 2026 by wpfleger96 via Run Codex Security Review #14734
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex-security-review-current The posted Codex security review matches its recorded range.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants