Repository navigation
refactor(plugin-manager): move distributor values into build settings - #2649
Conversation
The repository shipped a Git access rule for one organization, an Apps control plane for a private tenant and release settings for a private community. Distributors now supply these through build settings: - BUZZ_BUILD_REPOSITORY_ACCESS compiles default repository access rules in the repository-access.json schema. The native build validates it with the same parser and fails on any unusable rule. Unset means no default rules. - BUZZ_BUILDERLAB_APPS_CONTROL_PLANE names the Apps control plane for the build's login origin. The Rust and TypeScript copies of the public table drop the private tenant. Docs, tests and fixtures now use example hosts, organizations and fictional names, and drop private links, ticket keys and internal work logs. AGENTS.md gains an open-source boundary section. Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
Cargo reads rustc-env one line at a time, so pretty-printed BUZZ_BUILD_REPOSITORY_ACCESS reached the runtime truncated. The build now emits it as compact JSON. The frontend read BUZZ_BUILDERLAB_APPS_CONTROL_PLANE from Vite mode files, which the native build never reads. It now takes the value from the process and .env.local, as native does, with the same HTTPS-origin check. Fixtures use fictional names, and the design system describes its own values without naming an outside reference. Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
…leanup * origin/main: fix(mcp): accept create scopes in durable approvals (#2650) feat(bestie): Bestie tab and Remembers you for a hosted Bestie (#2478) fix(relay): p-tag a one-to-one DM's agent partner on new messages (#2475) fix(agents): show each message author's username and display name (#2628) fix(agents): preserve visible edits in conversation history (#2355) fix(canvas): keep todo edits from approving unrelated instructions (#2350) fix(messages): keep messages in their canonical channel (#2349)
…leanup * origin/main: fix(goose): track every replaced protected worker and check its security gate (#2528) docs(agents): say Pi agents don't take plugin notes yet (#2534) feat(agents): reorder agent cards with hold and drag (#1837) fix(messages): keep own sends from before the loaded history off the timeline (#2525) feat(github): rework the GitHub settings page (#2450) # Conflicts: # src/bundled/github/watcher.test.ts
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
…leanup * origin/main: Normalize profile names for verified-name matching (#2348) Add BuzzTerm font settings and compact glyph spacing (#2502) feat(plugins): let a host command run only verified bytes (#2535) NEXUS-4228: Add plugin toolbar actions and panel links (#2645) Keep plugin update controls stable and spaced (#2636) feat(inbox): rename to Activity and simplify the filter bar (#2543) # Conflicts: # src/bundled/inbox/InboxPage.test.tsx # tests/browser/inbox-archive.spec.mjs # tests/fixtures/profiles.tsx
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
…leanup * origin/main: fix(dialog): limit footer click-through to the gradient gutter (#2545) fix(channels): put the huddle launcher after the other header tools (#2660) feat(drafts-sent): bundle Drafts & sent for everyone (#2644) feat(identity): one Builderlab sign-in, the native NIP-FI session (#2576) fix(agents): let people dismiss connection setup cards (#2631) Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]> # Conflicts: # .github/workflows/release.yml # crates/plugin-manager/src/lib.rs # docs/configuration.md # src/bundled/builderlab/apps/client.test.ts # src/bundled/builderlab/apps/environment.ts # src/features/identity/builderlab-hosted.test.ts # src/features/identity/identity.test.tsx # vite.config.ts
…ones Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
) This PR strengthens the public-source boundary in `AGENTS.md` and removes internal deployment details from the contributor guide. - Adds an **Open-source boundary** section that prohibits Block-only identifiers and configuration, including internal community hosts, private repositories, organization-specific SSH users, internal infrastructure, tickets, Slack channels, and personal setups. It explicitly keeps public Builderlab supported. - Clarifies that the rule covers functionality as well as identifiers: OSS features must be generic and useful to any operator or distributor, with no knowledge of one company's internal services, workflows, or identity setup. Block-only functionality belongs in private repositories and may reach this code only through generic settings or documented general-purpose extension points that do not name, detect, or special-case an organization, plugin, or service. - Requires example values in tests, fixtures, docs, and examples, and makes boundary violations blocking. - Removes private build/deployment repository names and the internal deployment flow from the Ecosystem section. It retains the public repository descriptions and a general statement that internal builds and deployments live in private repositories. Related: [block/buzz-app#2649](block/buzz-app#2649) (the corresponding boundary for block/buzz-app) --------- Signed-off-by: Will Pfleger <[email protected]> Co-authored-by: Alia <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@buzz.block.builderlab.xyz>
…leanup * origin/main: (84 commits) Restore macOS Cmd-W window closing when no tab handles it (#2443) Make agent transcripts quieter and link finished replies to activity (#2424) fix(channels): wrap unread conversation stepping around the sidebar (#2682) fix(navigation): let bare buzz:// open Buzz without a broken-link notice (#2718) fix(inbox): open DM thread rows as the thread (#2587) test(channels): complete the context navigation fixture (#2783) fix(channels): open a thread's channel at its root message from the #channel link (#2377) fix(people): find people by a pasted npub or hex key (#2396) test(bestie): open the narrow long-history thread with clickRow (#2723) Account-first onboarding and sign-in recovery (#2579) fix(agents): scroll the avatar dock with a mouse wheel (#2567) fix(avatars): keep Done in view when the avatar popup is short (#2706) feat(messages): highlight reactions you've made (#2709) feat(usage): move Usage from the sidebar into Settings (#2742) fix(messages): keep a playing row mounted in the channel timeline (#2695) Fix plugin status declaration closure for author consumers (#2643) fix(navigation): keep empty new chats out of Back history (#1617) [buzz-app] Recover remote agent message outcomes (#2542) feat(messages): name background send destinations and attach the files that fit (#2406) feat(drafts): clear a draft from its row (#2725) ... # Conflicts: # src/bundled/builderlab/adapter-type/Activity.test.tsx
…leanup * origin/main: test(mentions): serve the mentions fixture as a build so cold loads fit (#2776) test(browser): let a late publication land after its page closed (#2565) test(relay): wait for the verified owner before a guest edits an agent (#2413) test: wait for the companion default width measurement (#2750) test(browser): preserve conversation scroll while revealing actions (#2715) test(browser): wait for link hit-testing after thread close (#2792) perf(messages): skip micromark for plain prose bodies (#2780) perf(inbox): load the emoji name table on first use (#2774) perf(messages): cut main-thread work while a busy channel is open (#2729) Refine agent Attention cards, watch details, and status controls (#2717) fix(bestie): remove a Bestie from its agent card on any device (#2720) feat(agents): preview Builderlab agent card links with Add to Buzz (#2719)
d633dc2 to
1df19cb
Compare
Names are not Block-internal values. The open-source rule now covers Block values and personal setups only. Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Will Pfleger <[email protected]>
kalvinnchau
left a comment
There was a problem hiding this comment.
🤖 Reviewed 534150f: distributor repository-access defaults and validation, runtime overrides, Rust/TypeScript/dev-broker Apps routing, FI origin selection, and release compatibility.
Approval is withheld because the paired staging build omits the new Apps control-plane input; see the anchored finding. The fix belongs in the companion release change. Two nonblocking behavior/scope findings are also inline.
Exact-head CI passed. Isolated actual-app/production-broker checks passed in Chromium and WebKit: four sign-in recovery outcomes and two custom-control-plane outcomes covering keyboard sign-in, 503/retry, reload continuity, and sign-out. Configuration checks covered source precedence, malformed inputs, FI origin selection, and public fallbacks. No actionable security finding was established.
Native GUI/keyring/FI forwarding, packaged artifacts, Windows runtime, real upstreams, and full host restart remain unverified. Merge this app change first, then the corrected companion release change immediately, with no release build between.
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
…leanup * origin/main: feat(agents): let app-hosted agents read their owner's channels and members (#2745) NEXUS-4271: Expose installed plugin status (#2754) fix(menu): stop clipping lifecycle actions behind a hidden scrollbar (#2716) feat(agents): give approved external apps the selected agent's full Buzz tools (#2707) AIDA-2549: Keep Claude settings drafts in sync (#2841) fix(channels): keep a channel's side panels open when returning to it (#2838) fix(builderlab): clarify remote-agent account availability (#2764) fix(sidebar): rename Remove from Team to Close conversation (#2845) perf(channels): cut header and name-matching work in large channels (#2726) fix(browser): silence a browser page once its tab goes away (#2721) Community Mesh: shared compute plugin (including agent type) (#941) perf(relay): cut main-thread work from profile updates (#2730) fix(composer): lead the channel placeholder with its sidebar icon (#2829) test(activity): scope preview assertions to the request row (#2843) perf(search): fold people names once across palette keystrokes (#2570) fix(github): keep PR watches running when localStorage is full (#2699) Make drafts and sent part of Messages (#2728) fix(canvas): render every Canvas within the save limit (#2839) # Conflicts: # .github/workflows/release.yml
kalvinnchau
left a comment
There was a problem hiding this comment.
🤖 Approved at 08a2f47. Re-reviewed distributor build defaults/schema, runtime overrides, Apps/FI routing and forwarding boundaries, community naming, and paired release inputs. The staging Apps input, legacy workflow override and naming findings are addressed; no new actionable findings remain.
Exact-head CI passed, including Rust/tool integration and Chromium/WebKit journeys (61 successful checks, one Windows validation skip). Earlier isolated app/broker 6/6 and corrected generic-host 2/2 results remain attributed to 2eca58f; source comparisons support the unchanged contracts. Native GUI/keyring/FI, packaged/Windows builds, real upstreams, registered agent-tool invocation and full restart remain unverified locally.
Merge this app PR first, then squareup/buzz-releases#135 immediately, with no release build between. Companion inputs were reviewed at 16f9a60b4f8fd46b323caf24860862d735ee1ec9.
…leanup * origin/main: feat(terminal): add an Option as Meta key setting on macOS (#2850) fix(agents): restrict workflow requests in bb-block only (#2518) fix(dialogs): Enter presses the highlighted button in every dialog (#2782) Polish Compact messages and conversation appearance settings (#2863) fix(composer): let Option+Up/Down switch conversations from an empty composer (#2832) fix(reactions): Scope timed reactions to the selected video (#2796) fix(communities): name what the Join dialog is doing instead of "Working…" (#2822) docs(agents): explain the per-conversation MCP cost of Claude agents (#2683) fix(avatars): keep unsaved avatar drafts and focus, and validate the URL late (#2714) fix(agents): offer stream and forum connection setup only to channel members (#2749) Describe Attention as what the agent does, not its tools (#2865) Let a local Codex agent join its owner's huddle by voice (#2321) ci: give the native job room for a cold Rust cache (#2867) fix(pairing): refuse unknown communities natively and name the requesting process (#2835) Add per-interest Attention pause and management controls (#2847) feat(drafts): show where unsent drafts wait (#2853) # Conflicts: # .github/workflows/release.yml
…ion-and-status * origin/main: (37 commits) fix(browser-host): use the Buzz login variant for dev Builderlab sign-in (#2222) refactor(plugin-manager): move distributor values into build settings (#2649) fix(communities): let Cancel, × and Escape leave a Join lookup and name the host that didn't answer (#2821) fix(agents): let watches hear public channels the agent is not in (#1854) Preview and send Drafts & sent in place, with a shared count bubble (#2833) feat(terminal): add an Option as Meta key setting on macOS (#2850) fix(agents): restrict workflow requests in bb-block only (#2518) fix(dialogs): Enter presses the highlighted button in every dialog (#2782) Polish Compact messages and conversation appearance settings (#2863) fix(composer): let Option+Up/Down switch conversations from an empty composer (#2832) fix(reactions): Scope timed reactions to the selected video (#2796) fix(communities): name what the Join dialog is doing instead of "Working…" (#2822) docs(agents): explain the per-conversation MCP cost of Claude agents (#2683) fix(avatars): keep unsaved avatar drafts and focus, and validate the URL late (#2714) fix(agents): offer stream and forum connection setup only to channel members (#2749) Describe Attention as what the agent does, not its tools (#2865) Let a local Codex agent join its owner's huddle by voice (#2321) ci: give the native job room for a cold Rust cache (#2867) fix(pairing): refuse unknown communities natively and name the requesting process (#2835) Add per-interest Attention pause and management controls (#2847) ... # Conflicts: # docs/buzz-help.md
Co-authored-by: Simone <0828be588d5c9c4d092c5b1cf01761d5aef63d6b104807fd8e8284d517dd1a99@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <[email protected]> * origin/main: (22 commits) feat(agents): squircle agent avatar previews (#2879) fix(todos): show Todos read-only without Canvas write access (#2799) fix(unread): leave mentions that arrive during catch-up unread (#2801) Show one working indicator while a message's live activity shows (#2851) fix(agents): ask before deleting a team (#2820) fix(dialog): keep stepped dialog cards top-anchored during crossfade (#2893) feat(attention): Interest titles, summaries and named people, and Activity and pause fixes (#2860) fix(messages): Enter on the outside-mention prompt invites again (#2897) feat(agents): keep open agent transcripts current while the agent works (#2844) perf(solo): render a sidebar chat row only when it changes (#2505) fix(solo): restore agent selection during slow background reads (#2751) feat(search): preview unread thread replies in cmd+k (#2743) fix(plugins): suggest SSH when a private HTTPS clone needs credentials (#2455) fix(browser-host): use the Buzz login variant for dev Builderlab sign-in (#2222) refactor(plugin-manager): move distributor values into build settings (#2649) fix(communities): let Cancel, × and Escape leave a Join lookup and name the host that didn't answer (#2821) fix(agents): let watches hear public channels the agent is not in (#1854) Preview and send Drafts & sent in place, with a shared count bubble (#2833) feat(terminal): add an Option as Meta key setting on macOS (#2850) fix(agents): restrict workflow requests in bb-block only (#2518) ... Signed-off-by: John Tennant <[email protected]> # Conflicts: # src/bundled/agents/AgentAvatarPicker.tsx # src/bundled/agents/AgentCreate.module.css
Co-authored-by: Simone <0828be588d5c9c4d092c5b1cf01761d5aef63d6b104807fd8e8284d517dd1a99@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <[email protected]> * origin/main: (22 commits) feat(agents): squircle agent avatar previews (#2879) fix(todos): show Todos read-only without Canvas write access (#2799) fix(unread): leave mentions that arrive during catch-up unread (#2801) Show one working indicator while a message's live activity shows (#2851) fix(agents): ask before deleting a team (#2820) fix(dialog): keep stepped dialog cards top-anchored during crossfade (#2893) feat(attention): Interest titles, summaries and named people, and Activity and pause fixes (#2860) fix(messages): Enter on the outside-mention prompt invites again (#2897) feat(agents): keep open agent transcripts current while the agent works (#2844) perf(solo): render a sidebar chat row only when it changes (#2505) fix(solo): restore agent selection during slow background reads (#2751) feat(search): preview unread thread replies in cmd+k (#2743) fix(plugins): suggest SSH when a private HTTPS clone needs credentials (#2455) fix(browser-host): use the Buzz login variant for dev Builderlab sign-in (#2222) refactor(plugin-manager): move distributor values into build settings (#2649) fix(communities): let Cancel, × and Escape leave a Join lookup and name the host that didn't answer (#2821) fix(agents): let watches hear public channels the agent is not in (#1854) Preview and send Drafts & sent in place, with a shared count bubble (#2833) feat(terminal): add an Option as Meta key setting on macOS (#2850) fix(agents): restrict workflow requests in bb-block only (#2518) ... Signed-off-by: John Tennant <[email protected]> # Conflicts: # src/bundled/agents/AgentCreate.module.css
Moves values that only make sense for one distributor out of the open-source tree and into build settings, and removes internal references from docs, tests and fixtures.
Merge order: this PR and squareup/buzz-releases#135 depend on each other and merge together: this PR first, then #135 right after, with no release build in between. #135 sets the new build inputs; without them a release build loses the Git access rule and the Apps control plane. #135 also checks that the built app contains both values, so it fails on any buzz-app commit from before this PR.
Build settings
BUZZ_BUILD_REPOSITORY_ACCESSreplaces the hardcodedsquareuprule incrates/plugin-manager/src/access.rs. It holds JSON in therepository-access.jsonschema and is compiled in as the default rules. The parser now lives inaccess/schema.rsand is shared withbuild.rs, so a value that isn't valid, has no rules or has an unusable rule fails the build. The build emits the value as compact JSON, so a pretty-printed value reaches the runtime whole. Unset means no default rules. Runtime file behavior is unchanged.BUZZ_BUILDERLAB_APPS_CONTROL_PLANEnames the Apps control plane for the build's own login origin. Rust (apps_control_plane) and TypeScript (controlPlane, plus the dev broker invite.config.ts) both read it from the same sources: the process environment, then.env.local. Vite mode files such as.env.productionare not read. Both sides require an HTTPS origin and a login origin. The private tenant entries (production and staging) are removed from both public tables. The native FI forwarder's Apps mode (src-tauri/src/federated_identity/access.rs) resolves its control plane through the sameapps_control_plane, and in an FI buildBUZZ_BUILDERLAB_ORIGINis the descriptor's identity origin, so the setting applies to FI sign-in too.release.ymlno longer compiles one private community into the external-MCP and owner-access allowlists (BUZZ_EXTERNAL_MCP_COMMUNITIES,BUZZ_OWNER_MCP_COMMUNITIES) or the workflow-restriction list (BUZZ_WORKFLOW_RESTRICTED_COMMUNITIES). Builds that want them set their own origins, and the docs and workflow-authorization test use example communities.communityNamedrops its hard-coded list of hosted suffixes. An unnamed<name>.communities.<domain>host shows as<name>on any domain, and any other host shows in full.Cleanup
docs/releases.md), and design-system source links. The design system describes its values in its own terms instead of naming an outside design reference.docs/archive/hardening-*, and the matching parts ofdocs/status.mdanddocs/inbox.md).AGENTS.md: the personal acceptance-setup section is removed. A new "Open-source boundary" section lists what must not be committed and the build settings to use instead. It also says the rule covers functionality, not only identifiers: features must be generic, Block-only functionality belongs in a privately kept plugin, and host changes for such plugins must be documented, inert, general-purpose extension points.Validation
cargo test -p buzzodz-plugins --lib: 80 passed.BUZZ_BUILD_REPOSITORY_ACCESSset to the buzz-releases value resolveshttps://github.com/squareup/x.gitto the same SSH URL and agent socket as the old built-in rule (buzzodz plugin access). An invalid value fails the build.build_configtests cover compact emission of pretty-printed JSON, and the control plane from process and.env.localbut not from a mode file.browser-host/vite-config.test.mjscovers the same frontend cases plus a rejected non-origin value. Abuzzodzbuilt with pretty-printed JSON resolves its rule at runtime (exit 0).cargo test -p buzzodz-pluginsand thefederated_identitytests insrc-tauripass.Related: squareup/buzz-releases#135, block/buzz#9114