Skip to content

fix(auth): style federated sign-in callback pages - #2549

Merged
kalvinnchau merged 6 commits into
mainfrom
am/federated-callback-style
Nov 5, 2026
Merged

fix(auth): style federated sign-in callback pages#2549
kalvinnchau merged 6 commits into
mainfrom
am/federated-callback-style

Conversation

@kalvinnchau

@kalvinnchau kalvinnchau commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Federated sign-in callbacks now use the shared account-card template with Buzz branding, embedded Inter, and browser light/dark styling. Viewport-bounded gutters keep enlarged text readable, with proportional card insets and corners on narrow screens. Success and error pages retain their return-to-app guidance, while Builderlab keeps its artwork and browser-close behavior. The development broker supplies the shared template's branding, artwork and close-hint fragments.

Validation: 16 callback tests, 120 Chromium/WebKit rendering cases, independent real-listener coverage, 24 pixel-identical Builderlab comparisons, workspace Clippy, full JavaScript unit suite (17,609 passed; 22 skipped), and commit hooks passed. The Node broker regression reproduced the template defect; 16 Chromium/WebKit checks of its corrected HTTP responses passed, including manual guidance after a blocked close. Full native package runs on macOS encounter a window-state SIGSEGV also reproduced on the base branch. Browser coverage includes narrow layouts, enlarged text, error states, CSP, privacy headers, and closing behavior.

Hosted CI and DCO passed, and the required GitHub approval is recorded. Human test confirmation remains pending. Native-app and real identity-provider acceptance remain pending. Browser journeys added/removed: 0.

Federated callback success in light mode Federated callback success in dark mode Federated callback error at narrow width Federated callback at 320px viewport and 200% text Existing Builderlab callback

kalvinnchau and others added 2 commits November 4, 2026 17:13
@kalvinnchau am
fix(auth): style federated sign-in callback pages
0763b9b 
reuse the standalone account card with buzz branding and browser theme colors. retain return-to-app guidance and select builderlab close behavior per callback type.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
@kalvinnchau am
fix(auth): preserve callback text width on narrow screens
f66248b 
cap federated page and card gutters by viewport width so enlarged text keeps readable word wrapping.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
@kalvinnchau
kalvinnchau marked this pull request as ready for review November 5, 2026 01:46
@kalvinnchau
kalvinnchau requested a review from a team as a code owner November 5, 2026 01:46
@kalvinnchau am
fix(auth): keep narrow callback card insets proportional
b570ea0 
scale all federated card insets and corner radius together while preserving enlarged text reflow.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
wesbillman
wesbillman reviewed Nov 5, 2026
View reviewed changes

@wesbillman wesbillman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

No blockers. Reviewed f66248bd. The b570ea0d delta only changes the padding and radius on the Buzz-only card, so Builderlab is untouched.

  • CSP/template: the style hash matches the emitted <style> on both paths. No placeholder collisions in the inserted CSS, JS, SVGs or close-hint. The federated (FI) pages emit no script or script-src, and only fixed copy is interpolated.
  • Rendering: the real reply() output was served with its real headers and checked in Chromium in light, dark, forced-colors, 320px and 200% text. No CSP violations, no overflow, and contrast of 7:1 or better. Builderlab differs from base only in CSP directive order, the style hash, the data-provider attribute and whitespace. Its computed layout matches, and screenshots are pixel-identical apart from spinner rotation.
  • Contract: the #1938 objection was Builderlab branding on non-Builderlab authorities. Buzz branding identifies the receiving app, so that concern doesn't apply. The FI pages keep receipt-before-verification copy, with no close and no focus return. The new deadline(...).is_none() assertion guards that last point.

One copy nit is inline. Process nit: the body says "Draft pending human acceptance", but the PR isn't a draft. Either restore draft status until the native and identity-provider acceptance you mention is done, or update the body. Hosted CI was still pending at review time.

Comment thread src-tauri/src/oauth_callback/mod.rs Resolved
@kalvinnchau am
fix(auth): remove duplicate callback receipt copy
6d63bc4 
keep receipt status in the heading and return-to-app verification guidance in the paragraph. update success-page assertions.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
wesbillman
wesbillman reviewed Nov 5, 2026
View reviewed changes

@wesbillman wesbillman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Star Lord automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot reviews.

Reviewed head 6d63bc4ae19d3a9849238e3d56cb7b47c1defe20, target base b95f9df80d970610a720baec68ca93258251f7c3 (PR diff from merge-base 5309a29a7f3a8f141e3b912b8a1827d3e87c2e19). The previously noted duplicate success copy is resolved. One separate P2 compatibility finding is inline: the shared template changed without updating its existing Node Builderlab renderer.

Reviewed callback/auth boundaries, native and broker consumers, CSP, error/success/close behavior, accessibility source, the PR description and all five attached screenshots. Source-only: no tests, builds, apps, browser or identity-provider flows executed; author-reported validation was not independently reproduced. Native and real-provider acceptance remain unverified by this review.

Comment thread src-tauri/src/oauth_callback/page.html Resolved
kalvinnchau and others added 2 commits November 4, 2026 18:13
@kalvinnchau am
fix(auth): update broker callback template rendering
0126c7f 
fill the shared builderlab brand, artwork, provider and close-hint slots. cover the callback title and unresolved placeholders in the broker regression test.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
@kalvinnchau am
refactor(auth): share callback brand and artwork fragments
f35d68a 
reuse the same markup in the native and node callback renderers. preserve emitted html and csp policies.

Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Kalvin Chau <[email protected]>
wesbillman
wesbillman reviewed Nov 5, 2026
View reviewed changes

@wesbillman wesbillman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Star Lord automated source review via Wes’s account, integrating independent Rocket, Mantis and Groot reviews.

Reviewed head f35d68a7030501d769c5184aeb7204b0a5161b23, target base b95f9df80d970610a720baec68ca93258251f7c3. The prior P2 is addressed in source: the Node Builderlab renderer now supplies the shared brand, artwork and close-hint fragments and resolves provider tokens after insertion, restoring its title, accessible brand and manual-close guidance. The new regression assertions cover those elements and unresolved placeholders. The shared-fragment extraction preserves the Rust renderer’s Builderlab/federated split.

No new actionable findings in the five-file follow-up against 6d63bc4ae19d3a9849238e3d56cb7b47c1defe20. Checked both consumers, substitution order, CSP and success/error/close behavior; retained prior coverage of unchanged code and the five unchanged screenshots, and checked the updated PR description.

Source-only: no tests, builds, apps, browser or identity-provider flows executed. Author-reported validation was not independently reproduced; native and real-provider acceptance remain unverified by this review.

@kalvinnchau
kalvinnchau merged commit f27e308 into main Nov 5, 2026
77 of 79 checks passed
@kalvinnchau
kalvinnchau deleted the am/federated-callback-style branch November 5, 2026 02:50
@baxen baxen mentioned this pull request Nov 5, 2026
Merged
cheng-block added a commit to cheng-block/buzz-app that referenced this pull request Nov 5, 2026
@cheng-block @cursoragent
Merge remote-tracking branch 'upstream/main' into cheng/fix-channel-s…
79024a0 
…ettings-shift-esc

* upstream/main: (91 commits)
  test(browser): click timeline rows only after the timeline settles (block#2560)
  ci: split Vitest across six shards so 3/4 stops hitting the job cap (block#2571)
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  fix(messages): keep the hover toolbar while its menu is open (block#2439)
  feat(workflows): suggest channel members for @ in Send Message text (block#2309)
  AIDA-2344: Exclude muted channels from Dock (block#2313)
  feat(search): add slack-style message search operators on desktop (block#2463)
  test: fix invitation and coordination checks on main (block#2517)
  ...

Signed-off-by: Cheng Peng <[email protected]>
Co-authored-by: Cursor <[email protected]>
cheng-block added a commit to cheng-block/buzz-app that referenced this pull request Nov 5, 2026
@cheng-block @cursoragent
Merge upstream/main to rerun CI against current main
5a3c2be 
* upstream/main: (22 commits)
  test(browser): click timeline rows only after the timeline settles (block#2560)
  ci: split Vitest across six shards so 3/4 stops hitting the job cap (block#2571)
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  fix(messages): keep the hover toolbar while its menu is open (block#2439)
  feat(workflows): suggest channel members for @ in Send Message text (block#2309)
  AIDA-2344: Exclude muted channels from Dock (block#2313)
  feat(search): add slack-style message search operators on desktop (block#2463)
  test: fix invitation and coordination checks on main (block#2517)
  ...

Signed-off-by: Cheng Peng <[email protected]>
Co-authored-by: Cursor <[email protected]>
cheng-block added a commit to cheng-block/buzz-app that referenced this pull request Nov 5, 2026
@cheng-block @cursoragent
Merge upstream/main to rerun CI against current main
8ef7a3c 
* upstream/main: (91 commits)
  test(browser): click timeline rows only after the timeline settles (block#2560)
  ci: split Vitest across six shards so 3/4 stops hitting the job cap (block#2571)
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  fix(messages): keep the hover toolbar while its menu is open (block#2439)
  feat(workflows): suggest channel members for @ in Send Message text (block#2309)
  AIDA-2344: Exclude muted channels from Dock (block#2313)
  feat(search): add slack-style message search operators on desktop (block#2463)
  test: fix invitation and coordination checks on main (block#2517)
  ...

Signed-off-by: Cheng Peng <[email protected]>
Co-authored-by: Cursor <[email protected]>
ljknight added a commit to ljknight/buzz-app that referenced this pull request Nov 5, 2026
@ljknight
Merge remote-tracking branch 'origin/main' into lauraknight/github-li…
bdfe17c 
…nks-in-browser

* origin/main: (138 commits)
  feat(composer): optional ⌘/Ctrl+Enter to send (block#2331)
  test: use keyboard activation for reply caret setup (block#2557)
  test: settle member search before invitation expansion (block#2532)
  test(agent-command): isolate the copied executable writer (block#2537)
  test(sidebar): wait for the rolled-back row to leave Starred before collapsing Work (block#2574)
  test(browser): click timeline rows only after the timeline settles (block#2560)
  ci: split Vitest across six shards so 3/4 stops hitting the job cap (block#2571)
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  ...

# Conflicts:
#	src/bundled/github/README.md
damienrj added a commit to damienrj/buzz-app that referenced this pull request Nov 5, 2026
@damienrj
Merge origin/main into claude/private-github-clone-auth-ab8b97
4d70569 
* commit 'a39dba132^':
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  fix(messages): keep the hover toolbar while its menu is open (block#2439)

Signed-off-by: damienrj <[email protected]>
ljknight added a commit to ljknight/buzz-app that referenced this pull request Nov 5, 2026
@ljknight
Merge origin/main into lauraknight/quote-selection
24cc09a 
* origin/main: (121 commits)
  feat(composer): optional ⌘/Ctrl+Enter to send (block#2331)
  test: use keyboard activation for reply caret setup (block#2557)
  test: settle member search before invitation expansion (block#2532)
  test(agent-command): isolate the copied executable writer (block#2537)
  test(sidebar): wait for the rolled-back row to leave Starred before collapsing Work (block#2574)
  test(browser): click timeline rows only after the timeline settles (block#2560)
  ci: split Vitest across six shards so 3/4 stops hitting the job cap (block#2571)
  feat(github): unfurl PR and issue links inline with their title (block#1693)
  fix(auth): style federated sign-in callback pages (block#2549)
  fix(agents): align creation model controls with identity (block#2480)
  Run native Codex through plugin execution targets (block#2150)
  test: split Solo access browser scenarios (block#2499)
  feat(agents): let any agent change Buzz settings through the MCP (block#2248)
  Let plugins decorate host sidebar rows and add sort modes (block#1853)
  NEXUS-4082: Keep the new-message boundary stable during a visit (block#2083)
  feat(agents): move version history into settings (block#2374)
  fix(agents): read goose Activity by saved session ids and render memory bodies on open (block#2466)
  feat(channels): starter channels: admin switch and relay auto_join flag (block#1624)
  fix(plugins): read Square HTTPS sources with the Block SSH agent (block#2465)
  feat(plugins): let agents request plugin changes for owner review (block#2280)
  ...

# Conflicts:
#	docs/buzz-help.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wesbillman wesbillman wesbillman approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kalvinnchau @wesbillman