From 2ee4224ae1b558c5c388618c097ed9884abfbabf Mon Sep 17 00:00:00 2001 From: Tim Marman Date: Mon, 27 Jul 2026 23:22:25 -0700 Subject: [PATCH 001/112] feat(desktop): join Remote Agencies via OASF and A2A Add a reviewable Remote Agency flow that imports public OASF-compatible agent records, invokes the source runtime through A2A, and supervises the local bridge through Buzz's existing ACP lifecycle. Buzz creates local Nostr proxy identities while the source runtime retains prompts, memory, tools, execution state, and signing authority. Signed-off-by: Tim Marman --- .github/workflows/ci.yml | 4 +- .github/workflows/linux-canary.yml | 2 +- .github/workflows/release.yml | 8 +- .github/workflows/signed-macos-canary.yml | 2 +- .github/workflows/windows-canary.yml | 2 +- Cargo.lock | 18 + Cargo.toml | 1 + Justfile | 13 +- crates/buzz-a2a-acp/Cargo.toml | 32 + crates/buzz-a2a-acp/README.md | 92 + crates/buzz-a2a-acp/src/lib.rs | 2173 +++++++++++++++++ crates/buzz-a2a-acp/src/main.rs | 6 + crates/buzz-acp/src/acp.rs | 19 + crates/buzz-acp/src/config.rs | 7 + crates/sprig/Cargo.toml | 1 + crates/sprig/src/main.rs | 5 +- .../src-tauri/src/commands/agent_models.rs | 15 +- .../src/commands/agent_models_tests.rs | 108 + .../src/commands/agent_name_update.rs | 34 + desktop/src-tauri/src/commands/mod.rs | 3 + .../src-tauri/src/commands/remote_agencies.rs | 813 ++++++ .../src/commands/remote_agencies_tests.rs | 275 +++ desktop/src-tauri/src/lib.rs | 4 + .../src-tauri/src/managed_agents/discovery.rs | 2 +- .../src-tauri/src/managed_agents/env_vars.rs | 1 + .../src-tauri/src/managed_agents/runtime.rs | 36 +- .../src/managed_agents/runtime/metadata.rs | 29 + .../src/managed_agents/runtime/process.rs | 14 + .../managed_agents/runtime/remote_adapter.rs | 27 + desktop/src-tauri/tauri.conf.json | 1 + .../agents/lib/remoteAgencyJoin.test.mjs | 146 ++ .../features/agents/lib/remoteAgencyJoin.ts | 133 + desktop/src/features/agents/ui/AgentsView.tsx | 3 + .../agents/ui/RemoteAgenciesSection.tsx | 116 + .../features/agents/ui/RemoteAgencyDialog.tsx | 597 +++++ desktop/src/shared/api/remoteAgencyTypes.ts | 61 + desktop/src/shared/api/tauri.ts | 32 + scripts/build-sprig.sh | 6 +- scripts/bundle-sidecars.sh | 4 +- 39 files changed, 4785 insertions(+), 60 deletions(-) create mode 100644 crates/buzz-a2a-acp/Cargo.toml create mode 100644 crates/buzz-a2a-acp/README.md create mode 100644 crates/buzz-a2a-acp/src/lib.rs create mode 100644 crates/buzz-a2a-acp/src/main.rs create mode 100644 desktop/src-tauri/src/commands/agent_name_update.rs create mode 100644 desktop/src-tauri/src/commands/remote_agencies.rs create mode 100644 desktop/src-tauri/src/commands/remote_agencies_tests.rs create mode 100644 desktop/src-tauri/src/managed_agents/runtime/remote_adapter.rs create mode 100644 desktop/src/features/agents/lib/remoteAgencyJoin.test.mjs create mode 100644 desktop/src/features/agents/lib/remoteAgencyJoin.ts create mode 100644 desktop/src/features/agents/ui/RemoteAgenciesSection.tsx create mode 100644 desktop/src/features/agents/ui/RemoteAgencyDialog.tsx create mode 100644 desktop/src/shared/api/remoteAgencyTypes.ts diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dd18179ee4..d1306901bc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -901,6 +901,7 @@ jobs: -p buzz-relay \ -p buzz-acp \ -p buzz-agent \ + -p buzz-a2a-acp \ -p buzz-dev-mcp \ -p git-credential-nostr \ -p git-sign-nostr @@ -939,7 +940,7 @@ jobs: shell: bash run: | mkdir -p desktop/src-tauri/binaries - for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do + for bin in buzz-acp buzz-agent buzz-a2a-acp buzz-dev-mcp git-credential-nostr buzz; do touch "desktop/src-tauri/binaries/${bin}-${TARGET}.exe" done - name: Clippy (workspace) @@ -1013,6 +1014,7 @@ jobs: mkdir -p desktop/src-tauri/binaries touch "desktop/src-tauri/binaries/buzz-acp-$TARGET" touch "desktop/src-tauri/binaries/buzz-agent-$TARGET" + touch "desktop/src-tauri/binaries/buzz-a2a-acp-$TARGET" touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET" touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET" touch "desktop/src-tauri/binaries/buzz-$TARGET" diff --git a/.github/workflows/linux-canary.yml b/.github/workflows/linux-canary.yml index 18d476e400..5e0a52bcad 100644 --- a/.github/workflows/linux-canary.yml +++ b/.github/workflows/linux-canary.yml @@ -166,7 +166,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh - name: Build Linux Tauri app diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c613924e57..896650c22f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -134,7 +134,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it. @@ -353,7 +353,7 @@ jobs: - name: Build sidecars run: | - cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh "$TARGET" - name: Build unsigned Tauri app @@ -611,7 +611,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh - name: Generate release config @@ -773,7 +773,7 @@ jobs: - name: Build sidecars shell: bash run: | - cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh "$TARGET" - name: Build Windows NSIS installer (unsigned) diff --git a/.github/workflows/signed-macos-canary.yml b/.github/workflows/signed-macos-canary.yml index fb0656028a..1a7bff0072 100644 --- a/.github/workflows/signed-macos-canary.yml +++ b/.github/workflows/signed-macos-canary.yml @@ -93,7 +93,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it. diff --git a/.github/workflows/windows-canary.yml b/.github/workflows/windows-canary.yml index 29f74fa0f6..192da231d5 100644 --- a/.github/workflows/windows-canary.yml +++ b/.github/workflows/windows-canary.yml @@ -122,7 +122,7 @@ jobs: - name: Build sidecars shell: bash run: | - cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh "$TARGET" - name: Build Windows NSIS installer (unsigned) diff --git a/Cargo.lock b/Cargo.lock index 3b60dc4579..4c1e8c960f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -760,6 +760,23 @@ version = "3.20.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" +[[package]] +name = "buzz-a2a-acp" +version = "0.1.0" +dependencies = [ + "base64", + "clap", + "hex", + "reqwest 0.13.4", + "serde", + "serde_json", + "sha2 0.11.0", + "thiserror 2.0.18", + "tokio", + "url", + "uuid", +] + [[package]] name = "buzz-acp" version = "0.1.0" @@ -8323,6 +8340,7 @@ dependencies = [ name = "sprig" version = "0.1.0" dependencies = [ + "buzz-a2a-acp", "buzz-acp", "buzz-agent", "buzz-dev-mcp", diff --git a/Cargo.toml b/Cargo.toml index 3ac7ee4cce..f8b07208f5 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -11,6 +11,7 @@ members = [ "crates/buzz-audit", "crates/buzz-acp", "crates/buzz-agent", + "crates/buzz-a2a-acp", "crates/sprig", "crates/buzz-test-client", "crates/buzz-ws-client", diff --git a/Justfile b/Justfile index bcef8983bc..2f27dfa9fd 100644 --- a/Justfile +++ b/Justfile @@ -155,7 +155,7 @@ _ensure-sidecar-stubs: set -euo pipefail TARGET=$(rustc -vV | sed -n 's|host: ||p') mkdir -p desktop/src-tauri/binaries - for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do + for bin in buzz-acp buzz-agent buzz-a2a-acp buzz-dev-mcp git-credential-nostr buzz; do touch "desktop/src-tauri/binaries/${bin}-${TARGET}" done @@ -236,6 +236,7 @@ desktop-release-build target="aarch64-apple-darwin": mkdir -p desktop/src-tauri/binaries touch "desktop/src-tauri/binaries/buzz-acp-$TARGET" touch "desktop/src-tauri/binaries/buzz-agent-$TARGET" + touch "desktop/src-tauri/binaries/buzz-a2a-acp-$TARGET" touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET" touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET" touch "desktop/src-tauri/binaries/buzz-$TARGET" @@ -428,7 +429,7 @@ dev *ARGS: bootstrap _ensure-sidecar-stubs _ensure-migrations fi done fi - cargo build -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr -p buzz-relay + cargo build -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr -p buzz-relay if [[ -n "{{mesh}}" ]]; then export MESH_LLM_NATIVE_RUNTIME_CACHE_DIR="$(./scripts/ensure-mesh-native-runtime.sh)" fi @@ -475,10 +476,10 @@ desktop-standalone *ARGS: _ensure-sidecar-stubs #!/usr/bin/env bash set -euo pipefail export PATH="{{justfile_directory()}}/bin:$PATH" - cargo build -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr + cargo build -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr TARGET=$(rustc -vV | sed -n 's|host: ||p') TARGET_DIR=$(cargo metadata --format-version 1 --no-deps | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).target_directory") - for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do + for bin in buzz-acp buzz-agent buzz-a2a-acp buzz-dev-mcp git-credential-nostr buzz; do cp "${TARGET_DIR}/debug/${bin}" "desktop/src-tauri/binaries/${bin}-${TARGET}" chmod +x "desktop/src-tauri/binaries/${bin}-${TARGET}" done @@ -504,7 +505,7 @@ staging *ARGS: bootstrap _ensure-sidecar-stubs set -euo pipefail export PATH="{{justfile_directory()}}/bin:$PATH" pnpm install # unconditional: staging must always start with a clean dep tree - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr FEATURES=() if [[ -n "{{mesh}}" ]]; then FEATURES=(--features mesh-llm) @@ -531,7 +532,7 @@ production *ARGS: bootstrap _ensure-sidecar-stubs set -euo pipefail export PATH="{{justfile_directory()}}/bin:$PATH" pnpm install # unconditional: production must always start with a clean dep tree - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr + cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr FEATURES=() if [[ -n "{{mesh}}" ]]; then FEATURES=(--features mesh-llm) diff --git a/crates/buzz-a2a-acp/Cargo.toml b/crates/buzz-a2a-acp/Cargo.toml new file mode 100644 index 0000000000..b8cb8738c6 --- /dev/null +++ b/crates/buzz-a2a-acp/Cargo.toml @@ -0,0 +1,32 @@ +[package] +name = "buzz-a2a-acp" +version.workspace = true +edition.workspace = true +rust-version.workspace = true +license.workspace = true +repository.workspace = true +description = "ACP adapter for agents advertised by an OASF Agent Record and invoked through A2A" +readme = "README.md" +keywords = ["acp", "a2a", "agntcy", "oasf", "agent"] +categories = ["command-line-utilities", "web-programming"] + +[lib] +name = "buzz_a2a_acp" +path = "src/lib.rs" + +[[bin]] +name = "buzz-a2a-acp" +path = "src/main.rs" + +[dependencies] +base64 = "0.22" +clap = { version = "4", features = ["derive", "env"] } +hex = { workspace = true } +reqwest = { workspace = true, features = ["json", "rustls"] } +serde = { workspace = true } +serde_json = { workspace = true, features = ["raw_value"] } +sha2 = { workspace = true } +thiserror = { workspace = true } +tokio = { workspace = true, features = ["fs", "io-std", "io-util", "macros", "net", "rt-multi-thread", "sync", "time"] } +url = { workspace = true } +uuid = { workspace = true } diff --git a/crates/buzz-a2a-acp/README.md b/crates/buzz-a2a-acp/README.md new file mode 100644 index 0000000000..4f1f6472e4 --- /dev/null +++ b/crates/buzz-a2a-acp/README.md @@ -0,0 +1,92 @@ +# buzz-a2a-acp + +`buzz-a2a-acp` is a small BYOH subprocess adapter. It lets Buzz host an agent +that is described by an [AGNTCY/OASF Agent Record](https://docs.agntcy.org/oasf/agent-record-guide/) +and invoked with [A2A](https://a2a-protocol.org/latest/). + +The adapter reads the record, resolves the `integration/a2a` module (OASF id +`203`), and exposes the remote agent through Buzz's existing ACP stdio seam: + +``` +OASF Agent Record -> A2A Agent Card -> A2A JSON-RPC -> ACP stdio -> Buzz +``` + +The current adapter prefers an A2A JSON-RPC interface declared in +`supportedInterfaces`. It selects `SendMessage`/`GetTask` for A2A 1.x and +`message/send`/`tasks/get` for A2A 0.3. It sends the matching `A2A-Version` +header on every standard A2A request. It also has an explicit vendor +compatibility path for a non-standard card shape (`serviceEndpoint` plus +`agent/sendMessage` and `agent/getTask`). The compatibility path is not an A2A +release contract. Task responses are polled with bounded backoff until a +terminal state or the configured timeout. + +## Configure in Buzz + +Register the binary as a BYOH ACP runtime with: + +```text +command: buzz-a2a-acp +args: --record,/absolute/path/to/agent-record.json +``` + +The same configuration can be represented by a custom-harness JSON object: + +```json +{ + "id": "remote-oasf-agent", + "label": "Remote OASF agent", + "command": "buzz-a2a-acp", + "args": ["--record", "/absolute/path/to/agent-record.json"], + "env": {} +} +``` + +This is an operator-owned configuration example. The adapter is not added to +Buzz's compiled-in runtime gallery and does not auto-import or auto-trust +records. + +Or set `BUZZ_A2A_AGENT_RECORD`. The record can be a local file or an HTTP(S) +URL. Use `BUZZ_A2A_BEARER_TOKEN` only when the remote A2A endpoint requires it. +The token is supplied by the operator and is never read from the public record. + +The adapter requires the OASF descriptor fields `digest`, `media_type`, and +`size` for every artifact. It validates the SHA-256 digest and exact size, and +it accepts only JSON media types. It accepts the OASF `data.card_data` field +only as an explicit deprecated compatibility fallback because current OASF +schemas prefer an artifact descriptor. + +Remote records and card/artifact endpoints must use HTTPS. HTTP is accepted +only for loopback hosts. Redirects are disabled. A bearer token is sent only +when `--bearer-token-endpoint` normalizes to the resolved A2A endpoint. This +keeps operator credentials out of arbitrary endpoints selected by a public +record. The adapter resolves each hostname, applies the address policy, and +pins the request client to the checked address. It does not perform a second +unchecked DNS lookup for the request. + +The optional `--agency-ref`, `--space-ref`, and `--agent-ref` flags project +stable host context references into A2A `metadata`. The source record does +not supply commands, environment variables, or credentials. New conversations +use random UUID context identifiers by default. An operator can supply a stable +identifier with `--context-id` or `BUZZ_A2A_CONTEXT_ID` when the host has a +durable conversation reference to preserve intentionally. + +## Scope and trust boundary + +The adapter projects public discovery metadata and A2A results. It does not +copy an Agency's private prompts, memory, tools, local files, or signing keys +into Buzz. The source runtime remains responsible for authentication, +authorization, execution, and any Nostr or Git signing. Buzz receives the +ACP-visible response or task status. + +This is an experimental adapter. It does not implement AGNTCY Directory +registration, OASF custom taxonomy exchange, A2A streaming, push notifications, +or Surface rendering. Those are separate integration layers that can build on +the real invocation seam without inventing a parallel agency protocol. + +OASF defines the record schema; it does not define how records are discovered +or transported. The current adapter resolves a reviewed local path or HTTPS +URL. Authenticity is therefore based on the operator's review and, for remote +records, the HTTPS connection. OASF 1.1 records do not carry a general record +signature. Domain-JWKS verification is the next planned trust layer. Optional +AGNTCY Directory resolution can follow when interoperable Directory identity +and verification are required. diff --git a/crates/buzz-a2a-acp/src/lib.rs b/crates/buzz-a2a-acp/src/lib.rs new file mode 100644 index 0000000000..1b52dad00c --- /dev/null +++ b/crates/buzz-a2a-acp/src/lib.rs @@ -0,0 +1,2173 @@ +#![forbid(unsafe_code)] + +//! A small, protocol-faithful bridge from an AGNTCY/OASF Agent Record to ACP. +//! +//! The bridge is intentionally a subprocess. Buzz owns the ACP session and UI; +//! the source runtime owns its agent identity, context, execution, and keys. + +use base64::Engine; +use clap::Parser; +use reqwest::{Client, StatusCode}; +use serde::Deserialize; +use serde_json::{json, value::RawValue, Value}; +use sha2::{Digest, Sha256}; +use std::{ + collections::HashSet, + net::{IpAddr, SocketAddr}, + path::{Path, PathBuf}, + sync::atomic::{AtomicU64, Ordering}, +}; +use thiserror::Error; +use tokio::io::{AsyncBufReadExt, AsyncWrite, AsyncWriteExt, BufReader}; +use url::Url; +use uuid::Uuid; + +const MAX_RECORD_BYTES: usize = 2 * 1024 * 1024; +const MAX_ARTIFACT_BYTES: usize = 2 * 1024 * 1024; +const MAX_ACP_LINE_BYTES: usize = 1024 * 1024; +const DEFAULT_TASK_POLL_SECS: u64 = 7_200; +const TASK_POLL_BACKOFF_SECS: [u64; 4] = [1, 5, 15, 30]; + +/// Configuration supplied by Buzz's BYOH subprocess definition. +#[derive(Debug, Clone)] +pub struct AdapterConfig { + /// Local path or HTTP(S) URL for an OASF Agent Record. + pub record: String, + /// Optional operator-supplied token for the A2A endpoint. + pub bearer_token: Option, + /// Exact endpoint where the operator permits the bearer token to be sent. + pub bearer_token_endpoint: Option, + /// Optional stable Agency reference projected into A2A metadata. + pub agency_ref: Option, + /// Optional stable Space reference projected into A2A metadata. + pub space_ref: Option, + /// Optional Buzz channel reference projected into A2A metadata. + pub channel_ref: Option, + /// Optional stable Agent reference projected into A2A metadata. + pub agent_ref: Option, + /// Optional caller-supplied A2A conversation context identifier. + pub context_id: Option, + /// Maximum time to wait for an asynchronous A2A task. + pub task_poll_secs: u64, +} + +#[derive(Debug, Parser)] +#[command( + name = "buzz-a2a-acp", + about = "Expose an OASF Agent Record as an ACP subprocess" +)] +struct Cli { + /// Local path or HTTP(S) URL for an OASF 1.0 Agent Record. + #[arg(long, env = "BUZZ_A2A_AGENT_RECORD")] + record: String, + + /// Exact A2A endpoint where the operator permits the bearer token to be sent. + #[arg(long, env = "BUZZ_A2A_BEARER_ENDPOINT")] + bearer_token_endpoint: Option, + + /// Optional stable Agency reference to include in A2A request metadata. + #[arg(long, env = "BUZZ_A2A_AGENCY_REF")] + agency_ref: Option, + + /// Optional stable Space reference to include in A2A request metadata. + #[arg(long, env = "BUZZ_A2A_SPACE_REF")] + space_ref: Option, + + /// Optional Buzz channel reference to include in A2A request metadata. + #[arg(long, env = "BUZZ_A2A_CHANNEL_REF")] + channel_ref: Option, + + /// Optional stable Agent reference to include in A2A request metadata. + #[arg(long, env = "BUZZ_A2A_AGENT_REF")] + agent_ref: Option, + + /// Optional stable A2A conversation context identifier. + #[arg(long, env = "BUZZ_A2A_CONTEXT_ID")] + context_id: Option, + + /// Maximum time to wait for an asynchronous A2A task. + #[arg( + long, + env = "BUZZ_A2A_TASK_POLL_SECS", + default_value_t = DEFAULT_TASK_POLL_SECS + )] + task_poll_secs: u64, +} + +#[derive(Debug, Error)] +pub enum AdapterError { + #[error("record source is empty")] + EmptyRecord, + #[error("record source is not a local path or HTTP(S) URL: {0}")] + InvalidSource(String), + #[error("fetch {what} failed with HTTP {status}")] + HttpStatus { + what: &'static str, + status: StatusCode, + }, + #[error("{what} exceeds the {limit} byte limit")] + TooLarge { what: &'static str, limit: usize }, + #[error("read {what}: {source}")] + Read { + what: &'static str, + source: std::io::Error, + }, + #[error("decode {what}: {source}")] + Decode { + what: &'static str, + source: serde_json::Error, + }, + #[error("invalid OASF Agent Record: {0}")] + InvalidRecord(String), + #[error("invalid OASF A2A artifact: {0}")] + InvalidArtifact(String), + #[error("A2A endpoint is not advertised by the Agent Card")] + MissingEndpoint, + #[error("unsafe endpoint URL: {0}")] + UnsafeEndpoint(String), + #[error("bearer token is not authorized for A2A endpoint {0}")] + UnauthorizedTokenEndpoint(String), + #[error("remote A2A task did not complete before the {0} second timeout")] + TaskTimeout(u64), + #[error("A2A request failed: {0}")] + Request(String), + #[error("A2A response was invalid: {0}")] + InvalidResponse(String), + #[error("ACP protocol error: {0}")] + Acp(String), +} + +#[derive(Debug, Deserialize)] +struct AgentRecord { + #[serde(default)] + name: Option, + #[serde(default)] + schema_version: Option, + #[serde(default)] + modules: Vec, +} + +#[derive(Debug, Clone, PartialEq, Eq)] +enum RecordSource { + LocalPath(PathBuf), + HttpUrl(Url), +} + +impl RecordSource { + fn parse(source: &str) -> Result { + if source.trim().is_empty() { + return Err(AdapterError::EmptyRecord); + } + if let Ok(url) = Url::parse(source) { + if matches!(url.scheme(), "http" | "https") { + validate_http_url(source) + .map_err(|_| AdapterError::InvalidSource(source.to_owned()))?; + return Ok(Self::HttpUrl(url)); + } + if source.contains("://") { + return Err(AdapterError::InvalidSource(source.to_owned())); + } + } + Ok(Self::LocalPath(PathBuf::from(source))) + } +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum RecordVerification { + OperatorReviewedLocal, + TlsOnly, +} + +impl RecordVerification { + fn label(self) -> &'static str { + match self { + Self::OperatorReviewedLocal => "operator-reviewed-local", + Self::TlsOnly => "tls-only", + } + } +} + +struct ResolvedRecord { + record: AgentRecord, + base: Option, + content_digest: String, + verification: RecordVerification, +} + +#[derive(Debug, Deserialize)] +struct OasfModule { + #[serde(default)] + name: Option, + #[serde(default)] + id: Option, + #[serde(default)] + artifact: Option>, + #[serde(default)] + data: Option, +} + +#[derive(Debug, Deserialize)] +struct A2aData { + #[serde(default)] + card_data: Option, + #[serde(default, rename = "card_schema_version")] + _card_schema_version: Option, +} + +#[derive(Debug, Deserialize)] +struct Descriptor { + #[serde(default)] + digest: Option, + #[serde(default, rename = "media_type")] + media_type: Option, + #[serde(default)] + size: Option, + #[serde(default)] + data: Option, + #[serde(default)] + json: Option>, + #[serde(default)] + urls: Vec, +} + +#[derive(Debug, Clone, Deserialize)] +/// Public A2A Agent Card fields used to select an invocation interface. +pub struct AgentCard { + /// Non-standard identifier used only by the vendor compatibility path. + #[serde(default, rename = "id")] + pub vendor_id: Option, + /// Human-readable name, when advertised. + #[serde(default)] + pub name: Option, + /// Human-readable description, when advertised. + #[serde(default)] + pub description: Option, + /// A2A 0.3 card endpoint. + #[serde(default)] + pub url: Option, + /// Non-standard endpoint field used by the vendor compatibility path. + #[serde(default, rename = "serviceEndpoint")] + pub service_endpoint: Option, + /// Current A2A interface declarations. + #[serde(default, rename = "supportedInterfaces")] + pub supported_interfaces: Vec, +} + +#[derive(Debug, Clone, Deserialize)] +/// A protocol endpoint declared by an A2A Agent Card. +pub struct SupportedInterface { + /// URL to the protocol endpoint. + #[serde(default)] + pub url: Option, + /// Protocol binding name, for example `JSONRPC`. + #[serde(default, rename = "protocolBinding")] + pub protocol_binding: Option, + /// Protocol version declared by the remote agent. + #[serde(default, rename = "protocolVersion")] + pub protocol_version: Option, +} + +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum ProtocolMode { + /// A2A JSON-RPC interface declared by a current Agent Card. + JsonRpc { + endpoint: String, + protocol_version: Option, + }, + /// Compatibility with a deployed vendor card and method shape. + VendorServiceEndpoint { endpoint: String }, +} + +impl ProtocolMode { + fn endpoint(&self) -> &str { + match self { + Self::JsonRpc { endpoint, .. } | Self::VendorServiceEndpoint { endpoint } => endpoint, + } + } + + fn a2a_version(&self) -> Option<&'static str> { + match self { + Self::JsonRpc { + protocol_version, .. + } if protocol_version + .as_deref() + .is_some_and(|version| version.starts_with("1.")) => + { + Some("1.0") + } + Self::JsonRpc { .. } => Some("0.3"), + Self::VendorServiceEndpoint { .. } => None, + } + } + + fn method(&self, task: bool) -> &str { + match self { + Self::JsonRpc { + protocol_version, .. + } => { + if protocol_version + .as_deref() + .is_some_and(|version| version.starts_with("1.")) + { + if task { + "GetTask" + } else { + "SendMessage" + } + } else if task { + "tasks/get" + } else { + "message/send" + } + } + Self::VendorServiceEndpoint { .. } => { + if task { + "agent/getTask" + } else { + "agent/sendMessage" + } + } + } + } +} + +/// A resolved public record and its invocation mode. +#[derive(Debug, Clone)] +/// Resolved public metadata and invocation mode for one remote agent. +pub struct ResolvedAgent { + /// Name from the OASF record. + pub record_name: Option, + /// OASF schema version from the record. + pub record_schema_version: Option, + /// Public A2A card resolved from the OASF module. + pub card: AgentCard, + /// Selected current or compatibility invocation mode. + pub mode: ProtocolMode, +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum CardSource { + Artifact, + DeprecatedCardData, +} + +static REQUEST_ID: AtomicU64 = AtomicU64::new(1); + +fn pinned_http_client(url: &Url, addresses: &[SocketAddr]) -> Result { + let raw_host = url + .host_str() + .ok_or_else(|| AdapterError::UnsafeEndpoint(url.to_string()))?; + let host = normalized_host(raw_host); + let mut builder = Client::builder() + .redirect(reqwest::redirect::Policy::none()) + .timeout(std::time::Duration::from_secs(30)); + // Pin every address that passed our policy check. This prevents reqwest + // from performing a second DNS lookup while preserving IPv4/IPv6 fallback. + if host.parse::().is_err() { + if addresses.is_empty() { + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + builder = builder.resolve_to_addrs(&host, addresses); + } + builder + .build() + .map_err(|e| AdapterError::Request(format!("build HTTP client: {e}"))) +} + +fn validate_http_url(raw: &str) -> Result { + let url = Url::parse(raw).map_err(|_| AdapterError::UnsafeEndpoint(raw.to_owned()))?; + let raw_host = url + .host_str() + .ok_or_else(|| AdapterError::UnsafeEndpoint(raw.to_owned()))?; + let host = normalized_host(raw_host); + if let Ok(ip) = host.parse::() { + // Local A2A runtimes are allowed over loopback HTTP. Private and + // link-local addresses remain rejected for every other scheme. + if url.scheme() == "http" && ip.is_loopback() { + return Ok(url); + } + if is_private_ip(ip) { + return Err(AdapterError::UnsafeEndpoint(raw.to_owned())); + } + } + if url.scheme() == "https" && host.eq_ignore_ascii_case("localhost") { + return Err(AdapterError::UnsafeEndpoint(raw.to_owned())); + } + match url.scheme() { + "https" => Ok(url), + "http" if is_loopback_host(&host) => Ok(url), + _ => Err(AdapterError::UnsafeEndpoint(raw.to_owned())), + } +} + +fn normalized_host(host: &str) -> String { + host.trim_start_matches('[') + .trim_end_matches(']') + .to_ascii_lowercase() +} + +fn is_loopback_host(host: &str) -> bool { + host.eq_ignore_ascii_case("localhost") + || host + .parse::() + .is_ok_and(|address| address.is_loopback()) +} + +fn is_private_ip(ip: IpAddr) -> bool { + let ip = match ip { + IpAddr::V6(address) => address + .to_ipv4_mapped() + .map(IpAddr::V4) + .unwrap_or(IpAddr::V6(address)), + address => address, + }; + match ip { + IpAddr::V4(ip) => { + let octets = ip.octets(); + ip.is_loopback() + || ip.is_private() + || ip.is_link_local() + || ip.is_unspecified() + || octets[0] == 0 + || (octets[0] == 100 && (64..=127).contains(&octets[1])) + } + IpAddr::V6(ip) => { + let segments = ip.segments(); + ip.is_loopback() + || ip.is_unspecified() + || ip.is_multicast() + || (segments[0] & 0xfe00) == 0xfc00 + || (segments[0] & 0xffc0) == 0xfe80 + // IPv4-transitional address ranges can encode private IPv4 + // targets while still presenting as IPv6 DNS answers. + || (segments[0] == 0x0064 + && segments[1] == 0xff9b + && segments[2..6] == [0, 0, 0, 0]) + || segments[0] == 0x2002 + || (segments[0] == 0x2001 && segments[1] == 0) + || segments[..6] == [0, 0, 0, 0, 0, 0] + } + } +} + +async fn resolve_network_url(url: &Url) -> Result, AdapterError> { + let raw_host = url + .host_str() + .ok_or_else(|| AdapterError::UnsafeEndpoint(url.to_string()))?; + let host = normalized_host(raw_host); + if let Ok(ip) = host.parse::() { + if url.scheme() == "http" && ip.is_loopback() { + return Ok(vec![SocketAddr::new( + ip, + url.port_or_known_default().unwrap_or(80), + )]); + } + if !is_private_ip(ip) { + return Ok(vec![SocketAddr::new( + ip, + url.port_or_known_default().unwrap_or(443), + )]); + } + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + let port = url + .port_or_known_default() + .ok_or_else(|| AdapterError::UnsafeEndpoint(url.to_string()))?; + let addresses: Vec = tokio::net::lookup_host((host.as_str(), port)) + .await + .map_err(|_| AdapterError::UnsafeEndpoint(url.to_string()))? + .collect(); + validate_resolved_addresses(url, &addresses)?; + Ok(addresses) +} + +fn validate_resolved_addresses(url: &Url, addresses: &[SocketAddr]) -> Result<(), AdapterError> { + let raw_host = url + .host_str() + .ok_or_else(|| AdapterError::UnsafeEndpoint(url.to_string()))?; + let host = normalized_host(raw_host); + if addresses.is_empty() { + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + let is_local_http = url.scheme() == "http" && is_loopback_host(&host); + if url.scheme() == "http" && !is_local_http { + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + if is_local_http { + if addresses.iter().any(|address| !address.ip().is_loopback()) { + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + } else if addresses.iter().any(|address| is_private_ip(address.ip())) { + return Err(AdapterError::UnsafeEndpoint(url.to_string())); + } + Ok(()) +} + +async fn response_bytes( + mut response: reqwest::Response, + what: &'static str, + limit: usize, +) -> Result, AdapterError> { + if response + .content_length() + .is_some_and(|size| size > limit as u64) + { + return Err(AdapterError::TooLarge { what, limit }); + } + let mut body = Vec::new(); + while let Some(chunk) = response + .chunk() + .await + .map_err(|e| AdapterError::Request(format!("read {what}: {e}")))? + { + if body.len().saturating_add(chunk.len()) > limit { + return Err(AdapterError::TooLarge { what, limit }); + } + body.extend_from_slice(&chunk); + } + Ok(body) +} + +async fn read_source( + source: &str, + what: &'static str, + limit: usize, +) -> Result, AdapterError> { + if source.trim().is_empty() { + return Err(AdapterError::EmptyRecord); + } + if let Ok(url) = Url::parse(source) { + if matches!(url.scheme(), "http" | "https") { + validate_http_url(source) + .map_err(|_| AdapterError::InvalidSource(source.to_owned()))?; + let addresses = resolve_network_url(&url).await?; + let response = pinned_http_client(&url, &addresses)? + .get(url) + .send() + .await + .map_err(|e| AdapterError::Request(format!("fetch {what}: {e}")))?; + let status = response.status(); + if !status.is_success() { + return Err(AdapterError::HttpStatus { what, status }); + } + return response_bytes(response, what, limit).await; + } + if source.contains("://") { + return Err(AdapterError::InvalidSource(source.to_owned())); + } + } + let body = tokio::fs::read(Path::new(source)) + .await + .map_err(|source| AdapterError::Read { what, source })?; + if body.len() > limit { + return Err(AdapterError::TooLarge { what, limit }); + } + Ok(body) +} + +async fn load_record(source: &str) -> Result { + let source = RecordSource::parse(source)?; + let source_text = match &source { + RecordSource::LocalPath(path) => path.to_string_lossy().into_owned(), + RecordSource::HttpUrl(url) => url.to_string(), + }; + let bytes = read_source(&source_text, "Agent Record", MAX_RECORD_BYTES).await?; + let record = if bytes.iter().find(|byte| !byte.is_ascii_whitespace()) == Some(&b'[') { + let mut records: Vec = + serde_json::from_slice(&bytes).map_err(|source| AdapterError::Decode { + what: "Agent Record", + source, + })?; + if records.len() != 1 { + return Err(AdapterError::InvalidRecord(format!( + "expected exactly one Agent Record, got {}", + records.len() + ))); + } + records + .pop() + .ok_or_else(|| AdapterError::InvalidRecord("Agent Record collection is empty".into()))? + } else { + serde_json::from_slice(&bytes).map_err(|source| AdapterError::Decode { + what: "Agent Record", + source, + })? + }; + let (base, verification) = match source { + RecordSource::LocalPath(_) => (None, RecordVerification::OperatorReviewedLocal), + RecordSource::HttpUrl(url) if url.scheme() == "https" => { + (Some(url), RecordVerification::TlsOnly) + } + RecordSource::HttpUrl(url) => (Some(url), RecordVerification::OperatorReviewedLocal), + }; + Ok(ResolvedRecord { + record, + base, + content_digest: format!("sha256:{}", hex::encode(Sha256::digest(&bytes))), + verification, + }) +} + +fn descriptor_from_raw(value: &RawValue) -> Result { + let raw = value.get(); + if raw.trim_start().starts_with('[') { + let mut descriptors: Vec = serde_json::from_str(raw) + .map_err(|e| AdapterError::InvalidArtifact(format!("descriptor: {e}")))?; + if descriptors.len() != 1 { + return Err(AdapterError::InvalidArtifact(format!( + "expected exactly one artifact descriptor, got {}", + descriptors.len() + ))); + } + descriptors + .pop() + .ok_or_else(|| AdapterError::InvalidArtifact("artifact descriptor is absent".into())) + } else { + serde_json::from_str(raw) + .map_err(|e| AdapterError::InvalidArtifact(format!("descriptor: {e}"))) + } +} + +fn verify_descriptor(descriptor: &Descriptor, bytes: &[u8]) -> Result<(), AdapterError> { + let size = descriptor.size.ok_or_else(|| { + AdapterError::InvalidArtifact("OASF artifact descriptor requires size".into()) + })?; + if size != bytes.len() as u64 { + return Err(AdapterError::InvalidArtifact(format!( + "descriptor size {size} does not match {}", + bytes.len() + ))); + } + let digest = descriptor.digest.as_deref().ok_or_else(|| { + AdapterError::InvalidArtifact("OASF artifact descriptor requires digest".into()) + })?; + let Some(expected) = digest + .strip_prefix("sha256:") + .or_else(|| digest.strip_prefix("sha256-")) + else { + return Err(AdapterError::InvalidArtifact(format!( + "unsupported digest {digest:?}; expected sha256:" + ))); + }; + let actual = hex::encode(Sha256::digest(bytes)); + if !actual.eq_ignore_ascii_case(expected) { + return Err(AdapterError::InvalidArtifact(format!( + "sha256 digest mismatch: expected {expected}, got {actual}" + ))); + } + Ok(()) +} + +async fn descriptor_bytes( + descriptor: &Descriptor, + record_url: Option<&Url>, +) -> Result, AdapterError> { + let media_type = descriptor.media_type.as_deref().ok_or_else(|| { + AdapterError::InvalidArtifact("OASF artifact descriptor requires media_type".into()) + })?; + if !media_type.to_ascii_lowercase().contains("json") { + return Err(AdapterError::InvalidArtifact(format!( + "A2A artifact media type must be JSON, got {media_type:?}" + ))); + } + if let Some(value) = descriptor.json.as_ref() { + let bytes = value.get().as_bytes().to_vec(); + verify_descriptor(descriptor, &bytes)?; + return Ok(bytes); + } + if let Some(data) = descriptor.data.as_deref() { + let bytes = base64::engine::general_purpose::STANDARD + .decode(data) + .map_err(|e| { + AdapterError::InvalidArtifact(format!("descriptor data is not base64: {e}")) + })?; + if bytes.len() > MAX_ARTIFACT_BYTES { + return Err(AdapterError::TooLarge { + what: "A2A artifact", + limit: MAX_ARTIFACT_BYTES, + }); + } + verify_descriptor(descriptor, &bytes)?; + return Ok(bytes); + } + if let Some(raw_url) = descriptor.urls.first() { + if descriptor.digest.is_none() { + return Err(AdapterError::InvalidArtifact( + "remote artifact descriptors require a sha256 digest".into(), + )); + } + let url = if let Ok(url) = Url::parse(raw_url) { + url + } else if let Some(base) = record_url { + base.join(raw_url) + .map_err(|_| AdapterError::UnsafeEndpoint(raw_url.clone()))? + } else { + return Err(AdapterError::InvalidArtifact(format!( + "relative artifact URL {raw_url:?} requires an HTTP(S) record source" + ))); + }; + validate_http_url(url.as_str())?; + let bytes = read_source(url.as_str(), "A2A artifact", MAX_ARTIFACT_BYTES).await?; + verify_descriptor(descriptor, &bytes)?; + return Ok(bytes); + } + Err(AdapterError::InvalidArtifact( + "descriptor has no json, data, or urls".into(), + )) +} + +fn is_a2a_module(module: &OasfModule) -> bool { + module.name.as_deref() == Some("integration/a2a") + || module.id.as_ref().and_then(Value::as_u64) == Some(203) +} + +async fn resolve_card( + record: AgentRecord, + record_url: Option<&Url>, +) -> Result<(ResolvedAgent, CardSource), AdapterError> { + let module = record + .modules + .iter() + .find(|m| is_a2a_module(m)) + .ok_or_else(|| { + AdapterError::InvalidRecord("missing integration/a2a module (id 203)".into()) + })?; + let (card_value, source) = if let Some(artifact) = module.artifact.as_ref() { + let descriptor = descriptor_from_raw(artifact)?; + let bytes = descriptor_bytes(&descriptor, record_url).await?; + ( + serde_json::from_slice::(&bytes) + .map_err(|e| AdapterError::InvalidArtifact(format!("Agent Card JSON: {e}")))?, + CardSource::Artifact, + ) + } else if let Some(data) = module.data.as_ref().and_then(|data| data.card_data.clone()) { + (data, CardSource::DeprecatedCardData) + } else { + return Err(AdapterError::InvalidRecord( + "integration/a2a module has no artifact; deprecated data.card_data is also absent" + .into(), + )); + }; + let card: AgentCard = serde_json::from_value(card_value) + .map_err(|e| AdapterError::InvalidArtifact(format!("Agent Card shape: {e}")))?; + let mode = select_protocol_mode(&card)?; + Ok(( + ResolvedAgent { + record_name: record.name, + record_schema_version: record.schema_version, + card, + mode, + }, + source, + )) +} + +/// Select the declared JSON-RPC interface, with a named pre-1.0 compatibility path. +pub fn select_protocol_mode(card: &AgentCard) -> Result { + if let Some(interface) = card.supported_interfaces.iter().find(|i| { + i.protocol_binding + .as_deref() + .is_some_and(|binding| binding.to_ascii_lowercase().contains("jsonrpc")) + }) { + if let Some(endpoint) = interface.url.clone() { + validate_http_url(&endpoint)?; + return Ok(ProtocolMode::JsonRpc { + endpoint, + protocol_version: interface.protocol_version.clone(), + }); + } + } + if let Some(endpoint) = card.service_endpoint.clone() { + validate_http_url(&endpoint)?; + return Ok(ProtocolMode::VendorServiceEndpoint { endpoint }); + } + if let Some(endpoint) = card.url.clone() { + validate_http_url(&endpoint)?; + return Ok(ProtocolMode::JsonRpc { + endpoint, + protocol_version: Some("0.3".into()), + }); + } + Err(AdapterError::MissingEndpoint) +} + +fn protocol_request( + client: &Client, + mode: &ProtocolMode, + endpoint: &str, +) -> reqwest::RequestBuilder { + let request = client.post(endpoint); + match mode.a2a_version() { + Some(version) => request.header("A2A-Version", version), + None => request, + } +} + +#[derive(Debug, Deserialize)] +#[serde(tag = "type", rename_all = "snake_case")] +enum PromptBlock { + Text { + text: String, + }, + #[serde(other)] + Unsupported, +} + +#[derive(Debug, Deserialize)] +struct PromptParams { + #[serde(rename = "sessionId")] + session_id: String, + prompt: Vec, +} + +#[derive(Debug, Deserialize)] +struct CancelParams { + #[serde(rename = "sessionId")] + session_id: String, +} + +fn prompt_text(blocks: &[PromptBlock]) -> Result { + let text = blocks + .iter() + .filter_map(|block| match block { + PromptBlock::Text { text } => Some(text.as_str()), + PromptBlock::Unsupported => None, + }) + .collect::>() + .join("\n"); + if text.trim().is_empty() { + return Err(AdapterError::Acp("prompt contains no text content".into())); + } + Ok(text) +} + +fn extract_text(value: &Value) -> Option { + if let Some(text) = value.get("text").and_then(Value::as_str) { + return Some(text.to_owned()); + } + if let Some(parts) = value.get("parts").and_then(Value::as_array) { + let joined = parts + .iter() + .filter_map(extract_text) + .collect::>() + .join("\n"); + if !joined.is_empty() { + return Some(joined); + } + } + if let Some(artifacts) = value.get("artifacts").and_then(Value::as_array) { + let joined = artifacts + .iter() + .rev() + .filter_map(extract_text) + .collect::>() + .join("\n"); + if !joined.is_empty() { + return Some(joined); + } + } + if let Some(history) = value.get("history").and_then(Value::as_array) { + for item in history.iter().rev() { + if item.get("role").and_then(Value::as_str) != Some("user") { + if let Some(text) = extract_text(item) { + return Some(text); + } + } + } + } + value.get("message").and_then(extract_text) +} + +async fn invoke( + resolved: &ResolvedAgent, + token: Option<&str>, + token_endpoint: Option<&str>, + metadata: Option<&Value>, + task_poll_secs: u64, + session_id: &str, + text: &str, +) -> Result { + validate_endpoint_binding(token, token_endpoint, resolved.mode.endpoint())?; + let endpoint = Url::parse(resolved.mode.endpoint()) + .map_err(|_| AdapterError::UnsafeEndpoint(resolved.mode.endpoint().to_owned()))?; + let addresses = resolve_network_url(&endpoint).await?; + let client = pinned_http_client(&endpoint, &addresses)?; + let id = REQUEST_ID.fetch_add(1, Ordering::Relaxed); + let payload = request_payload( + &resolved.mode, + resolved.card.vendor_id.as_deref(), + id, + session_id, + metadata, + text, + ); + let mut request = + protocol_request(&client, &resolved.mode, resolved.mode.endpoint()).json(&payload); + if let Some(token) = token { + request = request.bearer_auth(token); + } + let response = request + .send() + .await + .map_err(|e| AdapterError::Request(e.to_string()))?; + let status = response.status(); + if !status.is_success() { + return Err(AdapterError::HttpStatus { + what: "A2A request", + status, + }); + } + let bytes = response_bytes(response, "A2A response", MAX_ARTIFACT_BYTES).await?; + let body: Value = serde_json::from_slice(&bytes) + .map_err(|e| AdapterError::Request(format!("decode A2A response: {e}")))?; + if let Some(error) = body.get("error") { + return Err(AdapterError::InvalidResponse(error.to_string())); + } + let result = body.get("result").unwrap_or(&body); + let result = result + .get("task") + .or_else(|| result.get("message")) + .unwrap_or(result); + if result.pointer("/status/state").is_some() { + let task_id = result + .get("id") + .and_then(Value::as_str) + .unwrap_or("unknown"); + if let Some(text) = task_outcome(result, task_id)? { + return Ok(text); + } + if task_id != "unknown" { + return poll_task( + resolved, + token, + token_endpoint, + task_id, + metadata, + task_poll_secs, + &client, + ) + .await; + } + return Err(AdapterError::InvalidResponse( + "A2A task response has no task id".into(), + )); + } + extract_text(result).ok_or_else(|| { + AdapterError::InvalidResponse("A2A response contains no message or task state".into()) + }) +} + +async fn poll_task( + resolved: &ResolvedAgent, + token: Option<&str>, + token_endpoint: Option<&str>, + task_id: &str, + metadata: Option<&Value>, + task_poll_secs: u64, + client: &Client, +) -> Result { + let started = std::time::Instant::now(); + let timeout = std::time::Duration::from_secs(task_poll_secs); + let mut poll_attempt = 0usize; + while started.elapsed() < timeout { + let remaining = timeout.saturating_sub(started.elapsed()); + let delay = std::time::Duration::from_secs( + TASK_POLL_BACKOFF_SECS[poll_attempt.min(TASK_POLL_BACKOFF_SECS.len() - 1)], + ) + .min(remaining); + tokio::time::sleep(delay).await; + poll_attempt = poll_attempt.saturating_add(1); + if started.elapsed() >= timeout { + break; + } + let id = REQUEST_ID.fetch_add(1, Ordering::Relaxed); + let mut params = match resolved.mode { + ProtocolMode::JsonRpc { .. } => json!({ "id": task_id }), + ProtocolMode::VendorServiceEndpoint { .. } => json!({ "taskId": task_id }), + }; + if let Some(metadata) = metadata { + params["metadata"] = metadata.clone(); + } + let payload = json!({ + "jsonrpc": "2.0", + "id": id, + "method": resolved.mode.method(true), + "params": params, + }); + validate_endpoint_binding(token, token_endpoint, resolved.mode.endpoint())?; + let mut request = + protocol_request(client, &resolved.mode, resolved.mode.endpoint()).json(&payload); + if let Some(token) = token { + request = request.bearer_auth(token); + } + let response = request + .send() + .await + .map_err(|e| AdapterError::Request(e.to_string()))?; + let status = response.status(); + if !status.is_success() { + return Err(AdapterError::HttpStatus { + what: "A2A task poll", + status, + }); + } + let bytes = response_bytes(response, "A2A task response", MAX_ARTIFACT_BYTES).await?; + let body: Value = serde_json::from_slice(&bytes) + .map_err(|e| AdapterError::Request(format!("decode A2A task response: {e}")))?; + if let Some(error) = body.get("error") { + return Err(AdapterError::InvalidResponse(error.to_string())); + } + let result = body.get("result").unwrap_or(&body); + let result = result + .get("task") + .or_else(|| result.get("message")) + .unwrap_or(result); + if let Some(text) = task_outcome(result, task_id)? { + return Ok(text); + } + } + Err(AdapterError::TaskTimeout(task_poll_secs)) +} + +fn validate_endpoint_binding( + token: Option<&str>, + expected_endpoint: Option<&str>, + actual_endpoint: &str, +) -> Result<(), AdapterError> { + let endpoints_match = match expected_endpoint { + Some(expected) => { + let expected = validate_http_url(expected)?; + let actual = validate_http_url(actual_endpoint)?; + expected == actual + } + None => token.is_none(), + }; + if !endpoints_match { + return Err(AdapterError::UnauthorizedTokenEndpoint( + actual_endpoint.to_owned(), + )); + } + Ok(()) +} + +fn task_outcome(result: &Value, task_id: &str) -> Result, AdapterError> { + let wire_state = result + .get("status") + .and_then(|status| status.get("state")) + .and_then(Value::as_str) + .ok_or_else(|| { + AdapterError::InvalidResponse(format!("A2A task {task_id} has no status state")) + })?; + let normalized_state = wire_state.trim().to_ascii_lowercase(); + let state = normalized_state + .strip_prefix("task_state_") + .unwrap_or(&normalized_state); + match state { + "completed" => { + Ok(Some(extract_text(result).unwrap_or_else(|| { + format!("A2A task {task_id} completed") + }))) + } + "accepted" | "submitted" | "working" | "pending" => Ok(None), + "failed" | "canceled" | "cancelled" | "rejected" | "input-required" | "input_required" => { + let detail = extract_text(result) + .map(|text| format!(": {text}")) + .unwrap_or_default(); + Err(AdapterError::InvalidResponse(format!( + "A2A task {task_id} ended in {state}{detail}" + ))) + } + other => Err(AdapterError::InvalidResponse(format!( + "A2A task {task_id} has unknown state {wire_state} (normalized as {other})" + ))), + } +} + +fn request_payload( + mode: &ProtocolMode, + agent_id: Option<&str>, + id: u64, + session_id: &str, + metadata: Option<&Value>, + text: &str, +) -> Value { + let mut params = match mode { + ProtocolMode::JsonRpc { + protocol_version, .. + } if protocol_version + .as_deref() + .is_some_and(|version| version.starts_with("1.")) => + { + json!({ + "message": { "messageId": format!("buzz-{id}"), "role": "ROLE_USER", "contextId": session_id, "parts": [{ "text": text }] }, + }) + } + ProtocolMode::JsonRpc { .. } => json!({ + "message": { "messageId": format!("buzz-{id}"), "role": "user", "contextId": session_id, "parts": [{ "kind": "text", "text": text }] }, + }), + ProtocolMode::VendorServiceEndpoint { .. } => json!({ + "agentId": agent_id, + "message": { "role": "user", "parts": [{ "type": "text", "text": text }] }, + "contextId": session_id, + }), + }; + if let Some(metadata) = metadata { + params["metadata"] = metadata.clone(); + } + json!({ "jsonrpc": "2.0", "id": id, "method": mode.method(false), "params": params }) +} + +async fn send_json( + writer: &mut W, + value: Value, +) -> Result<(), AdapterError> { + let mut line = serde_json::to_vec(&value) + .map_err(|e| AdapterError::Acp(format!("encode response: {e}")))?; + line.push(b'\n'); + writer + .write_all(&line) + .await + .map_err(|e| AdapterError::Acp(format!("write response: {e}")))?; + writer + .flush() + .await + .map_err(|e| AdapterError::Acp(format!("flush response: {e}")))?; + Ok(()) +} + +enum AcpAction { + Response(Value), + Prompt { + id: Value, + session_id: String, + text: String, + }, + Cancel { + id: Option, + session_id: String, + }, +} + +fn handle_acp_message( + message: &Value, + sessions: &mut HashSet, + agent_name: &str, + configured_context_id: Option<&str>, +) -> Result, AdapterError> { + let method = message.get("method").and_then(Value::as_str); + if method == Some("session/cancel") { + let params: CancelParams = + serde_json::from_value(message.get("params").cloned().unwrap_or(Value::Null)) + .map_err(|e| AdapterError::Acp(format!("session/cancel params: {e}")))?; + return Ok(Some(AcpAction::Cancel { + id: message.get("id").cloned(), + session_id: params.session_id, + })); + } + let Some(id) = message.get("id").cloned() else { + return Ok(None); + }; + match method { + Some("initialize") => Ok(Some(AcpAction::Response(json!({ + "jsonrpc": "2.0", + "id": id, + "result": { + "protocolVersion": message.pointer("/params/protocolVersion").and_then(Value::as_u64).unwrap_or(1).min(1), + "agentCapabilities": { + "loadSession": false, + "promptCapabilities": { "image": false, "audio": false, "embeddedContext": false }, + "mcpCapabilities": { "http": false, "sse": false }, + }, + "agentInfo": { "name": agent_name, "version": "oasf-a2a" }, + } + })))), + Some("session/new") => { + let session_id = configured_context_id + .map(str::to_owned) + .unwrap_or_else(|| format!("a2a-{}", Uuid::new_v4())); + sessions.insert(session_id.clone()); + Ok(Some(AcpAction::Response(json!({ + "jsonrpc": "2.0", + "id": id, + "result": { "sessionId": session_id }, + })))) + } + Some("session/prompt") => { + let params: PromptParams = + serde_json::from_value(message.get("params").cloned().unwrap_or(Value::Null)) + .map_err(|e| AdapterError::Acp(format!("session/prompt params: {e}")))?; + if !sessions.contains(¶ms.session_id) { + return Ok(Some(AcpAction::Response(json!({ + "jsonrpc": "2.0", + "id": id, + "error": { "code": -32602, "message": "unknown session" }, + })))); + } + let text = match prompt_text(¶ms.prompt) { + Ok(text) => text, + Err(error) => { + return Ok(Some(AcpAction::Response(json!({ + "jsonrpc": "2.0", + "id": id, + "error": { "code": -32602, "message": error.to_string() }, + })))); + } + }; + Ok(Some(AcpAction::Prompt { + id, + session_id: params.session_id, + text, + })) + } + Some(method) => Ok(Some(AcpAction::Response(json!({ + "jsonrpc": "2.0", + "id": id, + "error": { "code": -32601, "message": format!("method not found: {method}") }, + })))), + None => Ok(None), + } +} + +fn prompt_success(id: Value, session_id: &str, text: &str) -> [Value; 2] { + [ + json!({ + "jsonrpc": "2.0", + "method": "session/update", + "params": { + "sessionId": session_id, + "update": { + "sessionUpdate": "agent_message_chunk", + "content": { "type": "text", "text": text }, + } + } + }), + json!({ "jsonrpc": "2.0", "id": id, "result": { "stopReason": "end_turn" } }), + ] +} + +struct ActivePrompt { + id: Value, + session_id: String, + task: tokio::task::JoinHandle>, +} + +enum LoopEvent { + Input(Option, AdapterError>>), + PromptFinished(Result, tokio::task::JoinError>), +} + +/// Run the adapter over ACP JSON-RPC lines on stdin/stdout. +pub async fn run(config: AdapterConfig) -> Result<(), AdapterError> { + let record = load_record(&config.record).await?; + eprintln!( + "buzz-a2a-acp: resolved Agent Record {} ({})", + record.content_digest, + record.verification.label() + ); + let (resolved, source) = resolve_card(record.record, record.base.as_ref()).await?; + if source == CardSource::DeprecatedCardData { + eprintln!( + "buzz-a2a-acp: using deprecated OASF integration/a2a data.card_data compatibility path" + ); + } + let mut sessions = HashSet::new(); + let mut lines = spawn_line_reader(BufReader::new(tokio::io::stdin())); + let mut writer = tokio::io::stdout(); + let mut active_prompt: Option = None; + loop { + let event = if let Some(active) = active_prompt.as_mut() { + tokio::select! { + line = lines.recv() => LoopEvent::Input(line), + result = &mut active.task => LoopEvent::PromptFinished(result), + } + } else { + LoopEvent::Input(lines.recv().await) + }; + match event { + LoopEvent::PromptFinished(result) => { + let active = active_prompt + .take() + .expect("completed prompt must still be active"); + match result { + Ok(Ok(text)) => { + for value in prompt_success(active.id, &active.session_id, &text) { + send_json(&mut writer, value).await?; + } + } + Ok(Err(error)) => { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": active.id, "error": { "code": -32000, "message": error.to_string() } }), + ) + .await?; + } + Err(error) => { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": active.id, "error": { "code": -32000, "message": format!("remote prompt task failed: {error}") } }), + ) + .await?; + } + } + } + LoopEvent::Input(None | Some(Ok(None))) => return Ok(()), + LoopEvent::Input(Some(Err(error))) => { + eprintln!("buzz-a2a-acp: ignored malformed ACP input: {error}"); + } + LoopEvent::Input(Some(Ok(Some(line)))) => { + let message: Value = match serde_json::from_str(line.trim()) { + Ok(message) => message, + Err(error) => { + eprintln!("buzz-a2a-acp: ignored malformed JSON-RPC line: {error}"); + continue; + } + }; + let action = match handle_acp_message( + &message, + &mut sessions, + resolved.card.name.as_deref().unwrap_or("remote-a2a-agent"), + config.context_id.as_deref(), + ) { + Ok(action) => action, + Err(error) => { + if let Some(id) = message.get("id").cloned() { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": id, "error": { "code": -32602, "message": error.to_string() } }), + ) + .await?; + } else { + eprintln!("buzz-a2a-acp: ignored invalid notification: {error}"); + } + continue; + } + }; + match action { + Some(AcpAction::Response(response)) => send_json(&mut writer, response).await?, + Some(AcpAction::Prompt { + id, + session_id, + text, + }) => { + if active_prompt.is_some() { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": id, "error": { "code": -32001, "message": "another prompt is already active" } }), + ) + .await?; + continue; + } + let prompt_resolved = resolved.clone(); + let prompt_token = config.bearer_token.clone(); + let prompt_token_endpoint = config.bearer_token_endpoint.clone(); + let prompt_metadata = request_metadata(&config); + let prompt_task_poll_secs = config.task_poll_secs; + let prompt_session_id = session_id.clone(); + let task = tokio::spawn(async move { + invoke( + &prompt_resolved, + prompt_token.as_deref(), + prompt_token_endpoint.as_deref(), + prompt_metadata.as_ref(), + prompt_task_poll_secs, + &prompt_session_id, + &text, + ) + .await + }); + active_prompt = Some(ActivePrompt { + id, + session_id, + task, + }); + } + Some(AcpAction::Cancel { id, session_id }) => { + if active_prompt + .as_ref() + .is_some_and(|active| active.session_id == session_id) + { + let active = active_prompt + .take() + .expect("matching prompt must still be active"); + active.task.abort(); + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": active.id, "result": { "stopReason": "cancelled" } }), + ) + .await?; + if let Some(id) = id { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": id, "result": {} }), + ) + .await?; + } + } else if let Some(id) = id { + send_json( + &mut writer, + json!({ "jsonrpc": "2.0", "id": id, "error": { "code": -32602, "message": "no active prompt for session" } }), + ) + .await?; + } + } + None => {} + } + } + } + } +} + +fn spawn_line_reader( + mut reader: R, +) -> tokio::sync::mpsc::Receiver, AdapterError>> +where + R: tokio::io::AsyncBufRead + Send + Unpin + 'static, +{ + let (sender, receiver) = tokio::sync::mpsc::channel(8); + tokio::spawn(async move { + loop { + let line = read_bounded_line(&mut reader).await; + let reached_eof = matches!(line, Ok(None)); + let transport_failed = matches!(line, Err(AdapterError::Read { .. })); + if sender.send(line).await.is_err() || reached_eof || transport_failed { + break; + } + } + }); + receiver +} + +async fn read_bounded_line( + reader: &mut R, +) -> Result, AdapterError> { + let mut bytes = Vec::new(); + loop { + let chunk = reader + .fill_buf() + .await + .map_err(|source| AdapterError::Read { + what: "ACP request", + source, + })?; + if chunk.is_empty() { + if bytes.is_empty() { + return Ok(None); + } + return Err(AdapterError::Acp("unterminated request at EOF".into())); + } + let take = chunk + .iter() + .position(|byte| *byte == b'\n') + .map_or(chunk.len(), |index| index + 1); + if bytes.len().saturating_add(take) > MAX_ACP_LINE_BYTES { + let ended = chunk[..take].ends_with(b"\n"); + reader.consume(take); + if !ended { + discard_until_newline(reader).await?; + } + return Err(AdapterError::Acp("request exceeds 1 MiB".into())); + } + bytes.extend_from_slice(&chunk[..take]); + reader.consume(take); + if bytes.ends_with(b"\n") { + bytes.pop(); + if bytes.ends_with(b"\r") { + bytes.pop(); + } + return String::from_utf8(bytes) + .map(Some) + .map_err(|_| AdapterError::Acp("request is not UTF-8".into())); + } + } +} + +async fn discard_until_newline( + reader: &mut R, +) -> Result<(), AdapterError> { + loop { + let chunk = reader + .fill_buf() + .await + .map_err(|source| AdapterError::Read { + what: "ACP request", + source, + })?; + if chunk.is_empty() { + return Ok(()); + } + let take = chunk + .iter() + .position(|byte| *byte == b'\n') + .map_or(chunk.len(), |index| index + 1); + let ended = chunk[..take].ends_with(b"\n"); + reader.consume(take); + if ended { + return Ok(()); + } + } +} + +fn request_metadata(config: &AdapterConfig) -> Option { + let mut metadata = serde_json::Map::new(); + if let Some(value) = config.agency_ref.as_ref() { + metadata.insert("agencyRef".into(), Value::String(value.clone())); + } + if let Some(value) = config.space_ref.as_ref() { + metadata.insert("spaceRef".into(), Value::String(value.clone())); + } + if let Some(value) = config.channel_ref.as_ref() { + metadata.insert("channelRef".into(), Value::String(value.clone())); + } + if let Some(value) = config.agent_ref.as_ref() { + metadata.insert("agentRef".into(), Value::String(value.clone())); + } + (!metadata.is_empty()).then_some(Value::Object(metadata)) +} + +/// Run the adapter as a normal CLI process. Sprig uses this entry point for +/// the `buzz-a2a-acp` multicall personality. +pub fn run_cli() -> Result<(), String> { + let args = Cli::parse(); + let bearer_token = std::env::var("BUZZ_A2A_BEARER_TOKEN") + .ok() + .filter(|value| !value.trim().is_empty()); + tokio::runtime::Builder::new_multi_thread() + .enable_all() + .build() + .map_err(|error| format!("build runtime: {error}"))? + .block_on(run(AdapterConfig { + record: args.record, + bearer_token, + bearer_token_endpoint: args.bearer_token_endpoint, + agency_ref: args.agency_ref, + space_ref: args.space_ref, + channel_ref: args.channel_ref, + agent_ref: args.agent_ref, + context_id: args.context_id, + task_poll_secs: args.task_poll_secs, + })) + .map_err(|error| error.to_string()) +} + +#[cfg(test)] +mod tests { + use super::*; + use std::fs; + + fn card(endpoint: &str) -> Value { + json!({ "id": "example-agent", "name": "Example Agent", "serviceEndpoint": endpoint }) + } + + #[tokio::test] + async fn resolves_oasf_artifact_and_validates_descriptor() { + let card = card("http://127.0.0.1:1337/a2a"); + let bytes = serde_json::to_vec(&card).expect("test card serializes"); + let digest = format!("sha256:{}", hex::encode(Sha256::digest(&bytes))); + let record = json!({ "name": "Example Agent", "schema_version": "1.0.0", "modules": [{ "name": "integration/a2a", "id": 203, "artifact": { "json": card, "digest": digest, "media_type": "application/a2a-agent-card+json", "size": bytes.len() } }] }); + let path = std::env::temp_dir().join(format!( + "buzz-a2a-record-{}-{}.json", + std::process::id(), + REQUEST_ID.fetch_add(1, Ordering::Relaxed) + )); + fs::write( + &path, + serde_json::to_vec(&record).expect("test record serializes"), + ) + .expect("write record"); + let loaded = load_record(path.to_str().expect("temp path is utf8")) + .await + .expect("load record"); + let (resolved, source) = resolve_card(loaded.record, loaded.base.as_ref()) + .await + .expect("resolve card"); + assert_eq!(source, CardSource::Artifact); + assert_eq!( + resolved.mode, + ProtocolMode::VendorServiceEndpoint { + endpoint: "http://127.0.0.1:1337/a2a".into() + } + ); + let _ = fs::remove_file(path); + } + + #[tokio::test] + async fn accepts_one_record_collection_and_preserves_embedded_artifact_bytes() { + let raw_card = r#"{"name":"Example Agent","version":"1.0.0","supportedInterfaces":[{"url":"http://127.0.0.1:1337/a2a/agent","protocolBinding":"JSONRPC","protocolVersion":"1.0"}]}"#; + let digest = format!( + "sha256:{}", + hex::encode(Sha256::digest(raw_card.as_bytes())) + ); + let record = format!( + r#"[{{"name":"Example Agent","schema_version":"1.0.0","modules":[{{"name":"integration/a2a","id":203,"artifact":{{"json":{raw_card},"digest":"{digest}","media_type":"application/a2a-agent-card+json","size":{}}}}}]}}]"#, + raw_card.len() + ); + let path = std::env::temp_dir().join(format!( + "buzz-a2a-record-collection-{}-{}.json", + std::process::id(), + REQUEST_ID.fetch_add(1, Ordering::Relaxed) + )); + fs::write(&path, record).expect("write record collection"); + let record = load_record(path.to_str().expect("temp path is utf8")) + .await + .expect("load one-record collection"); + let (resolved, source) = resolve_card(record.record, record.base.as_ref()) + .await + .expect("resolve exact embedded artifact bytes"); + assert_eq!(source, CardSource::Artifact); + assert_eq!(resolved.mode.endpoint(), "http://127.0.0.1:1337/a2a/agent"); + let _ = fs::remove_file(path); + } + + #[test] + fn prefers_declared_jsonrpc_interface() { + let card: AgentCard = serde_json::from_value(json!({ "supportedInterfaces": [{ "url": "https://agent.example/rpc", "protocolBinding": "JSONRPC", "protocolVersion": "1.0" }], "serviceEndpoint": "https://legacy.example/a2a" })).expect("card"); + assert_eq!( + select_protocol_mode(&card).expect("mode"), + ProtocolMode::JsonRpc { + endpoint: "https://agent.example/rpc".into(), + protocol_version: Some("1.0".into()), + } + ); + } + + #[test] + fn builds_current_and_vendor_requests() { + let current = request_payload( + &ProtocolMode::JsonRpc { + endpoint: "https://agent.example/rpc".into(), + protocol_version: Some("1.0".into()), + }, + Some("remote"), + 1, + "session", + None, + "hello", + ); + assert_eq!(current["method"], "SendMessage"); + assert_eq!(current["params"]["message"]["role"], "ROLE_USER"); + assert!(current["params"]["message"]["parts"][0]["kind"].is_null()); + assert_eq!(current["params"]["message"]["parts"][0]["text"], "hello"); + let vendor = request_payload( + &ProtocolMode::VendorServiceEndpoint { + endpoint: "http://127.0.0.1:1337/a2a".into(), + }, + Some("remote"), + 2, + "session", + None, + "hello", + ); + assert_eq!(vendor["method"], "agent/sendMessage"); + assert_eq!(vendor["params"]["agentId"], "remote"); + } + + #[test] + fn sends_a2a_version_header_for_standard_modes_only() { + let client = Client::new(); + for (mode, expected) in [ + ( + ProtocolMode::JsonRpc { + endpoint: "https://agent.example/rpc".into(), + protocol_version: Some("1.0".into()), + }, + Some("1.0"), + ), + ( + ProtocolMode::JsonRpc { + endpoint: "https://agent.example/rpc".into(), + protocol_version: Some("0.3".into()), + }, + Some("0.3"), + ), + ( + ProtocolMode::VendorServiceEndpoint { + endpoint: "https://agent.example/rpc".into(), + }, + None, + ), + ] { + let request = protocol_request(&client, &mode, mode.endpoint()) + .build() + .expect("request builds"); + assert_eq!( + request + .headers() + .get("A2A-Version") + .and_then(|value| value.to_str().ok()), + expected + ); + } + } + + #[test] + fn builds_a2a_0_3_request_and_preserves_context() { + let request = request_payload( + &ProtocolMode::JsonRpc { + endpoint: "https://agent.example/rpc".into(), + protocol_version: Some("0.3".into()), + }, + Some("remote"), + 3, + "buzz-session", + None, + "hello", + ); + assert_eq!(request["method"], "message/send"); + assert!(request["params"]["contextId"].is_null()); + assert_eq!(request["params"]["message"]["contextId"], "buzz-session"); + assert_eq!(request["params"]["message"]["parts"][0]["kind"], "text"); + } + + #[test] + fn rejects_non_loopback_http_endpoints() { + let card: AgentCard = serde_json::from_value(json!({ + "supportedInterfaces": [{ + "url": "http://remote.example/a2a", + "protocolBinding": "JSONRPC", + "protocolVersion": "1.0" + }] + })) + .expect("card"); + assert!(matches!( + select_protocol_mode(&card), + Err(AdapterError::UnsafeEndpoint(_)) + )); + let private_card: AgentCard = serde_json::from_value(json!({ + "supportedInterfaces": [{ + "url": "https://127.0.0.1/a2a", + "protocolBinding": "JSONRPC", + "protocolVersion": "1.0" + }] + })) + .expect("card"); + assert!(matches!( + select_protocol_mode(&private_card), + Err(AdapterError::UnsafeEndpoint(_)) + )); + } + + #[tokio::test] + async fn pinned_localhost_client_falls_back_across_checked_addresses() { + let listener = tokio::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, 0)) + .await + .expect("bind IPv4 listener"); + let port = listener.local_addr().expect("listener address").port(); + let server = tokio::spawn(async move { + let (mut socket, _) = listener.accept().await.expect("accept request"); + socket + .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok") + .await + .expect("write response"); + }); + let url = Url::parse(&format!("http://localhost:{port}/a2a")).expect("url"); + let addresses = [ + SocketAddr::new(IpAddr::V6(std::net::Ipv6Addr::LOCALHOST), port), + SocketAddr::new(IpAddr::V4(std::net::Ipv4Addr::LOCALHOST), port), + ]; + validate_resolved_addresses(&url, &addresses).expect("loopback addresses"); + + let response = tokio::time::timeout( + std::time::Duration::from_secs(2), + pinned_http_client(&url, &addresses) + .expect("pinned client") + .get(url) + .send(), + ) + .await + .expect("connect using validated fallback") + .expect("HTTP response"); + assert_eq!(response.status(), StatusCode::OK); + server.await.expect("server task"); + } + + #[test] + fn resolver_policy_rejects_mixed_or_private_addresses() { + let localhost = Url::parse("http://localhost:1337/a2a").expect("url"); + assert!(validate_resolved_addresses( + &localhost, + &[ + SocketAddr::from(([127, 0, 0, 1], 1337)), + SocketAddr::from(([8, 8, 8, 8], 1337)) + ] + ) + .is_err()); + let public = Url::parse("https://agent.example/a2a").expect("url"); + assert!(validate_resolved_addresses( + &public, + &[ + SocketAddr::from(([8, 8, 8, 8], 443)), + SocketAddr::from(([10, 0, 0, 1], 443)) + ] + ) + .is_err()); + assert!( + validate_resolved_addresses(&public, &[SocketAddr::from(([8, 8, 8, 8], 443))]).is_ok() + ); + } + + #[test] + fn reviewed_endpoint_is_enforced_even_without_a_token() { + assert!(validate_endpoint_binding( + None, + Some("https://reviewed.example/a2a"), + "https://reviewed.example/a2a" + ) + .is_ok()); + assert!(matches!( + validate_endpoint_binding( + None, + Some("https://reviewed.example/a2a"), + "https://other.example/a2a" + ), + Err(AdapterError::UnauthorizedTokenEndpoint(_)) + )); + assert!(matches!( + validate_endpoint_binding(Some("secret"), None, "https://agent.example/a2a"), + Err(AdapterError::UnauthorizedTokenEndpoint(_)) + )); + } + + #[test] + fn projects_agency_space_channel_and_agent_context() { + let metadata = request_metadata(&AdapterConfig { + record: "record.json".into(), + bearer_token: None, + bearer_token_endpoint: None, + agency_ref: Some("agency-1".into()), + space_ref: Some("space-1".into()), + channel_ref: Some("channel-1".into()), + agent_ref: Some("agent-1".into()), + context_id: None, + task_poll_secs: DEFAULT_TASK_POLL_SECS, + }) + .expect("metadata"); + assert_eq!(metadata["agencyRef"], "agency-1"); + assert_eq!(metadata["spaceRef"], "space-1"); + assert_eq!(metadata["channelRef"], "channel-1"); + assert_eq!(metadata["agentRef"], "agent-1"); + } + + #[tokio::test] + async fn deprecated_card_data_is_explicit_compatibility_path() { + let record: AgentRecord = serde_json::from_value(json!({ "modules": [{ "name": "integration/a2a", "data": { "card_data": card("http://127.0.0.1:1337/a2a"), "card_schema_version": "0.3" } }] })).expect("record"); + let (_, source) = resolve_card(record, None).await.expect("resolve card"); + assert_eq!(source, CardSource::DeprecatedCardData); + } + + #[tokio::test] + async fn digest_mismatch_is_rejected() { + let artifact = json!({ "name": "wrong" }); + let artifact_bytes = serde_json::to_vec(&artifact).expect("artifact serializes"); + let descriptor: Descriptor = serde_json::from_value(json!({ + "json": artifact, + "digest": "sha256:00", + "media_type": "application/json", + "size": artifact_bytes.len() + })) + .expect("descriptor"); + let err = descriptor_bytes(&descriptor, None) + .await + .expect_err("mismatch"); + assert!(err.to_string().contains("digest mismatch")); + } + + #[tokio::test] + async fn missing_oasf_descriptor_media_type_is_rejected() { + let artifact = json!({ "name": "missing media type" }); + let artifact_bytes = serde_json::to_vec(&artifact).expect("artifact serializes"); + let descriptor: Descriptor = serde_json::from_value(json!({ + "json": artifact, + "digest": format!("sha256:{}", hex::encode(Sha256::digest(&artifact_bytes))), + "size": artifact_bytes.len() + })) + .expect("descriptor"); + let err = descriptor_bytes(&descriptor, None) + .await + .expect_err("missing media_type"); + assert!(err.to_string().contains("requires media_type")); + } + + #[tokio::test] + async fn acp_transcript_handles_initialize_new_and_prompt() { + let mut sessions = HashSet::new(); + let initialize = handle_acp_message( + &json!({ "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": { "protocolVersion": 1 } }), + &mut sessions, + "remote-agent", + None, + ) + .expect("initialize action") + .expect("initialize response"); + let AcpAction::Response(initialize) = initialize else { + panic!("initialize must return a response"); + }; + assert_eq!(initialize["result"]["protocolVersion"], 1); + assert_eq!(initialize["result"]["agentInfo"]["name"], "remote-agent"); + + let new = handle_acp_message( + &json!({ "jsonrpc": "2.0", "id": 2, "method": "session/new", "params": {} }), + &mut sessions, + "remote-agent", + None, + ) + .expect("session/new action") + .expect("session/new response"); + let AcpAction::Response(new) = new else { + panic!("session/new must return a response"); + }; + let session_id = new["result"]["sessionId"] + .as_str() + .expect("session id") + .to_owned(); + assert!(sessions.contains(&session_id)); + + let prompt = handle_acp_message( + &json!({ + "jsonrpc": "2.0", + "id": 3, + "method": "session/prompt", + "params": { "sessionId": session_id, "prompt": [{ "type": "text", "text": "ship it" }] } + }), + &mut sessions, + "remote-agent", + None, + ) + .expect("session/prompt action") + .expect("session/prompt request"); + let AcpAction::Prompt { + id, + session_id, + text, + } = prompt + else { + panic!("session/prompt must invoke the remote runtime"); + }; + assert_eq!(id, 3); + assert_eq!(text, "ship it"); + let [update, result] = prompt_success(id, &session_id, "done"); + assert_eq!(update["method"], "session/update"); + assert_eq!(update["params"]["sessionId"], session_id); + assert_eq!(update["params"]["update"]["content"]["text"], "done"); + assert_eq!(result["result"]["stopReason"], "end_turn"); + } + + #[test] + fn terminal_task_polling_distinguishes_working_and_terminal_states() { + assert_eq!( + task_outcome(&json!({ "status": { "state": "working" } }), "task-1") + .expect("working is nonterminal"), + None, + ); + assert_eq!( + task_outcome( + &json!({ "status": { "state": "TASK_STATE_SUBMITTED" } }), + "task-1" + ) + .expect("protobuf-style submitted is nonterminal"), + None, + ); + assert_eq!( + task_outcome(&json!({ "status": { "state": "completed" } }), "task-1") + .expect("completed is successful"), + Some("A2A task task-1 completed".into()), + ); + assert_eq!( + task_outcome( + &json!({ "status": { "state": "TASK_STATE_COMPLETED" } }), + "task-1" + ) + .expect("protobuf-style completed is successful"), + Some("A2A task task-1 completed".into()), + ); + let failed = task_outcome( + &json!({ + "status": { "state": "TASK_STATE_FAILED" }, + "parts": [{ "text": "remote failure" }] + }), + "task-1", + ); + assert!(failed + .expect_err("failed tasks are ACP errors") + .to_string() + .contains("remote failure")); + } + + #[test] + fn unwraps_current_a2a_task_and_message_results() { + let task = json!({ "task": { "id": "task-2", "status": { "state": "completed" }, "artifacts": [{ "parts": [{ "text": "complete" }] }] } }); + let task_result = task.get("task").expect("task result"); + assert_eq!(task_result["id"], "task-2"); + assert_eq!( + task_outcome(task_result, "task-2").expect("completed task"), + Some("complete".into()), + ); + + let message = json!({ "message": { "messageId": "m-1", "role": "ROLE_AGENT", "parts": [{ "text": "direct response" }] } }); + let message_result = message.get("message").expect("message result"); + assert_eq!(extract_text(message_result), Some("direct response".into())); + } + + #[tokio::test] + async fn acp_reader_accepts_multiple_bounded_lines() { + let input = b"{\"method\":\"initialize\"}\r\n{\"method\":\"session/new\"}\n"; + let mut reader = BufReader::new(&input[..]); + assert_eq!( + read_bounded_line(&mut reader).await.expect("first line"), + Some("{\"method\":\"initialize\"}".into()) + ); + assert_eq!( + read_bounded_line(&mut reader).await.expect("second line"), + Some("{\"method\":\"session/new\"}".into()) + ); + assert_eq!(read_bounded_line(&mut reader).await.expect("eof"), None); + } + + #[tokio::test] + async fn spawned_reader_preserves_partial_lines_while_other_work_completes() { + use tokio::io::AsyncWriteExt; + + let (mut writer, reader) = tokio::io::duplex(32 * 1024); + let mut lines = spawn_line_reader(BufReader::with_capacity(8 * 1024, reader)); + let line = format!( + "{{\"jsonrpc\":\"2.0\",\"id\":7,\"method\":\"session/prompt\",\"padding\":\"{}\"}}", + "P".repeat(20 * 1024) + ); + writer + .write_all(&line.as_bytes()[..12 * 1024]) + .await + .expect("write first fragment"); + tokio::task::yield_now().await; + writer + .write_all(&line.as_bytes()[12 * 1024..]) + .await + .expect("write second fragment"); + writer.write_all(b"\n").await.expect("finish line"); + + assert_eq!( + lines + .recv() + .await + .expect("reader remains available") + .expect("line is valid"), + Some(line), + ); + } + + #[tokio::test] + async fn spawned_reader_stops_after_a_transport_error() { + use std::{ + pin::Pin, + sync::{ + atomic::{AtomicUsize, Ordering}, + Arc, + }, + task::{Context, Poll}, + }; + use tokio::io::{AsyncBufRead, AsyncRead, ReadBuf}; + + struct FailingReader { + reads: Arc, + } + + impl AsyncRead for FailingReader { + fn poll_read( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + _buf: &mut ReadBuf<'_>, + ) -> Poll> { + Poll::Ready(Err(std::io::Error::other("transport failed"))) + } + } + + impl AsyncBufRead for FailingReader { + fn poll_fill_buf( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + ) -> Poll> { + self.reads.fetch_add(1, Ordering::Relaxed); + Poll::Ready(Err(std::io::Error::other("transport failed"))) + } + + fn consume(self: Pin<&mut Self>, _amount: usize) {} + } + + let reads = Arc::new(AtomicUsize::new(0)); + let mut lines = spawn_line_reader(FailingReader { + reads: Arc::clone(&reads), + }); + assert!(matches!( + lines.recv().await, + Some(Err(AdapterError::Read { + what: "ACP request", + .. + })) + )); + assert!(lines.recv().await.is_none()); + assert_eq!(reads.load(Ordering::Relaxed), 1); + } + + #[test] + fn idless_notifications_do_not_produce_json_rpc_responses() { + let mut sessions = HashSet::new(); + let action = handle_acp_message( + &json!({ "jsonrpc": "2.0", "method": "unknown/notification" }), + &mut sessions, + "remote-agent", + None, + ) + .expect("notification is valid"); + assert!(action.is_none()); + } + + #[test] + fn cancel_notification_remains_actionable_without_an_id() { + let mut sessions = HashSet::new(); + let action = handle_acp_message( + &json!({ + "jsonrpc": "2.0", + "method": "session/cancel", + "params": { "sessionId": "session-1" } + }), + &mut sessions, + "remote-agent", + None, + ) + .expect("cancel is valid") + .expect("cancel action"); + let AcpAction::Cancel { id, session_id } = action else { + panic!("cancel notification must produce a local action"); + }; + assert!(id.is_none()); + assert_eq!(session_id, "session-1"); + } + + #[test] + fn private_ipv4_transitional_ipv6_addresses_are_rejected() { + for address in [ + "::ffff:127.0.0.1", + "::ffff:10.0.0.1", + "64:ff9b::0a00:0001", + "2002:0a00:0001::", + "2001:0000:4136:e378:8000:63bf:3fff:fdd2", + ] { + assert!( + is_private_ip(address.parse().expect("test IP")), + "{address} must not bypass the private-address policy" + ); + } + } + + #[tokio::test] + async fn remote_artifact_requires_a_digest_before_fetch() { + let descriptor: Descriptor = serde_json::from_value(json!({ + "urls": ["https://agent.example/card.json"], + "media_type": "application/a2a-agent-card+json", + "size": 1 + })) + .expect("descriptor"); + let error = descriptor_bytes(&descriptor, None) + .await + .expect_err("unsigned remote artifact"); + assert!(error.to_string().contains("require a sha256 digest")); + } +} diff --git a/crates/buzz-a2a-acp/src/main.rs b/crates/buzz-a2a-acp/src/main.rs new file mode 100644 index 0000000000..f2ecc41c93 --- /dev/null +++ b/crates/buzz-a2a-acp/src/main.rs @@ -0,0 +1,6 @@ +fn main() { + if let Err(error) = buzz_a2a_acp::run_cli() { + eprintln!("buzz-a2a-acp: {error}"); + std::process::exit(2); + } +} diff --git a/crates/buzz-acp/src/acp.rs b/crates/buzz-acp/src/acp.rs index c0147baf1b..1fe1b9ef8b 100644 --- a/crates/buzz-acp/src/acp.rs +++ b/crates/buzz-acp/src/acp.rs @@ -414,6 +414,8 @@ impl AcpClient { use std::process::Stdio; let mut cmd = tokio::process::Command::new(command); + let is_remote_a2a_adapter = + crate::config::normalize_agent_command_identity(command) == "buzz-a2a-acp"; cmd.args(args) .stdin(Stdio::piped()) .stdout(Stdio::piped()) @@ -422,6 +424,19 @@ impl AcpClient { // Ensure the child is killed when the AcpClient is dropped (best-effort). // Callers MUST still call shutdown().await for guaranteed cleanup. .kill_on_drop(true); + if is_remote_a2a_adapter { + for key in [ + "BUZZ_PRIVATE_KEY", + "NOSTR_PRIVATE_KEY", + "BUZZ_AUTH_TAG", + "BUZZ_API_TOKEN", + "BUZZ_ACP_PRIVATE_KEY", + "BUZZ_ACP_API_TOKEN", + "BUZZ_A2A_BEARER_TOKEN", + ] { + cmd.env_remove(key); + } + } // Per-persona env vars (e.g., GOOSE_PROVIDER, BUZZ_AGENT_PROVIDER). // For most keys, operator precedence wins: skip injection if already set @@ -452,6 +467,10 @@ impl AcpClient { // Handled by build_codex_config_env; skip here to avoid double-setting. continue; } + if is_remote_a2a_adapter && key == "BUZZ_A2A_BEARER_TOKEN" { + cmd.env(key, value); + continue; + } if std::env::var(key).is_err() { cmd.env(key, value); } diff --git a/crates/buzz-acp/src/config.rs b/crates/buzz-acp/src/config.rs index 9a1b74c276..77b52cd432 100644 --- a/crates/buzz-acp/src/config.rs +++ b/crates/buzz-acp/src/config.rs @@ -1026,6 +1026,13 @@ impl Config { } else { false }; + if normalize_agent_command_identity(&agent_command) == "buzz-a2a-acp" { + if let Ok(token) = std::env::var("BUZZ_A2A_BEARER_TOKEN") { + if !token.is_empty() { + persona_env_vars.push(("BUZZ_A2A_BEARER_TOKEN".to_string(), token)); + } + } + } validate_multiple_event_handling(args.multiple_event_handling, args.dedup)?; diff --git a/crates/sprig/Cargo.toml b/crates/sprig/Cargo.toml index 4e8c4ab41f..082bac570b 100644 --- a/crates/sprig/Cargo.toml +++ b/crates/sprig/Cargo.toml @@ -15,5 +15,6 @@ path = "src/main.rs" [dependencies] buzz-acp = { path = "../buzz-acp" } +buzz-a2a-acp = { path = "../buzz-a2a-acp" } buzz-agent = { path = "../buzz-agent" } buzz-dev-mcp = { path = "../buzz-dev-mcp" } diff --git a/crates/sprig/src/main.rs b/crates/sprig/src/main.rs index 672a5a5f37..530e506d7d 100644 --- a/crates/sprig/src/main.rs +++ b/crates/sprig/src/main.rs @@ -15,6 +15,7 @@ fn dispatch() -> Result<(), String> { match cmd.as_str() { "buzz-acp" => buzz_acp::run().map_err(|e| e.to_string()), + "buzz-a2a-acp" => buzz_a2a_acp::run_cli(), "buzz-agent" => buzz_agent::run().map_err(|e| e.to_string()), "sprig" => match std::env::args().nth(1).as_deref() { Some("-V") | Some("--version") => { @@ -46,8 +47,8 @@ fn print_usage() { println!( "Sprig — all-in-one Buzz ACP harness, agent, and developer MCP\n\n\ Sprig is a multicall binary. Invoke it through one of the personality names:\n\n\ - buzz-acp ACP harness\n buzz-agent ACP-compliant agent\n buzz-dev-mcp Developer MCP server\n\n\ + buzz-acp ACP harness\n buzz-agent ACP-compliant agent\n buzz-a2a-acp OASF/A2A remote-agent ACP adapter\n buzz-dev-mcp Developer MCP server\n\n\ Developer MCP helper names are also supported: rg, tree, buzz, git-credential-nostr, git-sign-nostr.\n\n\ -Installers can create links with:\n ln -s sprig buzz-acp\n ln -s sprig buzz-agent\n ln -s sprig buzz-dev-mcp" +Installers can create links with:\n ln -s sprig buzz-acp\n ln -s sprig buzz-agent\n ln -s sprig buzz-a2a-acp\n ln -s sprig buzz-dev-mcp" ); } diff --git a/desktop/src-tauri/src/commands/agent_models.rs b/desktop/src-tauri/src/commands/agent_models.rs index ca1fe9bdf6..8d9007fae7 100644 --- a/desktop/src-tauri/src/commands/agent_models.rs +++ b/desktop/src-tauri/src/commands/agent_models.rs @@ -5,6 +5,7 @@ use serde::Deserialize; use tauri::{AppHandle, State}; use super::agent_model_process::run_agent_models_command; +use super::agent_name_update::apply_managed_agent_name_update; // The map-only lookup is reached solely from the base-URL helpers that exist for // their unit tests; discovery itself always goes through the process-env variant. #[cfg(test)] @@ -883,14 +884,7 @@ pub async fn update_managed_agent( let record = find_managed_agent_mut(&mut records, &input.pubkey)?; let previous_record = record.clone(); - let mut name_changed = false; - if let Some(name_update) = input.name { - let trimmed = name_update.trim().to_string(); - if !trimmed.is_empty() && trimmed != record.name { - record.name = trimmed; - name_changed = true; - } - } + let name_changed = apply_managed_agent_name_update(record, input.name); apply_model_provider_prompt_update( record, input.model, @@ -1002,7 +996,10 @@ pub async fn update_managed_agent( &record.relay_url, &relay_ws_url_with_override(&state), ); - let display_name = record.name.clone(); + let display_name = record + .display_name + .clone() + .unwrap_or_else(|| record.name.clone()); // Avatar fallback derives from the EFFECTIVE harness (persona-wins), // not the frozen snapshot, so an inherited harness picks the right // default avatar. diff --git a/desktop/src-tauri/src/commands/agent_models_tests.rs b/desktop/src-tauri/src/commands/agent_models_tests.rs index d98460109f..011b26ffff 100644 --- a/desktop/src-tauri/src/commands/agent_models_tests.rs +++ b/desktop/src-tauri/src/commands/agent_models_tests.rs @@ -565,6 +565,114 @@ fn definition_less_instance_accepts_model_provider_prompt_writes() { assert_eq!(record.system_prompt.as_deref(), Some("new-prompt")); } +#[test] +fn managed_agent_rename_keeps_a_mirrored_display_name_in_sync() { + let mut record: crate::managed_agents::ManagedAgentRecord = serde_json::from_str( + r#"{ + "pubkey": "standalone1", + "name": "Remote Agency · proxied by Buzz · example-agent", + "display_name": "Remote Agency · proxied by Buzz · example-agent", + "private_key_nsec": "nsec1fake", + "relay_url": "wss://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "buzz-a2a-acp", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "system_prompt": null, + "model": null, + "provider": null, + "env_vars": {}, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "last_started_at": null, + "last_stopped_at": null, + "last_exit_code": null, + "last_error": null + }"#, + ) + .expect("standalone agent record"); + + assert!(apply_managed_agent_name_update( + &mut record, + Some("Example Agent".to_string()) + )); + assert_eq!(record.name, "Example Agent"); + assert_eq!(record.display_name.as_deref(), Some("Example Agent")); +} + +#[test] +fn managed_agent_rename_repairs_a_legacy_remote_display_name() { + let mut record: crate::managed_agents::ManagedAgentRecord = serde_json::from_str( + r#"{ + "pubkey": "standalone1", + "name": "example-agent", + "display_name": "Remote Agency · proxied by Buzz · example-agent", + "private_key_nsec": "nsec1fake", + "relay_url": "wss://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "buzz-a2a-acp", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "system_prompt": null, + "model": null, + "provider": null, + "env_vars": {}, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "last_started_at": null, + "last_stopped_at": null, + "last_exit_code": null, + "last_error": null + }"#, + ) + .expect("standalone agent record"); + + assert!(apply_managed_agent_name_update( + &mut record, + Some("example-agent".to_string()) + )); + assert_eq!(record.name, "example-agent"); + assert_eq!(record.display_name.as_deref(), Some("example-agent")); +} + +#[test] +fn managed_agent_rename_preserves_a_custom_display_name() { + let mut record: crate::managed_agents::ManagedAgentRecord = serde_json::from_str( + r#"{ + "pubkey": "standalone1", + "name": "example-runtime", + "display_name": "Example Agent Custom", + "private_key_nsec": "nsec1fake", + "relay_url": "wss://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "buzz-a2a-acp", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "system_prompt": null, + "model": null, + "provider": null, + "env_vars": {}, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "last_started_at": null, + "last_stopped_at": null, + "last_exit_code": null, + "last_error": null + }"#, + ) + .expect("standalone agent record"); + + assert!(apply_managed_agent_name_update( + &mut record, + Some("example-agent".to_string()) + )); + assert_eq!(record.name, "example-agent"); + assert_eq!(record.display_name.as_deref(), Some("Example Agent Custom")); +} + #[test] fn is_databricks_provider_matches_both_variants() { assert!(is_databricks_provider(Some("databricks"))); diff --git a/desktop/src-tauri/src/commands/agent_name_update.rs b/desktop/src-tauri/src/commands/agent_name_update.rs new file mode 100644 index 0000000000..38e066db11 --- /dev/null +++ b/desktop/src-tauri/src/commands/agent_name_update.rs @@ -0,0 +1,34 @@ +use crate::managed_agents::ManagedAgentRecord; + +pub(super) fn apply_managed_agent_name_update( + record: &mut ManagedAgentRecord, + name_update: Option, +) -> bool { + let Some(name_update) = name_update else { + return false; + }; + let trimmed = name_update.trim(); + if trimmed.is_empty() { + return false; + } + + let display_name_mirrors_handle = record.display_name.as_deref() == Some(record.name.as_str()); + let display_name_is_legacy_remote_label = record + .display_name + .as_deref() + .and_then(|display_name| display_name.strip_prefix("Remote Agency · proxied by Buzz · ")) + .is_some_and(|handle| handle.eq_ignore_ascii_case(record.name.trim())); + if trimmed == record.name { + if display_name_is_legacy_remote_label { + record.display_name = Some(trimmed.to_string()); + return true; + } + return false; + } + + record.name = trimmed.to_string(); + if display_name_mirrors_handle || display_name_is_legacy_remote_label { + record.display_name = Some(record.name.clone()); + } + true +} diff --git a/desktop/src-tauri/src/commands/mod.rs b/desktop/src-tauri/src/commands/mod.rs index 1c89ee4f77..84c6981a3f 100644 --- a/desktop/src-tauri/src/commands/mod.rs +++ b/desktop/src-tauri/src/commands/mod.rs @@ -6,6 +6,7 @@ mod agent_metric_archive; mod agent_model_process; mod agent_models; mod agent_models_env; +mod agent_name_update; mod agent_providers; mod agent_settings; mod agent_update_rollback; @@ -51,6 +52,7 @@ mod project_terminal; mod qr_download; mod relay_members; mod relay_reconnect; +mod remote_agencies; mod social; mod team_snapshot; mod teams; @@ -102,6 +104,7 @@ pub use project_terminal::*; pub use qr_download::*; pub use relay_members::*; pub use relay_reconnect::*; +pub use remote_agencies::*; pub use social::*; pub use team_snapshot::*; pub use teams::*; diff --git a/desktop/src-tauri/src/commands/remote_agencies.rs b/desktop/src-tauri/src/commands/remote_agencies.rs new file mode 100644 index 0000000000..70bf7f3f20 --- /dev/null +++ b/desktop/src-tauri/src/commands/remote_agencies.rs @@ -0,0 +1,813 @@ +//! Remote Agency discovery and binding persistence. +//! +//! This module intentionally implements only the host-side projection. The +//! source runtime remains authoritative for prompts, memory, tools, and +//! signing keys. Execution is supplied by the separately packaged +//! `buzz-a2a-acp` adapter. + +use std::{collections::BTreeSet, net::IpAddr, path::PathBuf, sync::OnceLock, time::Duration}; + +use regex::Regex; +use serde::{Deserialize, Serialize}; +use serde_json::Value; +use sha2::{Digest, Sha256}; +use tauri::{AppHandle, Manager}; +use url::Url; + +const MAX_DOCUMENT_BYTES: usize = 1024 * 1024; +const MAX_ITEMS: usize = 128; +const MAX_TEXT_BYTES: usize = 512; +const MAX_BEARER_TOKEN_BYTES: usize = 16 * 1024; +const FETCH_TIMEOUT: Duration = Duration::from_secs(10); + +fn is_private_address(address: IpAddr) -> bool { + let address = match address { + IpAddr::V6(address) => address + .to_ipv4_mapped() + .map(IpAddr::V4) + .unwrap_or(IpAddr::V6(address)), + address => address, + }; + match address { + IpAddr::V4(address) => { + let octets = address.octets(); + address.is_private() + || address.is_loopback() + || address.is_link_local() + || address.is_unspecified() + || address.is_multicast() + || octets[0] == 0 + || (octets[0] == 100 && (64..=127).contains(&octets[1])) + } + IpAddr::V6(address) => { + let segments = address.segments(); + address.is_unique_local() + || address.is_loopback() + || address.is_unicast_link_local() + || address.is_unspecified() + || address.is_multicast() + || (segments[0] == 0x0064 + && segments[1] == 0xff9b + && segments[2..6] == [0, 0, 0, 0]) + || segments[0] == 0x2002 + || (segments[0] == 0x2001 && segments[1] == 0) + || segments[..6] == [0, 0, 0, 0, 0, 0] + } + } +} + +fn normalized_host(host: &str) -> String { + host.trim_start_matches('[') + .trim_end_matches(']') + .to_ascii_lowercase() +} + +fn is_loopback_host(host: &str) -> bool { + host.eq_ignore_ascii_case("localhost") + || host + .parse::() + .is_ok_and(|address| address.is_loopback()) +} + +fn equivalent_loopback_agency_source(left: &str, right: &str) -> bool { + let (Ok(left), Ok(right)) = (Url::parse(left), Url::parse(right)) else { + return false; + }; + let (Some(left_host), Some(right_host)) = (left.host_str(), right.host_str()) else { + return false; + }; + is_loopback_host(&normalized_host(left_host)) + && is_loopback_host(&normalized_host(right_host)) + && left.scheme() == right.scheme() + && left.port_or_known_default() == right.port_or_known_default() + && left.path() == right.path() + && left.query() == right.query() + && left.fragment() == right.fragment() + && left.username() == right.username() + && left.password() == right.password() +} + +fn remote_agency_bearer_token_key_from_urls(record_url: &Url, endpoint: &Url) -> String { + let digest = Sha256::digest(format!("{record_url}\n{endpoint}").as_bytes()); + format!("remote-agency-a2a:{}", hex::encode(digest)) +} + +fn remote_agency_bearer_token_key(record_url: &str, endpoint: &str) -> Result { + let record_url = validate_remote_agency_url(record_url)?; + let endpoint = validate_remote_agency_url(endpoint)?; + Ok(remote_agency_bearer_token_key_from_urls( + &record_url, + &endpoint, + )) +} + +fn remote_agency_bearer_token_keys( + record_url: &str, + endpoint: &str, +) -> Result, String> { + let record_url = validate_remote_agency_url(record_url)?; + let endpoint = validate_remote_agency_url(endpoint)?; + let mut keys = vec![remote_agency_bearer_token_key_from_urls( + &record_url, + &endpoint, + )]; + + let loopback_pair = record_url.host_str().zip(endpoint.host_str()).is_some_and( + |(record_host, endpoint_host)| { + is_loopback_host(&normalized_host(record_host)) + && is_loopback_host(&normalized_host(endpoint_host)) + }, + ); + if loopback_pair { + for host in ["localhost", "127.0.0.1", "[::1]"] { + let mut record_alias = record_url.clone(); + let mut endpoint_alias = endpoint.clone(); + record_alias + .set_host(Some(host)) + .map_err(|_| "Remote Agency record loopback alias is invalid".to_string())?; + endpoint_alias + .set_host(Some(host)) + .map_err(|_| "Remote Agency endpoint loopback alias is invalid".to_string())?; + let key = remote_agency_bearer_token_key_from_urls(&record_alias, &endpoint_alias); + if !keys.contains(&key) { + keys.push(key); + } + } + } + + Ok(keys) +} + +pub(crate) fn load_remote_agency_bearer_token( + record_url: &str, + endpoint: &str, +) -> Result, String> { + let store = crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); + for key in remote_agency_bearer_token_keys(record_url, endpoint)? { + if let Some(token) = store.load(&key)? { + return Ok(Some(token)); + } + } + Ok(None) +} + +fn sanitize_untrusted_text(value: &str) -> String { + static CONTROL_OR_FORMAT: OnceLock = OnceLock::new(); + CONTROL_OR_FORMAT + .get_or_init(|| Regex::new(r"[\p{Cc}\p{Cf}]").expect("static Unicode category regex")) + .replace_all(value, "") + .trim() + .to_string() +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencyAgent { + pub id: String, + pub name: String, + pub description: Option, + pub record_url: Option, + pub record_revision: Option, + pub a2a_endpoint: Option, + pub agent_card_url: Option, + pub capabilities: Vec, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencySurface { + pub id: String, + pub name: String, + pub surface_type: Option, + pub locator: Option, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencySpace { + pub id: String, + pub name: String, + pub description: Option, + pub surfaces: Vec, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencyDescriptor { + pub source_url: String, + pub agency_id: String, + pub name: String, + pub description: Option, + pub agents: Vec, + pub spaces: Vec, + pub protocols: Vec, + pub capabilities: Vec, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencyBinding { + pub source_url: String, + pub agency_id: String, + pub agent_ids: Vec, + pub space_ids: Vec, + pub channel_ids: Vec, + #[serde(default)] + pub proxies: Vec, + pub joined_at: String, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub struct RemoteAgencyProxy { + pub agent_id: String, + pub pubkey: String, + pub channel_id: String, + pub space_id: Option, + pub record_url: String, + pub record_revision: Option, + #[serde(default)] + pub record_cid: Option, + #[serde(default)] + pub record_verification: Option, +} + +fn text(value: Option<&Value>) -> Option { + let value = sanitize_untrusted_text(value?.as_str()?); + if value.is_empty() || value.len() > MAX_TEXT_BYTES { + return None; + } + Some(value) +} + +fn id(value: Option<&Value>) -> Option { + text(value).filter(|value| value.len() <= 128) +} + +fn strings(value: Option<&Value>) -> Vec { + let Some(values) = value.and_then(Value::as_array) else { + return Vec::new(); + }; + let mut result = BTreeSet::new(); + for value in values.iter().take(MAX_ITEMS) { + if let Some(value) = value.as_str().and_then(|value| { + let value = sanitize_untrusted_text(value); + (!value.is_empty() && value.len() <= MAX_TEXT_BYTES).then_some(value) + }) { + result.insert(value); + } else if let Some(value) = value.get("name").and_then(|value| value.as_str()) { + let value = sanitize_untrusted_text(value); + if !value.is_empty() && value.len() <= MAX_TEXT_BYTES { + result.insert(value); + } + } + } + result.into_iter().collect() +} + +fn same_origin_reference(source: &Url, value: Option<&Value>) -> Option { + let candidate = text(value) + .or_else(|| value?.get("url").and_then(|value| text(Some(value)))) + .or_else(|| value?.get("href").and_then(|value| text(Some(value))))?; + let parsed = Url::parse(&candidate) + .or_else(|_| source.join(&candidate)) + .ok()?; + if parsed.scheme() != source.scheme() + || parsed.host_str() != source.host_str() + || parsed.port_or_known_default() != source.port_or_known_default() + { + return None; + } + Some(parsed.to_string()) +} + +fn linked_urls(source: &Url, document: &Value) -> Vec<(String, String)> { + if let Some(links) = document.get("links").and_then(Value::as_array) { + return links + .iter() + .filter_map(|link| { + let kind = relation_kind(link.get("rel"))?; + same_origin_reference(source, link.get("href").or_else(|| link.get("url"))) + .map(|url| (kind.to_string(), url)) + }) + .take(8) + .collect(); + } + let Some(links) = document + .get("links") + .or_else(|| document.get("resources")) + .and_then(Value::as_object) + else { + return Vec::new(); + }; + links + .iter() + .take(8) + .filter_map(|(kind, value)| { + same_origin_reference(source, Some(value)).map(|url| (kind.clone(), url)) + }) + .collect() +} + +fn relation_kind(value: Option<&Value>) -> Option<&'static str> { + let classify = |relation: &str| { + let relation = relation.trim_end_matches('/'); + if relation.ends_with("agents") || relation.ends_with("agent-records") { + Some("agents") + } else if relation.ends_with("spaces") { + Some("spaces") + } else { + None + } + }; + match value { + Some(Value::String(value)) => classify(value), + Some(Value::Array(values)) => values.iter().filter_map(Value::as_str).find_map(classify), + _ => None, + } +} + +fn linked_collection_values<'a>(document: &'a Value, kind: &str) -> Option<&'a [Value]> { + document + .as_array() + .map(Vec::as_slice) + .or_else(|| { + document + .get(kind) + .and_then(Value::as_array) + .map(Vec::as_slice) + }) + .or_else(|| { + document + .get("data") + .and_then(Value::as_object) + .and_then(|data| data.get(kind)) + .and_then(Value::as_array) + .map(Vec::as_slice) + }) +} + +fn merge_linked_collections(mut document: Value, linked: I) -> Value +where + I: IntoIterator, +{ + for (kind, linked_document) in linked { + let Some(values) = linked_collection_values(&linked_document, &kind) else { + continue; + }; + if matches!(kind.as_str(), "agents" | "agent_records" | "spaces") { + document[kind] = Value::Array(values.iter().take(MAX_ITEMS).cloned().collect()); + } + } + document +} + +fn parse_preview_document( + source_url: &str, + document: Value, + linked: impl IntoIterator, +) -> Result { + let merged = merge_linked_collections(document, linked); + let bytes = serde_json::to_vec(&merged) + .map_err(|error| format!("failed to normalize Remote Agency descriptor: {error}"))?; + parse_remote_agency_document(source_url, &bytes) +} + +fn first_reference(source: &Url, value: Option<&Value>) -> Option { + value + .and_then(Value::as_array) + .into_iter() + .flatten() + .take(MAX_ITEMS) + .find_map(|value| same_origin_reference(source, Some(value))) +} + +fn first_jsonrpc_reference(source: &Url, value: Option<&Value>) -> Option { + value + .and_then(Value::as_array) + .into_iter() + .flatten() + .take(MAX_ITEMS) + .filter(|value| { + value + .get("protocolBinding") + .or_else(|| value.get("protocol_binding")) + .and_then(Value::as_str) + .is_some_and(|binding| binding.to_ascii_lowercase().contains("jsonrpc")) + }) + .find_map(|value| same_origin_reference(source, Some(value))) +} + +fn parse_agent(source: &Url, value: &Value) -> Option { + let agent_id = id(value.get("id").or_else(|| value.get("identifier"))) + .or_else(|| id(value.get("agent_id")))?; + let name = text(value.get("display_name")) + .or_else(|| text(value.get("displayName"))) + .or_else(|| text(value.get("name"))) + .unwrap_or_else(|| agent_id.clone()); + let card = value + .get("agent_card_url") + .or_else(|| value.get("agentCardUrl")) + .or_else(|| value.get("agent_card")) + .or_else(|| value.get("card")) + .or_else(|| value.get("url")) + .and_then(|value| same_origin_reference(source, Some(value))); + let record = value + .get("record_url") + .or_else(|| value.get("recordUrl")) + .or_else(|| value.get("oasf_record_url")) + .or_else(|| value.get("oasfRecordUrl")) + .or_else(|| value.get("record")) + .or_else(|| value.get("artifact")) + .and_then(|value| same_origin_reference(source, Some(value))); + let record = record.or_else(|| first_reference(source, value.get("locators"))); + let a2a_endpoint = value + .get("a2a_endpoint") + .or_else(|| value.get("a2aEndpoint")) + .or_else(|| value.get("endpoint")) + .or_else(|| value.get("a2a")) + .and_then(|value| same_origin_reference(source, Some(value))); + let a2a_endpoint = a2a_endpoint.or_else(|| { + first_jsonrpc_reference( + source, + value + .get("supported_interfaces") + .or_else(|| value.get("supportedInterfaces")), + ) + }); + Some(RemoteAgencyAgent { + id: agent_id, + name, + description: text(value.get("description")), + record_url: record, + record_revision: text( + value + .get("record_revision") + .or_else(|| value.get("revision")), + ), + a2a_endpoint, + agent_card_url: card, + capabilities: strings(value.get("capabilities").or_else(|| value.get("skills"))), + }) +} + +fn parse_surface(source: &Url, value: &Value) -> Option { + let surface_id = id(value.get("id").or_else(|| value.get("identifier")))?; + let name = text(value.get("name")).unwrap_or_else(|| surface_id.clone()); + let locator = value + .get("locator") + .or_else(|| value.get("url")) + .or_else(|| value.get("artifact")) + .and_then(|value| same_origin_reference(source, Some(value))); + Some(RemoteAgencySurface { + id: surface_id, + name, + surface_type: text(value.get("type").or_else(|| value.get("experience_type"))), + locator, + }) +} + +fn parse_space(source: &Url, value: &Value) -> Option { + let space_id = id(value.get("id").or_else(|| value.get("identifier"))) + .or_else(|| id(value.get("space_id")))?; + let name = text(value.get("name")).unwrap_or_else(|| space_id.clone()); + let surfaces = value + .get("surfaces") + .and_then(Value::as_array) + .map(|values| { + values + .iter() + .take(MAX_ITEMS) + .filter_map(|value| parse_surface(source, value)) + .collect() + }) + .unwrap_or_default(); + Some(RemoteAgencySpace { + id: space_id, + name, + description: text(value.get("description")), + surfaces, + }) +} + +/// Validate a descriptor URL before any network request is made. +pub fn validate_remote_agency_url(raw: &str) -> Result { + let parsed = Url::parse(raw.trim()).map_err(|_| "Remote Agency URL is invalid".to_string())?; + if parsed.username() != "" || parsed.password().is_some() { + return Err("Remote Agency URL must not contain credentials".to_string()); + } + let host = parsed + .host_str() + .ok_or_else(|| "Remote Agency URL must include a host".to_string())?; + let host = normalized_host(host); + let local_host = is_loopback_host(&host); + if parsed.scheme() != "https" && !(parsed.scheme() == "http" && local_host) { + return Err( + "Remote Agency URL must use HTTPS (HTTP is allowed only for local development)" + .to_string(), + ); + } + if host.ends_with(".local") || host.contains('%') { + return Err("Remote Agency URL host is not allowed".to_string()); + } + if let Ok(address) = host.parse::() { + let private = is_private_address(address); + if private && !(local_host && parsed.scheme() == "http") { + return Err("Remote Agency URL must not target a private network".to_string()); + } + } + Ok(parsed) +} + +/// Parse only the public projection needed for the join preview. This never +/// copies prompts, memory, tool definitions, environment variables, keys, or +/// executable instructions from the source document. +pub fn parse_remote_agency_document( + source_url: &str, + bytes: &[u8], +) -> Result { + if bytes.len() > MAX_DOCUMENT_BYTES { + return Err("Remote Agency descriptor exceeds the 1 MiB limit".to_string()); + } + let source = validate_remote_agency_url(source_url)?; + let document: Value = serde_json::from_slice(bytes) + .map_err(|_| "Remote Agency descriptor is not valid JSON".to_string())?; + let agency = document + .get("agency") + .filter(|value| value.is_object()) + .unwrap_or(&document); + let agency_id = id(agency.get("id").or_else(|| agency.get("identifier"))) + .or_else(|| id(agency.get("agency_id"))) + .ok_or_else(|| "Remote Agency descriptor is missing an agency id".to_string())?; + let name = text(agency.get("name")).unwrap_or_else(|| agency_id.clone()); + let agents_value = agency + .get("agents") + .or_else(|| document.get("agents")) + .and_then(Value::as_array); + let agents = agents_value + .map(|values| { + values + .iter() + .take(MAX_ITEMS) + .filter_map(|value| parse_agent(&source, value)) + .collect() + }) + .unwrap_or_default(); + let spaces_value = agency + .get("spaces") + .or_else(|| document.get("spaces")) + .and_then(Value::as_array); + let spaces = spaces_value + .map(|values| { + values + .iter() + .take(MAX_ITEMS) + .filter_map(|value| parse_space(&source, value)) + .collect() + }) + .unwrap_or_default(); + let protocols = strings( + document + .get("protocols") + .or_else(|| agency.get("protocols")), + ); + let capabilities = strings( + document + .get("capabilities") + .or_else(|| agency.get("capabilities")), + ); + Ok(RemoteAgencyDescriptor { + source_url: source.to_string(), + agency_id, + name, + description: text(agency.get("description")), + agents, + spaces, + protocols, + capabilities, + }) +} + +fn binding_path(app: &AppHandle) -> Result { + let path = app + .path() + .app_data_dir() + .map_err(|error| format!("failed to resolve app data dir: {error}"))?; + std::fs::create_dir_all(&path) + .map_err(|error| format!("failed to create app data dir: {error}"))?; + Ok(path.join("remote-agencies.json")) +} + +fn load_bindings(app: &AppHandle) -> Result, String> { + let path = binding_path(app)?; + if !path.exists() { + return Ok(Vec::new()); + } + let bytes = + std::fs::read(&path).map_err(|error| format!("failed to read remote agencies: {error}"))?; + serde_json::from_slice(&bytes) + .map_err(|error| format!("failed to parse remote agencies: {error}")) +} + +async fn public_addresses(source: &Url) -> Result, String> { + let host = source + .host_str() + .ok_or_else(|| "Remote Agency URL must include a host".to_string())?; + let host = normalized_host(host); + let port = source.port_or_known_default().unwrap_or(443); + let addresses = tokio::net::lookup_host((host.as_str(), port)) + .await + .map_err(|_| "Remote Agency host could not be resolved".to_string())?; + let addresses: Vec<_> = addresses.collect(); + if addresses.is_empty() { + return Err("Remote Agency host did not resolve to an address".to_string()); + } + let local_http = source.scheme() == "http" && is_loopback_host(&host); + if local_http { + if addresses.iter().any(|address| !address.ip().is_loopback()) { + return Err("Local Remote Agency URL resolved outside loopback".to_string()); + } + } else if addresses + .iter() + .any(|address| is_private_address(address.ip())) + { + return Err("Remote Agency URL resolved to a private network".to_string()); + } + Ok(addresses) +} + +async fn fetch_json_document(source: &Url) -> Result { + let addresses = public_addresses(source).await?; + let host = source + .host_str() + .ok_or_else(|| "Remote Agency URL must include a host".to_string())?; + let host = normalized_host(host); + let client = reqwest::Client::builder() + .redirect(reqwest::redirect::Policy::none()) + .timeout(FETCH_TIMEOUT) + .resolve_to_addrs(&host, &addresses) + .build() + .map_err(|error| format!("failed to create Remote Agency client: {error}"))?; + let mut response = client + .get(source.clone()) + .header(reqwest::header::ACCEPT, "application/json") + .send() + .await + .map_err(|error| format!("Remote Agency request failed: {error}"))?; + if response.status().is_redirection() { + return Err("Remote Agency redirects are not allowed".to_string()); + } + if response.status().as_u16() == 401 || response.status().as_u16() == 403 { + return Err("Remote Agency linked projection requires authentication; use a public record or configure adapter credentials".to_string()); + } + if !response.status().is_success() { + return Err(format!("Remote Agency returned HTTP {}", response.status())); + } + if response + .content_length() + .is_some_and(|size| size > MAX_DOCUMENT_BYTES as u64) + { + return Err("Remote Agency descriptor exceeds the 1 MiB limit".to_string()); + } + let mut bytes = Vec::new(); + while let Some(chunk) = response + .chunk() + .await + .map_err(|error| format!("failed to read Remote Agency descriptor: {error}"))? + { + if bytes.len().saturating_add(chunk.len()) > MAX_DOCUMENT_BYTES { + return Err("Remote Agency descriptor exceeds the 1 MiB limit".to_string()); + } + bytes.extend_from_slice(&chunk); + } + serde_json::from_slice(&bytes) + .map_err(|_| "Remote Agency descriptor is not valid JSON".to_string()) +} + +#[tauri::command] +pub async fn preview_remote_agency(source_url: String) -> Result { + let parsed = validate_remote_agency_url(&source_url)?; + let document = fetch_json_document(&parsed).await?; + let mut links = linked_urls(&parsed, &document); + if let Some(agency) = document.get("agency") { + links.extend(linked_urls(&parsed, agency)); + } + let mut linked_documents = Vec::new(); + for (kind, url) in links.into_iter().take(4) { + let linked_url = Url::parse(&url).map_err(|_| "Remote Agency linked URL is invalid")?; + let linked_document = fetch_json_document(&linked_url).await?; + linked_documents.push((kind, linked_document)); + } + parse_preview_document(parsed.as_str(), document, linked_documents) +} + +#[tauri::command] +pub fn list_remote_agencies(app: AppHandle) -> Result, String> { + load_bindings(&app) +} + +#[tauri::command] +pub fn store_remote_agency_bearer_token( + record_url: String, + endpoint: String, + token: String, +) -> Result<(), String> { + let key = remote_agency_bearer_token_key(&record_url, &endpoint)?; + let store = crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); + if token.is_empty() { + return store.delete(&key); + } + if token.len() > MAX_BEARER_TOKEN_BYTES { + return Err(format!( + "Remote Agency bearer token exceeds the {MAX_BEARER_TOKEN_BYTES}-byte limit" + )); + } + if token.chars().any(char::is_whitespace) || token.chars().any(char::is_control) { + return Err( + "Remote Agency bearer token must not contain whitespace or control characters" + .to_string(), + ); + } + store.store(&key, &token) +} + +#[tauri::command] +pub fn save_remote_agency_binding( + mut binding: RemoteAgencyBinding, + app: AppHandle, +) -> Result { + let source = validate_remote_agency_url(&binding.source_url)?; + binding.source_url = source.to_string(); + binding.agency_id = binding.agency_id.trim().to_string(); + if binding.agency_id.is_empty() || binding.agency_id.len() > 128 { + return Err("Remote Agency binding has an invalid agency id".to_string()); + } + binding.agent_ids.sort(); + binding.agent_ids.dedup(); + binding.space_ids.sort(); + binding.space_ids.dedup(); + binding.channel_ids.sort(); + binding.channel_ids.dedup(); + for proxy in &binding.proxies { + if proxy.agent_id.is_empty() + || proxy.agent_id.len() > 128 + || proxy.channel_id.is_empty() + || proxy.channel_id.len() > 128 + || proxy.pubkey.len() != 64 + || !proxy.pubkey.chars().all(|value| value.is_ascii_hexdigit()) + || proxy.record_url.is_empty() + || proxy.record_url.len() > MAX_TEXT_BYTES + { + return Err("Remote Agency binding has an invalid proxy mapping".to_string()); + } + if let Some(space_id) = proxy.space_id.as_deref() { + if space_id.is_empty() || space_id.len() > 128 { + return Err("Remote Agency binding has an invalid Space id".to_string()); + } + } + if proxy + .record_cid + .as_deref() + .is_some_and(|value| value.is_empty() || value.len() > 256) + { + return Err("Remote Agency binding has an invalid record CID".to_string()); + } + if proxy.record_verification.as_deref().is_some_and(|value| { + !matches!( + value, + "operator-reviewed-local" | "tls-only" | "domain-jwks" | "directory-sigstore" + ) + }) { + return Err("Remote Agency binding has an invalid verification method".to_string()); + } + validate_remote_agency_url(&proxy.record_url)?; + } + binding.proxies.sort_by(|left, right| { + (&left.agent_id, &left.channel_id, &left.space_id).cmp(&( + &right.agent_id, + &right.channel_id, + &right.space_id, + )) + }); + binding.proxies.dedup_by(|left, right| { + left.agent_id == right.agent_id + && left.channel_id == right.channel_id + && left.space_id == right.space_id + }); + let mut bindings = load_bindings(&app)?; + bindings.retain(|existing| { + existing.agency_id != binding.agency_id + || (existing.source_url != binding.source_url + && !equivalent_loopback_agency_source(&existing.source_url, &binding.source_url)) + }); + bindings.push(binding.clone()); + bindings.sort_by(|left, right| left.source_url.cmp(&right.source_url)); + let payload = serde_json::to_vec_pretty(&bindings) + .map_err(|error| format!("failed to serialize remote agencies: {error}"))?; + crate::managed_agents::atomic_write_json_restricted(&binding_path(&app)?, &payload)?; + Ok(binding) +} + +#[cfg(test)] +#[path = "remote_agencies_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/commands/remote_agencies_tests.rs b/desktop/src-tauri/src/commands/remote_agencies_tests.rs new file mode 100644 index 0000000000..cb3e1aa998 --- /dev/null +++ b/desktop/src-tauri/src/commands/remote_agencies_tests.rs @@ -0,0 +1,275 @@ +use super::*; + +#[test] +fn rejects_non_https_and_private_hosts() { + assert!(validate_remote_agency_url("http://example.com/agency").is_err()); + assert!(validate_remote_agency_url("https://127.0.0.1/agency").is_err()); + assert!(validate_remote_agency_url("https://10.0.0.2/agency").is_err()); + assert!(validate_remote_agency_url("http://localhost:1337/surfaces").is_ok()); +} + +#[test] +fn rejects_private_dns_results_before_request() { + assert!(is_private_address("192.168.1.10".parse().unwrap())); + assert!(is_private_address("fd00::1".parse().unwrap())); + assert!(is_private_address("fe80::1".parse().unwrap())); + assert!(!is_private_address("203.0.113.10".parse().unwrap())); +} + +#[test] +fn rejects_ipv4_embedded_ipv6_addresses() { + for address in [ + "::ffff:127.0.0.1", + "::ffff:169.254.169.254", + "::ffff:10.0.0.1", + "64:ff9b::7f00:1", + "2002:7f00:1::", + "2001::1", + "ff02::1", + ] { + assert!( + is_private_address(address.parse().unwrap()), + "{address} must be rejected" + ); + } +} + +#[test] +fn validates_ipv6_literal_urls_with_normalized_hosts() { + assert!(validate_remote_agency_url("https://[fd00::1]/agency").is_err()); + assert!(validate_remote_agency_url("https://[::1]/agency").is_err()); + assert!(validate_remote_agency_url("http://[::1]:1337/agency").is_ok()); +} + +#[test] +fn migrates_only_equivalent_loopback_agency_sources() { + assert!(equivalent_loopback_agency_source( + "http://localhost:1337/.well-known/agency.json", + "http://127.0.0.1:1337/.well-known/agency.json" + )); + assert!(equivalent_loopback_agency_source( + "http://[::1]:1337/.well-known/agency.json", + "http://127.0.0.1:1337/.well-known/agency.json" + )); + assert!(!equivalent_loopback_agency_source( + "http://localhost:1338/.well-known/agency.json", + "http://127.0.0.1:1337/.well-known/agency.json" + )); + assert!(!equivalent_loopback_agency_source( + "https://agency.example/.well-known/agency.json", + "https://other.example/.well-known/agency.json" + )); +} + +#[test] +fn bearer_token_keys_are_endpoint_scoped_and_canonical() { + let first = remote_agency_bearer_token_key( + "https://example.com/agents/a.json", + "https://example.com:443/a2a/a", + ) + .unwrap(); + let equivalent = remote_agency_bearer_token_key( + "https://example.com/agents/a.json", + "https://example.com/a2a/a", + ) + .unwrap(); + let second = remote_agency_bearer_token_key( + "https://example.com/agents/a.json", + "https://example.com/a2a/b", + ) + .unwrap(); + assert_eq!(first, equivalent); + assert_ne!(first, second); + assert!(first.starts_with("remote-agency-a2a:")); +} + +#[test] +fn bearer_token_lookup_preserves_only_synchronized_loopback_aliases() { + let localhost = remote_agency_bearer_token_keys( + "http://localhost:1337/api/agency/oasf/records/a", + "http://localhost:1337/a2a/a", + ) + .unwrap(); + let ipv4 = remote_agency_bearer_token_keys( + "http://127.0.0.1:1337/api/agency/oasf/records/a", + "http://127.0.0.1:1337/a2a/a", + ) + .unwrap(); + assert_eq!( + localhost.into_iter().collect::>(), + ipv4.into_iter().collect::>() + ); + + let public = remote_agency_bearer_token_keys( + "https://agency.example/agents/a", + "https://agency.example/a2a/a", + ) + .unwrap(); + assert_eq!(public.len(), 1); + assert_ne!( + public[0], + remote_agency_bearer_token_key( + "https://other.example/agents/a", + "https://other.example/a2a/a" + ) + .unwrap() + ); +} + +#[test] +fn legacy_proxy_bindings_default_new_provenance_fields() { + let proxy: RemoteAgencyProxy = serde_json::from_value(serde_json::json!({ + "agentId": "example-agent", + "pubkey": "0".repeat(64), + "channelId": "channel-1", + "spaceId": "space-1", + "recordUrl": "https://agency.example/agents/example-agent.json", + "recordRevision": "r1" + })) + .expect("legacy proxy remains readable"); + assert_eq!(proxy.record_cid, None); + assert_eq!(proxy.record_verification, None); +} + +#[test] +fn parses_public_projection_and_drops_private_fields() { + let json = br#"{ + "id":"agency.example", + "name":"Example Agency", + "prompt":"private", + "agents":[{"id":"a1","name":"Scout","memory":"private","skills":["research"],"agent_card_url":"https://example.com/a1.json"}], + "spaces":[{"id":"s1","name":"Research","surfaces":[{"id":"board","name":"Board","type":"remote-defined","url":"https://example.com/board"}]}], + "protocols":["a2a"] + }"#; + let descriptor = parse_remote_agency_document("https://example.com/agency.json", json).unwrap(); + assert_eq!(descriptor.agents[0].id, "a1"); + assert_eq!( + descriptor.spaces[0].surfaces[0].surface_type.as_deref(), + Some("remote-defined") + ); + assert!(!serde_json::to_string(&descriptor) + .unwrap() + .contains("private")); +} + +#[test] +fn rejects_cross_origin_references() { + let json = + br#"{"id":"agency","agents":[{"id":"a","agent_card_url":"https://evil.example/card"}]}"#; + let descriptor = parse_remote_agency_document("https://example.com/agency.json", json).unwrap(); + assert!(descriptor.agents[0].agent_card_url.is_none()); +} + +#[test] +fn parses_collection_projection_shape() { + let json = br#"{ + "agency_id":"agency.example", + "revision":"r1", + "agents":[{"agent_id":"a1","name":"Scout","record":"https://example.com/agents/a1.json","a2a_endpoint":"https://example.com/a2a/scout"}], + "spaces":[{"space_id":"s1","name":"Research","surfaces":[]}] + }"#; + let descriptor = parse_remote_agency_document("https://example.com/agents.json", json).unwrap(); + assert_eq!(descriptor.agency_id, "agency.example"); + assert_eq!( + descriptor.agents[0].record_url.as_deref(), + Some("https://example.com/agents/a1.json") + ); + assert_eq!( + descriptor.agents[0].a2a_endpoint.as_deref(), + Some("https://example.com/a2a/scout") + ); + assert_eq!(descriptor.spaces[0].id, "s1"); +} + +#[test] +fn selects_only_a_declared_jsonrpc_interface() { + let json = br#"{ + "id":"agency.example", + "agents":[{ + "id":"a1", + "supportedInterfaces":[ + {"url":"https://example.com/a2a/grpc","protocolBinding":"GRPC"}, + {"url":"https://example.com/a2a/jsonrpc","protocolBinding":"JSONRPC"} + ] + }] + }"#; + let descriptor = parse_remote_agency_document("https://example.com/agency.json", json).unwrap(); + assert_eq!( + descriptor.agents[0].a2a_endpoint.as_deref(), + Some("https://example.com/a2a/jsonrpc") + ); +} + +#[test] +fn parses_export_projection_aliases_and_relative_refs() { + let json = br#"{ + "agency_id":"agency.example", + "revision":"r2", + "agents":[{"agent_id":"a1","name":"scout","display_name":"Scout","oasf_record_url":"/agency/agents/a1.json","a2a_endpoint":"/a2a/scout"}], + "spaces":[{"space_id":"s1","name":"Research","surfaces":[]}] + }"#; + let descriptor = + parse_remote_agency_document("https://example.com/.well-known/agency.json", json).unwrap(); + assert_eq!( + descriptor.agents[0].record_url.as_deref(), + Some("https://example.com/agency/agents/a1.json") + ); + assert_eq!( + descriptor.agents[0].a2a_endpoint.as_deref(), + Some("https://example.com/a2a/scout") + ); + assert_eq!(descriptor.agents[0].name, "Scout"); +} + +#[test] +fn resolves_manifest_link_relations_without_cross_origin() { + let json = br#"{ + "id":"agency.example", + "links":[ + {"rel":"agents","href":"/agents.json"}, + {"rel":"https://agntcy.org/rel/spaces","href":"https://example.com/spaces.json"}, + {"rel":"agents","href":"https://evil.example/agents.json"} + ] + }"#; + let source = Url::parse("https://example.com/.well-known/agency.json").unwrap(); + let links = linked_urls(&source, &serde_json::from_slice(json).unwrap()); + assert_eq!(links.len(), 2); + assert_eq!(links[0].0, "agents"); + assert_eq!(links[0].1, "https://example.com/agents.json"); +} + +#[test] +fn previews_manifest_when_spaces_link_follows_namespaced_links() { + let manifest: Value = serde_json::json!({ + "schema": "agency.remote/v1", + "id": "urn:uuid:test-agency", + "name": "Example Agency", + "links": [ + {"rel": "agents", "href": "/api/agency/agents"}, + {"rel": "https://example.com/agency/rel/one/v1", "href": "/one"}, + {"rel": "https://example.com/agency/rel/two/v1", "href": "/two"}, + {"rel": "https://example.com/agency/rel/three/v1", "href": "/three"}, + {"rel": "https://example.com/agency/rel/four/v1", "href": "/four"}, + {"rel": "https://example.com/agency/rel/five/v1", "href": "/five"}, + {"rel": "spaces", "href": "/api/agency/spaces"} + ] + }); + let source = Url::parse("http://127.0.0.1:1337/.well-known/agency.json").unwrap(); + let links = linked_urls(&source, &manifest); + assert_eq!(links.len(), 2); + assert_eq!(links[1].0, "spaces"); + let linked = vec![ + ( + "agents".to_string(), + serde_json::json!({"schema":"agency.agents/v1","agency_id":"urn:uuid:test-agency","revision":"r1","agents":[]}), + ), + ( + "spaces".to_string(), + serde_json::json!({"schema":"agency.spaces/v1","agency_id":"urn:uuid:test-agency","revision":"r2","spaces":[{"schema":"space.summary/v1","id":"urn:uuid:space-1","agency_id":"urn:uuid:test-agency","name":"Research"}]}), + ), + ]; + let descriptor = parse_preview_document(source.as_str(), manifest, linked).unwrap(); + assert_eq!(descriptor.agency_id, "urn:uuid:test-agency"); + assert_eq!(descriptor.spaces.len(), 1); + assert_eq!(descriptor.spaces[0].id, "urn:uuid:space-1"); +} diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs index 5346791ccf..20a44563bc 100644 --- a/desktop/src-tauri/src/lib.rs +++ b/desktop/src-tauri/src/lib.rs @@ -721,6 +721,10 @@ pub fn run() { install_acp_runtime, save_custom_harness, delete_custom_harness, + preview_remote_agency, + list_remote_agencies, + store_remote_agency_bearer_token, + save_remote_agency_binding, connect_acp_runtime, discover_managed_agent_prereqs, sign_event, diff --git a/desktop/src-tauri/src/managed_agents/discovery.rs b/desktop/src-tauri/src/managed_agents/discovery.rs index 71e689330f..ef526595ea 100644 --- a/desktop/src-tauri/src/managed_agents/discovery.rs +++ b/desktop/src-tauri/src/managed_agents/discovery.rs @@ -226,7 +226,7 @@ fn executable_basename(command: &str) -> String { } } -fn normalize_command_identity(command: &str) -> String { +pub(crate) fn normalize_command_identity(command: &str) -> String { let normalized = command.trim().replace('\\', "/"); let basename = normalized.rsplit('/').next().unwrap_or(normalized.as_str()); let lower = basename diff --git a/desktop/src-tauri/src/managed_agents/env_vars.rs b/desktop/src-tauri/src/managed_agents/env_vars.rs index 592a5cbbd9..57429ff73d 100644 --- a/desktop/src-tauri/src/managed_agents/env_vars.rs +++ b/desktop/src-tauri/src/managed_agents/env_vars.rs @@ -63,6 +63,7 @@ pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[ "BUZZ_API_TOKEN", "BUZZ_ACP_PRIVATE_KEY", "BUZZ_ACP_API_TOKEN", + "BUZZ_A2A_BEARER_TOKEN", // Relay URL: overriding would let a malicious config redirect the // agent to an attacker-controlled relay. "BUZZ_RELAY_URL", diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs index f3b4cb67fd..b621b194c9 100644 --- a/desktop/src-tauri/src/managed_agents/runtime.rs +++ b/desktop/src-tauri/src/managed_agents/runtime.rs @@ -22,8 +22,8 @@ pub(crate) use path::should_use_inherited; mod metadata; pub(crate) use metadata::{ - resolve_effective_prompt_model_provider, resolve_session_title, runtime_metadata_env_vars, - SESSION_TITLE_ENV_VAR, + persona_drift_state, resolve_effective_prompt_model_provider, resolve_session_title, + runtime_metadata_env_vars, SESSION_TITLE_ENV_VAR, }; mod stop; @@ -69,35 +69,7 @@ mod lifecycle; #[cfg(test)] use lifecycle::kill_stale_tracked_processes_with; pub use lifecycle::{kill_stale_tracked_processes, sync_managed_agent_processes}; - -/// Classify an agent's persona against the live catalog for the Agents-menu -/// drift indicator. Returns `(out_of_date, orphaned)`. -/// -/// Drift basis is the RECORD's `persona_source_version`, never the engram: -/// - persona_id set + persona present: out_of_date when the snapshot hash -/// differs from the persona's current content hash. -/// - persona_id set + persona gone: orphaned (no current hash to respawn into, -/// so never out_of_date — we must not tell the user to respawn into nothing). -/// - no persona_id: neither — a hand-built agent has no persona to drift from. -fn persona_drift_state( - record: &ManagedAgentRecord, - personas: &[crate::managed_agents::types::AgentDefinition], -) -> (bool, bool) { - let Some(persona_id) = record.persona_id.as_deref() else { - return (false, false); - }; - let Some(persona) = personas.iter().find(|p| p.id == persona_id) else { - return (false, true); - }; - let current = crate::managed_agents::persona_events::persona_content_hash( - &crate::managed_agents::persona_events::persona_event_content(persona), - ); - let out_of_date = record - .persona_source_version - .as_deref() - .is_some_and(|pinned| pinned != current); - (out_of_date, false) -} +mod remote_adapter; /// Resolve the runtime-pair key this record maps to for the active /// workspace: always the active workspace relay (the legacy per-record relay @@ -506,6 +478,7 @@ pub fn spawn_agent_child( })?; let effective_command = &descriptor.command; let agent_args = &descriptor.args; + let remote_a2a_bearer_token = remote_adapter::load_bearer_token(&descriptor)?; let log_path = super::managed_agent_runtime_log_path(app, &runtime_key)?; append_log_marker( @@ -860,6 +833,7 @@ pub fn spawn_agent_child( for (key, value) in &descriptor.env { command.env(key, value); } + remote_adapter::apply_bearer_token(&mut command, remote_a2a_bearer_token); configure_runtime_cli(&mut command, runtime_meta); // Buzz shared compute is stored as a native provider; derive the OpenAI-compatible diff --git a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs index 288ce06b0a..cd288da35d 100644 --- a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs +++ b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs @@ -1,3 +1,32 @@ +/// Classify an agent's persona against the live catalog for the Agents-menu +/// drift indicator. Returns `(out_of_date, orphaned)`. +/// +/// Drift basis is the RECORD's `persona_source_version`, never the engram: +/// - persona_id set + persona present: out_of_date when the snapshot hash +/// differs from the persona's current content hash. +/// - persona_id set + persona gone: orphaned (no current hash to respawn into, +/// so never out_of_date — we must not tell the user to respawn into nothing). +/// - no persona_id: neither — a hand-built agent has no persona to drift from. +pub(crate) fn persona_drift_state( + record: &crate::managed_agents::ManagedAgentRecord, + personas: &[crate::managed_agents::types::AgentDefinition], +) -> (bool, bool) { + let Some(persona_id) = record.persona_id.as_deref() else { + return (false, false); + }; + let Some(persona) = personas.iter().find(|p| p.id == persona_id) else { + return (false, true); + }; + let current = crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(persona), + ); + let out_of_date = record + .persona_source_version + .as_deref() + .is_some_and(|pinned| pinned != current); + (out_of_date, false) +} + /// Returns the (key, value) env var pairs that should be forwarded to the /// agent process for model and provider selection. /// diff --git a/desktop/src-tauri/src/managed_agents/runtime/process.rs b/desktop/src-tauri/src/managed_agents/runtime/process.rs index 37eb5659a4..ceb64b00b7 100644 --- a/desktop/src-tauri/src/managed_agents/runtime/process.rs +++ b/desktop/src-tauri/src/managed_agents/runtime/process.rs @@ -10,6 +10,8 @@ pub(crate) const KNOWN_AGENT_BINARIES: &[&str] = &[ "buzz_acp", "buzz-agent", "buzz_agent", + "buzz-a2a-acp", + "buzz_a2a_acp", "claude-agent-acp", "claude_agent_acp", "claude-code-acp", @@ -467,3 +469,15 @@ pub(crate) fn terminate_untracked_pair_runtime( super::super::remove_agent_runtime_receipt_path, ) } + +#[cfg(test)] +mod tests { + #[test] + fn known_binary_accepts_remote_a2a_adapter_variants() { + assert!(super::name_matches_known_binary("buzz-a2a-acp")); + assert!(super::name_matches_known_binary("buzz_a2a_acp")); + assert!(super::name_matches_known_binary( + "buzz-a2a-acp-aarch64-apple-darwin" + )); + } +} diff --git a/desktop/src-tauri/src/managed_agents/runtime/remote_adapter.rs b/desktop/src-tauri/src/managed_agents/runtime/remote_adapter.rs new file mode 100644 index 0000000000..52217023f1 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/runtime/remote_adapter.rs @@ -0,0 +1,27 @@ +use std::process::Command; + +use super::super::readiness::EffectiveHarnessDescriptor; + +pub(super) fn load_bearer_token( + descriptor: &EffectiveHarnessDescriptor, +) -> Result, String> { + if super::super::discovery::normalize_command_identity(&descriptor.command) != "buzz-a2a-acp" { + return Ok(None); + } + match ( + descriptor.env.get("BUZZ_A2A_AGENT_RECORD"), + descriptor.env.get("BUZZ_A2A_BEARER_ENDPOINT"), + ) { + (Some(record_url), Some(endpoint)) => { + crate::commands::load_remote_agency_bearer_token(record_url, endpoint) + } + _ => Ok(None), + } +} + +pub(super) fn apply_bearer_token(command: &mut Command, token: Option) { + command.env_remove("BUZZ_A2A_BEARER_TOKEN"); + if let Some(token) = token { + command.env("BUZZ_A2A_BEARER_TOKEN", token); + } +} diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index 07b7216346..a667c6f2ae 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -55,6 +55,7 @@ "externalBin": [ "binaries/buzz-acp", "binaries/buzz-agent", + "binaries/buzz-a2a-acp", "binaries/buzz-dev-mcp", "binaries/git-credential-nostr", "binaries/buzz" diff --git a/desktop/src/features/agents/lib/remoteAgencyJoin.test.mjs b/desktop/src/features/agents/lib/remoteAgencyJoin.test.mjs new file mode 100644 index 0000000000..6c60eda807 --- /dev/null +++ b/desktop/src/features/agents/lib/remoteAgencyJoin.test.mjs @@ -0,0 +1,146 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { + bindingFromRemoteAgencyProxies, + buildRemoteAgencyManagedAgentInput, + findRemoteAgencyBinding, + findRemoteAgencyProxy, +} from "./remoteAgencyJoin.ts"; + +const descriptor = { + sourceUrl: "https://example.com/.well-known/agency.json", + agencyId: "agency.example", + name: "Example Agency", + description: null, + protocols: ["a2a"], + capabilities: [], + agents: [], + spaces: [], +}; + +test("builds the reviewed Remote Agency adapter request without secrets", () => { + const input = buildRemoteAgencyManagedAgentInput( + descriptor, + { + id: "agent-1", + name: "Scout", + description: null, + recordUrl: "https://example.com/agents/scout.json", + recordRevision: "r1", + a2aEndpoint: "https://example.com/a2a/scout", + agentCardUrl: "https://example.com/a2a/card.json", + capabilities: ["research"], + }, + "channel-1", + "space-1", + ); + assert.deepEqual(input.agentArgs, []); + assert.equal(input.envVars.BUZZ_A2A_BEARER_TOKEN, undefined); + assert.equal( + input.envVars.BUZZ_A2A_BEARER_ENDPOINT, + "https://example.com/a2a/scout", + ); + assert.equal(input.envVars.BUZZ_A2A_CHANNEL_REF, "channel-1"); + assert.equal(input.name, "Scout"); + assert.equal(input.parallelism, 1); + assert.equal(input.startOnAppLaunch, true); +}); + +test("refuses a participant without a reviewed record or endpoint", () => { + assert.throws(() => + buildRemoteAgencyManagedAgentInput( + descriptor, + { + id: "agent-1", + name: "Scout", + description: null, + recordUrl: null, + recordRevision: null, + a2aEndpoint: "https://example.com/a2a/scout", + agentCardUrl: null, + capabilities: [], + }, + "channel-1", + null, + ), + ); + assert.throws(() => + buildRemoteAgencyManagedAgentInput( + descriptor, + { + id: "agent-1", + name: "Scout", + description: null, + recordUrl: "https://example.com/agents/scout.json", + recordRevision: null, + a2aEndpoint: null, + agentCardUrl: null, + capabilities: [], + }, + "channel-1", + null, + ), + ); +}); + +test("reuses a persisted proxy after a partial join failure", () => { + const proxy = { + agentId: "agent-1", + pubkey: "a".repeat(64), + channelId: "channel-1", + spaceId: "space-1", + recordUrl: "https://example.com/agents/scout.json", + recordRevision: "r1", + }; + const binding = bindingFromRemoteAgencyProxies(descriptor, [proxy], "joined"); + assert.equal( + findRemoteAgencyProxy(binding.proxies, "agent-1", "channel-1", "space-1"), + proxy, + ); + assert.deepEqual(binding.agentIds, ["agent-1"]); + assert.deepEqual(binding.spaceIds, ["space-1"]); + assert.deepEqual(binding.channelIds, ["channel-1"]); + assert.equal(binding.joinedAt, "joined"); +}); + +test("matches a persisted Agency binding across local loopback aliases", () => { + const binding = { + ...bindingFromRemoteAgencyProxies(descriptor, [], "joined"), + sourceUrl: "http://localhost:1337/.well-known/agency.json", + agencyId: "agency.local", + }; + const localDescriptor = { + ...descriptor, + sourceUrl: "http://127.0.0.1:1337/.well-known/agency.json", + agencyId: "agency.local", + }; + assert.equal(findRemoteAgencyBinding([binding], localDescriptor), binding); +}); + +test("does not migrate a binding across public hosts or Agency identities", () => { + const binding = bindingFromRemoteAgencyProxies(descriptor, [], "joined"); + assert.equal( + findRemoteAgencyBinding([binding], { + ...descriptor, + sourceUrl: "https://other.example/.well-known/agency.json", + }), + undefined, + ); + assert.equal( + findRemoteAgencyBinding( + [ + { + ...binding, + sourceUrl: "http://localhost:1337/.well-known/agency.json", + }, + ], + { + ...descriptor, + sourceUrl: "http://127.0.0.1:1337/.well-known/agency.json", + agencyId: "other-agency", + }, + ), + undefined, + ); +}); diff --git a/desktop/src/features/agents/lib/remoteAgencyJoin.ts b/desktop/src/features/agents/lib/remoteAgencyJoin.ts new file mode 100644 index 0000000000..884823d985 --- /dev/null +++ b/desktop/src/features/agents/lib/remoteAgencyJoin.ts @@ -0,0 +1,133 @@ +import type { + RemoteAgencyAgent, + RemoteAgencyBinding, + RemoteAgencyDescriptor, + RemoteAgencyProxy, +} from "@/shared/api/remoteAgencyTypes"; +import type { CreateManagedAgentInput } from "@/shared/api/types"; + +function normalizedLoopbackHost(hostname: string): string | null { + const normalized = hostname + .trim() + .toLowerCase() + .replace(/^\[|\]$/g, ""); + return normalized === "localhost" || + normalized === "127.0.0.1" || + normalized === "::1" + ? normalized + : null; +} + +function equivalentLoopbackAgencySource(left: string, right: string): boolean { + try { + const leftUrl = new URL(left); + const rightUrl = new URL(right); + if ( + !normalizedLoopbackHost(leftUrl.hostname) || + !normalizedLoopbackHost(rightUrl.hostname) + ) { + return false; + } + return ( + leftUrl.protocol === rightUrl.protocol && + leftUrl.port === rightUrl.port && + leftUrl.pathname === rightUrl.pathname && + leftUrl.search === rightUrl.search && + leftUrl.hash === rightUrl.hash && + leftUrl.username === rightUrl.username && + leftUrl.password === rightUrl.password + ); + } catch { + return false; + } +} + +export function findRemoteAgencyBinding( + bindings: RemoteAgencyBinding[], + descriptor: RemoteAgencyDescriptor, +): RemoteAgencyBinding | undefined { + const matchingAgency = bindings.filter( + (binding) => binding.agencyId === descriptor.agencyId, + ); + return ( + matchingAgency.find( + (binding) => binding.sourceUrl === descriptor.sourceUrl, + ) ?? + matchingAgency.find((binding) => + equivalentLoopbackAgencySource(binding.sourceUrl, descriptor.sourceUrl), + ) + ); +} + +/** + * Build the exact adapter input for a reviewed Remote Agency participant. + * The adapter requires a public Agent Record and an explicitly reviewed A2A + * endpoint. Secrets are supplied by the operator through the local Buzz + * process environment and never enter this object. + */ +export function buildRemoteAgencyManagedAgentInput( + descriptor: RemoteAgencyDescriptor, + agent: RemoteAgencyAgent, + channelId: string, + spaceId: string | null, +): CreateManagedAgentInput { + if (!agent.recordUrl) { + throw new Error( + "Remote Agent does not advertise a public OASF Agent Record", + ); + } + if (!agent.a2aEndpoint) { + throw new Error("Remote Agent does not advertise a reviewed A2A endpoint"); + } + return { + name: agent.name, + acpCommand: "buzz-acp", + agentCommand: "buzz-a2a-acp", + harnessOverride: true, + agentArgs: [], + envVars: { + BUZZ_A2A_AGENT_RECORD: agent.recordUrl, + BUZZ_A2A_BEARER_ENDPOINT: agent.a2aEndpoint, + BUZZ_A2A_AGENCY_REF: descriptor.agencyId, + BUZZ_A2A_AGENT_REF: agent.id, + BUZZ_A2A_CHANNEL_REF: channelId, + ...(spaceId ? { BUZZ_A2A_SPACE_REF: spaceId } : {}), + }, + parallelism: 1, + spawnAfterCreate: true, + startOnAppLaunch: true, + }; +} + +export function findRemoteAgencyProxy( + proxies: RemoteAgencyProxy[], + agentId: string, + channelId: string, + spaceId: string | null, +): RemoteAgencyProxy | undefined { + return proxies.find( + (proxy) => + proxy.agentId === agentId && + proxy.channelId === channelId && + proxy.spaceId === spaceId, + ); +} + +export function bindingFromRemoteAgencyProxies( + descriptor: RemoteAgencyDescriptor, + proxies: RemoteAgencyProxy[], + joinedAt?: string, +): RemoteAgencyBinding { + const unique = (values: T[]) => [...new Set(values)]; + return { + sourceUrl: descriptor.sourceUrl, + agencyId: descriptor.agencyId, + agentIds: unique(proxies.map((proxy) => proxy.agentId)).sort(), + spaceIds: unique( + proxies.flatMap((proxy) => (proxy.spaceId ? [proxy.spaceId] : [])), + ).sort(), + channelIds: unique(proxies.map((proxy) => proxy.channelId)).sort(), + proxies, + joinedAt: joinedAt ?? new Date().toISOString(), + }; +} diff --git a/desktop/src/features/agents/ui/AgentsView.tsx b/desktop/src/features/agents/ui/AgentsView.tsx index 8e1c47c615..4992647fe5 100644 --- a/desktop/src/features/agents/ui/AgentsView.tsx +++ b/desktop/src/features/agents/ui/AgentsView.tsx @@ -21,6 +21,7 @@ import { TeamDeleteDialog } from "./TeamDeleteDialog"; import { TeamDialog } from "./TeamDialog"; import { TeamsSection } from "./TeamsSection"; import { UnifiedAgentsSection } from "./UnifiedAgentsSection"; +import { RemoteAgenciesSection } from "./RemoteAgenciesSection"; import { useManagedAgentActions } from "./useManagedAgentActions"; import { usePersonaActions } from "./usePersonaActions"; import { useTeamActions } from "./useTeamActions"; @@ -202,6 +203,8 @@ export function AgentsView() { }} /> + + ([]); + const refreshBindings = React.useCallback(() => { + void listRemoteAgencies() + .then(setBindings) + .catch(() => setBindings([])); + }, []); + React.useEffect(refreshBindings, [refreshBindings]); + const remotePubkeys = React.useMemo( + () => + new Set( + bindings.flatMap((binding) => + binding.proxies.map((proxy) => proxy.pubkey), + ), + ), + [bindings], + ); + const remoteAgents = agents.filter((agent) => + remotePubkeys.has(agent.pubkey), + ); + + return ( +
+
+
+

+ + Remote Agencies +

+

+ Join an existing Agency manifest. Agent records use OASF, and + invocation uses A2A. +

+
+ +
+ {remoteAgents.length === 0 ? ( +
+ Remote participants appear here and in your selected channel after + review. Buzz uses a local proxy identity for each participant. +
+ ) : ( +
+ {remoteAgents.map((agent) => { + const displayName = remoteDisplayName(agent); + const connected = isManagedAgentActive(agent); + return ( +
+
+ +
+

{displayName}

+

+ Existing Agent · remote runtime +

+
+ + + {connected ? "Proxy running" : "Proxy stopped"} + +
+
+ Remote + OASF record + A2A configured +
+
+ ); + })} +
+ )} + +
+ ); +} diff --git a/desktop/src/features/agents/ui/RemoteAgencyDialog.tsx b/desktop/src/features/agents/ui/RemoteAgencyDialog.tsx new file mode 100644 index 0000000000..46504c1654 --- /dev/null +++ b/desktop/src/features/agents/ui/RemoteAgencyDialog.tsx @@ -0,0 +1,597 @@ +import * as React from "react"; +import { ExternalLink, LoaderCircle, Network, ShieldCheck } from "lucide-react"; + +import { useChannelsQuery } from "@/features/channels/hooks"; +import { useCreateManagedAgentMutation } from "@/features/agents/hooks"; +import { + bindingFromRemoteAgencyProxies, + buildRemoteAgencyManagedAgentInput, + findRemoteAgencyBinding, + findRemoteAgencyProxy, +} from "@/features/agents/lib/remoteAgencyJoin"; +import { + addChannelMembers, + listRemoteAgencies, + previewRemoteAgency, + saveRemoteAgencyBinding, + storeRemoteAgencyBearerToken, + updateManagedAgent, +} from "@/shared/api/tauri"; +import { + startManagedAgent, + stopManagedAgent, +} from "@/shared/api/tauriManagedAgents"; +import type { RemoteAgencyDescriptor } from "@/shared/api/remoteAgencyTypes"; +import type { Channel } from "@/shared/api/types"; +import { truncatePubkey } from "@/shared/lib/pubkey"; +import { Badge } from "@/shared/ui/badge"; +import { Button } from "@/shared/ui/button"; +import { Checkbox } from "@/shared/ui/checkbox"; +import { + Dialog, + DialogContent, + DialogDescription, + DialogHeader, + DialogTitle, +} from "@/shared/ui/dialog"; +import { Input } from "@/shared/ui/input"; + +type RemoteAgencyDialogProps = { + open: boolean; + onOpenChange: (open: boolean) => void; + onBindingChange?: () => void; +}; + +function targetChannels(channels: Channel[] | undefined) { + return (channels ?? []).filter( + (channel) => channel.channelType !== "dm" && !channel.archivedAt, + ); +} + +export function RemoteAgencyDialog({ + open, + onOpenChange, + onBindingChange, +}: RemoteAgencyDialogProps) { + const channelsQuery = useChannelsQuery({ enabled: open }); + const createMutation = useCreateManagedAgentMutation(); + const [sourceUrl, setSourceUrl] = React.useState(""); + const [descriptor, setDescriptor] = + React.useState(null); + const [selectedAgentIds, setSelectedAgentIds] = React.useState([]); + const [selectedSpaceIds, setSelectedSpaceIds] = React.useState([]); + const [channelId, setChannelId] = React.useState(""); + const [error, setError] = React.useState(null); + const [credentialMessage, setCredentialMessage] = React.useState< + string | null + >(null); + const [isPreviewing, setIsPreviewing] = React.useState(false); + const [isJoining, setIsJoining] = React.useState(false); + const bearerTokenRef = React.useRef(null); + + const channels = React.useMemo( + () => targetChannels(channelsQuery.data), + [channelsQuery.data], + ); + + React.useEffect(() => { + if (open && !channelId && channels.length > 0) { + setChannelId(channels[0].id); + } + }, [channelId, channels, open]); + + function reset() { + setSourceUrl(""); + setDescriptor(null); + setSelectedAgentIds([]); + setSelectedSpaceIds([]); + setChannelId(""); + setError(null); + setCredentialMessage(null); + setIsPreviewing(false); + setIsJoining(false); + createMutation.reset(); + } + + function handleOpenChange(next: boolean) { + if (!next) reset(); + onOpenChange(next); + } + + async function handlePreview(event: React.FormEvent) { + event.preventDefault(); + setError(null); + setCredentialMessage(null); + setIsPreviewing(true); + try { + const next = await previewRemoteAgency(sourceUrl.trim()); + setDescriptor(next); + const joinableAgent = next.agents.find( + (agent) => agent.recordUrl && agent.a2aEndpoint, + ); + setSelectedAgentIds(joinableAgent ? [joinableAgent.id] : []); + setSelectedSpaceIds(next.spaces.length > 0 ? [next.spaces[0].id] : []); + } catch (cause) { + setError(cause instanceof Error ? cause.message : String(cause)); + } finally { + setIsPreviewing(false); + } + } + + async function handleJoin() { + if (!descriptor || selectedAgentIds.length === 0 || !channelId) return; + setError(null); + setIsJoining(true); + try { + const joinedPubkeys: string[] = []; + const failures: string[] = []; + const currentBindings = await listRemoteAgencies(); + const existingBinding = findRemoteAgencyBinding( + currentBindings, + descriptor, + ); + const proxies = [...(existingBinding?.proxies ?? [])]; + const bearerToken = bearerTokenRef.current?.value ?? ""; + for (const agentId of selectedAgentIds) { + const remote = descriptor.agents.find((agent) => agent.id === agentId); + if (!remote) continue; + if (!remote.recordUrl || !remote.a2aEndpoint) { + throw new Error( + `${remote.name} no longer advertises a public OASF Agent Record and reviewed A2A endpoint`, + ); + } + const selectedSpaceId = selectedSpaceIds[0]; + if (bearerToken) { + await storeRemoteAgencyBearerToken({ + recordUrl: remote.recordUrl, + endpoint: remote.a2aEndpoint, + token: bearerToken, + }); + } + const existingProxy = findRemoteAgencyProxy( + proxies, + remote.id, + channelId, + selectedSpaceId ?? null, + ); + if (existingProxy) { + joinedPubkeys.push(existingProxy.pubkey); + try { + const desired = buildRemoteAgencyManagedAgentInput( + descriptor, + remote, + channelId, + selectedSpaceId ?? null, + ); + await stopManagedAgent(existingProxy.pubkey); + await updateManagedAgent({ + pubkey: existingProxy.pubkey, + name: desired.name, + acpCommand: desired.acpCommand, + agentCommand: desired.agentCommand, + harnessOverride: desired.harnessOverride, + agentArgs: desired.agentArgs, + envVars: desired.envVars, + parallelism: desired.parallelism, + }); + const existingProxyIndex = proxies.indexOf(existingProxy); + proxies[existingProxyIndex] = { + ...existingProxy, + recordUrl: remote.recordUrl, + recordRevision: remote.recordRevision, + recordCid: null, + recordVerification: remote.recordUrl.startsWith("https:") + ? "tls-only" + : "operator-reviewed-local", + }; + await saveRemoteAgencyBinding( + bindingFromRemoteAgencyProxies( + descriptor, + proxies, + existingBinding?.joinedAt, + ), + ); + await startManagedAgent(existingProxy.pubkey); + } catch (cause) { + failures.push( + `${remote.name}: ${ + cause instanceof Error ? cause.message : String(cause) + }`, + ); + } + continue; + } + const created = await createMutation.mutateAsync( + buildRemoteAgencyManagedAgentInput( + descriptor, + remote, + channelId, + selectedSpaceId ?? null, + ), + ); + proxies.push({ + agentId: remote.id, + pubkey: created.agent.pubkey, + channelId, + spaceId: selectedSpaceId ?? null, + recordUrl: remote.recordUrl, + recordRevision: remote.recordRevision, + recordCid: null, + recordVerification: remote.recordUrl.startsWith("https:") + ? "tls-only" + : "operator-reviewed-local", + }); + await saveRemoteAgencyBinding( + bindingFromRemoteAgencyProxies( + descriptor, + proxies, + existingBinding?.joinedAt, + ), + ); + if (created.spawnError) { + failures.push( + `${remote.name}: proxy configured but not started: ${created.spawnError}`, + ); + } + joinedPubkeys.push(created.agent.pubkey); + } + const membership = await addChannelMembers({ + channelId, + pubkeys: [...new Set(joinedPubkeys)], + role: "bot", + }); + failures.push( + ...membership.errors.map( + ({ pubkey, error: membershipError }) => + `${truncatePubkey(pubkey)}: channel membership failed: ${membershipError}`, + ), + ); + await saveRemoteAgencyBinding( + bindingFromRemoteAgencyProxies( + descriptor, + proxies, + existingBinding?.joinedAt, + ), + ); + if (bearerTokenRef.current) bearerTokenRef.current.value = ""; + onBindingChange?.(); + if (failures.length > 0) { + setError( + `The proxy identities were saved and can be retried without duplication. ${failures.join( + " ", + )}`, + ); + } else { + handleOpenChange(false); + } + } catch (cause) { + setError(cause instanceof Error ? cause.message : String(cause)); + } finally { + setIsJoining(false); + } + } + + async function handleClearStoredCredential() { + if (!descriptor) return; + setError(null); + setCredentialMessage(null); + const selectedEndpoints = descriptor.agents.flatMap((agent) => { + if ( + !selectedAgentIds.includes(agent.id) || + !agent.recordUrl || + !agent.a2aEndpoint + ) { + return []; + } + return [ + { endpoint: agent.a2aEndpoint, recordUrl: agent.recordUrl } as const, + ]; + }); + try { + await Promise.all( + selectedEndpoints.map(({ endpoint, recordUrl }) => + storeRemoteAgencyBearerToken({ + endpoint, + recordUrl, + token: "", + }), + ), + ); + if (bearerTokenRef.current) bearerTokenRef.current.value = ""; + setCredentialMessage( + `Cleared stored credentials for ${selectedEndpoints.length} selected endpoint${ + selectedEndpoints.length === 1 ? "" : "s" + }.`, + ); + } catch (cause) { + setError(cause instanceof Error ? cause.message : String(cause)); + } + } + + return ( + + + + + + Add Remote Agency + + + Preview an agency manifest, then join selected agents to a Buzz + channel through local proxy identities. + + + + {!descriptor ? ( +
+ setSourceUrl(event.target.value)} + placeholder="https://agency.example/.well-known/agency.json" + required + type="url" + value={sourceUrl} + /> +

+ HTTPS is required. HTTP is allowed only for localhost development. + Buzz imports public identity and capability metadata only. +

+ +
+ ) : ( +
+
+
+
+

{descriptor.name}

+

+ {descriptor.sourceUrl} +

+
+ Remote Agency +
+ {descriptor.description ? ( +

+ {descriptor.description} +

+ ) : null} +
+

+ Declared by the agency manifest +

+
+ {[...descriptor.protocols, ...descriptor.capabilities] + .slice(0, 8) + .map((value) => ( + + {value} + + ))} +
+
+
+ +
+

Agents to join

+ {descriptor.agents.length === 0 ? ( +

+ No public agents were advertised. +

+ ) : null} + {descriptor.agents.map((agent) => ( +
+ + setSelectedAgentIds((current) => + checked + ? [...new Set([...current, agent.id])] + : current.filter((id) => id !== agent.id), + ) + } + /> + + {agent.name} + {agent.description ? ( + + {agent.description} + + ) : null} + {agent.agentCardUrl ? ( + + A2A Agent Card + + ) : null} + {agent.recordUrl ? ( + + OASF Agent Record + + ) : null} + {agent.a2aEndpoint ? ( + + A2A endpoint configured: {agent.a2aEndpoint} + + ) : null} + {!agent.recordUrl || !agent.a2aEndpoint ? ( + + Missing public OASF Agent Record or A2A endpoint; this + agent is preview-only. + + ) : null} + +
+ ))} +
+ +
+

Spaces and surfaces

+

+ Spaces and surfaces are advertised metadata in this release. + Buzz can bind a proxy to a Space, but it does not install or + render the advertised surfaces yet. +

+ {descriptor.spaces.length === 0 ? ( +

+ No public Spaces were advertised. +

+ ) : null} + {descriptor.spaces.map((space) => ( +
+ + + setSelectedSpaceIds(checked ? [space.id] : []) + } + /> + + {space.name} + {space.description ? ( + + {space.description} + + ) : null} + + + {space.surfaces.length > 0 ? ( +
+ {space.surfaces.map((surface) => ( + + {surface.name} + {surface.surfaceType + ? ` · ${surface.surfaceType}` + : ""} + + ))} +
+ ) : null} +
+ ))} +
+ + + +
+ + +
+ + One token is applied to each selected endpoint for this join. + Leave it blank for public endpoints or to reuse a token + already stored on this machine. + + +
+ {credentialMessage ? ( +

+ {credentialMessage} +

+ ) : null} +
+ +
+ + + Buzz creates a local Nostr identity for each proxy. The remote + runtime keeps its own keys, prompts, memory, tools, and signing + authority. Endpoint credentials are stored in the OS Keychain + and are injected only into the matching A2A adapter. + +
+ + {error ? ( +

+ {error} +

+ ) : null} +
+ + +
+
+ )} + {error && !descriptor ? ( +

+ {error} +

+ ) : null} + + + ); +} diff --git a/desktop/src/shared/api/remoteAgencyTypes.ts b/desktop/src/shared/api/remoteAgencyTypes.ts new file mode 100644 index 0000000000..bb288ef88c --- /dev/null +++ b/desktop/src/shared/api/remoteAgencyTypes.ts @@ -0,0 +1,61 @@ +export type RemoteAgencyAgent = { + id: string; + name: string; + description: string | null; + recordUrl: string | null; + recordRevision: string | null; + a2aEndpoint: string | null; + agentCardUrl: string | null; + capabilities: string[]; +}; + +export type RemoteAgencySurface = { + id: string; + name: string; + surfaceType: string | null; + locator: string | null; +}; + +export type RemoteAgencySpace = { + id: string; + name: string; + description: string | null; + surfaces: RemoteAgencySurface[]; +}; + +export type RemoteAgencyDescriptor = { + sourceUrl: string; + agencyId: string; + name: string; + description: string | null; + agents: RemoteAgencyAgent[]; + spaces: RemoteAgencySpace[]; + protocols: string[]; + capabilities: string[]; +}; + +export type RemoteAgencyBinding = { + sourceUrl: string; + agencyId: string; + agentIds: string[]; + spaceIds: string[]; + channelIds: string[]; + proxies: RemoteAgencyProxy[]; + joinedAt: string; +}; + +export type RemoteAgencyProxy = { + agentId: string; + pubkey: string; + channelId: string; + spaceId: string | null; + recordUrl: string; + recordRevision: string | null; + recordCid: string | null; + recordVerification: + | "operator-reviewed-local" + | "tls-only" + | "domain-jwks" + | "directory-sigstore" + | null; +}; diff --git a/desktop/src/shared/api/tauri.ts b/desktop/src/shared/api/tauri.ts index c57525480e..3a3106942e 100644 --- a/desktop/src/shared/api/tauri.ts +++ b/desktop/src/shared/api/tauri.ts @@ -37,6 +37,10 @@ import type { GitBashPrerequisite, RuntimeConfigSurface, } from "@/shared/api/types"; +import type { + RemoteAgencyBinding, + RemoteAgencyDescriptor, +} from "@/shared/api/remoteAgencyTypes"; export * from "@/shared/api/tauriChannels"; @@ -865,6 +869,34 @@ export async function listManagedAgents(): Promise { fromRawManagedAgent, ); } + +export async function previewRemoteAgency( + sourceUrl: string, +): Promise { + return invokeTauri("preview_remote_agency", { + sourceUrl, + }); +} + +export async function listRemoteAgencies(): Promise { + return invokeTauri("list_remote_agencies"); +} + +export async function storeRemoteAgencyBearerToken(input: { + recordUrl: string; + endpoint: string; + token: string; +}): Promise { + return invokeTauri("store_remote_agency_bearer_token", input); +} + +export async function saveRemoteAgencyBinding( + binding: RemoteAgencyBinding, +): Promise { + return invokeTauri("save_remote_agency_binding", { + binding, + }); +} export async function createManagedAgent(input: CreateManagedAgentInput) { const response = await invokeTauri( "create_managed_agent", diff --git a/scripts/build-sprig.sh b/scripts/build-sprig.sh index 77ee6e5832..de27b343ab 100755 --- a/scripts/build-sprig.sh +++ b/scripts/build-sprig.sh @@ -5,6 +5,7 @@ # sprig implementation binary # buzz-acp link to sprig (ACP harness) # buzz-agent link to sprig (ACP-compliant agent) +# buzz-a2a-acp link to sprig (OASF/A2A remote-agent ACP adapter) # buzz-dev-mcp link to sprig (developer MCP server; also dispatches # rg/tree/buzz/git-credential-nostr/git-sign-nostr) # @@ -34,6 +35,7 @@ # sprig # buzz-acp # buzz-agent +# buzz-a2a-acp # buzz-dev-mcp # README.md # sprig.json { version, git_sha, target, binaries: [{name, sha256, size}] } @@ -59,7 +61,7 @@ else fi BUNDLE_BIN="sprig" -COMMANDS=(buzz-acp buzz-agent buzz-dev-mcp) +COMMANDS=(buzz-acp buzz-agent buzz-a2a-acp buzz-dev-mcp) echo "==> Building Sprig v${VERSION} for ${TARGET}" echo " git_sha=${GIT_SHA}" @@ -143,6 +145,8 @@ Commands: - `buzz-acp` — ACP harness that bridges Buzz channel events to an ACP-compliant agent over stdio. - `buzz-agent` — ACP-compliant agent (spawns MCP servers, calls LLMs). +- `buzz-a2a-acp` — OASF/A2A remote-agent ACP adapter. It reads an operator- + supplied Agent Record and forwards prompts through the advertised A2A endpoint. - `buzz-dev-mcp` — Developer MCP server (shell, str_replace, todo) and multicall entrypoint for `rg`, `tree`, `buzz`, `git-credential-nostr`, `git-sign-nostr`. diff --git a/scripts/bundle-sidecars.sh b/scripts/bundle-sidecars.sh index 07de477405..a09f54a93a 100755 --- a/scripts/bundle-sidecars.sh +++ b/scripts/bundle-sidecars.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -SIDECARS=(buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz) +SIDECARS=(buzz-acp buzz-agent buzz-a2a-acp buzz-dev-mcp git-credential-nostr buzz) HOST=$(rustc -vV | sed -n 's|host: ||p') TARGET=${1:-$HOST} BINARIES_DIR="desktop/src-tauri/binaries" @@ -29,7 +29,7 @@ for bin in "${SIDECARS[@]}"; do done if [[ ${#missing[@]} -gt 0 ]]; then echo "Error: missing release binaries in $SRC_DIR: ${missing[*]}" >&2 - echo "Run 'cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli' first." >&2 + echo "Run 'cargo build --release -p buzz-acp -p buzz-agent -p buzz-a2a-acp -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli' first." >&2 exit 1 fi From 2ce2d71cc38a9657eaf344c10e07f155b8a18615 Mon Sep 17 00:00:00 2001 From: Tyler <109685178+tlongwell-block@users.noreply.github.com> Date: Tue, 28 Jul 2026 09:17:43 -0400 Subject: [PATCH 002/112] feat(relay): make Postgres pool size configurable, default 50 (#3191) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Raise the relay's Postgres pool cap from the `buzz-db` default of 20 to 50 per pool, and expose `BUZZ_DB_POOL_SIZE` for per-deploy tuning - Applies to the writer pool and, when `READ_DATABASE_URL` is set, the reader pool; zero/unparsable values fall back to the default - The `buzz-db` library default is unchanged — only the relay opts into the larger cap ## Why During the 2026-07-27 18:40–19:05Z traffic burst on bb-public, per-pod PG pools pinned at 20 fleet-wide and ~380 requests failed on the 3s acquire timeout — membership checks, channel access lookups, and historical queries returning errors to users. The database was nowhere near a limit: Aurora (db.r8g.8xlarge, ~5,000 max connections) sat at 19% CPU, 201 connections (~4% of capacity), commit latency flat at 0.01ms. The 20-connection default was sized for "four relay pods against PG max_connections=100" (the comment in `buzz-db` says exactly that). Production now runs 12–15 pods against Aurora — the per-pod cap is the binding constraint, not the DB. Budget at the new default: 15 pods × (50 writer + 50 reader + 5 audit) ≈ 1,575 potential connections, ~30% of Aurora's ceiling — and actual usage stays demand-driven (`min_connections` stays 2, connections only open under load). Same shape as #2521 (`BUZZ_REDIS_POOL_SIZE`), which fixed the identical class of ceiling on the Redis side. ## Testing - `cargo test -p buzz-relay`: 762 passed, 1 failed — the lone red is `api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo`, the known pre-existing flake; it fails identically on clean `main` at the same SHA (verified via `git stash` / rerun) - New test `db_pool_size_env_override_and_invalid_fallback` covers override, zero, and unparsable fallback - `defaults_are_valid` extended to pin the new default - `cargo clippy -p buzz-relay --all-targets -- -D warnings` and `cargo fmt --check` clean Signed-off-by: Tyler Longwell Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell --- .env.example | 4 ++++ crates/buzz-relay/src/config.rs | 41 +++++++++++++++++++++++++++++++++ crates/buzz-relay/src/main.rs | 1 + 3 files changed, 46 insertions(+) diff --git a/.env.example b/.env.example index 024175bff0..3dc54856e7 100644 --- a/.env.example +++ b/.env.example @@ -34,6 +34,10 @@ REDIS_URL=redis://localhost:6379 # Max connections in the relay's shared Redis pool (default 16). # BUZZ_REDIS_POOL_SIZE=16 +# Max connections in each of the relay's Postgres pools — writer and, when +# READ_DATABASE_URL is set, reader (default 50). +# BUZZ_DB_POOL_SIZE=50 + # ----------------------------------------------------------------------------- # Typesense (search) # ----------------------------------------------------------------------------- diff --git a/crates/buzz-relay/src/config.rs b/crates/buzz-relay/src/config.rs index 47030dcf3f..a1691349d6 100644 --- a/crates/buzz-relay/src/config.rs +++ b/crates/buzz-relay/src/config.rs @@ -64,6 +64,14 @@ pub struct Config { /// pod is only 4 — small enough that rate-limit checks, presence, and /// pub/sub publishes queue behind each other under load. pub redis_pool_size: usize, + /// Maximum connections in the Postgres writer/reader pools. Defaults to 50. + /// + /// The `buzz-db` default of 20 was sized for a handful of pods against + /// `max_connections=100`. Against Aurora (~5,000 connections) that cap + /// is the binding constraint: a burst of concurrent handlers exhausts + /// the per-pod pool and requests fail on acquire timeout while the + /// database sits idle. + pub db_pool_size: u32, /// Public WebSocket URL of this relay, advertised in NIP-11. pub relay_url: String, /// Public WebSocket URL of the dedicated device-pairing relay, when configured. @@ -424,6 +432,12 @@ impl Config { .filter(|&v| v > 0) .unwrap_or(16); + let db_pool_size = std::env::var("BUZZ_DB_POOL_SIZE") + .ok() + .and_then(|v| v.parse::().ok()) + .filter(|&v| v > 0) + .unwrap_or(50); + let relay_url = std::env::var("RELAY_URL").unwrap_or_else(|_| "ws://localhost:3000".to_string()); @@ -875,6 +889,7 @@ impl Config { read_database_url, redis_url, redis_pool_size, + db_pool_size, relay_url, pairing_relay_url, max_connections, @@ -942,6 +957,7 @@ mod tests { assert!(!config.database_url.is_empty()); assert!(!config.redis_url.is_empty()); assert_eq!(config.redis_pool_size, 16); + assert_eq!(config.db_pool_size, 50); assert!(config.max_connections > 0); assert!(config.send_buffer_size > 0); assert_eq!(config.max_frame_bytes, DEFAULT_MAX_FRAME_BYTES); @@ -1009,6 +1025,31 @@ mod tests { assert_eq!(junk, 16, "unparsable value must fall back to the default"); } + #[test] + fn db_pool_size_env_override_and_invalid_fallback() { + let _guard = ENV_MUTEX.lock().unwrap(); + let previous = std::env::var_os("BUZZ_DB_POOL_SIZE"); + + std::env::set_var("BUZZ_DB_POOL_SIZE", "80"); + let overridden = Config::from_env().expect("config").db_pool_size; + + std::env::set_var("BUZZ_DB_POOL_SIZE", "0"); + let zero = Config::from_env().expect("config").db_pool_size; + + std::env::set_var("BUZZ_DB_POOL_SIZE", "not-a-number"); + let junk = Config::from_env().expect("config").db_pool_size; + + if let Some(value) = previous { + std::env::set_var("BUZZ_DB_POOL_SIZE", value); + } else { + std::env::remove_var("BUZZ_DB_POOL_SIZE"); + } + + assert_eq!(overridden, 80); + assert_eq!(zero, 50, "zero must fall back to the default"); + assert_eq!(junk, 50, "unparsable value must fall back to the default"); + } + #[test] fn read_database_url_unset_or_blank_is_none() { let _guard = ENV_MUTEX.lock().unwrap(); diff --git a/crates/buzz-relay/src/main.rs b/crates/buzz-relay/src/main.rs index c1a127d8eb..3ed820d3c5 100644 --- a/crates/buzz-relay/src/main.rs +++ b/crates/buzz-relay/src/main.rs @@ -158,6 +158,7 @@ async fn main() -> anyhow::Result<()> { let db_config = DbConfig { database_url: config.database_url.clone(), read_database_url: config.read_database_url.clone(), + max_connections: config.db_pool_size, ..DbConfig::default() }; let db = Db::new(&db_config).await.map_err(|e| { From 4a977c588a540be38bd8ddb268cd24437bac8165 Mon Sep 17 00:00:00 2001 From: Wes Date: Tue, 28 Jul 2026 08:21:38 -0600 Subject: [PATCH 003/112] chore(release): release Buzz Desktop version 0.5.0 (#3213) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Buzz Desktop release v0.5.0 ### Changes since v0.4.26: - feat(invites): add use-limited invite links ([#3141](https://github.com/block/buzz/pull/3141)) ([`d500c2d5c`](https://github.com/block/buzz/commit/d500c2d5cf5d9aabe0ca4ebebfcafdbe5f5b7fd3)) - fix(node): bump Buzz-supplied Node runtimes past OpenClaw's >=24.15.0 floor ([#3218](https://github.com/block/buzz/pull/3218)) ([`98a7b1334`](https://github.com/block/buzz/commit/98a7b1334823ee0be3e3fa5cab7a2e349e438dab)) - fix(desktop): preserve thread anchor through layout reflow ([#3212](https://github.com/block/buzz/pull/3212)) ([`9810d8545`](https://github.com/block/buzz/commit/9810d8545937329f229ff40d8a19edc9e3e325c1)) - feat(search): parse from:/in:/after:/before: and pass them in the filter ([#2871](https://github.com/block/buzz/pull/2871)) ([`cb2a265b5`](https://github.com/block/buzz/commit/cb2a265b5399426e808461c1a16713754c593258)) - fix(desktop): fetch join policies through native networking ([#2862](https://github.com/block/buzz/pull/2862)) ([`0019f8076`](https://github.com/block/buzz/commit/0019f80765e96f056e81b57789b8b5fb80936f72)) - fix(desktop): republish agent identity records when a persona rename propagates ([#2607](https://github.com/block/buzz/pull/2607)) ([`7ca0bbd94`](https://github.com/block/buzz/commit/7ca0bbd946fd82a7008132f94d069a97bb53f94b)) - fix(desktop): keep project Inbox previews compact ([#3193](https://github.com/block/buzz/pull/3193)) ([`de1396050`](https://github.com/block/buzz/commit/de13960505fd798070e177cb33b1663100ac06bb)) - Inbox refactor ([#2045](https://github.com/block/buzz/pull/2045)) ([`2bd4c24b7`](https://github.com/block/buzz/commit/2bd4c24b71335e7ce272ec6de6491f7f37f4b20d)) - Fix composer selection formatting and drop overlay ([#3172](https://github.com/block/buzz/pull/3172)) ([`99da5b7eb`](https://github.com/block/buzz/commit/99da5b7ebb19e26453e075bfb949672122b31be3)) - Refine pending message status ([#3153](https://github.com/block/buzz/pull/3153)) ([`75588eaff`](https://github.com/block/buzz/commit/75588eaff2354d620e554c055b80ec83735ddb0a)) - fix(desktop): recover full local storage on startup ([#3182](https://github.com/block/buzz/pull/3182)) ([`174c38e4b`](https://github.com/block/buzz/commit/174c38e4bd1ed8498641546bc4fcb6d5a4c9cede)) - fix(desktop): keep collapsed table separators out of spoilers ([#3169](https://github.com/block/buzz/pull/3169)) ([`4d8b676bb`](https://github.com/block/buzz/commit/4d8b676bb283a1917cec5850c3b7327fe122b0c1)) - feat(desktop): redesign agent runtime settings ([#3093](https://github.com/block/buzz/pull/3093)) ([`d98da7389`](https://github.com/block/buzz/commit/d98da7389e60cfbd79b219aa411449fe2e53a18a)) - fix(desktop): use forward slashes for git credential.helper on Windows ([#3023](https://github.com/block/buzz/pull/3023)) ([`899531684`](https://github.com/block/buzz/commit/8995316844f7ad50552fbae67fbd35119262796f)) - chore(desktop): add AgentCreationPreview file-size override to unblock main CI ([#3154](https://github.com/block/buzz/pull/3154)) ([`b92a1f4bf`](https://github.com/block/buzz/commit/b92a1f4bf400e7da5ab7a010cdd81a69497d8191)) - fix(desktop): make the test loader work on Windows ([#2758](https://github.com/block/buzz/pull/2758)) ([`8bb43d519`](https://github.com/block/buzz/commit/8bb43d51912894553f2670b2d285a96cf09cd472)) - fix(desktop): make lint and unit-test gates work on Windows ([#2943](https://github.com/block/buzz/pull/2943)) ([`545bb46b8`](https://github.com/block/buzz/commit/545bb46b824a3fbf4401062f03b72531d832ebb9)) - feat(desktop): add search to agent emoji picker ([#2630](https://github.com/block/buzz/pull/2630)) ([`313f793c8`](https://github.com/block/buzz/commit/313f793c8753d413c22ff8edfe420d5ee78708bc)) - fix(desktop): keep identity key help dialog readable in dark mode ([#2854](https://github.com/block/buzz/pull/2854)) ([`be275cfc6`](https://github.com/block/buzz/commit/be275cfc6c7b80fe43e9d66c6d14b6d2bbe58a10)) - feat(acp): title agent sessions from the agent and channel name ([#3028](https://github.com/block/buzz/pull/3028)) ([`f2fe3b63c`](https://github.com/block/buzz/commit/f2fe3b63c21be55907175715c076cd3a9195b74d)) - feat(git): use agent display name as git author name ([#3040](https://github.com/block/buzz/pull/3040)) ([`18eef633d`](https://github.com/block/buzz/commit/18eef633d88ac465c61d98f12655fbf51dc3ca44)) - fix(deps): bump nostr to 0.44.6 for RUSTSEC-2026-0216 (NIP-44 remote DoS) ([#3135](https://github.com/block/buzz/pull/3135)) ([`31e2de196`](https://github.com/block/buzz/commit/31e2de1966672e73e026af3c54f3a1a9a2f5e103)) - fix(desktop): read the newest pair-scoped harness log ([#3134](https://github.com/block/buzz/pull/3134)) ([`654f38490`](https://github.com/block/buzz/commit/654f384906b5c720a60a199d85031a6f1cb6efc9)) - feat(desktop): handle project work from Inbox ([#3117](https://github.com/block/buzz/pull/3117)) ([`c5c4f390b`](https://github.com/block/buzz/commit/c5c4f390b6713256e2efb8394c59823ebad73db6)) - fix(desktop): clarify identity key button when key exists ([#2357](https://github.com/block/buzz/pull/2357)) ([`87b3fcd3c`](https://github.com/block/buzz/commit/87b3fcd3c0131683569dd4268b099d18b25dcd5e)) - Restore Goose and Buzz Agent to onboarding harness selection ([#2731](https://github.com/block/buzz/pull/2731)) ([`7fc0cc82d`](https://github.com/block/buzz/commit/7fc0cc82db4d9dced9c258bbe8b530164a832a77)) - fix(desktop): render rich project work item content ([#3100](https://github.com/block/buzz/pull/3100)) ([`afb272bb7`](https://github.com/block/buzz/commit/afb272bb7b8d7d45d7de676fa97dcd5a8eefacc7)) - feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery ([#2773](https://github.com/block/buzz/pull/2773)) ([`95fdf9788`](https://github.com/block/buzz/commit/95fdf978800982389b120c66ff5e766d785419c7)) - feat(desktop): use collective mesh routing for Auto ([#2825](https://github.com/block/buzz/pull/2825)) ([`16d4ec335`](https://github.com/block/buzz/commit/16d4ec335e210295a9d9f77f36c1e85a18b6814a)) - fix(desktop): strip legacy baked team instructions from stored prompts ([#3035](https://github.com/block/buzz/pull/3035)) ([`aee631448`](https://github.com/block/buzz/commit/aee63144843854ee32ed9d36a2e7511c82ddc6b0)) - feat(agents): lower default agent parallelism from 24 to 10 ([#3038](https://github.com/block/buzz/pull/3038)) ([`5d8ede446`](https://github.com/block/buzz/commit/5d8ede446f8fdc48146fe56d389cab6bf3500f92)) - Polish community rail and mobile pairing ([#2972](https://github.com/block/buzz/pull/2972)) ([`e6c90bb7c`](https://github.com/block/buzz/commit/e6c90bb7c430d1b2af16508b634f9a5283b7fa3b)) - fix(desktop): remove bundled libsystemd from AppImage ([#2353](https://github.com/block/buzz/pull/2353)) ([`a31fc4d2f`](https://github.com/block/buzz/commit/a31fc4d2f35d51cdf45ff8c61fc3a07f49c665e8)) - fix(desktop): make agent definition authoritative for model/provider/prompt ([#1968](https://github.com/block/buzz/pull/1968)) ([`8c0e8cb16`](https://github.com/block/buzz/commit/8c0e8cb1656b04ad269bce3c2deeda2a943ae78a)) - chore(desktop): delete dead persona catalog UI cluster ([#2886](https://github.com/block/buzz/pull/2886)) ([`8e67cf399`](https://github.com/block/buzz/commit/8e67cf399d0291bcdbc69cd0402983ca030f05bb)) - fix(desktop): surface install failures hidden by curl-pipe exit codes ([#2892](https://github.com/block/buzz/pull/2892)) ([`166c6655e`](https://github.com/block/buzz/commit/166c6655e8bca87d83ad60c087fb70a32a026baf)) - Refactor managed-agent runtime into cohesive modules ([#2974](https://github.com/block/buzz/pull/2974)) ([`74b63e184`](https://github.com/block/buzz/commit/74b63e1846212af6e6751a62cfc631f74b1dfe07)) - fix(desktop): make Linux AppImage GStreamer work on non-Debian distros ([#2176](https://github.com/block/buzz/pull/2176)) ([`cc6c4d347`](https://github.com/block/buzz/commit/cc6c4d3471629fad018bcf645f9471a01b9ffe2f)) - refactor(desktop): remove Agent directory section from Agents page ([#2290](https://github.com/block/buzz/pull/2290)) ([`5d1233e84`](https://github.com/block/buzz/commit/5d1233e841b0efa91470bb45467b2c8e4284ebf6)) - fix(desktop): enable arboard Wayland backend so Linux copies reach the Wayland clipboard ([#2904](https://github.com/block/buzz/pull/2904)) ([`ab7aa8b12`](https://github.com/block/buzz/commit/ab7aa8b1200710dbc2d7a8661ed5aab95c4199c1)) - fix(desktop): supervise and re-arm relay-mesh runtime ([#2823](https://github.com/block/buzz/pull/2823)) ([`aa51dab9d`](https://github.com/block/buzz/commit/aa51dab9da5fef7054d03cf1a1207986d0000684)) - fix(agents): run live Databricks discovery instead of the fallback list ([#2890](https://github.com/block/buzz/pull/2890)) ([`8eb6e3eb6`](https://github.com/block/buzz/commit/8eb6e3eb601174249642373a6a367262fa476753)) - fix(desktop): retire prepend mode on every reader wheel ([#2913](https://github.com/block/buzz/pull/2913)) ([`07d0265cf`](https://github.com/block/buzz/commit/07d0265cfc212ef02e1c26153bf58ff46ce5ffe6)) - fix(desktop): consolidate prepend scroll correction ([#2855](https://github.com/block/buzz/pull/2855)) ([`25e7864b3`](https://github.com/block/buzz/commit/25e7864b35f4dfd1c0ff31304a38555230a85f8d)) - fix(desktop): track concurrent agent turns up to the harness maximum ([#2882](https://github.com/block/buzz/pull/2882)) ([`20bff5910`](https://github.com/block/buzz/commit/20bff591023daffc5ee1032cff02b54b75da3567)) - fix(relay): preserve reconnect backoff ([#2759](https://github.com/block/buzz/pull/2759)) ([`499c5d349`](https://github.com/block/buzz/commit/499c5d349dab13bc906b1af5fe1fcb09ce2afa81)) - refactor(relay): expose reconnect timing policy ([#2310](https://github.com/block/buzz/pull/2310)) ([`2f0041595`](https://github.com/block/buzz/commit/2f0041595d72529c06885680d2bd07ddb6a0beb4)) - fix(desktop): clear stale working badges on agent stop/restart ([#2803](https://github.com/block/buzz/pull/2803)) ([`a64cc71f6`](https://github.com/block/buzz/commit/a64cc71f6c1605279b1a6fbd0fe904a2984cbdb0)) - fix(desktop): surface agent rename relay profile sync failure as a warning toast ([#2279](https://github.com/block/buzz/pull/2279)) ([`5e3d2e484`](https://github.com/block/buzz/commit/5e3d2e4849c0f2512330801d804fb96f4ab72d28)) - fix(discovery): inject PATH into Codex adapter planning ([#2767](https://github.com/block/buzz/pull/2767)) ([`6ab3835f3`](https://github.com/block/buzz/commit/6ab3835f3fe89ee215819fe8d193463c0ae7472b)) **To release:** merge this PR. The tag and build will happen automatically. Signed-off-by: Wes --- CHANGELOG.md | 54 +++++++++++++++++++++++++++++++ desktop/package.json | 2 +- desktop/src-tauri/Cargo.lock | 2 +- desktop/src-tauri/Cargo.toml | 2 +- desktop/src-tauri/tauri.conf.json | 2 +- 5 files changed, 58 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1223936504..cfd3b16d0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,59 @@ # Changelog +## v0.5.0 + +- feat(invites): add use-limited invite links ([#3141](https://github.com/block/buzz/pull/3141)) ([`d500c2d5c`](https://github.com/block/buzz/commit/d500c2d5cf5d9aabe0ca4ebebfcafdbe5f5b7fd3)) +- fix(node): bump Buzz-supplied Node runtimes past OpenClaw's >=24.15.0 floor ([#3218](https://github.com/block/buzz/pull/3218)) ([`98a7b1334`](https://github.com/block/buzz/commit/98a7b1334823ee0be3e3fa5cab7a2e349e438dab)) +- fix(desktop): preserve thread anchor through layout reflow ([#3212](https://github.com/block/buzz/pull/3212)) ([`9810d8545`](https://github.com/block/buzz/commit/9810d8545937329f229ff40d8a19edc9e3e325c1)) +- feat(search): parse from:/in:/after:/before: and pass them in the filter ([#2871](https://github.com/block/buzz/pull/2871)) ([`cb2a265b5`](https://github.com/block/buzz/commit/cb2a265b5399426e808461c1a16713754c593258)) +- fix(desktop): fetch join policies through native networking ([#2862](https://github.com/block/buzz/pull/2862)) ([`0019f8076`](https://github.com/block/buzz/commit/0019f80765e96f056e81b57789b8b5fb80936f72)) +- fix(desktop): republish agent identity records when a persona rename propagates ([#2607](https://github.com/block/buzz/pull/2607)) ([`7ca0bbd94`](https://github.com/block/buzz/commit/7ca0bbd946fd82a7008132f94d069a97bb53f94b)) +- fix(desktop): keep project Inbox previews compact ([#3193](https://github.com/block/buzz/pull/3193)) ([`de1396050`](https://github.com/block/buzz/commit/de13960505fd798070e177cb33b1663100ac06bb)) +- Inbox refactor ([#2045](https://github.com/block/buzz/pull/2045)) ([`2bd4c24b7`](https://github.com/block/buzz/commit/2bd4c24b71335e7ce272ec6de6491f7f37f4b20d)) +- Fix composer selection formatting and drop overlay ([#3172](https://github.com/block/buzz/pull/3172)) ([`99da5b7eb`](https://github.com/block/buzz/commit/99da5b7ebb19e26453e075bfb949672122b31be3)) +- Refine pending message status ([#3153](https://github.com/block/buzz/pull/3153)) ([`75588eaff`](https://github.com/block/buzz/commit/75588eaff2354d620e554c055b80ec83735ddb0a)) +- fix(desktop): recover full local storage on startup ([#3182](https://github.com/block/buzz/pull/3182)) ([`174c38e4b`](https://github.com/block/buzz/commit/174c38e4bd1ed8498641546bc4fcb6d5a4c9cede)) +- fix(desktop): keep collapsed table separators out of spoilers ([#3169](https://github.com/block/buzz/pull/3169)) ([`4d8b676bb`](https://github.com/block/buzz/commit/4d8b676bb283a1917cec5850c3b7327fe122b0c1)) +- feat(desktop): redesign agent runtime settings ([#3093](https://github.com/block/buzz/pull/3093)) ([`d98da7389`](https://github.com/block/buzz/commit/d98da7389e60cfbd79b219aa411449fe2e53a18a)) +- fix(desktop): use forward slashes for git credential.helper on Windows ([#3023](https://github.com/block/buzz/pull/3023)) ([`899531684`](https://github.com/block/buzz/commit/8995316844f7ad50552fbae67fbd35119262796f)) +- chore(desktop): add AgentCreationPreview file-size override to unblock main CI ([#3154](https://github.com/block/buzz/pull/3154)) ([`b92a1f4bf`](https://github.com/block/buzz/commit/b92a1f4bf400e7da5ab7a010cdd81a69497d8191)) +- fix(desktop): make the test loader work on Windows ([#2758](https://github.com/block/buzz/pull/2758)) ([`8bb43d519`](https://github.com/block/buzz/commit/8bb43d51912894553f2670b2d285a96cf09cd472)) +- fix(desktop): make lint and unit-test gates work on Windows ([#2943](https://github.com/block/buzz/pull/2943)) ([`545bb46b8`](https://github.com/block/buzz/commit/545bb46b824a3fbf4401062f03b72531d832ebb9)) +- feat(desktop): add search to agent emoji picker ([#2630](https://github.com/block/buzz/pull/2630)) ([`313f793c8`](https://github.com/block/buzz/commit/313f793c8753d413c22ff8edfe420d5ee78708bc)) +- fix(desktop): keep identity key help dialog readable in dark mode ([#2854](https://github.com/block/buzz/pull/2854)) ([`be275cfc6`](https://github.com/block/buzz/commit/be275cfc6c7b80fe43e9d66c6d14b6d2bbe58a10)) +- feat(acp): title agent sessions from the agent and channel name ([#3028](https://github.com/block/buzz/pull/3028)) ([`f2fe3b63c`](https://github.com/block/buzz/commit/f2fe3b63c21be55907175715c076cd3a9195b74d)) +- feat(git): use agent display name as git author name ([#3040](https://github.com/block/buzz/pull/3040)) ([`18eef633d`](https://github.com/block/buzz/commit/18eef633d88ac465c61d98f12655fbf51dc3ca44)) +- fix(deps): bump nostr to 0.44.6 for RUSTSEC-2026-0216 (NIP-44 remote DoS) ([#3135](https://github.com/block/buzz/pull/3135)) ([`31e2de196`](https://github.com/block/buzz/commit/31e2de1966672e73e026af3c54f3a1a9a2f5e103)) +- fix(desktop): read the newest pair-scoped harness log ([#3134](https://github.com/block/buzz/pull/3134)) ([`654f38490`](https://github.com/block/buzz/commit/654f384906b5c720a60a199d85031a6f1cb6efc9)) +- feat(desktop): handle project work from Inbox ([#3117](https://github.com/block/buzz/pull/3117)) ([`c5c4f390b`](https://github.com/block/buzz/commit/c5c4f390b6713256e2efb8394c59823ebad73db6)) +- fix(desktop): clarify identity key button when key exists ([#2357](https://github.com/block/buzz/pull/2357)) ([`87b3fcd3c`](https://github.com/block/buzz/commit/87b3fcd3c0131683569dd4268b099d18b25dcd5e)) +- Restore Goose and Buzz Agent to onboarding harness selection ([#2731](https://github.com/block/buzz/pull/2731)) ([`7fc0cc82d`](https://github.com/block/buzz/commit/7fc0cc82db4d9dced9c258bbe8b530164a832a77)) +- fix(desktop): render rich project work item content ([#3100](https://github.com/block/buzz/pull/3100)) ([`afb272bb7`](https://github.com/block/buzz/commit/afb272bb7b8d7d45d7de676fa97dcd5a8eefacc7)) +- feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery ([#2773](https://github.com/block/buzz/pull/2773)) ([`95fdf9788`](https://github.com/block/buzz/commit/95fdf978800982389b120c66ff5e766d785419c7)) +- feat(desktop): use collective mesh routing for Auto ([#2825](https://github.com/block/buzz/pull/2825)) ([`16d4ec335`](https://github.com/block/buzz/commit/16d4ec335e210295a9d9f77f36c1e85a18b6814a)) +- fix(desktop): strip legacy baked team instructions from stored prompts ([#3035](https://github.com/block/buzz/pull/3035)) ([`aee631448`](https://github.com/block/buzz/commit/aee63144843854ee32ed9d36a2e7511c82ddc6b0)) +- feat(agents): lower default agent parallelism from 24 to 10 ([#3038](https://github.com/block/buzz/pull/3038)) ([`5d8ede446`](https://github.com/block/buzz/commit/5d8ede446f8fdc48146fe56d389cab6bf3500f92)) +- Polish community rail and mobile pairing ([#2972](https://github.com/block/buzz/pull/2972)) ([`e6c90bb7c`](https://github.com/block/buzz/commit/e6c90bb7c430d1b2af16508b634f9a5283b7fa3b)) +- fix(desktop): remove bundled libsystemd from AppImage ([#2353](https://github.com/block/buzz/pull/2353)) ([`a31fc4d2f`](https://github.com/block/buzz/commit/a31fc4d2f35d51cdf45ff8c61fc3a07f49c665e8)) +- fix(desktop): make agent definition authoritative for model/provider/prompt ([#1968](https://github.com/block/buzz/pull/1968)) ([`8c0e8cb16`](https://github.com/block/buzz/commit/8c0e8cb1656b04ad269bce3c2deeda2a943ae78a)) +- chore(desktop): delete dead persona catalog UI cluster ([#2886](https://github.com/block/buzz/pull/2886)) ([`8e67cf399`](https://github.com/block/buzz/commit/8e67cf399d0291bcdbc69cd0402983ca030f05bb)) +- fix(desktop): surface install failures hidden by curl-pipe exit codes ([#2892](https://github.com/block/buzz/pull/2892)) ([`166c6655e`](https://github.com/block/buzz/commit/166c6655e8bca87d83ad60c087fb70a32a026baf)) +- Refactor managed-agent runtime into cohesive modules ([#2974](https://github.com/block/buzz/pull/2974)) ([`74b63e184`](https://github.com/block/buzz/commit/74b63e1846212af6e6751a62cfc631f74b1dfe07)) +- fix(desktop): make Linux AppImage GStreamer work on non-Debian distros ([#2176](https://github.com/block/buzz/pull/2176)) ([`cc6c4d347`](https://github.com/block/buzz/commit/cc6c4d3471629fad018bcf645f9471a01b9ffe2f)) +- refactor(desktop): remove Agent directory section from Agents page ([#2290](https://github.com/block/buzz/pull/2290)) ([`5d1233e84`](https://github.com/block/buzz/commit/5d1233e841b0efa91470bb45467b2c8e4284ebf6)) +- fix(desktop): enable arboard Wayland backend so Linux copies reach the Wayland clipboard ([#2904](https://github.com/block/buzz/pull/2904)) ([`ab7aa8b12`](https://github.com/block/buzz/commit/ab7aa8b1200710dbc2d7a8661ed5aab95c4199c1)) +- fix(desktop): supervise and re-arm relay-mesh runtime ([#2823](https://github.com/block/buzz/pull/2823)) ([`aa51dab9d`](https://github.com/block/buzz/commit/aa51dab9da5fef7054d03cf1a1207986d0000684)) +- fix(agents): run live Databricks discovery instead of the fallback list ([#2890](https://github.com/block/buzz/pull/2890)) ([`8eb6e3eb6`](https://github.com/block/buzz/commit/8eb6e3eb601174249642373a6a367262fa476753)) +- fix(desktop): retire prepend mode on every reader wheel ([#2913](https://github.com/block/buzz/pull/2913)) ([`07d0265cf`](https://github.com/block/buzz/commit/07d0265cfc212ef02e1c26153bf58ff46ce5ffe6)) +- fix(desktop): consolidate prepend scroll correction ([#2855](https://github.com/block/buzz/pull/2855)) ([`25e7864b3`](https://github.com/block/buzz/commit/25e7864b35f4dfd1c0ff31304a38555230a85f8d)) +- fix(desktop): track concurrent agent turns up to the harness maximum ([#2882](https://github.com/block/buzz/pull/2882)) ([`20bff5910`](https://github.com/block/buzz/commit/20bff591023daffc5ee1032cff02b54b75da3567)) +- fix(relay): preserve reconnect backoff ([#2759](https://github.com/block/buzz/pull/2759)) ([`499c5d349`](https://github.com/block/buzz/commit/499c5d349dab13bc906b1af5fe1fcb09ce2afa81)) +- refactor(relay): expose reconnect timing policy ([#2310](https://github.com/block/buzz/pull/2310)) ([`2f0041595`](https://github.com/block/buzz/commit/2f0041595d72529c06885680d2bd07ddb6a0beb4)) +- fix(desktop): clear stale working badges on agent stop/restart ([#2803](https://github.com/block/buzz/pull/2803)) ([`a64cc71f6`](https://github.com/block/buzz/commit/a64cc71f6c1605279b1a6fbd0fe904a2984cbdb0)) +- fix(desktop): surface agent rename relay profile sync failure as a warning toast ([#2279](https://github.com/block/buzz/pull/2279)) ([`5e3d2e484`](https://github.com/block/buzz/commit/5e3d2e4849c0f2512330801d804fb96f4ab72d28)) +- fix(discovery): inject PATH into Codex adapter planning ([#2767](https://github.com/block/buzz/pull/2767)) ([`6ab3835f3`](https://github.com/block/buzz/commit/6ab3835f3fe89ee215819fe8d193463c0ae7472b)) + + ## v0.4.26 - Style mobile pairing QR codes ([#2775](https://github.com/block/buzz/pull/2775)) ([`50655ac09`](https://github.com/block/buzz/commit/50655ac097fbf1a7db1a5284dccc7e2a0b0f1bfc)) diff --git a/desktop/package.json b/desktop/package.json index 6726bfdcad..adac095a47 100644 --- a/desktop/package.json +++ b/desktop/package.json @@ -1,7 +1,7 @@ { "name": "buzz", "private": true, - "version": "0.4.26", + "version": "0.5.0", "type": "module", "scripts": { "dev": "vite", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 074b8f739e..66553ef595 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1010,7 +1010,7 @@ dependencies = [ [[package]] name = "buzz-desktop" -version = "0.4.26" +version = "0.5.0" dependencies = [ "anyhow", "arboard", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index d689544688..324218a49d 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -2,7 +2,7 @@ [package] name = "buzz-desktop" -version = "0.4.26" +version = "0.5.0" description = "Buzz desktop app" authors = ["you"] edition = "2021" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index 07b7216346..7a480c4c18 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Buzz", - "version": "0.4.26", + "version": "0.5.0", "identifier": "xyz.block.buzz.app", "build": { "beforeDevCommand": { From 7dfea2634f7e87f6a42f5fc1f22d9f77c648abfc Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Tue, 28 Jul 2026 16:48:35 +0100 Subject: [PATCH 004/112] Add mobile message image galleries (#3312) ## What - group uploaded photos into full-width message carousels - add a fullscreen viewer with pinch zoom, double-tap reset, swipe-down dismissal, a centered filmstrip, and image actions - preload nearby display-sized images for smoother swiping and keep each upload as its own avatar-backed message ## Validation - `just mobile-check` - `flutter test test/features/channels/message_content_test.dart` - iOS 26.5 simulator gesture pass --------- Signed-off-by: kenny lopez --- .../android/app/src/main/AndroidManifest.xml | 11 +- .../xyz/block/buzz/mobile/MainActivity.kt | 5 + mobile/ios/Podfile.lock | 13 + mobile/ios/Runner/Info.plist | 2 + .../channel_detail_page/message_bubble.dart | 41 +- .../channel_detail_page/message_list.dart | 3 +- .../features/channels/media_viewer_hero.dart | 72 ++ .../features/channels/media_viewer_page.dart | 710 +++++++++++++----- .../media_viewer_page/image_controls.dart | 300 ++++++++ .../media_viewer_page/route_transition.dart | 22 + .../features/channels/message_actions.dart | 237 +++++- .../features/channels/message_content.dart | 82 +- .../message_content/media_carousel.dart | 293 ++++++++ .../features/channels/thread_detail_page.dart | 42 +- .../features/channels/timeline_message.dart | 5 + mobile/lib/shared/relay/media_upload.dart | 13 + mobile/pubspec.lock | 24 + mobile/pubspec.yaml | 2 + .../channels/message_actions_test.dart | 65 ++ .../channels/message_content_test.dart | 305 +++++++- 20 files changed, 2024 insertions(+), 223 deletions(-) create mode 100644 mobile/lib/features/channels/media_viewer_hero.dart create mode 100644 mobile/lib/features/channels/media_viewer_page/image_controls.dart create mode 100644 mobile/lib/features/channels/media_viewer_page/route_transition.dart create mode 100644 mobile/lib/features/channels/message_content/media_carousel.dart diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml index 17a16742af..e1eb3e3456 100644 --- a/mobile/android/app/src/main/AndroidManifest.xml +++ b/mobile/android/app/src/main/AndroidManifest.xml @@ -1,6 +1,15 @@ - + + + { handleTranscodeVideoToMp4(call.arguments, result) } + REQUIRES_LEGACY_MEDIA_STORAGE_PERMISSION_METHOD -> { + result.success(Build.VERSION.SDK_INT <= Build.VERSION_CODES.P) + } else -> result.notImplemented() } } @@ -284,5 +287,7 @@ class MainActivity : FlutterActivity() { private const val SANITIZE_IMAGE_FOR_UPLOAD_METHOD = "sanitizeImageForUpload" private const val TRANSCODE_IMAGE_TO_JPEG_METHOD = "transcodeImageToJpeg" private const val TRANSCODE_VIDEO_TO_MP4_METHOD = "transcodeVideoToMp4" + private const val REQUIRES_LEGACY_MEDIA_STORAGE_PERMISSION_METHOD = + "requiresLegacyMediaStoragePermission" } } diff --git a/mobile/ios/Podfile.lock b/mobile/ios/Podfile.lock index ba8c828d25..c1a2b9e13c 100644 --- a/mobile/ios/Podfile.lock +++ b/mobile/ios/Podfile.lock @@ -22,6 +22,11 @@ PODS: - Flutter - package_info_plus (0.4.5): - Flutter + - photo_manager (3.11.0): + - Flutter + - FlutterMacOS + - share_plus (0.0.1): + - Flutter - shared_preferences_foundation (0.0.1): - Flutter - FlutterMacOS @@ -43,6 +48,8 @@ DEPENDENCIES: - mobile_scanner (from `.symlinks/plugins/mobile_scanner/darwin`) - open_filex (from `.symlinks/plugins/open_filex/ios`) - package_info_plus (from `.symlinks/plugins/package_info_plus/ios`) + - photo_manager (from `.symlinks/plugins/photo_manager/darwin`) + - share_plus (from `.symlinks/plugins/share_plus/ios`) - shared_preferences_foundation (from `.symlinks/plugins/shared_preferences_foundation/darwin`) - url_launcher_ios (from `.symlinks/plugins/url_launcher_ios/ios`) - video_player_avfoundation (from `.symlinks/plugins/video_player_avfoundation/darwin`) @@ -70,6 +77,10 @@ EXTERNAL SOURCES: :path: ".symlinks/plugins/open_filex/ios" package_info_plus: :path: ".symlinks/plugins/package_info_plus/ios" + photo_manager: + :path: ".symlinks/plugins/photo_manager/darwin" + share_plus: + :path: ".symlinks/plugins/share_plus/ios" shared_preferences_foundation: :path: ".symlinks/plugins/shared_preferences_foundation/darwin" url_launcher_ios: @@ -89,6 +100,8 @@ SPEC CHECKSUMS: mobile_scanner: 9157936403f5a0644ca3779a38ff8404c5434a93 open_filex: 432f3cd11432da3e39f47fcc0df2b1603854eff1 package_info_plus: af8e2ca6888548050f16fa2f1938db7b5a5df499 + photo_manager: 6ab48c2ce7ec21aa06d59e6cc049f0b6d9ba7f94 + share_plus: 50da8cb520a8f0f65671c6c6a99b3617ed10a58a shared_preferences_foundation: 7036424c3d8ec98dfe75ff1667cb0cd531ec82bb url_launcher_ios: 7a95fa5b60cc718a708b8f2966718e93db0cef1b video_player_avfoundation: dd410b52df6d2466a42d28550e33e4146928280a diff --git a/mobile/ios/Runner/Info.plist b/mobile/ios/Runner/Info.plist index 70ba34a11f..bf0aca8f57 100644 --- a/mobile/ios/Runner/Info.plist +++ b/mobile/ios/Runner/Info.plist @@ -47,6 +47,8 @@ Buzz needs camera access so you can take photos to attach to messages and scan QR codes for device pairing. NSPhotoLibraryUsageDescription Buzz needs photo library access so you can attach images to messages. + NSPhotoLibraryAddUsageDescription + Buzz needs permission to save images to your photo library. UIApplicationSceneManifest UIApplicationSupportsMultipleScenes diff --git a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart index 453e788271..2a02b51c95 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart @@ -29,6 +29,10 @@ class _MessageBubble extends ConsumerWidget { ref.watch(userCacheProvider.select((cache) => cache[pk])) ?? ref.read(userCacheProvider.notifier).get(pk); final displayName = profile?.label ?? shortPubkey(message.pubkey); + final canManageMessage = + currentPubkey?.toLowerCase() == pk || + (profile?.ownerPubkey != null && + profile?.ownerPubkey == currentPubkey?.toLowerCase()); // Build mention names map from event p-tags. final userCache = ref.watch(userCacheProvider); @@ -55,10 +59,7 @@ class _MessageBubble extends ConsumerWidget { ref: ref, message: message, channelId: currentChannelId, - canManageMessage: - currentPubkey?.toLowerCase() == pk || - (profile?.ownerPubkey != null && - profile?.ownerPubkey == currentPubkey?.toLowerCase()), + canManageMessage: canManageMessage, allMessages: allMessages, currentPubkey: currentPubkey, isMember: isMember, @@ -124,6 +125,38 @@ class _MessageBubble extends ConsumerWidget { baseStyle: context.textTheme.bodyLarge?.copyWith( color: context.colors.onSurface, ), + mediaCarouselTrailingOverflow: Grid.gutter, + onMediaReply: allMessages == null + ? null + : () { + if (!context.mounted) return; + Navigator.of(context).push( + MaterialPageRoute( + builder: (_) => ThreadDetailPage( + threadHead: message, + allMessages: allMessages!, + channelId: currentChannelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + ), + ); + }, + onMediaMore: (viewerContext, imageUrl) => + showImageActions( + context: viewerContext, + ref: ref, + message: message, + channelId: currentChannelId, + imageUrl: imageUrl, + canManageMessage: canManageMessage, + onDeleted: () { + if (viewerContext.mounted) { + Navigator.of(viewerContext).maybePop(); + } + }, + ), onChannelTap: (channelId) { openChannelLink( context: context, diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart index ba5a2e1a71..035cbb3051 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_list.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart @@ -240,7 +240,8 @@ class _MessageList extends HookConsumerWidget { final showAuthor = !message.isSystem && - (prevMessage == null || + (message.hasAttachments || + prevMessage == null || prevMessage.isSystem || showDayDivider || prevMessage.pubkey.toLowerCase() != diff --git a/mobile/lib/features/channels/media_viewer_hero.dart b/mobile/lib/features/channels/media_viewer_hero.dart new file mode 100644 index 0000000000..00be663a6f --- /dev/null +++ b/mobile/lib/features/channels/media_viewer_hero.dart @@ -0,0 +1,72 @@ +import 'package:flutter/material.dart'; + +/// Keeps image-viewer shared-element motion consistent at every source. +class MediaViewerHero extends StatelessWidget { + /// The identity shared by the inline image and full-screen image. + final Object tag; + + /// The image rendered during and after the shared-element transition. + final Widget child; + + /// Creates an image-viewer shared element. + const MediaViewerHero({super.key, required this.tag, required this.child}); + + @override + Widget build(BuildContext context) { + return Hero( + tag: tag, + createRectTween: (begin, end) => RectTween(begin: begin, end: end), + flightShuttleBuilder: + ( + flightContext, + animation, + flightDirection, + fromHeroContext, + toHeroContext, + ) { + final sourceHero = fromHeroContext.widget; + final destinationHero = toHeroContext.widget; + final sourceChild = sourceHero is Hero ? sourceHero.child : child; + final destinationChild = destinationHero is Hero + ? destinationHero.child + : child; + return _MediaViewerHeroFlight( + animation: animation, + sourceChild: sourceChild, + destinationChild: destinationChild, + ); + }, + child: child, + ); + } +} + +class _MediaViewerHeroFlight extends StatelessWidget { + final Animation animation; + final Widget sourceChild; + final Widget destinationChild; + + const _MediaViewerHeroFlight({ + required this.animation, + required this.sourceChild, + required this.destinationChild, + }); + + @override + Widget build(BuildContext context) { + final destinationOpacity = CurvedAnimation( + parent: animation, + curve: const Interval(0.18, 0.82, curve: Curves.easeInOutCubic), + ); + return Stack( + fit: StackFit.expand, + children: [ + FadeTransition( + opacity: ReverseAnimation(destinationOpacity), + child: sourceChild, + ), + FadeTransition(opacity: destinationOpacity, child: destinationChild), + ], + ); + } +} diff --git a/mobile/lib/features/channels/media_viewer_page.dart b/mobile/lib/features/channels/media_viewer_page.dart index 1c4052e1b8..6ea579374f 100644 --- a/mobile/lib/features/channels/media_viewer_page.dart +++ b/mobile/lib/features/channels/media_viewer_page.dart @@ -1,34 +1,105 @@ import 'dart:async'; +import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; +import 'package:flutter/physics.dart'; import 'package:flutter_hooks/flutter_hooks.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import 'package:video_player/video_player.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; +import 'media_viewer_hero.dart'; -const _imageViewerPushDuration = Duration(milliseconds: 280); -const _imageViewerPopDuration = Duration(milliseconds: 220); -const _imageViewerTransitionOffset = Offset(0, 0.08); +export 'media_viewer_hero.dart'; + +part 'media_viewer_page/image_controls.dart'; +part 'media_viewer_page/route_transition.dart'; + +const _imageViewerPushDuration = Duration(milliseconds: 260); +const _imageViewerPopDuration = Duration(milliseconds: 170); const _identityTransformEpsilon = 0.0001; final List _identityTransformStorage = List.unmodifiable( Matrix4.identity().storage, ); +/// Opens message-specific actions for the currently visible image. +typedef MediaViewerMoreAction = + void Function(BuildContext context, String imageUrl); + +/// An image and its source Hero tag in a full-screen media gallery. +@immutable +class MediaViewerImage { + /// The image URL. + final String url; + + /// The shared-element transition tag for the source thumbnail. + final Object heroTag; + + /// The accessible image description. + final String? semanticLabel; + + /// The logical decode width already cached by the source thumbnail. + final double? previewDecodeWidth; + + /// The image's intrinsic width-to-height ratio, when provided by metadata. + final double? aspectRatio; + + /// A display-sized provider that can be warmed before this page is shown. + final ImageProvider? preloadProvider; + + /// Creates a media-viewer image. + const MediaViewerImage({ + required this.url, + required this.heroTag, + this.semanticLabel, + this.previewDecodeWidth, + this.aspectRatio, + this.preloadProvider, + }); +} + PageRoute buildImageViewerRoute({ required String imageUrl, required Object heroTag, String? semanticLabel, + double? previewDecodeWidth, + double? aspectRatio, + List? galleryItems, + int initialIndex = 0, + VoidCallback? onReply, + MediaViewerMoreAction? onMore, + bool disableAnimations = false, }) { + final images = + galleryItems ?? + [ + MediaViewerImage( + url: imageUrl, + heroTag: heroTag, + semanticLabel: semanticLabel, + previewDecodeWidth: previewDecodeWidth, + aspectRatio: aspectRatio, + ), + ]; + final safeInitialIndex = initialIndex.clamp(0, images.length - 1).toInt(); return PageRouteBuilder( - transitionDuration: _imageViewerPushDuration, - reverseTransitionDuration: _imageViewerPopDuration, + transitionDuration: disableAnimations + ? Duration.zero + : _imageViewerPushDuration, + reverseTransitionDuration: disableAnimations + ? Duration.zero + : _imageViewerPopDuration, pageBuilder: (context, animation, secondaryAnimation) => MediaImageViewerPage( imageUrl: imageUrl, heroTag: heroTag, semanticLabel: semanticLabel, + galleryItems: images, + initialIndex: safeInitialIndex, + onReply: onReply, + onMore: onMore, ), transitionsBuilder: (context, animation, secondaryAnimation, child) => _MediaViewerRouteTransition(animation: animation, child: child), @@ -40,12 +111,25 @@ void openImageViewer( required String imageUrl, required Object heroTag, String? semanticLabel, + double? previewDecodeWidth, + double? aspectRatio, + List? galleryItems, + int initialIndex = 0, + VoidCallback? onReply, + MediaViewerMoreAction? onMore, }) { Navigator.of(context).push( buildImageViewerRoute( imageUrl: imageUrl, heroTag: heroTag, semanticLabel: semanticLabel, + previewDecodeWidth: previewDecodeWidth, + aspectRatio: aspectRatio, + galleryItems: galleryItems, + initialIndex: initialIndex, + onReply: onReply, + onMore: onMore, + disableAnimations: MediaQuery.disableAnimationsOf(context), ), ); } @@ -57,8 +141,12 @@ void openVideoViewer( }) { Navigator.of(context).push( PageRouteBuilder( - transitionDuration: _imageViewerPushDuration, - reverseTransitionDuration: _imageViewerPopDuration, + transitionDuration: MediaQuery.disableAnimationsOf(context) + ? Duration.zero + : _imageViewerPushDuration, + reverseTransitionDuration: MediaQuery.disableAnimationsOf(context) + ? Duration.zero + : _imageViewerPopDuration, pageBuilder: (context, animation, secondaryAnimation) => MediaVideoViewerPage(videoUrl: videoUrl, posterUrl: posterUrl), transitionsBuilder: (context, animation, secondaryAnimation, child) => @@ -67,189 +155,345 @@ void openVideoViewer( ); } -class _MediaViewerRouteTransition extends StatelessWidget { - final Animation animation; - final Widget child; - - const _MediaViewerRouteTransition({ - required this.animation, - required this.child, - }); - - @override - Widget build(BuildContext context) { - final fade = CurvedAnimation( - parent: animation, - curve: Curves.easeOut, - reverseCurve: Curves.easeIn, - ); - final slide = CurvedAnimation( - parent: animation, - curve: Curves.easeOutCubic, - reverseCurve: Curves.easeInCubic, - ); - - return FadeTransition( - opacity: fade, - child: SlideTransition( - position: Tween( - begin: _imageViewerTransitionOffset, - end: Offset.zero, - ).animate(slide), - child: child, - ), - ); - } -} - -// StatefulWidget retained: imperative gesture/animation controllers with -// listener lifecycle don't map cleanly to hooks (allowed exception). -class MediaImageViewerPage extends StatefulWidget { +class MediaImageViewerPage extends HookConsumerWidget { final String imageUrl; final Object heroTag; final String? semanticLabel; + final List? galleryItems; + final int initialIndex; + final VoidCallback? onReply; + final MediaViewerMoreAction? onMore; const MediaImageViewerPage({ super.key, required this.imageUrl, required this.heroTag, this.semanticLabel, + this.galleryItems, + this.initialIndex = 0, + this.onReply, + this.onMore, }); - @override - State createState() => _MediaImageViewerPageState(); -} - -class _MediaImageViewerPageState extends State - with SingleTickerProviderStateMixin { - late final TransformationController _transformationController; - late final AnimationController _snapBackController; - bool _isTransformed = false; - bool _disableHeroOnDismiss = false; - double _dragOffset = 0; - bool _isDragging = false; - static const _dismissThreshold = 100.0; + static const _dismissVelocity = 700.0; static const _backgroundFadeDivisor = 300.0; + static const _filmstripScrubExtent = 44.0; @override - void initState() { - super.initState(); - _transformationController = TransformationController(); - _transformationController.addListener(_handleTransformChanged); - _snapBackController = AnimationController( - vsync: this, + Widget build(BuildContext context, WidgetRef ref) { + final images = useMemoized( + () => + galleryItems ?? + [ + MediaViewerImage( + url: imageUrl, + heroTag: heroTag, + semanticLabel: semanticLabel, + ), + ], + [galleryItems, imageUrl, heroTag, semanticLabel], + ); + final safeInitialIndex = initialIndex.clamp(0, images.length - 1).toInt(); + final currentIndex = useState(safeInitialIndex); + final pageController = usePageController(initialPage: safeInitialIndex); + final pagePosition = useState(safeInitialIndex.toDouble()); + final transformationControllers = useMemoized( + () => [ + for (var index = 0; index < images.length; index++) + TransformationController(), + ], + [images], + ); + final snapBackController = useAnimationController( duration: const Duration(milliseconds: 200), ); - } + final zoomResetController = useAnimationController( + duration: const Duration(milliseconds: 180), + ); + final zoomResetListener = useRef(null); + final fullResolutionIndices = useState>({}); + final isTransformed = useState(false); + final disableHeroOnDismiss = useState(false); + final dragOffset = useState(0.0); + final isDragging = useState(false); + + void handlePagePositionChanged() { + if (!pageController.hasClients) return; + final nextPosition = pageController.page; + if (nextPosition == null || + (nextPosition - pagePosition.value).abs() < 0.0001) { + return; + } + pagePosition.value = nextPosition; + } - @override - void dispose() { - _transformationController.removeListener(_handleTransformChanged); - _transformationController.dispose(); - _snapBackController.dispose(); - super.dispose(); - } + void handleTransformChanged(int index) { + if (index != currentIndex.value) return; + final nextIsTransformed = _hasImageTransform( + transformationControllers[index].value, + ); + if (nextIsTransformed == isTransformed.value) { + return; + } - void _handleTransformChanged() { - final isTransformed = _hasImageTransform(_transformationController.value); - if (isTransformed == _isTransformed) { - return; + isTransformed.value = nextIsTransformed; + if (nextIsTransformed && isDragging.value) { + isDragging.value = false; + dragOffset.value = 0; + } } - setState(() { - _isTransformed = isTransformed; - // If the user zooms in while dragging, cancel the drag. - if (_isTransformed && _isDragging) { - _isDragging = false; - _dragOffset = 0; + useEffect(() { + pageController.addListener(handlePagePositionChanged); + return () => pageController.removeListener(handlePagePositionChanged); + }, [pageController]); + + useEffect(() { + final listeners = []; + for (var index = 0; index < transformationControllers.length; index++) { + final controllerIndex = index; + void listener() => handleTransformChanged(controllerIndex); + listeners.add(listener); + transformationControllers[index].addListener(listener); } - }); - } + return () { + for (var index = 0; index < transformationControllers.length; index++) { + transformationControllers[index] + ..removeListener(listeners[index]) + ..dispose(); + } + }; + }, [transformationControllers]); + + useEffect(() { + var cancelled = false; + WidgetsBinding.instance.addPostFrameCallback((_) { + if (!cancelled && context.mounted) { + _precacheViewerImages(context, images, currentIndex.value); + } + }); + return () => cancelled = true; + }, [images]); + + useEffect(() { + return () { + final listener = zoomResetListener.value; + if (listener != null) { + zoomResetController.removeListener(listener); + } + }; + }, [zoomResetController]); + + void onPageChanged(int index) { + _precacheViewerImages(context, images, index); + currentIndex.value = index; + isTransformed.value = _hasImageTransform( + transformationControllers[index].value, + ); + disableHeroOnDismiss.value = index != safeInitialIndex; + dragOffset.value = 0; + isDragging.value = false; + } - void _onInteractionStart(ScaleStartDetails details) { - if (!_isTransformed && details.pointerCount == 1) { - _isDragging = true; + void onFilmstripScrubUpdate(double delta) { + if (isTransformed.value || !pageController.hasClients) return; + final position = pageController.position; + final viewport = position.viewportDimension; + if (viewport <= 0) return; + final target = + (pageController.offset - ((delta / _filmstripScrubExtent) * viewport)) + .clamp(position.minScrollExtent, position.maxScrollExtent) + .toDouble(); + pageController.jumpTo(target); } - } - void _onInteractionUpdate(ScaleUpdateDetails details) { - if (_isDragging && !_isTransformed) { - setState(() { - _dragOffset += details.focalPointDelta.dy; - }); + void onFilmstripScrubEnd() { + if (!pageController.hasClients) return; + final targetPage = (pageController.page ?? currentIndex.value.toDouble()) + .round() + .clamp(0, images.length - 1); + if (MediaQuery.disableAnimationsOf(context)) { + pageController.jumpToPage(targetPage); + return; + } + pageController.animateToPage( + targetPage, + duration: const Duration(milliseconds: 180), + curve: Curves.easeOutCubic, + ); } - } - void _onInteractionEnd(ScaleEndDetails details) { - if (!_isDragging) return; - _isDragging = false; + void upgradeToFullResolution(int index) { + if (images[index].previewDecodeWidth == null || + fullResolutionIndices.value.contains(index)) { + return; + } + fullResolutionIndices.value = {...fullResolutionIndices.value, index}; + } - if (_dragOffset.abs() > _dismissThreshold) { - _dismiss(); - } else { - _animateSnapBack(); + void onImageInteractionStart(int index, ScaleStartDetails details) { + if (details.pointerCount > 1) { + upgradeToFullResolution(index); + } + if (details.pointerCount == 1 && !isTransformed.value) { + isDragging.value = true; + } } - } - void _animateSnapBack() { - final startOffset = _dragOffset; - final tween = Tween(begin: startOffset, end: 0); - final curved = CurvedAnimation( - parent: _snapBackController, - curve: Curves.easeOut, - ); + void onImageInteractionUpdate(int index, ScaleUpdateDetails details) { + if (details.pointerCount > 1 || details.scale != 1) { + final needsFullResolution = + images[index].previewDecodeWidth != null && + !fullResolutionIndices.value.contains(index); + if (isDragging.value || needsFullResolution) { + if (needsFullResolution) { + fullResolutionIndices.value = { + ...fullResolutionIndices.value, + index, + }; + } + isDragging.value = false; + dragOffset.value = 0; + } + return; + } - void listener() { - setState(() { - _dragOffset = tween.evaluate(curved); - }); + if (!isDragging.value || isTransformed.value) return; + dragOffset.value = (dragOffset.value + details.focalPointDelta.dy).clamp( + 0.0, + MediaQuery.sizeOf(context).height, + ); } - _snapBackController - ..reset() - ..addListener(listener); - _snapBackController.forward().whenCompleteOrCancel(() { - _snapBackController.removeListener(listener); - }); - } + void resetImageTransform(int index) { + final controller = transformationControllers[index]; + if (!_hasImageTransform(controller.value)) { + return; + } + + final previousListener = zoomResetListener.value; + if (previousListener != null) { + zoomResetController.removeListener(previousListener); + } + zoomResetController.stop(); - bool get _canDismissWithHero => !_isTransformed || _disableHeroOnDismiss; + if (MediaQuery.disableAnimationsOf(context)) { + controller.value = Matrix4.identity(); + zoomResetListener.value = null; + return; + } - Future _prepareHeroFallbackDismiss() async { - if (_canDismissWithHero) { - return; + final animation = + Matrix4Tween( + begin: Matrix4.copy(controller.value), + end: Matrix4.identity(), + ).animate( + CurvedAnimation( + parent: zoomResetController, + curve: Curves.easeOutCubic, + ), + ); + void listener() => controller.value = animation.value; + zoomResetListener.value = listener; + zoomResetController + ..reset() + ..addListener(listener) + ..forward(); } - setState(() { - _disableHeroOnDismiss = true; - }); + bool canDismissWithHero() => + !isTransformed.value || disableHeroOnDismiss.value; - await WidgetsBinding.instance.endOfFrame; - } + Future prepareHeroFallbackDismiss() async { + if (canDismissWithHero()) { + return; + } + disableHeroOnDismiss.value = true; + await WidgetsBinding.instance.endOfFrame; + } - Future _dismiss() async { - await _prepareHeroFallbackDismiss(); - if (!mounted) { - return; + Future dismiss() async { + await prepareHeroFallbackDismiss(); + if (!context.mounted) { + return; + } + Navigator.of(context).maybePop(); } - Navigator.of(context).maybePop(); - } - @override - Widget build(BuildContext context) { + void animateSnapBack() { + final tween = Tween(begin: dragOffset.value, end: 0); + + void listener() { + dragOffset.value = tween.evaluate(snapBackController); + } + + snapBackController + ..stop() + ..reset() + ..addListener(listener); + snapBackController + .animateWith( + SpringSimulation( + SpringDescription.withDurationAndBounce( + duration: const Duration(milliseconds: 260), + bounce: 0.14, + ), + 0, + 1, + 0, + snapToEnd: true, + ), + ) + .whenCompleteOrCancel(() { + snapBackController.removeListener(listener); + }); + } + + void finishVerticalDismiss(double velocity) { + isDragging.value = false; + if (dragOffset.value > _dismissThreshold || velocity > _dismissVelocity) { + unawaited(dismiss()); + } else { + animateSnapBack(); + } + } + + void onImageInteractionEnd(ScaleEndDetails details) { + if (!isDragging.value) return; + finishVerticalDismiss(details.velocity.pixelsPerSecond.dy); + } + + Future replyInThread() async { + final callback = onReply; + if (callback == null) return; + final route = ModalRoute.of(context); + await dismiss(); + await route?.completed; + callback(); + } + + void showMoreActions() { + onMore?.call(context, images[currentIndex.value].url); + } + + final viewportHeight = MediaQuery.sizeOf(context).height; + final dragProgress = (dragOffset.value / viewportHeight).clamp(0.0, 1.0); + final imageScale = 1 - (dragProgress * 0.1); + final chromeOpacity = (1 - (dragOffset.value / 160)).clamp(0.0, 1.0); + return PopScope( - canPop: _canDismissWithHero, + canPop: canDismissWithHero(), onPopInvokedWithResult: (didPop, result) { if (didPop) { return; } - unawaited(_dismiss()); + unawaited(dismiss()); }, child: Scaffold( key: const ValueKey('message-media-image-viewer'), backgroundColor: Colors.black.withValues( - alpha: (1 - (_dragOffset.abs() / _backgroundFadeDivisor)).clamp( + alpha: (1 - (dragOffset.value.abs() / _backgroundFadeDivisor)).clamp( 0.3, 1.0, ), @@ -258,52 +502,146 @@ class _MediaImageViewerPageState extends State children: [ Positioned.fill( child: Transform.translate( - offset: Offset(0, _dragOffset), - child: InteractiveViewer( - transformationController: _transformationController, - onInteractionStart: _onInteractionStart, - onInteractionUpdate: _onInteractionUpdate, - onInteractionEnd: _onInteractionEnd, - minScale: 1, - maxScale: 4, - child: Center( - child: HeroMode( - key: const ValueKey( - 'message-media-image-viewer-hero-mode', - ), - enabled: !_disableHeroOnDismiss, - child: Hero( - tag: widget.heroTag, - child: MediaImage( - url: widget.imageUrl, - boundDecodeToLayout: false, - fit: BoxFit.contain, - semanticLabel: widget.semanticLabel, - errorBuilder: (_, _, _) => const _MediaLoadFailure( - message: 'Failed to load image', - icon: LucideIcons.imageOff, - ), + offset: Offset(0, dragOffset.value), + child: Transform.scale( + scale: imageScale, + child: PageView.builder( + key: const ValueKey('message-media-image-viewer-pages'), + controller: pageController, + physics: isTransformed.value + ? const NeverScrollableScrollPhysics() + : const PageScrollPhysics(), + itemCount: images.length, + onPageChanged: onPageChanged, + itemBuilder: (context, index) { + final image = images[index]; + final viewPadding = MediaQuery.viewPaddingOf(context); + return Padding( + padding: EdgeInsets.only( + top: viewPadding.top + 48 + Grid.xxs, + bottom: viewPadding.bottom + 56 + (Grid.xxs * 2), + ), + child: LayoutBuilder( + builder: (context, constraints) { + final viewerSize = _imageViewerSize( + Size(constraints.maxWidth, constraints.maxHeight), + image.aspectRatio, + ); + return GestureDetector( + key: ValueKey( + 'message-media-image-viewer-gesture:$index', + ), + behavior: HitTestBehavior.opaque, + onDoubleTap: () => resetImageTransform(index), + child: InteractiveViewer( + transformationController: + transformationControllers[index], + onInteractionStart: (details) => + onImageInteractionStart(index, details), + onInteractionUpdate: (details) => + onImageInteractionUpdate(index, details), + onInteractionEnd: onImageInteractionEnd, + panEnabled: isTransformed.value, + scaleEnabled: true, + minScale: 1, + maxScale: 4, + boundaryMargin: const EdgeInsets.all(Grid.xxl), + clipBehavior: Clip.none, + child: Align( + alignment: Alignment.center, + child: SizedBox( + width: viewerSize.width, + height: viewerSize.height, + child: HeroMode( + key: index == safeInitialIndex + ? const ValueKey( + 'message-media-image-viewer-hero-mode', + ) + : ValueKey( + 'message-media-image-viewer-hero-mode-$index', + ), + enabled: + !disableHeroOnDismiss.value && + index == safeInitialIndex, + child: MediaViewerHero( + tag: image.heroTag, + child: MediaImage( + key: ValueKey( + 'message-media-image-viewer-image:$index', + ), + url: image.url, + decodeWidth: + fullResolutionIndices.value + .contains(index) + ? null + : image.previewDecodeWidth, + boundDecodeToLayout: false, + fit: BoxFit.contain, + semanticLabel: image.semanticLabel, + errorBuilder: (_, _, _) => + const _MediaLoadFailure( + message: 'Failed to load image', + icon: LucideIcons.imageOff, + ), + ), + ), + ), + ), + ), + ), + ); + }, ), - ), - ), + ); + }, ), ), ), ), PositionedDirectional( - top: Grid.sm, - end: Grid.sm, - child: SafeArea( - child: DecoratedBox( - decoration: const BoxDecoration( - color: Color.fromRGBO(0, 0, 0, 0.56), - shape: BoxShape.circle, + bottom: 0, + start: 0, + end: 0, + child: Opacity( + opacity: chromeOpacity, + child: SafeArea( + child: _MediaViewerBottomControls( + images: images, + currentIndex: currentIndex.value, + pagePosition: pagePosition, + onScrubUpdate: onFilmstripScrubUpdate, + onScrubEnd: onFilmstripScrubEnd, + onSelect: (index) { + if (index == currentIndex.value) return; + if (MediaQuery.disableAnimationsOf(context)) { + pageController.jumpToPage(index); + return; + } + pageController.animateToPage( + index, + duration: const Duration(milliseconds: 220), + curve: Curves.easeOutCubic, + ); + }, + onReply: onReply == null + ? null + : () => unawaited(replyInThread()), + onMore: onMore == null ? null : showMoreActions, ), - child: IconButton( + ), + ), + ), + PositionedDirectional( + top: 0, + end: Grid.sm, + child: Opacity( + opacity: chromeOpacity, + child: SafeArea( + child: _MediaViewerCircleButton( key: const ValueKey('message-media-image-viewer-close'), - onPressed: _dismiss, + icon: LucideIcons.x, tooltip: 'Close image viewer', - icon: const Icon(LucideIcons.x, color: Colors.white), + onPressed: () => unawaited(dismiss()), ), ), ), @@ -315,17 +653,6 @@ class _MediaImageViewerPageState extends State } } -bool _hasImageTransform(Matrix4 transform) { - final storage = transform.storage; - for (var index = 0; index < storage.length; index++) { - if ((storage[index] - _identityTransformStorage[index]).abs() > - _identityTransformEpsilon) { - return true; - } - } - return false; -} - // StatefulWidget retained: owns a VideoPlayerController with async init and // disposal — kept imperative deliberately (allowed exception). class MediaVideoViewerPage extends StatefulWidget { @@ -462,7 +789,12 @@ class _VideoLoadingPoster extends StatelessWidget { else _videoPlaceholder(context), const ColoredBox(color: Color.fromRGBO(0, 0, 0, 0.24)), - const Center(child: CircularProgressIndicator()), + const Center( + child: CircularProgressIndicator( + strokeWidth: 3, + color: Colors.white, + ), + ), ], ), ); diff --git a/mobile/lib/features/channels/media_viewer_page/image_controls.dart b/mobile/lib/features/channels/media_viewer_page/image_controls.dart new file mode 100644 index 0000000000..7736167611 --- /dev/null +++ b/mobile/lib/features/channels/media_viewer_page/image_controls.dart @@ -0,0 +1,300 @@ +part of '../media_viewer_page.dart'; + +class _MediaViewerBottomControls extends StatelessWidget { + final List images; + final int currentIndex; + final ValueListenable pagePosition; + final ValueChanged onScrubUpdate; + final VoidCallback onScrubEnd; + final ValueChanged onSelect; + final VoidCallback? onReply; + final VoidCallback? onMore; + + const _MediaViewerBottomControls({ + required this.images, + required this.currentIndex, + required this.pagePosition, + required this.onScrubUpdate, + required this.onScrubEnd, + required this.onSelect, + required this.onReply, + required this.onMore, + }); + + @override + Widget build(BuildContext context) { + return Padding( + padding: const EdgeInsets.fromLTRB(Grid.sm, Grid.xxs, Grid.sm, 0), + child: Row( + crossAxisAlignment: CrossAxisAlignment.center, + children: [ + _MediaViewerCircleButton( + key: const ValueKey('message-media-image-viewer-reply-thread'), + icon: LucideIcons.messageSquareReply, + tooltip: 'Reply in thread', + onPressed: onReply, + ), + const SizedBox(width: Grid.xxs), + Expanded( + child: images.length > 1 + ? _MediaViewerFilmstrip( + key: const ValueKey('message-media-image-viewer-filmstrip'), + images: images, + currentIndex: currentIndex, + pagePosition: pagePosition, + onScrubUpdate: onScrubUpdate, + onScrubEnd: onScrubEnd, + onSelect: onSelect, + ) + : const SizedBox(height: 56), + ), + const SizedBox(width: Grid.xxs), + _MediaViewerCircleButton( + key: const ValueKey('message-media-image-viewer-more-actions'), + icon: LucideIcons.ellipsis, + tooltip: 'More image actions', + onPressed: onMore, + ), + ], + ), + ); + } +} + +class _MediaViewerFilmstrip extends StatelessWidget { + final List images; + final int currentIndex; + final ValueListenable pagePosition; + final ValueChanged onScrubUpdate; + final VoidCallback onScrubEnd; + final ValueChanged onSelect; + + const _MediaViewerFilmstrip({ + super.key, + required this.images, + required this.currentIndex, + required this.pagePosition, + required this.onScrubUpdate, + required this.onScrubEnd, + required this.onSelect, + }); + + @override + Widget build(BuildContext context) { + return SizedBox( + height: 56, + child: RepaintBoundary( + child: GestureDetector( + behavior: HitTestBehavior.opaque, + onHorizontalDragUpdate: (details) => + onScrubUpdate(details.primaryDelta ?? 0), + onHorizontalDragEnd: (_) => onScrubEnd(), + child: ValueListenableBuilder( + valueListenable: pagePosition, + builder: (context, position, _) { + return LayoutBuilder( + builder: (context, constraints) { + const compactWidth = 40.0; + const focusedWidth = 72.0; + const itemHeight = 52.0; + const spacing = Grid.half; + final clampedPosition = position + .clamp(0.0, images.length - 1.0) + .toDouble(); + final widths = []; + final proximities = []; + final centers = []; + var cursor = 0.0; + + for (var index = 0; index < images.length; index++) { + final proximity = (1 - (index - clampedPosition).abs()) + .clamp(0.0, 1.0) + .toDouble(); + final width = + compactWidth + + ((focusedWidth - compactWidth) * proximity); + widths.add(width); + proximities.add(proximity); + centers.add(cursor + (width / 2)); + cursor += width + spacing; + } + + final lowerIndex = clampedPosition.floor(); + final upperIndex = clampedPosition.ceil(); + final fraction = clampedPosition - lowerIndex; + final lowerCenter = centers[lowerIndex]; + final upperCenter = centers[upperIndex]; + final focusCenter = + lowerCenter + ((upperCenter - lowerCenter) * fraction); + final viewportCenter = constraints.maxWidth / 2; + + return Stack( + clipBehavior: Clip.hardEdge, + children: [ + for (var index = 0; index < images.length; index++) + Positioned( + left: + viewportCenter + + centers[index] - + focusCenter - + (widths[index] / 2), + top: Grid.quarter, + width: widths[index], + height: itemHeight, + child: _MediaViewerFilmstripImage( + image: images[index], + index: index, + proximity: proximities[index], + selected: index == currentIndex, + onSelect: onSelect, + ), + ), + ], + ); + }, + ); + }, + ), + ), + ), + ); + } +} + +class _MediaViewerFilmstripImage extends StatelessWidget { + final MediaViewerImage image; + final int index; + final double proximity; + final bool selected; + final ValueChanged onSelect; + + const _MediaViewerFilmstripImage({ + required this.image, + required this.index, + required this.proximity, + required this.selected, + required this.onSelect, + }); + + @override + Widget build(BuildContext context) { + final borderWidth = 1 + (1.5 * proximity); + return Semantics( + button: true, + selected: selected, + label: selected + ? 'Image ${index + 1}, selected' + : 'Show image ${index + 1}', + child: GestureDetector( + key: ValueKey('message-media-image-viewer-thumbnail:$index'), + onTap: () => onSelect(index), + child: Container( + height: 52, + padding: EdgeInsets.all(borderWidth), + decoration: BoxDecoration( + borderRadius: BorderRadius.circular(Radii.sm), + border: Border.all( + color: Colors.white.withValues(alpha: 0.28 + (0.72 * proximity)), + width: borderWidth, + ), + ), + child: ClipRRect( + key: ValueKey('message-media-image-viewer-thumbnail-clip:$index'), + borderRadius: BorderRadius.circular(Radii.sm - borderWidth), + clipBehavior: Clip.antiAlias, + child: Opacity( + opacity: 0.62 + (0.38 * proximity), + child: MediaImage( + url: image.url, + decodeWidth: 72, + fit: BoxFit.cover, + semanticLabel: image.semanticLabel, + errorBuilder: (_, _, _) => const ColoredBox( + color: Color.fromRGBO(255, 255, 255, 0.12), + child: Icon( + LucideIcons.imageOff, + color: Colors.white70, + size: 18, + ), + ), + ), + ), + ), + ), + ), + ); + } +} + +class _MediaViewerCircleButton extends StatelessWidget { + final IconData icon; + final String tooltip; + final VoidCallback? onPressed; + + const _MediaViewerCircleButton({ + super.key, + required this.icon, + required this.tooltip, + required this.onPressed, + }); + + @override + Widget build(BuildContext context) { + return SizedBox.square( + dimension: 48, + child: onPressed == null + ? const SizedBox.shrink() + : DecoratedBox( + decoration: BoxDecoration( + color: Colors.white.withValues(alpha: 0.16), + shape: BoxShape.circle, + ), + child: IconButton( + onPressed: onPressed, + tooltip: tooltip, + icon: Icon(icon, color: Colors.white, size: 20), + ), + ), + ); + } +} + +Size _imageViewerSize(Size viewport, double? aspectRatio) { + if (aspectRatio == null || aspectRatio <= 0) { + return viewport; + } + + final safeAspectRatio = aspectRatio.clamp(0.05, 20.0).toDouble(); + if (viewport.aspectRatio > safeAspectRatio) { + return Size(viewport.height * safeAspectRatio, viewport.height); + } + return Size(viewport.width, viewport.width / safeAspectRatio); +} + +void _precacheViewerImages( + BuildContext context, + List images, + int focusedIndex, +) { + for (var index = focusedIndex - 2; index <= focusedIndex + 2; index++) { + if (index < 0 || index >= images.length) { + continue; + } + final provider = images[index].preloadProvider; + if (provider == null) { + continue; + } + unawaited(precacheImage(provider, context, onError: (_, _) {})); + } +} + +bool _hasImageTransform(Matrix4 transform) { + final storage = transform.storage; + for (var index = 0; index < storage.length; index++) { + if ((storage[index] - _identityTransformStorage[index]).abs() > + _identityTransformEpsilon) { + return true; + } + } + return false; +} diff --git a/mobile/lib/features/channels/media_viewer_page/route_transition.dart b/mobile/lib/features/channels/media_viewer_page/route_transition.dart new file mode 100644 index 0000000000..5ebed62a95 --- /dev/null +++ b/mobile/lib/features/channels/media_viewer_page/route_transition.dart @@ -0,0 +1,22 @@ +part of '../media_viewer_page.dart'; + +class _MediaViewerRouteTransition extends StatelessWidget { + final Animation animation; + final Widget child; + + const _MediaViewerRouteTransition({ + required this.animation, + required this.child, + }); + + @override + Widget build(BuildContext context) { + final fade = CurvedAnimation( + parent: animation, + curve: Curves.easeOutCubic, + reverseCurve: Curves.easeInOutCubic, + ); + + return FadeTransition(opacity: fade, child: child); + } +} diff --git a/mobile/lib/features/channels/message_actions.dart b/mobile/lib/features/channels/message_actions.dart index 6cbcd843a6..c4cc5e2a0e 100644 --- a/mobile/lib/features/channels/message_actions.dart +++ b/mobile/lib/features/channels/message_actions.dart @@ -1,10 +1,18 @@ +import 'dart:async'; +import 'dart:io'; + +import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; import 'package:flutter/services.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; +import 'package:path_provider/path_provider.dart'; +import 'package:photo_manager/photo_manager.dart'; +import 'package:share_plus/share_plus.dart'; import '../../shared/clipboard_utils.dart'; import '../../shared/deeplink/deep_link.dart'; +import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/custom_emoji/custom_emoji.dart'; import '../../shared/custom_emoji/custom_emoji_provider.dart'; @@ -167,6 +175,214 @@ void showMessageActions({ ); } +/// Image-focused actions shown from the full-screen viewer. +void showImageActions({ + required BuildContext context, + required WidgetRef ref, + required TimelineMessage message, + required String channelId, + required String imageUrl, + required bool canManageMessage, + VoidCallback? onDeleted, +}) { + showModalBottomSheet( + context: context, + showDragHandle: true, + builder: (sheetContext) => SafeArea( + child: Padding( + padding: const EdgeInsets.fromLTRB( + Grid.gutter, + 0, + Grid.gutter, + Grid.xs, + ), + child: Column( + mainAxisSize: MainAxisSize.min, + children: [ + ListTile( + leading: const Icon(LucideIcons.download), + title: const Text('Save image'), + onTap: () { + Navigator.of(sheetContext).pop(); + unawaited(_saveImage(context, ref, imageUrl)); + }, + ), + ListTile( + leading: const Icon(LucideIcons.share2), + title: const Text('Share image'), + onTap: () { + final renderBox = context.findRenderObject() as RenderBox?; + final shareOrigin = renderBox == null + ? null + : renderBox.localToGlobal(Offset.zero) & renderBox.size; + Navigator.of(sheetContext).pop(); + unawaited( + _shareImage(context, ref, imageUrl, shareOrigin: shareOrigin), + ); + }, + ), + ListTile( + leading: const Icon(LucideIcons.link2), + title: const Text('Copy image link'), + onTap: () { + Navigator.of(sheetContext).pop(); + copyToClipboard( + context, + imageUrl, + message: 'Image link copied', + ); + }, + ), + if (canManageMessage) ...[ + const SheetDivider(), + ListTile( + leading: Icon( + LucideIcons.trash2, + color: sheetContext.colors.error, + ), + title: Text( + 'Delete message', + style: TextStyle(color: sheetContext.colors.error), + ), + onTap: () { + Navigator.of(sheetContext).pop(); + _confirmDelete( + context: context, + ref: ref, + channelId: channelId, + messageId: message.id, + onDeleted: onDeleted, + ); + }, + ), + ], + ], + ), + ), + ), + ); +} + +@immutable +class _DownloadedImage { + final Uint8List bytes; + final String filename; + + const _DownloadedImage({required this.bytes, required this.filename}); +} + +Future<_DownloadedImage> _downloadImage(WidgetRef ref, String imageUrl) async { + final response = await ref + .read(mediaHttpClientProvider) + .get( + Uri.parse(imageUrl), + headers: ref.read(mediaGetAuthServiceProvider).headersFor(imageUrl), + ); + if (response.statusCode < 200 || response.statusCode >= 300) { + throw HttpException( + 'Image download failed (${response.statusCode})', + uri: Uri.parse(imageUrl), + ); + } + return _DownloadedImage( + bytes: response.bodyBytes, + filename: downloadedImageFilename( + imageUrl, + response.headers['content-type'], + ), + ); +} + +/// Returns a safe image filename while preserving supported image formats. +@visibleForTesting +String downloadedImageFilename(String imageUrl, String? contentType) { + final pathSegments = Uri.tryParse(imageUrl)?.pathSegments; + final rawName = pathSegments == null || pathSegments.isEmpty + ? '' + : pathSegments.last; + final safeName = rawName + .replaceAll(RegExp(r'[^A-Za-z0-9._-]'), '-') + .replaceAll(RegExp(r'-+'), '-'); + if (RegExp( + r'\.(avif|bmp|gif|heic|heif|jpe?g|png|webp)$', + caseSensitive: false, + ).hasMatch(safeName)) { + return safeName; + } + final extension = switch (contentType?.split(';').first.trim()) { + 'image/avif' => '.avif', + 'image/gif' => '.gif', + 'image/heic' => '.heic', + 'image/heif' => '.heif', + 'image/png' => '.png', + 'image/webp' => '.webp', + _ => '.jpg', + }; + return 'buzz-${DateTime.now().millisecondsSinceEpoch}$extension'; +} + +Future _saveImage( + BuildContext context, + WidgetRef ref, + String imageUrl, +) async { + final messenger = ScaffoldMessenger.maybeOf(context); + try { + final needsPhotoLibraryPermission = + defaultTargetPlatform == TargetPlatform.iOS || + await requiresLegacyMediaStoragePermission(); + if (needsPhotoLibraryPermission) { + final permission = await PhotoManager.requestPermissionExtend( + requestOption: const PermissionRequestOption( + iosAccessLevel: IosAccessLevel.addOnly, + androidPermission: AndroidPermission( + type: RequestType.image, + mediaLocation: false, + ), + ), + ); + if (!permission.isAuth) { + throw const FileSystemException( + 'Photo library permission was not granted.', + ); + } + } + final image = await _downloadImage(ref, imageUrl); + await PhotoManager.editor.saveImage(image.bytes, filename: image.filename); + messenger?.showSnackBar( + const SnackBar(content: Text('Image saved to Photos')), + ); + } catch (_) { + messenger?.showSnackBar( + const SnackBar(content: Text('Could not save image')), + ); + } +} + +Future _shareImage( + BuildContext context, + WidgetRef ref, + String imageUrl, { + Rect? shareOrigin, +}) async { + final messenger = ScaffoldMessenger.maybeOf(context); + try { + final image = await _downloadImage(ref, imageUrl); + final directory = await getTemporaryDirectory(); + final file = File( + '${directory.path}${Platform.pathSeparator}${image.filename}', + ); + await file.writeAsBytes(image.bytes, flush: true); + await SharePlus.instance.share( + ShareParams(files: [XFile(file.path)], sharePositionOrigin: shareOrigin), + ); + } catch (_) { + messenger?.showSnackBar( + const SnackBar(content: Text('Could not share image')), + ); + } +} + /// Canonical `buzz://message` link for a timeline message, including thread /// context when the message is a reply. String messageLinkFor({ @@ -496,6 +712,7 @@ void _confirmDelete({ required WidgetRef ref, required String channelId, required String messageId, + VoidCallback? onDeleted, }) { showDialog( context: context, @@ -508,17 +725,19 @@ void _confirmDelete({ child: const Text('Cancel'), ), FilledButton( - onPressed: () { + onPressed: () async { Navigator.of(dialogContext).pop(); final messenger = ScaffoldMessenger.of(context); - ref - .read(channelActionsProvider) - .deleteMessage(channelId: channelId, eventId: messageId) - .catchError((Object error) { - messenger.showSnackBar( - SnackBar(content: Text('Failed to delete message: $error')), - ); - }); + try { + await ref + .read(channelActionsProvider) + .deleteMessage(channelId: channelId, eventId: messageId); + onDeleted?.call(); + } catch (error) { + messenger.showSnackBar( + SnackBar(content: Text('Failed to delete message: $error')), + ); + } }, style: FilledButton.styleFrom( backgroundColor: dialogContext.colors.error, diff --git a/mobile/lib/features/channels/message_content.dart b/mobile/lib/features/channels/message_content.dart index cb1af75c68..664594ade7 100644 --- a/mobile/lib/features/channels/message_content.dart +++ b/mobile/lib/features/channels/message_content.dart @@ -1,3 +1,4 @@ +import 'dart:async'; import 'dart:io'; import 'dart:math' as math; @@ -21,6 +22,8 @@ import '../../shared/custom_emoji/custom_emoji_render.dart'; import 'media_viewer_page.dart'; import 'message_media.dart'; +part 'message_content/media_carousel.dart'; + const _messageMediaMaxInlineWidth = 320.0; const _messageMediaMaxImageHeight = 240.0; @@ -92,10 +95,25 @@ class MessageContent extends HookConsumerWidget { /// mentioned user's pubkey. final void Function(String pubkey)? onMentionTap; + /// Opens the message's thread from the full-screen image viewer. + final VoidCallback? onMediaReply; + + /// Opens message-specific actions for an image in the full-screen viewer. + final MediaViewerMoreAction? onMediaMore; + final TextStyle? baseStyle; final int? maxLines; + /// Allows a multi-image carousel to reclaim leading space reserved by the + /// surrounding message layout, while keeping its image count aligned with + /// the message body. + final double mediaCarouselLeadingOverflow; + + /// Allows a multi-image carousel to continue through the trailing page + /// gutter while keeping its first image and count aligned with the body. + final double mediaCarouselTrailingOverflow; + const MessageContent({ super.key, required this.content, @@ -105,8 +123,12 @@ class MessageContent extends HookConsumerWidget { this.tags = const [], this.onChannelTap, this.onMentionTap, + this.onMediaReply, + this.onMediaMore, this.baseStyle, this.maxLines, + this.mediaCarouselLeadingOverflow = 0, + this.mediaCarouselTrailingOverflow = 0, }); @override @@ -115,6 +137,10 @@ class MessageContent extends HookConsumerWidget { baseStyle ?? context.textTheme.bodyMedium?.copyWith(color: context.colors.onSurface); final imetaByUrl = parseImetaTags(tags); + final trailingGallery = maxLines == null + ? _extractTrailingImageGallery(content, imetaByUrl) + : null; + final markdownContent = trailingGallery?.content ?? content; final customEmoji = _mergeCustomEmoji( customEmojiFromTags(tags), ref.watch(customEmojiListProvider), @@ -124,7 +150,7 @@ class MessageContent extends HookConsumerWidget { // Convert autolinks and bare URLs to standard markdown links, // but skip content inside backticks (inline code / fenced blocks). final buffer = StringBuffer(); - final parts = content.split('`'); + final parts = markdownContent.split('`'); for (var i = 0; i < parts.length; i++) { if (i.isOdd) { // Inside backticks — preserve as-is. @@ -186,9 +212,9 @@ class MessageContent extends HookConsumerWidget { result = '\u200B$result'; } return result; - }, [content, mentionNames]); + }, [markdownContent, mentionNames]); - return GptMarkdown( + final markdown = GptMarkdown( finalContent, style: style, followLinkColor: false, @@ -210,6 +236,25 @@ class MessageContent extends HookConsumerWidget { ...MarkdownComponent.inlineComponents, ], ); + if (trailingGallery == null) return markdown; + + return Column( + crossAxisAlignment: CrossAxisAlignment.start, + mainAxisSize: MainAxisSize.min, + children: [ + if (trailingGallery.content.trim().isNotEmpty) markdown, + _MessageImageCarousel( + key: ValueKey( + trailingGallery.items.map((item) => item.url).join('\u0000'), + ), + items: trailingGallery.items, + leadingOverflow: mediaCarouselLeadingOverflow, + trailingOverflow: mediaCarouselTrailingOverflow, + onReply: onMediaReply, + onMore: onMediaMore, + ), + ], + ); } Widget _buildMedia(BuildContext context, String imageUrl, ImetaEntry? imeta) { @@ -221,6 +266,8 @@ class MessageContent extends HookConsumerWidget { url: imageUrl, imeta: imeta, semanticLabel: imeta?.alt ?? 'Message image', + onReply: onMediaReply, + onMore: onMediaMore, ); } @@ -298,17 +345,22 @@ class _MessageImagePreview extends HookConsumerWidget { final String url; final ImetaEntry? imeta; final String semanticLabel; + final VoidCallback? onReply; + final MediaViewerMoreAction? onMore; const _MessageImagePreview({ required this.url, required this.imeta, required this.semanticLabel, + required this.onReply, + required this.onMore, }); @override Widget build(BuildContext context, WidgetRef ref) { final heroTag = useMemoized(() => Object()); final layout = _resolveImagePreviewLayout(context, imeta?.aspectRatio); + final previewDecodeWidth = layout.width ?? _messageMediaMaxWidth(context); return Padding( padding: const EdgeInsets.only(top: Grid.half), @@ -318,6 +370,10 @@ class _MessageImagePreview extends HookConsumerWidget { imageUrl: url, heroTag: heroTag, semanticLabel: semanticLabel, + previewDecodeWidth: previewDecodeWidth, + aspectRatio: imeta?.aspectRatio, + onReply: onReply, + onMore: onMore, ), child: _MessageMediaPreviewFrame( previewKey: ValueKey('message-media-image-preview:$url'), @@ -325,15 +381,19 @@ class _MessageImagePreview extends HookConsumerWidget { width: layout.width, height: layout.height, constraints: layout.constraints, - child: Hero( + child: MediaViewerHero( tag: heroTag, - child: MediaImage( - url: url, - fit: layout.fit, - semanticLabel: semanticLabel, - errorBuilder: (_, _, _) => _MediaPreviewFallback( - icon: LucideIcons.imageOff, - label: 'Image unavailable', + child: ClipRRect( + borderRadius: BorderRadius.circular(Radii.md), + child: MediaImage( + url: url, + decodeWidth: previewDecodeWidth, + fit: layout.fit, + semanticLabel: semanticLabel, + errorBuilder: (_, _, _) => _MediaPreviewFallback( + icon: LucideIcons.imageOff, + label: 'Image unavailable', + ), ), ), ), diff --git a/mobile/lib/features/channels/message_content/media_carousel.dart b/mobile/lib/features/channels/message_content/media_carousel.dart new file mode 100644 index 0000000000..88bfed5b1d --- /dev/null +++ b/mobile/lib/features/channels/message_content/media_carousel.dart @@ -0,0 +1,293 @@ +part of '../message_content.dart'; + +const _messageMediaCarouselHeight = 220.0; + +@immutable +class _MessageGalleryItem { + final String url; + final String semanticLabel; + final double? aspectRatio; + + const _MessageGalleryItem({ + required this.url, + required this.semanticLabel, + required this.aspectRatio, + }); +} + +@immutable +class _TrailingImageGallery { + final String content; + final List<_MessageGalleryItem> items; + + const _TrailingImageGallery({required this.content, required this.items}); +} + +class _MessageGalleryPrecache extends HookWidget { + final List> providers; + final int focusedIndex; + + const _MessageGalleryPrecache({ + required this.providers, + required this.focusedIndex, + }); + + @override + Widget build(BuildContext context) { + final providerSignature = Object.hashAll(providers); + useEffect(() { + var cancelled = false; + WidgetsBinding.instance.addPostFrameCallback((_) { + if (cancelled || !context.mounted) { + return; + } + for (var index = focusedIndex - 2; index <= focusedIndex + 2; index++) { + if (index < 0 || index >= providers.length) { + continue; + } + unawaited( + precacheImage(providers[index], context, onError: (_, _) {}), + ); + } + }); + return () => cancelled = true; + }, [focusedIndex, providerSignature]); + return const SizedBox.shrink(); + } +} + +_TrailingImageGallery? _extractTrailingImageGallery( + String content, + Map imetaByUrl, +) { + final lines = content.split('\n'); + var cursor = lines.length - 1; + while (cursor >= 0 && lines[cursor].trim().isEmpty) { + cursor -= 1; + } + + final items = <_MessageGalleryItem>[]; + final imagePattern = RegExp(r'^!\[([^\]]*)\]\((https?://[^)\s]+)\)$'); + while (cursor >= 0) { + final match = imagePattern.firstMatch(lines[cursor].trim()); + if (match == null) break; + final url = match.group(2)!; + final imeta = imetaByUrl[url]; + if (classifyMediaUrl(url, imeta: imeta) == MessageMediaKind.video) { + break; + } + final markdownLabel = match.group(1)?.trim(); + items.insert( + 0, + _MessageGalleryItem( + url: url, + semanticLabel: + imeta?.alt ?? + (markdownLabel?.isNotEmpty == true + ? markdownLabel! + : 'Message image'), + aspectRatio: imeta?.aspectRatio, + ), + ); + cursor -= 1; + } + + if (items.length < 2) return null; + return _TrailingImageGallery( + content: lines.take(cursor + 1).join('\n').trimRight(), + items: items, + ); +} + +class _MessageImageCarousel extends HookConsumerWidget { + final List<_MessageGalleryItem> items; + final double leadingOverflow; + final double trailingOverflow; + final VoidCallback? onReply; + final MediaViewerMoreAction? onMore; + + const _MessageImageCarousel({ + super.key, + required this.items, + required this.leadingOverflow, + required this.trailingOverflow, + required this.onReply, + required this.onMore, + }); + + @override + Widget build(BuildContext context, WidgetRef ref) { + final itemSignature = items.map((item) => item.url).join('\u0000'); + final heroTags = useMemoized( + () => [for (var index = 0; index < items.length; index++) Object()], + [itemSignature], + ); + final controller = usePageController(viewportFraction: 0.9); + final currentIndex = useState(0); + final mediaAuth = ref.watch(mediaGetAuthServiceProvider); + final mediaClient = ref.watch(mediaHttpClientProvider); + + return Padding( + padding: const EdgeInsets.only(top: Grid.half), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + mainAxisSize: MainAxisSize.min, + children: [ + Text( + '${items.length} images', + key: const ValueKey('message-media-carousel-count'), + style: context.textTheme.labelMedium?.copyWith( + color: context.colors.onSurfaceVariant, + fontWeight: FontWeight.w400, + ), + ), + const SizedBox(height: Grid.half), + LayoutBuilder( + builder: (context, constraints) { + final contentWidth = constraints.hasBoundedWidth + ? constraints.maxWidth + : _messageMediaMaxWidth(context); + final carouselWidth = + contentWidth + leadingOverflow + trailingOverflow; + final leadingExtent = leadingOverflow; + final isLeftToRight = + Directionality.of(context) == TextDirection.ltr; + final previewDecodeWidths = [ + for (var index = 0; index < items.length; index++) + math.max( + 1.0, + carouselWidth * controller.viewportFraction - + (index == items.length - 1 ? 0 : Grid.half), + ), + ]; + final devicePixelRatio = MediaQuery.devicePixelRatioOf(context); + final previewProviders = [ + for (var index = 0; index < items.length; index++) + ResizeImage.resizeIfNeeded( + (previewDecodeWidths[index] * devicePixelRatio).ceil(), + null, + MediaImageProvider( + url: items[index].url, + auth: mediaAuth, + client: mediaClient, + ), + ), + ]; + final viewerItems = [ + for (var index = 0; index < items.length; index++) + MediaViewerImage( + url: items[index].url, + heroTag: heroTags[index], + semanticLabel: items[index].semanticLabel, + previewDecodeWidth: previewDecodeWidths[index], + aspectRatio: items[index].aspectRatio, + preloadProvider: previewProviders[index], + ), + ]; + final carousel = SizedBox( + key: const ValueKey('message-media-carousel'), + width: carouselWidth, + height: _messageMediaCarouselHeight, + child: PageView.builder( + controller: controller, + clipBehavior: Clip.none, + padEnds: false, + itemCount: items.length, + onPageChanged: (index) => currentIndex.value = index, + itemBuilder: (context, index) { + final item = items[index]; + return Padding( + padding: EdgeInsetsDirectional.only( + end: index == items.length - 1 ? 0 : Grid.half, + ), + child: Semantics( + button: true, + excludeSemantics: true, + label: 'Open ${item.semanticLabel}', + child: GestureDetector( + key: ValueKey( + 'message-media-carousel-item:${item.url}', + ), + onTap: () => openImageViewer( + context, + imageUrl: item.url, + heroTag: heroTags[index], + semanticLabel: item.semanticLabel, + previewDecodeWidth: previewDecodeWidths[index], + aspectRatio: item.aspectRatio, + galleryItems: viewerItems, + initialIndex: index, + onReply: onReply, + onMore: onMore, + ), + child: Container( + clipBehavior: Clip.antiAlias, + decoration: BoxDecoration( + color: context.colors.surfaceContainerHighest, + borderRadius: BorderRadius.circular(Radii.md), + border: Border.all( + color: context.colors.outlineVariant, + ), + ), + child: MediaViewerHero( + tag: heroTags[index], + child: ClipRRect( + borderRadius: BorderRadius.circular(Radii.md), + child: MediaImage( + url: item.url, + decodeWidth: previewDecodeWidths[index], + fit: BoxFit.cover, + semanticLabel: item.semanticLabel, + errorBuilder: (_, _, _) => + const _MediaPreviewFallback( + icon: LucideIcons.imageOff, + label: 'Image unavailable', + ), + ), + ), + ), + ), + ), + ), + ); + }, + ), + ); + + final carouselSurface = Stack( + clipBehavior: Clip.none, + children: [ + carousel, + _MessageGalleryPrecache( + providers: previewProviders, + focusedIndex: currentIndex.value, + ), + ], + ); + + if (leadingExtent <= 0 && trailingOverflow <= 0) { + return carouselSurface; + } + return SizedBox( + width: contentWidth, + height: _messageMediaCarouselHeight, + child: OverflowBox( + alignment: AlignmentDirectional.centerStart, + minWidth: carouselWidth, + maxWidth: carouselWidth, + child: Transform.translate( + offset: Offset( + isLeftToRight ? -leadingExtent : leadingExtent, + 0, + ), + child: carouselSurface, + ), + ), + ); + }, + ), + ], + ), + ); + } +} diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart index d00973b4d1..32a1cf156a 100644 --- a/mobile/lib/features/channels/thread_detail_page.dart +++ b/mobile/lib/features/channels/thread_detail_page.dart @@ -221,6 +221,7 @@ class ThreadDetailPage extends HookConsumerWidget { reply.createdAt, ); final showAuthor = + reply.hasAttachments || prevReply == null || showDayDivider || prevReply.pubkey.toLowerCase() != @@ -455,6 +456,10 @@ class _ThreadMessage extends ConsumerWidget { ref.watch(userCacheProvider.select((cache) => cache[pk])) ?? ref.read(userCacheProvider.notifier).get(pk); final displayName = profile?.label ?? shortPubkey(message.pubkey); + final canManageMessage = + currentPubkey?.toLowerCase() == pk || + (profile?.ownerPubkey != null && + profile?.ownerPubkey == currentPubkey?.toLowerCase()); final userCache = ref.watch(userCacheProvider); final knownAgentPubkeys = ref.watch(mentionAgentPubkeysProvider(channelId)); @@ -478,10 +483,7 @@ class _ThreadMessage extends ConsumerWidget { ref: ref, message: message, channelId: channelId, - canManageMessage: - currentPubkey?.toLowerCase() == pk || - (profile?.ownerPubkey != null && - profile?.ownerPubkey == currentPubkey?.toLowerCase()), + canManageMessage: canManageMessage, allMessages: allMessages, currentPubkey: currentPubkey, isMember: isMember, @@ -568,6 +570,38 @@ class _ThreadMessage extends ConsumerWidget { baseStyle: context.textTheme.bodyLarge?.copyWith( color: context.colors.onSurface, ), + mediaCarouselTrailingOverflow: Grid.gutter, + onMediaReply: allMessages == null + ? null + : () { + if (!context.mounted) return; + Navigator.of(context).push( + MaterialPageRoute( + builder: (_) => ThreadDetailPage( + threadHead: message, + allMessages: allMessages!, + channelId: channelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + ), + ); + }, + onMediaMore: (viewerContext, imageUrl) => + showImageActions( + context: viewerContext, + ref: ref, + message: message, + channelId: channelId, + imageUrl: imageUrl, + canManageMessage: canManageMessage, + onDeleted: () { + if (viewerContext.mounted) { + Navigator.of(viewerContext).maybePop(); + } + }, + ), onChannelTap: (targetChannelId) { openChannelLink( context: context, diff --git a/mobile/lib/features/channels/timeline_message.dart b/mobile/lib/features/channels/timeline_message.dart index 203be2dbbd..253c949703 100644 --- a/mobile/lib/features/channels/timeline_message.dart +++ b/mobile/lib/features/channels/timeline_message.dart @@ -171,6 +171,11 @@ class TimelineMessage { this.parentId, this.rootId, }); + + /// Attachment messages stay visually distinct from surrounding messages, + /// even when several are sent by the same author in quick succession. + bool get hasAttachments => + tags.any((tag) => tag.isNotEmpty && tag.first == 'imeta'); } @immutable diff --git a/mobile/lib/shared/relay/media_upload.dart b/mobile/lib/shared/relay/media_upload.dart index 93c53e9743..bd9a1cce43 100644 --- a/mobile/lib/shared/relay/media_upload.dart +++ b/mobile/lib/shared/relay/media_upload.dart @@ -21,6 +21,8 @@ const _mediaUploadPlatformChannelName = 'buzz/media_upload'; const _sanitizeImageForUploadMethod = 'sanitizeImageForUpload'; const _transcodeVideoToMp4Method = 'transcodeVideoToMp4'; const _transcodeImageToJpegMethod = 'transcodeImageToJpeg'; +const _requiresLegacyMediaStoragePermissionMethod = + 'requiresLegacyMediaStoragePermission'; const _readClipboardImageMethod = 'readClipboardImage'; const _clipboardHasImageMethod = 'clipboardHasImage'; const _uploadAuthKind = 24242; @@ -39,6 +41,17 @@ final _mediaUploadPlatformChannel = MethodChannel( _mediaUploadPlatformChannelName, ); +/// Whether saving media needs Android's pre-scoped-storage runtime permission. +Future requiresLegacyMediaStoragePermission() async { + if (defaultTargetPlatform != TargetPlatform.android) { + return false; + } + return await _mediaUploadPlatformChannel.invokeMethod( + _requiresLegacyMediaStoragePermissionMethod, + ) ?? + false; +} + const _allowedImageMimeTypes = { 'image/jpeg', 'image/png', diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock index 55185fc9c6..61d7fd58e4 100644 --- a/mobile/pubspec.lock +++ b/mobile/pubspec.lock @@ -1000,6 +1000,14 @@ packages: url: "https://pub.dev" source: hosted version: "7.0.2" + photo_manager: + dependency: "direct main" + description: + name: photo_manager + sha256: "4f7de6c9778993c5c54cf1fb2eaa8d5c27c0771dc24a4dfca341aa81aef13fe1" + url: "https://pub.dev" + source: hosted + version: "3.11.0" platform: dependency: transitive description: @@ -1096,6 +1104,22 @@ packages: url: "https://pub.dev" source: hosted version: "0.3.8" + share_plus: + dependency: "direct main" + description: + name: share_plus + sha256: "34f00f9becd2743c1fb05363d624f9f70d37f7ccdcdda47450bc0b8c9d327b8c" + url: "https://pub.dev" + source: hosted + version: "13.3.0" + share_plus_platform_interface: + dependency: transitive + description: + name: share_plus_platform_interface + sha256: "365ef7379fc22507256adda3385152942ffce08935452bc972c2e52a0bebae41" + url: "https://pub.dev" + source: hosted + version: "7.2.0" shared_preferences: dependency: "direct main" description: diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml index b90f50c25a..b525926288 100644 --- a/mobile/pubspec.yaml +++ b/mobile/pubspec.yaml @@ -29,6 +29,7 @@ dependencies: file_selector: ^1.1.0 camera: ^0.12.0+2 image_picker: ^1.1.2 + photo_manager: ^3.11.0 video_player: ^2.10.1 package_info_plus: ^10.0.0 app_badge_plus: ^1.2.10 @@ -36,6 +37,7 @@ dependencies: scrollable_positioned_list: ^0.3.8 open_filex: ^4.7.0 path_provider: ^2.1.6 + share_plus: ^13.3.0 dev_dependencies: flutter_test: diff --git a/mobile/test/features/channels/message_actions_test.dart b/mobile/test/features/channels/message_actions_test.dart index 5f0406bfab..03d7951b05 100644 --- a/mobile/test/features/channels/message_actions_test.dart +++ b/mobile/test/features/channels/message_actions_test.dart @@ -149,6 +149,37 @@ Future _pumpSheet( await tester.pumpAndSettle(); } +Future _pumpImageSheet( + WidgetTester tester, { + required TimelineMessage message, + bool canManageMessage = false, +}) async { + await tester.pumpWidget( + ProviderScope( + child: MaterialApp( + theme: AppTheme.light(), + home: Scaffold( + body: Consumer( + builder: (context, ref, _) => TextButton( + onPressed: () => showImageActions( + context: context, + ref: ref, + message: message, + channelId: _channelId, + imageUrl: 'https://example.com/photo.png', + canManageMessage: canManageMessage, + ), + child: const Text('open image actions'), + ), + ), + ), + ), + ), + ); + await tester.tap(find.text('open image actions')); + await tester.pumpAndSettle(); +} + void main() { group('showMessageActions', () { testWidgets('shows parity actions for a regular message', (tester) async { @@ -367,6 +398,40 @@ void main() { }); }); + group('showImageActions', () { + testWidgets('labels the destructive action as deleting the message', ( + tester, + ) async { + await _pumpImageSheet( + tester, + message: _message(), + canManageMessage: true, + ); + + expect(find.text('Delete message'), findsOneWidget); + expect(find.text('Delete upload'), findsNothing); + }); + }); + + group('downloadedImageFilename', () { + test('preserves gif file extensions', () { + expect( + downloadedImageFilename('https://example.com/animation.gif', null), + 'animation.gif', + ); + }); + + test('uses gif extension for gif content types', () { + expect( + downloadedImageFilename( + 'https://example.com/download', + 'image/gif; charset=binary', + ), + matches(RegExp(r'^buzz-\d+\.gif$')), + ); + }); + }); + group('messageLinkFor', () { test('builds a canonical link with thread context', () { expect( diff --git a/mobile/test/features/channels/message_content_test.dart b/mobile/test/features/channels/message_content_test.dart index bcb46f0c37..91e31eee22 100644 --- a/mobile/test/features/channels/message_content_test.dart +++ b/mobile/test/features/channels/message_content_test.dart @@ -9,12 +9,23 @@ import 'package:buzz/features/channels/media_viewer_page.dart'; import 'package:buzz/shared/relay/relay.dart'; import 'package:buzz/shared/theme/theme.dart'; -Widget _testable(Widget child, {List overrides = const []}) { +Widget _testable( + Widget child, { + List overrides = const [], + bool disableAnimations = false, +}) { return ProviderScope( overrides: overrides, child: MaterialApp( theme: AppTheme.light(), - home: Scaffold(body: child), + home: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of( + context, + ).copyWith(disableAnimations: disableAnimations), + child: Scaffold(body: child), + ), + ), ), ); } @@ -182,11 +193,22 @@ void main() { ); expect(route, isA>()); - expect(route.transitionDuration, const Duration(milliseconds: 280)); + expect(route.transitionDuration, const Duration(milliseconds: 260)); expect( route.reverseTransitionDuration, - const Duration(milliseconds: 220), + const Duration(milliseconds: 170), + ); + }); + + test('buildImageViewerRoute disables motion when requested', () { + final route = buildImageViewerRoute( + imageUrl: 'https://example.com/media/image.png', + heroTag: Object(), + disableAnimations: true, ); + + expect(route.transitionDuration, Duration.zero); + expect(route.reverseTransitionDuration, Duration.zero); }); group('plain text', () { @@ -430,6 +452,197 @@ void main() { ); }); + testWidgets( + 'groups uploaded photos into a carousel and opens the full gallery', + (tester) async { + const first = 'https://example.com/media/one.png'; + const second = 'https://example.com/media/two.png'; + const third = 'https://example.com/media/three.png'; + await tester.pumpWidget( + _testable( + const MessageContent( + content: + ''' +Photos +![image]($first) +![image]($second) +![image]($third) +''', + tags: [ + ['imeta', 'url $first', 'm image/png', 'alt First photo'], + ['imeta', 'url $second', 'm image/png', 'alt Second photo'], + ['imeta', 'url $third', 'm image/png', 'alt Third photo'], + ], + ), + ), + ); + await tester.pumpAndSettle(); + + final carousel = find.byKey(const ValueKey('message-media-carousel')); + expect(carousel, findsOneWidget); + expect(find.text('3 images'), findsOneWidget); + + await tester.drag(carousel, const Offset(-600, 0)); + await tester.pumpAndSettle(); + + await tester.tap( + find.byKey(const ValueKey('message-media-carousel-item:$second')), + ); + await tester.pumpAndSettle(); + + expect( + find.byKey(const ValueKey('message-media-image-viewer')), + findsOneWidget, + ); + expect( + find.byKey(const ValueKey('message-media-image-viewer-filmstrip')), + findsOneWidget, + ); + expect( + find.byKey( + const ValueKey('message-media-image-viewer-thumbnail:1'), + ), + findsOneWidget, + ); + final displayedImage = tester.widget( + find.byKey(const ValueKey('message-media-image-viewer-image:1')), + ); + expect(displayedImage.decodeWidth, isNotNull); + final selectedThumbnailClip = tester.widget( + find.byKey( + const ValueKey('message-media-image-viewer-thumbnail-clip:1'), + ), + ); + final selectedThumbnailRadius = + selectedThumbnailClip.borderRadius as BorderRadius; + expect( + selectedThumbnailRadius.topLeft.x, + closeTo(Radii.sm - 2.5, 0.01), + ); + + await tester.fling( + find.byKey(const ValueKey('message-media-image-viewer-pages')), + const Offset(-700, 0), + 1200, + ); + await tester.pumpAndSettle(); + + final thirdThumbnail = find.byKey( + const ValueKey('message-media-image-viewer-thumbnail:2'), + ); + final thirdSemantics = tester.widget( + find + .ancestor(of: thirdThumbnail, matching: find.byType(Semantics)) + .first, + ); + expect(thirdSemantics.properties.selected, isTrue); + }, + ); + + testWidgets( + 'jumps to a selected gallery thumbnail when motion is disabled', + (tester) async { + const first = 'https://example.com/media/reduced-motion-one.png'; + const second = 'https://example.com/media/reduced-motion-two.png'; + await tester.pumpWidget( + _testable( + const MessageContent( + content: + ''' +![image]($first) +![image]($second) +''', + tags: [ + ['imeta', 'url $first', 'm image/png'], + ['imeta', 'url $second', 'm image/png'], + ], + ), + disableAnimations: true, + ), + ); + await tester.pumpAndSettle(); + + await tester.tap( + find.byKey(const ValueKey('message-media-carousel-item:$first')), + ); + await tester.pumpAndSettle(); + await tester.tap( + find.byKey( + const ValueKey('message-media-image-viewer-thumbnail:1'), + ), + ); + await tester.pumpAndSettle(); + + final selectedThumbnail = tester.widget( + find + .ancestor( + of: find.byKey( + const ValueKey('message-media-image-viewer-thumbnail:1'), + ), + matching: find.byType(Semantics), + ) + .first, + ); + expect(selectedThumbnail.properties.selected, isTrue); + expect(tester.takeException(), isNull); + }, + ); + + testWidgets('resets carousel paging when gallery images change', ( + tester, + ) async { + const firstGallery = [ + 'https://example.com/media/first-a.png', + 'https://example.com/media/first-b.png', + 'https://example.com/media/first-c.png', + ]; + const secondGallery = [ + 'https://example.com/media/second-a.png', + 'https://example.com/media/second-b.png', + ]; + + Widget gallery(List urls) => _testable( + MessageContent( + content: urls.map((url) => '![image]($url)').join('\n'), + tags: [ + for (final url in urls) ['imeta', 'url $url', 'm image/png'], + ], + ), + ); + + await tester.pumpWidget(gallery(firstGallery)); + await tester.pumpAndSettle(); + final firstCarousel = tester.widget( + find.descendant( + of: find.byKey(const ValueKey('message-media-carousel')), + matching: find.byType(PageView), + ), + ); + + await tester.fling( + find.byKey(const ValueKey('message-media-carousel')), + const Offset(-700, 0), + 1200, + ); + await tester.pumpAndSettle(); + expect(firstCarousel.controller!.page, greaterThan(0)); + + await tester.pumpWidget(gallery(secondGallery)); + await tester.pumpAndSettle(); + final secondCarousel = tester.widget( + find.descendant( + of: find.byKey(const ValueKey('message-media-carousel')), + matching: find.byType(PageView), + ), + ); + + expect( + secondCarousel.controller, + isNot(same(firstCarousel.controller)), + ); + expect(secondCarousel.controller!.page, 0); + }); + testWidgets( 'disables hero on close after the fullscreen image is transformed', (tester) async { @@ -484,6 +697,90 @@ void main() { }, ); + testWidgets('double tap resets the fullscreen image transform', ( + tester, + ) async { + const imageUrl = 'https://example.com/media/double-tap-reset.png'; + + await tester.pumpWidget( + _testable( + const MessageContent( + content: + 'Look\n![image](https://example.com/media/double-tap-reset.png)', + tags: [ + [ + 'imeta', + 'url https://example.com/media/double-tap-reset.png', + 'm image/png', + ], + ], + ), + ), + ); + await tester.pumpAndSettle(); + + final transformationController = await _openImageViewer( + tester, + imageUrl, + ); + _applyImageViewerTransform( + transformationController, + dx: 32, + dy: 24, + scale: 2, + ); + await tester.pump(); + + final gestureSurface = find.byKey( + const ValueKey('message-media-image-viewer-gesture:0'), + ); + await tester.tap(gestureSurface); + await tester.pump(const Duration(milliseconds: 50)); + await tester.tap(gestureSurface); + await tester.pumpAndSettle(); + + expect( + transformationController.value.storage, + orderedEquals(Matrix4.identity().storage), + ); + expect(_isImageViewerHeroEnabled(tester), isTrue); + }); + + testWidgets('swiping down dismisses the fullscreen gallery', ( + tester, + ) async { + const imageUrl = 'https://example.com/media/swipe-dismiss.png'; + + await tester.pumpWidget( + _testable( + const MessageContent( + content: + 'Look\n![image](https://example.com/media/swipe-dismiss.png)', + tags: [ + [ + 'imeta', + 'url https://example.com/media/swipe-dismiss.png', + 'm image/png', + ], + ], + ), + ), + ); + await tester.pumpAndSettle(); + await _openImageViewer(tester, imageUrl); + + await tester.drag( + find.byKey(const ValueKey('message-media-image-viewer-gesture:0')), + const Offset(0, 180), + ); + await tester.pumpAndSettle(); + + expect( + find.byKey(const ValueKey('message-media-image-viewer')), + findsNothing, + ); + }); + testWidgets( 'disables hero on back navigation after the fullscreen image is transformed', (tester) async { From 6da45ac5cf90fa0768a98256e2200708d219ddfc Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Tue, 28 Jul 2026 17:20:50 +0100 Subject: [PATCH 005/112] Polish mobile message and search layouts (#3121) ## Summary - align message typography, avatars, metadata, and spacing across mobile surfaces - improve message follow behavior, touch feedback, and Activity popover motion - refine Search motion, gutters, and explicit recent-search history ## Snapshots ### Home ![Home](https://raw.githubusercontent.com/block/buzz/99aaf9719f68a2813e14c484f503af10c4fca04a/pr-3121--01-home.png) ### Activity ![Activity](https://raw.githubusercontent.com/block/buzz/99aaf9719f68a2813e14c484f503af10c4fca04a/pr-3121--02-activity.png) ### Search ![Search](https://raw.githubusercontent.com/block/buzz/99aaf9719f68a2813e14c484f503af10c4fca04a/pr-3121--03-search.png) ## Testing - `just mobile-check` - `just mobile-test` (749 passed, 1 skipped) --------- Signed-off-by: Taylor Ho Signed-off-by: kenny lopez Signed-off-by: npub14vtk7pvazqrq9639qu7e560wnqtl0d53ca4gjuvq6jzf3k2el23qqlwa7f Signed-off-by: Wes Signed-off-by: npub15w828kxsxu2684ynste0uah2jwkgatd99flt7ds4523hzm8ju6cshdr8hh Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> Co-authored-by: Taylor Ho Co-authored-by: npub14vtk7pvazqrq9639qu7e560wnqtl0d53ca4gjuvq6jzf3k2el23qqlwa7f Co-authored-by: Wes Co-authored-by: Carl Co-authored-by: npub15w828kxsxu2684ynste0uah2jwkgatd99flt7ds4523hzm8ju6cshdr8hh --- .../lib/features/activity/activity_page.dart | 5 + .../activity_page/header_actions.dart | 232 ++++---- .../activity/activity_page/inbox_row.dart | 50 +- .../activity/activity_page/popover_menu.dart | 231 ++++++++ .../channels/channel_detail_page.dart | 3 + .../channels/channel_detail_page/app_bar.dart | 6 +- .../channel_detail_page/message_bubble.dart | 276 +++++----- .../channel_detail_page/message_list.dart | 150 ++++-- .../channel_detail_page/system_rows.dart | 226 ++++---- .../channels/channels_page/channel_tile.dart | 2 +- .../channels/channels_page/sections.dart | 6 +- .../lib/features/channels/reaction_row.dart | 3 +- .../features/channels/thread_detail_page.dart | 475 +++++++++-------- .../lib/features/forum/forum_post_card.dart | 22 +- .../lib/features/forum/forum_thread_page.dart | 65 ++- mobile/lib/features/profile/user_profile.dart | 7 + .../lib/features/pulse/compose_note_page.dart | 23 +- mobile/lib/features/pulse/note_card.dart | 60 ++- .../search/recent_searches_provider.dart | 64 +++ mobile/lib/features/search/search_page.dart | 481 +++++++++++++---- .../lib/shared/theme/message_typography.dart | 131 +++++ mobile/lib/shared/theme/theme.dart | 1 + .../lib/shared/widgets/filter_chip_bar.dart | 2 +- .../lib/shared/widgets/frosted_app_bar.dart | 6 +- .../shared/widgets/message_author_meta.dart | 118 +++++ .../features/activity/activity_page_test.dart | 190 ++++++- .../channels/channel_detail_page_test.dart | 435 +++++++++++++-- .../features/channels/channels_page_test.dart | 9 + .../features/forum/forum_widgets_test.dart | 184 ++++++- .../pulse/compose_note_page_test.dart | 67 ++- .../test/features/pulse/note_card_test.dart | 130 +++++ .../search/recent_searches_provider_test.dart | 105 ++++ .../features/search/search_page_test.dart | 494 ++++++++++++++++++ .../shared/theme/message_typography_test.dart | 141 +++++ .../shared/widgets/filter_chip_bar_test.dart | 8 + .../widgets/message_author_meta_test.dart | 82 +++ 36 files changed, 3634 insertions(+), 856 deletions(-) create mode 100644 mobile/lib/features/activity/activity_page/popover_menu.dart create mode 100644 mobile/lib/features/search/recent_searches_provider.dart create mode 100644 mobile/lib/shared/theme/message_typography.dart create mode 100644 mobile/lib/shared/widgets/message_author_meta.dart create mode 100644 mobile/test/features/pulse/note_card_test.dart create mode 100644 mobile/test/features/search/recent_searches_provider_test.dart create mode 100644 mobile/test/shared/theme/message_typography_test.dart create mode 100644 mobile/test/shared/widgets/message_author_meta_test.dart diff --git a/mobile/lib/features/activity/activity_page.dart b/mobile/lib/features/activity/activity_page.dart index 6f38681b2e..50d0544cfc 100644 --- a/mobile/lib/features/activity/activity_page.dart +++ b/mobile/lib/features/activity/activity_page.dart @@ -1,4 +1,6 @@ import 'dart:async'; +import 'dart:math' as math; +import 'dart:ui' show SemanticsRole; import 'package:flutter/material.dart'; import 'package:flutter_hooks/flutter_hooks.dart'; @@ -11,6 +13,7 @@ import '../../shared/utils/string_utils.dart'; import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; +import '../../shared/widgets/message_author_meta.dart'; import '../channels/channel.dart'; import '../channels/channel_detail_page.dart'; import '../channels/channels_provider.dart'; @@ -30,6 +33,7 @@ import 'reminders_provider.dart'; part 'activity_page/header_actions.dart'; part 'activity_page/inbox_row.dart'; part 'activity_page/lists.dart'; +part 'activity_page/popover_menu.dart'; part 'activity_page/status_views.dart'; /// Conversation-oriented Activity inbox. @@ -281,6 +285,7 @@ class ActivityPage extends HookConsumerWidget { return FrostedScaffold( appBar: FrostedAppBar( gradient: context.appColors.topSectionGradient, + automaticallyImplyLeading: false, title: const Text('Activity'), titleStyle: headerTitleStyle, actions: [ diff --git a/mobile/lib/features/activity/activity_page/header_actions.dart b/mobile/lib/features/activity/activity_page/header_actions.dart index 731285caaa..1aab78e622 100644 --- a/mobile/lib/features/activity/activity_page/header_actions.dart +++ b/mobile/lib/features/activity/activity_page/header_actions.dart @@ -28,64 +28,101 @@ class _FilterMenuButton extends StatelessWidget { @override Widget build(BuildContext context) { - return PopupMenuButton( - key: const ValueKey('activity-filter-menu'), - onSelected: onChanged, - itemBuilder: (context) => [ - for (final entry in _filterLabels.entries) - PopupMenuItem( - value: entry.key, + return Builder( + builder: (buttonContext) => InkWell( + key: const ValueKey('activity-filter-menu'), + borderRadius: BorderRadius.circular(Radii.md), + onTap: () async { + final selected = await _showActivityPopover( + context: buttonContext, + width: 240, + alignment: _ActivityPopoverAlignment.start, + offset: const Offset(0, Grid.half), + menuPadding: const EdgeInsets.symmetric(vertical: Grid.half), + color: context.colors.surface.withValues(alpha: 0.98), + elevation: 8, + shadowColor: context.colors.shadow.withValues(alpha: 0.18), + shape: RoundedRectangleBorder( + borderRadius: BorderRadius.circular(Radii.card), + side: BorderSide( + color: context.colors.outlineVariant.withValues(alpha: 0.45), + ), + ), + surfaceKey: const ValueKey('activity-filter-popover'), + items: [ + for (final entry in _filterLabels.entries) + PopupMenuItem( + value: entry.key, + height: Grid.xl, + padding: const EdgeInsets.symmetric(horizontal: Grid.twelve), + child: Row( + children: [ + SizedBox( + width: Grid.sm, + child: entry.key == filter + ? Icon( + LucideIcons.check, + size: 16, + color: context.colors.primary, + ) + : null, + ), + Expanded( + child: Text( + entry.value, + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: context.textTheme.labelLarge?.copyWith( + color: context.colors.onSurface, + ), + ), + ), + if (entry.key == InboxFilter.reminders && + dueReminderCount > 0) + _CountBadge(count: dueReminderCount) + else if (entry.key == InboxFilter.drafts && + draftCount > 0) + _CountBadge(count: draftCount), + ], + ), + ), + ], + ); + if (buttonContext.mounted && selected != null) onChanged(selected); + }, + child: ConstrainedBox( + constraints: const BoxConstraints(minHeight: Grid.xl), + child: Padding( + padding: const EdgeInsets.symmetric(horizontal: Grid.xxs), child: Row( + mainAxisSize: MainAxisSize.min, children: [ - SizedBox( - width: Grid.sm, - child: entry.key == filter - ? Icon( - LucideIcons.check, - size: 16, - color: context.colors.primary, - ) - : null, + Text( + _filterLabels[filter]!, + style: context.textTheme.labelLarge?.copyWith( + fontWeight: FontWeight.w600, + ), ), - Text(entry.value), - const Spacer(), - if (entry.key == InboxFilter.reminders && dueReminderCount > 0) - _CountBadge(count: dueReminderCount) - else if (entry.key == InboxFilter.drafts && draftCount > 0) - _CountBadge(count: draftCount), + const SizedBox(width: Grid.quarter), + Icon( + LucideIcons.chevronDown, + size: 16, + color: context.colors.onSurfaceVariant, + ), + if (dueReminderCount > 0 || draftCount > 0) ...[ + const SizedBox(width: Grid.quarter), + Container( + width: 6, + height: 6, + decoration: BoxDecoration( + shape: BoxShape.circle, + color: context.colors.primary, + ), + ), + ], ], ), ), - ], - child: Padding( - padding: const EdgeInsets.symmetric(horizontal: Grid.xxs), - child: Row( - mainAxisSize: MainAxisSize.min, - children: [ - Text( - _filterLabels[filter]!, - style: context.textTheme.labelLarge?.copyWith( - fontWeight: FontWeight.w600, - ), - ), - const SizedBox(width: Grid.quarter), - Icon( - LucideIcons.chevronDown, - size: 16, - color: context.colors.onSurfaceVariant, - ), - if (dueReminderCount > 0 || draftCount > 0) ...[ - const SizedBox(width: Grid.quarter), - Container( - width: 6, - height: 6, - decoration: BoxDecoration( - shape: BoxShape.circle, - color: context.colors.primary, - ), - ), - ], - ], ), ), ); @@ -136,45 +173,64 @@ class _InboxOptionsButton extends StatelessWidget { @override Widget build(BuildContext context) { - return PopupMenuButton( - key: const ValueKey('activity-options-menu'), - icon: const Icon(LucideIcons.ellipsis, size: 20), - onSelected: (value) { - if (value == 'unread-only') onUnreadOnlyChanged(!unreadOnly); - if (value == 'mark-all-read') onMarkAllRead(); - }, - itemBuilder: (context) => [ - PopupMenuItem( - value: 'unread-only', - child: Row( - children: [ - Expanded(child: Text(unreadOnly ? 'Show all' : 'Show unread')), - if (unreadOnly) - Icon( - LucideIcons.check, - size: 16, - color: context.colors.primary, + return Builder( + builder: (buttonContext) => IconButton( + key: const ValueKey('activity-options-menu'), + tooltip: 'Activity options', + icon: const Icon(LucideIcons.ellipsis, size: 20), + onPressed: () async { + final selected = await _showActivityPopover( + context: buttonContext, + width: 216, + alignment: _ActivityPopoverAlignment.end, + color: context.colors.surface, + elevation: 4, + shadowColor: context.colors.shadow.withValues(alpha: 0.18), + shape: RoundedRectangleBorder( + borderRadius: BorderRadius.circular(Radii.md), + side: BorderSide(color: context.colors.outline), + ), + surfaceKey: const ValueKey('activity-options-popover'), + items: [ + PopupMenuItem( + value: 'unread-only', + child: Row( + children: [ + Expanded( + child: Text(unreadOnly ? 'Show all' : 'Show unread'), + ), + if (unreadOnly) + Icon( + LucideIcons.check, + size: 16, + color: context.colors.primary, + ), + ], ), - ], - ), - ), - PopupMenuItem( - value: 'mark-all-read', - enabled: unreadCount > 0, - child: Row( - children: [ - const Expanded(child: Text('Mark all as read')), - if (unreadCount > 0) - Text( - '$unreadCount', - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, - ), + ), + PopupMenuItem( + value: 'mark-all-read', + enabled: unreadCount > 0, + child: Row( + children: [ + const Expanded(child: Text('Mark all as read')), + if (unreadCount > 0) + Text( + '$unreadCount', + style: context.textTheme.labelSmall?.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ], ), + ), ], - ), - ), - ], + ); + if (!buttonContext.mounted || selected == null) return; + if (selected == 'unread-only') onUnreadOnlyChanged(!unreadOnly); + if (selected == 'mark-all-read') onMarkAllRead(); + }, + ), ); } } diff --git a/mobile/lib/features/activity/activity_page/inbox_row.dart b/mobile/lib/features/activity/activity_page/inbox_row.dart index 83ae55225f..fb267c03be 100644 --- a/mobile/lib/features/activity/activity_page/inbox_row.dart +++ b/mobile/lib/features/activity/activity_page/inbox_row.dart @@ -91,7 +91,7 @@ class _InboxRow extends ConsumerWidget { crossAxisAlignment: CrossAxisAlignment.start, children: [ _RowAvatar(pubkey: item.item.pubkey, profile: profile), - const SizedBox(width: Grid.twelve), + const SizedBox(width: messageAvatarContentGap), Expanded( child: Column( crossAxisAlignment: CrossAxisAlignment.start, @@ -100,19 +100,25 @@ class _InboxRow extends ConsumerWidget { Row( children: [ Expanded( - child: Text( - senderLabel, - // Compact label scale — matches the old - // "@ Mention" headline treatment while staying - // the row's primary label. - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w600, + child: MessageAuthorMeta( + displayName: senderLabel, + username: messageUsernameLabel(profile), + timestamp: _inboxTimestamp(item.latestActivityAt), + nameColor: context.colors.onSurface, + metadataColor: mutedColor, + nameStyle: activityUsernameTextStyle, + metadataStyle: activityTimestampTextStyle, + displayNameKey: ValueKey( + 'activity-author-${item.id}', + ), + usernameKey: ValueKey('activity-username-${item.id}'), + timestampKey: ValueKey( + 'activity-timestamp-${item.id}', ), - overflow: TextOverflow.ellipsis, ), ), - const SizedBox(width: Grid.xxs), if (!isDone) ...[ + const SizedBox(width: Grid.xxs), Container( key: ValueKey('inbox-unread-dot-${item.id}'), width: 6, @@ -122,17 +128,7 @@ class _InboxRow extends ConsumerWidget { color: context.colors.primary, ), ), - const SizedBox(width: Grid.half), ], - Text( - _inboxTimestamp(item.latestActivityAt), - style: context.textTheme.labelSmall?.copyWith( - color: mutedColor, - fontWeight: isDone - ? FontWeight.w400 - : FontWeight.w500, - ), - ), ], ), const SizedBox(height: Grid.quarter), @@ -142,9 +138,8 @@ class _InboxRow extends ConsumerWidget { Flexible( child: Text( label.text, - style: context.textTheme.labelSmall?.copyWith( + style: activityContextTextStyle.copyWith( color: labelColor, - fontWeight: FontWeight.w500, ), overflow: TextOverflow.ellipsis, ), @@ -163,7 +158,7 @@ class _InboxRow extends ConsumerWidget { ), child: Text( '#${label.channelLabel}', - style: context.textTheme.labelSmall?.copyWith( + style: activityContextTextStyle.copyWith( color: mutedColor, ), overflow: TextOverflow.ellipsis, @@ -174,14 +169,13 @@ class _InboxRow extends ConsumerWidget { ], ), const SizedBox(height: Grid.half), - // Preview (bold while unread — desktop parity). + // Message preview. MessageContent( content: item.item.displayContent, tags: item.item.tags, maxLines: 2, - baseStyle: context.textTheme.bodySmall?.copyWith( - color: isDone ? mutedColor : context.colors.onSurface, - fontWeight: isDone ? FontWeight.w400 : FontWeight.w600, + baseStyle: activityPreviewTextStyle.copyWith( + color: context.colors.onSurface, ), ), ], @@ -238,7 +232,7 @@ class _RowAvatar extends StatelessWidget { profile?.initial ?? (pubkey.isNotEmpty ? pubkey[0].toUpperCase() : '?'); return AvatarImage( imageUrl: profile?.avatarUrl, - radius: 18, + radius: activityAvatarSize / 2, backgroundColor: context.colors.primaryContainer, fallback: Text( initial, diff --git a/mobile/lib/features/activity/activity_page/popover_menu.dart b/mobile/lib/features/activity/activity_page/popover_menu.dart new file mode 100644 index 0000000000..56d0a612ec --- /dev/null +++ b/mobile/lib/features/activity/activity_page/popover_menu.dart @@ -0,0 +1,231 @@ +part of '../activity_page.dart'; + +const _activityPopoverEnterDuration = Duration(milliseconds: 150); +const _activityPopoverExitDuration = Duration(milliseconds: 110); +const _activityPopoverStartScale = 0.96; + +enum _ActivityPopoverAlignment { start, end } + +Future _showActivityPopover({ + required BuildContext context, + required List> items, + required double width, + required _ActivityPopoverAlignment alignment, + required Color color, + required ShapeBorder shape, + required double elevation, + required Color shadowColor, + Offset offset = Offset.zero, + EdgeInsetsGeometry menuPadding = EdgeInsets.zero, + Clip clipBehavior = Clip.antiAlias, + Key? surfaceKey, +}) { + final navigator = Navigator.of(context); + final overlay = navigator.overlay; + final triggerRenderObject = context.findRenderObject(); + final overlayRenderObject = overlay?.context.findRenderObject(); + if (triggerRenderObject is! RenderBox || overlayRenderObject is! RenderBox) { + return Future.value(); + } + + final triggerRect = MatrixUtils.transformRect( + triggerRenderObject.getTransformTo(overlayRenderObject), + Offset.zero & triggerRenderObject.size, + ); + final overlayRect = Offset.zero & overlayRenderObject.size; + final mediaQuery = MediaQuery.of(context); + + return navigator.push( + _ActivityPopoverRoute( + position: RelativeRect.fromRect(triggerRect, overlayRect), + items: items, + width: width, + alignment: alignment, + offset: offset, + color: color, + shape: shape, + elevation: elevation, + shadowColor: shadowColor, + menuPadding: menuPadding, + clipBehavior: clipBehavior, + surfaceKey: surfaceKey, + screenPadding: EdgeInsets.fromLTRB( + math.max(Grid.xxs, mediaQuery.padding.left), + math.max(Grid.xxs, mediaQuery.padding.top), + math.max(Grid.xxs, mediaQuery.padding.right), + math.max(Grid.xxs, mediaQuery.padding.bottom), + ), + reducedMotion: mediaQuery.disableAnimations, + barrierLabel: MaterialLocalizations.of(context).modalBarrierDismissLabel, + ), + ); +} + +class _ActivityPopoverRoute extends PopupRoute { + final RelativeRect position; + final List> items; + final double width; + final _ActivityPopoverAlignment alignment; + final Offset offset; + final Color color; + final ShapeBorder shape; + final double elevation; + final Color shadowColor; + final EdgeInsetsGeometry menuPadding; + final Clip clipBehavior; + final Key? surfaceKey; + final EdgeInsets screenPadding; + final bool reducedMotion; + final String _barrierLabel; + + _ActivityPopoverRoute({ + required this.position, + required this.items, + required this.width, + required this.alignment, + required this.offset, + required this.color, + required this.shape, + required this.elevation, + required this.shadowColor, + required this.menuPadding, + required this.clipBehavior, + required this.surfaceKey, + required this.screenPadding, + required this.reducedMotion, + required String barrierLabel, + }) : _barrierLabel = barrierLabel; + + @override + Color? get barrierColor => null; + + @override + bool get barrierDismissible => true; + + @override + String? get barrierLabel => _barrierLabel; + + @override + Duration get transitionDuration => + reducedMotion ? Duration.zero : _activityPopoverEnterDuration; + + @override + Duration get reverseTransitionDuration => + reducedMotion ? Duration.zero : _activityPopoverExitDuration; + + @override + Widget buildPage( + BuildContext context, + Animation animation, + Animation secondaryAnimation, + ) { + final curvedAnimation = animation.drive( + CurveTween(curve: Curves.easeOutCubic), + ); + final scaleAnimation = Tween( + begin: _activityPopoverStartScale, + end: 1, + ).animate(curvedAnimation); + final transformOrigin = switch (alignment) { + _ActivityPopoverAlignment.start => Alignment.topLeft, + _ActivityPopoverAlignment.end => Alignment.topRight, + }; + + return CustomSingleChildLayout( + delegate: _ActivityPopoverLayoutDelegate( + position: position, + alignment: alignment, + offset: offset, + screenPadding: screenPadding, + ), + child: FadeTransition( + key: const ValueKey('activity-popover-fade'), + opacity: curvedAnimation, + child: ScaleTransition( + key: const ValueKey('activity-popover-scale'), + scale: scaleAnimation, + alignment: transformOrigin, + child: Material( + key: surfaceKey, + type: MaterialType.card, + color: color, + surfaceTintColor: Colors.transparent, + elevation: elevation, + shadowColor: shadowColor, + shape: shape, + clipBehavior: clipBehavior, + child: SizedBox( + width: width, + child: Semantics( + role: SemanticsRole.menu, + scopesRoute: true, + namesRoute: true, + explicitChildNodes: true, + child: SingleChildScrollView( + padding: menuPadding, + child: ListBody(children: items), + ), + ), + ), + ), + ), + ), + ); + } +} + +class _ActivityPopoverLayoutDelegate extends SingleChildLayoutDelegate { + final RelativeRect position; + final _ActivityPopoverAlignment alignment; + final Offset offset; + final EdgeInsets screenPadding; + + const _ActivityPopoverLayoutDelegate({ + required this.position, + required this.alignment, + required this.offset, + required this.screenPadding, + }); + + @override + BoxConstraints getConstraintsForChild(BoxConstraints constraints) { + return BoxConstraints.loose( + Size( + constraints.maxWidth - screenPadding.horizontal, + constraints.maxHeight - screenPadding.vertical, + ), + ); + } + + @override + Offset getPositionForChild(Size size, Size childSize) { + final anchorBottom = size.height - position.bottom; + final desiredX = switch (alignment) { + _ActivityPopoverAlignment.start => position.left + offset.dx, + _ActivityPopoverAlignment.end => + size.width - position.right - childSize.width + offset.dx, + }; + final minX = screenPadding.left; + final maxX = size.width - screenPadding.right - childSize.width; + final x = desiredX.clamp(minX, maxX).toDouble(); + + final belowY = anchorBottom + offset.dy; + final aboveY = position.top - childSize.height - offset.dy; + final maxY = size.height - screenPadding.bottom - childSize.height; + final desiredY = + belowY + childSize.height <= size.height - screenPadding.bottom + ? belowY + : aboveY; + final y = desiredY.clamp(screenPadding.top, maxY).toDouble(); + + return Offset(x, y); + } + + @override + bool shouldRelayout(_ActivityPopoverLayoutDelegate oldDelegate) { + return position != oldDelegate.position || + alignment != oldDelegate.alignment || + offset != oldDelegate.offset || + screenPadding != oldDelegate.screenPadding; + } +} diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart index f94226ac80..3e5140f844 100644 --- a/mobile/lib/features/channels/channel_detail_page.dart +++ b/mobile/lib/features/channels/channel_detail_page.dart @@ -2,6 +2,7 @@ import 'dart:async'; import 'dart:math' show min; import 'package:flutter/material.dart'; +import 'package:flutter/rendering.dart' show ScrollDirection; import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; @@ -12,6 +13,7 @@ import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; +import '../../shared/widgets/message_author_meta.dart'; import '../../shared/widgets/skeleton.dart'; import '../profile/presence_cache_provider.dart'; import '../profile/profile_provider.dart'; @@ -216,6 +218,7 @@ class ChannelDetailPage extends HookConsumerWidget { appBar: FrostedAppBar( iconColor: context.colors.primary, titleContentHeight: appBarTitleContentHeight, + titleStyle: channelTitleTextStyle, title: resolvedChannel.isDm ? _DmAppBarTitle( channel: resolvedChannel, diff --git a/mobile/lib/features/channels/channel_detail_page/app_bar.dart b/mobile/lib/features/channels/channel_detail_page/app_bar.dart index 251a6ea0b8..fbf5abfb3b 100644 --- a/mobile/lib/features/channels/channel_detail_page/app_bar.dart +++ b/mobile/lib/features/channels/channel_detail_page/app_bar.dart @@ -8,9 +8,9 @@ double _scaledTextHeight(BuildContext context, TextStyle style) { } double _dmAppBarTitleContentHeight(BuildContext context) { - final titleStyle = context.textTheme.titleSmall; + const titleStyle = channelTitleTextStyle; final presenceStyle = context.textTheme.bodySmall; - if (titleStyle == null || presenceStyle == null) { + if (presenceStyle == null) { return 30; } final textHeight = @@ -240,7 +240,7 @@ class _DmAppBarTitle extends ConsumerWidget { ), maxLines: 1, overflow: TextOverflow.ellipsis, - style: context.textTheme.titleSmall, + style: channelTitleTextStyle, ), ), if (channel.isEphemeral) ...[ diff --git a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart index 2a02b51c95..8e7ac95644 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart @@ -52,147 +52,171 @@ class _MessageBubble extends ConsumerWidget { } } - return GestureDetector( - behavior: HitTestBehavior.opaque, - onLongPress: () => showMessageActions( - context: context, - ref: ref, - message: message, - channelId: currentChannelId, - canManageMessage: canManageMessage, - allMessages: allMessages, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, - ), - child: Padding( - padding: EdgeInsets.only(top: showAuthor ? Grid.xs : Grid.half), - child: Row( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showAuthor) - GestureDetector( - onTap: () => showUserProfileSheet(context, message.pubkey), - child: _UserAvatar(profile: profile, pubkey: message.pubkey), - ) - else - const SizedBox(width: 36), - const SizedBox(width: Grid.xxs), - Expanded( - child: Transform.translate( - offset: Offset(0, showAuthor ? -Grid.quarter : 0), - child: Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showAuthor) - Padding( - padding: const EdgeInsets.only(bottom: Grid.quarter), - child: Row( - crossAxisAlignment: CrossAxisAlignment.center, - children: [ - GestureDetector( - onTap: () => - showUserProfileSheet(context, message.pubkey), - child: Text( - displayName, - style: context.textTheme.titleSmall?.copyWith( - fontWeight: FontWeight.w600, - color: context.colors.onSurface, + return Material( + color: Colors.transparent, + borderRadius: BorderRadius.circular(Radii.md), + clipBehavior: Clip.antiAlias, + child: InkWell( + key: ValueKey('message-row-${message.id}'), + borderRadius: BorderRadius.circular(Radii.md), + highlightColor: context.colors.primary.withValues(alpha: 0.1), + onLongPress: () => showMessageActions( + context: context, + ref: ref, + message: message, + channelId: currentChannelId, + canManageMessage: canManageMessage, + allMessages: allMessages, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + child: Padding( + padding: EdgeInsets.only( + top: showAuthor ? Grid.xs : Grid.xxs, + bottom: showAuthor ? 0 : Grid.xxs, + ), + child: Row( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showAuthor) + GestureDetector( + onTap: () => showUserProfileSheet(context, message.pubkey), + child: _UserAvatar(profile: profile, pubkey: message.pubkey), + ) + else + const SizedBox(width: messageAvatarSize), + const SizedBox(width: messageAvatarContentGap), + Expanded( + child: Transform.translate( + offset: Offset(0, showAuthor ? -Grid.quarter : 0), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showAuthor) + Padding( + padding: const EdgeInsets.only(bottom: Grid.quarter), + child: Row( + children: [ + Expanded( + child: MessageAuthorMeta( + displayName: displayName, + username: messageUsernameLabel(profile), + timestamp: formatMessageTime( + message.createdAt, + ), + nameColor: context.colors.onSurface, + metadataColor: + context.colors.onSurfaceVariant, + onAuthorTap: () => showUserProfileSheet( + context, + message.pubkey, + ), + displayNameKey: ValueKey( + 'message-author-${message.id}', + ), + usernameKey: ValueKey( + 'message-username-${message.id}', + ), + timestampKey: ValueKey( + 'message-timestamp-${message.id}', + ), ), ), - ), - const SizedBox(width: Grid.xxs), - _messageTimestamp(context, message.createdAt), - if (message.edited) ...[ - const SizedBox(width: Grid.half), - Text( - '(edited)', - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, - fontStyle: FontStyle.italic, + if (message.edited) ...[ + const SizedBox(width: Grid.half), + Text( + '(edited)', + style: context.textTheme.labelSmall?.copyWith( + color: context.colors.onSurfaceVariant, + fontStyle: FontStyle.italic, + ), ), - ), + ], ], - ], + ), ), - ), - MessageContent( - content: message.content, - mentionNames: mentionNames, - agentMentionPubkeys: agentMentionPubkeys, - channelNames: channelNames, - tags: message.tags, - baseStyle: context.textTheme.bodyLarge?.copyWith( - color: context.colors.onSurface, - ), - mediaCarouselTrailingOverflow: Grid.gutter, - onMediaReply: allMessages == null - ? null - : () { - if (!context.mounted) return; - Navigator.of(context).push( - MaterialPageRoute( - builder: (_) => ThreadDetailPage( - threadHead: message, - allMessages: allMessages!, - channelId: currentChannelId, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, + MessageContent( + content: message.content, + mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, + channelNames: channelNames, + tags: message.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), + mediaCarouselTrailingOverflow: Grid.gutter, + onMediaReply: allMessages == null + ? null + : () { + if (!context.mounted) return; + Navigator.of(context).push( + MaterialPageRoute( + builder: (_) => ThreadDetailPage( + threadHead: message, + allMessages: allMessages!, + channelId: currentChannelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), ), - ), - ); - }, - onMediaMore: (viewerContext, imageUrl) => - showImageActions( - context: viewerContext, + ); + }, + onMediaMore: (viewerContext, imageUrl) => + showImageActions( + context: viewerContext, + ref: ref, + message: message, + channelId: currentChannelId, + imageUrl: imageUrl, + canManageMessage: canManageMessage, + onDeleted: () { + if (viewerContext.mounted) { + Navigator.of(viewerContext).maybePop(); + } + }, + ), + onChannelTap: (channelId) { + openChannelLink( + context: context, ref: ref, - message: message, - channelId: currentChannelId, - imageUrl: imageUrl, - canManageMessage: canManageMessage, - onDeleted: () { - if (viewerContext.mounted) { - Navigator.of(viewerContext).maybePop(); - } - }, - ), - onChannelTap: (channelId) { - openChannelLink( - context: context, - ref: ref, - channelId: channelId, - currentChannelId: currentChannelId, - ); - }, - onMentionTap: (pubkey) => - showUserProfileSheet(context, pubkey), - ), - if (message.reactions.isNotEmpty) - ReactionRow( - reactions: message.reactions, - onToggle: (emoji) => - toggleReaction(ref, message, emoji), + channelId: channelId, + currentChannelId: currentChannelId, + ); + }, + onMentionTap: (pubkey) => + showUserProfileSheet(context, pubkey), ), - ], + if (message.reactions.isNotEmpty) + ReactionRow( + reactions: message.reactions, + onToggle: (emoji) => + toggleReaction(ref, message, emoji), + ), + ], + ), ), ), - ), - ], + ], + ), ), ), ); } } -Widget _messageTimestamp(BuildContext context, int createdAt) { - return Text( - formatMessageTime(createdAt), - style: context.textTheme.labelSmall?.copyWith( - fontSize: 14, - height: 22 / 14, - letterSpacing: context.textTheme.titleSmall?.letterSpacing, - color: context.colors.onSurfaceVariant, +Widget _messageTimestamp(BuildContext context, int createdAt, {Key? key}) { + return ConstrainedBox( + constraints: const BoxConstraints(maxWidth: Grid.xxl), + child: Text( + key: key, + formatMessageTime(createdAt), + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ); } @@ -205,7 +229,7 @@ class _UserAvatar extends StatelessWidget { const _UserAvatar({ required this.profile, required this.pubkey, - this.size = 36, + this.size = messageAvatarSize, }); @override diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart index 035cbb3051..af1293dd00 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_list.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart @@ -31,6 +31,11 @@ class _MessageList extends HookConsumerWidget { final isLoadingOlder = useState(false); final isAtLatest = useState(true); final hasUserScrolled = useState(false); + final followsLatest = useRef( + initialMessageId == null && initialThreadRootId == null, + ); + final isAutoScrolling = useRef(false); + final autoScrollScheduled = useRef(false); final latestEntryId = entries.isEmpty ? null : entries.last.message.id; final previousLatestEntryId = useRef(null); final didOpenInitialThread = useRef(false); @@ -47,24 +52,57 @@ class _MessageList extends HookConsumerWidget { } Future scrollToLatest() async { - if (!itemScrollController.isAttached) return; - await itemScrollController.scrollTo( - index: 0, - duration: const Duration(milliseconds: 220), - curve: Curves.easeOutCubic, + if (!itemScrollController.isAttached || isAutoScrolling.value) return; + followsLatest.value = true; + hasUserScrolled.value = false; + isAutoScrolling.value = true; + try { + await itemScrollController.scrollTo( + index: 0, + duration: const Duration(milliseconds: 220), + curve: Curves.easeOutCubic, + ); + if (context.mounted && !hasUserScrolled.value) { + isAtLatest.value = true; + } + } finally { + isAutoScrolling.value = false; + } + } + + void scheduleAutoScrollToLatest() { + if (autoScrollScheduled.value || isAutoScrolling.value) return; + autoScrollScheduled.value = true; + WidgetsBinding.instance.addPostFrameCallback((_) { + autoScrollScheduled.value = false; + if (!context.mounted || !followsLatest.value || hasUserScrolled.value) { + return; + } + scrollToLatest(); + }); + } + + bool latestIsAtBoundary() { + // In this reversed list, item 0's leading edge is the bottom boundary. + return itemPositionsListener.itemPositions.value.any( + (position) => position.index == 0 && position.itemLeadingEdge >= 0, ); - if (context.mounted) isAtLatest.value = true; } useEffect(() { void onPositionsChanged() { final positions = itemPositionsListener.itemPositions.value; if (positions.isEmpty) return; - final nextIsAtLatest = positions.any( - (position) => position.index == 0 && position.itemLeadingEdge < 1, - ); - if (isAtLatest.value != nextIsAtLatest) { - isAtLatest.value = nextIsAtLatest; + final nextIsAtLatest = latestIsAtBoundary(); + if (nextIsAtLatest) { + if (!isAtLatest.value) isAtLatest.value = true; + } else if (followsLatest.value && !hasUserScrolled.value) { + // The viewport can shrink when the composer or keyboard opens. + // Preserve auto-follow until the user scrolls the timeline. + if (!isAtLatest.value) isAtLatest.value = true; + scheduleAutoScrollToLatest(); + } else if (isAtLatest.value) { + isAtLatest.value = false; } final oldestVisible = positions @@ -124,8 +162,11 @@ class _MessageList extends HookConsumerWidget { } WidgetsBinding.instance.addPostFrameCallback((_) { if (!context.mounted || !itemScrollController.isAttached) return; - itemScrollController.jumpTo(index: targetIndex, alignment: 0.35); didJumpToInitialMessage.value = true; + followsLatest.value = false; + hasUserScrolled.value = false; + isAtLatest.value = false; + itemScrollController.jumpTo(index: targetIndex, alignment: 0.35); }); return null; }, [initialMessageId, initialThreadRootId, entries.length]); @@ -187,9 +228,18 @@ class _MessageList extends HookConsumerWidget { children: [ NotificationListener( onNotification: (notification) { - if (notification is ScrollStartNotification && - notification.dragDetails != null) { + if (notification is UserScrollNotification && + notification.direction != ScrollDirection.idle) { hasUserScrolled.value = true; + followsLatest.value = false; + } else if (notification is ScrollEndNotification && + hasUserScrolled.value) { + WidgetsBinding.instance.addPostFrameCallback((_) { + if (!context.mounted || !latestIsAtBoundary()) return; + hasUserScrolled.value = false; + followsLatest.value = true; + if (!isAtLatest.value) isAtLatest.value = true; + }); } return false; }, @@ -205,7 +255,7 @@ class _MessageList extends HookConsumerWidget { context, titleContentHeight: appBarTitleContentHeight, ), - bottom: Grid.xxs, + bottom: 0, ), itemCount: displayEntries.length + (isLoadingOlder.value ? 1 : 0), itemBuilder: (context, index) { @@ -248,46 +298,50 @@ class _MessageList extends HookConsumerWidget { message.pubkey.toLowerCase() || (message.createdAt - prevMessage.createdAt) > 300); - return Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showDayDivider) - DayDivider(label: formatDayHeading(message.createdAt)), - if (message.isSystem) - _SystemMessageRow( - message: message, - groupedMessages: entryGroup.length > 1 - ? entryGroup.map((entry) => entry.message).toList() - : null, - channelId: channelId, - currentPubkey: currentPubkey, - allMessages: null, - isMember: isMember, - isArchived: isArchived, - ) - else ...[ - _MessageBubble( - message: message, - showAuthor: showAuthor, - channelNames: channelNamesMap, - currentChannelId: channelId, - currentPubkey: currentPubkey, - allMessages: allMessages, - isMember: isMember, - isArchived: isArchived, - ), - if (entry.summary != null) - _ThreadSummaryRow( - summary: entry.summary!, + return Padding( + key: ValueKey('channel-message-group-${message.id}'), + padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showDayDivider) + DayDivider(label: formatDayHeading(message.createdAt)), + if (message.isSystem) + _SystemMessageRow( message: message, - allMessages: allMessages, + groupedMessages: entryGroup.length > 1 + ? entryGroup.map((entry) => entry.message).toList() + : null, channelId: channelId, currentPubkey: currentPubkey, + allMessages: null, + isMember: isMember, + isArchived: isArchived, + ) + else ...[ + _MessageBubble( + message: message, + showAuthor: showAuthor, + channelNames: channelNamesMap, + currentChannelId: channelId, + currentPubkey: currentPubkey, + allMessages: allMessages, isMember: isMember, isArchived: isArchived, ), + if (entry.summary != null) + _ThreadSummaryRow( + summary: entry.summary!, + message: message, + allMessages: allMessages, + channelId: channelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + ], ], - ], + ), ); }, ), diff --git a/mobile/lib/features/channels/channel_detail_page/system_rows.dart b/mobile/lib/features/channels/channel_detail_page/system_rows.dart index 8ff09b4e5c..f6019febab 100644 --- a/mobile/lib/features/channels/channel_detail_page/system_rows.dart +++ b/mobile/lib/features/channels/channel_detail_page/system_rows.dart @@ -30,6 +30,9 @@ class _SystemMessageRow extends ConsumerWidget { final channelCreator = systemEvent.type == SystemEventType.channelCreated ? systemEvent.actorPubkey?.trim() : null; + final usesMessageStyleLayout = + groupedMembership != null || + (channelCreator != null && channelCreator.isNotEmpty); String resolveLabel(String? pubkey) { if (pubkey == null) return 'Someone'; @@ -68,66 +71,83 @@ class _SystemMessageRow extends ConsumerWidget { } } - return GestureDetector( - behavior: HitTestBehavior.opaque, - onLongPress: () => showMessageActions( - context: context, - ref: ref, - message: message, - channelId: channelId, - canManageMessage: false, - allMessages: null, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, - ), - child: Padding( - padding: const EdgeInsets.symmetric(vertical: Grid.xxs), - child: Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (groupedMembership != null) - _MembershipSystemMessageContent( - event: groupedMembership, - createdAt: message.createdAt, - resolveLabel: resolveLabel, - userCache: userCache, - ) - else if (channelCreator != null && channelCreator.isNotEmpty) - _MessageStyleSystemMessageContent( - displayPubkey: channelCreator, - createdAt: message.createdAt, - resolveLabel: resolveLabel, - userCache: userCache, - actionSpans: const [TextSpan(text: 'created this channel')], - ) - else - Row( - children: [ - _systemEventAvatar(context, systemEvent, userCache), - const SizedBox(width: Grid.xxs), - Expanded( - child: Text( - systemEvent.describe(resolveLabel), - style: context.textTheme.bodyLarge?.copyWith( - color: context.colors.onSurfaceVariant, + return Material( + color: Colors.transparent, + borderRadius: BorderRadius.circular(Radii.md), + clipBehavior: Clip.antiAlias, + child: InkWell( + key: ValueKey('system-message-row-${message.id}'), + borderRadius: BorderRadius.circular(Radii.md), + highlightColor: context.colors.primary.withValues(alpha: 0.1), + onLongPress: () => showMessageActions( + context: context, + ref: ref, + message: message, + channelId: channelId, + canManageMessage: false, + allMessages: null, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + child: Padding( + padding: const EdgeInsets.symmetric(vertical: Grid.xxs), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (groupedMembership != null) + _MembershipSystemMessageContent( + event: groupedMembership, + createdAt: message.createdAt, + resolveLabel: resolveLabel, + userCache: userCache, + ) + else if (channelCreator != null && channelCreator.isNotEmpty) + _MessageStyleSystemMessageContent( + displayPubkey: channelCreator, + createdAt: message.createdAt, + resolveLabel: resolveLabel, + userCache: userCache, + actionSpans: const [TextSpan(text: 'created this channel')], + ) + else + Row( + children: [ + _systemEventAvatar(context, systemEvent, userCache), + const SizedBox(width: Grid.xxs), + Expanded( + child: Text( + systemEvent.describe(resolveLabel), + style: systemMessageBodyTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), + _messageTimestamp( + context, + message.createdAt, + key: ValueKey('system-message-timestamp-${message.id}'), + ), + ], + ), + if (reactions.isNotEmpty) + Padding( + padding: EdgeInsets.only( + left: + (usesMessageStyleLayout ? messageAvatarSize : 36) + + (usesMessageStyleLayout + ? messageAvatarContentGap + : Grid.xxs), + ), + child: ReactionRow( + reactions: reactions, + onToggle: groupedMessages == null + ? (emoji) => toggleReaction(ref, message, emoji) + : toggleGroupedReaction, ), - _messageTimestamp(context, message.createdAt), - ], - ), - if (reactions.isNotEmpty) - Padding( - padding: const EdgeInsets.only(left: 36 + Grid.xxs), - child: ReactionRow( - reactions: reactions, - onToggle: groupedMessages == null - ? (emoji) => toggleReaction(ref, message, emoji) - : toggleGroupedReaction, ), - ), - ], + ], + ), ), ), ); @@ -282,7 +302,7 @@ class _MembershipSystemMessageContent extends StatelessWidget { } TextStyle? _systemActionTextStyle(BuildContext context) { - return context.textTheme.bodyLarge?.copyWith( + return systemMessageBodyTextStyle.copyWith( color: context.colors.onSurfaceVariant, ); } @@ -310,28 +330,33 @@ class _MessageStyleSystemMessageContent extends StatelessWidget { _UserAvatar( profile: userCache[displayPubkey.toLowerCase()], pubkey: displayPubkey, - size: 36, + size: messageAvatarSize, ), - const SizedBox(width: Grid.xxs), + const SizedBox(width: messageAvatarContentGap), Expanded( child: Transform.translate( offset: const Offset(0, -Grid.quarter), child: Column( crossAxisAlignment: CrossAxisAlignment.start, children: [ - Row( - crossAxisAlignment: CrossAxisAlignment.center, - children: [ - Text( - resolveLabel(displayPubkey), - style: context.textTheme.titleSmall?.copyWith( - color: context.colors.onSurface, - fontWeight: FontWeight.w600, - ), - ), - const SizedBox(width: Grid.xxs), - _messageTimestamp(context, createdAt), - ], + MessageAuthorMeta( + displayName: resolveLabel(displayPubkey), + username: messageUsernameLabel( + userCache[displayPubkey.toLowerCase()], + ), + timestamp: formatMessageTime(createdAt), + nameColor: context.colors.onSurface, + metadataColor: context.colors.onSurfaceVariant, + nameStyle: systemMessageHeadingTextStyle, + displayNameKey: ValueKey( + 'system-message-author-$displayPubkey', + ), + usernameKey: ValueKey( + 'system-message-username-$displayPubkey', + ), + timestampKey: ValueKey( + 'system-message-timestamp-$displayPubkey', + ), ), Text.rich( TextSpan( @@ -482,10 +507,11 @@ class _ThreadSummaryRow extends ConsumerWidget { ); }, child: Padding( + key: ValueKey('thread-summary-${message.id}'), padding: const EdgeInsets.only( - left: 36 + Grid.xxs, + left: messageAvatarSize + messageAvatarContentGap, top: Grid.half, - bottom: Grid.half, + bottom: Grid.xs, ), child: Row( mainAxisSize: MainAxisSize.min, @@ -509,36 +535,38 @@ class _ThreadSummaryRow extends ConsumerWidget { ), ), const SizedBox(width: Grid.xxs), - Text.rich( - TextSpan( - children: [ - TextSpan( - text: - '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.primary, - fontWeight: FontWeight.w600, - ), - ), - if (summary.lastReplyAt case final lastReplyAt?) ...[ - TextSpan( - text: ' · ', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.onSurfaceVariant.withValues( - alpha: 0.5, - ), - ), - ), + Flexible( + child: Text.rich( + TextSpan( + children: [ TextSpan( text: - 'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.onSurfaceVariant, - fontWeight: FontWeight.w400, + '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}', + style: replyPreviewTextStyle.copyWith( + color: context.colors.primary, ), ), + if (summary.lastReplyAt case final lastReplyAt?) ...[ + TextSpan( + text: ' · ', + style: replyPreviewTextStyle.copyWith( + color: context.colors.onSurfaceVariant.withValues( + alpha: 0.5, + ), + ), + ), + TextSpan( + text: + 'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}', + style: replyPreviewTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ], ], - ], + ), + maxLines: 2, + overflow: TextOverflow.ellipsis, ), ), ], diff --git a/mobile/lib/features/channels/channels_page/channel_tile.dart b/mobile/lib/features/channels/channels_page/channel_tile.dart index 298383c369..551e3f8dd6 100644 --- a/mobile/lib/features/channels/channels_page/channel_tile.dart +++ b/mobile/lib/features/channels/channels_page/channel_tile.dart @@ -66,7 +66,7 @@ class _ChannelTile extends ConsumerWidget { ), maxLines: 1, overflow: TextOverflow.ellipsis, - style: context.textTheme.bodyLarge?.copyWith( + style: contentListTitleTextStyle.copyWith( color: context.colors.onSurface, fontWeight: isUnread ? FontWeight.w700 : FontWeight.w400, ), diff --git a/mobile/lib/features/channels/channels_page/sections.dart b/mobile/lib/features/channels/channels_page/sections.dart index 394f68f6f7..63bd5db9d9 100644 --- a/mobile/lib/features/channels/channels_page/sections.dart +++ b/mobile/lib/features/channels/channels_page/sections.dart @@ -154,7 +154,7 @@ class _CustomSectionHeader extends ConsumerWidget { const SizedBox(width: _kChannelLabelGap), Text( section.name, - style: context.textTheme.bodyLarge?.copyWith( + style: contentListTitleTextStyle.copyWith( color: sectionColor, fontWeight: FontWeight.w600, ), @@ -318,7 +318,7 @@ class _ChannelSection extends StatelessWidget { ), child: Text( emptyLabel, - style: context.textTheme.bodySmall?.copyWith( + style: contentListBodyTextStyle.copyWith( color: context.colors.onSurfaceVariant, ), ), @@ -430,7 +430,7 @@ class _SectionHeader extends StatelessWidget { const SizedBox(width: _kChannelLabelGap), Text( label, - style: context.textTheme.bodyLarge?.copyWith( + style: contentListTitleTextStyle.copyWith( color: sectionColor, fontWeight: FontWeight.w600, ), diff --git a/mobile/lib/features/channels/reaction_row.dart b/mobile/lib/features/channels/reaction_row.dart index 8814d698fb..2f2404ccf7 100644 --- a/mobile/lib/features/channels/reaction_row.dart +++ b/mobile/lib/features/channels/reaction_row.dart @@ -75,11 +75,10 @@ class ReactionRow extends StatelessWidget { const SizedBox(width: Grid.quarter), Text( '${reaction.count}', - style: context.textTheme.labelSmall?.copyWith( + style: reactionCountTextStyle.copyWith( color: reaction.reactedByCurrentUser ? context.colors.primary : context.colors.onSurfaceVariant, - fontWeight: FontWeight.w600, ), ), ], diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart index 32a1cf156a..a6d75a9f05 100644 --- a/mobile/lib/features/channels/thread_detail_page.dart +++ b/mobile/lib/features/channels/thread_detail_page.dart @@ -7,6 +7,7 @@ import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; +import '../../shared/widgets/message_author_meta.dart'; import '../profile/user_cache_provider.dart'; import '../profile/user_profile.dart'; import 'channel_link_navigation.dart'; @@ -153,11 +154,15 @@ class ThreadDetailPage extends HookConsumerWidget { }); return FrostedScaffold( - appBar: const FrostedAppBar(title: Text('Thread')), + appBar: const FrostedAppBar( + title: Text('Thread'), + titleStyle: channelTitleTextStyle, + ), body: Column( children: [ Expanded( child: ScrollablePositionedList.builder( + key: const ValueKey('thread-message-list'), itemScrollController: itemScrollController, // Reversed so the list opens pinned to the newest reply, // matching the channel message list. @@ -166,48 +171,54 @@ class ThreadDetailPage extends HookConsumerWidget { left: Grid.gutter, right: Grid.gutter, top: frostedAppBarHeight(context), - bottom: Grid.xxs, + bottom: 0, ), itemCount: replies.length + 1, // +1 for thread head itemBuilder: (context, index) { if (index == replies.length) { // Thread head. - return Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - DayDivider(label: formatDayHeading(liveHead.createdAt)), - _ThreadMessage( - message: liveHead, - channelNames: channelNamesMap, - channelId: channelId, - currentPubkey: currentPubkey, - showAuthor: true, - isHighlighted: liveHead.id == initialMessageId, - allMessages: allMsgs, - isMember: isMember, - isArchived: isArchived, - ), - Padding( - padding: const EdgeInsets.symmetric(vertical: Grid.xxs), - child: Row( - children: [ - Text( - '${replies.length} ${replies.length == 1 ? 'reply' : 'replies'}', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.onSurfaceVariant, - fontWeight: FontWeight.w600, + return Padding( + key: ValueKey('thread-message-group-${liveHead.id}'), + padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + DayDivider(label: formatDayHeading(liveHead.createdAt)), + _ThreadMessage( + message: liveHead, + channelNames: channelNamesMap, + channelId: channelId, + currentPubkey: currentPubkey, + showAuthor: true, + isHighlighted: liveHead.id == initialMessageId, + allMessages: allMsgs, + isMember: isMember, + isArchived: isArchived, + ), + Padding( + padding: const EdgeInsets.symmetric( + vertical: Grid.xxs, + ), + child: Row( + children: [ + Text( + '${replies.length} ${replies.length == 1 ? 'reply' : 'replies'}', + style: context.textTheme.labelMedium?.copyWith( + color: context.colors.onSurfaceVariant, + fontWeight: FontWeight.w600, + ), ), - ), - const SizedBox(width: Grid.xxs), - Expanded( - child: Divider( - color: context.colors.outlineVariant, + const SizedBox(width: Grid.xxs), + Expanded( + child: Divider( + color: context.colors.outlineVariant, + ), ), - ), - ], + ], + ), ), - ), - ], + ], + ), ); } @@ -221,7 +232,6 @@ class ThreadDetailPage extends HookConsumerWidget { reply.createdAt, ); final showAuthor = - reply.hasAttachments || prevReply == null || showDayDivider || prevReply.pubkey.toLowerCase() != @@ -235,33 +245,37 @@ class ThreadDetailPage extends HookConsumerWidget { ? _buildNestedSummary(reply.id, nestedChildren) : null; - return Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showDayDivider) - DayDivider(label: formatDayHeading(reply.createdAt)), - _ThreadMessage( - message: reply, - channelNames: channelNamesMap, - channelId: channelId, - currentPubkey: currentPubkey, - showAuthor: showAuthor, - isHighlighted: reply.id == initialMessageId, - allMessages: allMsgs, - isMember: isMember, - isArchived: isArchived, - ), - if (nestedSummary != null) - _NestedThreadSummaryRow( - summary: nestedSummary, - replyMessage: reply, - allMessages: allMsgs, + return Padding( + key: ValueKey('thread-message-group-${reply.id}'), + padding: EdgeInsets.only(bottom: index == 0 ? Grid.xs : 0), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showDayDivider) + DayDivider(label: formatDayHeading(reply.createdAt)), + _ThreadMessage( + message: reply, + channelNames: channelNamesMap, channelId: channelId, currentPubkey: currentPubkey, + showAuthor: showAuthor, + isHighlighted: reply.id == initialMessageId, + allMessages: allMsgs, isMember: isMember, isArchived: isArchived, ), - ], + if (nestedSummary != null) + _NestedThreadSummaryRow( + summary: nestedSummary, + replyMessage: reply, + allMessages: allMsgs, + channelId: channelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + ], + ), ); }, ), @@ -358,10 +372,11 @@ class _NestedThreadSummaryRow extends ConsumerWidget { ); }, child: Padding( + key: ValueKey('nested-thread-summary-${replyMessage.id}'), padding: const EdgeInsets.only( - left: 36 + Grid.xxs, + left: messageAvatarSize + messageAvatarContentGap, top: Grid.half, - bottom: Grid.half, + bottom: Grid.xs, ), child: Row( mainAxisSize: MainAxisSize.min, @@ -387,36 +402,38 @@ class _NestedThreadSummaryRow extends ConsumerWidget { ), ), const SizedBox(width: Grid.xxs), - Text.rich( - TextSpan( - children: [ - TextSpan( - text: - '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.primary, - fontWeight: FontWeight.w600, - ), - ), - if (summary.lastReplyAt case final lastReplyAt?) ...[ - TextSpan( - text: ' · ', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.onSurfaceVariant.withValues( - alpha: 0.5, - ), - ), - ), + Flexible( + child: Text.rich( + TextSpan( + children: [ TextSpan( text: - 'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}', - style: context.textTheme.labelMedium?.copyWith( - color: context.colors.onSurfaceVariant, - fontWeight: FontWeight.w400, + '${summary.replyCount} ${summary.replyCount == 1 ? 'reply' : 'replies'}', + style: replyPreviewTextStyle.copyWith( + color: context.colors.primary, ), ), + if (summary.lastReplyAt case final lastReplyAt?) ...[ + TextSpan( + text: ' · ', + style: replyPreviewTextStyle.copyWith( + color: context.colors.onSurfaceVariant.withValues( + alpha: 0.5, + ), + ), + ), + TextSpan( + text: + 'last reply ${formatThreadSummaryLastReplyTime(lastReplyAt)}', + style: replyPreviewTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ], ], - ], + ), + maxLines: 2, + overflow: TextOverflow.ellipsis, ), ), ], @@ -476,154 +493,166 @@ class _ThreadMessage extends ConsumerWidget { } } - return GestureDetector( - behavior: HitTestBehavior.opaque, - onLongPress: () => showMessageActions( - context: context, - ref: ref, - message: message, - channelId: channelId, - canManageMessage: canManageMessage, - allMessages: allMessages, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, + return DecoratedBox( + key: ValueKey('thread-message-${message.id}'), + decoration: BoxDecoration( + color: isHighlighted + ? context.colors.primary.withValues(alpha: 0.12) + : Colors.transparent, + borderRadius: BorderRadius.circular(Radii.md), ), - child: DecoratedBox( - key: ValueKey('thread-message-${message.id}'), - decoration: BoxDecoration( - color: isHighlighted - ? context.colors.primary.withValues(alpha: 0.12) - : Colors.transparent, - borderRadius: BorderRadius.circular(Grid.half), - ), - child: Padding( - padding: EdgeInsets.only(top: showAuthor ? Grid.xs : Grid.quarter), - child: Row( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showAuthor) - GestureDetector( - onTap: () => showUserProfileSheet(context, message.pubkey), - child: _Avatar(profile: profile, pubkey: message.pubkey), - ) - else - const SizedBox(width: 36), - const SizedBox(width: Grid.xxs), - Expanded( - child: Transform.translate( - offset: Offset(0, showAuthor ? -Grid.quarter : 0), - child: Column( - crossAxisAlignment: CrossAxisAlignment.start, - children: [ - if (showAuthor) - Padding( - padding: const EdgeInsets.only(bottom: Grid.quarter), - child: Row( - crossAxisAlignment: CrossAxisAlignment.center, - children: [ - GestureDetector( - onTap: () => showUserProfileSheet( - context, - message.pubkey, - ), - child: Text( - displayName, - style: context.textTheme.titleSmall?.copyWith( - fontWeight: FontWeight.w600, - color: context.colors.onSurface, + child: Material( + color: Colors.transparent, + borderRadius: BorderRadius.circular(Radii.md), + clipBehavior: Clip.antiAlias, + child: InkWell( + key: ValueKey('thread-message-row-${message.id}'), + borderRadius: BorderRadius.circular(Radii.md), + highlightColor: context.colors.primary.withValues(alpha: 0.1), + onLongPress: () => showMessageActions( + context: context, + ref: ref, + message: message, + channelId: channelId, + canManageMessage: canManageMessage, + allMessages: allMessages, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + child: Padding( + padding: EdgeInsets.only( + top: showAuthor ? Grid.xs : Grid.xxs, + bottom: showAuthor ? 0 : Grid.xxs, + ), + child: Row( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showAuthor) + GestureDetector( + onTap: () => showUserProfileSheet(context, message.pubkey), + child: _Avatar(profile: profile, pubkey: message.pubkey), + ) + else + const SizedBox(width: messageAvatarSize), + const SizedBox(width: messageAvatarContentGap), + Expanded( + child: Transform.translate( + offset: Offset(0, showAuthor ? -Grid.quarter : 0), + child: Column( + crossAxisAlignment: CrossAxisAlignment.start, + children: [ + if (showAuthor) + Padding( + padding: const EdgeInsets.only( + bottom: Grid.quarter, + ), + child: Row( + children: [ + Expanded( + child: MessageAuthorMeta( + displayName: displayName, + username: messageUsernameLabel(profile), + timestamp: formatMessageTime( + message.createdAt, + ), + nameColor: context.colors.onSurface, + metadataColor: + context.colors.onSurfaceVariant, + onAuthorTap: () => showUserProfileSheet( + context, + message.pubkey, + ), + displayNameKey: ValueKey( + 'thread-message-author-${message.id}', + ), + usernameKey: ValueKey( + 'thread-message-username-${message.id}', + ), + timestampKey: ValueKey( + 'thread-message-timestamp-${message.id}', + ), ), ), - ), - const SizedBox(width: Grid.xxs), - Text( - formatMessageTime(message.createdAt), - style: context.textTheme.labelSmall?.copyWith( - fontSize: 14, - height: 22 / 14, - letterSpacing: context - .textTheme - .titleSmall - ?.letterSpacing, - color: context.colors.onSurfaceVariant, - ), - ), - if (message.edited) ...[ - const SizedBox(width: Grid.half), - Text( - '(edited)', - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, - fontStyle: FontStyle.italic, + if (message.edited) ...[ + const SizedBox(width: Grid.half), + Text( + '(edited)', + style: context.textTheme.labelSmall + ?.copyWith( + color: + context.colors.onSurfaceVariant, + fontStyle: FontStyle.italic, + ), ), - ), + ], ], - ], + ), ), - ), - MessageContent( - content: message.content, - mentionNames: mentionNames, - agentMentionPubkeys: agentMentionPubkeys, - channelNames: channelNames, - tags: message.tags, - baseStyle: context.textTheme.bodyLarge?.copyWith( - color: context.colors.onSurface, - ), - mediaCarouselTrailingOverflow: Grid.gutter, - onMediaReply: allMessages == null - ? null - : () { - if (!context.mounted) return; - Navigator.of(context).push( - MaterialPageRoute( - builder: (_) => ThreadDetailPage( - threadHead: message, - allMessages: allMessages!, - channelId: channelId, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, + MessageContent( + content: message.content, + mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, + channelNames: channelNames, + tags: message.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), + mediaCarouselTrailingOverflow: Grid.gutter, + onMediaReply: allMessages == null + ? null + : () { + if (!context.mounted) return; + Navigator.of(context).push( + MaterialPageRoute( + builder: (_) => ThreadDetailPage( + threadHead: message, + allMessages: allMessages!, + channelId: channelId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), ), - ), - ); - }, - onMediaMore: (viewerContext, imageUrl) => - showImageActions( - context: viewerContext, + ); + }, + onMediaMore: (viewerContext, imageUrl) => + showImageActions( + context: viewerContext, + ref: ref, + message: message, + channelId: channelId, + imageUrl: imageUrl, + canManageMessage: canManageMessage, + onDeleted: () { + if (viewerContext.mounted) { + Navigator.of(viewerContext).maybePop(); + } + }, + ), + onChannelTap: (targetChannelId) { + openChannelLink( + context: context, ref: ref, - message: message, - channelId: channelId, - imageUrl: imageUrl, - canManageMessage: canManageMessage, - onDeleted: () { - if (viewerContext.mounted) { - Navigator.of(viewerContext).maybePop(); - } - }, - ), - onChannelTap: (targetChannelId) { - openChannelLink( - context: context, - ref: ref, - channelId: targetChannelId, - currentChannelId: channelId, - ); - }, - onMentionTap: (pubkey) => - showUserProfileSheet(context, pubkey), - ), - if (message.reactions.isNotEmpty) - ReactionRow( - reactions: message.reactions, - onToggle: (emoji) => - toggleReaction(ref, message, emoji), + channelId: targetChannelId, + currentChannelId: channelId, + ); + }, + onMentionTap: (pubkey) => + showUserProfileSheet(context, pubkey), ), - ], + if (message.reactions.isNotEmpty) + ReactionRow( + reactions: message.reactions, + onToggle: (emoji) => + toggleReaction(ref, message, emoji), + ), + ], + ), ), ), - ), - ], + ], + ), ), ), ), @@ -709,7 +738,7 @@ class _Avatar extends StatelessWidget { return AvatarImage( imageUrl: avatarUrl, - radius: 18, + radius: messageAvatarSize / 2, backgroundColor: context.colors.primaryContainer, fallback: Text( initial, diff --git a/mobile/lib/features/forum/forum_post_card.dart b/mobile/lib/features/forum/forum_post_card.dart index 7c1851ba54..8666919a4a 100644 --- a/mobile/lib/features/forum/forum_post_card.dart +++ b/mobile/lib/features/forum/forum_post_card.dart @@ -77,17 +77,22 @@ class ForumPostCard extends ConsumerWidget { onTap: () => showUserProfileSheet(context, post.pubkey), child: Text( displayName, - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w600, - ), + maxLines: 1, + style: messageUsernameTextStyle, overflow: TextOverflow.ellipsis, ), ), ), - Text( - formatRelativeTime(post.createdAt), - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + const SizedBox(width: Grid.xxs), + ConstrainedBox( + constraints: const BoxConstraints(maxWidth: Grid.xxl), + child: Text( + formatRelativeTime(post.createdAt), + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), const SizedBox(width: Grid.half), @@ -124,6 +129,9 @@ class ForumPostCard extends ConsumerWidget { content: preview, mentionNames: mentionNames, tags: post.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), ), ), ), diff --git a/mobile/lib/features/forum/forum_thread_page.dart b/mobile/lib/features/forum/forum_thread_page.dart index 4a4c0d0ab8..f7da19be12 100644 --- a/mobile/lib/features/forum/forum_thread_page.dart +++ b/mobile/lib/features/forum/forum_thread_page.dart @@ -335,22 +335,29 @@ class _OriginalPost extends ConsumerWidget { ), const SizedBox(width: Grid.xxs), Expanded( - child: Column( - crossAxisAlignment: CrossAxisAlignment.start, + child: Row( children: [ - GestureDetector( - onTap: () => showUserProfileSheet(context, post.pubkey), - child: Text( - displayName, - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w600, + Expanded( + child: GestureDetector( + onTap: () => showUserProfileSheet(context, post.pubkey), + child: Text( + displayName, + maxLines: 1, + style: messageUsernameTextStyle, + overflow: TextOverflow.ellipsis, ), ), ), - Text( - formatRelativeTime(post.createdAt), - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + const SizedBox(width: Grid.xxs), + ConstrainedBox( + constraints: const BoxConstraints(maxWidth: Grid.xxl), + child: Text( + formatRelativeTime(post.createdAt), + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), ], @@ -363,6 +370,9 @@ class _OriginalPost extends ConsumerWidget { content: post.content, mentionNames: mentionNames, tags: post.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), onMentionTap: (pubkey) => showUserProfileSheet(context, pubkey), ), ], @@ -417,20 +427,28 @@ class _ReplyRow extends ConsumerWidget { Expanded( child: Row( children: [ - GestureDetector( - onTap: () => showUserProfileSheet(context, reply.pubkey), - child: Text( - displayName, - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w600, + Expanded( + child: GestureDetector( + onTap: () => + showUserProfileSheet(context, reply.pubkey), + child: Text( + displayName, + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageUsernameTextStyle, ), ), ), const SizedBox(width: Grid.xxs), - Text( - formatRelativeTime(reply.createdAt), - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + ConstrainedBox( + constraints: const BoxConstraints(maxWidth: Grid.xxl), + child: Text( + formatRelativeTime(reply.createdAt), + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), ], @@ -458,6 +476,9 @@ class _ReplyRow extends ConsumerWidget { content: reply.content, mentionNames: mentionNames, tags: reply.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), onMentionTap: (pubkey) => showUserProfileSheet(context, pubkey), ), ), diff --git a/mobile/lib/features/profile/user_profile.dart b/mobile/lib/features/profile/user_profile.dart index 4e74159016..de58d955e3 100644 --- a/mobile/lib/features/profile/user_profile.dart +++ b/mobile/lib/features/profile/user_profile.dart @@ -39,3 +39,10 @@ class UserProfile { (displayName?.isNotEmpty == true ? displayName! : pubkey)[0] .toUpperCase(); } + +/// Optional profile handle shown beside a message author's display name. +String? messageUsernameLabel(UserProfile? profile) { + final handle = profile?.nip05Handle?.trim(); + if (handle != null && handle.isNotEmpty) return handle; + return null; +} diff --git a/mobile/lib/features/pulse/compose_note_page.dart b/mobile/lib/features/pulse/compose_note_page.dart index 2c514d6a71..240cd980d7 100644 --- a/mobile/lib/features/pulse/compose_note_page.dart +++ b/mobile/lib/features/pulse/compose_note_page.dart @@ -198,20 +198,24 @@ class _ReplyContext extends ConsumerWidget { children: [ Row( children: [ - Flexible( + Expanded( child: Text( displayName, - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w700, - ), + maxLines: 1, + style: messageUsernameTextStyle, overflow: TextOverflow.ellipsis, ), ), const SizedBox(width: Grid.half), - Text( - formatPulseRelativeTime(note.createdAt), - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + ConstrainedBox( + constraints: const BoxConstraints(maxWidth: Grid.xxl), + child: Text( + formatPulseRelativeTime(note.createdAt), + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), ], @@ -229,6 +233,9 @@ class _ReplyContext extends ConsumerWidget { child: MessageContent( content: note.content, tags: note.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), ), ), ), diff --git a/mobile/lib/features/pulse/note_card.dart b/mobile/lib/features/pulse/note_card.dart index 6caf1dad6a..d99e3ada4b 100644 --- a/mobile/lib/features/pulse/note_card.dart +++ b/mobile/lib/features/pulse/note_card.dart @@ -89,33 +89,47 @@ class NoteCard extends HookConsumerWidget { onTap: () => showUserProfileSheet(context, note.pubkey), child: Row( children: [ - Flexible( + Expanded( + child: Row( + mainAxisSize: MainAxisSize.min, + children: [ + Flexible( + child: Text( + displayName, + maxLines: 1, + style: messageUsernameTextStyle, + overflow: TextOverflow.ellipsis, + ), + ), + if (isAgent) ...[ + const SizedBox(width: Grid.half), + Icon( + LucideIcons.bot, + size: 13, + color: context.colors.primary, + ), + ], + ], + ), + ), + const SizedBox(width: Grid.xxs), + ConstrainedBox( + constraints: const BoxConstraints( + maxWidth: Grid.xl, + ), child: Text( - displayName, - style: context.textTheme.labelMedium?.copyWith( - fontWeight: FontWeight.w700, - ), + formatPulseRelativeTime(note.createdAt), + maxLines: 1, overflow: TextOverflow.ellipsis, + style: messageTimestampTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), ), ), - if (isAgent) ...[ - const SizedBox(width: Grid.half), - Icon( - LucideIcons.bot, - size: 13, - color: context.colors.primary, - ), - ], ], ), ), ), - Text( - formatPulseRelativeTime(note.createdAt), - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, - ), - ), if (canFollow) ...[ const SizedBox(width: Grid.half), _FollowButton( @@ -142,7 +156,13 @@ class NoteCard extends HookConsumerWidget { ), ], const SizedBox(height: Grid.half), - MessageContent(content: note.content, tags: note.tags), + MessageContent( + content: note.content, + tags: note.tags, + baseStyle: messageBodyTextStyle.copyWith( + color: context.colors.onSurface, + ), + ), const SizedBox(height: Grid.xxs), Row( children: [ diff --git a/mobile/lib/features/search/recent_searches_provider.dart b/mobile/lib/features/search/recent_searches_provider.dart new file mode 100644 index 0000000000..813672a9cc --- /dev/null +++ b/mobile/lib/features/search/recent_searches_provider.dart @@ -0,0 +1,64 @@ +import 'package:hooks_riverpod/hooks_riverpod.dart'; + +import '../../shared/relay/relay.dart'; +import '../../shared/theme/theme_provider.dart'; + +const _recentSearchesPrefsKey = 'recent_searches_v1'; +const _maxRecentSearches = 6; + +/// Device-local history of explicitly submitted searches, newest first. +/// +/// Queries are scoped by community and account so searches from one identity +/// cannot appear after switching to another. +class RecentSearchesNotifier extends Notifier> { + late String _prefsKey; + + @override + List build() { + final config = ref.watch(relayConfigProvider); + final pubkey = ref.watch(myPubkeyProvider) ?? 'anon'; + _prefsKey = '$_recentSearchesPrefsKey:${config.baseUrl}:$pubkey'; + + final stored = + ref.read(savedPrefsProvider).getStringList(_prefsKey) ?? const []; + return List.unmodifiable( + stored + .map((query) => query.trim()) + .where((query) => query.isNotEmpty) + .take(_maxRecentSearches), + ); + } + + /// Records [query] as the most recent search after trimming whitespace. + /// + /// Empty queries are ignored. Existing matches are deduplicated + /// case-insensitively, the newest spelling is retained, the history is capped + /// at six entries, and the result is persisted for the current community and + /// account. + void record(String query) { + final trimmed = query.trim(); + if (trimmed.isEmpty) return; + + final normalized = trimmed.toLowerCase(); + final next = [ + trimmed, + ...state.where((item) => item.toLowerCase() != normalized), + ].take(_maxRecentSearches).toList(growable: false); + _persist(next); + } + + /// Clears the current community and account's history and persists it empty. + void clear() => _persist(const []); + + void _persist(List searches) { + state = List.unmodifiable(searches); + ref.read(savedPrefsProvider).setStringList(_prefsKey, searches); + } +} + +/// Provides device-local recent searches scoped to the active community and +/// account. +final recentSearchesProvider = + NotifierProvider>( + RecentSearchesNotifier.new, + ); diff --git a/mobile/lib/features/search/search_page.dart b/mobile/lib/features/search/search_page.dart index 635169f0de..1809dc7437 100644 --- a/mobile/lib/features/search/search_page.dart +++ b/mobile/lib/features/search/search_page.dart @@ -8,6 +8,7 @@ import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/filter_chip_bar.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; +import '../../shared/widgets/message_author_meta.dart'; import '../channels/channel.dart'; import '../channels/channel_detail_page.dart'; import '../channels/channel_management_provider.dart'; @@ -19,20 +20,22 @@ import '../forum/forum_thread_page.dart'; import '../profile/profile_provider.dart'; import '../profile/user_cache_provider.dart'; import '../profile/user_profile.dart'; +import 'recent_searches_provider.dart'; import 'search_provider.dart'; enum _SearchFilter { all, messages, channels, people } const _searchFieldMinHeight = 36.0; const _searchFieldVerticalPadding = Grid.xxs; +const _searchFieldHint = 'Search messages, channels, people\u2026'; +const _searchCancelEnterDuration = Duration(milliseconds: 160); +const _searchCancelExitDuration = Duration(milliseconds: 120); double _searchFieldHeight(BuildContext context) { - final style = - context.textTheme.bodyMedium ?? - const TextStyle(fontSize: 14, height: 1.3); + const style = searchInputTextStyle; final scaledFontSize = MediaQuery.textScalerOf( context, - ).scale(style.fontSize ?? 14); + ).scale(style.fontSize ?? 15); final contentHeight = scaledFontSize * (style.height ?? 1) + _searchFieldVerticalPadding * 2; return contentHeight > _searchFieldMinHeight @@ -52,10 +55,12 @@ class SearchPage extends HookConsumerWidget { .value; final activeFilter = useState(_SearchFilter.all); final textController = useTextEditingController(); - final hasText = useListenableSelector( - textController, - () => textController.text.isNotEmpty, + final focusNode = useFocusNode(); + final isSearchFocused = useListenableSelector( + focusNode, + () => focusNode.hasFocus, ); + final reduceMotion = MediaQuery.disableAnimationsOf(context); final isBuzzTheme = context.appColors.topSectionGradient != null; final buzzSearchColor = context.theme.brightness == Brightness.dark ? Colors.white @@ -71,7 +76,20 @@ class SearchPage extends HookConsumerWidget { fontWeight: FontWeight.w600, ); final searchFieldHeight = _searchFieldHeight(context); - final searchHeaderBottomHeight = searchFieldHeight + Grid.twelve; + final searchControlHeight = searchFieldHeight > Grid.xl + ? searchFieldHeight + : Grid.xl; + final searchHeaderBottomHeight = searchControlHeight + Grid.twelve; + + void runRecentSearch(String query) { + textController.value = TextEditingValue( + text: query, + selection: TextSelection.collapsed(offset: query.length), + ); + focusNode.requestFocus(); + ref.read(recentSearchesProvider.notifier).record(query); + ref.read(searchProvider.notifier).search(query); + } return FrostedScaffold( // Keep the empty state centered in the page rather than the portion left @@ -89,51 +107,120 @@ class SearchPage extends HookConsumerWidget { Grid.gutter, Grid.twelve, ), - child: Container( - key: const Key('search-field-container'), - height: searchFieldHeight, - padding: const EdgeInsets.symmetric(horizontal: Grid.half), - decoration: BoxDecoration( - color: searchSurfaceColor, - borderRadius: BorderRadius.circular(Radii.lg), - ), - child: TextField( - controller: textController, - decoration: InputDecoration( - hintText: 'Search messages, channels, people\u2026', - hintStyle: context.textTheme.bodyMedium?.copyWith( - color: searchMutedColor, - ), - prefixIcon: Icon( - LucideIcons.search, - size: 16, - color: searchMutedColor, - ), - prefixIconConstraints: const BoxConstraints(minWidth: 32), - border: InputBorder.none, - enabledBorder: InputBorder.none, - focusedBorder: InputBorder.none, - isDense: true, - contentPadding: const EdgeInsets.symmetric( - vertical: _searchFieldVerticalPadding, + child: Row( + children: [ + Expanded( + child: Container( + key: const Key('search-field-container'), + height: searchFieldHeight, + padding: const EdgeInsets.symmetric(horizontal: Grid.half), + decoration: BoxDecoration( + color: searchSurfaceColor, + borderRadius: BorderRadius.circular(Radii.lg), + ), + child: TextField( + key: const Key('search-field'), + controller: textController, + focusNode: focusNode, + decoration: InputDecoration( + hintText: isSearchFocused ? null : _searchFieldHint, + hintStyle: searchInputTextStyle.copyWith( + color: searchMutedColor, + ), + prefixIcon: Icon( + LucideIcons.search, + size: 16, + color: searchMutedColor, + ), + prefixIconConstraints: const BoxConstraints(minWidth: 32), + border: InputBorder.none, + enabledBorder: InputBorder.none, + focusedBorder: InputBorder.none, + isDense: true, + contentPadding: const EdgeInsets.symmetric( + vertical: _searchFieldVerticalPadding, + ), + ), + style: searchInputTextStyle.copyWith( + color: context.colors.onSurface, + ), + textInputAction: TextInputAction.search, + onChanged: (value) => + ref.read(searchProvider.notifier).search(value), + onSubmitted: (value) { + final query = value.trim(); + if (query.isEmpty) return; + ref.read(recentSearchesProvider.notifier).record(query); + }, + ), ), ), - style: context.textTheme.bodyMedium, - onChanged: (value) => - ref.read(searchProvider.notifier).search(value), - ), + AnimatedSwitcher( + duration: reduceMotion + ? Duration.zero + : _searchCancelEnterDuration, + reverseDuration: reduceMotion + ? Duration.zero + : _searchCancelExitDuration, + transitionBuilder: (child, animation) { + final curvedAnimation = CurvedAnimation( + parent: animation, + curve: Curves.easeOutCubic, + reverseCurve: Curves.easeInCubic, + ); + return SizeTransition( + sizeFactor: curvedAnimation, + axis: Axis.horizontal, + axisAlignment: 1, + child: FadeTransition( + opacity: curvedAnimation, + child: SlideTransition( + position: Tween( + begin: const Offset(0.35, 0), + end: Offset.zero, + ).animate(curvedAnimation), + child: child, + ), + ), + ); + }, + child: isSearchFocused + ? Padding( + key: const ValueKey('search-cancel-visible'), + padding: const EdgeInsets.only(left: Grid.xxs), + child: TextButton( + key: const Key('search-cancel'), + onPressed: () { + textController.clear(); + ref.read(searchProvider.notifier).clear(); + focusNode.unfocus(); + }, + style: TextButton.styleFrom( + foregroundColor: context.colors.primary, + minimumSize: Size(0, searchControlHeight), + padding: const EdgeInsets.symmetric( + horizontal: Grid.half, + vertical: Grid.xxs, + ), + tapTargetSize: MaterialTapTargetSize.shrinkWrap, + ), + child: Text( + 'Cancel', + style: filterChipTextStyle.copyWith( + color: context.colors.primary, + fontWeight: FontWeight.w500, + ), + ), + ), + ) + : const SizedBox.shrink( + key: ValueKey('search-cancel-hidden'), + ), + ), + ], ), ), - actions: [ - if (hasText) - IconButton( - icon: const Icon(LucideIcons.x, size: 20), - onPressed: () { - textController.clear(); - ref.read(searchProvider.notifier).clear(); - }, - ), - ], + actions: const [], ), body: Column( crossAxisAlignment: CrossAxisAlignment.stretch, @@ -162,6 +249,7 @@ class SearchPage extends HookConsumerWidget { state: searchState, filter: activeFilter.value, currentPubkey: currentPubkey, + onRecentSearchSelected: runRecentSearch, ), ), ], @@ -174,16 +262,27 @@ class _SearchBody extends ConsumerWidget { final SearchState state; final _SearchFilter filter; final String? currentPubkey; + final ValueChanged onRecentSearchSelected; const _SearchBody({ required this.state, required this.filter, required this.currentPubkey, + required this.onRecentSearchSelected, }); @override Widget build(BuildContext context, WidgetRef ref) { if (state.query.isEmpty) { + final recentSearches = ref.watch(recentSearchesProvider); + if (recentSearches.isNotEmpty) { + return _RecentSearches( + searches: recentSearches, + onSelected: onRecentSearchSelected, + onClear: ref.read(recentSearchesProvider.notifier).clear, + ); + } + return Center( child: Padding( key: const Key('search-empty-state'), @@ -221,6 +320,8 @@ class _SearchBody extends ConsumerWidget { state.channelResults.isNotEmpty || state.userResults.isNotEmpty || state.messageResults.isNotEmpty; + void recordResultSelection() => + ref.read(recentSearchesProvider.notifier).record(state.query); if (!state.isLoading && !hasAnyResults) { return Padding( @@ -246,13 +347,20 @@ class _SearchBody extends ConsumerWidget { ), children: [ if (showChannels && state.channelResults.isNotEmpty) - _ChannelsSection(channels: state.channelResults), + _ChannelsSection( + channels: state.channelResults, + onResultSelected: recordResultSelection, + ), if (showPeople && state.userResults.isNotEmpty) - _PeopleSection(users: state.userResults), + _PeopleSection( + users: state.userResults, + onResultSelected: recordResultSelection, + ), if (showMessages && state.messageResults.isNotEmpty) _MessagesSection( hits: state.messageResults, currentPubkey: currentPubkey, + onResultSelected: recordResultSelection, ), if (state.isLoading) const Padding( @@ -264,10 +372,106 @@ class _SearchBody extends ConsumerWidget { } } +class _RecentSearches extends StatelessWidget { + final List searches; + final ValueChanged onSelected; + final VoidCallback onClear; + + const _RecentSearches({ + required this.searches, + required this.onSelected, + required this.onClear, + }); + + @override + Widget build(BuildContext context) { + return ListView( + key: const Key('recent-searches-list'), + padding: EdgeInsets.only( + bottom: Grid.xl + MediaQuery.viewInsetsOf(context).bottom, + ), + children: [ + Padding( + padding: const EdgeInsets.fromLTRB( + Grid.gutter, + Grid.xs, + Grid.xxs, + Grid.half, + ), + child: Row( + children: [ + Expanded( + child: Text( + 'Recent searches', + key: const Key('recent-searches-heading'), + style: activityContextTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ), + TextButton( + key: const Key('clear-recent-searches'), + onPressed: onClear, + child: Text( + 'Clear', + style: activityContextTextStyle.copyWith( + color: context.colors.primary, + ), + ), + ), + ], + ), + ), + for (var index = 0; index < searches.length; index++) + InkWell( + key: ValueKey('recent-search-$index'), + onTap: () => onSelected(searches[index]), + child: ConstrainedBox( + constraints: const BoxConstraints(minHeight: Grid.xl), + child: Padding( + padding: const EdgeInsets.symmetric( + horizontal: Grid.gutter, + vertical: Grid.twelve, + ), + child: Row( + children: [ + Icon( + LucideIcons.clock, + size: 18, + color: context.colors.onSurfaceVariant, + ), + const SizedBox(width: Grid.twelve), + Expanded( + child: Text( + searches[index], + style: contentListTitleTextStyle.copyWith( + color: context.colors.onSurface, + ), + ), + ), + Icon( + LucideIcons.chevronRight, + size: 16, + color: context.colors.onSurfaceVariant, + ), + ], + ), + ), + ), + ), + ], + ); + } +} + class _ChannelsSection extends StatelessWidget { final List channels; + final VoidCallback onResultSelected; - const _ChannelsSection({required this.channels}); + const _ChannelsSection({ + required this.channels, + required this.onResultSelected, + }); @override Widget build(BuildContext context) { @@ -277,11 +481,21 @@ class _ChannelsSection extends StatelessWidget { _SectionLabel(label: 'Channels'), for (final channel in channels) ListTile( - leading: Icon(channelIcon(channel), size: 20), - title: Text(channel.name), + key: ValueKey('search-channel-row-${channel.id}'), + contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter), + leading: Icon( + channelIcon(channel), + key: ValueKey('search-channel-leading-${channel.id}'), + size: 20, + ), + title: Text( + channel.name, + key: ValueKey('search-channel-title-${channel.id}'), + style: contentListTitleTextStyle, + ), subtitle: Text( '${channel.memberCount} member${channel.memberCount == 1 ? '' : 's'}', - style: context.textTheme.bodySmall?.copyWith( + style: contentListBodyTextStyle.copyWith( color: context.colors.onSurfaceVariant, ), ), @@ -304,11 +518,14 @@ class _ChannelsSection extends StatelessWidget { ), ) : null, - onTap: () => Navigator.of(context).push( - MaterialPageRoute( - builder: (_) => ChannelDetailPage(channel: channel), - ), - ), + onTap: () { + onResultSelected(); + Navigator.of(context).push( + MaterialPageRoute( + builder: (_) => ChannelDetailPage(channel: channel), + ), + ); + }, ), ], ); @@ -317,8 +534,9 @@ class _ChannelsSection extends StatelessWidget { class _PeopleSection extends ConsumerWidget { final List users; + final VoidCallback onResultSelected; - const _PeopleSection({required this.users}); + const _PeopleSection({required this.users, required this.onResultSelected}); @override Widget build(BuildContext context, WidgetRef ref) { @@ -328,19 +546,27 @@ class _PeopleSection extends ConsumerWidget { _SectionLabel(label: 'People'), for (final user in users) ListTile( + key: ValueKey('search-person-row-${user.pubkey}'), + contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter), leading: AvatarImage( + key: ValueKey('search-person-leading-${user.pubkey}'), imageUrl: user.avatarUrl, radius: 20, fallback: Text(user.label.substring(0, 1).toUpperCase()), ), - title: Text(user.label), + title: Text( + user.label, + key: ValueKey('search-person-title-${user.pubkey}'), + style: contentListTitleTextStyle, + ), subtitle: Text( user.secondaryLabel, - style: context.textTheme.bodySmall?.copyWith( + style: contentListBodyTextStyle.copyWith( color: context.colors.onSurfaceVariant, ), ), onTap: () async { + onResultSelected(); final channel = await ref .read(channelActionsProvider) .openDm(pubkeys: [user.pubkey]); @@ -360,8 +586,13 @@ class _PeopleSection extends ConsumerWidget { class _MessagesSection extends ConsumerWidget { final List hits; final String? currentPubkey; + final VoidCallback onResultSelected; - const _MessagesSection({required this.hits, required this.currentPubkey}); + const _MessagesSection({ + required this.hits, + required this.currentPubkey, + required this.onResultSelected, + }); @override Widget build(BuildContext context, WidgetRef ref) { @@ -383,6 +614,7 @@ class _MessagesSection extends ConsumerWidget { userCache: profiles, channel: channels.where((c) => c.id == hit.channelId).firstOrNull, currentPubkey: currentPubkey, + onResultSelected: onResultSelected, ), ], ); @@ -395,6 +627,7 @@ class _MessageTile extends StatelessWidget { final Map userCache; final Channel? channel; final String? currentPubkey; + final VoidCallback onResultSelected; const _MessageTile({ required this.hit, @@ -402,68 +635,99 @@ class _MessageTile extends StatelessWidget { required this.userCache, required this.channel, required this.currentPubkey, + required this.onResultSelected, }); @override Widget build(BuildContext context) { final authorName = authorProfile?.label ?? shortPubkey(hit.pubkey); final timeAgo = relativeTime(hit.createdAt); + final channelName = hit.channelName?.trim().replaceFirst(RegExp(r'^#'), ''); + final hasChannelName = channelName != null && channelName.isNotEmpty; + final isDm = channel?.isDm ?? false; return ListTile( - leading: SmallAvatar(pubkey: hit.pubkey, userCache: userCache), - title: Row( - children: [ - Expanded( - child: Text( - authorName, - maxLines: 1, - overflow: TextOverflow.ellipsis, - style: context.textTheme.bodyMedium?.copyWith( - fontWeight: FontWeight.w600, - ), - ), - ), - if (hit.channelName != null) ...[ - const SizedBox(width: Grid.half), - Container( - padding: const EdgeInsets.symmetric( - horizontal: Grid.half, - vertical: 2, - ), - decoration: BoxDecoration( - color: context.colors.surfaceContainerHighest, - borderRadius: BorderRadius.circular(Radii.sm), - ), - child: Text( - hit.channelName!, - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, - ), - ), - ), - ], - ], + key: ValueKey('search-message-row-${hit.eventId}'), + contentPadding: const EdgeInsets.symmetric(horizontal: Grid.gutter), + titleAlignment: ListTileTitleAlignment.top, + horizontalTitleGap: messageAvatarContentGap, + leading: SmallAvatar( + key: ValueKey('search-message-avatar-${hit.eventId}'), + pubkey: hit.pubkey, + userCache: userCache, + size: compactMessageAvatarSize, + ), + title: MessageAuthorMeta( + displayName: authorName, + username: messageUsernameLabel(authorProfile), + timestamp: timeAgo, + nameColor: context.colors.onSurface, + metadataColor: context.colors.onSurfaceVariant, + displayNameKey: ValueKey('search-message-author-${hit.eventId}'), + usernameKey: ValueKey('search-message-username-${hit.eventId}'), + timestampKey: ValueKey('search-message-timestamp-${hit.eventId}'), ), subtitle: Column( crossAxisAlignment: CrossAxisAlignment.start, children: [ const SizedBox(height: 2), + Row( + key: ValueKey('search-message-context-${hit.eventId}'), + children: [ + Flexible( + child: Text( + isDm + ? 'Direct message' + : hasChannelName + ? 'Message in' + : 'Message', + style: activityContextTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), + overflow: TextOverflow.ellipsis, + ), + ), + if (!isDm && hasChannelName) ...[ + const SizedBox(width: Grid.half), + Flexible( + child: Container( + padding: const EdgeInsets.symmetric( + horizontal: Grid.half + Grid.quarter, + vertical: Grid.quarter / 2, + ), + decoration: BoxDecoration( + color: context.colors.surfaceContainerHighest, + borderRadius: BorderRadius.circular(Radii.xs), + ), + child: Text( + '#$channelName', + key: ValueKey('search-message-channel-${hit.eventId}'), + style: activityContextTextStyle.copyWith( + color: context.colors.onSurfaceVariant, + ), + overflow: TextOverflow.ellipsis, + ), + ), + ), + ], + ], + ), + const SizedBox(height: Grid.half), MessageContent( + key: ValueKey('search-message-body-${hit.eventId}'), content: hit.content, tags: hit.tags, maxLines: 2, - baseStyle: context.textTheme.bodyMedium, - ), - const SizedBox(height: 2), - Text( - timeAgo, - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + baseStyle: activityPreviewTextStyle.copyWith( + color: context.colors.onSurface, ), ), ], ), - onTap: () => _navigateToHit(context, hit, channel), + onTap: () { + onResultSelected(); + _navigateToHit(context, hit, channel); + }, ); } @@ -507,11 +771,10 @@ class _SectionLabel extends StatelessWidget { Grid.half, ), child: Text( - label.toUpperCase(), - style: context.textTheme.labelSmall?.copyWith( + label, + key: ValueKey('search-section-${label.toLowerCase()}'), + style: activityContextTextStyle.copyWith( color: context.colors.onSurfaceVariant, - fontWeight: FontWeight.w600, - letterSpacing: 0.8, ), ), ); diff --git a/mobile/lib/shared/theme/message_typography.dart b/mobile/lib/shared/theme/message_typography.dart new file mode 100644 index 0000000000..1073626390 --- /dev/null +++ b/mobile/lib/shared/theme/message_typography.dart @@ -0,0 +1,131 @@ +import 'package:flutter/material.dart'; + +import 'grid.dart'; + +const _fontFamily = 'Inter'; + +/// Avatar size for full channel and thread messages. +const messageAvatarSize = 42.0; + +/// Avatar size for conversation-oriented Activity rows. +const activityAvatarSize = messageAvatarSize; + +/// Avatar size for compact message-result rows. +const compactMessageAvatarSize = messageAvatarSize; + +/// Horizontal space between a message avatar and its content. +const messageAvatarContentGap = Grid.twelve; + +/// Primary message copy: 15sp regular on a 20sp line height. +const messageBodyTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 15, + fontWeight: FontWeight.w400, + height: 20 / 15, + letterSpacing: 0, +); + +/// Message author names: 15sp semibold on a 17sp line height. +const messageUsernameTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 15, + fontWeight: FontWeight.w600, + height: 17 / 15, + letterSpacing: 0, +); + +/// Secondary author metadata: 15sp regular on a tight 17sp line height. +const messageMetadataTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 15, + fontWeight: FontWeight.w400, + height: 17 / 15, + letterSpacing: 0, +); + +/// Message timestamps share the secondary author metadata style. +const messageTimestampTextStyle = messageMetadataTextStyle; + +/// Compact reply previews: 13.1sp regular on a 17sp line height. +const replyPreviewTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 13.1, + fontWeight: FontWeight.w400, + height: 17 / 13.1, + letterSpacing: 0, +); + +/// Reaction counts: 13.1sp medium on a 17sp line height. +const reactionCountTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 13.1, + fontWeight: FontWeight.w500, + height: 17 / 13.1, + letterSpacing: 0, +); + +/// Channel and thread titles: 20sp bold on a 24sp line height. +const channelTitleTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 20, + fontWeight: FontWeight.w700, + height: 24 / 20, + letterSpacing: 0, +); + +/// Primary labels in compact content lists. +const contentListTitleTextStyle = messageUsernameTextStyle; + +/// Secondary copy in compact content lists. +const contentListBodyTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 13.1, + fontWeight: FontWeight.w400, + height: 17 / 13.1, + letterSpacing: 0, +); + +/// Timestamps in compact content lists. +const contentListTimestampTextStyle = messageMetadataTextStyle; + +/// Filter chip labels use the compact 15sp type ramp. +const filterChipTextStyle = messageMetadataTextStyle; + +/// Search fields use the primary 15sp body treatment. +const searchInputTextStyle = messageBodyTextStyle; + +/// System message actor names: 15sp semibold on a 17sp line height. +const systemMessageHeadingTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 15, + fontWeight: FontWeight.w600, + height: 17 / 15, + letterSpacing: 0, +); + +/// System message copy: 15sp regular on a 20sp line height. +const systemMessageBodyTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 15, + fontWeight: FontWeight.w400, + height: 20 / 15, + letterSpacing: 0, +); + +/// Activity sender names share the primary author style. +const activityUsernameTextStyle = messageUsernameTextStyle; + +/// Activity timestamps share the secondary author metadata style. +const activityTimestampTextStyle = messageMetadataTextStyle; + +/// Activity context labels: 13.1sp medium on a 17sp line height. +const activityContextTextStyle = TextStyle( + fontFamily: _fontFamily, + fontSize: 13.1, + fontWeight: FontWeight.w500, + height: 17 / 13.1, + letterSpacing: 0, +); + +/// Activity message previews use the primary message copy style. +const activityPreviewTextStyle = messageBodyTextStyle; diff --git a/mobile/lib/shared/theme/theme.dart b/mobile/lib/shared/theme/theme.dart index 91cdf4dcc1..862534b4f7 100644 --- a/mobile/lib/shared/theme/theme.dart +++ b/mobile/lib/shared/theme/theme.dart @@ -5,6 +5,7 @@ export 'app_theme.dart'; export 'buzz_theme.dart'; export 'color_scheme.dart'; export 'grid.dart'; +export 'message_typography.dart'; export 'theme_catalog.dart'; export 'theme_extensions.dart'; export 'theme_pairs.dart'; diff --git a/mobile/lib/shared/widgets/filter_chip_bar.dart b/mobile/lib/shared/widgets/filter_chip_bar.dart index 294d7b9a5d..1fe55712a5 100644 --- a/mobile/lib/shared/widgets/filter_chip_bar.dart +++ b/mobile/lib/shared/widgets/filter_chip_bar.dart @@ -101,7 +101,7 @@ class FilterChipBar extends StatelessWidget { final fg = isSelected ? context.colors.onPrimary : context.colors.onSurfaceVariant; - final labelStyle = context.textTheme.bodyLarge?.copyWith( + final labelStyle = filterChipTextStyle.copyWith( color: fg, fontWeight: isSelected ? FontWeight.w500 : FontWeight.w400, ); diff --git a/mobile/lib/shared/widgets/frosted_app_bar.dart b/mobile/lib/shared/widgets/frosted_app_bar.dart index d8fb533026..6a0bd2729d 100644 --- a/mobile/lib/shared/widgets/frosted_app_bar.dart +++ b/mobile/lib/shared/widgets/frosted_app_bar.dart @@ -61,6 +61,9 @@ class FrostedAppBar extends StatelessWidget { /// can pop, a back button is shown automatically. final Widget? leading; + /// Whether to infer a back button from the current navigator. + final bool automaticallyImplyLeading; + /// Widget displayed in the center/title area. final Widget? title; @@ -95,6 +98,7 @@ class FrostedAppBar extends StatelessWidget { const FrostedAppBar({ super.key, this.leading, + this.automaticallyImplyLeading = true, this.title, this.titleStyle, this.titleContentHeight = 0, @@ -119,7 +123,7 @@ class FrostedAppBar extends StatelessWidget { final effectiveLeading = leading ?? - (canPop + (automaticallyImplyLeading && canPop ? SizedBox( width: 48, height: 48, diff --git a/mobile/lib/shared/widgets/message_author_meta.dart b/mobile/lib/shared/widgets/message_author_meta.dart new file mode 100644 index 0000000000..bc69506cc9 --- /dev/null +++ b/mobile/lib/shared/widgets/message_author_meta.dart @@ -0,0 +1,118 @@ +import 'package:flutter/material.dart'; + +import '../theme/theme.dart'; + +/// A consistent inline author row for message-oriented surfaces. +class MessageAuthorMeta extends StatelessWidget { + /// Primary author name shown at the start of the row. + final String displayName; + + /// Optional secondary username, hidden when blank or equal to [displayName]. + final String? username; + + /// Timestamp label shown after the author metadata. + final String timestamp; + + /// Color applied to [displayName]. + final Color nameColor; + + /// Color applied to the username, separator, and [timestamp]. + final Color metadataColor; + + /// Optional callback invoked when [displayName] is tapped. + final VoidCallback? onAuthorTap; + + /// Optional key assigned to the display-name text. + final Key? displayNameKey; + + /// Optional key assigned to the username text. + final Key? usernameKey; + + /// Optional key assigned to the timestamp text. + final Key? timestampKey; + + /// Base text style for [displayName], with [nameColor] applied. + final TextStyle nameStyle; + + /// Base text style for secondary metadata, with [metadataColor] applied. + final TextStyle metadataStyle; + + /// Creates an inline author row with optional username and tap handling. + const MessageAuthorMeta({ + super.key, + required this.displayName, + required this.timestamp, + required this.nameColor, + required this.metadataColor, + this.username, + this.onAuthorTap, + this.displayNameKey, + this.usernameKey, + this.timestampKey, + this.nameStyle = messageUsernameTextStyle, + this.metadataStyle = messageMetadataTextStyle, + }); + + @override + Widget build(BuildContext context) { + final normalizedUsername = username?.trim(); + final showUsername = + normalizedUsername != null && + normalizedUsername.isNotEmpty && + normalizedUsername != displayName.trim(); + final resolvedNameStyle = nameStyle.copyWith(color: nameColor); + final resolvedMetadataStyle = metadataStyle.copyWith(color: metadataColor); + + Widget authorName = Text( + displayName, + key: displayNameKey, + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: resolvedNameStyle, + ); + if (onAuthorTap != null) { + authorName = GestureDetector(onTap: onAuthorTap, child: authorName); + } + + return LayoutBuilder( + builder: (context, constraints) { + final metadataMaxWidth = constraints.hasBoundedWidth + ? constraints.maxWidth / (showUsername ? 3 : 2) + : double.infinity; + + return Row( + crossAxisAlignment: CrossAxisAlignment.center, + children: [ + Expanded(child: authorName), + if (showUsername) ...[ + const SizedBox(width: Grid.half), + ConstrainedBox( + constraints: BoxConstraints(maxWidth: metadataMaxWidth), + child: Text( + normalizedUsername, + key: usernameKey, + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: resolvedMetadataStyle, + ), + ), + ], + const SizedBox(width: Grid.half), + Text('·', style: resolvedMetadataStyle), + const SizedBox(width: Grid.half), + ConstrainedBox( + constraints: BoxConstraints(maxWidth: metadataMaxWidth), + child: Text( + timestamp, + key: timestampKey, + maxLines: 1, + overflow: TextOverflow.ellipsis, + style: resolvedMetadataStyle, + ), + ), + ], + ); + }, + ); + } +} diff --git a/mobile/test/features/activity/activity_page_test.dart b/mobile/test/features/activity/activity_page_test.dart index fba440cc96..19b170b52a 100644 --- a/mobile/test/features/activity/activity_page_test.dart +++ b/mobile/test/features/activity/activity_page_test.dart @@ -3,14 +3,18 @@ import 'dart:async'; import 'package:buzz/features/activity/activity_page.dart'; import 'package:buzz/features/activity/activity_provider.dart'; import 'package:buzz/features/activity/feed_item.dart'; +import 'package:buzz/features/activity/inbox_item.dart'; import 'package:buzz/features/activity/reminders_provider.dart'; import 'package:buzz/features/channels/channel.dart'; import 'package:buzz/features/channels/channel_detail_page.dart'; +import 'package:buzz/features/channels/message_content.dart'; import 'package:buzz/features/channels/channels_provider.dart'; import 'package:buzz/features/channels/read_state/read_state_provider.dart'; import 'package:buzz/features/profile/user_cache_provider.dart'; import 'package:buzz/features/profile/user_profile.dart'; import 'package:buzz/shared/theme/theme.dart'; +import 'package:buzz/shared/widgets/frosted_app_bar.dart'; +import 'package:buzz/shared/widgets/avatar_image.dart'; import 'package:flutter/material.dart'; import 'package:flutter_test/flutter_test.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; @@ -91,7 +95,11 @@ void main() { ]; final testUsers = { - 'alice_pk': const UserProfile(pubkey: 'alice_pk', displayName: 'Alice'), + 'alice_pk': const UserProfile( + pubkey: 'alice_pk', + displayName: 'Alice', + nip05Handle: 'alice@example.com', + ), 'bob_pk': const UserProfile(pubkey: 'bob_pk', displayName: 'Bob'), 'agent_pk': const UserProfile(pubkey: 'agent_pk', displayName: 'Scout'), }; @@ -102,6 +110,7 @@ void main() { Map? users, Map readContexts = const {}, List? channels, + TextScaler? textScaler, }) async { SharedPreferences.setMockInitialValues({}); final prefs = await SharedPreferences.getInstance(); @@ -122,7 +131,16 @@ void main() { ), remindersProvider.overrideWith(() => _FakeRemindersNotifier(const [])), ], - child: MaterialApp(theme: AppTheme.light(), home: const ActivityPage()), + child: MaterialApp( + theme: AppTheme.light(), + builder: textScaler == null + ? null + : (context, child) => MediaQuery( + data: MediaQuery.of(context).copyWith(textScaler: textScaler), + child: child!, + ), + home: const ActivityPage(), + ), ); } @@ -153,6 +171,17 @@ void main() { expect(find.text('No activity yet'), findsOneWidget); }); + testWidgets('does not imply a back button for the top-level Activity tab', ( + tester, + ) async { + await tester.pumpWidget(await buildTestable()); + await tester.pumpAndSettle(); + + final appBar = tester.widget(find.byType(FrostedAppBar)); + expect(appBar.automaticallyImplyLeading, isFalse); + expect(find.byTooltip('Back'), findsNothing); + }); + testWidgets('shows error view with retry button', (tester) async { await tester.pumpWidget( await buildTestable(activityNotifier: _ErrorActivityNotifier.new), @@ -163,6 +192,88 @@ void main() { expect(find.text('Retry'), findsOneWidget); }); + testWidgets('activity popovers use fixed-layout scale and opacity motion', ( + tester, + ) async { + await tester.pumpWidget(await buildTestable()); + await tester.pumpAndSettle(); + + final filterTrigger = find.byKey(const ValueKey('activity-filter-menu')); + expect( + tester.getSize(filterTrigger).height, + greaterThanOrEqualTo(Grid.xl), + reason: 'The Activity filter trigger must keep a 48dp touch target.', + ); + + await tester.tap(filterTrigger); + await tester.pump(); + + final surface = find.byKey(const ValueKey('activity-filter-popover')); + final fade = find.byKey(const ValueKey('activity-popover-fade')); + final scale = find.byKey(const ValueKey('activity-popover-scale')); + expect(surface, findsOneWidget); + expect(fade, findsOneWidget); + expect(scale, findsOneWidget); + + final initialSize = tester.getSize(surface); + final initialFade = tester.widget(fade); + final initialScale = tester.widget(scale); + expect(initialSize.width, 240); + expect(initialFade.opacity.value, lessThan(1)); + expect(initialScale.scale.value, greaterThanOrEqualTo(0.96)); + expect(initialScale.scale.value, lessThan(1)); + expect(initialScale.alignment, Alignment.topLeft); + + await tester.pump(const Duration(milliseconds: 75)); + + final movingFade = tester.widget(fade); + final movingScale = tester.widget(scale); + expect(movingFade.opacity.value, greaterThan(0)); + expect(movingFade.opacity.value, lessThan(1)); + expect(movingScale.scale.value, greaterThan(0.96)); + expect(movingScale.scale.value, lessThan(1)); + expect(tester.getSize(surface), initialSize); + + await tester.pump(const Duration(milliseconds: 75)); + expect(tester.widget(fade).opacity.value, 1); + expect(tester.widget(scale).scale.value, 1); + expect(tester.getSize(surface), initialSize); + + final material = tester.widget(surface); + final shape = material.shape! as RoundedRectangleBorder; + expect(shape.borderRadius, BorderRadius.circular(Radii.card)); + expect(material.surfaceTintColor, Colors.transparent); + expect(material.clipBehavior, Clip.antiAlias); + + final items = tester.widgetList>( + find.byType(PopupMenuItem), + ); + expect(items, hasLength(InboxFilter.values.length)); + expect( + items.every((item) => item.height >= Grid.xl), + isTrue, + reason: 'Activity filter choices must keep 48dp touch targets.', + ); + + await tester.tap(find.descendant(of: surface, matching: find.text('All'))); + await tester.pumpAndSettle(); + await tester.tap(find.byKey(const ValueKey('activity-options-menu'))); + await tester.pump(); + + final optionsSurface = find.byKey( + const ValueKey('activity-options-popover'), + ); + expect(tester.getSize(optionsSurface).width, 216); + expect( + tester + .widget( + find.byKey(const ValueKey('activity-popover-scale')), + ) + .alignment, + Alignment.topRight, + ); + }); + testWidgets('rows lead with sender, contextual label, and preview', ( tester, ) async { @@ -171,6 +282,7 @@ void main() { // Sender names resolved from the user cache. expect(find.text('Alice'), findsOneWidget); + expect(find.text('alice@example.com'), findsOneWidget); expect(find.text('Bob'), findsOneWidget); expect(find.text('Scout'), findsOneWidget); @@ -180,18 +292,62 @@ void main() { expect(find.text('#general'), findsNWidgets(2)); // mention + agent expect(find.text('#engineering'), findsOneWidget); + // Context labels and channel pills share the compact Activity style. + final contextLabel = tester.widget(find.text('Mentioned in')); + final channelLabel = tester.widgetList(find.text('#general')).first; + expect(contextLabel.style?.fontSize, activityContextTextStyle.fontSize); + expect(contextLabel.style?.fontWeight, activityContextTextStyle.fontWeight); + expect(contextLabel.style?.height, activityContextTextStyle.height); + expect(channelLabel.style?.fontSize, activityContextTextStyle.fontSize); + expect(channelLabel.style?.fontWeight, activityContextTextStyle.fontWeight); + expect(channelLabel.style?.height, activityContextTextStyle.height); + // Message previews. expect(find.textContaining('Hey check this out'), findsOneWidget); expect(find.textContaining('Deployed the fix'), findsOneWidget); - // Sender uses the compact label scale (labelMedium), not a - // headline-like title scale. + // Activity rows use their conversation-oriented scale. final senderText = tester.widget(find.text('Alice')); - final textTheme = Theme.of(tester.element(find.text('Alice'))).textTheme; - expect(senderText.style?.fontSize, textTheme.labelMedium?.fontSize); + final theme = Theme.of(tester.element(find.text('Alice'))); + expect(senderText.style?.fontSize, activityUsernameTextStyle.fontSize); + expect(senderText.style?.fontWeight, activityUsernameTextStyle.fontWeight); + expect(senderText.style?.height, activityUsernameTextStyle.height); + expect(senderText.style?.color, theme.colorScheme.onSurface); + final usernameText = tester.widget( + find.byKey(const ValueKey('activity-username-m1')), + ); + final timestampText = tester.widget( + find.byKey(const ValueKey('activity-timestamp-m1')), + ); + expect(usernameText.style?.fontSize, messageMetadataTextStyle.fontSize); + expect(usernameText.style?.fontWeight, FontWeight.w400); + expect(usernameText.style?.height, messageMetadataTextStyle.height); + expect(timestampText.style?.fontSize, messageMetadataTextStyle.fontSize); + expect(timestampText.style?.fontWeight, FontWeight.w400); + + final avatars = tester.widgetList(find.byType(AvatarImage)); + expect(avatars, isNotEmpty); expect( - senderText.style!.fontSize!, - lessThan(textTheme.titleSmall!.fontSize!), + avatars.every((avatar) => avatar.radius == activityAvatarSize / 2), + isTrue, + ); + + final previews = tester.widgetList( + find.byType(MessageContent), + ); + expect(previews, isNotEmpty); + expect( + previews.every( + (preview) => + preview.baseStyle?.fontSize == activityPreviewTextStyle.fontSize && + preview.baseStyle?.fontWeight == + activityPreviewTextStyle.fontWeight && + preview.baseStyle?.height == activityPreviewTextStyle.height && + preview.baseStyle?.letterSpacing == + activityPreviewTextStyle.letterSpacing && + preview.baseStyle?.color == theme.colorScheme.onSurface, + ), + isTrue, ); }); @@ -293,6 +449,24 @@ void main() { expect(find.text('Nothing needs your action'), findsOneWidget); }); + testWidgets('filter menu supports accessibility text scaling', ( + tester, + ) async { + await tester.pumpWidget( + await buildTestable(textScaler: const TextScaler.linear(3)), + ); + await tester.pumpAndSettle(); + + await tester.tap(find.byKey(const ValueKey('activity-filter-menu'))); + await tester.pumpAndSettle(); + + expect( + find.byKey(const ValueKey('activity-filter-popover')), + findsOneWidget, + ); + expect(tester.takeException(), isNull); + }); + testWidgets('opens a thread mention at the referenced message', ( tester, ) async { diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart index af39eb103a..2dc01a9a0b 100644 --- a/mobile/test/features/channels/channel_detail_page_test.dart +++ b/mobile/test/features/channels/channel_detail_page_test.dart @@ -2,6 +2,7 @@ import 'dart:convert'; import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; +import 'package:flutter/rendering.dart' show ScrollDirection; import 'package:flutter_test/flutter_test.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; @@ -203,16 +204,15 @@ Widget _buildTestable({ ], child: MaterialApp( theme: AppTheme.light(), + builder: (context, child) => MediaQuery( + data: MediaQuery.of(context).copyWith(textScaler: textScaler), + child: child!, + ), navigatorObservers: navigatorObservers, - home: Builder( - builder: (context) => MediaQuery( - data: MediaQuery.of(context).copyWith(textScaler: textScaler), - child: ChannelDetailPage( - channel: resolvedChannel, - initialMessageId: initialMessageId, - initialThreadRootId: initialThreadRootId, - ), - ), + home: ChannelDetailPage( + channel: resolvedChannel, + initialMessageId: initialMessageId, + initialThreadRootId: initialThreadRootId, ), ), ); @@ -680,7 +680,11 @@ void main() { _buildTestable( messages: messages, users: { - 'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'), + 'alice': const UserProfile( + pubkey: 'alice', + displayName: 'Alice', + nip05Handle: 'alice@example.com', + ), 'bob': const UserProfile(pubkey: 'bob', displayName: 'Bob'), }, ), @@ -690,29 +694,58 @@ void main() { expect(findRichText('Hello world!'), findsOneWidget); expect(findRichText('Hey Alice!'), findsOneWidget); expect(find.text('Alice'), findsOneWidget); + expect(find.text('alice@example.com'), findsOneWidget); expect(find.text('Bob'), findsOneWidget); final messageAvatars = find.byType(CircleAvatar); expect(messageAvatars, findsNWidgets(2)); for (final avatar in messageAvatars.evaluate()) { expect( tester.getSize(find.byWidget(avatar.widget)), - const Size.square(36), + const Size.square(messageAvatarSize), ); } final aliceName = find.text('Alice'); final aliceText = tester.widget(aliceName); - final titleStyle = Theme.of( - tester.element(aliceName), - ).textTheme.titleSmall; - expect(aliceText.style?.fontSize, titleStyle?.fontSize); + expect(aliceText.style?.fontSize, messageUsernameTextStyle.fontSize); + expect(aliceText.style?.fontWeight, messageUsernameTextStyle.fontWeight); + expect(aliceText.style?.height, messageUsernameTextStyle.height); + final aliceUsername = tester.widget( + find.byKey(const ValueKey('message-username-msg1')), + ); + final aliceTimestamp = tester.widget( + find.byKey(const ValueKey('message-timestamp-msg1')), + ); + expect(aliceUsername.style?.fontSize, messageMetadataTextStyle.fontSize); + expect(aliceUsername.style?.fontWeight, FontWeight.w400); + expect(aliceUsername.style?.height, messageMetadataTextStyle.height); + expect(aliceTimestamp.style?.fontSize, messageMetadataTextStyle.fontSize); + expect(aliceTimestamp.style?.fontWeight, FontWeight.w400); final helloContent = findRichText('Hello world!'); final helloText = tester.widget(helloContent); - final bodyStyle = Theme.of( - tester.element(helloContent), - ).textTheme.bodyLarge; expect( effectiveFontSizeForText(helloText.text, 'Hello world!'), - bodyStyle?.fontSize, + messageBodyTextStyle.fontSize, + ); + final messageList = tester.widget( + find.byKey(const ValueKey('channel-message-list')), + ); + expect(messageList.padding!.bottom, 0); + final newestMessageGroup = tester.widget( + find.byKey(const ValueKey('channel-message-group-msg2')), + ); + expect( + newestMessageGroup.padding, + const EdgeInsets.only(bottom: Grid.xs), + ); + expect( + find.byKey(const ValueKey('channel-jump-to-latest')), + findsNothing, + ); + await tester.tap(find.text('Message #general')); + await tester.pumpAndSettle(); + expect( + find.byKey(const ValueKey('channel-jump-to-latest')), + findsNothing, ); }); @@ -767,9 +800,62 @@ void main() { const Size.square(32), ); } + final summaryPadding = tester.widget( + find.byKey(const ValueKey('thread-summary-root')), + ); + expect( + summaryPadding.padding, + const EdgeInsets.only( + left: messageAvatarSize + messageAvatarContentGap, + top: Grid.half, + bottom: Grid.xs, + ), + ); }); - testWidgets('can jump back to latest when newer messages are offscreen', ( + testWidgets('constrains reply summaries at accessibility text sizes', ( + tester, + ) async { + tester.view.physicalSize = const Size(400, 800); + tester.view.devicePixelRatio = 1; + addTearDown(tester.view.resetPhysicalSize); + addTearDown(tester.view.resetDevicePixelRatio); + + final lastReplyAt = + DateTime.now().millisecondsSinceEpoch ~/ 1000 - 59 * 60; + await tester.pumpWidget( + _buildTestable( + messages: [ + _textMsg( + id: 'root', + pubkey: 'alice', + content: 'Thread head', + createdAt: lastReplyAt - 300, + ), + for (var i = 0; i < 3; i++) + _textMsg( + id: 'reply-$i', + pubkey: 'participant-$i', + content: 'Reply $i', + createdAt: lastReplyAt - 2 + i, + extraTags: const [ + ['e', 'root', '', 'reply'], + ], + ), + ], + channel: _testChannel.copyWith(archivedAt: DateTime.now()), + textScaler: const TextScaler.linear(2), + ), + ); + await tester.pumpAndSettle(); + + final summaryText = tester.widget(findRichText('3 replies')); + expect(summaryText.maxLines, 2); + expect(summaryText.overflow, TextOverflow.ellipsis); + expect(tester.takeException(), isNull); + }); + + testWidgets('can jump back to latest after a non-drag user scroll', ( tester, ) async { final initialMessages = [ @@ -794,9 +880,21 @@ void main() { ); await tester.pumpAndSettle(); - final listView = tester.widget( - find.byKey(const ValueKey('channel-message-list')), - ); + final messageList = find.byKey(const ValueKey('channel-message-list')); + final messageListElement = tester.element(messageList); + UserScrollNotification( + metrics: FixedScrollMetrics( + minScrollExtent: 0, + maxScrollExtent: 100, + pixels: 0, + viewportDimension: 100, + axisDirection: AxisDirection.down, + devicePixelRatio: 1, + ), + context: messageListElement, + direction: ScrollDirection.reverse, + ).dispatch(messageListElement); + final listView = tester.widget(messageList); listView.itemScrollController!.jumpTo(index: 39); await tester.pumpAndSettle(); expect( @@ -822,6 +920,185 @@ void main() { expect(findRichText('Newest live update'), findsOneWidget); }); + testWidgets( + 'keeps follow mode off while a tall newest message stays visible', + (tester) async { + tester.view.physicalSize = const Size(400, 600); + tester.view.devicePixelRatio = 1; + addTearDown(tester.view.resetPhysicalSize); + addTearDown(tester.view.resetDevicePixelRatio); + + final tallMessage = List.generate( + 12, + (index) => 'Newest message line $index', + ).join('\n'); + final initialMessages = [ + for (var i = 0; i < 12; i++) + _textMsg( + id: 'msg$i', + pubkey: i.isEven ? 'alice' : 'bob', + content: 'Message $i', + createdAt: 1000 + i * 1000, + ), + _textMsg( + id: 'tall-newest', + pubkey: 'alice', + content: tallMessage, + createdAt: 20_000, + ), + ]; + final messagesNotifier = _FakeMessagesNotifier(initialMessages); + + await tester.pumpWidget( + _buildTestable( + messages: const [], + messagesNotifier: messagesNotifier, + users: const { + 'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'), + 'bob': UserProfile(pubkey: 'bob', displayName: 'Bob'), + }, + ), + ); + await tester.pumpAndSettle(); + + final messageList = find.byKey(const ValueKey('channel-message-list')); + await tester.drag(messageList, const Offset(0, 120)); + await tester.pumpAndSettle(); + + expect(findRichText('Newest message line 0'), findsOneWidget); + expect( + find.byKey(const ValueKey('channel-jump-to-latest')), + findsOneWidget, + ); + + messagesNotifier.setMessages([ + ...initialMessages, + _textMsg( + id: 'newest-live', + pubkey: 'alice', + content: 'Newest live update', + createdAt: 30_000, + ), + ]); + await tester.pumpAndSettle(); + + expect(findRichText('Newest live update'), findsNothing); + expect( + find.byKey(const ValueKey('channel-jump-to-latest')), + findsOneWidget, + ); + }, + ); + + testWidgets('preserves an initial message deep-link position', ( + tester, + ) async { + final initialMessages = [ + for (var i = 0; i < 40; i++) + _textMsg( + id: 'msg$i', + pubkey: 'alice', + content: 'Message $i', + createdAt: 1000 + i, + ), + ]; + final messagesNotifier = _FakeMessagesNotifier(initialMessages); + + await tester.pumpWidget( + _buildTestable( + messages: const [], + messagesNotifier: messagesNotifier, + initialMessageId: 'msg5', + users: const { + 'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'), + }, + ), + ); + await tester.pumpAndSettle(); + + expect(findRichText('Message 5'), findsOneWidget); + expect(findRichText('Message 39'), findsNothing); + expect( + find.byKey(const ValueKey('channel-jump-to-latest')), + findsOneWidget, + ); + + messagesNotifier.setMessages([ + ...initialMessages, + _textMsg( + id: 'newest', + pubkey: 'alice', + content: 'Newest live update', + createdAt: 2000, + ), + ]); + await tester.pumpAndSettle(); + + expect(findRichText('Message 5'), findsOneWidget); + expect(findRichText('Newest live update'), findsNothing); + }); + + testWidgets( + 'keeps a deep-linked message in view when its page arrives after a ' + 'small scroll near the latest message', + (tester) async { + tester.view.physicalSize = const Size(400, 800); + tester.view.devicePixelRatio = 1; + addTearDown(tester.view.resetPhysicalSize); + addTearDown(tester.view.resetDevicePixelRatio); + + // The deep-link target lives in an older page that has not loaded yet. + final messagesNotifier = _FakeMessagesNotifier([ + for (var i = 30; i < 60; i++) + _textMsg( + id: 'msg$i', + pubkey: 'alice', + content: 'Message $i', + createdAt: 1000 + i * 1000, + ), + ]); + + await tester.pumpWidget( + _buildTestable( + messages: const [], + messagesNotifier: messagesNotifier, + initialMessageId: 'msg3', + users: const { + 'alice': UserProfile(pubkey: 'alice', displayName: 'Alice'), + }, + ), + ); + await tester.pumpAndSettle(); + + // Small scrolls that keep the newest message visible, so isAtLatest + // stays true while the scroll offset becomes non-zero. This lets a + // later programmatic jumpTo dispatch ScrollEndNotification. + for (final dy in const [10.0, 20.0, 30.0]) { + await tester.drag( + find.byKey(const ValueKey('channel-message-list')), + Offset(0, dy), + ); + await tester.pumpAndSettle(); + } + + // The older page containing the deep-link target arrives. + messagesNotifier.setMessages([ + for (var i = 0; i < 60; i++) + _textMsg( + id: 'msg$i', + pubkey: 'alice', + content: 'Message $i', + createdAt: 1000 + i * 1000, + ), + ]); + await tester.pumpAndSettle(); + + // The deep-link jump must stick rather than snapping back to newest. + expect(findRichText('Message 3'), findsOneWidget); + expect(findRichText('Message 59'), findsNothing); + }, + ); + testWidgets('groups consecutive messages from same author', (tester) async { final messages = [ _textMsg( @@ -925,22 +1202,29 @@ void main() { expect(find.text('Alice'), findsOneWidget); final createdAction = findRichText('created this channel'); expect(createdAction, findsOneWidget); - expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36)); + expect( + tester.getSize(find.byType(CircleAvatar)), + const Size.square(messageAvatarSize), + ); final nameRect = tester.getRect(find.text('Alice')); final nameText = tester.widget(find.text('Alice')); - final nameStyle = Theme.of( - tester.element(find.text('Alice')), - ).textTheme.titleSmall; - expect(nameText.style?.fontSize, nameStyle?.fontSize); - final timestampRect = tester.getRect(find.text(formatMessageTime(1000))); - expect(timestampRect.left - nameRect.right, Grid.xxs); + expect(nameText.style?.fontSize, systemMessageHeadingTextStyle.fontSize); + expect( + nameText.style?.fontWeight, + systemMessageHeadingTextStyle.fontWeight, + ); + expect( + find.byKey(const ValueKey('system-message-username-alice')), + findsNothing, + ); + final timestampRect = tester.getRect( + find.byKey(const ValueKey('system-message-timestamp-alice')), + ); + expect(timestampRect.left, greaterThan(nameRect.right)); final createdText = tester.widget(createdAction); - final bodyStyle = Theme.of( - tester.element(createdAction), - ).textTheme.bodyLarge; expect( effectiveFontSizeForText(createdText.text, 'created this channel'), - bodyStyle?.fontSize, + systemMessageBodyTextStyle.fontSize, ); }); @@ -964,7 +1248,10 @@ void main() { expect(find.text('Bob'), findsOneWidget); expect(findRichText('joined the channel'), findsOneWidget); - expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36)); + expect( + tester.getSize(find.byType(CircleAvatar)), + const Size.square(messageAvatarSize), + ); }); testWidgets('renders member_joined (added by other) system event', ( @@ -992,17 +1279,23 @@ void main() { final addedAction = findRichText('was added by Alice'); expect(addedAction, findsOneWidget); expect(find.text('Alice added Bob to the channel'), findsNothing); - expect(tester.getSize(find.byType(CircleAvatar)), const Size.square(36)); + expect( + tester.getSize(find.byType(CircleAvatar)), + const Size.square(messageAvatarSize), + ); final nameRect = tester.getRect(find.text('Bob')); - final timestampRect = tester.getRect(find.text(formatMessageTime(1000))); - expect(timestampRect.left - nameRect.right, Grid.xxs); + expect( + find.byKey(const ValueKey('system-message-username-bob')), + findsNothing, + ); + final timestampRect = tester.getRect( + find.byKey(const ValueKey('system-message-timestamp-bob')), + ); + expect(timestampRect.left, greaterThan(nameRect.right)); final addedText = tester.widget(addedAction); - final bodyStyle = Theme.of( - tester.element(addedAction), - ).textTheme.bodyLarge; expect( effectiveFontSizeForText(addedText.text, 'was added by Alice'), - bodyStyle?.fontSize, + systemMessageBodyTextStyle.fontSize, ); }); @@ -1113,7 +1406,10 @@ void main() { final avatarRect = tester.getRect(find.byType(CircleAvatar)); final reactionRect = tester.getRect(find.byType(ReactionRow)); - expect(reactionRect.left, avatarRect.left + 36 + Grid.xxs); + expect( + reactionRect.left, + avatarRect.left + messageAvatarSize + messageAvatarContentGap, + ); }); testWidgets('renders member_left system event', (tester) async { @@ -1135,6 +1431,51 @@ void main() { expect(find.text('Bob left the channel'), findsOneWidget); }); + testWidgets( + 'constrains generic system timestamps at accessibility text sizes', + (tester) async { + tester.view.physicalSize = const Size(240, 600); + tester.view.devicePixelRatio = 1; + addTearDown(tester.view.resetPhysicalSize); + addTearDown(tester.view.resetDevicePixelRatio); + + await tester.pumpWidget( + _buildTestable( + messages: [ + _systemMsg( + id: 'sys-accessible', + payload: { + 'type': 'topic_changed', + 'actor': 'alice', + 'topic': 'Release planning', + }, + createdAt: + DateTime(2026, 7, 28, 12, 34).millisecondsSinceEpoch ~/ + 1000, + ), + ], + users: { + 'alice': const UserProfile(pubkey: 'alice', displayName: 'Alice'), + }, + textScaler: const TextScaler.linear(3), + ), + ); + await tester.pumpAndSettle(); + + final timestampFinder = find.byKey( + const ValueKey('system-message-timestamp-sys-accessible'), + ); + final timestamp = tester.widget(timestampFinder); + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + expect( + tester.getSize(timestampFinder).width, + lessThanOrEqualTo(Grid.xxl), + ); + expect(tester.takeException(), isNull); + }, + ); + testWidgets('renders member_removed system event', (tester) async { final messages = [ _systemMsg( @@ -1851,6 +2192,14 @@ void main() { expect(find.byType(DayDivider), findsNWidgets(2)); expect(find.text(formatDayHeading(rootCreatedAt)), findsOneWidget); expect(find.text(formatDayHeading(nextDayCreatedAt)), findsOneWidget); + final threadList = tester.widget( + find.byKey(const ValueKey('thread-message-list')), + ); + expect(threadList.padding!.bottom, 0); + final newestThreadGroup = tester.widget( + find.byKey(const ValueKey('thread-message-group-reply-next-day')), + ); + expect(newestThreadGroup.padding, const EdgeInsets.only(bottom: Grid.xs)); }); }); } diff --git a/mobile/test/features/channels/channels_page_test.dart b/mobile/test/features/channels/channels_page_test.dart index 086db18d08..2a624cbde7 100644 --- a/mobile/test/features/channels/channels_page_test.dart +++ b/mobile/test/features/channels/channels_page_test.dart @@ -131,6 +131,15 @@ void main() { expect(find.text('DMs'), findsOneWidget); expect(find.text('Community'), findsOneWidget); expect(find.byTooltip('Create or start conversation'), findsOneWidget); + + for (final label in ['general', 'Alice']) { + final text = tester.widget(find.text(label)); + expect(text.style?.fontSize, contentListTitleTextStyle.fontSize); + expect(text.style?.height, contentListTitleTextStyle.height); + } + final sectionTitle = tester.widget(find.text('Channels')); + expect(sectionTitle.style?.fontSize, contentListTitleTextStyle.fontSize); + expect(sectionTitle.style?.fontWeight, FontWeight.w600); }); testWidgets('aligns the top, section, row, and skeleton label columns', ( diff --git a/mobile/test/features/forum/forum_widgets_test.dart b/mobile/test/features/forum/forum_widgets_test.dart index b350cbbb29..7f83a33c8d 100644 --- a/mobile/test/features/forum/forum_widgets_test.dart +++ b/mobile/test/features/forum/forum_widgets_test.dart @@ -61,6 +61,7 @@ Widget _buildPostCard({ Map users = const {}, VoidCallback? onTap, void Function(String)? onDelete, + TextScaler textScaler = TextScaler.noScaling, }) { return ProviderScope( overrides: [ @@ -68,12 +69,17 @@ Widget _buildPostCard({ ], child: MaterialApp( theme: AppTheme.light(), - home: Scaffold( - body: ForumPostCard( - post: post, - currentPubkey: currentPubkey, - onTap: onTap ?? () {}, - onDelete: onDelete, + home: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of(context).copyWith(textScaler: textScaler), + child: Scaffold( + body: ForumPostCard( + post: post, + currentPubkey: currentPubkey, + onTap: onTap ?? () {}, + onDelete: onDelete, + ), + ), ), ), ), @@ -115,6 +121,7 @@ Widget _buildThreadPage({ bool isMember = true, bool isArchived = false, Map users = const {}, + TextScaler textScaler = TextScaler.noScaling, }) { return ProviderScope( overrides: [ @@ -131,12 +138,17 @@ Widget _buildThreadPage({ ], child: MaterialApp( theme: AppTheme.light(), - home: ForumThreadPage( - channelId: _channelId, - postEventId: postEventId, - currentPubkey: currentPubkey, - isMember: isMember, - isArchived: isArchived, + home: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of(context).copyWith(textScaler: textScaler), + child: ForumThreadPage( + channelId: _channelId, + postEventId: postEventId, + currentPubkey: currentPubkey, + isMember: isMember, + isArchived: isArchived, + ), + ), ), ), ); @@ -171,6 +183,63 @@ void main() { expect(find.text('abcdef12\u2026'), findsOneWidget); }); + testWidgets( + 'constrains an older timestamp at large accessible text sizes', + (tester) async { + _setSurfaceSize(tester, const Size(240, 600)); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + + await tester.pumpWidget( + _buildPostCard( + post: _makePost( + createdAt: + DateTime.utc(2025, 12, 31, 12).millisecondsSinceEpoch ~/ 1000, + ), + users: const { + 'alice': UserProfile( + pubkey: 'alice', + displayName: 'A very long display name', + ), + }, + textScaler: const TextScaler.linear(2), + ), + ); + await tester.pumpAndSettle(); + + final timestamp = tester.widget(find.text('12/31/2025')); + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + expect(tester.takeException(), isNull); + }, + ); + + testWidgets('gives the author unused timestamp width', (tester) async { + _setSurfaceSize(tester, const Size(320, 600)); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120; + const displayName = 'A moderately long forum author name'; + + await tester.pumpWidget( + _buildPostCard( + post: _makePost(createdAt: createdAt), + users: const { + 'alice': UserProfile(pubkey: 'alice', displayName: displayName), + }, + ), + ); + await tester.pumpAndSettle(); + + expect(tester.getSize(find.text(displayName)).width, greaterThan(150)); + expect(find.text('2m ago'), findsOneWidget); + expect(tester.takeException(), isNull); + }); + testWidgets('truncates long content', (tester) async { final longContent = 'A' * 300; await tester.pumpWidget( @@ -495,6 +564,97 @@ void main() { expect(find.text('Bob'), findsOneWidget); }); + testWidgets('constrains post and reply timestamps at large text sizes', ( + tester, + ) async { + final oldTimestamp = + DateTime.utc(2025, 12, 31, 12).millisecondsSinceEpoch ~/ 1000; + + await tester.pumpWidget( + _buildThreadPage( + threadResponse: ForumThreadResponse( + post: _makePost(createdAt: oldTimestamp), + replies: [ + ThreadReply( + eventId: 'old-reply', + pubkey: 'bob', + content: 'An older reply', + kind: 45003, + createdAt: oldTimestamp, + channelId: _channelId, + tags: const [ + ['h', _channelId], + ], + depth: 1, + ), + ], + totalReplies: 1, + ), + users: const { + 'alice': _aliceProfile, + 'bob': UserProfile( + pubkey: 'bob', + displayName: 'A very long reply author name', + ), + }, + textScaler: const TextScaler.linear(2), + ), + ); + await tester.pumpAndSettle(); + + final timestamps = tester.widgetList(find.text('12/31/2025')); + expect(timestamps, hasLength(2)); + for (final timestamp in timestamps) { + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + } + expect(tester.takeException(), isNull); + }); + + testWidgets('gives thread authors unused timestamp width', (tester) async { + _setSurfaceSize(tester, const Size(320, 800)); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120; + const postAuthor = 'A moderately long original author'; + const replyAuthor = 'A moderately long reply author'; + + await tester.pumpWidget( + _buildThreadPage( + threadResponse: ForumThreadResponse( + post: _makePost(createdAt: createdAt), + replies: [ + ThreadReply( + eventId: 'reply', + pubkey: 'bob', + content: 'A reply', + kind: 45003, + createdAt: createdAt, + channelId: _channelId, + tags: const [ + ['h', _channelId], + ], + depth: 1, + ), + ], + totalReplies: 1, + ), + users: const { + 'alice': UserProfile(pubkey: 'alice', displayName: postAuthor), + 'bob': UserProfile(pubkey: 'bob', displayName: replyAuthor), + }, + ), + ); + await tester.pumpAndSettle(); + + expect(tester.getSize(find.text(postAuthor)).width, greaterThan(150)); + expect(tester.getSize(find.text(replyAuthor)).width, greaterThan(140)); + expect(find.text('2m ago'), findsNWidgets(2)); + expect(tester.takeException(), isNull); + }); + testWidgets('shows compose bar for members', (tester) async { await tester.pumpWidget( _buildThreadPage( diff --git a/mobile/test/features/pulse/compose_note_page_test.dart b/mobile/test/features/pulse/compose_note_page_test.dart index 5ac84bcc8c..e32225fe1a 100644 --- a/mobile/test/features/pulse/compose_note_page_test.dart +++ b/mobile/test/features/pulse/compose_note_page_test.dart @@ -24,19 +24,31 @@ void main() { tags: const [], ); - Widget buildTestable(Widget home) { + Widget buildTestable( + Widget home, { + TextScaler textScaler = TextScaler.noScaling, + String displayName = 'Alice', + }) { return ProviderScope( overrides: [ userCacheProvider.overrideWith( () => _FakeUserCacheNotifier({ - 'alice_pk': const UserProfile( + 'alice_pk': UserProfile( pubkey: 'alice_pk', - displayName: 'Alice', + displayName: displayName, ), }), ), ], - child: MaterialApp(theme: AppTheme.light(), home: home), + child: MaterialApp( + theme: AppTheme.light(), + home: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of(context).copyWith(textScaler: textScaler), + child: home, + ), + ), + ), ); } @@ -52,6 +64,53 @@ void main() { expect(find.text('Reply'), findsOneWidget); // action button label }); + testWidgets('reply preview constrains its timestamp at large text sizes', ( + tester, + ) async { + final oldReplyNote = UserNote( + id: 'old-note', + pubkey: 'alice_pk', + createdAt: DateTime.utc(2025, 9, 30, 12).millisecondsSinceEpoch ~/ 1000, + content: 'An older note', + tags: const [], + ); + + await tester.pumpWidget( + buildTestable( + ComposeNotePage(replyTo: oldReplyNote), + textScaler: const TextScaler.linear(2), + ), + ); + await tester.pump(); + + final timestamp = tester.widget(find.text('Sep 30')); + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + expect(tester.takeException(), isNull); + }); + + testWidgets('gives the reply author unused timestamp width', (tester) async { + tester.view.devicePixelRatio = 1; + tester.view.physicalSize = const Size(320, 600); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + const displayName = 'A moderately long Pulse reply author'; + + await tester.pumpWidget( + buildTestable( + ComposeNotePage(replyTo: replyNote), + displayName: displayName, + ), + ); + await tester.pump(); + + expect(tester.getSize(find.text(displayName)).width, greaterThan(150)); + expect(find.text('2m'), findsOneWidget); + expect(tester.takeException(), isNull); + }); + testWidgets('new-note mode shows no reply preview', (tester) async { await tester.pumpWidget(buildTestable(const ComposeNotePage())); await tester.pump(); diff --git a/mobile/test/features/pulse/note_card_test.dart b/mobile/test/features/pulse/note_card_test.dart new file mode 100644 index 0000000000..73e6e8af02 --- /dev/null +++ b/mobile/test/features/pulse/note_card_test.dart @@ -0,0 +1,130 @@ +import 'package:buzz/features/profile/user_cache_provider.dart'; +import 'package:buzz/features/profile/user_profile.dart'; +import 'package:buzz/features/pulse/note_card.dart'; +import 'package:buzz/features/pulse/pulse_models.dart'; +import 'package:buzz/shared/theme/theme.dart'; +import 'package:flutter/material.dart'; +import 'package:flutter_test/flutter_test.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; + +class _FakeUserCacheNotifier extends UserCacheNotifier { + final Map _users; + + _FakeUserCacheNotifier(this._users); + + @override + Map build() => _users; +} + +void main() { + testWidgets('constrains timestamp with agent and follow metadata', ( + tester, + ) async { + tester.view.devicePixelRatio = 1; + tester.view.physicalSize = const Size(280, 600); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + + final note = UserNote( + id: 'note-1', + pubkey: 'alice', + createdAt: DateTime.utc(2025, 9, 30, 12).millisecondsSinceEpoch ~/ 1000, + content: 'A note', + tags: const [], + ); + + await tester.pumpWidget( + ProviderScope( + overrides: [ + userCacheProvider.overrideWith( + () => _FakeUserCacheNotifier({ + 'alice': const UserProfile( + pubkey: 'alice', + displayName: 'A very long display name', + ), + }), + ), + ], + child: MaterialApp( + theme: AppTheme.light(), + home: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of( + context, + ).copyWith(textScaler: const TextScaler.linear(2)), + child: Scaffold( + body: NoteCard( + note: note, + reaction: const PulseReactionState( + count: 0, + reactedByCurrentUser: false, + ), + isAgent: true, + canFollow: true, + ), + ), + ), + ), + ), + ), + ); + await tester.pumpAndSettle(); + + final timestamp = tester.widget(find.text('Sep 30')); + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + expect(tester.takeException(), isNull); + }); + + testWidgets('gives the author unused timestamp width', (tester) async { + tester.view.devicePixelRatio = 1; + tester.view.physicalSize = const Size(320, 600); + addTearDown(() { + tester.view.resetPhysicalSize(); + tester.view.resetDevicePixelRatio(); + }); + const displayName = 'A moderately long Pulse author'; + final note = UserNote( + id: 'note-2', + pubkey: 'alice', + createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120, + content: 'A note', + tags: const [], + ); + + await tester.pumpWidget( + ProviderScope( + overrides: [ + userCacheProvider.overrideWith( + () => _FakeUserCacheNotifier({ + 'alice': const UserProfile( + pubkey: 'alice', + displayName: displayName, + ), + }), + ), + ], + child: MaterialApp( + theme: AppTheme.light(), + home: Scaffold( + body: NoteCard( + note: note, + reaction: const PulseReactionState( + count: 0, + reactedByCurrentUser: false, + ), + canFollow: true, + ), + ), + ), + ), + ); + await tester.pumpAndSettle(); + + expect(tester.getSize(find.text(displayName)).width, greaterThan(145)); + expect(find.text('2m'), findsOneWidget); + expect(tester.takeException(), isNull); + }); +} diff --git a/mobile/test/features/search/recent_searches_provider_test.dart b/mobile/test/features/search/recent_searches_provider_test.dart new file mode 100644 index 0000000000..30f13c329c --- /dev/null +++ b/mobile/test/features/search/recent_searches_provider_test.dart @@ -0,0 +1,105 @@ +import 'package:buzz/features/search/recent_searches_provider.dart'; +import 'package:buzz/shared/relay/relay.dart'; +import 'package:buzz/shared/theme/theme_provider.dart'; +import 'package:flutter_test/flutter_test.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; +import 'package:shared_preferences/shared_preferences.dart'; + +class _FixedRelayConfigNotifier extends RelayConfigNotifier { + final RelayConfig _config; + + _FixedRelayConfigNotifier(this._config); + + @override + RelayConfig build() => _config; +} + +void main() { + TestWidgetsFlutterBinding.ensureInitialized(); + + Future containerWithPrefs({ + required String relayUrl, + required String? pubkey, + }) async { + final prefs = await SharedPreferences.getInstance(); + final container = ProviderContainer( + overrides: [ + savedPrefsProvider.overrideWithValue(prefs), + relayConfigProvider.overrideWith( + () => _FixedRelayConfigNotifier(RelayConfig(baseUrl: relayUrl)), + ), + myPubkeyProvider.overrideWithValue(pubkey), + ], + ); + addTearDown(container.dispose); + return container; + } + + test( + 'normalizes, deduplicates, caps, and persists submitted queries', + () async { + SharedPreferences.setMockInitialValues({}); + final first = await containerWithPrefs( + relayUrl: 'https://relay-a.example', + pubkey: 'pk-a', + ); + final notifier = first.read(recentSearchesProvider.notifier); + + notifier.record(' Design '); + notifier.record('design'); + notifier.record(''); + for (var index = 0; index < 6; index++) { + notifier.record('query-$index'); + } + + expect(first.read(recentSearchesProvider), [ + 'query-5', + 'query-4', + 'query-3', + 'query-2', + 'query-1', + 'query-0', + ]); + + final restarted = await containerWithPrefs( + relayUrl: 'https://relay-a.example', + pubkey: 'pk-a', + ); + expect( + restarted.read(recentSearchesProvider), + first.read(recentSearchesProvider), + ); + }, + ); + + test('isolates persisted history by community and account', () async { + SharedPreferences.setMockInitialValues({}); + final accountA = await containerWithPrefs( + relayUrl: 'https://relay-a.example', + pubkey: 'pk-a', + ); + accountA.read(recentSearchesProvider.notifier).record('private query'); + + final accountB = await containerWithPrefs( + relayUrl: 'https://relay-a.example', + pubkey: 'pk-b', + ); + expect(accountB.read(recentSearchesProvider), isEmpty); + accountB.read(recentSearchesProvider.notifier).record('account b query'); + + final communityB = await containerWithPrefs( + relayUrl: 'https://relay-b.example', + pubkey: 'pk-a', + ); + expect(communityB.read(recentSearchesProvider), isEmpty); + communityB + .read(recentSearchesProvider.notifier) + .record('community b query'); + + final accountAAgain = await containerWithPrefs( + relayUrl: 'https://relay-a.example', + pubkey: 'pk-a', + ); + expect(accountAAgain.read(recentSearchesProvider), ['private query']); + }); +} diff --git a/mobile/test/features/search/search_page_test.dart b/mobile/test/features/search/search_page_test.dart index dfde69e5ec..52c2fb23ae 100644 --- a/mobile/test/features/search/search_page_test.dart +++ b/mobile/test/features/search/search_page_test.dart @@ -1,6 +1,12 @@ import 'package:buzz/features/channels/channel.dart'; +import 'package:buzz/features/channels/channel_management_provider.dart'; +import 'package:buzz/features/channels/channels_provider.dart'; +import 'package:buzz/features/channels/message_content.dart'; +import 'package:buzz/features/channels/small_avatar.dart'; import 'package:buzz/features/profile/profile_provider.dart'; +import 'package:buzz/features/profile/user_cache_provider.dart'; import 'package:buzz/features/profile/user_profile.dart'; +import 'package:buzz/features/search/recent_searches_provider.dart'; import 'package:buzz/features/search/search_page.dart'; import 'package:buzz/features/search/search_provider.dart'; import 'package:buzz/shared/theme/theme.dart'; @@ -24,6 +30,9 @@ void main() { searchProvider.overrideWith( () => _FakeSearchNotifier(const SearchState.initial()), ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), profileProvider.overrideWith(() => _FakeProfileNotifier()), ], child: Builder( @@ -55,10 +64,227 @@ void main() { tester.getSize(searchField).height, greaterThanOrEqualTo(scaledLineHeight + Grid.xxs * 2), ); + final input = tester.widget( + find.byKey(const Key('search-field')), + ); + expect(input.style?.fontSize, searchInputTextStyle.fontSize); + expect(input.style?.height, searchInputTextStyle.height); expect(tester.getSize(message).height, greaterThan(32)); expect(tester.takeException(), isNull); }); + testWidgets('focus slides Cancel in beside the search field', (tester) async { + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith( + () => _FakeSearchNotifier(const SearchState.initial()), + ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + ], + child: const SearchPage(), + ), + ); + await tester.pumpAndSettle(); + + final searchField = find.byKey(const Key('search-field')); + final searchFieldContainer = find.byKey( + const Key('search-field-container'), + ); + final unfocusedWidth = tester.getSize(searchFieldContainer).width; + expect(find.byKey(const Key('search-cancel')), findsNothing); + expect( + tester.widget(searchField).decoration?.hintText, + 'Search messages, channels, people\u2026', + ); + expect( + tester.widget(searchField).textInputAction, + TextInputAction.search, + ); + + await tester.tap(searchField); + await tester.pump(); + + final cancel = find.byKey(const Key('search-cancel')); + expect(cancel, findsOneWidget); + expect( + tester.getSize(cancel).height, + greaterThanOrEqualTo(Grid.xl), + reason: 'Cancel must keep a 48dp touch target.', + ); + expect(tester.widget(searchField).decoration?.hintText, isNull); + final enteringSlide = tester.widget( + find.ancestor(of: cancel, matching: find.byType(SlideTransition)).first, + ); + expect(enteringSlide.position.value.dx, greaterThan(0)); + + await tester.pump(const Duration(milliseconds: 160)); + final focusedWidth = tester.getSize(searchFieldContainer).width; + expect(focusedWidth, lessThan(unfocusedWidth)); + final settledSlide = tester.widget( + find.ancestor(of: cancel, matching: find.byType(SlideTransition)).first, + ); + expect(settledSlide.position.value, Offset.zero); + + await tester.enterText(searchField, 'design'); + await tester.tap(cancel); + await tester.pump(); + await tester.pump(const Duration(milliseconds: 60)); + final exitingWidth = tester.getSize(searchFieldContainer).width; + expect(exitingWidth, greaterThan(focusedWidth)); + expect(exitingWidth, lessThan(unfocusedWidth)); + await tester.pumpAndSettle(); + + final input = tester.widget(searchField); + expect(input.controller?.text, isEmpty); + expect(input.focusNode?.hasFocus, isFalse); + expect( + input.decoration?.hintText, + 'Search messages, channels, people\u2026', + ); + expect(find.byKey(const Key('search-cancel')), findsNothing); + expect( + tester.getSize(searchFieldContainer).width, + closeTo(unfocusedWidth, 0.01), + ); + }); + + testWidgets('only submitted queries are added to recent searches', ( + tester, + ) async { + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith( + () => _FakeSearchNotifier(const SearchState.initial()), + ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + ], + child: const SearchPage(), + ), + ); + await tester.pumpAndSettle(); + + final searchField = find.byKey(const Key('search-field')); + await tester.tap(searchField); + await tester.pumpAndSettle(); + await tester.enterText(searchField, 'draft'); + await tester.tap(find.byKey(const Key('search-cancel'))); + await tester.pumpAndSettle(); + expect(find.byKey(const Key('recent-searches-list')), findsNothing); + + await tester.tap(searchField); + await tester.pumpAndSettle(); + await tester.enterText(searchField, 'design systems'); + await tester.testTextInput.receiveAction(TextInputAction.search); + await tester.pump(); + await tester.tap(find.byKey(const Key('search-cancel'))); + await tester.pumpAndSettle(); + + expect(find.byKey(const Key('recent-searches-list')), findsOneWidget); + expect(find.text('design systems'), findsOneWidget); + }); + + testWidgets('recent searches can be rerun and cleared', (tester) async { + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith( + () => _FakeSearchNotifier(const SearchState.initial()), + ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const [ + 'design systems', + 'launch plan', + ]), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + ], + child: const SearchPage(), + ), + ); + await tester.pumpAndSettle(); + + expect(find.byKey(const Key('recent-searches-list')), findsOneWidget); + expect(find.text('Recent searches'), findsOneWidget); + expect(find.text('design systems'), findsOneWidget); + expect(find.text('launch plan'), findsOneWidget); + expect( + tester.getSize(find.byKey(const ValueKey('recent-search-0'))).height, + greaterThanOrEqualTo(Grid.xl), + ); + expect( + tester.getSize(find.byKey(const ValueKey('recent-search-1'))).height, + greaterThanOrEqualTo(Grid.xl), + ); + + await tester.tap(find.byKey(const ValueKey('recent-search-1'))); + await tester.pumpAndSettle(); + + final searchField = find.byKey(const Key('search-field')); + final input = tester.widget(searchField); + expect(input.controller?.text, 'launch plan'); + expect(input.focusNode?.hasFocus, isTrue); + expect(find.text("No results for 'launch plan'"), findsOneWidget); + + await tester.tap(find.byKey(const Key('search-cancel'))); + await tester.pumpAndSettle(); + expect(find.byKey(const Key('recent-search-0')), findsOneWidget); + expect(find.text('launch plan'), findsOneWidget); + + await tester.tap(find.byKey(const Key('clear-recent-searches'))); + await tester.pumpAndSettle(); + expect(find.byKey(const Key('recent-searches-list')), findsNothing); + expect(find.text('Search messages, channels, and people'), findsOneWidget); + }); + + testWidgets('keeps recent searches scrollable above the keyboard', ( + tester, + ) async { + const keyboardInset = 300.0; + + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith( + () => _FakeSearchNotifier(const SearchState.initial()), + ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const [ + 'design systems', + 'launch plan', + ]), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + ], + child: Builder( + builder: (context) => MediaQuery( + data: MediaQuery.of(context).copyWith( + viewInsets: const EdgeInsets.only(bottom: keyboardInset), + ), + child: const SearchPage(), + ), + ), + ), + ); + await tester.pumpAndSettle(); + await tester.tap(find.byKey(const Key('search-field'))); + await tester.pumpAndSettle(); + + final recentSearches = tester.widget( + find.byKey(const Key('recent-searches-list')), + ); + final padding = recentSearches.padding! as EdgeInsets; + + expect(padding.bottom, Grid.xl + keyboardInset); + }); + testWidgets('keeps search results scrollable above the keyboard', ( tester, ) async { @@ -84,6 +310,9 @@ void main() { WidgetHelpers.testable( overrides: [ searchProvider.overrideWith(() => _FakeSearchNotifier(state)), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), profileProvider.overrideWith(() => _FakeProfileNotifier()), ], child: Builder( @@ -120,6 +349,9 @@ void main() { searchProvider.overrideWith( () => _FakeSearchNotifier(const SearchState(query: query)), ), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), profileProvider.overrideWith(() => _FakeProfileNotifier()), ], child: Builder( @@ -144,6 +376,219 @@ void main() { expect(tester.getBottomLeft(message).dy, lessThan(keyboardTop)); expect(tester.takeException(), isNull); }); + + testWidgets('uses compact content styles and keeps message time by author', ( + tester, + ) async { + late _FakeRecentSearchesNotifier recentSearches; + final createdAt = DateTime.now().millisecondsSinceEpoch ~/ 1000 - 120; + final state = SearchState( + query: 'design', + channelResults: [ + Channel( + id: 'design', + name: 'design', + channelType: 'stream', + visibility: 'open', + description: 'Design discussion', + createdBy: 'test', + createdAt: DateTime(2025), + memberCount: 4, + isMember: true, + ), + ], + userResults: const [ + DirectoryUser( + pubkey: 'maya', + displayName: 'Maya', + nip05Handle: 'maya@example.com', + ), + ], + messageResults: [ + SearchHit( + eventId: 'message-1', + content: 'The latest design is ready', + kind: 9, + pubkey: 'alice', + channelName: 'design', + createdAt: createdAt, + score: 1, + ), + ], + ); + + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith(() => _FakeSearchNotifier(state)), + recentSearchesProvider.overrideWith( + () => recentSearches = _FakeRecentSearchesNotifier(const []), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + channelsProvider.overrideWith(() => _FakeChannelsNotifier()), + userCacheProvider.overrideWith( + () => _FakeUserCacheNotifier( + const UserProfile( + pubkey: 'alice', + displayName: 'Alice', + nip05Handle: 'alice@example.com', + ), + ), + ), + ], + child: const SearchPage(), + ), + ); + await tester.pumpAndSettle(); + + final channelTitle = tester.widget( + find.byKey(const ValueKey('search-channel-title-design')), + ); + final personTitle = tester.widget( + find.byKey(const ValueKey('search-person-title-maya')), + ); + for (final title in [channelTitle, personTitle]) { + expect(title.style?.fontSize, contentListTitleTextStyle.fontSize); + expect(title.style?.fontWeight, contentListTitleTextStyle.fontWeight); + expect(title.style?.height, contentListTitleTextStyle.height); + } + for (final label in ['channels', 'people', 'messages']) { + final sectionLabel = tester.widget( + find.byKey(ValueKey('search-section-$label')), + ); + expect( + sectionLabel.data, + '${label[0].toUpperCase()}${label.substring(1)}', + ); + expect(sectionLabel.style?.fontSize, activityContextTextStyle.fontSize); + expect( + sectionLabel.style?.fontWeight, + activityContextTextStyle.fontWeight, + ); + expect(sectionLabel.style?.letterSpacing, 0); + } + for (final rowKey in [ + 'search-channel-row-design', + 'search-person-row-maya', + 'search-message-row-message-1', + ]) { + final row = tester.widget(find.byKey(ValueKey(rowKey))); + expect( + row.contentPadding, + const EdgeInsets.symmetric(horizontal: Grid.gutter), + ); + } + for (final alignment in [ + ('channels', 'search-channel-leading-design'), + ('people', 'search-person-leading-maya'), + ('messages', 'search-message-avatar-message-1'), + ]) { + expect( + tester + .getTopLeft(find.byKey(ValueKey('search-section-${alignment.$1}'))) + .dx, + tester.getTopLeft(find.byKey(ValueKey(alignment.$2))).dx, + ); + } + + final authorFinder = find.byKey( + const ValueKey('search-message-author-message-1'), + ); + final usernameFinder = find.byKey( + const ValueKey('search-message-username-message-1'), + ); + final timestampFinder = find.byKey( + const ValueKey('search-message-timestamp-message-1'), + ); + final author = tester.widget(authorFinder); + final username = tester.widget(usernameFinder); + final timestamp = tester.widget(timestampFinder); + expect(author.style?.fontSize, messageUsernameTextStyle.fontSize); + expect(author.style?.fontWeight, messageUsernameTextStyle.fontWeight); + expect(author.style?.height, messageUsernameTextStyle.height); + expect(username.data, 'alice@example.com'); + expect(username.style?.fontSize, messageMetadataTextStyle.fontSize); + expect(username.style?.fontWeight, FontWeight.w400); + expect(username.style?.height, messageMetadataTextStyle.height); + expect(timestamp.style?.fontSize, messageTimestampTextStyle.fontSize); + expect(timestamp.style?.height, messageTimestampTextStyle.height); + expect( + (tester.getCenter(authorFinder).dy - tester.getCenter(timestampFinder).dy) + .abs(), + lessThan(1), + ); + expect( + (tester + .getTopLeft( + find.byKey( + const ValueKey('search-message-avatar-message-1'), + ), + ) + .dy - + tester.getTopLeft(authorFinder).dy) + .abs(), + lessThan(6), + ); + + final body = tester.widget( + find.byKey(const ValueKey('search-message-body-message-1')), + ); + expect(body.baseStyle?.fontSize, activityPreviewTextStyle.fontSize); + expect(body.baseStyle?.height, activityPreviewTextStyle.height); + expect( + tester.widget(find.byType(SmallAvatar)).size, + compactMessageAvatarSize, + ); + final contextLabel = tester.widget(find.text('Message in')); + final channelLabel = tester.widget( + find.byKey(const ValueKey('search-message-channel-message-1')), + ); + expect(contextLabel.style?.fontSize, activityContextTextStyle.fontSize); + expect(contextLabel.style?.height, activityContextTextStyle.height); + expect(channelLabel.data, '#design'); + expect(channelLabel.style?.fontSize, activityContextTextStyle.fontSize); + final channelChip = tester.widget( + find.byWidgetPredicate( + (widget) => + widget is Container && + widget.child is Text && + (widget.child as Text).key == + const ValueKey('search-message-channel-message-1'), + ), + ); + expect( + (channelChip.decoration! as BoxDecoration).borderRadius, + BorderRadius.circular(Radii.xs), + ); + expect( + tester + .getTopLeft( + find.byKey(const ValueKey('search-message-context-message-1')), + ) + .dy, + greaterThan(tester.getTopLeft(authorFinder).dy), + ); + expect( + tester + .getTopLeft( + find.byKey(const ValueKey('search-message-body-message-1')), + ) + .dy, + greaterThan( + tester + .getBottomLeft( + find.byKey(const ValueKey('search-message-context-message-1')), + ) + .dy, + ), + ); + + await tester.tap( + find.byKey(const ValueKey('search-message-row-message-1')), + ); + await tester.pump(); + expect(recentSearches.searches, const ['design']); + }); } class _FakeSearchNotifier extends SearchNotifier { @@ -153,6 +598,41 @@ class _FakeSearchNotifier extends SearchNotifier { @override SearchState build() => initialState; + + @override + void search(String query) { + state = SearchState(query: query.trim()); + } + + @override + void clear() { + state = const SearchState.initial(); + } +} + +class _FakeRecentSearchesNotifier extends RecentSearchesNotifier { + _FakeRecentSearchesNotifier(this.initialSearches); + + final List initialSearches; + List get searches => state; + + @override + List build() => initialSearches; + + @override + void record(String query) { + final trimmed = query.trim(); + if (trimmed.isEmpty) return; + state = [ + trimmed, + ...state.where((item) => item.toLowerCase() != trimmed.toLowerCase()), + ]; + } + + @override + void clear() { + state = const []; + } } class _FakeProfileNotifier extends ProfileNotifier { @@ -160,3 +640,17 @@ class _FakeProfileNotifier extends ProfileNotifier { Future build() async => const UserProfile(pubkey: 'test', displayName: 'Test'); } + +class _FakeChannelsNotifier extends ChannelsNotifier { + @override + Future> build() async => const []; +} + +class _FakeUserCacheNotifier extends UserCacheNotifier { + _FakeUserCacheNotifier(this.profile); + + final UserProfile profile; + + @override + Map build() => {profile.pubkey: profile}; +} diff --git a/mobile/test/shared/theme/message_typography_test.dart b/mobile/test/shared/theme/message_typography_test.dart new file mode 100644 index 0000000000..169bcc0200 --- /dev/null +++ b/mobile/test/shared/theme/message_typography_test.dart @@ -0,0 +1,141 @@ +import 'package:buzz/shared/theme/theme.dart'; +import 'package:flutter/material.dart'; +import 'package:flutter_test/flutter_test.dart'; + +void main() { + void expectStyle( + TextStyle style, { + required double fontSize, + required FontWeight fontWeight, + required double lineHeight, + required double letterSpacing, + }) { + expect(style.fontFamily, 'Inter'); + expect(style.fontSize, fontSize); + expect(style.fontWeight, fontWeight); + expect(style.height, closeTo(lineHeight / fontSize, 0.0001)); + expect(style.letterSpacing, letterSpacing); + } + + test('message typography matches the shared mobile scale', () { + expectStyle( + messageBodyTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 20, + letterSpacing: 0, + ); + expectStyle( + messageUsernameTextStyle, + fontSize: 15, + fontWeight: FontWeight.w600, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + messageTimestampTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 17, + letterSpacing: 0, + ); + expect(messageTimestampTextStyle, messageMetadataTextStyle); + expectStyle( + replyPreviewTextStyle, + fontSize: 13.1, + fontWeight: FontWeight.w400, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + reactionCountTextStyle, + fontSize: 13.1, + fontWeight: FontWeight.w500, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + channelTitleTextStyle, + fontSize: 20, + fontWeight: FontWeight.w700, + lineHeight: 24, + letterSpacing: 0, + ); + expectStyle( + systemMessageHeadingTextStyle, + fontSize: 15, + fontWeight: FontWeight.w600, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + systemMessageBodyTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 20, + letterSpacing: 0, + ); + }); + + test('activity typography matches the conversation row scale', () { + expectStyle( + activityUsernameTextStyle, + fontSize: 15, + fontWeight: FontWeight.w600, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + activityTimestampTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + activityContextTextStyle, + fontSize: 13.1, + fontWeight: FontWeight.w500, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + activityPreviewTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 20, + letterSpacing: 0, + ); + }); + + test('content list typography matches the compact list scale', () { + expectStyle( + contentListTitleTextStyle, + fontSize: 15, + fontWeight: FontWeight.w600, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + contentListBodyTextStyle, + fontSize: 13.1, + fontWeight: FontWeight.w400, + lineHeight: 17, + letterSpacing: 0, + ); + expectStyle( + contentListTimestampTextStyle, + fontSize: 15, + fontWeight: FontWeight.w400, + lineHeight: 17, + letterSpacing: 0, + ); + }); + + test('message and activity avatars use their surface sizes', () { + expect(messageAvatarSize, 42); + expect(activityAvatarSize, 42); + expect(compactMessageAvatarSize, 42); + expect(messageAvatarContentGap, Grid.twelve); + }); +} diff --git a/mobile/test/shared/widgets/filter_chip_bar_test.dart b/mobile/test/shared/widgets/filter_chip_bar_test.dart index 09a2f04531..6f651624b6 100644 --- a/mobile/test/shared/widgets/filter_chip_bar_test.dart +++ b/mobile/test/shared/widgets/filter_chip_bar_test.dart @@ -35,6 +35,14 @@ void main() { ); final resolved = chipTheme.color?.resolve({WidgetState.selected}); expect(resolved, accent); + final selectedLabel = tester.widget(find.text('Everyone')); + final unselectedLabel = tester.widget(find.text('Following')); + expect(selectedLabel.style?.fontSize, filterChipTextStyle.fontSize); + expect(selectedLabel.style?.height, filterChipTextStyle.height); + expect(selectedLabel.style?.fontWeight, FontWeight.w500); + expect(unselectedLabel.style?.fontSize, filterChipTextStyle.fontSize); + expect(unselectedLabel.style?.height, filterChipTextStyle.height); + expect(unselectedLabel.style?.fontWeight, FontWeight.w400); }); testWidgets('expanded chips preserve large accessible text scaling', ( diff --git a/mobile/test/shared/widgets/message_author_meta_test.dart b/mobile/test/shared/widgets/message_author_meta_test.dart new file mode 100644 index 0000000000..a97af86130 --- /dev/null +++ b/mobile/test/shared/widgets/message_author_meta_test.dart @@ -0,0 +1,82 @@ +import 'package:buzz/shared/theme/theme.dart'; +import 'package:buzz/shared/widgets/message_author_meta.dart'; +import 'package:flutter/material.dart'; +import 'package:flutter_test/flutter_test.dart'; + +void main() { + testWidgets('reallocates unused metadata width to the display name', ( + tester, + ) async { + const displayNameKey = Key('author-display-name'); + const timestampKey = Key('author-timestamp'); + + await tester.pumpWidget( + MaterialApp( + theme: AppTheme.light(), + home: const Scaffold( + body: SizedBox( + width: 300, + child: MessageAuthorMeta( + displayName: 'A display name that needs the available width', + username: 'al', + timestamp: '2m', + displayNameKey: displayNameKey, + timestampKey: timestampKey, + nameColor: Colors.black, + metadataColor: Colors.grey, + ), + ), + ), + ), + ); + await tester.pumpAndSettle(); + + final row = find.byType(MessageAuthorMeta); + final displayName = find.byKey(displayNameKey); + final timestamp = find.byKey(timestampKey); + + expect( + tester.getSize(displayName).width, + greaterThan(tester.getSize(row).width / 2), + ); + expect( + tester.getTopRight(timestamp).dx, + closeTo(tester.getTopRight(row).dx, 0.01), + ); + expect(tester.takeException(), isNull); + }); + + testWidgets('constrains long metadata at large accessible text sizes', ( + tester, + ) async { + const timestampKey = Key('author-timestamp'); + + await tester.pumpWidget( + MaterialApp( + theme: AppTheme.light(), + home: const MediaQuery( + data: MediaQueryData(textScaler: TextScaler.linear(2)), + child: Scaffold( + body: SizedBox( + width: 220, + child: MessageAuthorMeta( + displayName: 'A very long display name', + username: 'a-very-long-username', + timestamp: 'Mar 15, 2025', + timestampKey: timestampKey, + nameColor: Colors.black, + metadataColor: Colors.grey, + ), + ), + ), + ), + ), + ); + await tester.pumpAndSettle(); + + final timestamp = tester.widget(find.byKey(timestampKey)); + expect(timestamp.maxLines, 1); + expect(timestamp.overflow, TextOverflow.ellipsis); + expect(tester.takeException(), isNull); + }); +} From a3b097745a3fc22872d05bbd558d231ead4e661d Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Tue, 28 Jul 2026 18:05:43 +0100 Subject: [PATCH 006/112] Refine mobile attachment picking (#3313) ## What - morph the composer plus button into the attachment menu, camera, and photo surfaces - add ordered multi-select with inline recent photos and system picker fallback - add native iOS attachment/photo popovers and align the Android camera treatment ## Stack - follows #3312 ## Validation - `just mobile-check` - `flutter test test/features/channels/compose_bar_test.dart` - full mobile pre-push suite --------- Signed-off-by: kenny lopez --- .../android/app/src/main/AndroidManifest.xml | 5 +- mobile/ios/Runner.xcodeproj/project.pbxproj | 12 + mobile/ios/Runner/AppDelegate.swift | 55 +- mobile/ios/Runner/Info.plist | 2 + mobile/ios/Runner/InlinePhotoPicker.swift | 235 +++++ .../ios/Runner/NativeAttachmentPopover.swift | 969 ++++++++++++++++++ .../NativeAttachmentPopoverCoordinator.swift | 228 +++++ .../channels/camera_capture_cleanup.dart | 24 +- mobile/lib/features/channels/compose_bar.dart | 568 +++++----- .../channels/compose_bar/attachments.dart | 353 +++++-- .../channels/compose_bar/camera_preview.dart | 98 +- .../channels/compose_bar/helpers.dart | 6 + .../compose_bar/ios_attachment_popover.dart | 174 ++++ .../compose_bar/ios_photo_picker.dart | 228 +++++ .../features/channels/compose_bar/layout.dart | 245 +++++ .../compose_bar/photo_gallery_picker.dart | 381 +++++++ .../channels/compose_bar/suggestions.dart | 111 +- .../lib/features/channels/photo_library.dart | 104 ++ mobile/lib/shared/relay/media_upload.dart | 44 +- .../channels/camera_capture_cleanup_test.dart | 19 + .../features/channels/compose_bar_test.dart | 535 +++++++++- 21 files changed, 3932 insertions(+), 464 deletions(-) create mode 100644 mobile/ios/Runner/InlinePhotoPicker.swift create mode 100644 mobile/ios/Runner/NativeAttachmentPopover.swift create mode 100644 mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift create mode 100644 mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart create mode 100644 mobile/lib/features/channels/compose_bar/ios_photo_picker.dart create mode 100644 mobile/lib/features/channels/compose_bar/layout.dart create mode 100644 mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart create mode 100644 mobile/lib/features/channels/photo_library.dart diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml index e1eb3e3456..5e607ad2ea 100644 --- a/mobile/android/app/src/main/AndroidManifest.xml +++ b/mobile/android/app/src/main/AndroidManifest.xml @@ -5,11 +5,14 @@ + + + Buzz needs photo library access so you can attach images to messages. NSPhotoLibraryAddUsageDescription Buzz needs permission to save images to your photo library. + PHPhotoLibraryPreventAutomaticLimitedAccessAlert + UIApplicationSceneManifest UIApplicationSupportsMultipleScenes diff --git a/mobile/ios/Runner/InlinePhotoPicker.swift b/mobile/ios/Runner/InlinePhotoPicker.swift new file mode 100644 index 0000000000..4b8d1365df --- /dev/null +++ b/mobile/ios/Runner/InlinePhotoPicker.swift @@ -0,0 +1,235 @@ +import Flutter +import PhotosUI +import UIKit +import UniformTypeIdentifiers + +final class InlinePhotoPickerFactory: NSObject, FlutterPlatformViewFactory { + private let messenger: FlutterBinaryMessenger + private weak var parentViewController: UIViewController? + + init( + messenger: FlutterBinaryMessenger, + parentViewController: UIViewController? + ) { + self.messenger = messenger + self.parentViewController = parentViewController + super.init() + } + + func create( + withFrame frame: CGRect, + viewIdentifier viewId: Int64, + arguments args: Any? + ) -> FlutterPlatformView { + InlinePhotoPickerPlatformView( + frame: frame, + viewIdentifier: viewId, + messenger: messenger, + parentViewController: parentViewController + ) + } +} + +final class InlinePhotoPickerPlatformView: NSObject, FlutterPlatformView { + private let containerView: UIView + private let channel: FlutterMethodChannel + private weak var parentViewController: UIViewController? + private var pickerViewController: PHPickerViewController? + private var selectionGeneration = 0 + private var selectionTask: Task? + private var selectedTemporaryPaths: [String] = [] + + init( + frame: CGRect, + viewIdentifier viewId: Int64, + messenger: FlutterBinaryMessenger, + parentViewController: UIViewController? + ) { + containerView = UIView(frame: frame) + channel = FlutterMethodChannel( + name: "buzz/inline_photo_picker/\(viewId)", + binaryMessenger: messenger + ) + self.parentViewController = parentViewController + super.init() + + channel.setMethodCallHandler { [weak self] call, result in + guard call.method == "claimSelection" else { + result(FlutterMethodNotImplemented) + return + } + let paths = call.arguments as? [String] ?? [] + guard let self, paths == self.selectedTemporaryPaths else { + result(false) + return + } + self.selectedTemporaryPaths = [] + result(true) + } + + containerView.backgroundColor = .clear + if #available(iOS 17.0, *) { + installPicker() + } + } + + deinit { + selectionTask?.cancel() + Self.removeTemporaryFiles(selectedTemporaryPaths) + channel.setMethodCallHandler(nil) + pickerViewController?.willMove(toParent: nil) + pickerViewController?.view.removeFromSuperview() + pickerViewController?.removeFromParent() + } + + func view() -> UIView { + containerView + } + + @available(iOS 17.0, *) + private func installPicker() { + var configuration = PHPickerConfiguration(photoLibrary: .shared()) + configuration.filter = .images + configuration.selectionLimit = 0 + configuration.selection = .continuousAndOrdered + configuration.preferredAssetRepresentationMode = .compatible + configuration.disabledCapabilities = [ + .search, + .stagingArea, + .collectionNavigation, + .selectionActions, + ] + configuration.edgesWithoutContentMargins = .all + + let picker = PHPickerViewController(configuration: configuration) + picker.delegate = self + picker.view.backgroundColor = .clear + picker.view.translatesAutoresizingMaskIntoConstraints = false + + if let parentViewController { + parentViewController.addChild(picker) + } + containerView.addSubview(picker.view) + NSLayoutConstraint.activate([ + picker.view.leadingAnchor.constraint(equalTo: containerView.leadingAnchor), + picker.view.trailingAnchor.constraint(equalTo: containerView.trailingAnchor), + picker.view.topAnchor.constraint(equalTo: containerView.topAnchor), + picker.view.bottomAnchor.constraint(equalTo: containerView.bottomAnchor), + ]) + if parentViewController != nil { + picker.didMove(toParent: parentViewController) + } + pickerViewController = picker + } + + private func exportPickerResult(_ result: PHPickerResult) async throws -> String { + let provider = result.itemProvider + guard + let typeIdentifier = provider.registeredTypeIdentifiers.first(where: { + guard let type = UTType($0) else { return false } + return type.conforms(to: .image) + }) + else { + throw InlinePhotoPickerError.unsupportedImage + } + + return try await withCheckedThrowingContinuation { continuation in + provider.loadFileRepresentation(forTypeIdentifier: typeIdentifier) { + sourceURL, + error in + if let error { + continuation.resume(throwing: error) + return + } + guard let sourceURL else { + continuation.resume(throwing: InlinePhotoPickerError.missingFile) + return + } + + do { + let fileExtension = + sourceURL.pathExtension.isEmpty + ? (UTType(typeIdentifier)?.preferredFilenameExtension ?? "jpg") + : sourceURL.pathExtension + let destinationURL = FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString) + .appendingPathExtension(fileExtension) + try FileManager.default.copyItem( + at: sourceURL, + to: destinationURL + ) + continuation.resume(returning: destinationURL.path) + } catch { + continuation.resume(throwing: error) + } + } + } + } + + private static func removeTemporaryFiles(_ paths: [String]) { + for path in paths where !path.isEmpty { + try? FileManager.default.removeItem(atPath: path) + } + } +} + +extension InlinePhotoPickerPlatformView: PHPickerViewControllerDelegate { + func picker( + _ picker: PHPickerViewController, + didFinishPicking results: [PHPickerResult] + ) { + selectionGeneration += 1 + let generation = selectionGeneration + selectionTask?.cancel() + selectionTask = nil + Self.removeTemporaryFiles(selectedTemporaryPaths) + selectedTemporaryPaths = [] + channel.invokeMethod( + "selectionCountChanged", + arguments: results.count + ) + + guard !results.isEmpty else { + channel.invokeMethod("selectionDidChange", arguments: [String]()) + return + } + + selectionTask = Task { [weak self] in + guard let self else { return } + var paths: [String] = [] + do { + for result in results { + try Task.checkCancellation() + paths.append(try await self.exportPickerResult(result)) + } + try Task.checkCancellation() + await MainActor.run { + guard generation == self.selectionGeneration else { + Self.removeTemporaryFiles(paths) + return + } + self.selectedTemporaryPaths = paths + self.selectionTask = nil + self.channel.invokeMethod("selectionDidChange", arguments: paths) + } + } catch is CancellationError { + Self.removeTemporaryFiles(paths) + } catch { + Self.removeTemporaryFiles(paths) + await MainActor.run { + guard generation == self.selectionGeneration else { return } + self.selectionTask = nil + self.channel.invokeMethod( + "didFail", + arguments: "Unable to prepare the selected photos." + ) + } + } + } + } +} + +private enum InlinePhotoPickerError: Error { + case missingFile + case unsupportedImage +} diff --git a/mobile/ios/Runner/NativeAttachmentPopover.swift b/mobile/ios/Runner/NativeAttachmentPopover.swift new file mode 100644 index 0000000000..bb49ca6e46 --- /dev/null +++ b/mobile/ios/Runner/NativeAttachmentPopover.swift @@ -0,0 +1,969 @@ +import AVFoundation +import Flutter +import PhotosUI +import UIKit +import UniformTypeIdentifiers + +@available(iOS 26.0, *) +final class NativeAttachmentPopoverViewController: + UIViewController, + PHPickerViewControllerDelegate, + UIPopoverPresentationControllerDelegate, + AVCapturePhotoCaptureDelegate +{ + private enum Surface { + case menu + case photos + case camera + } + + private let channel: FlutterMethodChannel + private let expandedWidth: CGFloat + private let menuSize = CGSize(width: 176, height: 208) + private let expandedHeight: CGFloat = 372 + private let expandedHorizontalOffset: CGFloat = 10 + private let expandedVerticalOffset: CGFloat = 40 + private let contentHost = UIView() + private let cameraSession = AVCaptureSession() + private let cameraOutput = AVCapturePhotoOutput() + private let cameraQueue = DispatchQueue( + label: "buzz.native-attachment-camera" + ) + + private var surface = Surface.menu + private var visibleContentView: UIView? + private var photoPickerViewController: PHPickerViewController? + private var cameraPreviewLayer: AVCaptureVideoPreviewLayer? + private weak var cameraPreviewView: UIView? + private weak var photoActionButton: UIButton? + private weak var cameraCaptureButton: UIButton? + private var cameraDevice: AVCaptureDevice? + private var cameraRotationCoordinator: AVCaptureDevice.RotationCoordinator? + private var cameraRotationObservation: NSKeyValueObservation? + private var selectionGeneration = 0 + private var selectionTask: Task? + private var selectedPhotoPaths: [String] = [] + private var cameraConfigured = false + private var cameraIsStarting = false + private var cameraStartupGeneration = 0 + private var cameraIsCapturing = false + private var activeCameraCaptureID: Int64? + private var isFinishing = false + private var didNotifyDismissal = false + + var onDismiss: (() -> Void)? + + init(channel: FlutterMethodChannel, expandedWidth: CGFloat) { + self.channel = channel + self.expandedWidth = expandedWidth + super.init(nibName: nil, bundle: nil) + preferredContentSize = menuSize + } + + @available(*, unavailable) + required init?(coder: NSCoder) { + fatalError("init(coder:) has not been implemented") + } + + override func viewDidLoad() { + super.viewDidLoad() + view.backgroundColor = .clear + view.layer.cornerRadius = 22 + view.layer.cornerCurve = .continuous + view.clipsToBounds = true + + let glassEffect = UIGlassEffect(style: .regular) + glassEffect.isInteractive = true + let glassView = UIVisualEffectView(effect: glassEffect) + glassView.translatesAutoresizingMaskIntoConstraints = false + view.addSubview(glassView) + + contentHost.translatesAutoresizingMaskIntoConstraints = false + view.addSubview(contentHost) + NSLayoutConstraint.activate([ + glassView.leadingAnchor.constraint(equalTo: view.leadingAnchor), + glassView.trailingAnchor.constraint(equalTo: view.trailingAnchor), + glassView.topAnchor.constraint(equalTo: view.topAnchor), + glassView.bottomAnchor.constraint(equalTo: view.bottomAnchor), + contentHost.leadingAnchor.constraint(equalTo: view.leadingAnchor), + contentHost.trailingAnchor.constraint(equalTo: view.trailingAnchor), + contentHost.topAnchor.constraint(equalTo: view.topAnchor), + contentHost.bottomAnchor.constraint(equalTo: view.bottomAnchor), + ]) + + let menu = makeMenuView() + installContent(menu) + } + + override func viewDidLayoutSubviews() { + super.viewDidLayoutSubviews() + cameraPreviewLayer?.frame = cameraPreviewView?.bounds ?? .zero + } + + override func viewWillDisappear(_ animated: Bool) { + super.viewWillDisappear(animated) + invalidateCameraCapture() + stopCamera() + } + + func adaptivePresentationStyle( + for controller: UIPresentationController + ) -> UIModalPresentationStyle { + .none + } + + func presentationControllerDidDismiss( + _ presentationController: UIPresentationController + ) { + notifyDismissalIfNeeded() + } + + private func makeMenuView() -> UIView { + let container = UIView() + container.translatesAutoresizingMaskIntoConstraints = false + + let stack = UIStackView() + stack.axis = .vertical + stack.distribution = .fillEqually + stack.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(stack) + NSLayoutConstraint.activate([ + stack.leadingAnchor.constraint(equalTo: container.leadingAnchor), + stack.trailingAnchor.constraint(equalTo: container.trailingAnchor), + stack.topAnchor.constraint(equalTo: container.topAnchor, constant: 8), + stack.bottomAnchor.constraint(equalTo: container.bottomAnchor, constant: -8), + ]) + + stack.addArrangedSubview( + makeNativeAttachmentMenuButton( + title: "Camera", + symbol: "camera", + action: UIAction { [weak self] _ in self?.showCamera() } + ) + ) + stack.addArrangedSubview( + makeNativeAttachmentMenuButton( + title: "Photos", + symbol: "photo.on.rectangle.angled", + action: UIAction { [weak self] _ in self?.showPhotos() } + ) + ) + stack.addArrangedSubview( + makeNativeAttachmentMenuButton( + title: "Video", + symbol: "video", + action: UIAction { [weak self] _ in + self?.finish(method: "pickVideo") + } + ) + ) + stack.addArrangedSubview( + makeNativeAttachmentMenuButton( + title: "Files", + symbol: "doc", + action: UIAction { [weak self] _ in + self?.finish(method: "pickFiles") + } + ) + ) + return container + } + + private func showPhotos() { + guard surface != .photos else { return } + stopCamera() + + var configuration = PHPickerConfiguration(photoLibrary: .shared()) + configuration.filter = .images + configuration.selectionLimit = 0 + configuration.selection = .continuousAndOrdered + configuration.preferredAssetRepresentationMode = .compatible + configuration.disabledCapabilities = [ + .search, + .stagingArea, + .collectionNavigation, + .selectionActions, + ] + configuration.edgesWithoutContentMargins = .all + + let picker = PHPickerViewController(configuration: configuration) + picker.delegate = self + picker.view.backgroundColor = .clear + + let container = UIView() + container.backgroundColor = .clear + addChild(picker) + picker.view.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(picker.view) + NSLayoutConstraint.activate([ + picker.view.leadingAnchor.constraint(equalTo: container.leadingAnchor), + picker.view.trailingAnchor.constraint(equalTo: container.trailingAnchor), + picker.view.topAnchor.constraint( + equalTo: container.topAnchor, + constant: -8 + ), + picker.view.bottomAnchor.constraint(equalTo: container.bottomAnchor), + ]) + picker.didMove(toParent: self) + photoPickerViewController = picker + + let backButton = makeGlassControl( + title: nil, + symbol: "chevron.left", + accessibilityLabel: "Back to attachment options", + action: UIAction { [weak self] _ in self?.showMenu() } + ) + let actionButton = makeGlassControl( + title: "All Photos", + symbol: nil, + accessibilityLabel: "All Photos", + prominent: true, + action: UIAction { [weak self] _ in self?.performPhotoAction() } + ) + photoActionButton = actionButton + addBottomControls( + to: container, + leading: backButton, + trailing: actionButton + ) + + transition(to: .photos, content: container) + } + + private func showCamera() { + guard surface != .camera else { return } + removePhotoPicker() + + let container = UIView() + container.backgroundColor = .black + let preview = UIView() + preview.backgroundColor = .black + preview.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(preview) + NSLayoutConstraint.activate([ + preview.leadingAnchor.constraint(equalTo: container.leadingAnchor), + preview.trailingAnchor.constraint(equalTo: container.trailingAnchor), + preview.topAnchor.constraint(equalTo: container.topAnchor), + preview.bottomAnchor.constraint(equalTo: container.bottomAnchor), + ]) + cameraPreviewView = preview + + let placeholder = UIActivityIndicatorView(style: .large) + placeholder.color = .white + placeholder.startAnimating() + placeholder.translatesAutoresizingMaskIntoConstraints = false + preview.addSubview(placeholder) + NSLayoutConstraint.activate([ + placeholder.centerXAnchor.constraint(equalTo: preview.centerXAnchor), + placeholder.centerYAnchor.constraint(equalTo: preview.centerYAnchor), + ]) + placeholder.tag = 7001 + + let backButton = makeGlassControl( + title: nil, + symbol: "chevron.left", + accessibilityLabel: "Back to attachment options", + action: UIAction { [weak self] _ in self?.showMenu() } + ) + let captureButton = makeCameraCaptureButton() + cameraCaptureButton = captureButton + addBottomControls( + to: container, + leading: backButton, + center: captureButton + ) + + transition(to: .camera, content: container) + startCamera() + } + + private func showMenu() { + guard surface != .menu else { return } + invalidateCameraCapture() + selectionGeneration += 1 + selectionTask?.cancel() + selectionTask = nil + Self.removeTemporaryFiles(selectedPhotoPaths) + selectedPhotoPaths = [] + stopCamera() + + let menu = makeMenuView() + transition(to: .menu, content: menu) { [weak self] in + self?.removePhotoPicker() + } + } + + private func installContent(_ content: UIView) { + content.translatesAutoresizingMaskIntoConstraints = false + contentHost.addSubview(content) + NSLayoutConstraint.activate([ + content.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor), + content.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor), + content.topAnchor.constraint(equalTo: contentHost.topAnchor), + content.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor), + ]) + visibleContentView = content + } + + private func transition( + to nextSurface: Surface, + content nextView: UIView, + completion: (() -> Void)? = nil + ) { + let previousView = visibleContentView + let isExpanding = nextSurface != .menu + let targetSize = + isExpanding + ? CGSize(width: expandedWidth, height: expandedHeight) + : menuSize + + nextView.translatesAutoresizingMaskIntoConstraints = false + contentHost.addSubview(nextView) + NSLayoutConstraint.activate([ + nextView.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor), + nextView.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor), + nextView.topAnchor.constraint(equalTo: contentHost.topAnchor), + nextView.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor), + ]) + contentHost.layoutIfNeeded() + + let direction: CGFloat = isExpanding ? 34 : -34 + nextView.alpha = UIAccessibility.isReduceMotionEnabled ? 0 : 0.01 + nextView.transform = + UIAccessibility.isReduceMotionEnabled + ? .identity + : CGAffineTransform(translationX: direction, y: 0).scaledBy( + x: 0.97, + y: 0.97 + ) + visibleContentView = nextView + surface = nextSurface + + let duration = UIAccessibility.isReduceMotionEnabled ? 0.16 : 0.36 + UIView.animate( + withDuration: duration, + delay: 0, + usingSpringWithDamping: 0.86, + initialSpringVelocity: 0.18, + options: [.beginFromCurrentState, .allowUserInteraction] + ) { + self.preferredContentSize = targetSize + if let popover = self.popoverPresentationController, + let sourceView = popover.sourceView + { + popover.sourceRect = sourceView.bounds.offsetBy( + dx: isExpanding ? self.expandedHorizontalOffset : 0, + dy: isExpanding ? self.expandedVerticalOffset : 0 + ) + } + previousView?.alpha = 0 + previousView?.transform = + UIAccessibility.isReduceMotionEnabled + ? .identity + : CGAffineTransform(translationX: -direction, y: 0).scaledBy( + x: 0.97, + y: 0.97 + ) + nextView.alpha = 1 + nextView.transform = .identity + self.view.layoutIfNeeded() + } completion: { _ in + previousView?.removeFromSuperview() + previousView?.transform = .identity + completion?() + } + } + + private func makeGlassControl( + title: String?, + symbol: String?, + accessibilityLabel: String, + prominent: Bool = false, + action: UIAction + ) -> UIButton { + var configuration = + prominent + ? UIButton.Configuration.prominentGlass() + : UIButton.Configuration.glass() + configuration.title = title + if prominent { + configuration.baseBackgroundColor = .black + } + if let symbol { + configuration.image = UIImage(systemName: symbol) + } + configuration.imagePadding = 8 + configuration.baseForegroundColor = .white + configuration.contentInsets = NSDirectionalEdgeInsets( + top: 11, + leading: 15, + bottom: 11, + trailing: 15 + ) + let button = UIButton(configuration: configuration, primaryAction: action) + button.accessibilityLabel = accessibilityLabel + return button + } + + private func makeCameraCaptureButton() -> UIButton { + let button = UIButton( + primaryAction: UIAction { [weak self] _ in self?.capturePhoto() } + ) + button.accessibilityLabel = "Take photo" + button.translatesAutoresizingMaskIntoConstraints = false + button.backgroundColor = UIColor.white.withAlphaComponent(0.22) + button.layer.cornerRadius = 34 + button.layer.borderColor = UIColor.white.cgColor + button.layer.borderWidth = 3 + let inner = UIView() + inner.isUserInteractionEnabled = false + inner.translatesAutoresizingMaskIntoConstraints = false + inner.backgroundColor = .white + inner.layer.cornerRadius = 25 + button.addSubview(inner) + NSLayoutConstraint.activate([ + button.widthAnchor.constraint(equalToConstant: 68), + button.heightAnchor.constraint(equalToConstant: 68), + inner.widthAnchor.constraint(equalToConstant: 50), + inner.heightAnchor.constraint(equalToConstant: 50), + inner.centerXAnchor.constraint(equalTo: button.centerXAnchor), + inner.centerYAnchor.constraint(equalTo: button.centerYAnchor), + ]) + return button + } + + private func addBottomControls( + to container: UIView, + leading: UIButton, + center: UIButton? = nil, + trailing: UIButton? = nil + ) { + leading.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(leading) + var constraints = [ + leading.leadingAnchor.constraint( + equalTo: container.leadingAnchor, + constant: 12 + ), + leading.bottomAnchor.constraint( + equalTo: container.bottomAnchor, + constant: -12 + ), + leading.heightAnchor.constraint(greaterThanOrEqualToConstant: 44), + ] + + if let center { + center.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(center) + constraints.append( + center.centerXAnchor.constraint(equalTo: container.centerXAnchor) + ) + constraints.append( + center.bottomAnchor.constraint( + equalTo: container.bottomAnchor, + constant: -12 + ) + ) + } + if let trailing { + trailing.translatesAutoresizingMaskIntoConstraints = false + container.addSubview(trailing) + constraints.append( + trailing.trailingAnchor.constraint( + equalTo: container.trailingAnchor, + constant: -12 + ) + ) + constraints.append( + trailing.bottomAnchor.constraint( + equalTo: container.bottomAnchor, + constant: -12 + ) + ) + constraints.append( + trailing.heightAnchor.constraint(greaterThanOrEqualToConstant: 44) + ) + } + NSLayoutConstraint.activate(constraints) + } + + func picker( + _ picker: PHPickerViewController, + didFinishPicking results: [PHPickerResult] + ) { + selectionGeneration += 1 + let generation = selectionGeneration + selectionTask?.cancel() + selectionTask = nil + Self.removeTemporaryFiles(selectedPhotoPaths) + selectedPhotoPaths = [] + updatePhotoAction(count: results.count, preparing: !results.isEmpty) + + guard !results.isEmpty else { return } + selectionTask = Task { [weak self] in + guard let self else { return } + var paths: [String] = [] + do { + for result in results { + try Task.checkCancellation() + paths.append(try await self.exportPickerResult(result)) + } + try Task.checkCancellation() + await MainActor.run { + guard generation == self.selectionGeneration else { + Self.removeTemporaryFiles(paths) + return + } + self.selectedPhotoPaths = paths + self.selectionTask = nil + self.updatePhotoAction(count: paths.count, preparing: false) + } + } catch is CancellationError { + Self.removeTemporaryFiles(paths) + } catch { + Self.removeTemporaryFiles(paths) + await MainActor.run { + guard generation == self.selectionGeneration else { return } + self.selectionTask = nil + self.selectedPhotoPaths = [] + self.updatePhotoAction(count: 0, preparing: false) + self.showError("Unable to prepare the selected photos.") + } + } + } + } + + private func updatePhotoAction(count: Int, preparing: Bool) { + let title: String + if preparing { + title = "Preparing…" + } else if count == 0 { + title = "All Photos" + } else { + title = "Add \(count) \(count == 1 ? "photo" : "photos")" + } + guard let button = photoActionButton else { return } + let canInteract = !preparing + button.configuration?.title = title + button.accessibilityLabel = title + button.isUserInteractionEnabled = canInteract + if canInteract { + button.accessibilityTraits.remove(.notEnabled) + } else { + button.accessibilityTraits.insert(.notEnabled) + } + } + + private func performPhotoAction() { + if selectedPhotoPaths.isEmpty { + finish(method: "pickAllPhotos") + } else { + let paths = selectedPhotoPaths + selectedPhotoPaths = [] + finish( + method: "photosSelected", + arguments: paths, + temporaryPaths: paths + ) + } + } + + private func exportPickerResult(_ result: PHPickerResult) async throws + -> String + { + let provider = result.itemProvider + guard + let typeIdentifier = provider.registeredTypeIdentifiers.first(where: { + guard let type = UTType($0) else { return false } + return type.conforms(to: .image) + }) + else { + throw NativeAttachmentPopoverError.unsupportedImage + } + + return try await withCheckedThrowingContinuation { continuation in + provider.loadFileRepresentation(forTypeIdentifier: typeIdentifier) { + sourceURL, + error in + if let error { + continuation.resume(throwing: error) + return + } + guard let sourceURL else { + continuation.resume( + throwing: NativeAttachmentPopoverError.missingFile + ) + return + } + + do { + let fileExtension = + sourceURL.pathExtension.isEmpty + ? (UTType(typeIdentifier)?.preferredFilenameExtension ?? "jpg") + : sourceURL.pathExtension + let destinationURL = FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString) + .appendingPathExtension(fileExtension) + try FileManager.default.copyItem( + at: sourceURL, + to: destinationURL + ) + continuation.resume(returning: destinationURL.path) + } catch { + continuation.resume(throwing: error) + } + } + } + } + + private static func removeTemporaryFiles(_ paths: [String]) { + for path in paths where !path.isEmpty { + try? FileManager.default.removeItem(atPath: path) + } + } + + private func startCamera() { + guard !cameraIsStarting else { return } + cameraIsStarting = true + cameraStartupGeneration += 1 + let startupGeneration = cameraStartupGeneration + + switch AVCaptureDevice.authorizationStatus(for: .video) { + case .authorized: + configureAndStartCamera(startupGeneration: startupGeneration) + case .notDetermined: + AVCaptureDevice.requestAccess(for: .video) { [weak self] granted in + DispatchQueue.main.async { + guard + let self, + self.cameraStartupIsCurrent(startupGeneration) + else { return } + if granted { + self.configureAndStartCamera( + startupGeneration: startupGeneration + ) + } else { + self.cameraIsStarting = false + self.showCameraUnavailable( + "Camera access is needed to take a photo." + ) + } + } + } + default: + cameraIsStarting = false + showCameraUnavailable("Camera access is needed to take a photo.") + } + } + + private func configureAndStartCamera(startupGeneration: Int) { + cameraQueue.async { [weak self] in + guard let self else { return } + do { + if !self.cameraConfigured { + self.cameraSession.beginConfiguration() + defer { self.cameraSession.commitConfiguration() } + self.cameraSession.sessionPreset = .photo + guard + let device = AVCaptureDevice.default( + .builtInWideAngleCamera, + for: .video, + position: .back + ) + else { + throw NativeAttachmentPopoverError.cameraUnavailable + } + let input = try AVCaptureDeviceInput(device: device) + guard self.cameraSession.canAddInput(input) else { + throw NativeAttachmentPopoverError.cameraUnavailable + } + self.cameraSession.addInput(input) + self.cameraDevice = device + guard self.cameraSession.canAddOutput(self.cameraOutput) else { + throw NativeAttachmentPopoverError.cameraUnavailable + } + self.cameraSession.addOutput(self.cameraOutput) + self.cameraConfigured = true + } + + if !self.cameraSession.isRunning { + self.cameraSession.startRunning() + } + DispatchQueue.main.async { [weak self] in + guard + let self, + self.cameraStartupIsCurrent(startupGeneration) + else { return } + self.cameraIsStarting = false + self.installCameraPreview() + } + } catch { + if self.cameraSession.isRunning { + self.cameraSession.stopRunning() + } + DispatchQueue.main.async { [weak self] in + guard + let self, + self.cameraStartupIsCurrent(startupGeneration) + else { return } + self.cameraIsStarting = false + self.showCameraUnavailable("Camera isn’t available here.") + } + } + } + } + + private func cameraStartupIsCurrent(_ generation: Int) -> Bool { + generation == cameraStartupGeneration && surface == .camera && !isFinishing + } + + private func installCameraPreview() { + guard surface == .camera, let previewView = cameraPreviewView else { return } + previewView.viewWithTag(7001)?.removeFromSuperview() + cameraPreviewLayer?.removeFromSuperlayer() + + let layer = AVCaptureVideoPreviewLayer(session: cameraSession) + layer.videoGravity = .resizeAspectFill + layer.frame = previewView.bounds + previewView.layer.insertSublayer(layer, at: 0) + cameraPreviewLayer = layer + + if let cameraDevice { + let coordinator = AVCaptureDevice.RotationCoordinator( + device: cameraDevice, + previewLayer: layer + ) + cameraRotationCoordinator = coordinator + cameraRotationObservation = coordinator.observe( + \.videoRotationAngleForHorizonLevelPreview, + options: [.initial, .new] + ) { [weak layer] coordinator, _ in + guard let connection = layer?.connection else { return } + let angle = coordinator.videoRotationAngleForHorizonLevelPreview + guard connection.isVideoRotationAngleSupported(angle) else { return } + connection.videoRotationAngle = angle + } + } + } + + private func stopCamera() { + cameraStartupGeneration += 1 + cameraIsStarting = false + cameraRotationObservation?.invalidate() + cameraRotationObservation = nil + cameraRotationCoordinator = nil + cameraPreviewLayer?.removeFromSuperlayer() + cameraPreviewLayer = nil + cameraQueue.async { [weak self] in + guard let self, self.cameraSession.isRunning else { return } + self.cameraSession.stopRunning() + } + } + + private func capturePhoto() { + guard !cameraIsCapturing, cameraSession.isRunning else { return } + cameraIsCapturing = true + cameraCaptureButton?.isEnabled = false + cameraCaptureButton?.transform = CGAffineTransform( + scaleX: 0.92, + y: 0.92 + ) + UIView.animate( + withDuration: 0.12, + delay: 0, + options: [.beginFromCurrentState, .allowUserInteraction] + ) { + self.cameraCaptureButton?.transform = .identity + } + if let connection = cameraOutput.connection(with: .video), + let cameraRotationCoordinator + { + let angle = + cameraRotationCoordinator.videoRotationAngleForHorizonLevelCapture + if connection.isVideoRotationAngleSupported(angle) { + connection.videoRotationAngle = angle + } + } + let settings = AVCapturePhotoSettings() + activeCameraCaptureID = settings.uniqueID + cameraOutput.capturePhoto(with: settings, delegate: self) + } + + func photoOutput( + _ output: AVCapturePhotoOutput, + didFinishProcessingPhoto photo: AVCapturePhoto, + error: Error? + ) { + guard error == nil, let data = photo.fileDataRepresentation() else { + DispatchQueue.main.async { [weak self] in + self?.completeCameraCapture( + captureID: photo.resolvedSettings.uniqueID, + path: nil, + errorMessage: "Unable to capture the photo." + ) + } + return + } + + DispatchQueue.global(qos: .userInitiated).async { + do { + let destinationURL = FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString) + .appendingPathExtension("jpg") + try data.write(to: destinationURL, options: .atomic) + DispatchQueue.main.async { [weak self] in + guard let self else { + Self.removeTemporaryFiles([destinationURL.path]) + return + } + self.completeCameraCapture( + captureID: photo.resolvedSettings.uniqueID, + path: destinationURL.path, + errorMessage: nil + ) + } + } catch { + DispatchQueue.main.async { [weak self] in + self?.completeCameraCapture( + captureID: photo.resolvedSettings.uniqueID, + path: nil, + errorMessage: "Unable to prepare the captured photo." + ) + } + } + } + } + + @MainActor + private func completeCameraCapture( + captureID: Int64, + path: String?, + errorMessage: String? + ) { + guard + captureID == activeCameraCaptureID, surface == .camera, !isFinishing + else { + if let path { Self.removeTemporaryFiles([path]) } + return + } + activeCameraCaptureID = nil + cameraIsCapturing = false + cameraCaptureButton?.isEnabled = true + if let path { + finish( + method: "cameraCaptured", + arguments: path, + temporaryPaths: [path] + ) + } else if !isFinishing, let errorMessage { + showError(errorMessage) + } + } + + private func invalidateCameraCapture() { + activeCameraCaptureID = nil + cameraIsCapturing = false + cameraCaptureButton?.isEnabled = true + } + + private func showCameraUnavailable(_ message: String) { + guard let previewView = cameraPreviewView else { return } + previewView.viewWithTag(7001)?.removeFromSuperview() + let label = UILabel() + label.text = message + label.textColor = .white + label.textAlignment = .center + label.numberOfLines = 0 + label.translatesAutoresizingMaskIntoConstraints = false + previewView.addSubview(label) + NSLayoutConstraint.activate([ + label.centerXAnchor.constraint(equalTo: previewView.centerXAnchor), + label.centerYAnchor.constraint(equalTo: previewView.centerYAnchor), + label.leadingAnchor.constraint( + greaterThanOrEqualTo: previewView.leadingAnchor, + constant: 28 + ), + label.trailingAnchor.constraint( + lessThanOrEqualTo: previewView.trailingAnchor, + constant: -28 + ), + ]) + } + + private func showError(_ message: String) { + let alert = UIAlertController( + title: nil, + message: message, + preferredStyle: .alert + ) + alert.addAction(UIAlertAction(title: "OK", style: .default)) + present(alert, animated: true) + } + + private func removePhotoPicker() { + guard let picker = photoPickerViewController else { return } + picker.willMove(toParent: nil) + picker.view.removeFromSuperview() + picker.removeFromParent() + photoPickerViewController = nil + } + + private func finish( + method: String, + arguments: Any? = nil, + temporaryPaths: [String] = [] + ) { + guard !isFinishing else { + Self.removeTemporaryFiles(temporaryPaths) + return + } + isFinishing = true + view.isUserInteractionEnabled = false + selectionGeneration += 1 + selectionTask?.cancel() + selectionTask = nil + stopCamera() + dismiss(animated: true) { [weak self] in + guard let self else { + Self.removeTemporaryFiles(temporaryPaths) + return + } + self.channel.invokeMethod(method, arguments: arguments) { _ in + Self.removeTemporaryFiles(temporaryPaths) + } + self.notifyDismissalIfNeeded() + } + } + + func dismissAndNotify() { + guard !isFinishing else { return } + isFinishing = true + view.isUserInteractionEnabled = false + selectionGeneration += 1 + selectionTask?.cancel() + selectionTask = nil + Self.removeTemporaryFiles(selectedPhotoPaths) + selectedPhotoPaths = [] + stopCamera() + dismiss(animated: true) { [weak self] in + self?.notifyDismissalIfNeeded() + } + } + + private func notifyDismissalIfNeeded() { + selectionGeneration += 1 + selectionTask?.cancel() + selectionTask = nil + Self.removeTemporaryFiles(selectedPhotoPaths) + selectedPhotoPaths = [] + guard !didNotifyDismissal else { return } + didNotifyDismissal = true + onDismiss?() + } +} + +private enum NativeAttachmentPopoverError: Error { + case cameraUnavailable + case missingFile + case unsupportedImage +} diff --git a/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift b/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift new file mode 100644 index 0000000000..4b9c32ffcd --- /dev/null +++ b/mobile/ios/Runner/NativeAttachmentPopoverCoordinator.swift @@ -0,0 +1,228 @@ +import Flutter +import UIKit + +final class NativeAttachmentPopoverCoordinator: NSObject { + private let channel: FlutterMethodChannel + private weak var parentViewController: UIViewController? + private weak var presentedController: UIViewController? + private weak var sourceAnchorView: UIView? + + init( + messenger: FlutterBinaryMessenger, + parentViewController: UIViewController? + ) { + channel = FlutterMethodChannel( + name: "buzz/native_attachment_popover", + binaryMessenger: messenger + ) + self.parentViewController = parentViewController + super.init() + + channel.setMethodCallHandler { [weak self] call, result in + self?.handle(call, result: result) + } + } + + private func handle( + _ call: FlutterMethodCall, + result: @escaping FlutterResult + ) { + switch call.method { + case "isSupported": + if #available(iOS 26.0, *) { + result(true) + } else { + result(false) + } + case "present": + guard + let arguments = call.arguments as? [String: Any], + let x = arguments["x"] as? NSNumber, + let y = arguments["y"] as? NSNumber, + let width = arguments["width"] as? NSNumber, + let height = arguments["height"] as? NSNumber + else { + result( + FlutterError( + code: "invalid_arguments", + message: "Expected the attachment trigger bounds.", + details: nil + ) + ) + return + } + + let sourceRect = CGRect( + x: CGFloat(truncating: x), + y: CGFloat(truncating: y), + width: CGFloat(truncating: width), + height: CGFloat(truncating: height) + ) + DispatchQueue.main.async { [weak self] in + result(self?.presentPopover(sourceRect: sourceRect) ?? false) + } + case "dismiss": + DispatchQueue.main.async { [weak self] in + if #available(iOS 26.0, *), + let controller = + self?.presentedController + as? NativeAttachmentPopoverViewController + { + controller.dismissAndNotify() + } else { + self?.presentedController?.dismiss(animated: true) + } + result(nil) + } + default: + result(FlutterMethodNotImplemented) + } + } + + @MainActor + private func presentPopover(sourceRect: CGRect) -> Bool { + guard #available(iOS 26.0, *) else { return false } + guard presentedController == nil else { return true } + let rootViewController = + parentViewController ?? activeWindowRootViewController() + guard let presenter = topViewController(from: rootViewController) else { + return false + } + + let sourceView = presenter.view + let convertedRect: CGRect + if let window = sourceView?.window { + convertedRect = sourceView?.convert(sourceRect, from: window) ?? sourceRect + } else { + convertedRect = sourceRect + } + + let anchorView = makeSourceAnchor(frame: convertedRect) + sourceView?.addSubview(anchorView) + sourceAnchorView = anchorView + + let availableWidth = max( + 320, + min( + (sourceView?.bounds.width ?? UIScreen.main.bounds.width) - 24, + 430 + ) + ) + let controller = NativeAttachmentPopoverViewController( + channel: channel, + expandedWidth: availableWidth + ) + controller.modalPresentationStyle = .popover + controller.preferredTransition = .zoom { [weak anchorView] _ in + anchorView + } + controller.onDismiss = { [weak self] in + self?.presentedController = nil + self?.sourceAnchorView?.removeFromSuperview() + self?.channel.invokeMethod("dismissed", arguments: nil) + } + + guard let popover = controller.popoverPresentationController else { + anchorView.removeFromSuperview() + return false + } + popover.sourceView = anchorView + popover.sourceRect = anchorView.bounds + popover.permittedArrowDirections = [.down] + popover.backgroundColor = .clear + popover.delegate = controller + + presentedController = controller + presenter.present(controller, animated: true) + return true + } + + @MainActor + private func makeSourceAnchor(frame: CGRect) -> UIView { + let anchor = UIView(frame: frame) + anchor.isUserInteractionEnabled = false + anchor.accessibilityElementsHidden = true + anchor.backgroundColor = .clear + anchor.layer.cornerRadius = min(frame.width, frame.height) / 2 + anchor.layer.cornerCurve = .continuous + return anchor + } + + @MainActor + private func activeWindowRootViewController() -> UIViewController? { + UIApplication.shared.connectedScenes + .compactMap { $0 as? UIWindowScene } + .filter { $0.activationState == .foregroundActive } + .flatMap(\.windows) + .first(where: \.isKeyWindow)? + .rootViewController + } + + @MainActor + private func topViewController( + from viewController: UIViewController? + ) -> UIViewController? { + if let presented = viewController?.presentedViewController { + return topViewController(from: presented) + } + if let navigation = viewController as? UINavigationController { + return topViewController(from: navigation.visibleViewController) + } + if let tab = viewController as? UITabBarController { + return topViewController(from: tab.selectedViewController) + } + return viewController + } +} + +func makeNativeAttachmentMenuButton( + title: String, + symbol: String, + action: UIAction +) -> UIButton { + let button = UIButton(primaryAction: action) + button.accessibilityLabel = title + + let symbolConfiguration = UIImage.SymbolConfiguration( + pointSize: 18, + weight: .regular + ) + let iconView = UIImageView( + image: UIImage( + systemName: symbol, + withConfiguration: symbolConfiguration + ) + ) + iconView.tintColor = .label + iconView.contentMode = .center + iconView.translatesAutoresizingMaskIntoConstraints = false + + let titleLabel = UILabel() + titleLabel.text = title + titleLabel.textColor = .label + titleLabel.font = .preferredFont(forTextStyle: .body) + titleLabel.adjustsFontForContentSizeCategory = true + titleLabel.textAlignment = .left + titleLabel.translatesAutoresizingMaskIntoConstraints = false + + button.addSubview(iconView) + button.addSubview(titleLabel) + NSLayoutConstraint.activate([ + iconView.leadingAnchor.constraint(equalTo: button.leadingAnchor, constant: 14), + iconView.centerYAnchor.constraint(equalTo: button.centerYAnchor), + iconView.widthAnchor.constraint(equalToConstant: 26), + titleLabel.leadingAnchor.constraint( + equalTo: iconView.trailingAnchor, + constant: 12 + ), + titleLabel.trailingAnchor.constraint( + equalTo: button.trailingAnchor, + constant: -14 + ), + titleLabel.centerYAnchor.constraint(equalTo: button.centerYAnchor), + ]) + button.configurationUpdateHandler = { button in + button.alpha = button.isHighlighted ? 0.62 : 1 + } + return button +} diff --git a/mobile/lib/features/channels/camera_capture_cleanup.dart b/mobile/lib/features/channels/camera_capture_cleanup.dart index 6937218c9e..469a150e13 100644 --- a/mobile/lib/features/channels/camera_capture_cleanup.dart +++ b/mobile/lib/features/channels/camera_capture_cleanup.dart @@ -5,16 +5,26 @@ import 'package:image_picker/image_picker.dart'; Future processCapturedImage( XFile image, Future Function(XFile image) onCapture, +) async { + await processTemporaryImages([image], (images) => onCapture(images.single)); +} + +/// Processes native-owned [images], then removes their temporary files. +Future processTemporaryImages( + List images, + Future Function(List images) process, ) async { try { - await onCapture(image); + await process(images); } finally { - final path = image.path; - if (path.isNotEmpty) { - try { - await File(path).delete(); - } on FileSystemException { - // The camera plugin may already have removed its temporary file. + for (final image in images) { + final path = image.path; + if (path.isNotEmpty) { + try { + await File(path).delete(); + } on FileSystemException { + // The native picker may already have removed its temporary file. + } } } } diff --git a/mobile/lib/features/channels/compose_bar.dart b/mobile/lib/features/channels/compose_bar.dart index b172f6a885..90a19d8d3d 100644 --- a/mobile/lib/features/channels/compose_bar.dart +++ b/mobile/lib/features/channels/compose_bar.dart @@ -1,10 +1,12 @@ import 'dart:async'; import 'dart:collection'; +import 'dart:math' as math; import 'package:camera/camera.dart' as camera; import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; import 'package:flutter/physics.dart'; +import 'package:flutter/services.dart'; import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:image_picker/image_picker.dart'; @@ -28,21 +30,21 @@ import 'emoji_picker.dart'; import 'mentions/mention_candidates.dart'; import 'mentions/mention_candidates_provider.dart'; import 'mentions/mention_ranking.dart'; +import 'photo_library.dart'; part 'compose_bar/helpers.dart'; part 'compose_bar/markdown_editing_controller.dart'; part 'compose_bar/suggestions.dart'; part 'compose_bar/formatting_toolbar.dart'; part 'compose_bar/attachments.dart'; +part 'compose_bar/photo_gallery_picker.dart'; +part 'compose_bar/ios_photo_picker.dart'; +part 'compose_bar/ios_attachment_popover.dart'; part 'compose_bar/camera_preview.dart'; part 'compose_bar/send_button.dart'; +part 'compose_bar/layout.dart'; -const _pastedImageMimeTypes = [ - 'image/jpeg', - 'image/jpg', - 'image/png', - 'image/webp', -]; +const _maxConcurrentImageUploads = 3; /// Rich compose bar with @mention autocomplete and a markdown formatting /// toolbar. Used in both channel and thread views — the caller provides an @@ -120,8 +122,15 @@ class ComposeBar extends HookConsumerWidget { }, [controller, draftKey, draftIdentity]); final focusNode = useFocusNode(); final isComposerExpanded = useState(false); - final showAttachments = useState(false); - final showCamera = useState(false); + final attachmentSurface = useState(_AttachmentSurface.closed); + final iosAttachmentPopover = useMemoized( + _IOSAttachmentPopoverController.new, + ); + useEffect( + () => + () => unawaited(iosAttachmentPopover.dispose()), + [iosAttachmentPopover], + ); final isSending = useState(false); final showFormatting = useState(false); final attachments = useState>([]); @@ -389,8 +398,7 @@ class ComposeBar extends HookConsumerWidget { mentionMap.value.clear(); mentionQuery.value = null; channelQuery.value = null; - showAttachments.value = false; - showCamera.value = false; + attachmentSurface.value = _AttachmentSurface.closed; showFormatting.value = false; uploadError.value = null; focusNode.requestFocus(); @@ -533,6 +541,80 @@ class ComposeBar extends HookConsumerWidget { } } + Future pickThenUpload({ + required Future Function() pick, + required Future Function(XFile file) upload, + }) async { + uploadError.value = null; + try { + final picked = await pick(); + if (picked == null || !context.mounted) return; + await pickAndUpload(() => upload(picked)); + } catch (error) { + if (context.mounted) { + uploadError.value = _formatUploadError(error); + } + } + } + + Future uploadImages(List images) async { + if (images.isEmpty) return; + uploadError.value = null; + uploadingCount.value += images.length; + try { + Future<({BlobDescriptor? uploaded, Object? error})> uploadImage( + XFile image, + ) async { + try { + final uploaded = await ref + .read(mediaUploadServiceProvider) + .uploadImage(image); + return (uploaded: uploaded, error: null); + } catch (error) { + return (uploaded: null, error: error); + } + } + + final results = <({BlobDescriptor? uploaded, Object? error})>[]; + for ( + var start = 0; + start < images.length; + start += _maxConcurrentImageUploads + ) { + final end = math.min( + start + _maxConcurrentImageUploads, + images.length, + ); + results.addAll( + await Future.wait([ + for (final image in images.sublist(start, end)) + uploadImage(image), + ]), + ); + } + if (!context.mounted) return; + + final uploaded = [for (final result in results) ?result.uploaded]; + if (uploaded.isNotEmpty) { + attachments.value = [...attachments.value, ...uploaded]; + } + final firstError = results + .map((result) => result.error) + .whereType() + .firstOrNull; + if (firstError != null) { + uploadError.value = _formatUploadError(firstError); + } + } finally { + if (context.mounted) { + uploadingCount.value = math.max( + 0, + uploadingCount.value - images.length, + ); + } + } + } + Widget buildContextMenu( BuildContext context, EditableTextState editableTextState, @@ -621,31 +703,88 @@ class ComposeBar extends HookConsumerWidget { // ----- Widget tree ---------------------------------------------------- - void chooseAttachment(Future Function() pick) { - showAttachments.value = false; - showCamera.value = false; - pickAndUpload(pick); + void chooseAttachment( + Future Function() choose, { + String? errorMessage, + }) { + attachmentSurface.value = _AttachmentSurface.closed; + unawaited(() async { + try { + await choose(); + } catch (error) { + if (context.mounted) { + uploadError.value = errorMessage ?? _formatUploadError(error); + } + } + }()); } void toggleAttachments() { - if (showCamera.value) { - showCamera.value = false; - showAttachments.value = false; + attachmentSurface.value = switch (attachmentSurface.value) { + _AttachmentSurface.closed => _AttachmentSurface.menu, + _AttachmentSurface.menu => _AttachmentSurface.closed, + _AttachmentSurface.camera || + _AttachmentSurface.photos => _AttachmentSurface.menu, + }; + } + + void handleAttachmentTap(BuildContext triggerContext) { + if (defaultTargetPlatform != TargetPlatform.iOS || + attachmentSurface.value != _AttachmentSurface.closed) { + toggleAttachments(); return; } - showCamera.value = false; - showAttachments.value = !showAttachments.value; + + focusNode.unfocus(); + unawaited( + iosAttachmentPopover + .present( + sourceContext: triggerContext, + onCapture: (image) => pickAndUpload( + () => ref.read(mediaUploadServiceProvider).uploadImage(image), + ), + onChoosePhotos: uploadImages, + onAllPhotos: () => chooseAttachment(() async { + final photos = await ref + .read(mediaUploadServiceProvider) + .pickGalleryImages(); + await uploadImages(photos); + }, errorMessage: 'Unable to open your photo library.'), + onVideo: () => chooseAttachment(() { + final service = ref.read(mediaUploadServiceProvider); + return pickThenUpload( + pick: service.pickGalleryVideo, + upload: service.uploadVideo, + ); + }), + onFiles: () => chooseAttachment(() { + final service = ref.read(mediaUploadServiceProvider); + return pickThenUpload( + pick: service.pickAttachmentFile, + upload: service.uploadFile, + ); + }), + ) + .then((didPresent) { + if (!didPresent && context.mounted) toggleAttachments(); + }), + ); } void openCamera() { focusNode.unfocus(); - showAttachments.value = false; - showCamera.value = true; + attachmentSurface.value = _AttachmentSurface.camera; } final motionDuration = reducedMotion ? Duration.zero - : const Duration(milliseconds: 180); + : Duration( + milliseconds: + attachmentSurface.value == _AttachmentSurface.camera || + attachmentSurface.value == _AttachmentSurface.photos + ? 320 + : 250, + ); final suggestionOverlayController = useMemoized( OverlayPortalController.new, ); @@ -659,8 +798,7 @@ class ComposeBar extends HookConsumerWidget { void expandComposer() { if (isComposerExpanded.value) return; - showAttachments.value = false; - showCamera.value = false; + attachmentSurface.value = _AttachmentSurface.closed; isComposerExpanded.value = true; WidgetsBinding.instance.addPostFrameCallback((_) { if (context.mounted) focusNode.requestFocus(); @@ -687,40 +825,48 @@ class ComposeBar extends HookConsumerWidget { ), ) : const SizedBox.shrink(key: ValueKey('no-suggestions')); - final overlayPanel = showCamera.value - ? KeyedSubtree( - key: const ValueKey('camera-preview'), - child: _InlineCameraPreview( - onClose: () => showCamera.value = false, - onCapture: (image) async { - showCamera.value = false; - await pickAndUpload( - () => ref.read(mediaUploadServiceProvider).uploadImage(image), - ); - }, - ), - ) - : showAttachments.value - ? KeyedSubtree( - key: const ValueKey('attachment-menu'), - child: Align( - alignment: Alignment.bottomLeft, - heightFactor: 1, - child: _AttachmentMenu( - onCamera: openCamera, - onPhotos: () => chooseAttachment( - ref.read(mediaUploadServiceProvider).pickAndUploadImage, - ), - onVideo: () => chooseAttachment( - ref.read(mediaUploadServiceProvider).pickAndUploadVideo, - ), - onFiles: () => chooseAttachment( - ref.read(mediaUploadServiceProvider).pickAndUploadFile, - ), - ), - ), - ) - : suggestionPanel; + Widget buildOverlayPanel(_AttachmentSurface surface) { + return _AttachmentSurfacePanel( + key: ValueKey( + surface == _AttachmentSurface.closed + ? 'composer-suggestions' + : 'attachment-surface', + ), + surface: surface, + suggestionPanel: suggestionPanel, + onBack: () => attachmentSurface.value = _AttachmentSurface.menu, + onCamera: openCamera, + onPhotos: () { + focusNode.unfocus(); + attachmentSurface.value = _AttachmentSurface.photos; + }, + onVideo: () => chooseAttachment(() { + final service = ref.read(mediaUploadServiceProvider); + return pickThenUpload( + pick: service.pickGalleryVideo, + upload: service.uploadVideo, + ); + }), + onFiles: () => chooseAttachment(() { + final service = ref.read(mediaUploadServiceProvider); + return pickThenUpload( + pick: service.pickAttachmentFile, + upload: service.uploadFile, + ); + }), + onCapture: (image) async { + attachmentSurface.value = _AttachmentSurface.closed; + await pickAndUpload( + () => ref.read(mediaUploadServiceProvider).uploadImage(image), + ); + }, + onPickAllPhotos: ref.read(mediaUploadServiceProvider).pickGalleryImages, + onChoosePhotos: (photos) async { + attachmentSurface.value = _AttachmentSurface.closed; + await uploadImages(photos); + }, + ); + } // Suggestions and attachments live in the overlay so showing them cannot // reflow the composer. Both stay anchored just above the capsule. @@ -737,233 +883,91 @@ class ComposeBar extends HookConsumerWidget { layoutInfo.childPaintTransform, Offset.zero, ); - return Positioned( - left: composerOrigin.dx, - bottom: layoutInfo.overlaySize.height - composerOrigin.dy, - width: layoutInfo.childSize.width, - child: ClipRect( - child: Padding( - padding: const EdgeInsets.only(bottom: Grid.xxs), - child: _SuggestionPanelMotion( - duration: motionDuration, - child: overlayPanel, + return ValueListenableBuilder<_AttachmentSurface>( + valueListenable: attachmentSurface, + builder: (context, surface, _) { + final surfaceDuration = reducedMotion + ? Duration.zero + : Duration( + milliseconds: + surface == _AttachmentSurface.camera || + surface == _AttachmentSurface.photos + ? 320 + : 250, + ); + final expandedSurfaceCoversComposer = + surface == _AttachmentSurface.camera || + surface == _AttachmentSurface.photos; + final overlayAnchorY = + composerOrigin.dy + + (expandedSurfaceCoversComposer + ? layoutInfo.childSize.height + Grid.twelve + : 0); + return AnimatedPositioned( + duration: surfaceDuration, + curve: + surface == _AttachmentSurface.camera || + surface == _AttachmentSurface.photos + ? const Cubic(0.34, 1.25, 0.64, 1) + : const Cubic(0.22, 1, 0.36, 1), + left: composerOrigin.dx, + bottom: layoutInfo.overlaySize.height - overlayAnchorY, + width: layoutInfo.childSize.width, + child: ClipRect( + child: Padding( + padding: const EdgeInsets.only(bottom: Grid.xxs), + child: surface == _AttachmentSurface.closed + ? _SuggestionPanelMotion( + duration: surfaceDuration, + alignment: Alignment.bottomLeft, + child: buildOverlayPanel(surface), + ) + : buildOverlayPanel(surface), + ), ), - ), - ), + ); + }, ); }, - child: Container( - decoration: BoxDecoration( - color: context.colors.surfaceContainerHighest, - borderRadius: BorderRadius.circular(Radii.dialog), - border: Border.all( - color: Colors.black.withValues(alpha: 0.04), - width: 1, - ), - ), - padding: const EdgeInsets.all(Grid.xxs), - child: Column( - mainAxisSize: MainAxisSize.min, - children: [ - if (hasAttachments || hasPendingUploads) ...[ - _AttachmentStrip( - attachments: attachments.value, - uploadingCount: uploadingCount.value, - onRemove: removeAttachment, - ), - const SizedBox(height: Grid.xxs), - ], - - if (uploadError.value case final error?) ...[ - Align( - alignment: Alignment.centerLeft, - child: Text( - error, - style: context.textTheme.bodySmall?.copyWith( - color: context.colors.error, - ), - ), - ), - const SizedBox(height: Grid.xxs), - ], - - // Keep the default state out of the focus system entirely so - // restored native focus cannot expand a newly opened channel. - if (isComposerExpanded.value) - TextField( - controller: controller, - focusNode: focusNode, - textInputAction: TextInputAction.send, - contextMenuBuilder: buildContextMenu, - contentInsertionConfiguration: ContentInsertionConfiguration( - allowedMimeTypes: _pastedImageMimeTypes, - onContentInserted: uploadPastedImage, - ), - onSubmitted: (_) => send(), - minLines: 1, - maxLines: 5, - style: context.textTheme.bodyLarge, - decoration: InputDecoration( - hintText: resolvedHint, - hintStyle: context.textTheme.bodyLarge?.copyWith( - color: context.colors.onSurfaceVariant, - ), - border: InputBorder.none, - enabledBorder: InputBorder.none, - focusedBorder: InputBorder.none, - contentPadding: const EdgeInsets.symmetric( - horizontal: Grid.half, - vertical: Grid.half, - ), - isDense: true, - ), - ) - else - Row( - children: [ - _AttachmentTrigger( - open: showAttachments.value || showCamera.value, - onTap: toggleAttachments, - ), - const SizedBox(width: Grid.xxs), - Expanded( - child: Semantics( - button: true, - label: resolvedHint, - child: GestureDetector( - behavior: HitTestBehavior.opaque, - onTap: expandComposer, - child: Padding( - padding: const EdgeInsets.symmetric( - vertical: Grid.half, - ), - child: Align( - alignment: Alignment.centerLeft, - child: Text( - resolvedHint, - style: context.textTheme.bodyLarge?.copyWith( - color: context.colors.onSurfaceVariant, - ), - ), - ), - ), - ), - ), - ), - ], - ), - - ClipRect( - child: Align( - alignment: Alignment.topCenter, - heightFactor: composerExpansionValue, - child: IgnorePointer( - ignoring: composerExpansionValue < 0.98, - child: Opacity( - opacity: composerExpansionProgress, - child: Transform.translate( - offset: Offset( - 0, - Grid.xxs * (1 - composerExpansionProgress), - ), - child: Column( - children: [ - const SizedBox(height: Grid.xxs), - Row( - children: [ - _AttachmentTrigger( - open: - showAttachments.value || - showCamera.value || - showFormatting.value, - onTap: () { - if (showFormatting.value) { - showFormatting.value = false; - } else { - toggleAttachments(); - } - }, - ), - const SizedBox(width: Grid.half), - Expanded( - child: AnimatedSwitcher( - duration: motionDuration, - switchInCurve: Curves.easeOutCubic, - switchOutCurve: Curves.easeInCubic, - layoutBuilder: - (currentChild, previousChildren) => - Stack( - alignment: Alignment.centerLeft, - children: [ - ...previousChildren, - ?currentChild, - ], - ), - child: showFormatting.value - ? _FormattingToolbar( - onFormat: applyFormat, - ) - : Row( - key: const ValueKey( - 'standard-actions', - ), - children: [ - _ComposeAction( - icon: LucideIcons.atSign, - onTap: () { - showAttachments.value = false; - showCamera.value = false; - triggerMention(); - }, - ), - _ComposeAction( - icon: LucideIcons.hash, - onTap: () { - showAttachments.value = false; - showCamera.value = false; - triggerChannel(); - }, - ), - _ComposeAction( - icon: LucideIcons.smilePlus, - onTap: () { - showAttachments.value = false; - showCamera.value = false; - showEmojiPicker( - context: context, - onSelect: insertEmoji, - ); - }, - ), - _ComposeAction( - icon: LucideIcons.aLargeSmall, - onTap: () { - showAttachments.value = false; - showCamera.value = false; - showFormatting.value = true; - }, - ), - const Spacer(), - _SendButton( - isDisabled: hasPendingUploads, - isSending: isSending.value, - onTap: send, - ), - ], - ), - ), - ), - ], - ), - ], - ), - ), - ), - ), - ), - ), - ], - ), + child: _ComposeBarLayout( + attachments: attachments.value, + uploadingCount: uploadingCount.value, + onRemoveAttachment: removeAttachment, + uploadError: uploadError.value, + isExpanded: isComposerExpanded.value, + controller: controller, + focusNode: focusNode, + contextMenuBuilder: buildContextMenu, + onContentInserted: uploadPastedImage, + onSend: () => unawaited(send()), + resolvedHint: resolvedHint, + attachmentSurface: attachmentSurface.value, + onAttachmentTap: handleAttachmentTap, + onExpand: expandComposer, + expansionValue: composerExpansionValue, + expansionProgress: composerExpansionProgress, + formattingOpen: showFormatting.value, + onCloseFormatting: () => showFormatting.value = false, + motionDuration: motionDuration, + onFormat: applyFormat, + onMention: () { + attachmentSurface.value = _AttachmentSurface.closed; + triggerMention(); + }, + onChannel: () { + attachmentSurface.value = _AttachmentSurface.closed; + triggerChannel(); + }, + onEmoji: () { + attachmentSurface.value = _AttachmentSurface.closed; + showEmojiPicker(context: context, onSelect: insertEmoji); + }, + onOpenFormatting: () { + attachmentSurface.value = _AttachmentSurface.closed; + showFormatting.value = true; + }, + hasPendingUploads: hasPendingUploads, + isSending: isSending.value, ), ), ); diff --git a/mobile/lib/features/channels/compose_bar/attachments.dart b/mobile/lib/features/channels/compose_bar/attachments.dart index 1d342cd15c..cfb541fc85 100644 --- a/mobile/lib/features/channels/compose_bar/attachments.dart +++ b/mobile/lib/features/channels/compose_bar/attachments.dart @@ -1,5 +1,195 @@ part of '../compose_bar.dart'; +enum _AttachmentSurface { closed, menu, camera, photos } + +const _attachmentMenuWidth = 176.0; +const _attachmentMenuHeight = 208.0; +const _attachmentExpandedHeight = 372.0; + +class _AttachmentSurfacePanel extends HookWidget { + final _AttachmentSurface surface; + final Widget suggestionPanel; + final VoidCallback onBack; + final VoidCallback onCamera; + final VoidCallback onPhotos; + final VoidCallback onVideo; + final VoidCallback onFiles; + final Future Function(XFile image) onCapture; + final Future> Function() onPickAllPhotos; + final Future Function(List photos) onChoosePhotos; + + const _AttachmentSurfacePanel({ + super.key, + required this.surface, + required this.suggestionPanel, + required this.onBack, + required this.onCamera, + required this.onPhotos, + required this.onVideo, + required this.onFiles, + required this.onCapture, + required this.onPickAllPhotos, + required this.onChoosePhotos, + }); + + @override + Widget build(BuildContext context) { + if (surface == _AttachmentSurface.closed) return suggestionPanel; + + final reducedMotion = MediaQuery.disableAnimationsOf(context); + final isExpanded = + surface == _AttachmentSurface.camera || + surface == _AttachmentSurface.photos; + final morphController = useAnimationController( + initialValue: isExpanded ? 1 : 0, + duration: reducedMotion + ? Duration.zero + : const Duration(milliseconds: 320), + reverseDuration: reducedMotion + ? Duration.zero + : const Duration(milliseconds: 250), + ); + final rawProgress = useAnimation(morphController); + final renderedExpandedSurface = useState<_AttachmentSurface?>( + isExpanded ? surface : null, + ); + final latestSurface = useRef(surface); + latestSurface.value = surface; + + useEffect(() { + void disposeCollapsedContent(AnimationStatus status) { + if (status == AnimationStatus.dismissed && + latestSurface.value == _AttachmentSurface.menu) { + renderedExpandedSurface.value = null; + } + } + + morphController.addStatusListener(disposeCollapsedContent); + return () => + morphController.removeStatusListener(disposeCollapsedContent); + }, [morphController]); + + useEffect(() { + if (isExpanded) { + renderedExpandedSurface.value = surface; + morphController.forward(); + } else { + morphController.reverse(); + } + return null; + }, [isExpanded, morphController, surface]); + + final visibleExpandedSurface = + renderedExpandedSurface.value ?? (isExpanded ? surface : null); + final expandedContent = switch (visibleExpandedSurface) { + _AttachmentSurface.camera => KeyedSubtree( + key: const ValueKey('camera-preview'), + child: _InlineCameraPreview(onClose: onBack, onCapture: onCapture), + ), + _AttachmentSurface.photos => KeyedSubtree( + key: const ValueKey('photo-gallery'), + child: _PhotoGalleryPicker( + onBack: onBack, + onPickAllPhotos: onPickAllPhotos, + onChoosePhotos: onChoosePhotos, + ), + ), + _AttachmentSurface.closed || + _AttachmentSurface.menu || + null => const SizedBox.shrink(), + }; + + double interval(double value, double begin, double end) { + return ((value - begin) / (end - begin)).clamp(0.0, 1.0); + } + + final menuOpacity = 1 - interval(rawProgress, 0.12, 0.38); + final expandedOpacity = interval(rawProgress, 0.28, 0.65); + final sizeProgress = morphController.status == AnimationStatus.reverse + ? const Cubic(0.22, 1, 0.36, 1).transform(rawProgress) + : Curves.easeInOutCubic.transform(rawProgress); + + return LayoutBuilder( + builder: (context, constraints) { + final expandedWidth = constraints.maxWidth; + const expandedHeight = _attachmentExpandedHeight; + final width = + _attachmentMenuWidth + + ((expandedWidth - _attachmentMenuWidth) * sizeProgress); + final height = + _attachmentMenuHeight + + ((expandedHeight - _attachmentMenuHeight) * sizeProgress); + final baseColor = context.colors.surfaceContainerHighest; + final expandedColor = + visibleExpandedSurface == _AttachmentSurface.camera + ? Colors.black + : baseColor; + + return Align( + alignment: Alignment.topLeft, + heightFactor: 1, + child: SizedBox( + width: width, + height: height, + child: DecoratedBox( + decoration: BoxDecoration( + color: Color.lerp(baseColor, expandedColor, sizeProgress), + borderRadius: BorderRadius.circular(Radii.dialog), + border: Border.all( + color: Colors.black.withValues(alpha: 0.04), + width: 1, + ), + ), + child: ClipRRect( + borderRadius: BorderRadius.circular(Radii.dialog), + child: Material( + type: MaterialType.transparency, + child: Stack( + clipBehavior: Clip.hardEdge, + children: [ + Positioned( + left: 0, + top: 0, + width: _attachmentMenuWidth, + height: _attachmentMenuHeight, + child: IgnorePointer( + ignoring: surface != _AttachmentSurface.menu, + child: Opacity( + opacity: menuOpacity, + child: _AttachmentMenu( + onCamera: onCamera, + onPhotos: onPhotos, + onVideo: onVideo, + onFiles: onFiles, + ), + ), + ), + ), + Positioned( + left: 0, + top: 0, + width: expandedWidth, + height: expandedHeight, + child: IgnorePointer( + ignoring: !isExpanded, + child: Opacity( + opacity: expandedOpacity, + child: expandedContent, + ), + ), + ), + ], + ), + ), + ), + ), + ), + ); + }, + ); + } +} + @immutable class _ComposeDraftPayload { final String content; @@ -24,16 +214,21 @@ class _ComposeDraftPayload { } class _AttachmentTrigger extends StatelessWidget { - final bool open; - final VoidCallback onTap; + final _AttachmentSurface surface; + final bool formattingOpen; + final ValueChanged onTap; - const _AttachmentTrigger({required this.open, required this.onTap}); + const _AttachmentTrigger({ + required this.surface, + required this.formattingOpen, + required this.onTap, + }); @override Widget build(BuildContext context) { final duration = MediaQuery.disableAnimationsOf(context) ? Duration.zero - : const Duration(milliseconds: 180); + : const Duration(milliseconds: 240); return SizedBox.square( dimension: 36, @@ -47,18 +242,44 @@ class _AttachmentTrigger extends StatelessWidget { ), ), child: IconButton( - tooltip: open ? 'Close attachments' : 'Add attachment', - onPressed: onTap, + tooltip: switch (surface) { + _AttachmentSurface.closed => + formattingOpen ? 'Close formatting' : 'Add attachment', + _AttachmentSurface.menu => 'Close attachments', + _AttachmentSurface.camera || + _AttachmentSurface.photos => 'Back to attachment options', + }, + onPressed: () => onTap(context), padding: EdgeInsets.zero, visualDensity: VisualDensity.compact, icon: AnimatedRotation( duration: duration, - curve: Curves.easeInOutCubic, - turns: open ? 0.125 : 0, - child: Icon( - LucideIcons.plus, - size: 20, - color: context.colors.onSurfaceVariant, + curve: Curves.easeOutBack, + turns: surface == _AttachmentSurface.menu || formattingOpen + ? 0.125 + : 0, + child: AnimatedSwitcher( + duration: duration, + switchInCurve: Curves.easeOutBack, + switchOutCurve: Curves.easeInOutCubic, + transitionBuilder: (child, animation) => FadeTransition( + opacity: animation, + child: ScaleTransition( + scale: Tween(begin: 0.92, end: 1).animate(animation), + child: child, + ), + ), + child: Icon( + switch (surface) { + _AttachmentSurface.camera => LucideIcons.camera, + _AttachmentSurface.photos => LucideIcons.images, + _AttachmentSurface.closed || + _AttachmentSurface.menu => LucideIcons.plus, + }, + key: ValueKey('attachment-trigger-${surface.name}'), + size: 20, + color: context.colors.onSurfaceVariant, + ), ), ), ), @@ -82,43 +303,37 @@ class _AttachmentMenu extends StatelessWidget { @override Widget build(BuildContext context) { - return Container( - width: 176, - clipBehavior: Clip.antiAlias, - decoration: BoxDecoration( - color: context.colors.surfaceContainerHighest, - borderRadius: BorderRadius.circular(Radii.dialog), - border: Border.all( - color: Colors.black.withValues(alpha: 0.04), - width: 1, + return SizedBox( + width: _attachmentMenuWidth, + height: _attachmentMenuHeight, + child: Padding( + padding: const EdgeInsets.symmetric(vertical: Grid.xxs), + child: Column( + mainAxisSize: MainAxisSize.min, + children: [ + _AttachmentMenuItem( + icon: LucideIcons.camera, + label: 'Camera', + onTap: onCamera, + ), + _AttachmentMenuItem( + icon: LucideIcons.images, + label: 'Photos', + onTap: onPhotos, + ), + _AttachmentMenuItem( + icon: LucideIcons.video, + label: 'Video', + onTap: onVideo, + ), + _AttachmentMenuItem( + icon: LucideIcons.file, + label: 'Files', + onTap: onFiles, + ), + ], ), ), - padding: const EdgeInsets.symmetric(vertical: Grid.xxs), - child: Column( - mainAxisSize: MainAxisSize.min, - children: [ - _AttachmentMenuItem( - icon: LucideIcons.camera, - label: 'Camera', - onTap: onCamera, - ), - _AttachmentMenuItem( - icon: LucideIcons.images, - label: 'Photos', - onTap: onPhotos, - ), - _AttachmentMenuItem( - icon: LucideIcons.video, - label: 'Video', - onTap: onVideo, - ), - _AttachmentMenuItem( - icon: LucideIcons.file, - label: 'Files', - onTap: onFiles, - ), - ], - ), ); } } @@ -201,38 +416,52 @@ class _AttachmentStrip extends StatelessWidget { ? 'Uploading attachment…' : 'Uploading $uploadingCount attachments…'; return Semantics( + excludeSemantics: true, liveRegion: true, label: label, child: Container( key: const ValueKey('compose-upload-progress'), - width: 128, + width: thumbWidth, decoration: BoxDecoration( color: context.colors.surface, borderRadius: BorderRadius.circular(Radii.md), border: Border.all(color: context.colors.outlineVariant), ), - padding: const EdgeInsets.symmetric(horizontal: Grid.xxs), - child: Row( - mainAxisAlignment: MainAxisAlignment.center, + child: Stack( + alignment: Alignment.center, children: [ SizedBox.square( - dimension: 18, + dimension: 34, child: CircularProgressIndicator( - strokeWidth: 2, + strokeWidth: 3, color: context.colors.primary, ), ), - const SizedBox(width: Grid.half), - Flexible( - child: Text( - label, - maxLines: 2, - overflow: TextOverflow.ellipsis, - style: context.textTheme.labelSmall?.copyWith( - color: context.colors.onSurfaceVariant, + if (uploadingCount > 1) + PositionedDirectional( + top: Grid.quarter, + end: Grid.quarter, + child: Container( + key: const ValueKey('compose-upload-count'), + constraints: const BoxConstraints( + minWidth: 22, + minHeight: 22, + ), + alignment: Alignment.center, + decoration: BoxDecoration( + color: context.colors.primary, + shape: BoxShape.circle, + ), + padding: const EdgeInsets.all(3), + child: Text( + '$uploadingCount', + style: context.textTheme.labelSmall?.copyWith( + color: context.colors.onPrimary, + fontWeight: FontWeight.w700, + ), + ), ), ), - ), ], ), ), diff --git a/mobile/lib/features/channels/compose_bar/camera_preview.dart b/mobile/lib/features/channels/compose_bar/camera_preview.dart index df16827ba5..b4a0d220a4 100644 --- a/mobile/lib/features/channels/compose_bar/camera_preview.dart +++ b/mobile/lib/features/channels/compose_bar/camera_preview.dart @@ -115,50 +115,44 @@ class _InlineCameraPreview extends HookConsumerWidget { } final activeController = controller.value; - return Container( - width: double.infinity, - clipBehavior: Clip.antiAlias, - decoration: BoxDecoration( - color: Colors.black, - borderRadius: BorderRadius.circular(Radii.dialog), - ), - foregroundDecoration: BoxDecoration( - borderRadius: BorderRadius.circular(Radii.dialog), - border: Border.all( - color: Colors.black.withValues(alpha: 0.04), - width: 1, - ), - ), - child: AspectRatio( - aspectRatio: 4 / 3, - child: Stack( - fit: StackFit.expand, - children: [ - if (activeController case final initialized?) - _CameraFeed(controller: initialized) - else - _CameraPlaceholder( - isInitializing: isInitializing.value, - message: error.value, - ), - if (activeController != null) - Align( - alignment: Alignment.bottomCenter, - child: Padding( - padding: const EdgeInsets.all(Grid.twelve), - child: _CameraCaptureButton( - isPressed: isCapturing.value, - onTap: capture, - ), + final usesAndroidCameraLayout = + defaultTargetPlatform == TargetPlatform.android; + return ColoredBox( + color: Colors.black, + child: Stack( + fit: StackFit.expand, + children: [ + if (activeController case final initialized?) + _CameraFeed(controller: initialized) + else + _CameraPlaceholder( + isInitializing: isInitializing.value, + message: error.value, + ), + if (activeController != null) + Align( + alignment: Alignment.bottomCenter, + child: Padding( + padding: const EdgeInsets.all(Grid.twelve), + child: _CameraCaptureButton( + isPressed: isCapturing.value, + onTap: capture, ), ), - Positioned( - top: Grid.xxs, - right: Grid.xxs, - child: _CameraCloseButton(onTap: onClose), ), - ], - ), + Positioned( + top: usesAndroidCameraLayout ? null : Grid.xxs, + left: usesAndroidCameraLayout ? Grid.twelve : null, + right: usesAndroidCameraLayout ? null : Grid.xxs, + bottom: usesAndroidCameraLayout + ? Grid.twelve + ((_cameraCaptureSize - _cameraBackSize) / 2) + : null, + child: _CameraCloseButton( + onTap: onClose, + emphasized: usesAndroidCameraLayout, + ), + ), + ], ), ); } @@ -206,7 +200,7 @@ class _CameraPlaceholder extends StatelessWidget { child: isInitializing ? const CircularProgressIndicator( color: Colors.white, - strokeWidth: 2, + strokeWidth: 3, ) : Column( mainAxisSize: MainAxisSize.min, @@ -254,8 +248,8 @@ class _CameraCaptureButton extends StatelessWidget { duration: duration, curve: Curves.easeOutCubic, child: Container( - width: 64, - height: 64, + width: _cameraCaptureSize, + height: _cameraCaptureSize, decoration: BoxDecoration( color: Colors.white.withValues(alpha: 0.24), shape: BoxShape.circle, @@ -277,27 +271,33 @@ class _CameraCaptureButton extends StatelessWidget { class _CameraCloseButton extends StatelessWidget { final VoidCallback onTap; + final bool emphasized; - const _CameraCloseButton({required this.onTap}); + const _CameraCloseButton({required this.onTap, required this.emphasized}); @override Widget build(BuildContext context) { return SizedBox.square( - dimension: 36, + dimension: emphasized ? _cameraBackSize : 36, child: IconButton( onPressed: onTap, - tooltip: 'Close camera', + tooltip: 'Back to attachment options', padding: EdgeInsets.zero, style: IconButton.styleFrom( - backgroundColor: Colors.black.withValues(alpha: 0.56), + backgroundColor: Colors.black.withValues( + alpha: emphasized ? 0.68 : 0.56, + ), foregroundColor: Colors.white, ), - icon: const Icon(LucideIcons.x, size: 18), + icon: Icon(LucideIcons.arrowLeft, size: emphasized ? 24 : 18), ), ); } } +const _cameraCaptureSize = 64.0; +const _cameraBackSize = 44.0; + String _cameraErrorMessage(Object error) { if (error is camera.CameraException) { return switch (error.code) { diff --git a/mobile/lib/features/channels/compose_bar/helpers.dart b/mobile/lib/features/channels/compose_bar/helpers.dart index 983aa27066..145d28fb44 100644 --- a/mobile/lib/features/channels/compose_bar/helpers.dart +++ b/mobile/lib/features/channels/compose_bar/helpers.dart @@ -1,6 +1,12 @@ part of '../compose_bar.dart'; const _typingThrottleMs = 3000; +const _pastedImageMimeTypes = [ + 'image/jpeg', + 'image/jpg', + 'image/png', + 'image/webp', +]; /// Cap on ranked mention suggestions shown — matches desktop's /// `MENTION_SUGGESTION_LIMIT`. diff --git a/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart new file mode 100644 index 0000000000..d56db5998c --- /dev/null +++ b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart @@ -0,0 +1,174 @@ +part of '../compose_bar.dart'; + +const _nativeAttachmentPopoverChannel = MethodChannel( + 'buzz/native_attachment_popover', +); + +final _iosAttachmentPopoverCoordinator = _IOSAttachmentPopoverCoordinator( + _nativeAttachmentPopoverChannel, +); + +class _IOSAttachmentPopoverCallbacks { + final Future Function(XFile image) onCapture; + final Future Function(List photos) onChoosePhotos; + final VoidCallback onAllPhotos; + final VoidCallback onVideo; + final VoidCallback onFiles; + + const _IOSAttachmentPopoverCallbacks({ + required this.onCapture, + required this.onChoosePhotos, + required this.onAllPhotos, + required this.onVideo, + required this.onFiles, + }); +} + +class _IOSAttachmentPopoverCoordinator { + final MethodChannel _channel; + + Object? _activeOwner; + _IOSAttachmentPopoverCallbacks? _callbacks; + bool _didPresent = false; + bool _handlerInstalled = false; + + _IOSAttachmentPopoverCoordinator(this._channel); + + Future present({ + required Object owner, + required BuildContext sourceContext, + required Future Function(XFile image) onCapture, + required Future Function(List photos) onChoosePhotos, + required VoidCallback onAllPhotos, + required VoidCallback onVideo, + required VoidCallback onFiles, + }) async { + if (defaultTargetPlatform != TargetPlatform.iOS) return false; + if (_activeOwner != null) return true; + + _activeOwner = owner; + _callbacks = _IOSAttachmentPopoverCallbacks( + onCapture: onCapture, + onChoosePhotos: onChoosePhotos, + onAllPhotos: onAllPhotos, + onVideo: onVideo, + onFiles: onFiles, + ); + _ensureHandler(); + + try { + final supported = + await _channel.invokeMethod('isSupported') ?? false; + if (!identical(_activeOwner, owner)) return false; + if (!supported || !sourceContext.mounted) { + _clearOwner(owner); + return false; + } + + final renderObject = sourceContext.findRenderObject(); + if (renderObject is! RenderBox || !renderObject.hasSize) { + _clearOwner(owner); + return false; + } + final origin = renderObject.localToGlobal(Offset.zero); + + _didPresent = true; + final didPresent = + await _channel.invokeMethod('present', { + 'x': origin.dx, + 'y': origin.dy, + 'width': renderObject.size.width, + 'height': renderObject.size.height, + }) ?? + false; + if (!identical(_activeOwner, owner)) return false; + if (!didPresent) _clearOwner(owner); + return didPresent; + } on PlatformException { + _clearOwner(owner); + return false; + } + } + + Future disposeOwner(Object owner) async { + if (!identical(_activeOwner, owner)) return; + + _callbacks = null; + if (!_didPresent) { + _clearOwner(owner); + return; + } + + try { + await _channel.invokeMethod('dismiss'); + } on PlatformException { + _clearOwner(owner); + } + } + + void _ensureHandler() { + if (_handlerInstalled) return; + _handlerInstalled = true; + _channel.setMethodCallHandler(_handleMethodCall); + } + + Future _handleMethodCall(MethodCall call) async { + final callbacks = _callbacks; + switch (call.method) { + case 'cameraCaptured': + if (call.arguments case final String path) { + final activeCallbacks = callbacks; + if (activeCallbacks != null) { + await processCapturedImage(XFile(path), activeCallbacks.onCapture); + } + } + case 'photosSelected': + final paths = (call.arguments as List? ?? const []) + .whereType() + .toList(); + if (callbacks != null && paths.isNotEmpty) { + await processTemporaryImages([ + for (final path in paths) XFile(path), + ], callbacks.onChoosePhotos); + } + case 'pickAllPhotos': + callbacks?.onAllPhotos(); + case 'pickVideo': + callbacks?.onVideo(); + case 'pickFiles': + callbacks?.onFiles(); + case 'dismissed': + _activeOwner = null; + _callbacks = null; + _didPresent = false; + } + } + + void _clearOwner(Object owner) { + if (!identical(_activeOwner, owner)) return; + _activeOwner = null; + _callbacks = null; + _didPresent = false; + } +} + +class _IOSAttachmentPopoverController { + Future present({ + required BuildContext sourceContext, + required Future Function(XFile image) onCapture, + required Future Function(List photos) onChoosePhotos, + required VoidCallback onAllPhotos, + required VoidCallback onVideo, + required VoidCallback onFiles, + }) => _iosAttachmentPopoverCoordinator.present( + owner: this, + sourceContext: sourceContext, + onCapture: onCapture, + onChoosePhotos: onChoosePhotos, + onAllPhotos: onAllPhotos, + onVideo: onVideo, + onFiles: onFiles, + ); + + Future dispose() => _iosAttachmentPopoverCoordinator.disposeOwner(this); +} diff --git a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart new file mode 100644 index 0000000000..b8cc83cbe9 --- /dev/null +++ b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart @@ -0,0 +1,228 @@ +part of '../compose_bar.dart'; + +const _inlinePhotoPickerViewType = 'buzz/inline_photo_picker'; +const _inlinePhotoPickerSupportChannel = MethodChannel( + 'buzz/inline_photo_picker', +); + +class _IOSInlinePhotoPicker extends HookWidget { + final VoidCallback onBack; + final Future> Function() onPickAllPhotos; + final Future Function(List photos) onChoosePhotos; + final Widget fallback; + + const _IOSInlinePhotoPicker({ + required this.onBack, + required this.onPickAllPhotos, + required this.onChoosePhotos, + required this.fallback, + }); + + @override + Widget build(BuildContext context) { + final supportFuture = useMemoized( + () async => + await _inlinePhotoPickerSupportChannel.invokeMethod( + 'isSupported', + ) ?? + false, + ); + final support = useFuture(supportFuture); + final pickerChannel = useState(null); + final selectedCount = useState(0); + final selectedPaths = useState>(const []); + final isPreparingSelection = useState(false); + final isProcessing = useState(false); + + useEffect(() { + final channel = pickerChannel.value; + if (channel == null) return null; + + channel.setMethodCallHandler((call) async { + switch (call.method) { + case 'selectionCountChanged': + selectedCount.value = call.arguments as int? ?? 0; + selectedPaths.value = const []; + isPreparingSelection.value = selectedCount.value > 0; + case 'selectionDidChange': + final paths = (call.arguments as List? ?? const []) + .whereType() + .toList(); + selectedPaths.value = paths; + isPreparingSelection.value = false; + case 'didFail': + isPreparingSelection.value = false; + if (!context.mounted) return; + ScaffoldMessenger.maybeOf(context)?.showSnackBar( + SnackBar( + content: Text( + call.arguments as String? ?? + 'Unable to prepare the selected photos.', + ), + ), + ); + } + }); + return () => channel.setMethodCallHandler(null); + }, [pickerChannel.value]); + + final canSelect = + selectedCount.value > 0 && + selectedPaths.value.length == selectedCount.value && + !isPreparingSelection.value && + !isProcessing.value; + + Future submitSelection() async { + if (!canSelect) return; + isProcessing.value = true; + try { + final paths = List.from(selectedPaths.value); + final claimed = + await pickerChannel.value?.invokeMethod( + 'claimSelection', + paths, + ) ?? + false; + if (!claimed) return; + final photos = [for (final path in paths) XFile(path)]; + await processTemporaryImages(photos, onChoosePhotos); + } finally { + if (context.mounted) isProcessing.value = false; + } + } + + Future openAllPhotos() async { + if (isPreparingSelection.value || isProcessing.value) return; + isProcessing.value = true; + try { + final photos = await onPickAllPhotos(); + if (photos.isNotEmpty) { + await onChoosePhotos(photos); + } + } catch (_) { + if (context.mounted) { + ScaffoldMessenger.maybeOf(context)?.showSnackBar( + const SnackBar(content: Text('Unable to open your photo library.')), + ); + } + } finally { + if (context.mounted) isProcessing.value = false; + } + } + + if (support.connectionState != ConnectionState.done) { + return const _NativePhotoPickerLoading(); + } + if (support.hasError || support.data != true) return fallback; + + return SizedBox( + key: const ValueKey('ios-inline-photo-picker'), + height: _attachmentExpandedHeight, + width: double.infinity, + child: Stack( + fit: StackFit.expand, + children: [ + UiKitView( + viewType: _inlinePhotoPickerViewType, + creationParamsCodec: const StandardMessageCodec(), + onPlatformViewCreated: (viewId) { + pickerChannel.value = MethodChannel( + 'buzz/inline_photo_picker/$viewId', + ); + }, + ), + PositionedDirectional( + start: Grid.twelve, + bottom: Grid.twelve, + child: SafeArea( + top: false, + child: DecoratedBox( + decoration: BoxDecoration( + color: Colors.black.withValues(alpha: 0.62), + shape: BoxShape.circle, + border: Border.all( + color: Colors.white.withValues(alpha: 0.28), + ), + ), + child: IconButton( + key: const ValueKey('ios-inline-photo-picker-back'), + onPressed: isProcessing.value ? null : onBack, + tooltip: 'Back to attachment options', + icon: const Icon( + LucideIcons.chevronLeft, + color: Colors.white, + ), + ), + ), + ), + ), + PositionedDirectional( + end: Grid.twelve, + bottom: Grid.twelve, + child: SafeArea( + top: false, + child: FilledButton( + key: const ValueKey('ios-inline-photo-picker-select'), + onPressed: canSelect + ? submitSelection + : selectedCount.value == 0 && + !isPreparingSelection.value && + !isProcessing.value + ? openAllPhotos + : null, + style: FilledButton.styleFrom( + backgroundColor: Colors.black.withValues(alpha: 0.76), + disabledBackgroundColor: Colors.black.withValues(alpha: 0.32), + foregroundColor: Colors.white, + disabledForegroundColor: Colors.white70, + minimumSize: const Size(0, 48), + padding: const EdgeInsets.symmetric(horizontal: Grid.twelve), + shape: const StadiumBorder(), + side: BorderSide(color: Colors.white.withValues(alpha: 0.28)), + ), + child: isPreparingSelection.value + ? const SizedBox.square( + dimension: 20, + child: CircularProgressIndicator( + strokeWidth: 2, + color: Colors.white, + ), + ) + : Text( + selectedCount.value == 0 + ? 'All Photos' + : 'Add ${selectedCount.value} ' + '${selectedCount.value == 1 ? 'photo' : 'photos'}', + ), + ), + ), + ), + if (isProcessing.value) + const ColoredBox( + color: Color.fromRGBO(0, 0, 0, 0.28), + child: Center( + child: CircularProgressIndicator( + strokeWidth: 3, + color: Colors.white, + ), + ), + ), + ], + ), + ); + } +} + +class _NativePhotoPickerLoading extends StatelessWidget { + const _NativePhotoPickerLoading(); + + @override + Widget build(BuildContext context) { + return SizedBox( + key: const ValueKey('ios-inline-photo-picker-loading'), + height: _attachmentExpandedHeight, + width: double.infinity, + child: const Center(child: CircularProgressIndicator(strokeWidth: 3)), + ); + } +} diff --git a/mobile/lib/features/channels/compose_bar/layout.dart b/mobile/lib/features/channels/compose_bar/layout.dart new file mode 100644 index 0000000000..2d62db836d --- /dev/null +++ b/mobile/lib/features/channels/compose_bar/layout.dart @@ -0,0 +1,245 @@ +part of '../compose_bar.dart'; + +class _ComposeBarLayout extends StatelessWidget { + final List attachments; + final int uploadingCount; + final ValueChanged onRemoveAttachment; + final String? uploadError; + final bool isExpanded; + final TextEditingController controller; + final FocusNode focusNode; + final EditableTextContextMenuBuilder contextMenuBuilder; + final ValueChanged onContentInserted; + final VoidCallback onSend; + final String resolvedHint; + final _AttachmentSurface attachmentSurface; + final ValueChanged onAttachmentTap; + final VoidCallback onExpand; + final double expansionValue; + final double expansionProgress; + final bool formattingOpen; + final VoidCallback onCloseFormatting; + final Duration motionDuration; + final void Function(String prefix, [String? suffix]) onFormat; + final VoidCallback onMention; + final VoidCallback onChannel; + final VoidCallback onEmoji; + final VoidCallback onOpenFormatting; + final bool hasPendingUploads; + final bool isSending; + + const _ComposeBarLayout({ + required this.attachments, + required this.uploadingCount, + required this.onRemoveAttachment, + required this.uploadError, + required this.isExpanded, + required this.controller, + required this.focusNode, + required this.contextMenuBuilder, + required this.onContentInserted, + required this.onSend, + required this.resolvedHint, + required this.attachmentSurface, + required this.onAttachmentTap, + required this.onExpand, + required this.expansionValue, + required this.expansionProgress, + required this.formattingOpen, + required this.onCloseFormatting, + required this.motionDuration, + required this.onFormat, + required this.onMention, + required this.onChannel, + required this.onEmoji, + required this.onOpenFormatting, + required this.hasPendingUploads, + required this.isSending, + }); + + @override + Widget build(BuildContext context) { + return Container( + decoration: BoxDecoration( + color: context.colors.surfaceContainerHighest, + borderRadius: BorderRadius.circular(Radii.dialog), + border: Border.all( + color: Colors.black.withValues(alpha: 0.04), + width: 1, + ), + ), + padding: const EdgeInsets.all(Grid.xxs), + child: Column( + mainAxisSize: MainAxisSize.min, + children: [ + if (attachments.isNotEmpty || hasPendingUploads) ...[ + _AttachmentStrip( + attachments: attachments, + uploadingCount: uploadingCount, + onRemove: onRemoveAttachment, + ), + const SizedBox(height: Grid.xxs), + ], + if (uploadError case final error?) ...[ + Align( + alignment: Alignment.centerLeft, + child: Text( + error, + style: context.textTheme.bodySmall?.copyWith( + color: context.colors.error, + ), + ), + ), + const SizedBox(height: Grid.xxs), + ], + // Keep the default state out of the focus system entirely so + // restored native focus cannot expand a newly opened channel. + if (isExpanded) + TextField( + controller: controller, + focusNode: focusNode, + textInputAction: TextInputAction.send, + contextMenuBuilder: contextMenuBuilder, + contentInsertionConfiguration: ContentInsertionConfiguration( + allowedMimeTypes: _pastedImageMimeTypes, + onContentInserted: onContentInserted, + ), + onSubmitted: (_) => onSend(), + minLines: 1, + maxLines: 5, + style: context.textTheme.bodyLarge, + decoration: InputDecoration( + hintText: resolvedHint, + hintStyle: context.textTheme.bodyLarge?.copyWith( + color: context.colors.onSurfaceVariant, + ), + border: InputBorder.none, + enabledBorder: InputBorder.none, + focusedBorder: InputBorder.none, + contentPadding: const EdgeInsets.symmetric( + horizontal: Grid.half, + vertical: Grid.half, + ), + isDense: true, + ), + ) + else + Row( + children: [ + _AttachmentTrigger( + surface: attachmentSurface, + formattingOpen: false, + onTap: onAttachmentTap, + ), + const SizedBox(width: Grid.xxs), + Expanded( + child: Semantics( + button: true, + label: resolvedHint, + child: GestureDetector( + behavior: HitTestBehavior.opaque, + onTap: onExpand, + child: Padding( + padding: const EdgeInsets.symmetric( + vertical: Grid.half, + ), + child: Align( + alignment: Alignment.centerLeft, + child: Text( + resolvedHint, + style: context.textTheme.bodyLarge?.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ), + ), + ), + ), + ), + ], + ), + ClipRect( + child: Align( + alignment: Alignment.topCenter, + heightFactor: expansionValue, + child: IgnorePointer( + ignoring: expansionValue < 0.98, + child: Opacity( + opacity: expansionProgress, + child: Transform.translate( + offset: Offset(0, Grid.xxs * (1 - expansionProgress)), + child: Column( + children: [ + const SizedBox(height: Grid.xxs), + Row( + children: [ + _AttachmentTrigger( + surface: attachmentSurface, + formattingOpen: formattingOpen, + onTap: (triggerContext) { + if (formattingOpen) { + onCloseFormatting(); + } else { + onAttachmentTap(triggerContext); + } + }, + ), + const SizedBox(width: Grid.half), + Expanded( + child: AnimatedSwitcher( + duration: motionDuration, + switchInCurve: Curves.easeOutCubic, + switchOutCurve: Curves.easeInCubic, + layoutBuilder: + (currentChild, previousChildren) => Stack( + alignment: Alignment.centerLeft, + children: [ + ...previousChildren, + ?currentChild, + ], + ), + child: formattingOpen + ? _FormattingToolbar(onFormat: onFormat) + : Row( + key: const ValueKey('standard-actions'), + children: [ + _ComposeAction( + icon: LucideIcons.atSign, + onTap: onMention, + ), + _ComposeAction( + icon: LucideIcons.hash, + onTap: onChannel, + ), + _ComposeAction( + icon: LucideIcons.smilePlus, + onTap: onEmoji, + ), + _ComposeAction( + icon: LucideIcons.aLargeSmall, + onTap: onOpenFormatting, + ), + const Spacer(), + _SendButton( + isDisabled: hasPendingUploads, + isSending: isSending, + onTap: onSend, + ), + ], + ), + ), + ), + ], + ), + ], + ), + ), + ), + ), + ), + ), + ], + ), + ); + } +} diff --git a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart new file mode 100644 index 0000000000..2b35cc53c6 --- /dev/null +++ b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart @@ -0,0 +1,381 @@ +part of '../compose_bar.dart'; + +class _PhotoGalleryPicker extends StatelessWidget { + final VoidCallback onBack; + final Future> Function() onPickAllPhotos; + final Future Function(List photos) onChoosePhotos; + + const _PhotoGalleryPicker({ + required this.onBack, + required this.onPickAllPhotos, + required this.onChoosePhotos, + }); + + @override + Widget build(BuildContext context) { + final fallback = _RecentPhotoGalleryPicker( + onBack: onBack, + onPickAllPhotos: onPickAllPhotos, + onChoosePhotos: onChoosePhotos, + ); + if (defaultTargetPlatform != TargetPlatform.iOS) return fallback; + return _IOSInlinePhotoPicker( + onBack: onBack, + onPickAllPhotos: onPickAllPhotos, + onChoosePhotos: onChoosePhotos, + fallback: fallback, + ); + } +} + +class _RecentPhotoGalleryPicker extends HookConsumerWidget { + final VoidCallback onBack; + final Future> Function() onPickAllPhotos; + final Future Function(List photos) onChoosePhotos; + + const _RecentPhotoGalleryPicker({ + required this.onBack, + required this.onPickAllPhotos, + required this.onChoosePhotos, + }); + + @override + Widget build(BuildContext context, WidgetRef ref) { + final recentPhotos = useMemoized( + ref.read(photoLibraryProvider).loadRecentPhotos, + ); + final recentSnapshot = useFuture(recentPhotos); + final selection = useState>([]); + final isResolving = useState(false); + final actionError = useState(null); + final reducedMotion = MediaQuery.disableAnimationsOf(context); + + void togglePhoto(RecentPhoto photo) { + if (isResolving.value) return; + final current = selection.value; + final existingIndex = current.indexWhere((item) => item.id == photo.id); + selection.value = existingIndex < 0 + ? [...current, photo] + : [ + ...current.take(existingIndex), + ...current.skip(existingIndex + 1), + ]; + } + + Future choosePhotos() async { + if (isResolving.value) return; + isResolving.value = true; + actionError.value = null; + try { + final photos = selection.value.isEmpty + ? await onPickAllPhotos() + : await ref + .read(photoLibraryProvider) + .resolveSelectedPhotos(selection.value); + if (photos.isNotEmpty && context.mounted) { + await onChoosePhotos(photos); + } + } catch (_) { + if (context.mounted) { + actionError.value = selection.value.isEmpty + ? 'Unable to open your photo library.' + : 'Unable to prepare the selected photos.'; + } + } finally { + if (context.mounted) isResolving.value = false; + } + } + + final selectedCount = selection.value.length; + final actionLabel = selectedCount == 0 + ? 'All photos' + : selectedCount == 1 + ? 'Add 1 photo' + : 'Add $selectedCount photos'; + + Widget buildGalleryBody() { + if (recentSnapshot.connectionState != ConnectionState.done) { + return const Center(child: CircularProgressIndicator(strokeWidth: 3)); + } + if (recentSnapshot.hasError) { + return const _PhotoGalleryMessage( + icon: LucideIcons.images, + title: 'Recent photos aren’t available', + message: 'Use All photos to choose with the system photo picker.', + ); + } + + final photos = recentSnapshot.data ?? const []; + if (photos.isEmpty) { + return const _PhotoGalleryMessage( + icon: LucideIcons.images, + title: 'No recent photos', + message: 'Use All photos to browse your photo library.', + ); + } + return GridView.builder( + key: const ValueKey('recent-photo-grid'), + padding: EdgeInsets.zero, + gridDelegate: const SliverGridDelegateWithFixedCrossAxisCount( + crossAxisCount: 4, + crossAxisSpacing: Grid.quarter, + mainAxisSpacing: Grid.quarter, + ), + itemCount: photos.length, + itemBuilder: (context, index) { + final photo = photos[index]; + final selectionIndex = selection.value.indexWhere( + (item) => item.id == photo.id, + ); + return _RecentPhotoTile( + photo: photo, + selectionIndex: selectionIndex, + reducedMotion: reducedMotion, + onTap: () => togglePhoto(photo), + ); + }, + ); + } + + return Padding( + key: const ValueKey('photo-gallery-picker'), + padding: const EdgeInsets.all(Grid.xxs), + child: Column( + mainAxisSize: MainAxisSize.min, + children: [ + SizedBox( + height: 40, + child: Row( + children: [ + IconButton( + key: const ValueKey('photo-gallery-back'), + onPressed: isResolving.value ? null : onBack, + tooltip: 'Back to attachment options', + visualDensity: VisualDensity.compact, + icon: const Icon(LucideIcons.arrowLeft, size: 20), + ), + const SizedBox(width: Grid.quarter), + Expanded( + child: Text( + 'Recent photos', + style: context.textTheme.titleSmall?.copyWith( + color: context.colors.onSurface, + fontWeight: FontWeight.w600, + ), + ), + ), + if (selectedCount > 0) + Padding( + padding: const EdgeInsets.only(right: Grid.half), + child: Text( + '$selectedCount selected', + style: context.textTheme.labelMedium?.copyWith( + color: context.colors.onSurfaceVariant, + ), + ), + ), + ], + ), + ), + const SizedBox(height: Grid.half), + Expanded( + child: Column( + children: [ + Expanded(child: buildGalleryBody()), + if (actionError.value case final error?) ...[ + const SizedBox(height: Grid.half), + ConstrainedBox( + constraints: const BoxConstraints(maxHeight: 72), + child: SingleChildScrollView( + child: Text( + error, + key: const ValueKey('photo-gallery-error'), + style: context.textTheme.bodySmall?.copyWith( + color: context.colors.error, + ), + textAlign: TextAlign.center, + ), + ), + ), + ], + ], + ), + ), + const SizedBox(height: Grid.xxs), + SizedBox( + width: double.infinity, + child: selectedCount == 0 + ? OutlinedButton.icon( + key: const ValueKey('photo-gallery-action'), + onPressed: isResolving.value ? null : choosePhotos, + icon: isResolving.value + ? SizedBox.square( + dimension: 22, + child: CircularProgressIndicator( + strokeWidth: 2, + color: context.colors.primary, + ), + ) + : const Icon(LucideIcons.images, size: 18), + label: Text(actionLabel), + ) + : FilledButton.icon( + key: const ValueKey('photo-gallery-action'), + onPressed: isResolving.value ? null : choosePhotos, + icon: isResolving.value + ? const SizedBox.square( + dimension: 22, + child: CircularProgressIndicator( + strokeWidth: 2, + color: Colors.white, + ), + ) + : const Icon(LucideIcons.plus, size: 18), + label: Text(actionLabel), + ), + ), + ], + ), + ); + } +} + +class _RecentPhotoTile extends StatelessWidget { + final RecentPhoto photo; + final int selectionIndex; + final bool reducedMotion; + final VoidCallback onTap; + + const _RecentPhotoTile({ + required this.photo, + required this.selectionIndex, + required this.reducedMotion, + required this.onTap, + }); + + @override + Widget build(BuildContext context) { + final isSelected = selectionIndex >= 0; + return Semantics( + button: true, + selected: isSelected, + label: isSelected + ? 'Photo ${selectionIndex + 1} selected' + : 'Select photo', + child: GestureDetector( + key: ValueKey('recent-photo-${photo.id}'), + behavior: HitTestBehavior.opaque, + onTap: onTap, + child: Stack( + fit: StackFit.expand, + children: [ + ClipRRect( + borderRadius: BorderRadius.circular(Radii.sm), + child: Image.memory( + photo.thumbnailBytes, + fit: BoxFit.cover, + gaplessPlayback: true, + ), + ), + AnimatedContainer( + duration: reducedMotion + ? Duration.zero + : const Duration(milliseconds: 140), + curve: Curves.easeOutCubic, + decoration: BoxDecoration( + borderRadius: BorderRadius.circular(Radii.sm), + border: Border.all( + color: isSelected + ? context.colors.primary + : Colors.transparent, + width: isSelected ? 3 : 0, + ), + color: isSelected + ? Colors.black.withValues(alpha: 0.08) + : Colors.transparent, + ), + ), + PositionedDirectional( + top: Grid.half, + end: Grid.half, + child: AnimatedScale( + scale: isSelected ? 1 : 0.8, + duration: reducedMotion + ? Duration.zero + : const Duration(milliseconds: 140), + curve: Curves.easeOutCubic, + child: AnimatedOpacity( + opacity: isSelected ? 1 : 0, + duration: reducedMotion + ? Duration.zero + : const Duration(milliseconds: 100), + child: Container( + key: ValueKey('photo-selection-index-${photo.id}'), + width: 24, + height: 24, + alignment: Alignment.center, + decoration: BoxDecoration( + color: context.colors.primary, + shape: BoxShape.circle, + border: Border.all(color: Colors.white, width: 1.5), + ), + child: Text( + '${selectionIndex + 1}', + style: context.textTheme.labelSmall?.copyWith( + color: context.colors.onPrimary, + fontWeight: FontWeight.w700, + ), + ), + ), + ), + ), + ), + ], + ), + ), + ); + } +} + +class _PhotoGalleryMessage extends StatelessWidget { + final IconData icon; + final String title; + final String message; + + const _PhotoGalleryMessage({ + required this.icon, + required this.title, + required this.message, + }); + + @override + Widget build(BuildContext context) { + return Center( + child: Padding( + padding: const EdgeInsets.all(Grid.sm), + child: Column( + mainAxisSize: MainAxisSize.min, + children: [ + Icon(icon, size: 32, color: context.colors.onSurfaceVariant), + const SizedBox(height: Grid.xxs), + Text( + title, + style: context.textTheme.titleSmall?.copyWith( + color: context.colors.onSurface, + ), + textAlign: TextAlign.center, + ), + const SizedBox(height: Grid.quarter), + Text( + message, + style: context.textTheme.bodySmall?.copyWith( + color: context.colors.onSurfaceVariant, + ), + textAlign: TextAlign.center, + ), + ], + ), + ), + ); + } +} diff --git a/mobile/lib/features/channels/compose_bar/suggestions.dart b/mobile/lib/features/channels/compose_bar/suggestions.dart index f1deefcdaf..ed97284d46 100644 --- a/mobile/lib/features/channels/compose_bar/suggestions.dart +++ b/mobile/lib/features/channels/compose_bar/suggestions.dart @@ -1,44 +1,95 @@ part of '../compose_bar.dart'; -class _SuggestionPanelMotion extends StatelessWidget { +class _SuggestionPanelMotion extends HookWidget { final Duration duration; + final Alignment alignment; final Widget child; - const _SuggestionPanelMotion({required this.duration, required this.child}); + const _SuggestionPanelMotion({ + required this.duration, + required this.alignment, + required this.child, + }); @override Widget build(BuildContext context) { - return AnimatedSwitcher( - duration: duration, - reverseDuration: duration, - layoutBuilder: (currentChild, previousChildren) => Stack( - alignment: Alignment.bottomLeft, - clipBehavior: Clip.none, - children: [...previousChildren, ?currentChild], - ), - transitionBuilder: (child, animation) { - final curvedAnimation = CurvedAnimation( - parent: animation, - curve: Curves.easeOutCubic, - reverseCurve: Curves.easeInCubic, - ); - - return AnimatedBuilder( - animation: curvedAnimation, - child: child, - builder: (context, child) => IgnorePointer( - ignoring: animation.status == AnimationStatus.reverse, - child: Opacity( - opacity: curvedAnimation.value, - child: Transform.translate( - offset: Offset(0, Grid.xs * (1 - curvedAnimation.value)), - child: child, + final reducedMotion = MediaQuery.disableAnimationsOf(context); + final springController = useAnimationController( + initialValue: 1, + upperBound: 1.08, + ); + final springValue = useAnimation(springController); + final previousChildKey = useRef(child.key); + + useEffect(() { + if (previousChildKey.value == child.key) return null; + previousChildKey.value = child.key; + if (reducedMotion) { + springController.value = 1; + } else { + springController + ..stop() + ..value = 0.9 + ..animateWith( + SpringSimulation( + SpringDescription.withDurationAndBounce( + duration: const Duration(milliseconds: 320), + bounce: 0.18, ), + 0.9, + 1, + 0, + snapToEnd: true, ), + ); + } + return null; + }, [child.key, reducedMotion]); + + return Transform.scale( + scale: springValue, + alignment: alignment, + child: AnimatedSize( + duration: duration, + curve: Curves.easeInOutCubic, + alignment: alignment, + child: AnimatedSwitcher( + duration: duration, + reverseDuration: duration, + layoutBuilder: (currentChild, previousChildren) => Stack( + alignment: alignment, + clipBehavior: Clip.none, + children: [...previousChildren, ?currentChild], ), - ); - }, - child: child, + transitionBuilder: (child, animation) { + final curvedAnimation = CurvedAnimation( + parent: animation, + curve: Curves.easeOutBack, + reverseCurve: Curves.easeInOutCubic, + ); + + return AnimatedBuilder( + animation: curvedAnimation, + child: child, + builder: (context, child) => IgnorePointer( + ignoring: animation.status == AnimationStatus.reverse, + child: Opacity( + opacity: animation.value.clamp(0.0, 1.0), + child: Transform.translate( + offset: Offset(0, Grid.xs * (1 - animation.value)), + child: Transform.scale( + scale: 0.92 + (0.08 * curvedAnimation.value), + alignment: alignment, + child: child, + ), + ), + ), + ), + ); + }, + child: child, + ), + ), ); } } diff --git a/mobile/lib/features/channels/photo_library.dart b/mobile/lib/features/channels/photo_library.dart new file mode 100644 index 0000000000..8a01de01e0 --- /dev/null +++ b/mobile/lib/features/channels/photo_library.dart @@ -0,0 +1,104 @@ +import 'package:flutter/foundation.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; +import 'package:image_picker/image_picker.dart'; +import 'package:photo_manager/photo_manager.dart'; + +const _recentPhotoCount = 30; +const _photoPermissionRequest = PermissionRequestOption( + androidPermission: AndroidPermission( + type: RequestType.image, + mediaLocation: false, + ), +); + +/// A recent photo exposed to Buzz's compact in-composer gallery. +@immutable +class RecentPhoto { + /// The platform photo-library identifier. + final String id; + + /// Thumbnail bytes sized for the compact picker grid. + final Uint8List thumbnailBytes; + + /// Creates a recent photo value. + const RecentPhoto({required this.id, required this.thumbnailBytes}); +} + +/// Reads recent photos and resolves selected library assets to uploadable files. +abstract interface class PhotoLibrary { + /// Requests access when needed and returns the newest visible photos. + Future> loadRecentPhotos(); + + /// Resolves selected photos in the supplied selection order. + Future> resolveSelectedPhotos(List photos); +} + +/// Indicates that the compact gallery cannot read the device photo library. +class PhotoLibraryAccessException implements Exception { + /// Creates a photo-library access error. + const PhotoLibraryAccessException(); + + @override + String toString() => 'Photo access is turned off for Buzz.'; +} + +/// Provides the device photo library. Tests can override this with fixtures. +final photoLibraryProvider = Provider( + (ref) => const DevicePhotoLibrary(), +); + +/// The device-backed implementation of [PhotoLibrary]. +class DevicePhotoLibrary implements PhotoLibrary { + /// Creates the device photo library. + const DevicePhotoLibrary(); + + @override + Future> loadRecentPhotos() async { + final permission = await PhotoManager.requestPermissionExtend( + requestOption: _photoPermissionRequest, + ); + if (!permission.hasAccess) { + throw const PhotoLibraryAccessException(); + } + + final assets = await PhotoManager.getAssetListPaged( + page: 0, + pageCount: _recentPhotoCount, + type: RequestType.image, + filterOption: FilterOptionGroup( + imageOption: const FilterOption(needTitle: true), + orders: const [ + OrderOption(type: OrderOptionType.createDate, asc: false), + ], + ), + ); + + final loaded = await Future.wait([ + for (final asset in assets) _loadRecentPhoto(asset), + ]); + return [for (final photo in loaded) ?photo]; + } + + Future _loadRecentPhoto(AssetEntity asset) async { + final bytes = await asset.thumbnailDataWithSize( + const ThumbnailSize.square(256), + quality: 84, + ); + if (bytes == null || bytes.isEmpty) return null; + return RecentPhoto(id: asset.id, thumbnailBytes: bytes); + } + + @override + Future> resolveSelectedPhotos(List photos) async { + final resolved = []; + for (final photo in photos) { + final asset = await AssetEntity.fromId(photo.id); + final file = await asset?.file; + if (file == null) { + throw const PhotoLibraryAccessException(); + } + resolved.add(XFile(file.path, name: asset?.title)); + } + return resolved; + } +} diff --git a/mobile/lib/shared/relay/media_upload.dart b/mobile/lib/shared/relay/media_upload.dart index bd9a1cce43..58c93979d7 100644 --- a/mobile/lib/shared/relay/media_upload.dart +++ b/mobile/lib/shared/relay/media_upload.dart @@ -64,6 +64,9 @@ const _maxFileSizeBytes = 100 * 1024 * 1024; // 100MB const _mediaPolicyUploadMessage = "We couldn't prepare this image for upload."; typedef PickGalleryImage = Future Function(); + +/// Selects multiple gallery images for upload in picker order. +typedef PickGalleryImages = Future> Function(); typedef PickGalleryVideo = Future Function(); typedef PickAttachmentFile = Future Function(); typedef SanitizeImageBytes = @@ -172,6 +175,7 @@ class MediaUploadService { final String _baseUrl; final String? _nsec; final PickGalleryImage _pickGalleryImage; + final PickGalleryImages _pickGalleryImages; final PickGalleryVideo _pickGalleryVideo; final PickAttachmentFile? _pickAttachmentFile; final SanitizeImageBytes _sanitizeImageBytes; @@ -186,6 +190,7 @@ class MediaUploadService { required String baseUrl, required String? nsec, required PickGalleryImage pickGalleryImage, + PickGalleryImages? pickGalleryImages, required PickGalleryVideo pickGalleryVideo, PickAttachmentFile? pickAttachmentFile, SanitizeImageBytes? sanitizeImageBytes, @@ -197,6 +202,12 @@ class MediaUploadService { }) : _baseUrl = baseUrl, _nsec = nsec, _pickGalleryImage = pickGalleryImage, + _pickGalleryImages = + pickGalleryImages ?? + (() async { + final image = await pickGalleryImage(); + return image == null ? const [] : [image]; + }), _pickGalleryVideo = pickGalleryVideo, _pickAttachmentFile = pickAttachmentFile, _sanitizeImageBytes = sanitizeImageBytes ?? _sanitizePickedImageBytes, @@ -220,6 +231,9 @@ class MediaUploadService { return uploadImage(pickedImage); } + /// Opens the system picker with multi-selection enabled. + Future> pickGalleryImages() => _pickGalleryImages(); + Future uploadImage(XFile image) async { final preparedImage = await _prepareUploadImage(image); return _uploadPreparedBytes( @@ -243,9 +257,11 @@ class MediaUploadService { return uploadImage(XFile.fromData(bytes)); } - Future pickAndUploadVideo() async { - final pickedVideo = await _pickGalleryVideo(); - if (pickedVideo == null) return null; + /// Opens the system gallery video picker. + Future pickGalleryVideo() => _pickGalleryVideo(); + + /// Sanitizes and uploads [pickedVideo] as an MP4 attachment. + Future uploadVideo(XFile pickedVideo) async { final length = await pickedVideo.length(); if (length > _maxVideoSizeBytes) { throw Exception( @@ -278,14 +294,23 @@ class MediaUploadService { } } - Future pickAndUploadFile() async { + Future pickAndUploadVideo() async { + final pickedVideo = await pickGalleryVideo(); + if (pickedVideo == null) return null; + return uploadVideo(pickedVideo); + } + + /// Opens the system document picker for a generic file attachment. + Future pickAttachmentFile() async { final pickAttachmentFile = _pickAttachmentFile; if (pickAttachmentFile == null) { throw Exception("File attachments aren't available on this device."); } - final pickedFile = await pickAttachmentFile(); - if (pickedFile == null) return null; + return pickAttachmentFile(); + } + /// Uploads [pickedFile] as a size-limited generic attachment. + Future uploadFile(XFile pickedFile) async { final length = await pickedFile.length(); if (length == 0) { throw Exception('File is empty.'); @@ -304,6 +329,12 @@ class MediaUploadService { return descriptor.withFilename(_safeAttachmentFilename(pickedFile.name)); } + Future pickAndUploadFile() async { + final pickedFile = await pickAttachmentFile(); + if (pickedFile == null) return null; + return uploadFile(pickedFile); + } + Future uploadBytes( Uint8List bytes, { required String mimeType, @@ -781,6 +812,7 @@ final mediaUploadServiceProvider = Provider((ref) { source: ImageSource.gallery, requestFullMetadata: false, ), + pickGalleryImages: () => picker.pickMultiImage(requestFullMetadata: false), pickGalleryVideo: () => picker.pickVideo(source: ImageSource.gallery), pickAttachmentFile: file_selector.openFile, ); diff --git a/mobile/test/features/channels/camera_capture_cleanup_test.dart b/mobile/test/features/channels/camera_capture_cleanup_test.dart index 2b5360035d..17d96b0d5b 100644 --- a/mobile/test/features/channels/camera_capture_cleanup_test.dart +++ b/mobile/test/features/channels/camera_capture_cleanup_test.dart @@ -32,4 +32,23 @@ void main() { expect(await file.exists(), isFalse); }); + + test('deletes every native picker file after processing', () async { + final suffix = DateTime.now().microsecondsSinceEpoch; + final files = [ + File('${Directory.systemTemp.path}/buzz-photo-$suffix-1.jpg'), + File('${Directory.systemTemp.path}/buzz-photo-$suffix-2.jpg'), + ]; + for (final file in files) { + await file.writeAsBytes([1, 2, 3]); + } + + await processTemporaryImages([ + for (final file in files) XFile(file.path), + ], (_) async {}); + + for (final file in files) { + expect(await file.exists(), isFalse); + } + }); } diff --git a/mobile/test/features/channels/compose_bar_test.dart b/mobile/test/features/channels/compose_bar_test.dart index c77cd26a12..b851bf0a6e 100644 --- a/mobile/test/features/channels/compose_bar_test.dart +++ b/mobile/test/features/channels/compose_bar_test.dart @@ -1,6 +1,7 @@ import 'dart:async'; import 'dart:convert'; import 'dart:io'; +import 'dart:math' as math; import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; @@ -18,6 +19,7 @@ import 'package:buzz/features/channels/compose_bar.dart'; import 'package:buzz/features/channels/channels_provider.dart'; import 'package:buzz/features/channels/mentions/mention_candidates.dart'; import 'package:buzz/features/channels/mentions/mention_candidates_provider.dart'; +import 'package:buzz/features/channels/photo_library.dart'; import 'package:buzz/shared/custom_emoji/custom_emoji.dart'; import 'package:buzz/shared/custom_emoji/custom_emoji_provider.dart'; import 'package:buzz/shared/relay/relay.dart'; @@ -127,6 +129,9 @@ List _testPngChunk(String type, List payload) { } const _mediaUploadPlatformChannel = MethodChannel('buzz/media_upload'); +const _nativeAttachmentPopoverChannel = MethodChannel( + 'buzz/native_attachment_popover', +); void _setMockMediaUploadPlatformHandler( Future Function(MethodCall call)? handler, @@ -135,6 +140,27 @@ void _setMockMediaUploadPlatformHandler( .setMockMethodCallHandler(_mediaUploadPlatformChannel, handler); } +void _setMockNativeAttachmentPopoverHandler( + Future Function(MethodCall call)? handler, +) { + TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger + .setMockMethodCallHandler(_nativeAttachmentPopoverChannel, handler); +} + +Future _sendNativeAttachmentPopoverCall( + WidgetTester tester, + String method, [ + Object? arguments, +]) async { + await tester.binding.defaultBinaryMessenger.handlePlatformMessage( + _nativeAttachmentPopoverChannel.name, + _nativeAttachmentPopoverChannel.codec.encodeMethodCall( + MethodCall(method, arguments), + ), + null, + ); +} + /// Shared mock prefs for the compose bar's draft store. Initialized in /// [main]. late SharedPreferences _testPrefs; @@ -148,13 +174,16 @@ Widget _buildComposeBar({ List channels = const [], String? currentPubkey, bool? supportsShowingSystemContextMenu, + TextScaler? textScaler, List customEmoji = const [], RelayConfigNotifier Function()? relayConfig, + PhotoLibrary photoLibrary = const _EmptyPhotoLibrary(), }) { return ProviderScope( overrides: [ customEmojiListProvider.overrideWithValue(customEmoji), mediaUploadServiceProvider.overrideWithValue(uploadService), + photoLibraryProvider.overrideWithValue(photoLibrary), currentPubkeyProvider.overrideWith((ref) => currentPubkey), channelMembersProvider( 'channel-1', @@ -172,12 +201,14 @@ Widget _buildComposeBar({ ], child: MaterialApp( theme: AppTheme.light(), - builder: supportsShowingSystemContextMenu == null + builder: supportsShowingSystemContextMenu == null && textScaler == null ? null : (context, child) => MediaQuery( data: MediaQuery.of(context).copyWith( supportsShowingSystemContextMenu: - supportsShowingSystemContextMenu, + supportsShowingSystemContextMenu ?? + MediaQuery.of(context).supportsShowingSystemContextMenu, + textScaler: textScaler ?? MediaQuery.textScalerOf(context), ), child: child!, ), @@ -193,6 +224,54 @@ Widget _buildComposeBar({ ); } +Widget _buildNativePopoverOwnershipHarness({ + required MediaUploadService uploadService, + required bool includeFirstComposer, +}) { + return ProviderScope( + overrides: [ + customEmojiListProvider.overrideWithValue(const []), + mediaUploadServiceProvider.overrideWithValue(uploadService), + photoLibraryProvider.overrideWithValue(const _EmptyPhotoLibrary()), + currentPubkeyProvider.overrideWith((ref) => null), + channelMembersProvider( + 'channel-1', + ).overrideWith((ref) => Future.value(const [])), + agentDirectoryProvider.overrideWith( + (ref) async => const [], + ), + agentOwnersProvider.overrideWith((ref) async => const {}), + relayClientProvider.overrideWithValue( + RelayClient(baseUrl: 'http://localhost:3000'), + ), + relayConfigProvider.overrideWith(_FakeRelayConfigNotifier.new), + savedPrefsProvider.overrideWithValue(_testPrefs), + channelsProvider.overrideWith(() => _FakeChannelsNotifier(const [])), + ], + child: MaterialApp( + theme: AppTheme.light(), + home: Scaffold( + body: Column( + mainAxisAlignment: MainAxisAlignment.end, + children: [ + if (includeFirstComposer) + ComposeBar( + key: const ValueKey('first-composer'), + channelId: 'channel-1', + onSend: (_, _, {mediaTags = const []}) async {}, + ), + ComposeBar( + key: const ValueKey('second-composer'), + channelId: 'channel-1', + onSend: (_, _, {mediaTags = const []}) async {}, + ), + ], + ), + ), + ), + ); +} + class _FakeRelayConfigNotifier extends RelayConfigNotifier { @override RelayConfig build() => RelayConfig( @@ -201,6 +280,32 @@ class _FakeRelayConfigNotifier extends RelayConfigNotifier { ); } +class _EmptyPhotoLibrary implements PhotoLibrary { + const _EmptyPhotoLibrary(); + + @override + Future> loadRecentPhotos() async => const []; + + @override + Future> resolveSelectedPhotos(List photos) async => + const []; +} + +class _FakePhotoLibrary implements PhotoLibrary { + final List photos; + + const _FakePhotoLibrary(this.photos); + + @override + Future> loadRecentPhotos() async => photos; + + @override + Future> resolveSelectedPhotos(List photos) async => [ + for (final photo in photos) + XFile.fromData(_pngBytes, name: '${photo.id}.png'), + ]; +} + /// Relay config that starts from a fixed identity and can be switched /// in place via [RelayConfigNotifier.update] — simulates a community or /// account switch while widgets stay mounted. @@ -390,6 +495,121 @@ void main() { expect(textField.controller!.selection.baseOffset, 12); }); + testWidgets('native All Photos picker failures show an error', ( + tester, + ) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + _setMockNativeAttachmentPopoverHandler((call) async { + return switch (call.method) { + 'isSupported' || 'present' => true, + 'dismiss' => null, + _ => null, + }; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => + throw PlatformException(code: 'photo_picker_failed'), + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildComposeBar( + uploadService: uploadService, + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async {}, + ), + ); + + await tester.tap(find.byTooltip('Add attachment').hitTestable()); + await tester.pumpAndSettle(); + await _sendNativeAttachmentPopoverCall(tester, 'pickAllPhotos'); + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpAndSettle(); + + expect(find.text('Unable to open your photo library.'), findsOneWidget); + } finally { + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }); + + testWidgets('disposing a non-owner keeps native popover callbacks active', ( + tester, + ) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + var presentCalls = 0; + var dismissCalls = 0; + var pickAllPhotosCalls = 0; + _setMockNativeAttachmentPopoverHandler((call) async { + switch (call.method) { + case 'isSupported': + return true; + case 'present': + presentCalls += 1; + return true; + case 'dismiss': + dismissCalls += 1; + return null; + } + return null; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async { + pickAllPhotosCalls += 1; + return const []; + }, + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: true, + ), + ); + + await tester.tap(find.byTooltip('Add attachment').hitTestable().at(1)); + await tester.pumpAndSettle(); + expect(presentCalls, 1); + + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: false, + ), + ); + await tester.pumpAndSettle(); + expect(dismissCalls, 0); + + await _sendNativeAttachmentPopoverCall(tester, 'pickAllPhotos'); + await tester.pumpAndSettle(); + expect(pickAllPhotosCalls, 1); + + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + } finally { + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }); + testWidgets('uploads an image and sends markdown plus imeta tags', ( tester, ) async { @@ -434,8 +654,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); expect(find.byTooltip('Remove attachment'), findsOneWidget); @@ -455,15 +674,115 @@ void main() { expect(find.byTooltip('Remove attachment'), findsNothing); }); - testWidgets('keeps upload progress visible after the picker closes', ( + testWidgets('uploads multiple system-selected photos in picker order', ( tester, ) async { - final pickedImage = Completer(); final uploadService = MediaUploadService( baseUrl: 'https://relay.example', nsec: nostr.Keys.generate().nsec, + httpClient: http_testing.MockClient((request) async { + final mimeType = request.headers.entries + .firstWhere((entry) => entry.key.toLowerCase() == 'content-type') + .value; + final isGif = mimeType == 'image/gif'; + return http.Response( + jsonEncode({ + 'url': isGif + ? 'https://relay.example/media/two.gif' + : 'https://relay.example/media/one.png', + 'sha256': isGif + ? '2222222222222222222222222222222222222222222222222222222222222222' + : '1111111111111111111111111111111111111111111111111111111111111111', + 'size': request.bodyBytes.length, + 'type': mimeType, + 'uploaded': 1, + }), + 200, + ); + }), + pickGalleryImage: () async => null, + pickGalleryImages: () async => [ + XFile.fromData(_pngBytes, name: 'one.png'), + XFile.fromData(_gifBytes, name: 'two.gif'), + ], + pickGalleryVideo: () async => null, + ); + + String? sentContent; + List> sentMediaTags = const []; + await tester.pumpWidget( + _buildComposeBar( + uploadService: uploadService, + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async { + sentContent = content; + sentMediaTags = mediaTags; + }, + ), + ); + + await _openSystemPhotoPicker(tester); + await tester.pumpAndSettle(); + + expect(find.byTooltip('Remove attachment'), findsNWidgets(2)); + + await _expandComposer(tester); + await tester.tap(find.byIcon(LucideIcons.arrowUp)); + await tester.pumpAndSettle(); + + expect( + sentContent, + '\n![image](https://relay.example/media/one.png)' + '\n![image](https://relay.example/media/two.gif)', + ); + expect(sentMediaTags, hasLength(2)); + expect(sentMediaTags.map((tag) => tag[1]), [ + 'url https://relay.example/media/one.png', + 'url https://relay.example/media/two.gif', + ]); + }); + + testWidgets('bounds concurrent system-selected photo uploads', ( + tester, + ) async { + final releaseFirstBatch = Completer(); + var requestsStarted = 0; + var activeRequests = 0; + var peakActiveRequests = 0; + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + httpClient: http_testing.MockClient((request) async { + requestsStarted += 1; + final requestNumber = requestsStarted; + activeRequests += 1; + peakActiveRequests = math.max(peakActiveRequests, activeRequests); + if (requestNumber <= 3) { + await releaseFirstBatch.future; + } + activeRequests -= 1; + return http.Response( + jsonEncode({ + 'url': 'https://relay.example/media/photo-$requestNumber.png', + 'sha256': + '1111111111111111111111111111111111111111111111111111111111111111', + 'size': request.bodyBytes.length, + 'type': 'image/png', + 'uploaded': 1, + }), + 200, + ); + }), + pickGalleryImage: () async => null, + pickGalleryImages: () async => [ + for (var index = 0; index < 5; index += 1) + XFile.fromData(_pngBytes, name: 'photo-$index.png'), + ], pickGalleryVideo: () async => null, - pickGalleryImage: () => pickedImage.future, ); await tester.pumpWidget( @@ -478,17 +797,191 @@ void main() { ), ); + await _openSystemPhotoPicker(tester); + for (var frame = 0; frame < 20 && requestsStarted < 3; frame += 1) { + await tester.pump(const Duration(milliseconds: 20)); + } + + expect(requestsStarted, 3); + expect(peakActiveRequests, 3); + + releaseFirstBatch.complete(); + await tester.pumpAndSettle(); + + expect(requestsStarted, 5); + expect(peakActiveRequests, 3); + expect(find.byTooltip('Remove attachment'), findsNWidgets(5)); + }); + + testWidgets('numbers recent photo selection and returns to the menu', ( + tester, + ) async { + final photoLibrary = _FakePhotoLibrary([ + RecentPhoto(id: 'one', thumbnailBytes: _gifBytes), + RecentPhoto(id: 'two', thumbnailBytes: _gifBytes), + RecentPhoto(id: 'three', thumbnailBytes: _gifBytes), + ]); + + await tester.pumpWidget( + _buildComposeBar( + uploadService: _testUploadService(nostr.Keys.generate().nsec), + photoLibrary: photoLibrary, + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async {}, + ), + ); + await _openAttachmentMenu(tester); await tester.tap(find.text('Photos')); + await tester.pumpAndSettle(); + + expect( + find.byKey(const ValueKey('photo-gallery-picker')), + findsOneWidget, + ); + expect(find.byTooltip('Back to attachment options'), findsWidgets); + expect(find.text('All photos'), findsOneWidget); + + await tester.tap(find.byKey(const ValueKey('recent-photo-two'))); + await tester.pumpAndSettle(); + await tester.tap(find.byKey(const ValueKey('recent-photo-one'))); + await tester.pumpAndSettle(); + + expect(find.text('Add 2 photos'), findsOneWidget); + expect( + find.descendant( + of: find.byKey(const ValueKey('photo-selection-index-two')), + matching: find.text('1'), + ), + findsOneWidget, + ); + expect( + find.descendant( + of: find.byKey(const ValueKey('photo-selection-index-one')), + matching: find.text('2'), + ), + findsOneWidget, + ); + + await tester.tap(find.byKey(const ValueKey('recent-photo-two'))); + await tester.pumpAndSettle(); + + expect(find.text('Add 1 photo'), findsOneWidget); + expect( + find.descendant( + of: find.byKey(const ValueKey('photo-selection-index-one')), + matching: find.text('1'), + ), + findsOneWidget, + ); + + await tester.tap(find.byKey(const ValueKey('photo-gallery-back'))); + await tester.pumpAndSettle(); + + expect(find.byKey(const ValueKey('photo-gallery-picker')), findsNothing); + expect( + find.byKey(const ValueKey('attachment-trigger-menu')).hitTestable(), + findsOneWidget, + ); + expect(find.text('Camera'), findsOneWidget); + expect(find.text('Photos'), findsOneWidget); + }); + + testWidgets('photo picker errors keep the action visible at large text', ( + tester, + ) async { + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => + throw PlatformException(code: 'photo_picker_failed'), + pickGalleryVideo: () async => null, + ); + + await tester.pumpWidget( + _buildComposeBar( + uploadService: uploadService, + textScaler: const TextScaler.linear(1.2), + photoLibrary: _FakePhotoLibrary([ + RecentPhoto(id: 'one', thumbnailBytes: _gifBytes), + RecentPhoto(id: 'two', thumbnailBytes: _gifBytes), + RecentPhoto(id: 'three', thumbnailBytes: _gifBytes), + RecentPhoto(id: 'four', thumbnailBytes: _gifBytes), + ]), + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async {}, + ), + ); + + await _openSystemPhotoPicker(tester); + await tester.pumpAndSettle(); + + expect(tester.takeException(), isNull); + expect(find.byKey(const ValueKey('photo-gallery-error')), findsOneWidget); + expect( + find.byKey(const ValueKey('photo-gallery-action')).hitTestable(), + findsOneWidget, + ); + }); + + testWidgets('keeps upload progress visible after the picker closes', ( + tester, + ) async { + final uploadResponse = Completer(); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + httpClient: http_testing.MockClient((request) => uploadResponse.future), + pickGalleryVideo: () async => null, + pickGalleryImage: () async => null, + pickGalleryImages: () async => [ + XFile.fromData(_pngBytes, name: 'tiny.png'), + ], + ); + + await tester.pumpWidget( + _buildComposeBar( + uploadService: uploadService, + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async {}, + ), + ); + + await _openSystemPhotoPicker(tester); await tester.pump(); expect( find.byKey(const ValueKey('compose-upload-progress')), findsOneWidget, ); - expect(find.text('Uploading attachment…'), findsOneWidget); - - pickedImage.complete(null); + expect(find.bySemanticsLabel('Uploading attachment…'), findsOneWidget); + + uploadResponse.complete( + http.Response( + jsonEncode({ + 'url': 'https://relay.example/media/test.png', + 'sha256': + '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', + 'size': 16, + 'type': 'image/png', + 'uploaded': 1, + }), + 200, + ), + ); await tester.pumpAndSettle(); expect( @@ -1053,8 +1546,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); final attachmentFinder = find.byKey( @@ -1109,8 +1601,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); expect(find.textContaining('upload failed'), findsOneWidget); @@ -1150,8 +1641,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); expect( @@ -1199,8 +1689,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); expect( @@ -1426,8 +1915,7 @@ void main() { ), ); - await _openAttachmentMenu(tester); - await tester.tap(find.text('Photos')); + await _openSystemPhotoPicker(tester); await tester.pumpAndSettle(); expect( @@ -1747,6 +2235,13 @@ Future _openAttachmentMenu(WidgetTester tester) async { await tester.pumpAndSettle(); } +Future _openSystemPhotoPicker(WidgetTester tester) async { + await _openAttachmentMenu(tester); + await tester.tap(find.text('Photos')); + await tester.pumpAndSettle(); + await tester.tap(find.text('All photos')); +} + Future _selectAndSendAgentMention(WidgetTester tester) async { await _expandComposer(tester); await tester.enterText(find.byType(TextField), '@hel'); From af4d8615165b9bdbe1190d4ba71ff32b1df75a8a Mon Sep 17 00:00:00 2001 From: Dave Grochowski Date: Tue, 28 Jul 2026 13:07:04 -0400 Subject: [PATCH 007/112] feat(chart): add relay pod extension points (#3322) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Allow operators to install wrapper binaries and override the relay entrypoint without maintaining a duplicated Deployment outside the OSS chart. `extraManifests` can create independent resources but cannot extend the chart-managed relay Pod. ## What - Add opt-in init-container, volume, volume-mount, command, and args extension points - Preserve image defaults when extensions are empty and compose generic init containers with the MinIO readiness gate - Document the distinction from `extraManifests`, add schema coverage, and release chart 0.1.7 ## Risk Assessment Low — all new values are opt-in, and default rendered manifests are unchanged apart from version-derived metadata. Merge publishes a new chart version without modifying existing installations. ## References - [OpenTelemetry Collector Pod extensions](https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-collector/templates/_pod.tpl) alongside [extraManifests](https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-collector/templates/extraManifests.yaml) - [Argo CD extraObjects](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/templates/extra-manifests.yaml) alongside component-scoped Pod extension hooks - `helm unittest` 0.8.2: 43/43 tests passed - Helm lint, schema validation, fixture renders, and chart packaging passed - Oracle review found no functional issues; its literal no-`tpl` regression test recommendation is included Generated with Amp --------- Signed-off-by: David Grochowski Co-authored-by: Amp --- deploy/charts/buzz/Chart.yaml | 4 +- deploy/charts/buzz/README.md | 51 ++++++++ deploy/charts/buzz/templates/deployment.yaml | 21 +++- deploy/charts/buzz/tests/render_test.yaml | 115 +++++++++++++++++++ deploy/charts/buzz/values.schema.json | 27 ++++- deploy/charts/buzz/values.yaml | 15 +++ 6 files changed, 229 insertions(+), 4 deletions(-) diff --git a/deploy/charts/buzz/Chart.yaml b/deploy/charts/buzz/Chart.yaml index 956e085749..9309074895 100644 --- a/deploy/charts/buzz/Chart.yaml +++ b/deploy/charts/buzz/Chart.yaml @@ -7,7 +7,7 @@ description: | PostgreSQL and Redis. Configurable for single-node evaluation (subcharts on) and HA production (external services, existingSecret). type: application -version: 0.1.6 +version: 0.1.7 appVersion: "0.1.0" home: https://github.com/block/buzz sources: @@ -24,7 +24,7 @@ maintainers: annotations: artifacthub.io/changes: | - kind: added - description: Optional READ_DATABASE_URL env (secretKeyRef) enabling relay read-replica routing; absent key preserves prior behavior. + description: Generic init-container, volume, volume-mount, command, and args extension points for the relay Pod. artifacthub.io/license: Apache-2.0 # Optional eval-only subcharts. Production deploys disable both and point diff --git a/deploy/charts/buzz/README.md b/deploy/charts/buzz/README.md index 4cf4b22b24..7e75d81a2e 100644 --- a/deploy/charts/buzz/README.md +++ b/deploy/charts/buzz/README.md @@ -52,6 +52,57 @@ See: The chart fails at `helm install` / `helm template` time with a clear message if any of these are missing or malformed (see `templates/_validate.tpl`). +## Relay Pod extensions + +The chart exposes narrow extension points for init containers, volumes, relay +volume mounts, and image command/argument overrides. `extraManifests` creates +independent Kubernetes resources but cannot modify the chart-managed relay +Deployment. These extension values insert fields into that Deployment, avoiding +duplication of its environment, probes, security context, secrets, and +chart-owned volumes. + +For example, an init container can copy a wrapper binary into a shared volume +and make that wrapper the relay entrypoint: + +```yaml +extraInitContainers: + - name: install-wrapper + image: example.com/wrapper-init:v1 + args: [/opt/wrapper/wrapper] + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + capabilities: + drop: [ALL] + resources: + requests: + cpu: 10m + memory: 16Mi + volumeMounts: + - name: wrapper + mountPath: /opt/wrapper + +extraVolumes: + - name: wrapper + emptyDir: {} + +relay: + command: [/opt/wrapper/wrapper] + args: [/usr/local/bin/buzz-relay] + extraVolumeMounts: + - name: wrapper + mountPath: /opt/wrapper +``` + +These values are raw Kubernetes fragments rendered with `toYaml`, not `tpl`. +The chart does not validate cross-field relationships: extension names must not +collide with chart-owned containers or volumes, mounts must reference existing +volumes, and each init container must define an appropriate security context +and resources. Empty `relay.command` and `relay.args` arrays preserve the image +defaults; non-empty values override its entrypoint and arguments respectively. + ## Device pairing relay The chart can run Buzz's stateless pairing WebSocket relay as an independent diff --git a/deploy/charts/buzz/templates/deployment.yaml b/deploy/charts/buzz/templates/deployment.yaml index f8d67de31d..bf2df4c2c8 100644 --- a/deploy/charts/buzz/templates/deployment.yaml +++ b/deploy/charts/buzz/templates/deployment.yaml @@ -55,13 +55,14 @@ spec: topologySpreadConstraints: {{- toYaml . | nindent 8 }} {{- end }} + {{- if or .Values.minio.enabled .Values.extraInitContainers }} + initContainers: {{- if .Values.minio.enabled }} # Quickstart only: the bundled MinIO bucket is created by a concurrent # init Job (templates/quickstart-minio-init.yaml). The relay's A3 S3 # conformance probe is startup-fatal, so without this gate the relay Pods # CrashLoopBackOff (with growing backoff) until the bucket appears. Block # relay start until the bucket exists — deterministic, no crash-loops. - initContainers: - name: wait-for-bucket image: {{ .Values.minio.mcImage | quote }} securityContext: @@ -90,12 +91,24 @@ spec: done echo "bucket {{ .Values.s3.bucket }} present" {{- end }} + {{- with .Values.extraInitContainers }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} containers: - name: relay image: {{ include "buzz.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: {{- toYaml .Values.relay.containerSecurityContext | nindent 12 }} + {{- with .Values.relay.command }} + command: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.relay.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} ports: - { name: app, containerPort: 3000, protocol: TCP } - { name: health, containerPort: {{ .Values.service.healthPort }}, protocol: TCP } @@ -225,6 +238,9 @@ spec: volumeMounts: - { name: git-repos, mountPath: {{ .Values.persistence.git.mountPath | quote }} } - { name: git-pack-cache, mountPath: {{ .Values.git.packCachePath | quote }} } + {{- with .Values.relay.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: git-repos @@ -238,3 +254,6 @@ spec: - name: git-pack-cache emptyDir: sizeLimit: {{ .Values.git.packCacheVolumeSize | quote }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/deploy/charts/buzz/tests/render_test.yaml b/deploy/charts/buzz/tests/render_test.yaml index c50a960d26..3e044f5d7c 100644 --- a/deploy/charts/buzz/tests/render_test.yaml +++ b/deploy/charts/buzz/tests/render_test.yaml @@ -165,3 +165,118 @@ tests: - hasDocuments: count: 0 template: templates/pvc-git.yaml + + - it: preserves image defaults when Pod extensions are empty + set: + relayUrl: wss://buzz.example.com + ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000" + externalPostgresql.url: postgres://u:p@h:5432/d + externalRedis.url: redis://h:6379 + s3.endpoint: http://minio:9000 + s3.accessKey: a + s3.secretKey: s + asserts: + - notExists: + path: spec.template.spec.initContainers + template: templates/deployment.yaml + - notExists: + path: spec.template.spec.containers[0].command + template: templates/deployment.yaml + - notExists: + path: spec.template.spec.containers[0].args + template: templates/deployment.yaml + + - it: appends generic Pod extensions and overrides the relay command + set: + relayUrl: wss://buzz.example.com + ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000" + externalPostgresql.url: postgres://u:p@h:5432/d + externalRedis.url: redis://h:6379 + s3.endpoint: http://minio:9000 + s3.accessKey: a + s3.secretKey: s + relay.command: + - /opt/wrapper/wrapper + relay.args: + - /usr/local/bin/buzz-relay + relay.extraVolumeMounts: + - name: wrapper + mountPath: /opt/wrapper + extraInitContainers: + - name: install-wrapper + image: example.com/wrapper-init:v1 + args: + - /opt/wrapper/wrapper + env: + - name: LITERAL_TEMPLATE + value: '{{ .Release.Name }}' + securityContext: + runAsNonRoot: true + resources: + requests: + cpu: 10m + memory: 16Mi + volumeMounts: + - name: wrapper + mountPath: /opt/wrapper + extraVolumes: + - name: wrapper + emptyDir: {} + asserts: + - equal: + path: spec.template.spec.initContainers[0].name + value: install-wrapper + template: templates/deployment.yaml + - equal: + path: spec.template.spec.initContainers[0].securityContext.runAsNonRoot + value: true + template: templates/deployment.yaml + # Extension fragments are deliberately rendered with toYaml, not tpl. + - equal: + path: spec.template.spec.initContainers[0].env[0].value + value: '{{ .Release.Name }}' + template: templates/deployment.yaml + - equal: + path: spec.template.spec.containers[0].command + value: + - /opt/wrapper/wrapper + template: templates/deployment.yaml + - equal: + path: spec.template.spec.containers[0].args + value: + - /usr/local/bin/buzz-relay + template: templates/deployment.yaml + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: wrapper + mountPath: /opt/wrapper + template: templates/deployment.yaml + - contains: + path: spec.template.spec.volumes + content: + name: wrapper + emptyDir: {} + template: templates/deployment.yaml + + - it: appends generic init containers after the bundled MinIO readiness gate + release: + name: rel + set: + relayUrl: wss://buzz.example.com + ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000" + postgresql.enabled: true + redis.enabled: true + minio.enabled: true + extraInitContainers: + - name: install-wrapper + image: example.com/wrapper-init:v1 + asserts: + - equal: + path: spec.template.spec.initContainers[0].name + value: wait-for-bucket + template: templates/deployment.yaml + - equal: + path: spec.template.spec.initContainers[1].name + value: install-wrapper + template: templates/deployment.yaml diff --git a/deploy/charts/buzz/values.schema.json b/deploy/charts/buzz/values.schema.json index 203fd9b69b..53bb29bb60 100644 --- a/deploy/charts/buzz/values.schema.json +++ b/deploy/charts/buzz/values.schema.json @@ -72,9 +72,34 @@ "type": "array", "items": { "type": "string" } }, - "ephemeralTtlOverride": { "type": "integer", "minimum": 0 } + "ephemeralTtlOverride": { "type": "integer", "minimum": 0 }, + "command": { + "type": "array", + "items": { "type": "string" }, + "description": "Optional relay container entrypoint override. Empty preserves the image default." + }, + "args": { + "type": "array", + "items": { "type": "string" }, + "description": "Optional relay container arguments override. Empty preserves the image default." + }, + "extraVolumeMounts": { + "type": "array", + "items": { "type": "object" }, + "description": "Raw Kubernetes volumeMount fragments appended to the relay container." + } } }, + "extraInitContainers": { + "type": "array", + "items": { "type": "object" }, + "description": "Raw Kubernetes init-container fragments appended to the relay Pod." + }, + "extraVolumes": { + "type": "array", + "items": { "type": "object" }, + "description": "Raw Kubernetes volume fragments appended to the relay Pod." + }, "service": { "type": "object", "additionalProperties": true, diff --git a/deploy/charts/buzz/values.yaml b/deploy/charts/buzz/values.yaml index 21548f3651..8ac5086e27 100644 --- a/deploy/charts/buzz/values.yaml +++ b/deploy/charts/buzz/values.yaml @@ -185,9 +185,24 @@ relay: readOnlyRootFilesystem: false # git writes need a writable repo path terminationGracePeriodSeconds: 60 + # Optional image entrypoint/arguments overrides. Empty arrays preserve the + # relay image's defaults. Consumers own compatibility with the selected image. + command: [] + args: [] + # Appended to the chart-owned relay mounts. Names must match extraVolumes (or + # another volume supplied by the platform) and must not collide with built-ins. + extraVolumeMounts: [] + extraEnv: [] extraEnvFrom: [] +# ── Pod extensions ────────────────────────────────────────────────────────── +# Raw Kubernetes fragments appended to the relay Pod. They are rendered with +# toYaml, not tpl. Init containers must define their own securityContext and +# resources; names must not collide with chart-owned containers or volumes. +extraInitContainers: [] +extraVolumes: [] + # ── Device pairing relay ───────────────────────────────────────────────────── # Optional, stateless NIP-AB relay. When enabled, the main relay advertises # pairingRelay.url in NIP-11 and Buzz clients use it instead of the legacy From 5457c947a74f5ba4b979f9c6411aa7626a858387 Mon Sep 17 00:00:00 2001 From: Taylor Ho Date: Tue, 28 Jul 2026 10:31:27 -0700 Subject: [PATCH 008/112] fix(composer): scope multiline block formatting (#3246) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Category:** fix **User Impact:** Composer block formatting now applies to the intended line or selection without collapsing multiline content. **Problem:** Block formatting from a Shift+Enter line could convert the entire draft, selected visual lines could collapse into one list item, and code conversion could lose line breaks. **Solution:** Scope caret formatting to its hard-break-delimited line and normalize explicit selections for the destination block type while preserving neighboring content and visual line boundaries.
File changes **desktop/src/features/messages/lib/selectionBlockFormatting.ts** Scopes collapsed-caret block actions to the active visual line and normalizes multiline selections for lists and code blocks. **desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs** Adds unit coverage for caret-line isolation across line positions and selection directions. **desktop/src/features/messages/ui/FormattingToolbar.tsx** Routes list, quote, and code-block actions through the selection-aware formatting transaction. **desktop/tests/e2e/composer-selection-formatting.spec.ts** Covers caret-only formatting, multiline list conversion, list-to-code conversion, preserved hard breaks, Markdown output, and backward selections.
## Reproduction steps 1. In the desktop composer, enter several lines using Shift+Enter and place the caret on one line. 2. Apply a bullet list, ordered list, quote, or code block; only the caret line should change. 3. Select several Shift+Enter lines and apply a list; each visual line should become its own item. 4. Select several list items and apply Code block; they should become one multiline code block while unselected neighbors remain intact. 5. Select several Shift+Enter lines and apply Code block; each line break should remain visible. ## Screenshots/Demos Screen Recording 2026-07-27 at 5 29 19 PM Expected multiline code-block result: https://buzz.block.builderlab.xyz/media/d2e2668093af3b67d896a32e9799daccd236da9fc9e24ec56ddb4ebf7d01dd96.png --------- Signed-off-by: Taylor Ho Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> --- .../lib/selectionBlockFormatting.test.mjs | 230 +++++++++++++ .../messages/lib/selectionBlockFormatting.ts | 267 ++++++++++++++- .../messages/ui/FormattingToolbar.tsx | 53 ++- .../e2e/composer-selection-formatting.spec.ts | 307 +++++++++++++++++- 4 files changed, 842 insertions(+), 15 deletions(-) create mode 100644 desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs diff --git a/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs b/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs new file mode 100644 index 0000000000..75d04cdde3 --- /dev/null +++ b/desktop/src/features/messages/lib/selectionBlockFormatting.test.mjs @@ -0,0 +1,230 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { getSchema, Node } from "@tiptap/core"; +import StarterKit from "@tiptap/starter-kit"; +import { EditorState, TextSelection } from "@tiptap/pm/state"; + +import { CustomEmojiNode } from "./customEmojiNode.ts"; + +import { + isolateSelectionForBlockFormatting, + mergeSelectedTextblocksIntoCodeBlock, + splitSelectedLinesForListFormatting, +} from "./selectionBlockFormatting.ts"; + +// Matching useRichTextEditor's StarterKit configuration (minus things +// irrelevant to block isolation). +const MentionNode = Node.create({ + name: "mention", + group: "inline", + inline: true, + atom: true, + addAttributes: () => ({ label: { default: "" } }), +}); +const UnknownLeaf = Node.create({ + name: "unknownLeaf", + group: "inline", + inline: true, + atom: true, + addAttributes: () => ({ internalId: { default: "secret" } }), +}); + +const schema = getSchema([ + StarterKit.configure({ + hardBreak: { keepMarks: true }, + heading: false, + trailingNode: false, + link: false, + }), + MentionNode, + CustomEmojiNode.configure({ + resolveUrl: () => undefined, + shortcodes: () => [], + }), + UnknownLeaf, +]); + +const para = (...content) => schema.nodes.paragraph.create(null, content); +const br = () => schema.nodes.hardBreak.create(); +const t = (text) => schema.text(text); + +function doc(...content) { + return schema.nodes.doc.create(null, content); +} + +function stateWithCaret(documentNode, caret) { + return EditorState.create({ + doc: documentNode, + selection: TextSelection.create(documentNode, caret), + }); +} + +function paragraphTexts(documentNode) { + const texts = []; + documentNode.forEach((node) => { + texts.push(node.textContent); + }); + return texts; +} + +test("caret between hard breaks isolates only its line", () => { + //

before␍target␍after

with the caret inside "target". + const state = stateWithCaret( + doc(para(t("before"), br(), t("target"), br(), t("after"))), + 10, + ); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), true); + + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["before", "target", "after"]); + assert.equal(next.selection.empty, true); + assert.equal(next.selection.$from.parent.textContent, "target"); +}); + +test("caret on an empty trailing line isolates an empty paragraph", () => { + // "before" + Shift+Enter, caret at the end — the reported bug shape. + const state = stateWithCaret(doc(para(t("before"), br())), 8); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), true); + + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["before", ""]); + assert.equal(next.selection.empty, true); + assert.equal(next.selection.$from.parent.textContent, ""); +}); + +test("caret on the first line splits only after that line", () => { + const state = stateWithCaret(doc(para(t("first"), br(), t("rest"))), 3); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), true); + + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["first", "rest"]); + assert.equal(next.selection.$from.parent.textContent, "first"); +}); + +test("caret on the last line splits only before that line", () => { + const state = stateWithCaret(doc(para(t("rest"), br(), t("last"))), 8); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), true); + + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["rest", "last"]); + assert.equal(next.selection.$from.parent.textContent, "last"); +}); + +test("caret in a single-line paragraph is a no-op", () => { + const state = stateWithCaret(doc(para(t("only line"))), 4); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), false); + assert.equal(transaction.steps.length, 0); +}); + +test("exact block-boundary selection excludes endpoint paragraphs", () => { + const documentNode = doc(para(t("alpha")), para(t("beta")), para(t("gamma"))); + for (const backward of [false, true]) { + const state = EditorState.create({ + doc: documentNode, + selection: TextSelection.create( + documentNode, + backward ? 14 : 6, + backward ? 6 : 14, + ), + }); + const transaction = state.tr; + isolateSelectionForBlockFormatting(transaction); + assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true); + const next = state.apply(transaction); + assert.deepEqual( + next.doc.toJSON(), + doc( + para(t("alpha")), + schema.nodes.codeBlock.create(null, t("beta")), + para(t("gamma")), + ).toJSON(), + ); + } +}); + +test("selection isolation still splits around the selected text", () => { + const documentNode = doc(para(t("before selected after"))); + const state = EditorState.create({ + doc: documentNode, + // "selected" spans positions 8..16. + selection: TextSelection.create(documentNode, 8, 16), + }); + + const transaction = state.tr; + assert.equal(isolateSelectionForBlockFormatting(transaction), true); + + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["before ", "selected", " after"]); + assert.equal( + next.doc.textBetween(next.selection.from, next.selection.to), + "selected", + ); +}); + +test("list splitting turns selected hard breaks into separate textblocks", () => { + const documentNode = doc(para(t("one"), br(), t("two"), br(), t("three"))); + const state = EditorState.create({ + doc: documentNode, + selection: TextSelection.create(documentNode, 1, 14), + }); + + const transaction = state.tr; + assert.equal(splitSelectedLinesForListFormatting(transaction), true); + const next = state.apply(transaction); + assert.deepEqual(paragraphTexts(next.doc), ["one", "two", "three"]); +}); + +test("code merge preserves hard breaks", () => { + const documentNode = doc(para(t("one"), br(), t("two")), para(t("three"))); + const state = EditorState.create({ + doc: documentNode, + selection: TextSelection.create( + documentNode, + 1, + documentNode.content.size - 1, + ), + }); + + const transaction = state.tr; + assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true); + const next = state.apply(transaction); + assert.equal(next.doc.firstChild.type.name, "codeBlock"); + assert.equal(next.doc.firstChild.textContent, "one\ntwo\nthree"); +}); + +test("code merge preserves meaningful inline atoms and drops unknown leaves", () => { + const documentNode = doc( + para( + t("hello "), + schema.nodes.mention.create({ label: "@Taylor Ho" }), + t(" "), + schema.nodes.customEmoji.create({ shortcode: "party" }), + schema.nodes.unknownLeaf.create(), + ), + ); + const state = EditorState.create({ + doc: documentNode, + selection: TextSelection.create( + documentNode, + 1, + documentNode.content.size - 1, + ), + }); + + const transaction = state.tr; + assert.equal(mergeSelectedTextblocksIntoCodeBlock(transaction), true); + const next = state.apply(transaction); + assert.equal(next.doc.firstChild.textContent, "hello @Taylor Ho :party:"); + assert.equal(next.doc.firstChild.textContent.includes("secret"), false); +}); diff --git a/desktop/src/features/messages/lib/selectionBlockFormatting.ts b/desktop/src/features/messages/lib/selectionBlockFormatting.ts index ef38ed7e0c..9d9792ad04 100644 --- a/desktop/src/features/messages/lib/selectionBlockFormatting.ts +++ b/desktop/src/features/messages/lib/selectionBlockFormatting.ts @@ -1,3 +1,4 @@ +import type { Node as ProseMirrorNode } from "@tiptap/pm/model"; import { TextSelection, type Transaction } from "@tiptap/pm/state"; import { canSplit } from "@tiptap/pm/transform"; @@ -29,13 +30,170 @@ function mapRangeThroughLatestStep( } /** - * Isolate a non-empty text selection at exact block boundaries. + * Isolate the hard-break-delimited line under a collapsed caret. + * + * The composer represents Shift+Enter lines as `hardBreak` nodes inside one + * paragraph, so a block toggle at a collapsed caret otherwise reformats every + * line of the draft. Replacing the line's bordering hard breaks with block + * splits gives the caret's line its own textblock, which scopes the following + * block toggle to just that line. + */ +function isolateCaretLineForBlockFormatting(transaction: Transaction): boolean { + const { $from } = transaction.selection; + if (!$from.parent.isTextblock || !$from.parent.inlineContent) return false; + + const blockStart = $from.start(); + const blockEnd = $from.end(); + let caret = transaction.selection.from; + + let lineFrom = blockStart; + let lineTo = blockEnd; + $from.parent.forEach((child, offset) => { + if (child.type.name !== "hardBreak") return; + const breakFrom = blockStart + offset; + const breakTo = breakFrom + child.nodeSize; + if (breakTo <= caret) lineFrom = breakTo; + if (breakFrom >= caret) lineTo = Math.min(lineTo, breakFrom); + }); + + // No hard breaks around the caret — the line already is the whole + // textblock, so the block toggle is correctly scoped as-is. + if (lineFrom === blockStart && lineTo === blockEnd) return false; + + const nodeAfterLine = transaction.doc.resolve(lineTo).nodeAfter; + if (nodeAfterLine?.type.name === "hardBreak") { + transaction.delete(lineTo, lineTo + nodeAfterLine.nodeSize); + if (canSplit(transaction.doc, lineTo)) { + transaction.split(lineTo); + const stepMap = transaction.steps.at(-1)?.getMap(); + if (stepMap) { + caret = stepMap.map(caret, -1); + lineFrom = stepMap.map(lineFrom, -1); + } + } + } + + const nodeBeforeLine = transaction.doc.resolve(lineFrom).nodeBefore; + if (nodeBeforeLine?.type.name === "hardBreak") { + transaction.delete(lineFrom - nodeBeforeLine.nodeSize, lineFrom); + let stepMap = transaction.steps.at(-1)?.getMap(); + if (stepMap) { + caret = stepMap.map(caret, 1); + lineFrom = stepMap.map(lineFrom, -1); + } + if (canSplit(transaction.doc, lineFrom)) { + transaction.split(lineFrom); + stepMap = transaction.steps.at(-1)?.getMap(); + if (stepMap) caret = stepMap.map(caret, 1); + } + } + + transaction.setSelection(TextSelection.create(transaction.doc, caret)); + return true; +} + +function listItemTextRange( + $position: Transaction["selection"]["$from"], +): { from: number; to: number } | null { + let itemDepth = -1; + for (let depth = $position.depth; depth > 0; depth -= 1) { + if ($position.node(depth).type.name === "listItem") { + itemDepth = depth; + break; + } + } + if (itemDepth < 0) return null; + + const item = $position.node(itemDepth); + const itemPosition = $position.before(itemDepth); + let from: number | null = null; + let to: number | null = null; + item.descendants((node, relativePosition) => { + if (!node.isTextblock) return true; + const position = itemPosition + 1 + relativePosition; + from ??= position + 1; + to = position + node.nodeSize - 1; + return false; + }); + return from === null || to === null ? null : { from, to }; +} + +/** Expand partial list endpoint selections to whole list-item textblocks. */ +function expandSelectionToListItems(transaction: Transaction): boolean { + const selection = transaction.selection; + if (!(selection instanceof TextSelection) || selection.empty) return false; + + const startItem = listItemTextRange(selection.$from); + const endItem = listItemTextRange(selection.$to); + if (!(startItem || endItem)) return false; + + const isBackward = selection.anchor > selection.head; + const from = startItem?.from ?? selection.from; + const to = endItem?.to ?? selection.to; + transaction.setSelection( + TextSelection.create( + transaction.doc, + isBackward ? to : from, + isBackward ? from : to, + ), + ); + return true; +} + +export function selectionIncludesList(transaction: Transaction): boolean { + const { from, to } = transaction.selection; + let includesList = false; + transaction.doc.nodesBetween(from, to, (node) => { + if (node.type.name === "listItem") { + includesList = true; + return false; + } + return !includesList; + }); + return includesList; +} + +function normalizeSelectionBlockBoundaries(transaction: Transaction): boolean { + const selection = transaction.selection; + if (!(selection instanceof TextSelection) || selection.empty) return false; + + const isBackward = selection.anchor > selection.head; + let { from, to } = selection; + if ( + selection.$from.parent.isTextblock && + selection.$from.parentOffset === selection.$from.parent.content.size && + selection.$from.depth > 0 + ) { + from = selection.$from.after(); + } + if ( + selection.$to.parent.isTextblock && + selection.$to.parentOffset === 0 && + selection.$to.depth > 0 + ) { + to = selection.$to.before(); + } + if (from >= to) return false; + + transaction.setSelection( + TextSelection.create( + transaction.doc, + isBackward ? to : from, + isBackward ? from : to, + ), + ); + return from !== selection.from || to !== selection.to; +} + +/** + * Isolate the current text selection at exact block boundaries. * * ProseMirror's block commands operate on whole textblocks. The composer can * hold an entire draft in one paragraph, so toggling a list or code block for * a substring otherwise formats the whole draft. Splitting at the selection * end and start first gives the selected text its own block while preserving - * the surrounding content as sibling paragraphs. + * the surrounding content as sibling paragraphs. A collapsed caret isolates + * its hard-break-delimited line so the block format starts at that line. * * This mutates the transaction supplied by a Tiptap command chain so the * isolation and the following block toggle remain one undoable edit. @@ -43,13 +201,16 @@ function mapRangeThroughLatestStep( export function isolateSelectionForBlockFormatting( transaction: Transaction, ): boolean { - if ( - !(transaction.selection instanceof TextSelection) || - transaction.selection.empty - ) { + if (!(transaction.selection instanceof TextSelection)) { return false; } + if (transaction.selection.empty) { + return isolateCaretLineForBlockFormatting(transaction); + } + + expandSelectionToListItems(transaction); + normalizeSelectionBlockBoundaries(transaction); const isBackward = transaction.selection.anchor > transaction.selection.head; let { from, to } = transaction.selection; @@ -84,3 +245,97 @@ export function isolateSelectionForBlockFormatting( ); return true; } + +/** Split each selected hard-break line into a textblock before list wrapping. */ +export function splitSelectedLinesForListFormatting( + transaction: Transaction, +): boolean { + if (!(transaction.selection instanceof TextSelection)) return false; + if (transaction.selection.empty) { + return isolateCaretLineForBlockFormatting(transaction); + } + + const isBackward = transaction.selection.anchor > transaction.selection.head; + isolateSelectionForBlockFormatting(transaction); + let { from, to } = transaction.selection; + const breakPositions: number[] = []; + + transaction.doc.nodesBetween(from, to, (node, position) => { + if (node.type.name === "hardBreak") breakPositions.push(position); + }); + + for (const position of breakPositions.reverse()) { + transaction.delete(position, position + 1); + ({ from, to } = mapRangeThroughLatestStep(transaction, from, to)); + if (!canSplit(transaction.doc, position)) continue; + transaction.split(position); + ({ from, to } = mapRangeThroughLatestStep(transaction, from, to)); + } + + transaction.setSelection( + TextSelection.create( + transaction.doc, + isBackward ? to : from, + isBackward ? from : to, + ), + ); + return true; +} + +function selectedTextblocks( + transaction: Transaction, +): Array<{ node: ProseMirrorNode; position: number }> { + const blocks: Array<{ node: ProseMirrorNode; position: number }> = []; + const { from, to } = transaction.selection; + transaction.doc.nodesBetween(from, to, (node, position) => { + if (node.isTextblock) { + blocks.push({ node, position }); + return false; + } + return true; + }); + return blocks; +} + +function leafTextForCode(leaf: ProseMirrorNode): string { + if (leaf.type.name === "hardBreak") return "\n"; + + const schemaText = leaf.type.spec.leafText?.(leaf); + if (schemaText !== undefined) return schemaText; + + // Inline atoms should survive conversion whenever they expose a meaningful + // textual identity. Unknown leaves intentionally fall back to an empty + // string rather than leaking implementation attributes into user content. + const attrs = leaf.attrs as Record; + if (typeof attrs.label === "string") return attrs.label; + if (typeof attrs.shortcode === "string") return `:${attrs.shortcode}:`; + return ""; +} + +function textblockTextForCode(node: ProseMirrorNode): string { + return node.textBetween(0, node.content.size, "\n", leafTextForCode); +} + +/** Replace selected textblocks with one newline-joined code block. */ +export function mergeSelectedTextblocksIntoCodeBlock( + transaction: Transaction, +): boolean { + if (!(transaction.selection instanceof TextSelection)) return false; + if (transaction.selection.empty) return false; + + const blocks = selectedTextblocks(transaction); + const codeBlock = transaction.doc.type.schema.nodes.codeBlock; + const first = blocks[0]; + const last = blocks.at(-1); + if (!(codeBlock && first && last)) return false; + + const text = blocks.map(({ node }) => textblockTextForCode(node)).join("\n"); + const from = first.position; + const to = last.position + last.node.nodeSize; + const content = text ? transaction.doc.type.schema.text(text) : undefined; + transaction.replaceWith(from, to, codeBlock.create(null, content)); + transaction.setSelection( + TextSelection.create(transaction.doc, from + 1, from + 1 + text.length), + ); + return true; +} diff --git a/desktop/src/features/messages/ui/FormattingToolbar.tsx b/desktop/src/features/messages/ui/FormattingToolbar.tsx index 9dcc45b63c..afe2cb22a5 100644 --- a/desktop/src/features/messages/ui/FormattingToolbar.tsx +++ b/desktop/src/features/messages/ui/FormattingToolbar.tsx @@ -16,7 +16,12 @@ import { import { cn } from "@/shared/lib/cn"; import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip"; -import { isolateSelectionForBlockFormatting } from "@/features/messages/lib/selectionBlockFormatting"; +import { + isolateSelectionForBlockFormatting, + mergeSelectedTextblocksIntoCodeBlock, + selectionIncludesList, + splitSelectedLinesForListFormatting, +} from "@/features/messages/lib/selectionBlockFormatting"; import { getEditorSpoilerRangeState } from "@/features/messages/lib/spoilerFormatting"; import { SPOILER_MARK_NAME } from "@/features/messages/lib/spoilerMark"; @@ -196,12 +201,26 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({ }, [formattingChain]); const toggleCodeBlock = React.useCallback(() => { - formattingChain() - ?.command(({ tr }) => { + const chain = formattingChain(); + if (!chain) return; + chain + .command(({ tr, chain: currentChain }) => { + if (tr.selection.empty) { + isolateSelectionForBlockFormatting(tr); + return currentChain().toggleCodeBlock().run(); + } + isolateSelectionForBlockFormatting(tr); - return true; + if (selectionIncludesList(tr)) { + return currentChain() + .liftListItem("listItem") + .command(({ tr: currentTransaction }) => + mergeSelectedTextblocksIntoCodeBlock(currentTransaction), + ) + .run(); + } + return mergeSelectedTextblocksIntoCodeBlock(tr); }) - .toggleCodeBlock() .run(); }, [formattingChain]); @@ -251,9 +270,13 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({ const toggleBulletList = React.useCallback(() => { formattingChain() ?.command(({ tr }) => { - isolateSelectionForBlockFormatting(tr); + splitSelectedLinesForListFormatting(tr); return true; }) + .command(({ tr, chain: currentChain }) => { + if (!selectionIncludesList(tr)) return true; + return currentChain().liftListItem("listItem").run(); + }) .toggleBulletList() .run(); }, [formattingChain]); @@ -261,15 +284,29 @@ export const FormattingToolbar = React.memo(function FormattingToolbar({ const toggleOrderedList = React.useCallback(() => { formattingChain() ?.command(({ tr }) => { - isolateSelectionForBlockFormatting(tr); + splitSelectedLinesForListFormatting(tr); return true; }) + .command(({ tr, chain: currentChain }) => { + if (!selectionIncludesList(tr)) return true; + return currentChain().liftListItem("listItem").run(); + }) .toggleOrderedList() .run(); }, [formattingChain]); const toggleBlockquote = React.useCallback(() => { - formattingChain()?.toggleBlockquote().run(); + formattingChain() + ?.command(({ tr }) => { + isolateSelectionForBlockFormatting(tr); + return true; + }) + .command(({ tr, chain: currentChain }) => { + if (!selectionIncludesList(tr)) return true; + return currentChain().liftListItem("listItem").run(); + }) + .toggleBlockquote() + .run(); }, [formattingChain]); const toggleSpoiler = React.useCallback(() => { diff --git a/desktop/tests/e2e/composer-selection-formatting.spec.ts b/desktop/tests/e2e/composer-selection-formatting.spec.ts index 0da13afe3e..b8ab46503d 100644 --- a/desktop/tests/e2e/composer-selection-formatting.spec.ts +++ b/desktop/tests/e2e/composer-selection-formatting.spec.ts @@ -38,6 +38,39 @@ async function selectText(input: Locator, selectedText: string) { }, selectedText); } +async function selectTextRange( + input: Locator, + firstText: string, + lastText: string, +) { + await input.evaluate( + (element, texts) => { + const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT); + let first: Text | null = null; + let last: Text | null = null; + while (walker.nextNode()) { + const node = walker.currentNode as Text; + if (!first && node.data.includes(texts.firstText)) first = node; + if (node.data.includes(texts.lastText)) last = node; + } + if (!(first && last)) + throw new Error("Could not find selection endpoints"); + const range = document.createRange(); + range.setStart(first, first.data.indexOf(texts.firstText)); + range.setEnd( + last, + last.data.indexOf(texts.lastText) + texts.lastText.length, + ); + const selection = window.getSelection(); + selection?.removeAllRanges(); + selection?.addRange(range); + (element as HTMLElement).focus(); + document.dispatchEvent(new Event("selectionchange")); + }, + { firstText, lastText }, + ); +} + async function dragSelectText( page: Page, input: Locator, @@ -93,7 +126,7 @@ async function dragSelectText( async function applySelectionFormat( page: Page, input: Locator, - label: "Bullet list" | "Code block" | "Ordered list", + label: "Bullet list" | "Code block" | "Ordered list" | "Quote", collapseAfterMouseDown = false, useMouseSelection = false, ) { @@ -136,10 +169,19 @@ test.beforeEach(async ({ page }) => { await installMockBridge(page); }); +async function applyCaretFormat( + page: Page, + label: "Bullet list" | "Code block" | "Ordered list" | "Quote", +) { + await page.getByRole("button", { name: "Toggle formatting" }).first().click(); + await page.getByRole("button", { name: label, exact: true }).click(); +} + for (const format of [ { label: "Code block", selector: "pre" }, { label: "Bullet list", selector: "ul" }, { label: "Ordered list", selector: "ol" }, + { label: "Quote", selector: "blockquote" }, ] as const) { test(`${format.label} applies only to the selected composer text`, async ({ page, @@ -157,8 +199,271 @@ for (const format of [ await expect(input.locator(":scope > p").last()).toHaveText(" after"); await expect(input).toHaveText("before selected after"); }); + + test(`${format.label} starts at a collapsed caret on a new line`, async ({ + page, + }) => { + await openGeneral(page); + + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await applyCaretFormat(page, format.label); + await input.pressSequentially("inside"); + + await expect(input.locator(":scope > p").first()).toHaveText("before"); + await expect(input.locator(`:scope > ${format.selector}`)).toHaveText( + "inside", + ); + }); + + test(`${format.label} at a collapsed caret formats only the caret's line`, async ({ + page, + }) => { + await openGeneral(page); + + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await input.pressSequentially("target"); + await input.press("Shift+Enter"); + await input.pressSequentially("after"); + // Collapse the caret into the middle line. + await selectText(input, "target"); + await input.press("ArrowRight"); + await applyCaretFormat(page, format.label); + + await expect(input.locator(":scope > p").first()).toHaveText("before"); + await expect(input.locator(`:scope > ${format.selector}`)).toHaveText( + "target", + ); + await expect(input.locator(":scope > p").last()).toHaveText("after"); + }); +} + +test("Code block uses the restored multiline selection after mouseup collapse", async ({ + page, +}) => { + await openGeneral(page); + + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await input.pressSequentially("selected"); + await input.press("Shift+Enter"); + await input.pressSequentially("after"); + await applySelectionFormat(page, input, "Code block", true); + + await expect(input.locator(":scope > p").first()).toHaveText("before"); + await expect(input.locator(":scope > pre")).toHaveText("selected"); + await expect(input.locator(":scope > p").last()).toHaveText("after"); +}); + +for (const list of [ + { label: "Bullet list", selector: "ul" }, + { label: "Ordered list", selector: "ol" }, +] as const) { + test(`selected hard-break lines become separate ${list.label.toLowerCase()} items`, async ({ + page, + }) => { + await openGeneral(page); + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("one"); + await input.press("Shift+Enter"); + await input.pressSequentially("two"); + await input.press("Shift+Enter"); + await input.pressSequentially("three"); + await selectTextRange(input, "one", "three"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: list.label }) + .click(); + + const items = input.locator(`:scope > ${list.selector} > li`); + await expect(items).toHaveCount(3); + await expect(items).toHaveText(["one", "two", "three"]); + }); } +test("partial list-item selections snap to whole items for block formats", async ({ + page, +}) => { + for (const format of [ + "Code block", + "Bullet list", + "Ordered list", + "Quote", + ] as const) { + await openGeneral(page); + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await input.pressSequentially("first"); + await input.press("Shift+Enter"); + await input.pressSequentially("second"); + await input.press("Shift+Enter"); + await input.pressSequentially("after"); + await selectTextRange(input, "before", "after"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: "Bullet list" }) + .click(); + + await selectTextRange(input, "irst", "seco"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: format }) + .click(); + + const structure = await input.locator(":scope > *").evaluateAll((nodes) => + nodes.map((node) => ({ + tag: node.tagName.toLowerCase(), + text: node.textContent, + items: Array.from( + node.querySelectorAll(":scope > li"), + (item) => item.textContent, + ), + })), + ); + const expected = { + "Code block": [ + { tag: "ul", text: "before", items: ["before"] }, + { tag: "pre", text: "first\nsecond", items: [] }, + { tag: "ul", text: "after", items: ["after"] }, + ], + "Bullet list": [ + { + tag: "ul", + text: "beforefirstsecondafter", + items: ["before", "first", "second", "after"], + }, + ], + "Ordered list": [ + { tag: "ul", text: "before", items: ["before"] }, + { tag: "ol", text: "firstsecond", items: ["first", "second"] }, + { tag: "ul", text: "after", items: ["after"] }, + ], + Quote: [ + { tag: "ul", text: "before", items: ["before"] }, + { tag: "blockquote", text: "firstsecond", items: [] }, + { tag: "ul", text: "after", items: ["after"] }, + ], + }[format]; + expect(structure).toEqual(expected); + await page.reload(); + } +}); + +test("selected hard-break lines stay newline-separated in one code block", async ({ + page, +}) => { + await openGeneral(page); + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("one"); + await input.press("Shift+Enter"); + await input.pressSequentially("two"); + await input.press("Shift+Enter"); + await input.pressSequentially("three"); + await selectTextRange(input, "one", "three"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: "Code block" }) + .click(); + + await expect(input.locator(":scope > pre")).toHaveCount(1); + await expect(input.locator(":scope > pre")).toHaveText("one\ntwo\nthree"); + + await page.getByTestId("send-message").click(); + await expect + .poll(() => + page.evaluate( + () => + ( + window as Window & { + __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>; + } + ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content, + ), + ) + .toBe("```\none\ntwo\nthree\n```"); +}); + +test("selected list items become one multiline code block and keep neighbors", async ({ + page, +}) => { + await openGeneral(page); + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await input.pressSequentially("one"); + await input.press("Shift+Enter"); + await input.pressSequentially("two"); + await input.press("Shift+Enter"); + await input.pressSequentially("after"); + await selectTextRange(input, "before", "after"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: "Bullet list" }) + .click(); + await selectTextRange(input, "one", "two"); + await page + .getByTestId("selection-formatting-tray") + .getByRole("button", { name: "Code block" }) + .click(); + + await expect(input.locator(":scope > pre")).toHaveCount(1); + await expect(input.locator(":scope > pre")).toHaveText("one\ntwo"); + await expect(input.locator(":scope > ul li")).toHaveText(["before", "after"]); + + await page.getByTestId("send-message").click(); + await expect + .poll(() => + page.evaluate( + () => + ( + window as Window & { + __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>; + } + ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content, + ), + ) + .toBe("- before\n\n```\none\ntwo\n```\n\n- after"); +}); + +test("caret-only block formatting serializes the prior draft unchanged", async ({ + page, +}) => { + await openGeneral(page); + + const input = page.getByTestId("message-input"); + await input.click(); + await input.pressSequentially("before"); + await input.press("Shift+Enter"); + await applyCaretFormat(page, "Bullet list"); + await input.pressSequentially("item"); + + await page.getByTestId("send-message").click(); + await expect + .poll(() => + page.evaluate( + () => + ( + window as Window & { + __BUZZ_E2E_SIGNED_EVENTS__?: Array<{ content: string }>; + } + ).__BUZZ_E2E_SIGNED_EVENTS__?.at(-1)?.content, + ), + ) + .toBe("before\n\n- item"); +}); + test("block formatting preserves the lines around a selected composer line", async ({ page, }) => { From 60158fce3e670f11bb35d42627857ccaea50ff06 Mon Sep 17 00:00:00 2001 From: kagan yaldizkaya Date: Tue, 28 Jul 2026 19:44:57 +0200 Subject: [PATCH 009/112] feat(cli): add users set-status command for NIP-38 profile status (#3253) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary The desktop client renders a persistent user status (NIP-38 kind:30315, `d:general`) as the status line on profiles, but the CLI had no way to set it — only ephemeral presence (`set-presence`, kind:20001). Integrations that want a scriptable, durable status line (for example a now-playing music bridge that shows the current TIDAL track on a profile) had no entry point. ## Screenshots 1 2 This adds: ```bash buzz users set-status --text "Working on the relay" --emoji "🔧" buzz users set-status --text "" --emoji "🎶" # intentional emoji-only status buzz users set-status --clear # removes the status ``` - Signs and submits the replaceable kind:30315 event via the HTTP bridge (no WS needed — unlike presence, user status is a stored event). - Uses the `d:general` coordinate the desktop client already reads for the profile status line, and the same `emoji` tag shape `SetStatusDialog` publishes. - Event construction lives in `buzz_sdk::build_user_status()`, keyed off `buzz_core::kind::KIND_USER_STATUS`, so the CLI command is a thin sign/submit wrapper. Text and emoji are trimmed; a blank emoji is omitted rather than emitted as an empty tag. - Clearing is the explicit `--clear` flag, mutually exclusive with `--text`/`--emoji`. It publishes an empty-content event carrying only `d:general`, which the desktop treats as no status. `--text ""` with an `--emoji` is an emoji-only status, not a clear. --------- Signed-off-by: Kagan Yaldizkaya Signed-off-by: Will Pfleger Co-authored-by: Will Pfleger --- crates/buzz-cli/README.md | 3 ++ crates/buzz-cli/TESTING.md | 17 ++++++- crates/buzz-cli/src/commands/users.rs | 26 +++++++++++ crates/buzz-cli/src/lib.rs | 47 ++++++++++++++++++- crates/buzz-sdk/src/builders.rs | 67 ++++++++++++++++++++++++++- 5 files changed, 155 insertions(+), 5 deletions(-) diff --git a/crates/buzz-cli/README.md b/crates/buzz-cli/README.md index a8c668cf06..40699459fc 100644 --- a/crates/buzz-cli/README.md +++ b/crates/buzz-cli/README.md @@ -57,6 +57,8 @@ buzz users get # your own profile buzz users get --pubkey # single user buzz users get --pubkey --pubkey # batch (max 200) buzz users set-presence --status online +buzz users set-status --text "heads down on the CLI" --emoji "🚀" +buzz users set-status --clear # remove your status # DMs buzz dms open --pubkey @@ -133,6 +135,7 @@ stored rules in `validation_error` so an owner can remove and repair them. | | `set-profile` | Update your profile | | | `presence` | Get presence status | | | `set-presence` | Set presence status | +| | `set-status` | Set or clear your NIP-38 profile status | | `workflows` | `list` | List workflows | | | `get` | Get workflow definition | | | `create` | Create a workflow | diff --git a/crates/buzz-cli/TESTING.md b/crates/buzz-cli/TESTING.md index 4b7257aba7..77234b7faa 100644 --- a/crates/buzz-cli/TESTING.md +++ b/crates/buzz-cli/TESTING.md @@ -87,7 +87,7 @@ export BUZZ_PRIVATE_KEY="nsec1..." # from the mint output | `channels:read` | ✅ | `channels list`, `channels get`, `channels members` | | `channels:write` | ✅ | `channels create`, `channels update`, `channels join`, `channels leave`, `channels topic`, `channels purpose` | | `users:read` | ✅ | `users get`, `users presence` | -| `users:write` | ✅ | `users set-profile`, `users set-presence` | +| `users:write` | ✅ | `users set-profile`, `users set-presence`, `users set-status` | | `files:read` | ✅ | — | | `files:write` | ✅ | — | | `admin:channels` | ❌ | `channels archive`, `channels unarchive`, `channels delete`, `channels add-member`, `channels remove-member` | @@ -331,6 +331,20 @@ buzz users set-presence --status online | jq . buzz users set-presence --status away | jq . buzz users set-presence --status offline | jq . # Note: set-presence may fail — kind:20001 is ephemeral and rejected by the HTTP bridge + +# users set-status — NIP-38 kind:30315 on the d:general coordinate +buzz users set-status --text "reviewing PRs" --emoji "🔍" | jq . +buzz users set-status --text "no emoji this time" | jq . + +# users set-status — emoji-only status (intentional: text is blank, emoji is kept) +buzz users set-status --text "" --emoji "🎶" | jq . + +# users set-status --clear — removes the status (empty content, d:general only) +buzz users set-status --clear | jq . + +# --clear is mutually exclusive with --text/--emoji +buzz users set-status --clear --text "nope" 2>&1; echo "exit: $?" +# Expected: exit 1 — clap conflict error ``` ### 6.8 Channel Members (add/remove require admin:channels) @@ -606,3 +620,4 @@ buzz channels delete --channel "$FORUM_ID" | jq . | 59 | `notes get` | ☐ | By name, by naddr, --content-only, cross-author, ambiguous → exit 1 | | 60 | `notes ls` | ☐ | Own, --author all, --tag, --limit | | 61 | `notes rm` | ☐ | Delete→get 404, double-delete idempotent, missing slug → NotFound | +| 62 | `users set-status` | ☐ | Text+emoji, text only, emoji-only (`--text ""`), `--clear`, `--clear` + `--text` → exit 1 | diff --git a/crates/buzz-cli/src/commands/users.rs b/crates/buzz-cli/src/commands/users.rs index 3f8325b4b9..f5a0bee879 100644 --- a/crates/buzz-cli/src/commands/users.rs +++ b/crates/buzz-cli/src/commands/users.rs @@ -304,6 +304,22 @@ pub async fn cmd_set_presence(client: &BuzzClient, status: &str) -> Result<(), C Ok(()) } +/// Set user status — sign and submit a NIP-38 kind:30315 user status event. +/// +/// Uses the `d:general` coordinate that the desktop client reads for the +/// profile status line. A blank `text` with no `emoji` clears the status. +pub async fn cmd_set_status( + client: &BuzzClient, + text: &str, + emoji: Option<&str>, +) -> Result<(), CliError> { + let builder = buzz_sdk::build_user_status(text, emoji).map_err(crate::validate::sdk_err)?; + let event = client.sign_event(builder)?; + let resp = client.submit_event(event).await?; + println!("{}", normalize_write_response(&resp)); + Ok(()) +} + pub async fn dispatch( cmd: crate::UsersCmd, client: &BuzzClient, @@ -331,6 +347,16 @@ pub async fn dispatch( } UsersCmd::Presence { pubkeys } => cmd_get_presence(client, &pubkeys).await, UsersCmd::SetPresence { status } => cmd_set_presence(client, &status.to_string()).await, + UsersCmd::SetStatus { text, emoji, clear } => { + // `--clear` is mutually exclusive with `--text`/`--emoji`: publish the + // empty `d:general` event that clients read as "no status". + let (text, emoji) = if clear { + ("", None) + } else { + (text.as_deref().unwrap_or_default(), emoji.as_deref()) + }; + cmd_set_status(client, text, emoji).await + } } } diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs index 6ab81a082d..0b46734584 100644 --- a/crates/buzz-cli/src/lib.rs +++ b/crates/buzz-cli/src/lib.rs @@ -838,6 +838,19 @@ pub enum UsersCmd { #[arg(long, value_enum)] status: PresenceStatus, }, + /// Set your user status (NIP-38 kind:30315 — the "status" line on your profile) + #[command(name = "set-status")] + SetStatus { + /// Status text (required unless --clear) + #[arg(long, required_unless_present = "clear")] + text: Option, + /// Optional emoji shown before the status text + #[arg(long)] + emoji: Option, + /// Remove your status entirely + #[arg(long, conflicts_with_all = ["text", "emoji"])] + clear: bool, + }, } #[derive(Subcommand)] @@ -1803,6 +1816,30 @@ mod tests { Cli::command().debug_assert(); } + #[test] + fn set_status_clear_rejects_text_and_emoji() { + for extra in [["--text", "busy"], ["--emoji", "🎶"]] { + let args = ["buzz", "users", "set-status", "--clear"] + .into_iter() + .chain(extra); + assert!( + Cli::try_parse_from(args).is_err(), + "--clear must conflict with {}", + extra[0] + ); + } + } + + #[test] + fn set_status_requires_text_or_clear() { + assert!(Cli::try_parse_from(["buzz", "users", "set-status"]).is_err()); + assert!( + Cli::try_parse_from(["buzz", "users", "set-status", "--emoji", "🎶"]).is_err(), + "--emoji alone must not imply a status" + ); + assert!(Cli::try_parse_from(["buzz", "users", "set-status", "--clear"]).is_ok()); + } + #[test] fn command_inventory_is_stable() { let expected_groups: Vec<&str> = vec![ @@ -1924,7 +1961,13 @@ mod tests { ); assert_eq!( names(&cmd, "users"), - vec!["get", "presence", "set-presence", "set-profile"] + vec![ + "get", + "presence", + "set-presence", + "set-profile", + "set-status" + ] ); assert_eq!( names(&cmd, "workflows"), @@ -2011,7 +2054,7 @@ mod tests { ("repos", 4), ("social", 7), ("upload", 1), - ("users", 4), + ("users", 5), ("workflows", 8), ]; diff --git a/crates/buzz-sdk/src/builders.rs b/crates/buzz-sdk/src/builders.rs index f9e54de9c5..8cc9c8650a 100644 --- a/crates/buzz-sdk/src/builders.rs +++ b/crates/buzz-sdk/src/builders.rs @@ -11,8 +11,8 @@ use buzz_core::{ KIND_GIT_STATUS_CLOSED, KIND_GIT_STATUS_DRAFT, KIND_GIT_STATUS_MERGED, KIND_GIT_STATUS_OPEN, KIND_IA_ARCHIVE_REQUEST, KIND_IA_UNARCHIVE_REQUEST, KIND_MODERATION_BAN, KIND_MODERATION_RESOLVE_REPORT, KIND_MODERATION_TIMEOUT, - KIND_MODERATION_UNBAN, KIND_MODERATION_UNTIMEOUT, KIND_PRESENCE_UPDATE, KIND_WORKFLOW_DEF, - KIND_WORKFLOW_TRIGGER, + KIND_MODERATION_UNBAN, KIND_MODERATION_UNTIMEOUT, KIND_PRESENCE_UPDATE, KIND_USER_STATUS, + KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER, }, observer::{ content_looks_like_nip44, OBSERVER_AGENT_TAG, OBSERVER_FRAME_CONTROL, OBSERVER_FRAME_TAG, @@ -1580,6 +1580,22 @@ pub fn build_presence_update(status: &str) -> Result { Ok(EventBuilder::new(Kind::Custom(KIND_PRESENCE_UPDATE as u16), status).tags(tags)) } +/// Build a NIP-38 user status event (kind 30315) on the `d:general` coordinate. +/// +/// `text` becomes the event content and `emoji`, when non-blank, an +/// `["emoji", ...]` tag; both are trimmed. Blank text with no emoji clears the +/// status — kind 30315 is parameterized-replaceable, so an event carrying +/// neither is what clients read as "no status". +pub fn build_user_status(text: &str, emoji: Option<&str>) -> Result { + let text = text.trim(); + check_content(text, 64 * 1024)?; + let mut tags = vec![tag(&["d", "general"])?]; + if let Some(emoji) = emoji.map(str::trim).filter(|e| !e.is_empty()) { + tags.push(tag(&["emoji", emoji])?); + } + Ok(EventBuilder::new(Kind::Custom(KIND_USER_STATUS as u16), text).tags(tags)) +} + // --------------------------------------------------------------------------- // Community moderation commands (kinds 9040–9044). // @@ -3391,6 +3407,53 @@ mod tests { assert!(matches!(err, SdkError::InvalidInput(_))); } + // ── build_user_status ───────────────────────────────────────────────────── + + #[test] + fn user_status_carries_text_and_emoji_on_d_general() { + let ev = sign(build_user_status("shipping the CLI", Some("🚀")).unwrap()); + assert_eq!(ev.kind.as_u16(), 30315); + assert_eq!(ev.content, "shipping the CLI"); + assert_eq!(tag_values(&ev, "d"), vec!["general"]); + assert_eq!(tag_values(&ev, "emoji"), vec!["🚀"]); + } + + #[test] + fn user_status_trims_text_and_emoji() { + let ev = sign(build_user_status(" heads down ", Some(" 🎧 ")).unwrap()); + assert_eq!(ev.content, "heads down"); + assert_eq!(tag_values(&ev, "emoji"), vec!["🎧"]); + } + + #[test] + fn user_status_omits_blank_emoji_tag() { + let ev = sign(build_user_status("on call", Some(" ")).unwrap()); + assert_eq!(ev.content, "on call"); + assert!(tag_values(&ev, "emoji").is_empty()); + } + + #[test] + fn user_status_keeps_emoji_when_text_is_blank() { + let ev = sign(build_user_status("", Some("🎶")).unwrap()); + assert_eq!(ev.content, ""); + assert_eq!(tag_values(&ev, "emoji"), vec!["🎶"]); + } + + #[test] + fn user_status_clear_shape_is_empty_content_and_d_tag_only() { + let ev = sign(build_user_status("", None).unwrap()); + assert_eq!(ev.kind.as_u16(), 30315); + assert_eq!(ev.content, ""); + assert_eq!(tag_values(&ev, "d"), vec!["general"]); + assert_eq!(ev.tags.len(), 1); + } + + #[test] + fn user_status_rejects_oversize_text() { + let err = build_user_status(&"x".repeat(64 * 1024 + 1), None).unwrap_err(); + assert!(matches!(err, SdkError::ContentTooLarge { .. })); + } + // ── build_git_pull_request / build_git_pr_update ────────────────────────── fn pr_repo() -> GitRepoCoord { From 4e3998f36e36d68b9a93dcbd85f0864450bb8f5f Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Tue, 28 Jul 2026 13:56:59 -0400 Subject: [PATCH 010/112] fix(desktop): gate codex-acp on a minimum supported version (#3254) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The codex adapter version gate accepted any `major >= 1`, so a 1.x `codex-acp` older than the version that fixes outbound relay access for `buzz` CLI subprocesses classified as `Available` and was never offered a reinstall. Only the 0.16.x `@zed-industries/codex-acp` adapter — which fails `--version` outright — was caught. `probe_codex_acp_version` now returns the full `(major, minor, patch)` triple and `codex_adapter_availability` compares it against a new `MIN_CODEX_ACP_VERSION` floor of `1.1.7`, the current npm latest. An adapter below the floor classifies as `AdapterOutdated`, which routes it through the existing uninstall-then-install reinstall plan. The parse requires exactly three numeric dot-separated components. Partial versions (`1.2`) and prerelease tags (`1.2.0-rc1`) return `None` and therefore classify as `AdapterOutdated` — a version Buzz cannot compare against the floor fails closed, offering a reinstall rather than running an adapter of unknown vintage. Both the floor's bump policy and the strict-parse behavior are stated in doc comments rather than left implicit. Supersedes [#3097](https://github.com/block/buzz/pull/3097) by @Bharathchinneni, whose semver floor and behavior tests this carries. That PR could not land as written: the two `probe_codex_acp_major_version` compatibility wrappers it kept had no non-test callers, which is a hard `clippy -D warnings` failure. The wrappers are deleted here and their call sites collapsed onto `probe_codex_acp_version`. Signed-off-by: Will Pfleger --- desktop/scripts/check-file-sizes.mjs | 15 ++- .../src-tauri/src/commands/agent_discovery.rs | 37 ++++++- .../src-tauri/src/managed_agents/discovery.rs | 69 ++++++++----- .../src/managed_agents/discovery/tests.rs | 99 ++++++++++++++----- .../discovery/tests/codex_version.rs | 10 +- 5 files changed, 168 insertions(+), 62 deletions(-) diff --git a/desktop/scripts/check-file-sizes.mjs b/desktop/scripts/check-file-sizes.mjs index 6e44481d57..5b781f63f6 100644 --- a/desktop/scripts/check-file-sizes.mjs +++ b/desktop/scripts/check-file-sizes.mjs @@ -346,7 +346,10 @@ const overrides = new Map([ // entries.push block collapsed into the helper. // +6: legacy Goose Windows install dir (%USERPROFILE%\goose) probed in // common_binary_paths so pre-#2680 standalone installs are discoverable. - ["src-tauri/src/managed_agents/discovery.rs", 1841], + // +19: codex-acp minimum-version gate — MIN_CODEX_ACP_VERSION plus the strict + // three-component parse in probe_codex_acp_version, so an outdated 1.x adapter + // is offered a reinstall instead of classifying as Available on major alone. + ["src-tauri/src/managed_agents/discovery.rs", 1860], // BYOH — save_custom_harness_to_dir (backup-swap atomic write) + save_and_warm / // delete_and_warm (persist-mutex serialization for concurrent-safe registry // refresh, B-6). Also: id/collision/load/registry tests (from the file base) + @@ -391,7 +394,11 @@ const overrides = new Map([ // Available both-present AND adapter-present/CLI-absent — the selectability // regression guard), bound to an injectable resolver so the tests stay // PATH-independent. - ["src-tauri/src/managed_agents/discovery/tests.rs", 1871], + // +51: codex-acp minimum-version gate — probe_codex_acp_version assertions carry + // the full (major, minor, patch) triple instead of a bare major, plus + // below-the-floor and uncomparable-version (partial / prerelease) classification + // regressions for the fail-closed parse. + ["src-tauri/src/managed_agents/discovery/tests.rs", 1922], // identity-import-keyring: the identity resolution state machine's behavioral // matrix (46 tests over FakeIdentityStore — probe × marker × file cells, // adoption / read-back-corruption / marker-failure arms, recovery-mode @@ -633,7 +640,9 @@ const overrides = new Map([ // with backoff, output truncation) extracted to agent_discovery/install_exec.rs // alongside its tests, matching the managed_node.rs / post_install_verification.rs // split. The entries above describe the file's history, not its current shape. - ["src-tauri/src/commands/agent_discovery.rs", 1808], + // +27: codex-acp minimum-version gate — test_plan_adapter_install_updates_older_ + // 1x_codex_binary pins that a 1.x adapter below the floor still plans a reinstall. + ["src-tauri/src/commands/agent_discovery.rs", 1835], // draft-persistence predicate: submit-time `loadDraft` check + inline comment // + deps-array entry in submitMessage closes the never-persisted-boundary // defect (Thufir Pass-3 finding). Load-bearing correctness fix; queued to diff --git a/desktop/src-tauri/src/commands/agent_discovery.rs b/desktop/src-tauri/src/commands/agent_discovery.rs index 76f8596caf..d6429e0454 100644 --- a/desktop/src-tauri/src/commands/agent_discovery.rs +++ b/desktop/src-tauri/src/commands/agent_discovery.rs @@ -25,7 +25,8 @@ fn active_installs() -> &'static std::sync::Mutex..` on stdout and exits 0. /// The old 0.16.x adapter (`@zed-industries/codex-acp`) is a Rust binary that does /// not recognise `--version` and exits non-zero. /// -/// Returns the major version on success, `None` on any failure (non-zero exit, -/// unparseable output, timeout, or missing binary). +/// Returns the `(major, minor, patch)` triple on success, `None` on any failure +/// (non-zero exit, unparseable output, timeout, or missing binary). +/// +/// The parse is deliberately strict: exactly three numeric dot-separated components. +/// Partial versions (`1.2`) and prerelease tags (`1.2.0-rc1`) return `None` and so +/// classify as [`AcpAvailabilityStatus::AdapterOutdated`] — failing closed offers a +/// reinstall rather than running an adapter whose version cannot be compared. /// /// The probe is bounded by a 5-second deadline. The child is polled with /// [`std::process::Child::try_wait`] (the repo's standard deadline pattern) and @@ -1180,16 +1195,16 @@ pub(crate) fn classify_runtime( /// Stdout is redirected to a temporary file rather than a pipe, so forked /// descendants cannot hold EOF open. Reads from a regular file return EOF at its /// current write position regardless of inherited file descriptors, cross-platform. -pub(crate) fn probe_codex_acp_major_version(binary_path: &Path) -> Option { - probe_codex_acp_major_version_with_path( +pub(crate) fn probe_codex_acp_version(binary_path: &Path) -> Option<(u64, u64, u64)> { + probe_codex_acp_version_with_path( binary_path, crate::managed_agents::readiness::cli_probe::augmented_path().as_deref(), ) } -pub(crate) fn probe_codex_acp_major_version_with_path( +pub(crate) fn probe_codex_acp_version_with_path( binary_path: &Path, augmented_path: Option<&str>, -) -> Option { +) -> Option<(u64, u64, u64)> { use std::io::{Read as _, Seek as _, SeekFrom}; use std::time::{Duration, Instant}; const VERSION_PROBE_TIMEOUT: Duration = Duration::from_secs(5); @@ -1245,30 +1260,35 @@ pub(crate) fn probe_codex_acp_major_version_with_path( let stdout = String::from_utf8_lossy(&buf); // Output format: " .." let version_str = stdout.split_whitespace().last()?; - let major_str = version_str.split('.').next()?; - major_str.parse::().ok() + let mut components = version_str.split('.'); + let major = components.next()?.parse::().ok()?; + let minor = components.next()?.parse::().ok()?; + let patch = components.next()?.parse::().ok()?; + if components.next().is_some() { + return None; + } + Some((major, minor, patch)) } /// Classifies a resolved codex-acp binary path as [`AcpAvailabilityStatus::Available`] /// or [`AcpAvailabilityStatus::AdapterOutdated`]. /// /// The 0.16.x adapter (`@zed-industries/codex-acp`) does not recognise `--version` -/// and exits non-zero — that probe failure yields `AdapterOutdated`. The 1.x adapter -/// (`@agentclientprotocol/codex-acp`) prints its version and exits 0; major ≥ 1 -/// yields `Available`. +/// and exits non-zero — that probe failure yields `AdapterOutdated`. An adapter is +/// available only when its version is at least [`MIN_CODEX_ACP_VERSION`]. /// /// Used by `discover_acp_runtimes`, `cli_login_requirements`, and /// `install_acp_runtime_blocking` so the version-gate logic is not duplicated. pub(crate) fn codex_adapter_availability(path: &Path) -> AcpAvailabilityStatus { - match probe_codex_acp_major_version(path) { - Some(major) if major >= 1 => AcpAvailabilityStatus::Available, + match probe_codex_acp_version(path) { + Some(version) if version >= MIN_CODEX_ACP_VERSION => AcpAvailabilityStatus::Available, _ => AcpAvailabilityStatus::AdapterOutdated, } } -/// Returns `true` when the codex-acp binary at `path` is outdated (major version < 1) -/// or cannot be probed using `augmented_path`. Thin wrapper around -/// [`codex_adapter_is_outdated_with_path`]. +/// Returns `true` when the codex-acp binary at `path` is below +/// [`MIN_CODEX_ACP_VERSION`] or cannot be probed using `augmented_path`. Thin wrapper +/// around [`codex_adapter_is_outdated_with_path`]. #[cfg(test)] pub(crate) fn codex_adapter_is_outdated(path: &Path) -> bool { codex_adapter_is_outdated_with_path( @@ -1277,15 +1297,15 @@ pub(crate) fn codex_adapter_is_outdated(path: &Path) -> bool { ) } -/// Returns `true` when the codex-acp binary at `path` is outdated (major version < 1) -/// or cannot be probed with the supplied PATH. +/// Returns `true` when the codex-acp binary at `path` is below +/// [`MIN_CODEX_ACP_VERSION`] or cannot be probed with the supplied PATH. pub(crate) fn codex_adapter_is_outdated_with_path( path: &Path, augmented_path: Option<&str>, ) -> bool { !matches!( - probe_codex_acp_major_version_with_path(path, augmented_path), - Some(major) if major >= 1 + probe_codex_acp_version_with_path(path, augmented_path), + Some(version) if version >= MIN_CODEX_ACP_VERSION ) } @@ -1308,9 +1328,8 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr let (mut availability, command, binary_path) = classify_runtime(adapter_result, runtime.underlying_cli, underlying_cli_found); - // For codex-acp: when the adapter resolves as Available, probe the - // version. An adapter with major version < 1 is treated as outdated — - // the CODEX_CONFIG spawn contract requires 1.x. + // For codex-acp: when the adapter resolves as Available, probe its full + // version. An adapter below MIN_CODEX_ACP_VERSION is treated as outdated. if runtime.id == "codex" && availability == AcpAvailabilityStatus::Available && command.as_deref() == Some("codex-acp") diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests.rs b/desktop/src-tauri/src/managed_agents/discovery/tests.rs index 48e8d5479c..8761346b1f 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/tests.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/tests.rs @@ -6,7 +6,7 @@ use super::{ codex_adapter_is_outdated, create_time_agent_command_override, default_agent_command, effective_agent_command, find_nvm_default_bin, find_via_login_shell, is_login_shell_path_uninit, is_safe_nvm_tag, managed_agent_avatar_url, normalize_agent_args, - parse_semver_tag, preset_catalog_entry, probe_codex_acp_major_version, record_agent_command, + parse_semver_tag, preset_catalog_entry, probe_codex_acp_version, record_agent_command, refresh_login_shell_path, try_record_agent_command, PresetHarness, BUZZ_AGENT_AVATAR_URL, CLAUDE_CODE_AVATAR_URL, CODEX_AVATAR_URL, GOOSE_AVATAR_URL, }; @@ -749,37 +749,41 @@ fn apply_agent_command_update_concrete_pin_keeps_materialized_runtime() { assert_eq!(record_agent_command(&record, &personas), "codex-acp"); } -// ── probe_codex_acp_major_version ───────────────────────────────────────────── +// ── probe_codex_acp_version ─────────────────────────────────────────────────── mod managed_path_resolution; #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_parses_1x_output() { +fn probe_codex_acp_version_parses_full_semver_output() { use std::os::unix::fs::PermissionsExt; - // Simulate `@agentclientprotocol/codex-acp 1.1.2` output (1.x adapter) + // Simulate a current `@agentclientprotocol/codex-acp` output. let dir = std::env::temp_dir().join(format!("buzz-probe-1x-{}", uuid::Uuid::new_v4())); std::fs::create_dir_all(&dir).expect("create temp dir"); let bin = dir.join("codex-acp"); std::fs::write( &bin, - "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nexit 0\n", + "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.7'\nexit 0\n", ) .expect("write script"); std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); - let major = probe_codex_acp_major_version(&bin); + let version = probe_codex_acp_version(&bin); let _ = std::fs::remove_dir_all(dir); - assert_eq!(major, Some(1), "1.x adapter must return major version 1"); + assert_eq!( + version, + Some((1, 1, 7)), + "adapter output must parse to its full semantic version" + ); } mod codex_version; #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_returns_none_for_nonzero_exit() { +fn probe_codex_acp_version_returns_none_for_nonzero_exit() { use std::os::unix::fs::PermissionsExt; // Simulate old 0.16.x adapter: `--version` is unrecognised, exits non-zero @@ -789,21 +793,21 @@ fn probe_codex_acp_major_version_returns_none_for_nonzero_exit() { std::fs::write(&bin, "#!/bin/sh\nexit 1\n").expect("write script"); std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); - let major = probe_codex_acp_major_version(&bin); + let version = probe_codex_acp_version(&bin); let _ = std::fs::remove_dir_all(dir); assert_eq!( - major, None, + version, None, "old 0.16.x adapter (non-zero exit) must return None" ); } #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_returns_none_for_missing_binary() { +fn probe_codex_acp_version_returns_none_for_missing_binary() { let path = std::path::Path::new("/nonexistent/path/codex-acp-does-not-exist"); - let major = probe_codex_acp_major_version(path); - assert_eq!(major, None, "missing binary must return None"); + let version = probe_codex_acp_version(path); + assert_eq!(version, None, "missing binary must return None"); } // ── codex_adapter_availability / codex_adapter_is_outdated ─────────────────── @@ -813,7 +817,7 @@ fn probe_codex_acp_major_version_returns_none_for_missing_binary() { #[cfg(unix)] #[test] -fn codex_adapter_availability_available_for_1x_binary() { +fn codex_adapter_availability_available_for_minimum_supported_binary() { use std::os::unix::fs::PermissionsExt; let dir = std::env::temp_dir().join(format!("buzz-avail-1x-{}", uuid::Uuid::new_v4())); @@ -821,7 +825,7 @@ fn codex_adapter_availability_available_for_1x_binary() { let bin = dir.join("codex-acp"); std::fs::write( &bin, - "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.2'\nexit 0\n", + "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.7'\nexit 0\n", ) .expect("write script"); std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); @@ -832,7 +836,7 @@ fn codex_adapter_availability_available_for_1x_binary() { assert_eq!( status, AcpAvailabilityStatus::Available, - "1.x adapter must classify as Available" + "minimum supported adapter must classify as Available" ); } @@ -858,6 +862,53 @@ fn codex_adapter_availability_outdated_for_0x_binary() { ); } +#[cfg(unix)] +#[test] +fn codex_adapter_availability_outdated_for_older_1x_binary() { + use std::os::unix::fs::PermissionsExt; + + let dir = tempfile::tempdir().expect("temp dir"); + let bin = dir.path().join("codex-acp"); + std::fs::write( + &bin, + "#!/bin/sh\necho '@agentclientprotocol/codex-acp 1.1.5'\nexit 0\n", + ) + .expect("write script"); + std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); + + assert_eq!( + codex_adapter_availability(&bin), + AcpAvailabilityStatus::AdapterOutdated, + "a 1.x adapter below the floor must be offered an upgrade" + ); +} + +/// The strict three-component parse fails closed: a version Buzz cannot compare +/// against the floor is treated as outdated rather than assumed current. +#[cfg(unix)] +#[test] +fn codex_adapter_availability_outdated_for_uncomparable_version() { + use std::os::unix::fs::PermissionsExt; + + for version in ["1.2", "1.2.0-rc1"] { + let dir = tempfile::tempdir().expect("temp dir"); + let bin = dir.path().join("codex-acp"); + std::fs::write( + &bin, + format!("#!/bin/sh\necho '@agentclientprotocol/codex-acp {version}'\nexit 0\n"), + ) + .expect("write script"); + std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)) + .expect("chmod script"); + + assert_eq!( + codex_adapter_availability(&bin), + AcpAvailabilityStatus::AdapterOutdated, + "version {version} is not comparable to the floor and must fail closed" + ); + } +} + #[cfg(unix)] #[test] fn codex_adapter_availability_outdated_for_missing_binary() { @@ -876,7 +927,7 @@ fn codex_adapter_availability_outdated_for_missing_binary() { #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() { +fn probe_codex_acp_version_returns_none_for_hung_direct_child() { use std::os::unix::fs::PermissionsExt; use std::time::Instant; @@ -894,12 +945,12 @@ fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() { std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); let start = Instant::now(); - let major = probe_codex_acp_major_version(&bin); + let version = probe_codex_acp_version(&bin); let elapsed = start.elapsed(); let _ = std::fs::remove_dir_all(dir); assert_eq!( - major, None, + version, None, "hung binary must return None (timeout kills child)" ); // The timeout is 5 s; give a 10 s margin for parallel pre-push suites. @@ -911,7 +962,7 @@ fn probe_codex_acp_major_version_returns_none_for_hung_direct_child() { #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open() { +fn probe_codex_acp_version_returns_version_when_descendant_holds_pipe_open() { use std::os::unix::fs::PermissionsExt; use std::time::Instant; @@ -936,7 +987,7 @@ fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod script"); let start = Instant::now(); - let major = probe_codex_acp_major_version(&bin); + let version = probe_codex_acp_version(&bin); let elapsed = start.elapsed(); let _ = std::fs::remove_dir_all(dir); @@ -947,9 +998,9 @@ fn probe_codex_acp_major_version_returns_version_when_descendant_holds_pipe_open "probe must not block on descendant pipe; elapsed: {elapsed:?}" ); assert_eq!( - major, - Some(1), - "1.x version must be parsed even when descendant holds pipe open" + version, + Some((1, 1, 2)), + "version must be parsed even when descendant holds pipe open" ); } diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs b/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs index 5886a43990..82bfd27f32 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/tests/codex_version.rs @@ -1,8 +1,8 @@ -use super::super::probe_codex_acp_major_version_with_path; +use super::super::probe_codex_acp_version_with_path; #[cfg(unix)] #[test] -fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter() { +fn probe_codex_acp_version_uses_augmented_path_for_env_shebang_interpreter() { use std::fs; use std::os::unix::fs::PermissionsExt; let temp = tempfile::tempdir().expect("temp dir"); @@ -31,7 +31,7 @@ fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter .to_string_lossy() .into_owned(); assert_eq!( - probe_codex_acp_major_version_with_path(&shim_path, Some(&scrubbed_path)), + probe_codex_acp_version_with_path(&shim_path, Some(&scrubbed_path)), None, "with a scrubbed PATH, /usr/bin/env should not find node" ); @@ -41,8 +41,8 @@ fn probe_codex_acp_major_version_uses_augmented_path_for_env_shebang_interpreter .to_string_lossy() .into_owned(); assert_eq!( - probe_codex_acp_major_version_with_path(&shim_path, Some(&augmented_path)), - Some(1), + probe_codex_acp_version_with_path(&shim_path, Some(&augmented_path)), + Some((1, 1, 2)), "the injected augmented PATH should allow /usr/bin/env to find node" ); } From 00ede2e7aa7eb95571b7db3ebbd163adbf6cf74e Mon Sep 17 00:00:00 2001 From: Clay Delk Date: Tue, 28 Jul 2026 14:01:18 -0400 Subject: [PATCH 011/112] fix(desktop): restore the inbox icon in the sidebar (#3341) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The Inbox surface was briefly renamed to **Activity** during #2045 and picked up a bell icon to match. The name was reverted to **Inbox** before merge, but the icon was not. A bell says "notification tray." Inbox is a destination — a focused, conversation-oriented place to catch up on work relevant to you, including drafts and reminders that have nothing to do with notifications. The glyph should say that. ## What changed - Swap the sidebar entry from Lucide `Bell` to Lucide `Inbox`. - Assert the icon in `inbox-refactor-screenshots.spec.ts`. Nothing pinned it before, which is exactly how it drifted through a rename. This also brings desktop back in line with mobile, which already uses `LucideIcons.inbox300` / `inbox500` for the same destination. ## Deliberately unchanged The bell on **reminder** rows in the list pane (`InboxListPane.tsx`, reminders → bell, drafts → file) stays. A bell is the right glyph for a reminder; that one was never about the surface's identity. ## Verification - The new assertion is a real guard, not a no-op: with `Bell` restored the test fails with `Expected: 1, Received: 0` on `svg.lucide-inbox`. Confirmed before committing. - `biome` and `tsc` clean. - Playwright smoke: `inbox-refactor-screenshots` 4 passed; `smoke`, `navigation`, `channels`, `sidebar-more-unread-overlap`, `home-collapsed-top-chrome`, `workspace-rail` — 107 passed, 1 skipped. - Screenshot below is the regenerated `02-current-controls` shot from the spec. Signed-off-by: Clay Delk Co-authored-by: Claude Opus 5 (1M context) --- .../features/sidebar/ui/AppSidebarPinnedHeader.tsx | 4 ++-- .../tests/e2e/inbox-refactor-screenshots.spec.ts | 14 ++++++++------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx b/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx index 95a0a47ef1..a673492ef1 100644 --- a/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx +++ b/desktop/src/features/sidebar/ui/AppSidebarPinnedHeader.tsx @@ -1,4 +1,4 @@ -import { Activity, Bell, Bot, FolderGit2, Zap } from "lucide-react"; +import { Activity, Bot, FolderGit2, Inbox, Zap } from "lucide-react"; import { TopbarSearch } from "@/features/search/ui/TopbarSearch"; import { FeatureGate } from "@/shared/features"; @@ -103,7 +103,7 @@ export function AppSidebarPrimaryMenu({ tooltip="Inbox" type="button" > - + Inbox {homeBadgeCount > 0 ? ( diff --git a/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts index b7d5b2af2e..15a804d71f 100644 --- a/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts +++ b/desktop/tests/e2e/inbox-refactor-screenshots.spec.ts @@ -174,7 +174,7 @@ test.describe("inbox refactor screenshots", () => { await page.screenshot({ path: `${SHOTS}/01-current-filters.png` }); }); - test("02 — Inbox label, bell icon, and overflow controls", async ({ + test("02 — Inbox label, inbox icon, and overflow controls", async ({ page, }) => { await installMockBridge(page, { mode: "mock" }); @@ -185,11 +185,13 @@ test.describe("inbox refactor screenshots", () => { }); // The sidebar must be in frame — the label is the point of this shot. - await expect( - page - .getByTestId("sidebar-primary-menu") - .getByRole("button", { name: "Inbox", exact: true }), - ).toBeVisible(); + const inboxButton = page + .getByTestId("sidebar-primary-menu") + .getByRole("button", { name: "Inbox", exact: true }); + await expect(inboxButton).toBeVisible(); + // Inbox is a destination, not a notification tray, so it carries the inbox + // glyph rather than a bell. Asserted because nothing else pins the icon. + await expect(inboxButton.locator("svg.lucide-inbox")).toHaveCount(1); await page.getByTestId("inbox-options-trigger").click(); await expect(page.getByText("Show unread only")).toBeVisible(); From a77212875aea299350d01d94b0f6d9c22a8fce5f Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Tue, 28 Jul 2026 19:12:54 +0100 Subject: [PATCH 012/112] Unify mobile loading spinners (#3314) ## What - add the shared desktop-style arc spinner for mobile - replace app loading indicators with the shared component - preserve a static pose when reduced motion is enabled ## Stack - follows #3313 ## Validation - `just mobile-check` - focused spinner and pairing widget tests --------- Signed-off-by: kenny lopez --- mobile/lib/app.dart | 7 +- .../lib/features/activity/activity_page.dart | 1 + .../activity/activity_page/lists.dart | 7 +- .../agent_activity/agent_activity_sheet.dart | 12 +- .../channels/channel_detail_page.dart | 1 + .../channel_detail_page/message_list.dart | 7 +- .../lib/features/channels/channels_page.dart | 1 + .../channels/channels_page/community.dart | 7 +- .../channels/channels_page/sheets.dart | 16 +- mobile/lib/features/channels/compose_bar.dart | 1 + .../channels/compose_bar/attachments.dart | 10 +- .../channels/compose_bar/camera_preview.dart | 5 +- .../compose_bar/ios_attachment_popover.dart | 31 ++- .../compose_bar/ios_photo_picker.dart | 14 +- .../compose_bar/photo_gallery_picker.dart | 27 +- .../channels/compose_bar/send_button.dart | 11 +- .../channels/manage_channel_sheet.dart | 8 +- .../features/channels/media_viewer_page.dart | 6 +- .../lib/features/channels/members_sheet.dart | 19 +- .../lib/features/forum/forum_posts_view.dart | 8 +- .../lib/features/forum/forum_thread_page.dart | 8 +- .../features/invites/invite_join_sheet.dart | 8 +- mobile/lib/features/pairing/pairing_page.dart | 12 +- .../pairing_page/pairing_welcome_view.dart | 16 +- .../lib/features/pulse/compose_note_page.dart | 10 +- mobile/lib/features/search/search_page.dart | 8 +- .../widgets/buzz_loading_indicator.dart | 98 +++++++ .../features/channels/compose_bar_test.dart | 259 ++++++++++++++++++ .../features/pairing/pairing_page_test.dart | 3 +- .../widgets/buzz_loading_indicator_test.dart | 50 ++++ 30 files changed, 582 insertions(+), 89 deletions(-) create mode 100644 mobile/lib/shared/widgets/buzz_loading_indicator.dart create mode 100644 mobile/test/shared/widgets/buzz_loading_indicator_test.dart diff --git a/mobile/lib/app.dart b/mobile/lib/app.dart index 3d6a562a92..5b266c93f9 100644 --- a/mobile/lib/app.dart +++ b/mobile/lib/app.dart @@ -16,6 +16,7 @@ import 'shared/auth/auth.dart'; import 'shared/deeplink/pending_deep_link_provider.dart'; import 'shared/relay/relay.dart'; import 'shared/theme/theme.dart'; +import 'shared/widgets/buzz_loading_indicator.dart'; class App extends HookConsumerWidget { const App({super.key}); @@ -113,6 +114,10 @@ class _SplashScreen extends StatelessWidget { @override Widget build(BuildContext context) { - return const Scaffold(body: Center(child: CircularProgressIndicator())); + return const Scaffold( + body: Center( + child: BuzzLoadingIndicator(size: 56, semanticLabel: 'Starting Buzz'), + ), + ); } } diff --git a/mobile/lib/features/activity/activity_page.dart b/mobile/lib/features/activity/activity_page.dart index 50d0544cfc..d5ea8d1c53 100644 --- a/mobile/lib/features/activity/activity_page.dart +++ b/mobile/lib/features/activity/activity_page.dart @@ -11,6 +11,7 @@ import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/utils/string_utils.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; import '../../shared/widgets/message_author_meta.dart'; diff --git a/mobile/lib/features/activity/activity_page/lists.dart b/mobile/lib/features/activity/activity_page/lists.dart index 509491b906..37311c9287 100644 --- a/mobile/lib/features/activity/activity_page/lists.dart +++ b/mobile/lib/features/activity/activity_page/lists.dart @@ -17,7 +17,12 @@ class _RemindersList extends ConsumerWidget { ]; if (remindersAsync.isLoading && reminders.isEmpty) { - return const Center(child: CircularProgressIndicator()); + return const Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading reminders', + ), + ); } if (reminders.isEmpty) { return const _EmptySurface( diff --git a/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart b/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart index c0c7640617..26a53f8903 100644 --- a/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart +++ b/mobile/lib/features/channels/agent_activity/agent_activity_sheet.dart @@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../../shared/theme/theme.dart'; +import '../../../shared/widgets/buzz_loading_indicator.dart'; import '../../profile/user_cache_provider.dart'; import '../date_formatters.dart'; import 'observer_models.dart'; @@ -189,13 +190,10 @@ class _EmptyState extends StatelessWidget { child: Column( mainAxisSize: MainAxisSize.min, children: [ - SizedBox( - width: 24, - height: 24, - child: CircularProgressIndicator( - strokeWidth: 2, - color: context.colors.onSurfaceVariant, - ), + BuzzLoadingIndicator( + size: 28, + color: context.colors.onSurfaceVariant, + semanticLabel: 'Waiting for agent activity', ), const SizedBox(height: Grid.xxs), Text( diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart index 3e5140f844..6bbb60c0d1 100644 --- a/mobile/lib/features/channels/channel_detail_page.dart +++ b/mobile/lib/features/channels/channel_detail_page.dart @@ -11,6 +11,7 @@ import 'package:scrollable_positioned_list/scrollable_positioned_list.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; import '../../shared/widgets/message_author_meta.dart'; diff --git a/mobile/lib/features/channels/channel_detail_page/message_list.dart b/mobile/lib/features/channels/channel_detail_page/message_list.dart index af1293dd00..6a77069bea 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_list.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_list.dart @@ -264,10 +264,9 @@ class _MessageList extends HookConsumerWidget { return const Padding( padding: EdgeInsets.symmetric(vertical: Grid.xs), child: Center( - child: SizedBox( - width: 20, - height: 20, - child: CircularProgressIndicator(strokeWidth: 2), + child: BuzzLoadingIndicator( + size: 24, + semanticLabel: 'Loading older messages', ), ), ); diff --git a/mobile/lib/features/channels/channels_page.dart b/mobile/lib/features/channels/channels_page.dart index b32778d366..8edd056e76 100644 --- a/mobile/lib/features/channels/channels_page.dart +++ b/mobile/lib/features/channels/channels_page.dart @@ -14,6 +14,7 @@ import '../../shared/community/community_icon_provider.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; import '../../shared/widgets/skeleton.dart'; diff --git a/mobile/lib/features/channels/channels_page/community.dart b/mobile/lib/features/channels/channels_page/community.dart index f1f0219fa9..73935f4631 100644 --- a/mobile/lib/features/channels/channels_page/community.dart +++ b/mobile/lib/features/channels/channels_page/community.dart @@ -66,7 +66,12 @@ class _CommunitySwitcherSheet extends HookConsumerWidget { child: communitiesAsync.when( loading: () => const SizedBox( height: 120, - child: Center(child: CircularProgressIndicator()), + child: Center( + child: BuzzLoadingIndicator( + size: 40, + semanticLabel: 'Loading communities', + ), + ), ), error: (e, _) => Padding( padding: const EdgeInsets.all(Grid.xs), diff --git a/mobile/lib/features/channels/channels_page/sheets.dart b/mobile/lib/features/channels/channels_page/sheets.dart index 51aead28c7..2738be0aa9 100644 --- a/mobile/lib/features/channels/channels_page/sheets.dart +++ b/mobile/lib/features/channels/channels_page/sheets.dart @@ -642,10 +642,11 @@ class _NewDirectMessageSheet extends HookConsumerWidget { ), child: SizedBox.square( dimension: 16, - child: - CircularProgressIndicator( - strokeWidth: 2, - ), + child: BuzzLoadingIndicator( + size: 16, + semanticLabel: + 'Creating conversation', + ), ), ) : null, @@ -686,7 +687,12 @@ class _NewDirectMessageSheet extends HookConsumerWidget { isSearchTransitionPending) { return const SizedBox( height: 280, - child: Center(child: CircularProgressIndicator()), + child: Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading people', + ), + ), ); } if (directoryAsync.hasError) { diff --git a/mobile/lib/features/channels/compose_bar.dart b/mobile/lib/features/channels/compose_bar.dart index 90a19d8d3d..a2421c9339 100644 --- a/mobile/lib/features/channels/compose_bar.dart +++ b/mobile/lib/features/channels/compose_bar.dart @@ -17,6 +17,7 @@ import 'package:nostr/nostr.dart' as nostr; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../profile/user_cache_provider.dart'; import '../profile/user_profile.dart'; import '../../shared/custom_emoji/custom_emoji.dart'; diff --git a/mobile/lib/features/channels/compose_bar/attachments.dart b/mobile/lib/features/channels/compose_bar/attachments.dart index cfb541fc85..9d9f278edc 100644 --- a/mobile/lib/features/channels/compose_bar/attachments.dart +++ b/mobile/lib/features/channels/compose_bar/attachments.dart @@ -430,12 +430,10 @@ class _AttachmentStrip extends StatelessWidget { child: Stack( alignment: Alignment.center, children: [ - SizedBox.square( - dimension: 34, - child: CircularProgressIndicator( - strokeWidth: 3, - color: context.colors.primary, - ), + BuzzLoadingIndicator( + size: 34, + color: context.colors.primary, + semanticLabel: label, ), if (uploadingCount > 1) PositionedDirectional( diff --git a/mobile/lib/features/channels/compose_bar/camera_preview.dart b/mobile/lib/features/channels/compose_bar/camera_preview.dart index b4a0d220a4..6179bcfb2f 100644 --- a/mobile/lib/features/channels/compose_bar/camera_preview.dart +++ b/mobile/lib/features/channels/compose_bar/camera_preview.dart @@ -198,9 +198,10 @@ class _CameraPlaceholder extends StatelessWidget { child: Padding( padding: const EdgeInsets.all(Grid.sm), child: isInitializing - ? const CircularProgressIndicator( + ? const BuzzLoadingIndicator( + size: 44, color: Colors.white, - strokeWidth: 3, + semanticLabel: 'Starting camera', ) : Column( mainAxisSize: MainAxisSize.min, diff --git a/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart index d56db5998c..0a0c4f1a99 100644 --- a/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart +++ b/mobile/lib/features/channels/compose_bar/ios_attachment_popover.dart @@ -25,10 +25,13 @@ class _IOSAttachmentPopoverCallbacks { } class _IOSAttachmentPopoverCoordinator { + static final Object _cancelledSupportCheck = Object(); + final MethodChannel _channel; Object? _activeOwner; _IOSAttachmentPopoverCallbacks? _callbacks; + Completer? _pendingSupportCancellation; bool _didPresent = false; bool _handlerInstalled = false; @@ -44,9 +47,15 @@ class _IOSAttachmentPopoverCoordinator { required VoidCallback onFiles, }) async { if (defaultTargetPlatform != TargetPlatform.iOS) return false; - if (_activeOwner != null) return true; + if (_activeOwner case final activeOwner?) { + if (identical(activeOwner, owner)) return true; + if (!_didPresent) _clearOwner(activeOwner); + return _didPresent; + } + final supportCancellation = Completer(); _activeOwner = owner; + _pendingSupportCancellation = supportCancellation; _callbacks = _IOSAttachmentPopoverCallbacks( onCapture: onCapture, onChoosePhotos: onChoosePhotos, @@ -57,9 +66,16 @@ class _IOSAttachmentPopoverCoordinator { _ensureHandler(); try { - final supported = - await _channel.invokeMethod('isSupported') ?? false; + final supportResult = await Future.any([ + _channel.invokeMethod('isSupported'), + supportCancellation.future.then((_) => _cancelledSupportCheck), + ]); + if (identical(supportResult, _cancelledSupportCheck)) return true; + if (identical(_pendingSupportCancellation, supportCancellation)) { + _pendingSupportCancellation = null; + } if (!identical(_activeOwner, owner)) return false; + final supported = supportResult == true; if (!supported || !sourceContext.mounted) { _clearOwner(owner); return false; @@ -102,6 +118,10 @@ class _IOSAttachmentPopoverCoordinator { try { await _channel.invokeMethod('dismiss'); } on PlatformException { + // The native bridge is unavailable, so there is nothing left to dismiss. + } on MissingPluginException { + // The native bridge is unavailable, so there is nothing left to dismiss. + } finally { _clearOwner(owner); } } @@ -146,6 +166,11 @@ class _IOSAttachmentPopoverCoordinator { void _clearOwner(Object owner) { if (!identical(_activeOwner, owner)) return; + final supportCancellation = _pendingSupportCancellation; + _pendingSupportCancellation = null; + if (supportCancellation != null && !supportCancellation.isCompleted) { + supportCancellation.complete(); + } _activeOwner = null; _callbacks = null; _didPresent = false; diff --git a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart index b8cc83cbe9..039b5160a3 100644 --- a/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart +++ b/mobile/lib/features/channels/compose_bar/ios_photo_picker.dart @@ -183,9 +183,10 @@ class _IOSInlinePhotoPicker extends HookWidget { child: isPreparingSelection.value ? const SizedBox.square( dimension: 20, - child: CircularProgressIndicator( - strokeWidth: 2, + child: BuzzLoadingIndicator( + size: 20, color: Colors.white, + semanticLabel: 'Preparing selected photos', ), ) : Text( @@ -201,9 +202,10 @@ class _IOSInlinePhotoPicker extends HookWidget { const ColoredBox( color: Color.fromRGBO(0, 0, 0, 0.28), child: Center( - child: CircularProgressIndicator( - strokeWidth: 3, + child: BuzzLoadingIndicator( + size: 44, color: Colors.white, + semanticLabel: 'Preparing selected photos', ), ), ), @@ -222,7 +224,9 @@ class _NativePhotoPickerLoading extends StatelessWidget { key: const ValueKey('ios-inline-photo-picker-loading'), height: _attachmentExpandedHeight, width: double.infinity, - child: const Center(child: CircularProgressIndicator(strokeWidth: 3)), + child: const Center( + child: BuzzLoadingIndicator(size: 44, semanticLabel: 'Opening Photos'), + ), ); } } diff --git a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart index 2b35cc53c6..8b19b74aa2 100644 --- a/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart +++ b/mobile/lib/features/channels/compose_bar/photo_gallery_picker.dart @@ -95,7 +95,12 @@ class _RecentPhotoGalleryPicker extends HookConsumerWidget { Widget buildGalleryBody() { if (recentSnapshot.connectionState != ConnectionState.done) { - return const Center(child: CircularProgressIndicator(strokeWidth: 3)); + return const Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading recent photos', + ), + ); } if (recentSnapshot.hasError) { return const _PhotoGalleryMessage( @@ -209,12 +214,10 @@ class _RecentPhotoGalleryPicker extends HookConsumerWidget { key: const ValueKey('photo-gallery-action'), onPressed: isResolving.value ? null : choosePhotos, icon: isResolving.value - ? SizedBox.square( - dimension: 22, - child: CircularProgressIndicator( - strokeWidth: 2, - color: context.colors.primary, - ), + ? BuzzLoadingIndicator( + size: 22, + color: context.colors.primary, + semanticLabel: 'Opening all photos', ) : const Icon(LucideIcons.images, size: 18), label: Text(actionLabel), @@ -223,12 +226,10 @@ class _RecentPhotoGalleryPicker extends HookConsumerWidget { key: const ValueKey('photo-gallery-action'), onPressed: isResolving.value ? null : choosePhotos, icon: isResolving.value - ? const SizedBox.square( - dimension: 22, - child: CircularProgressIndicator( - strokeWidth: 2, - color: Colors.white, - ), + ? const BuzzLoadingIndicator( + size: 22, + color: Colors.white, + semanticLabel: 'Preparing selected photos', ) : const Icon(LucideIcons.plus, size: 18), label: Text(actionLabel), diff --git a/mobile/lib/features/channels/compose_bar/send_button.dart b/mobile/lib/features/channels/compose_bar/send_button.dart index 45bd1df9c2..54060ae948 100644 --- a/mobile/lib/features/channels/compose_bar/send_button.dart +++ b/mobile/lib/features/channels/compose_bar/send_button.dart @@ -27,13 +27,10 @@ class _SendButton extends StatelessWidget { ), padding: EdgeInsets.zero, icon: isSending - ? SizedBox( - width: 16, - height: 16, - child: CircularProgressIndicator( - strokeWidth: 2, - color: context.colors.onPrimary, - ), + ? BuzzLoadingIndicator( + size: 18, + color: context.colors.onPrimary, + semanticLabel: 'Sending message', ) : Icon( LucideIcons.arrowUp, diff --git a/mobile/lib/features/channels/manage_channel_sheet.dart b/mobile/lib/features/channels/manage_channel_sheet.dart index d1f0c231ae..15ad07b0cd 100644 --- a/mobile/lib/features/channels/manage_channel_sheet.dart +++ b/mobile/lib/features/channels/manage_channel_sheet.dart @@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import 'channel.dart'; import 'channel_management_provider.dart'; import 'channel_mutes/channel_mutes_provider.dart'; @@ -272,7 +273,12 @@ class ManageChannelSheet extends HookConsumerWidget { ], ); }, - loading: () => const Center(child: CircularProgressIndicator()), + loading: () => const Center( + child: BuzzLoadingIndicator( + size: 40, + semanticLabel: 'Loading channel details', + ), + ), error: (error, _) => Text( error.toString(), style: context.textTheme.bodySmall?.copyWith( diff --git a/mobile/lib/features/channels/media_viewer_page.dart b/mobile/lib/features/channels/media_viewer_page.dart index 6ea579374f..f7e1af9211 100644 --- a/mobile/lib/features/channels/media_viewer_page.dart +++ b/mobile/lib/features/channels/media_viewer_page.dart @@ -10,6 +10,7 @@ import 'package:video_player/video_player.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import 'media_viewer_hero.dart'; export 'media_viewer_hero.dart'; @@ -790,9 +791,10 @@ class _VideoLoadingPoster extends StatelessWidget { _videoPlaceholder(context), const ColoredBox(color: Color.fromRGBO(0, 0, 0, 0.24)), const Center( - child: CircularProgressIndicator( - strokeWidth: 3, + child: BuzzLoadingIndicator( + size: 44, color: Colors.white, + semanticLabel: 'Loading video', ), ), ], diff --git a/mobile/lib/features/channels/members_sheet.dart b/mobile/lib/features/channels/members_sheet.dart index b17d9f4823..e1c79164ee 100644 --- a/mobile/lib/features/channels/members_sheet.dart +++ b/mobile/lib/features/channels/members_sheet.dart @@ -5,6 +5,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../profile/user_cache_provider.dart'; import '../profile/user_profile.dart'; import '../profile/user_status.dart'; @@ -150,7 +151,12 @@ class MembersSheet extends HookConsumerWidget { ), ], ), - loading: () => const Center(child: CircularProgressIndicator()), + loading: () => const Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading members', + ), + ), error: (error, _) => Center( child: Text( error.toString(), @@ -240,13 +246,10 @@ class _MemberTile extends ConsumerWidget { ? Row( mainAxisSize: MainAxisSize.min, children: [ - SizedBox( - width: 10, - height: 10, - child: CircularProgressIndicator( - strokeWidth: 1.5, - color: context.appColors.success, - ), + BuzzLoadingIndicator( + size: 14, + color: context.appColors.success, + semanticLabel: 'Agent working', ), const SizedBox(width: Grid.half), Text( diff --git a/mobile/lib/features/forum/forum_posts_view.dart b/mobile/lib/features/forum/forum_posts_view.dart index 4d7482bfdd..e3eed1f96c 100644 --- a/mobile/lib/features/forum/forum_posts_view.dart +++ b/mobile/lib/features/forum/forum_posts_view.dart @@ -6,6 +6,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../channels/channel.dart'; import '../channels/compose_bar.dart'; @@ -61,7 +62,12 @@ class ForumPostsView extends HookConsumerWidget { body: postsAsync.when( loading: () => Padding( padding: EdgeInsets.only(top: frostedAppBarHeight(context)), - child: const Center(child: CircularProgressIndicator()), + child: const Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading posts', + ), + ), ), error: (e, _) => Padding( padding: EdgeInsets.only(top: frostedAppBarHeight(context)), diff --git a/mobile/lib/features/forum/forum_thread_page.dart b/mobile/lib/features/forum/forum_thread_page.dart index f7da19be12..d2e8490d61 100644 --- a/mobile/lib/features/forum/forum_thread_page.dart +++ b/mobile/lib/features/forum/forum_thread_page.dart @@ -8,6 +8,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; import '../channels/compose_bar.dart'; @@ -77,7 +78,12 @@ class ForumThreadPage extends HookConsumerWidget { body: threadAsync.when( loading: () => Padding( padding: EdgeInsets.only(top: frostedAppBarHeight(context)), - child: const Center(child: CircularProgressIndicator()), + child: const Center( + child: BuzzLoadingIndicator( + size: 44, + semanticLabel: 'Loading thread', + ), + ), ), error: (e, _) => Padding( padding: EdgeInsets.only(top: frostedAppBarHeight(context)), diff --git a/mobile/lib/features/invites/invite_join_sheet.dart b/mobile/lib/features/invites/invite_join_sheet.dart index 58221158e5..a88d38ac16 100644 --- a/mobile/lib/features/invites/invite_join_sheet.dart +++ b/mobile/lib/features/invites/invite_join_sheet.dart @@ -3,6 +3,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../pairing/pairing_page.dart'; import 'invite_join_provider.dart'; @@ -113,10 +114,13 @@ class InviteJoinSheet extends ConsumerWidget { .read(inviteJoinProvider.notifier) .confirmJoin(), icon: isClaiming - ? const SizedBox( + ? SizedBox( width: 16, height: 16, - child: CircularProgressIndicator(strokeWidth: 2), + child: BuzzLoadingIndicator( + size: 16, + semanticLabel: 'Joining community', + ), ) : const Icon(LucideIcons.check), label: Text(isClaiming ? 'Joining…' : 'Join'), diff --git a/mobile/lib/features/pairing/pairing_page.dart b/mobile/lib/features/pairing/pairing_page.dart index 5d471d1f3b..85b781052d 100644 --- a/mobile/lib/features/pairing/pairing_page.dart +++ b/mobile/lib/features/pairing/pairing_page.dart @@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/tappable_flapping_bee.dart'; import 'pairing_provider.dart'; import 'pairing_qr_scanner.dart'; @@ -255,13 +256,10 @@ class _SasVerificationView extends StatelessWidget { Row( mainAxisAlignment: MainAxisAlignment.center, children: [ - SizedBox( - width: 20, - height: 20, - child: CircularProgressIndicator( - strokeWidth: 2, - color: context.colors.primary, - ), + BuzzLoadingIndicator( + size: 24, + color: context.colors.primary, + semanticLabel: 'Connecting', ), const SizedBox(width: Grid.twelve), Text( diff --git a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart index 58c089bf52..49fc185133 100644 --- a/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart +++ b/mobile/lib/features/pairing/pairing_page/pairing_welcome_view.dart @@ -87,9 +87,10 @@ class _PairingWelcomeView extends StatelessWidget { ? const SizedBox( width: 20, height: 20, - child: CircularProgressIndicator( - strokeWidth: 2, + child: BuzzLoadingIndicator( + size: 20, color: _onboardingCtaLabel, + semanticLabel: 'Opening scanner', ), ) : const Text('Scan a QR code'), @@ -173,12 +174,11 @@ class _PairingWelcomeView extends StatelessWidget { ? const SizedBox( width: 20, height: 20, - child: - CircularProgressIndicator( - strokeWidth: 2, - color: - _onboardingCtaLabel, - ), + child: BuzzLoadingIndicator( + size: 20, + color: _onboardingCtaLabel, + semanticLabel: 'Connecting', + ), ) : const Text('Connect'), ), diff --git a/mobile/lib/features/pulse/compose_note_page.dart b/mobile/lib/features/pulse/compose_note_page.dart index 240cd980d7..d3df98ee89 100644 --- a/mobile/lib/features/pulse/compose_note_page.dart +++ b/mobile/lib/features/pulse/compose_note_page.dart @@ -4,6 +4,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; import '../channels/message_content.dart'; @@ -76,10 +77,15 @@ class ComposeNotePage extends HookConsumerWidget { shape: const StadiumBorder(), ), child: isSending.value - ? const SizedBox( + ? SizedBox( width: 16, height: 16, - child: CircularProgressIndicator(strokeWidth: 2), + child: BuzzLoadingIndicator( + size: 16, + semanticLabel: _isReply + ? 'Sending reply' + : 'Publishing post', + ), ) : Text(_isReply ? 'Reply' : 'Post'), ), diff --git a/mobile/lib/features/search/search_page.dart b/mobile/lib/features/search/search_page.dart index 1809dc7437..7f4dc24b45 100644 --- a/mobile/lib/features/search/search_page.dart +++ b/mobile/lib/features/search/search_page.dart @@ -5,6 +5,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; +import '../../shared/widgets/buzz_loading_indicator.dart'; import '../../shared/widgets/filter_chip_bar.dart'; import '../../shared/widgets/frosted_app_bar.dart'; import '../../shared/widgets/frosted_scaffold.dart'; @@ -365,7 +366,12 @@ class _SearchBody extends ConsumerWidget { if (state.isLoading) const Padding( padding: EdgeInsets.all(Grid.sm), - child: Center(child: CircularProgressIndicator()), + child: Center( + child: BuzzLoadingIndicator( + size: 36, + semanticLabel: 'Loading more search results', + ), + ), ), ], ); diff --git a/mobile/lib/shared/widgets/buzz_loading_indicator.dart b/mobile/lib/shared/widgets/buzz_loading_indicator.dart new file mode 100644 index 0000000000..6d0471ce64 --- /dev/null +++ b/mobile/lib/shared/widgets/buzz_loading_indicator.dart @@ -0,0 +1,98 @@ +import 'dart:math' show pi; + +import 'package:flutter/material.dart'; +import 'package:flutter_hooks/flutter_hooks.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; + +import '../theme/theme.dart'; + +/// The shared mobile loading indicator, matching the desktop arc spinner. +class BuzzLoadingIndicator extends HookConsumerWidget { + /// The spinner diameter. + final double size; + + /// An optional spinner color. Defaults to the active accent color. + final Color? color; + + /// The accessibility announcement for this loading state. + final String semanticLabel; + + /// Creates a looping arc loading indicator. + const BuzzLoadingIndicator({ + this.size = 40, + this.color, + this.semanticLabel = 'Loading', + super.key, + }); + + @override + Widget build(BuildContext context, WidgetRef ref) { + final reducedMotion = MediaQuery.disableAnimationsOf(context); + final animation = useAnimationController( + duration: const Duration(milliseconds: 500), + ); + + useEffect(() { + if (reducedMotion) { + animation + ..stop() + ..value = 0; + } else { + animation.repeat(); + } + return animation.stop; + }, [animation, reducedMotion]); + + final spinnerColor = color ?? context.colors.primary; + final strokeWidth = (size / 6).clamp(2.0, 4.0); + + return Semantics( + liveRegion: true, + label: semanticLabel, + child: ExcludeSemantics( + child: RotationTransition( + key: const ValueKey('buzz-loading-indicator-spinner'), + turns: animation, + child: CustomPaint( + size: Size.square(size), + painter: _ArcSpinnerPainter( + color: spinnerColor, + strokeWidth: strokeWidth, + ), + ), + ), + ), + ); + } +} + +class _ArcSpinnerPainter extends CustomPainter { + final Color color; + final double strokeWidth; + + const _ArcSpinnerPainter({required this.color, required this.strokeWidth}); + + @override + void paint(Canvas canvas, Size size) { + final center = size.center(Offset.zero); + final radius = (size.shortestSide - strokeWidth) / 2; + final bounds = Rect.fromCircle(center: center, radius: radius); + final trackPaint = Paint() + ..color = color.withValues(alpha: color.a * 0.1) + ..style = PaintingStyle.stroke + ..strokeWidth = strokeWidth; + final arcPaint = Paint() + ..color = color + ..style = PaintingStyle.stroke + ..strokeWidth = strokeWidth; + + canvas + ..drawCircle(center, radius, trackPaint) + ..drawArc(bounds, -pi / 2, pi / 2, false, arcPaint); + } + + @override + bool shouldRepaint(_ArcSpinnerPainter oldDelegate) { + return color != oldDelegate.color || strokeWidth != oldDelegate.strokeWidth; + } +} diff --git a/mobile/test/features/channels/compose_bar_test.dart b/mobile/test/features/channels/compose_bar_test.dart index b851bf0a6e..bf236e8151 100644 --- a/mobile/test/features/channels/compose_bar_test.dart +++ b/mobile/test/features/channels/compose_bar_test.dart @@ -610,6 +610,265 @@ void main() { } }); + testWidgets( + 'a pending native popover does not claim another composer tap', + (tester) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + final supportResult = Completer(); + var supportCalls = 0; + var presentCalls = 0; + _setMockNativeAttachmentPopoverHandler((call) async { + switch (call.method) { + case 'isSupported': + supportCalls += 1; + return supportResult.future; + case 'present': + presentCalls += 1; + return true; + case 'dismiss': + return null; + } + return null; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => const [], + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: true, + ), + ); + + await tester.tap( + find.byTooltip('Add attachment').hitTestable().at(0), + ); + await tester.pump(); + await tester.tap( + find.byTooltip('Add attachment').hitTestable().at(1), + ); + await tester.pumpAndSettle(); + + expect(supportCalls, 1); + expect(presentCalls, 0); + expect( + find.descendant( + of: find.byKey(const ValueKey('first-composer')), + matching: find.byTooltip('Close attachments'), + ), + findsNothing, + ); + expect( + find.descendant( + of: find.byKey(const ValueKey('second-composer')), + matching: find.byTooltip('Close attachments'), + ), + findsWidgets, + ); + + supportResult.complete(true); + await tester.pumpAndSettle(); + expect(presentCalls, 0); + expect( + find.descendant( + of: find.byKey(const ValueKey('first-composer')), + matching: find.byTooltip('Close attachments'), + ), + findsNothing, + ); + } finally { + if (!supportResult.isCompleted) supportResult.complete(false); + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }, + ); + + testWidgets('a repeated owner tap keeps its pending native presentation', ( + tester, + ) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + final supportResult = Completer(); + var supportCalls = 0; + var presentCalls = 0; + _setMockNativeAttachmentPopoverHandler((call) async { + switch (call.method) { + case 'isSupported': + supportCalls += 1; + return supportResult.future; + case 'present': + presentCalls += 1; + return true; + case 'dismiss': + return null; + } + return null; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => const [], + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: false, + ), + ); + + await tester.tap(find.byTooltip('Add attachment').hitTestable()); + await tester.pump(); + await tester.tap(find.byTooltip('Add attachment').hitTestable()); + await tester.pumpAndSettle(); + + expect(supportCalls, 1); + expect(presentCalls, 0); + + supportResult.complete(true); + await tester.pumpAndSettle(); + + expect(presentCalls, 1); + expect(find.byTooltip('Close attachments'), findsNothing); + } finally { + if (!supportResult.isCompleted) supportResult.complete(false); + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }); + + testWidgets('disposing the native popover owner releases ownership', ( + tester, + ) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + var presentCalls = 0; + var dismissCalls = 0; + _setMockNativeAttachmentPopoverHandler((call) async { + switch (call.method) { + case 'isSupported': + return true; + case 'present': + presentCalls += 1; + return true; + case 'dismiss': + dismissCalls += 1; + return null; + } + return null; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => const [], + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: true, + ), + ); + + await tester.tap(find.byTooltip('Add attachment').hitTestable().at(0)); + await tester.pumpAndSettle(); + expect(presentCalls, 1); + + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: false, + ), + ); + await tester.pumpAndSettle(); + expect(dismissCalls, 1); + + await tester.tap(find.byTooltip('Add attachment').hitTestable()); + await tester.pumpAndSettle(); + expect(presentCalls, 2); + } finally { + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }); + + testWidgets('missing native dismiss bridge still releases ownership', ( + tester, + ) async { + final previousPlatform = debugDefaultTargetPlatformOverride; + debugDefaultTargetPlatformOverride = TargetPlatform.iOS; + var presentCalls = 0; + _setMockNativeAttachmentPopoverHandler((call) async { + switch (call.method) { + case 'isSupported': + return true; + case 'present': + presentCalls += 1; + return true; + case 'dismiss': + throw MissingPluginException('dismiss is unavailable'); + } + return null; + }); + final uploadService = MediaUploadService( + baseUrl: 'https://relay.example', + nsec: nostr.Keys.generate().nsec, + pickGalleryImage: () async => null, + pickGalleryImages: () async => const [], + pickGalleryVideo: () async => null, + ); + + try { + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: true, + ), + ); + + await tester.tap(find.byTooltip('Add attachment').hitTestable().at(0)); + await tester.pumpAndSettle(); + expect(presentCalls, 1); + + await tester.pumpWidget( + _buildNativePopoverOwnershipHarness( + uploadService: uploadService, + includeFirstComposer: false, + ), + ); + await tester.pumpAndSettle(); + + await tester.tap(find.byTooltip('Add attachment').hitTestable()); + await tester.pumpAndSettle(); + expect(presentCalls, 2); + } finally { + await _sendNativeAttachmentPopoverCall(tester, 'dismissed'); + await tester.pumpWidget(const SizedBox.shrink()); + _setMockNativeAttachmentPopoverHandler(null); + debugDefaultTargetPlatformOverride = previousPlatform; + } + }); + testWidgets('uploads an image and sends markdown plus imeta tags', ( tester, ) async { diff --git a/mobile/test/features/pairing/pairing_page_test.dart b/mobile/test/features/pairing/pairing_page_test.dart index adb61624d8..678be9dfe7 100644 --- a/mobile/test/features/pairing/pairing_page_test.dart +++ b/mobile/test/features/pairing/pairing_page_test.dart @@ -5,6 +5,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:buzz/features/pairing/pairing_page.dart'; import 'package:buzz/features/pairing/pairing_provider.dart'; import 'package:buzz/shared/theme/theme.dart'; +import 'package:buzz/shared/widgets/buzz_loading_indicator.dart'; import 'package:buzz/shared/widgets/tappable_flapping_bee.dart'; import '../../helpers/widget_helpers.dart'; @@ -154,7 +155,7 @@ void main() { ); await tester.pump(); - expect(find.byType(CircularProgressIndicator), findsOneWidget); + expect(find.byType(BuzzLoadingIndicator), findsOneWidget); // Connect text should be replaced by spinner. expect(find.text('Connect'), findsNothing); }); diff --git a/mobile/test/shared/widgets/buzz_loading_indicator_test.dart b/mobile/test/shared/widgets/buzz_loading_indicator_test.dart new file mode 100644 index 0000000000..936c3bc397 --- /dev/null +++ b/mobile/test/shared/widgets/buzz_loading_indicator_test.dart @@ -0,0 +1,50 @@ +import 'package:flutter/material.dart'; +import 'package:flutter_test/flutter_test.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; +import 'package:buzz/shared/theme/theme.dart'; +import 'package:buzz/shared/widgets/buzz_loading_indicator.dart'; + +Widget _testable({required bool disableAnimations}) { + return ProviderScope( + child: MaterialApp( + theme: AppTheme.light(), + home: MediaQuery( + data: const MediaQueryData().copyWith( + disableAnimations: disableAnimations, + ), + child: const Scaffold( + body: BuzzLoadingIndicator(semanticLabel: 'Loading photos'), + ), + ), + ), + ); +} + +void main() { + testWidgets('animates the shared arc spinner', (tester) async { + final semantics = tester.ensureSemantics(); + + await tester.pumpWidget(_testable(disableAnimations: false)); + await tester.pump(const Duration(milliseconds: 70)); + + final spinner = tester.widget( + find.byKey(const ValueKey('buzz-loading-indicator-spinner')), + ); + expect(spinner.turns.value, greaterThan(0)); + expect(find.bySemanticsLabel('Loading photos'), findsOneWidget); + semantics.dispose(); + }); + + testWidgets('holds a static pose when reduced motion is enabled', ( + tester, + ) async { + await tester.pumpWidget(_testable(disableAnimations: true)); + await tester.pump(const Duration(milliseconds: 70)); + + final spinner = tester.widget( + find.byKey(const ValueKey('buzz-loading-indicator-spinner')), + ); + expect(spinner.turns.value, 0); + expect(tester.binding.hasScheduledFrame, isFalse); + }); +} From 35305bfc8fd456ca9a17caa1ddbfaabd87d46981 Mon Sep 17 00:00:00 2001 From: Cameron Hotchkies Date: Tue, 28 Jul 2026 11:27:22 -0700 Subject: [PATCH 013/112] docs: restructure DCO guidance into scannable subsection (#3337) Extracts the dense inline DCO paragraph from the "Before You Open a PR" section into a dedicated `### Sign Your Commits` subsection. ## What changed - Adds a `### Sign Your Commits` heading directly below the Conventional Commits paragraph - Leads with the command (`git commit -s`) in a code block - Follows with a plain-English explainer of what the sign-off does - Adds linkable `#### Fix unsigned commits already pushed` and `#### Auto-setup for future commits` subheadings - Removes the old inline paragraph (content preserved, structure only changed) ## Why The existing guidance was buried mid-paragraph; contributors may not find it until CI blocks them. This makes the requirement and its fix immediately visible and actionable. ## Notes Docs-only change, no code modified. Signed-off-by: Cameron Hotchkies Co-authored-by: npub1ep9tf72jk6xgwamqj5m2j0xvqvwm9vdu3zxlz7cesxg53x52tkkqf6pa42 --- CONTRIBUTING.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1f319fa20f..53ea0f11c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -43,7 +43,28 @@ Buzz is an agent platform, so AI-assisted PRs are welcome. No need to disclose t We squash-merge, so your PR title becomes the commit subject in `main`. Use [Conventional Commits](https://www.conventionalcommits.org/) format: `feat(mcp): add get_feed_actions tool`. The type prefix (`feat`, `fix`, `docs`, `refactor`, `test`, `chore`) is required. See the [Commit Messages](#commit-messages) section for the full reference. -Every commit needs a Developer Certificate of Origin sign-off, so commit with `git commit -s` — it appends the `Signed-off-by` trailer that certifies you wrote the change and can contribute it. The required **DCO Check** blocks merge without it on every commit, and it's the most common reason new PRs stall. If you already pushed unsigned commits, run `git rebase --signoff main` and force-push. Running `just hooks` installs a `commit-msg` hook that adds the trailer to commits created by `git commit` and `git merge`; other flows need their own flag — `git rebase --signoff`, `git cherry-pick -s`. +### Sign Your Commits + +```bash +git commit -s +``` + +Every commit needs a Developer Certificate of Origin (DCO) sign-off. The `-s` flag appends a `Signed-off-by` trailer that certifies you wrote the change and can contribute it under the project license. The **DCO Check** will block your PR without it. + +#### Fix unsigned commits already pushed + +```bash +git rebase --signoff main +git push --force-with-lease +``` + +#### Auto-setup for future commits + +```bash +just hooks +``` + +This installs a `commit-msg` hook that adds the sign-off trailer automatically for `git commit` and `git merge`. Other flows (`git rebase`, `git cherry-pick`) still need their own flag — `--signoff` and `-s` respectively. We review as capacity allows — focused PRs that follow this guide move fastest. From 3afa129ee785cc74d921d0ba969254a8255c4cc0 Mon Sep 17 00:00:00 2001 From: thomaspblock Date: Tue, 28 Jul 2026 20:37:12 +0200 Subject: [PATCH 014/112] fix(desktop): keep drafts out of the Inbox All view (#3217) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Drafts were showing up in the Home Inbox **All** view, mixed in with messages and reminders (reported in `#buzz-bugs`). Drafts are private composer state, not inbox activity — they now appear only under the dedicated **Drafts** filter. ## Changes - **`inboxListRows.ts`** — drop the `draft` row variant from `buildInboxListRows`; the mixed view builds only `inbox` + `reminder` rows. - **`InboxListPane.tsx`** — remove the draft branch of the All-view render path; `PersonalItemRow` now renders reminders only. - **`useHomePersonalInbox.ts`** — stop enabling draft selection (and its root-status relay probing) for the mixed view; draft selection is scoped to the Drafts filter. - Drafts filter behavior is unchanged: the filter badge count, `DraftsPanel` list, and `DraftDetailPane` all still work. ## Testing - `pnpm test` (desktop unit suite): 3697 passed, 0 failed. - `pnpm exec biome check src/features/home tests`: clean. - Updated `inboxListRows.test.mjs` for the two-variant row model. - Updated the e2e test (`channels.spec.ts`) to assert All never lists drafts and that the draft is still reachable under the Drafts filter. - Added `drafts-all-fix-screenshots.spec.ts` capturing both states (screenshots below). ### All view — draft is gone, messages/reminders unaffected ![01-all-view-no-drafts](https://raw.githubusercontent.com/block/buzz/12c97624832cef40df951c403982994fea58dd80/pr-3217--01-all-view-no-drafts.png) ### Drafts filter — the draft is still listed and editable ![02-drafts-filter-still-lists](https://raw.githubusercontent.com/block/buzz/12c97624832cef40df951c403982994fea58dd80/pr-3217--02-drafts-filter-still-lists.png) Signed-off-by: Thomas Petersen --- desktop/playwright.config.ts | 1 + .../features/home/lib/inboxListRows.test.mjs | 20 +--- .../src/features/home/lib/inboxListRows.ts | 30 ----- .../src/features/home/ui/InboxListPane.tsx | 77 +++---------- .../src/features/home/useHomePersonalInbox.ts | 4 +- desktop/tests/e2e/channels.spec.ts | 11 +- .../e2e/drafts-all-fix-screenshots.spec.ts | 105 ++++++++++++++++++ 7 files changed, 138 insertions(+), 110 deletions(-) create mode 100644 desktop/tests/e2e/drafts-all-fix-screenshots.spec.ts diff --git a/desktop/playwright.config.ts b/desktop/playwright.config.ts index 40dd5dd1b1..0d89b8e2d2 100644 --- a/desktop/playwright.config.ts +++ b/desktop/playwright.config.ts @@ -103,6 +103,7 @@ export default defineConfig({ "**/project-pr-review.spec.ts", "**/persona-model-combobox-screenshots.spec.ts", "**/drafts-screenshots.spec.ts", + "**/drafts-all-fix-screenshots.spec.ts", "**/inbox-refactor-screenshots.spec.ts", "**/buzz-theme-screenshots.spec.ts", "**/channel-sort.spec.ts", diff --git a/desktop/src/features/home/lib/inboxListRows.test.mjs b/desktop/src/features/home/lib/inboxListRows.test.mjs index c4bbcdfff0..b0a093de1b 100644 --- a/desktop/src/features/home/lib/inboxListRows.test.mjs +++ b/desktop/src/features/home/lib/inboxListRows.test.mjs @@ -17,16 +17,6 @@ function inboxItem( }; } -function draftItem(key, updatedAt, rootStatus = "available") { - return { - entry: { - key, - draft: { createdAt: updatedAt, updatedAt }, - }, - rootStatus, - }; -} - function reminder( id, createdAt, @@ -46,20 +36,18 @@ function reminder( test("Inbox All combines rows in latest-first order", () => { const rows = buildInboxListRows({ - drafts: [draftItem("draft", "2026-07-21T12:00:00.000Z")], items: [inboxItem("message", 1_753_099_300)], reminders: [reminder("reminder", 1_753_099_100)], }); assert.deepEqual( rows.map((row) => row.kind), - ["draft", "inbox", "reminder"], + ["inbox", "reminder"], ); }); -test("Inbox All excludes completed reminders and deleted-root drafts", () => { +test("Inbox All excludes completed reminders", () => { const rows = buildInboxListRows({ - drafts: [draftItem("deleted", "2026-07-21T12:00:00.000Z", "deleted")], items: [], reminders: [reminder("done", 1_753_099_100, "done")], }); @@ -69,12 +57,10 @@ test("Inbox All excludes completed reminders and deleted-root drafts", () => { test("Inbox conversation keys stay stable when the representative changes", () => { const first = buildInboxListRows({ - drafts: [], items: [inboxItem("reply-1", 1, "thread-root")], reminders: [], }); const second = buildInboxListRows({ - drafts: [], items: [inboxItem("reply-2", 2, "thread-root")], reminders: [], }); @@ -87,7 +73,6 @@ test("due reminder enriches its existing conversation instead of duplicating it" const item = inboxItem("message", 100); item.groupItems = [{ id: "reminded-reply" }]; const rows = buildInboxListRows({ - drafts: [], items: [item], reminders: [ reminder("reminder", 50, "pending", { @@ -105,7 +90,6 @@ test("due reminder enriches its existing conversation instead of duplicating it" test("due reminder without a represented conversation sorts at trigger time", () => { const rows = buildInboxListRows({ - drafts: [], items: [inboxItem("newer-than-creation", 150)], reminders: [ reminder("reminder", 50, "pending", { diff --git a/desktop/src/features/home/lib/inboxListRows.ts b/desktop/src/features/home/lib/inboxListRows.ts index 499ff96eab..70311a0d13 100644 --- a/desktop/src/features/home/lib/inboxListRows.ts +++ b/desktop/src/features/home/lib/inboxListRows.ts @@ -1,5 +1,4 @@ import type { InboxItem } from "@/features/home/lib/inbox"; -import type { DraftViewItem } from "@/features/messages/ui/DraftsPanel"; import type { Reminder } from "@/features/reminders/lib/reminderTypes"; export type InboxListRow = @@ -15,31 +14,12 @@ export type InboxListRow = kind: "reminder"; reminder: Reminder; sortAt: number; - } - | { - key: string; - kind: "draft"; - item: DraftViewItem; - sortAt: number; }; -function draftActivityAt(item: DraftViewItem): number { - for (const value of [ - item.entry.draft.updatedAt, - item.entry.draft.createdAt, - ]) { - const timestamp = Date.parse(value); - if (Number.isFinite(timestamp)) return timestamp / 1_000; - } - return 0; -} - export function buildInboxListRows({ - drafts, items, reminders, }: { - drafts: readonly DraftViewItem[]; items: readonly InboxItem[]; reminders: readonly Reminder[]; }): InboxListRow[] { @@ -98,15 +78,5 @@ export function buildInboxListRows({ sortAt: reminder.notBefore ?? reminder.createdAt, }), ), - ...drafts - .filter((item) => item.rootStatus !== "deleted") - .map( - (item): InboxListRow => ({ - key: `draft:${item.entry.key}`, - kind: "draft", - item, - sortAt: draftActivityAt(item), - }), - ), ].sort((left, right) => right.sortAt - left.sortAt); } diff --git a/desktop/src/features/home/ui/InboxListPane.tsx b/desktop/src/features/home/ui/InboxListPane.tsx index 20db0b5150..fa214dc730 100644 --- a/desktop/src/features/home/ui/InboxListPane.tsx +++ b/desktop/src/features/home/ui/InboxListPane.tsx @@ -1,11 +1,4 @@ -import { - Bell, - Clock, - Ellipsis, - ExternalLink, - FileText, - MailOpen, -} from "lucide-react"; +import { Bell, Clock, Ellipsis, ExternalLink, MailOpen } from "lucide-react"; import * as React from "react"; import { @@ -18,7 +11,6 @@ import { buildInboxListRows } from "@/features/home/lib/inboxListRows"; import { InboxFilterMenu } from "@/features/home/ui/InboxFilterMenu"; import { DraftsPanel, - getDraftPreview, type DraftViewItem, } from "@/features/messages/ui/DraftsPanel"; import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover"; @@ -130,7 +122,6 @@ function formatReminderStatus(notBefore: number | undefined) { function PersonalItemRow({ id, - kind, location, onClick, preview, @@ -138,16 +129,12 @@ function PersonalItemRow({ status, }: { id: string; - kind: "drafts" | "reminders"; location: InboxTypeLabel | null; onClick: () => void; preview: string; selected: boolean; status: string; }) { - const isDraft = kind === "drafts"; - const Icon = isDraft ? FileText : Bell; - return ( - - + handleOpenChange(false)} + publishesCatalogUpdates={ + publishCatalogUpdatesOnSave && hasUserChanges + } + submitBlockReason={null} + submitLabel={submitLabel} + /> } >
setHasUserChanges(true)} onSubmit={handleSubmitForm} > setAvatarUrl("")} + onClearAvatar={() => { + setHasUserChanges(true); + setAvatarUrl(""); + }} onUploadPendingChange={setIsAvatarUploadPending} - onSelectAvatar={setAvatarUrl} + onSelectAvatar={(nextAvatarUrl) => { + setHasUserChanges(true); + setAvatarUrl(nextAvatarUrl); + }} />
@@ -1008,7 +994,10 @@ export function AgentDefinitionDialog({ model={model} modelTuningRuntimeId={runtime} namePoolText={namePoolText} - onBehaviorDraftChange={setBehaviorDraft} + onBehaviorDraftChange={(nextBehaviorDraft) => { + setHasUserChanges(true); + setBehaviorDraft(nextBehaviorDraft); + }} onEnvVarsChange={setEnvVars} onNamePoolTextChange={setNamePoolText} provider={effectiveProvider} diff --git a/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx b/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx new file mode 100644 index 0000000000..92428ad95c --- /dev/null +++ b/desktop/src/features/agents/ui/AgentDefinitionDialogFooter.tsx @@ -0,0 +1,70 @@ +import { Button } from "@/shared/ui/button"; + +type AgentDefinitionDialogFooterProps = { + canSubmit: boolean; + isAvatarUploadPending: boolean; + isPending: boolean; + onCancel: () => void; + publishesCatalogUpdates: boolean; + submitBlockReason: string | null; + submitLabel: string; +}; + +export function AgentDefinitionDialogFooter({ + canSubmit, + isAvatarUploadPending, + isPending, + onCancel, + publishesCatalogUpdates, + submitBlockReason, + submitLabel, +}: AgentDefinitionDialogFooterProps) { + return ( +
+
+ {submitBlockReason ? ( +

+ {submitBlockReason} +

+ ) : null} + {publishesCatalogUpdates ? ( +

+ This agent is in the community catalog. Your changes will be + published when you save. +

+ ) : null} +
+ +
+ + +
+
+ ); +} diff --git a/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx b/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx new file mode 100644 index 0000000000..50109143cd --- /dev/null +++ b/desktop/src/features/agents/ui/AgentDefinitionMetadata.tsx @@ -0,0 +1,55 @@ +import { cn } from "@/shared/lib/cn"; + +export function AgentDefinitionMetadata({ + className, + isBuiltIn, + model, + runtime, +}: { + className?: string; + isBuiltIn: boolean; + model: string | null; + runtime: string | null; +}) { + const items = [ + { + label: "Type", + value: isBuiltIn ? "Built-in agent" : "Custom agent", + }, + { + label: "Preferred model", + value: model ?? "Use app default", + }, + { + label: "Preferred runtime", + value: runtime ?? "Use app default", + }, + ]; + + return ( +
+
+ {items.map((item, index) => ( +
0 && + "border-t border-border/60 sm:border-t-0 sm:before:absolute sm:before:bottom-3 sm:before:left-0 sm:before:top-3 sm:before:w-px sm:before:bg-border/70", + )} + key={item.label} + > +

+ {item.label} +

+

+ {item.value} +

+
+ ))} +
+
+ ); +} diff --git a/desktop/src/features/agents/ui/AgentDialog.tsx b/desktop/src/features/agents/ui/AgentDialog.tsx index 02a6d0e64a..f5be3cc7e8 100644 --- a/desktop/src/features/agents/ui/AgentDialog.tsx +++ b/desktop/src/features/agents/ui/AgentDialog.tsx @@ -11,7 +11,10 @@ import type { AgentCreateIntent } from "./agentCreateIntent"; import type { EditAgentFocusTarget } from "@/features/agents/openEditAgentEvent"; import { AgentInstanceEditDialog } from "./AgentInstanceEditDialog"; import { createPersonaDialogState } from "./personaDialogState"; -import { AgentDefinitionDialog } from "./AgentDefinitionDialog"; +import { + AgentDefinitionDialog, + type AgentDefinitionSubmitOptions, +} from "./AgentDefinitionDialog"; import { WhereToRunSection } from "./WhereToRunSection"; import { canSubmitWhereToRun, @@ -64,7 +67,9 @@ type AgentDialogDefinitionEditProps = { onOpenChange: (open: boolean) => void; onSubmit: ( input: CreatePersonaInput | UpdatePersonaInput, + options: AgentDefinitionSubmitOptions, ) => Promise; + publishCatalogUpdatesOnSave?: boolean; }; type AgentDialogProps = diff --git a/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx b/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx index ad1219310d..4a9584dfb9 100644 --- a/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx +++ b/desktop/src/features/agents/ui/AgentSnapshotImportDialog.tsx @@ -15,6 +15,8 @@ import { } from "@/shared/ui/dialog"; import { Separator } from "@/shared/ui/separator"; +import { AgentDefinitionMetadata } from "./AgentDefinitionMetadata"; + // ── Types ───────────────────────────────────────────────────────────────────── type ImportPhase = "preview" | "confirming" | "result"; @@ -164,6 +166,12 @@ function PreviewBody({ ) : null}
+ +

A new agent will be created with a fresh keypair. The imported agent is independent of the source — identity never travels. diff --git a/desktop/src/features/agents/ui/AgentsView.tsx b/desktop/src/features/agents/ui/AgentsView.tsx index 8e1c47c615..6e55f92dfe 100644 --- a/desktop/src/features/agents/ui/AgentsView.tsx +++ b/desktop/src/features/agents/ui/AgentsView.tsx @@ -1,5 +1,5 @@ import * as React from "react"; -import { OctagonX } from "lucide-react"; +import { OctagonX, Settings2 } from "lucide-react"; import { consumePendingSnapshotImport, subscribeSnapshotImport, @@ -20,7 +20,10 @@ import { SecretRevealDialog } from "./SecretRevealDialog"; import { TeamDeleteDialog } from "./TeamDeleteDialog"; import { TeamDialog } from "./TeamDialog"; import { TeamsSection } from "./TeamsSection"; -import { UnifiedAgentsSection } from "./UnifiedAgentsSection"; +import { + AGENT_CARD_GRID_COLUMNS_CLASS, + UnifiedAgentsSection, +} from "./UnifiedAgentsSection"; import { useManagedAgentActions } from "./useManagedAgentActions"; import { usePersonaActions } from "./usePersonaActions"; import { useTeamActions } from "./useTeamActions"; @@ -70,11 +73,14 @@ export function AgentsView() { const runningAgentCount = agents.managedAgents.filter((agent) => isManagedAgentActive(agent), ).length; - // Show the resolved effective model, not just the structured `model` field: - // most providers persist the model as a provider env var (e.g. DATABRICKS_MODEL) - // or inherit a baked build default, leaving `globalConfig.model` null. - const configuredGlobalModel = inheritedDefaults.model.value; - + const hasSavedAgentDefaults = Boolean( + globalConfig.preferred_runtime?.trim() || + globalConfig.provider?.trim() || + globalConfig.model?.trim() || + Object.values(globalConfig.env_vars).some( + (value) => value.trim().length > 0, + ), + ); // biome-ignore lint/correctness/useExhaustiveDependencies: mount-only; personas.handleImportSnapshotFile and teamActions.handleImportTeamSnapshotFile are stable React.useEffect(() => { // Consume a snapshot import that was enqueued before navigation (e.g. from @@ -106,18 +112,23 @@ export function AgentsView() { return ( <>

-
+
{runningAgentCount > 0 ? ( @@ -135,11 +146,10 @@ export function AgentsView() { ) : null}
} - className="mx-auto w-full max-w-[996px]" description="Set up and manage your agents." title="Agents" /> -
+
0} personas={personas.libraryPersonas} personasError={ personas.personasQuery.error instanceof Error @@ -186,10 +195,8 @@ export function AgentsView() { } isPersonasLoading={personas.personasQuery.isLoading} isPersonasPending={personas.isPending} - onCreatePersona={() => { - openUnifiedCreate(); - }} - onChooseCatalog={personas.openCatalog} + onCreatePersona={openUnifiedCreate} + onDiscoverPersonas={personas.openCatalog} onDuplicatePersona={personas.openDuplicate} onEditPersona={personas.openEdit} onSharePersona={personas.openShare} @@ -289,9 +296,11 @@ export function AgentsView() { error={ personas.updatePersonaMutation.error instanceof Error ? personas.updatePersonaMutation.error - : personas.createPersonaMutation.error instanceof Error - ? personas.createPersonaMutation.error - : null + : personas.updatePersonaAndPublishMutation.error instanceof Error + ? personas.updatePersonaAndPublishMutation.error + : personas.createPersonaMutation.error instanceof Error + ? personas.createPersonaMutation.error + : null } initialValues={personas.personaDialogState.initialValues} isPending={personas.isPending} @@ -303,8 +312,22 @@ export function AgentsView() { personas.setPersonaDialogState(null); } }} - onSubmit={personas.handleSubmit} + onSubmit={(input, options) => + personas.handleSubmit( + input, + undefined, + undefined, + undefined, + options, + ) + } open={personas.personaDialogState !== null} + publishCatalogUpdatesOnSave={ + "id" in personas.personaDialogState.initialValues && + personas.sharedCatalogPersonaIdSet.has( + personas.personaDialogState.initialValues.id, + ) + } submitLabel={personas.personaDialogState.submitLabel} title={personas.personaDialogState.title} /> @@ -330,8 +353,19 @@ export function AgentsView() { ) : null} {personas.personaToShare ? ( { + const shareTarget = personas.personaToShare; + if (!shareTarget) return; + void personas.setPersonaCatalogShareLevel( + shareTarget.persona, + shareLevel, + ); + }} onExport={() => { const shareTarget = personas.personaToShare; if (!shareTarget) return; @@ -390,8 +424,8 @@ export function AgentsView() { {personas.isCatalogDialogOpen ? ( { personas.clearFeedback("catalog"); }} diff --git a/desktop/src/features/agents/ui/CreateIdentityCard.tsx b/desktop/src/features/agents/ui/CreateIdentityCard.tsx index 70d063098b..4fdd6db26f 100644 --- a/desktop/src/features/agents/ui/CreateIdentityCard.tsx +++ b/desktop/src/features/agents/ui/CreateIdentityCard.tsx @@ -6,7 +6,7 @@ import { cn } from "@/shared/lib/cn"; type CreateIdentityCardProps = React.ButtonHTMLAttributes & { ariaLabel: string; dataTestId: string; - label: string; + label?: string; }; export const CreateIdentityCard = React.forwardRef< @@ -30,7 +30,9 @@ export const CreateIdentityCard = React.forwardRef< > - {label} + {label ? ( + {label} + ) : null} ); diff --git a/desktop/src/features/agents/ui/PersonaAddedBy.tsx b/desktop/src/features/agents/ui/PersonaAddedBy.tsx index 66e5ee31f9..3cdec29104 100644 --- a/desktop/src/features/agents/ui/PersonaAddedBy.tsx +++ b/desktop/src/features/agents/ui/PersonaAddedBy.tsx @@ -2,13 +2,17 @@ import { cn } from "@/shared/lib/cn"; type PersonaAddedByProps = { className?: string; + label?: string; }; -export function PersonaAddedBy({ className }: PersonaAddedByProps) { +export function PersonaAddedBy({ + className, + label = "You", +}: PersonaAddedByProps) { return (

Added by{" "} - You + {label}

); } diff --git a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx index 0d6b5583ff..ba76d6e4ed 100644 --- a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx +++ b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx @@ -1,6 +1,7 @@ import * as React from "react"; import { isCatalogPersonaSelected } from "@/features/agents/lib/catalog"; +import { isCatalogPersona } from "@/features/agents/lib/personaCatalogRelay"; import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar"; import type { AgentPersona } from "@/shared/api/types"; import { useFeedbackToasts } from "@/shared/hooks/useToastEffect"; @@ -11,6 +12,8 @@ import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content"; import { Markdown } from "@/shared/ui/markdown"; import { Skeleton } from "@/shared/ui/skeleton"; +import agentOutlineUrl from "../assets/agent-outline.svg"; +import { AgentDefinitionMetadata } from "./AgentDefinitionMetadata"; import { PersonaAddedBy } from "./PersonaAddedBy"; import { personaCatalogCopy } from "./personaLibraryCopy"; @@ -28,7 +31,7 @@ type PersonaCatalogDialogProps = { }; const agentInstructionMarkdownClassName = [ - "mt-3 leading-6 text-muted-foreground [&_blockquote]:!text-muted-foreground [&_code]:!text-muted-foreground [&_li]:text-muted-foreground [&_ol]:text-muted-foreground [&_p]:text-muted-foreground [&_strong]:text-muted-foreground [&_td]:text-muted-foreground [&_ul]:text-muted-foreground", + "mt-3 w-full min-w-0 max-w-full overflow-x-hidden leading-6 text-muted-foreground [&>*]:min-w-0 [&>*]:max-w-full [&_.code-block-lines]:min-w-0 [&_.code-block-lines]:max-w-full [&_.code-block-lines]:whitespace-pre-wrap [&_.code-block-lines]:[overflow-wrap:anywhere] [&_.inline-code-chip]:max-w-full [&_.inline-code-chip]:whitespace-pre-wrap [&_.inline-code-chip]:[overflow-wrap:anywhere] [&_blockquote]:!text-muted-foreground [&_code]:!text-muted-foreground [&_li]:text-muted-foreground [&_ol]:text-muted-foreground [&_p]:text-muted-foreground [&_strong]:text-muted-foreground [&_td]:text-muted-foreground [&_ul]:text-muted-foreground", "[&>h1]:!text-sm [&>h1]:!font-semibold [&>h1]:!leading-6 [&>h1]:!tracking-normal [&>h1]:!text-foreground", "[&>h2]:!text-sm [&>h2]:!font-semibold [&>h2]:!leading-6 [&>h2]:!tracking-normal [&>h2]:!text-foreground", "[&>h3]:!text-sm [&>h3]:!font-semibold [&>h3]:!leading-6 [&>h3]:!tracking-normal [&>h3]:!text-foreground", @@ -100,7 +103,7 @@ export function PersonaCatalogDialog({ +
+ +

+ {personaCatalogCopy.emptyCatalogTitle} +

+

+ {personaCatalogCopy.emptyCatalogDescription} +

+
+
+ ); + } + return (
@@ -200,9 +228,9 @@ function PersonaCatalogChooser({
-
+
{isLoading ? : null} @@ -211,19 +239,6 @@ function PersonaCatalogChooser({ ) : null} - {!isLoading && personas.length === 0 && !error ? ( -
-
-

- {personaCatalogCopy.emptyCatalogTitle} -

-

- {personaCatalogCopy.emptyCatalogDescription} -

-
-
- ) : null} - {error ? (

{error.message} @@ -263,7 +278,7 @@ function PersonaCatalogChooser({ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) { return ( -

+
{persona.displayName} - {persona.isBuiltIn ? null : } + {persona.isBuiltIn ? null : ( + + )}
- -
+

Agent instruction

@@ -309,36 +322,6 @@ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) { ); } -function PersonaCatalogMetaGroup({ - items, -}: { - items: { label: string; value: string }[]; -}) { - return ( -
-
- {items.map((item, index) => ( -
0 && - "border-t border-border/60 sm:border-t-0 sm:before:absolute sm:before:bottom-3 sm:before:left-0 sm:before:top-3 sm:before:w-px sm:before:bg-border/70", - )} - key={item.label} - > -

- {item.label} -

-

- {item.value} -

-
- ))} -
-
- ); -} - function PersonaCatalogListSkeleton() { return (
diff --git a/desktop/src/features/agents/ui/PersonaShareDialog.tsx b/desktop/src/features/agents/ui/PersonaShareDialog.tsx index b6d3fafd3c..af45e8f071 100644 --- a/desktop/src/features/agents/ui/PersonaShareDialog.tsx +++ b/desktop/src/features/agents/ui/PersonaShareDialog.tsx @@ -1,6 +1,7 @@ import * as React from "react"; import { AlertCircle, + BookUser, Check, ChevronRight, Download, @@ -11,6 +12,7 @@ import { AnimatePresence, motion, useReducedMotion } from "motion/react"; import { toast } from "sonner"; import { useEncodeAgentSnapshotForSendMutation } from "@/features/agents/hooks"; +import type { CatalogPersonaShareLevel } from "@/features/agents/lib/personaCatalogRelay"; import { useOpenDmMutation, useUpsertCachedChannel, @@ -20,7 +22,6 @@ import { uploadMediaBytes, type BlobDescriptor } from "@/shared/api/tauri"; import { copyTextToSystemClipboard } from "@/shared/api/tauriMedia"; import type { SnapshotMemoryLevel } from "@/shared/api/tauriPersonas"; import type { AgentPersona, UserSearchResult } from "@/shared/api/types"; -import { cn } from "@/shared/lib/cn"; import { AlertDialog, AlertDialogAction, @@ -39,7 +40,6 @@ import { DialogHeader, DialogTitle, } from "@/shared/ui/dialog"; -import { Separator } from "@/shared/ui/separator"; import { Spinner } from "@/shared/ui/spinner"; import { @@ -51,8 +51,10 @@ import { resolveSnapshotAvatarPng } from "./snapshotAvatarPng"; import { useSnapshotSendController } from "./useSnapshotSendController"; type PersonaShareDialogProps = { + catalogShareLevel: CatalogPersonaShareLevel; isPending: boolean; linkedAgentPubkey: string | null; + onCatalogShareLevelChange: (shareLevel: CatalogPersonaShareLevel) => void; onExport: () => void; onOpenChange: (open: boolean) => void; open: boolean; @@ -60,6 +62,7 @@ type PersonaShareDialogProps = { }; type SnapshotShareDialogProps = { + afterLink?: React.ReactNode; displayName: string; encodeSnapshot: ( memoryLevel: SnapshotMemoryLevel, @@ -109,6 +112,20 @@ type PendingMemoryShare = { recipientNames?: string[]; }; +function buildSnapshotShareLevels(itemLabel: "Agent" | "Team") { + return [ + { value: "none" as const, label: `${itemLabel} only` }, + { + value: "core" as const, + label: `${itemLabel} + core memory`, + }, + { + value: "everything" as const, + label: `${itemLabel} + all memories`, + }, + ]; +} + function formatRecipientAudience(names: readonly string[]): string { if (names.length === 0) return "The people you selected"; if (names.length === 1) return names[0] ?? "The person you selected"; @@ -179,39 +196,32 @@ function MemoryShareConfirmation({ function ShareLevelControl({ ariaLabel, - className, disabled, hasMemoryOptions, - onOpenChange, - staticClassName, - staticLabel, testId, value, options, onChange, }: { ariaLabel: string; - className?: string; disabled: boolean; hasMemoryOptions: boolean; - onOpenChange?: (open: boolean) => void; - staticClassName?: string; - staticLabel: string; testId: string; value: SnapshotMemoryLevel; options: { value: SnapshotMemoryLevel; label: string }[]; onChange: (level: SnapshotMemoryLevel) => void; }) { if (!hasMemoryOptions) { + // Nothing to choose from, so there is no dropdown to open. State the + // outcome rather than naming the sole option: the memory-level labels + // ("Agent only", "+ core memory", …) are comparative and only make sense + // when the alternatives are actually offered. return ( - {staticLabel} + No memories included ); } @@ -219,9 +229,7 @@ function ShareLevelControl({ return ( onChange(nextValue as SnapshotMemoryLevel)} options={options} testId={testId} @@ -231,6 +239,7 @@ function ShareLevelControl({ } export function SnapshotShareDialog({ + afterLink, displayName, encodeSnapshot, hasMemoryOptions, @@ -252,9 +261,7 @@ export function SnapshotShareDialog({ const [copyStatus, setCopyStatus] = React.useState("idle"); const [pendingMemoryShare, setPendingMemoryShare] = React.useState(null); - const [linkShareLevel, setLinkShareLevel] = - React.useState("none"); - const [recipientShareLevel, setRecipientShareLevel] = + const [shareLevel, setShareLevel] = React.useState("none"); const encodedSnapshotCacheRef = React.useRef( new Map>(), @@ -273,9 +280,7 @@ export function SnapshotShareDialog({ const isActionPending = isPending || isCopying || isSending; const isInterfacePending = isPending || isSending; const hasSelectedRecipients = selectedRecipients.length > 0; - const showMemoryWarning = - linkShareLevel !== "none" || - (hasSelectedRecipients && recipientShareLevel !== "none"); + const showMemoryWarning = shareLevel !== "none"; const recipientActionTransition = shouldReduceMotion ? { duration: 0 } : RECIPIENT_ACTION_TRANSITION; @@ -298,17 +303,7 @@ export function SnapshotShareDialog({ const itemLabel = snapshotKind === "team" ? "team" : "agent"; const itemLabelTitle = snapshotKind === "team" ? "Team" : "Agent"; const shareLevels = React.useMemo( - () => [ - { value: "none" as const, label: `${itemLabelTitle} only` }, - { - value: "core" as const, - label: `${itemLabelTitle} + core memory`, - }, - { - value: "everything" as const, - label: `${itemLabelTitle} + all memories`, - }, - ], + () => buildSnapshotShareLevels(itemLabelTitle), [itemLabelTitle], ); const getEncodedSnapshot = React.useCallback( @@ -337,8 +332,7 @@ export function SnapshotShareDialog({ setSelectedRecipients([]); setCopyStatus("idle"); setPendingMemoryShare(null); - setLinkShareLevel("none"); - setRecipientShareLevel("none"); + setShareLevel("none"); onReset?.(); snapshotSendController.reset(); } @@ -495,21 +489,6 @@ export function SnapshotShareDialog({ excludedPubkeys={excludedRecipientPubkeys} onSelectionChange={setSelectedRecipients} open={open} - renderEndControl={(handleAccessOpenChange) => ( - - )} selectedUsers={selectedRecipients} testIdPrefix={testIdPrefix} /> @@ -532,9 +511,7 @@ export function SnapshotShareDialog({ isActionPending || !snapshotSendController.isDmSafetyReady } - onClick={() => - requestMemoryShare("send", recipientShareLevel) - } + onClick={() => requestMemoryShare("send", shareLevel)} type="button" > {isSending ? "Sending…" : "Send"} @@ -552,6 +529,116 @@ export function SnapshotShareDialog({

+
+ + + +
+

Share with a link

+

+ Anyone with the link can add and use a copy. +

+
+ +
+ +
+

+ What’s included +

+ +
+ {showMemoryWarning ? ( -
-
- - - -
-

Share with a link

-

- Anyone with the link can add and use a copy. -

-
- -
- -
- -
-
+ {afterLink}
- {selectedUsers.length > 0 && renderEndControl - ? renderEndControl((controlOpen) => { - if (controlOpen) setIsPickerOpen(false); - }) - : null}
0 ? 1 : 0); if (visiblePersonas.length === 0 && overflowCount === 0) { return ( @@ -130,16 +131,26 @@ function TeamAvatarRow({
{visiblePersonas.map((persona, index) => ( - + ))} {overflowCount > 0 ? ( - - +{overflowCount} - +
0 ? "-ml-5" : ""} + style={{ zIndex: stackItemCount }} + > + + +{overflowCount} + +
) : null}
@@ -148,25 +159,39 @@ function TeamAvatarRow({ function TeamAvatarItem({ index, + isFollowedByAnother, persona, }: { index: number; + isFollowedByAnother: boolean; persona: AgentPersona; }) { const avatarUrl = persona.avatarUrl?.trim() ?? null; return ( -
+
0 ? "-ml-5" : ""}`} + data-team-member-avatar="avatar" + style={{ + zIndex: index + 1, + ...(isFollowedByAnother && { + mask: "radial-gradient(circle 32px at calc(100% + 8px) 50%, transparent 99%, #fff 100%)", + WebkitMask: + "radial-gradient(circle 32px at calc(100% + 8px) 50%, transparent 99%, #fff 100%)", + }), + }} + > {avatarUrl ? ( ) : ( - + - - Import team snapshot + Import diff --git a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx index f24d6a41ff..34f9f9819f 100644 --- a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx +++ b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx @@ -45,7 +45,6 @@ type UnifiedAgentsSectionProps = { onOpenPersonaProfile: (persona: AgentPersona) => void; onStartAgent: (pubkey: string) => void; onStartPersona: (persona: AgentPersona) => void; - canChooseCatalog: boolean; personas: AgentPersona[]; personasError: Error | null; personaFeedbackErrorMessage: string | null; @@ -53,7 +52,7 @@ type UnifiedAgentsSectionProps = { isPersonasLoading: boolean; isPersonasPending: boolean; onCreatePersona: () => void; - onChooseCatalog: () => void; + onDiscoverPersonas: () => void; onDuplicatePersona: (persona: AgentPersona) => void; onEditPersona: (persona: AgentPersona) => void; onSharePersona: ( @@ -66,7 +65,9 @@ type UnifiedAgentsSectionProps = { }; const AGENT_CARD_COLUMN_CLASS = "w-full"; -const AGENT_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} mx-auto grid max-w-[996px] grid-cols-[repeat(auto-fill,minmax(220px,240px))] justify-center gap-3`; +export const AGENT_CARD_GRID_COLUMNS_CLASS = + "grid-cols-[repeat(auto-fill,minmax(220px,240px))]"; +const AGENT_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} ${AGENT_CARD_GRID_COLUMNS_CLASS} grid justify-start gap-3`; export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { const { @@ -83,7 +84,6 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { onOpenPersonaProfile, onStartAgent, onStartPersona, - canChooseCatalog, personas, personasError, personaFeedbackErrorMessage, @@ -91,7 +91,7 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { isPersonasLoading, isPersonasPending, onCreatePersona, - onChooseCatalog, + onDiscoverPersonas, onDuplicatePersona, onEditPersona, onSharePersona, @@ -184,11 +184,10 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { ); })}
@@ -430,50 +429,37 @@ function firstAvatarUrl( } function NewAgentCard({ - canChooseCatalog, - isPersonasPending, - openFilePicker, - onChooseCatalog, - onCreatePersona, + isPending, + onCreate, + onDiscover, + onImport, }: { - canChooseCatalog: boolean; - isPersonasPending: boolean; - openFilePicker: () => void; - onChooseCatalog: () => void; - onCreatePersona: () => void; + isPending: boolean; + onCreate: () => void; + onDiscover: () => void; + onImport: () => void; }) { return ( - + event.preventDefault()} > - - Create from scratch + + Create agent + + + Discover agents - {canChooseCatalog ? ( - - Choose from catalog - - ) : null} - Import agent snapshot + Import diff --git a/desktop/src/features/agents/ui/agentConfigOptions.tsx b/desktop/src/features/agents/ui/agentConfigOptions.tsx index 6ae81ff6cb..1313d2cec4 100644 --- a/desktop/src/features/agents/ui/agentConfigOptions.tsx +++ b/desktop/src/features/agents/ui/agentConfigOptions.tsx @@ -426,6 +426,60 @@ export function formatRuntimeOptionLabel(runtime: AcpRuntimeCatalogEntry) { return `${runtime.label}${suffix}`; } +export function buildPersonaRuntimeDropdownOptions({ + defaultRuntimeId, + isCreateMode, + runtime, + runtimes, + runtimesLoading, +}: { + defaultRuntimeId?: string; + isCreateMode: boolean; + runtime: string; + runtimes: AcpRuntimeCatalogEntry[]; + runtimesLoading: boolean; +}): { + blankRuntimeOptionLabel: string; + runtimeDropdownOptions: PersonaDropdownOption[]; +} { + const blankRuntimeOptionLabel = runtimesLoading + ? "Loading harnesses..." + : isCreateMode + ? "Choose a harness" + : "No preference (use app default)"; + const runtimeDropdownOptions: PersonaDropdownOption[] = [ + ...(!isCreateMode + ? [ + { + label: blankRuntimeOptionLabel, + value: NO_RUNTIME_DROPDOWN_VALUE, + }, + ] + : []), + ...sortPersonaRuntimes(runtimes).map((candidate) => ({ + disabled: + isCreateMode && + defaultRuntimeId !== undefined && + candidate.availability !== "available", + label: `${formatRuntimeOptionLabel(candidate)}${ + isCreateMode && candidate.id === defaultRuntimeId ? " (default)" : "" + }`, + value: candidate.id, + })), + ]; + const currentRuntime = runtime.trim(); + if ( + currentRuntime.length > 0 && + !runtimeDropdownOptions.some((option) => option.value === currentRuntime) + ) { + runtimeDropdownOptions.push({ + label: `${currentRuntime} (current)`, + value: currentRuntime, + }); + } + return { blankRuntimeOptionLabel, runtimeDropdownOptions }; +} + function runtimeAvailabilitySortRank( availability: AcpRuntimeCatalogEntry["availability"], ) { diff --git a/desktop/src/features/agents/ui/personaLibraryCopy.ts b/desktop/src/features/agents/ui/personaLibraryCopy.ts index 53c5e7a16f..79ddad1c3c 100644 --- a/desktop/src/features/agents/ui/personaLibraryCopy.ts +++ b/desktop/src/features/agents/ui/personaLibraryCopy.ts @@ -14,14 +14,13 @@ export const personaLibraryCopy = { export const personaCatalogCopy = { title: "Agent Catalog", - description: "Browse built-in agents and add them to My Agents.", + description: "Browse agents shared to this relay.", dialogTitle: "Agent Catalog", - dialogDescription: "Browse built-in agents and add them to My Agents.", + dialogDescription: "Browse agents shared to this relay.", emptyTitle: "You're all set", emptyDescription: "Everything in Agent Catalog is already in My Agents.", - emptyCatalogDescription: - "New agents will show up here when the app ships more options.", - emptyCatalogTitle: "No agents in the catalog yet", + emptyCatalogDescription: "Shared agents will appear here.", + emptyCatalogTitle: "No agents are being shared", detailsAction: "View details", selectAction: "Choose", deselectAction: "Deselect", diff --git a/desktop/src/features/agents/ui/usePersonaActions.ts b/desktop/src/features/agents/ui/usePersonaActions.ts index 54535d121c..0c56eeac10 100644 --- a/desktop/src/features/agents/ui/usePersonaActions.ts +++ b/desktop/src/features/agents/ui/usePersonaActions.ts @@ -17,9 +17,26 @@ import { type AgentSnapshotImportPreview, type AgentSnapshotImportResult, } from "@/features/agents/hooks"; -import { getPersonaLibraryState } from "@/features/agents/lib/catalog"; -import { clearLegacyPersonaCatalogVisibility } from "@/features/agents/lib/legacyPersonaCatalogVisibility"; +import { + getLibraryPersonas, + getPersonaLabelsById, +} from "@/features/agents/lib/catalog"; +import { + type CatalogPersonaShareLevel, + catalogPersonasFromPublications, + findLocalPersonaForCatalogEntry, + isCatalogPersona, +} from "@/features/agents/lib/personaCatalogRelay"; +import { + usePersonaCatalogLiveUpdates, + usePersonaCatalogQuery, + useSetPersonaCatalogSharedMutation, + useUpdatePersonaAndPublishMutation, +} from "@/features/agents/lib/usePersonaCatalogRelay"; +import { personaSaveNotice } from "@/features/agents/lib/personaSaveNotice"; import { useCreatedAgentChannelAttachment } from "@/features/agents/useCreatedAgentChannelAttachment"; +import { useCommunities } from "@/features/communities/useCommunities"; +import { useIdentityQuery } from "@/shared/api/hooks"; import type { SnapshotFormat, SnapshotMemoryLevel, @@ -51,7 +68,14 @@ type PersonaFeedbackSurface = "catalog" | "library"; export function usePersonaActions() { const queryClient = useQueryClient(); + const { activeCommunity } = useCommunities(); + const identityQuery = useIdentityQuery(); + const communityId = activeCommunity?.id ?? null; const personasQuery = usePersonasQuery(); + const catalogQuery = usePersonaCatalogQuery(communityId); + usePersonaCatalogLiveUpdates(communityId); + const setCatalogSharedMutation = + useSetPersonaCatalogSharedMutation(communityId); const [shouldLoadAcpRuntimes, setShouldLoadAcpRuntimes] = React.useState(false); const acpRuntimesQuery = useAcpRuntimesQuery({ @@ -60,6 +84,8 @@ export function usePersonaActions() { const createAgentMutation = useCreateManagedAgentMutation(); const createPersonaMutation = useCreatePersonaMutation(); const updatePersonaMutation = useUpdatePersonaMutation(); + const updatePersonaAndPublishMutation = + useUpdatePersonaAndPublishMutation(communityId); const deletePersonaMutation = useDeletePersonaMutation(); const setPersonaActiveMutation = useSetPersonaActiveMutation(); const exportAgentSnapshotMutation = useExportAgentSnapshotMutation(); @@ -101,9 +127,15 @@ export function usePersonaActions() { React.useState(false); const personas = personasQuery.data ?? []; - React.useEffect(() => { - clearLegacyPersonaCatalogVisibility(); - }, []); + const publications = catalogQuery.data ?? []; + const sharedCatalogPersonaIdSet = React.useMemo(() => { + const currentPubkey = identityQuery.data?.pubkey.toLowerCase(); + return new Set( + publications + .filter((publication) => publication.ownerPubkey === currentPubkey) + .map((publication) => publication.sourcePersonaId), + ); + }, [identityQuery.data?.pubkey, publications]); const availableRuntimes = React.useMemo( () => (acpRuntimesQuery.data ?? []).filter( @@ -112,8 +144,21 @@ export function usePersonaActions() { ), [acpRuntimesQuery.data], ); - const { catalogPersonas, libraryPersonas, personaLabelsById } = React.useMemo( - () => getPersonaLibraryState(personas), + const catalogPersonas = React.useMemo( + () => + catalogPersonasFromPublications( + publications, + personas, + identityQuery.data?.pubkey, + ), + [identityQuery.data?.pubkey, personas, publications], + ); + const libraryPersonas = React.useMemo( + () => getLibraryPersonas(personas), + [personas], + ); + const personaLabelsById = React.useMemo( + () => getPersonaLabelsById(personas), [personas], ); @@ -130,6 +175,7 @@ export function usePersonaActions() { intent?: AgentCreateIntent, backendIntent?: BackendIntent | null, targetChannel?: Pick | null, + options?: { publishCatalogUpdates?: boolean }, ): Promise { if (isPersonaSubmitPending) { return false; @@ -139,8 +185,24 @@ export function usePersonaActions() { setIsPersonaSubmitPending(true); try { if ("id" in input) { - await updatePersonaMutation.mutateAsync(input); - setPersonaNoticeMessage(`Updated ${input.displayName}.`); + // "Save and publish" promises the community catalog sees this edit, so + // it must use the command that awaits the relay. A plain save only + // enqueues the head and cannot report the outcome. + if (options?.publishCatalogUpdates) { + const result = + await updatePersonaAndPublishMutation.mutateAsync(input); + if (result.publicationStatus === "queued" && result.relayMessage) { + console.warn( + `[updatePersonaAndPublish] relay publication queued: ${result.relayMessage}`, + ); + } + setPersonaNoticeMessage( + personaSaveNotice(input.displayName, result.publicationStatus), + ); + } else { + await updatePersonaMutation.mutateAsync(input); + setPersonaNoticeMessage(personaSaveNotice(input.displayName, null)); + } } else { const runtime = availableRuntimes.find( (candidate) => candidate.id === input.runtime, @@ -240,7 +302,46 @@ export function usePersonaActions() { ) { clearFeedback(surface); try { - await setPersonaActiveMutation.mutateAsync({ id: persona.id, active }); + if (active && isCatalogPersona(persona)) { + const localPersona = findLocalPersonaForCatalogEntry( + personas, + persona.catalogSource, + ); + + if (localPersona) { + if (!localPersona.isActive) { + await setPersonaActiveMutation.mutateAsync({ + id: localPersona.id, + active: true, + }); + } + } else { + await createPersonaMutation.mutateAsync({ + displayName: persona.displayName, + avatarUrl: persona.avatarUrl ?? undefined, + systemPrompt: persona.systemPrompt, + runtime: persona.runtime ?? undefined, + model: persona.model ?? undefined, + provider: persona.provider ?? undefined, + namePool: persona.namePool, + behavior: { + respondTo: + persona.respondTo === "anyone" ? "anyone" : "owner-only", + parallelism: persona.parallelism ?? undefined, + }, + // Provenance on the copy: without it the copy's fresh local id is + // the only identifier, and the catalog offers "Add" again. + catalogSource: persona.catalogSource.isOwn + ? undefined + : { + ownerPubkey: persona.catalogSource.ownerPubkey, + personaId: persona.catalogSource.personaId, + }, + }); + } + } else { + await setPersonaActiveMutation.mutateAsync({ id: persona.id, active }); + } setPersonaNoticeMessage( active ? `Selected ${persona.displayName} for My Agents.` @@ -334,6 +435,7 @@ export function usePersonaActions() { function openCatalog() { clearFeedback("catalog"); + void catalogQuery.refetch(); setIsCatalogDialogOpen(true); } @@ -386,22 +488,83 @@ export function usePersonaActions() { ); } + function getPersonaCatalogShareLevel( + persona: AgentPersona, + ): CatalogPersonaShareLevel { + return persona.shared ? "none" : "not-shared"; + } + + async function setPersonaCatalogShareLevel( + persona: AgentPersona, + shareLevel: CatalogPersonaShareLevel, + ): Promise { + if (persona.isBuiltIn) return; + + clearFeedback("library"); + try { + const shared = shareLevel !== "not-shared"; + const result = await setCatalogSharedMutation.mutateAsync({ + id: persona.id, + shared, + }); + setPersonaToShare((current) => + current?.persona.id === result.persona.id + ? { ...current, persona: result.persona } + : current, + ); + if (result.publicationStatus === "queued") { + if (shared) { + setPersonaNoticeMessage( + `Sharing ${persona.displayName} is queued. It will appear after the relay accepts the update.`, + ); + } else { + setPersonaNoticeMessage( + `Removing ${persona.displayName} is queued. It may remain discoverable until the relay accepts the update.`, + ); + } + if (result.relayMessage) { + console.warn( + `[setPersonaShared] relay publication queued: ${result.relayMessage}`, + ); + } + } else if (!shared) { + setPersonaNoticeMessage( + `${persona.displayName} is no longer discoverable in the community catalog.`, + ); + } else { + setPersonaNoticeMessage( + `Published ${persona.displayName} to the community catalog.`, + ); + } + } catch (error) { + setPersonaErrorMessage( + error instanceof Error + ? error.message + : "Failed to update catalog sharing.", + ); + } + } + const isPending = isPersonaSubmitPending || createPersonaMutation.isPending || createAgentMutation.isPending || updatePersonaMutation.isPending || + updatePersonaAndPublishMutation.isPending || deletePersonaMutation.isPending || setPersonaActiveMutation.isPending || exportAgentSnapshotMutation.isPending || previewSnapshotImportMutation.isPending || - confirmSnapshotImportMutation.isPending; + confirmSnapshotImportMutation.isPending || + setCatalogSharedMutation.isPending; return { personasQuery, + catalogQuery, acpRuntimesQuery, createPersonaMutation, updatePersonaMutation, + updatePersonaAndPublishMutation, setPersonaActiveMutation, catalogPersonas, libraryPersonas, @@ -431,6 +594,9 @@ export function usePersonaActions() { personaToExportSnapshot, setPersonaToExportSnapshot, handleExportSnapshot, + getPersonaCatalogShareLevel, + setPersonaCatalogShareLevel, + sharedCatalogPersonaIdSet, clearFeedback, snapshotImportState, snapshotImportResult, diff --git a/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx b/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx deleted file mode 100644 index 268bd863f2..0000000000 --- a/desktop/src/features/settings/ui/ActiveAgentCommunitiesSettingsCard.tsx +++ /dev/null @@ -1,133 +0,0 @@ -import * as React from "react"; - -import { useManagedAgentsQuery } from "@/features/agents/hooks"; -import { - useManagedAgentRuntimeAction, - useManagedAgentRuntimesQuery, -} from "@/features/agents/managedAgentRuntimeHooks"; -import { - agentCommunityAvailability, - agentCommunityStatusDetail, - managedAgentRuntimeKey, -} from "@/features/agents/managedAgentRuntimeStatus"; -import type { ManagedAgentRuntimeStatus } from "@/shared/api/types"; -import { Button } from "@/shared/ui/button"; -import { Badge } from "@/shared/ui/badge"; -import { truncatePubkey } from "@/shared/lib/pubkey"; -import { SettingsSectionHeader } from "./SettingsSectionHeader"; - -export function ActiveAgentCommunitiesSettingsCard() { - const agentsQuery = useManagedAgentsQuery(); - const runtimesQuery = useManagedAgentRuntimesQuery(); - const action = useManagedAgentRuntimeAction(); - const [pendingRuntimeKey, setPendingRuntimeKey] = React.useState< - string | null - >(null); - - const agentNames = React.useMemo( - () => - new Map( - (agentsQuery.data ?? []).map((agent) => [ - agent.pubkey.toLowerCase(), - agent.name, - ]), - ), - [agentsQuery.data], - ); - const runtimes = runtimesQuery.data ?? []; - - async function runAction(runtime: ManagedAgentRuntimeStatus) { - setPendingRuntimeKey(managedAgentRuntimeKey(runtime)); - try { - await action.mutateAsync({ - action: - runtime.lifecycle === "starting" || - runtime.lifecycle === "listening" || - runtime.lifecycle === "waking" || - runtime.lifecycle === "ready" - ? "stop" - : runtime.lifecycle === "stopped" - ? "start" - : "restart", - pubkey: runtime.pubkey, - relayUrl: runtime.relayUrl, - }); - } finally { - setPendingRuntimeKey(null); - } - } - - return ( -
- -
- {runtimesQuery.isPending ? ( -

Loading…

- ) : runtimes.length === 0 ? ( -

- No agent community runtimes found. -

- ) : ( - runtimes.map((runtime) => { - const status = agentCommunityAvailability(runtime); - const detail = agentCommunityStatusDetail(runtime); - const runtimeKey = managedAgentRuntimeKey(runtime); - const pending = pendingRuntimeKey === runtimeKey; - return ( -
-
-
-

- {agentNames.get(runtime.pubkey.toLowerCase()) ?? - truncatePubkey(runtime.pubkey)} -

- - {status} - -
-

- {runtime.relayUrl} -

- {detail ? ( -

{detail}

- ) : null} -
- {runtime.localSetup ? ( - - ) : null} -
- ); - }) - )} -
- {action.error instanceof Error ? ( -

{action.error.message}

- ) : null} -
- ); -} diff --git a/desktop/src/features/settings/ui/SettingsPanels.tsx b/desktop/src/features/settings/ui/SettingsPanels.tsx index 156be00b72..e74d1f3837 100644 --- a/desktop/src/features/settings/ui/SettingsPanels.tsx +++ b/desktop/src/features/settings/ui/SettingsPanels.tsx @@ -77,7 +77,6 @@ import { MobilePairingCard } from "./MobilePairingCard"; import { ModerationQueueCard } from "./ModerationQueueCard"; import { NotificationSettingsCard } from "./NotificationSettingsCard"; import { PreventSleepSettingsCard } from "./PreventSleepSettingsCard"; -import { ActiveAgentCommunitiesSettingsCard } from "./ActiveAgentCommunitiesSettingsCard"; import { AgentDefaultsSettingsCard } from "./AgentDefaultsSettingsCard"; import { HostedCommunitiesSettingsCard } from "./HostedCommunitiesSettingsCard"; import { SettingsOptionGroup, SettingsOptionRow } from "./SettingsOptionGroup"; @@ -815,7 +814,6 @@ export function renderSettingsSection(
-
); diff --git a/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs b/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs index 8503a79349..d4e0b1d5f3 100644 --- a/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs +++ b/desktop/src/shared/api/tauriPersonas.snapshotImport.test.mjs @@ -12,6 +12,9 @@ import test from "node:test"; function makePreview(overrides = {}) { return { displayName: "Test Agent", + isBuiltIn: false, + model: null, + runtime: null, systemPrompt: "You are helpful.", avatarUrl: null, memoryLevel: "none", diff --git a/desktop/src/shared/api/tauriPersonas.ts b/desktop/src/shared/api/tauriPersonas.ts index bd3be92407..66e07f5e88 100644 --- a/desktop/src/shared/api/tauriPersonas.ts +++ b/desktop/src/shared/api/tauriPersonas.ts @@ -17,7 +17,14 @@ export type RawPersona = { name_pool?: string[]; is_builtin: boolean; is_active?: boolean; + shared?: boolean; source_team?: string | null; + /** + * Provenance of a local copy of another owner's catalog entry. Serialized by + * the backend `CatalogSource` in snake_case; the create payload sends the + * camelCase aliases it accepts. + */ + catalog_source?: { owner_pubkey: string; persona_id: string } | null; env_vars?: Record; respond_to?: string | null; respond_to_allowlist?: string[]; @@ -40,7 +47,14 @@ export function fromRawPersona(persona: RawPersona): AgentPersona { namePool: persona.name_pool ?? [], isBuiltIn: persona.is_builtin, isActive: persona.is_active ?? true, + shared: persona.shared ?? false, sourceTeam: persona.source_team ?? null, + catalogSource: persona.catalog_source + ? { + ownerPubkey: persona.catalog_source.owner_pubkey, + personaId: persona.catalog_source.persona_id, + } + : null, envVars: persona.env_vars ?? {}, respondTo: (persona.respond_to as RespondToMode | undefined) ?? null, respondToAllowlist: persona.respond_to_allowlist ?? [], @@ -69,31 +83,37 @@ export async function createPersona( namePool: input.namePool ?? [], envVars: input.envVars ?? {}, behavior: input.behavior, + catalogSource: input.catalogSource, }, }), ); } +/** The `UpdatePersonaRequest` payload shared by both edit commands. */ +function updatePersonaPayload(input: UpdatePersonaInput) { + return { + id: input.id, + displayName: input.displayName, + avatarUrl: input.avatarUrl, + systemPrompt: input.systemPrompt, + runtime: input.runtime, + model: input.model, + provider: input.provider, + namePool: input.namePool ?? [], + // Send envVars only when caller explicitly provided it; omitting + // tells the backend "don't touch the stored env vars" so editing + // unrelated fields can't silently wipe saved credentials. + envVars: input.envVars, + // Same absent-vs-present contract as envVars for the behavioral quad. + behavior: input.behavior, + }; +} + export async function updatePersona( input: UpdatePersonaInput, ): Promise { const raw = await invokeTauri("update_persona", { - input: { - id: input.id, - displayName: input.displayName, - avatarUrl: input.avatarUrl, - systemPrompt: input.systemPrompt, - runtime: input.runtime, - model: input.model, - provider: input.provider, - namePool: input.namePool ?? [], - // Send envVars only when caller explicitly provided it; omitting - // tells the backend "don't touch the stored env vars" so editing - // unrelated fields can't silently wipe saved credentials. - envVars: input.envVars, - // Same absent-vs-present contract as envVars for the behavioral quad. - behavior: input.behavior, - }, + input: updatePersonaPayload(input), }); if (raw.writeback_warning) { console.warn( @@ -103,6 +123,41 @@ export async function updatePersona( return fromRawPersona(raw); } +/** + * Save an edit AND publish the persona's catalog head, reporting whether the + * relay accepted it. + * + * `updatePersona` only enqueues the head best-effort, so it cannot tell the UI + * whether the community catalog actually received the change. Use this for the + * "Save and publish" affordance, which promises exactly that. + */ +export async function updatePersonaAndPublish( + input: UpdatePersonaInput, +): Promise { + return fromRawPublicationResult( + await invokeTauri( + "update_persona_and_publish", + { input: updatePersonaPayload(input) }, + ), + ); +} + +type RawPersonaSharePublicationResult = { + persona: RawPersona; + publicationStatus: "published" | "queued"; + relayMessage?: string; +}; + +function fromRawPublicationResult( + raw: RawPersonaSharePublicationResult, +): PersonaSharePublicationResult { + return { + persona: fromRawPersona(raw.persona), + publicationStatus: raw.publicationStatus, + relayMessage: raw.relayMessage ?? null, + }; +} + export async function deletePersona(id: string): Promise { await invokeTauri("delete_persona", { id }); } @@ -116,6 +171,24 @@ export async function setPersonaActive( ); } +export async function setPersonaShared( + id: string, + shared: boolean, +): Promise { + return fromRawPublicationResult( + await invokeTauri("set_persona_shared", { + id, + shared, + }), + ); +} + +export type PersonaSharePublicationResult = { + persona: AgentPersona; + publicationStatus: "published" | "queued"; + relayMessage: string | null; +}; + export type SnapshotMemoryLevel = "none" | "core" | "everything"; export type SnapshotFormat = "json" | "png"; @@ -172,6 +245,10 @@ export async function encodeAgentSnapshotForSend( /** Preview returned by `preview_agent_snapshot_import` before any write. */ export type AgentSnapshotImportPreview = { displayName: string; + /** Source classification shown in the preview; imports remain custom. */ + isBuiltIn: boolean; + model: string | null; + runtime: string | null; systemPrompt: string | null; /** Effective avatar: data URL if present, source URL fallback otherwise. */ avatarUrl: string | null; @@ -235,9 +312,15 @@ export async function confirmAgentSnapshotImport( // Patches a single inbound persona/team/agent projection event into the local // store (personas.json). The backend resolves the match key and the -// pending-edit race; the frontend only forwards the raw Nostr event JSON. +// pending-edit race; the frontend forwards the raw Nostr event JSON plus the +// relay it arrived on, so a workspace switch mid-flight cannot retain the event +// into the newly active community's scoped store. export async function reconcileInboundPersonaEvent( eventJson: string, + arrivalRelayUrl: string, ): Promise { - await invokeTauri("reconcile_inbound_persona_event", { eventJson }); + await invokeTauri("reconcile_inbound_persona_event", { + eventJson, + arrivalRelayUrl, + }); } diff --git a/desktop/src/shared/api/types.ts b/desktop/src/shared/api/types.ts index d14b66eebb..689c400b03 100644 --- a/desktop/src/shared/api/types.ts +++ b/desktop/src/shared/api/types.ts @@ -753,10 +753,17 @@ export type AgentPersona = { namePool: string[]; isBuiltIn: boolean; isActive: boolean; + /** Whether this persona is discoverable in the active community catalog. */ + shared: boolean; /** Team ID if this persona was imported from a team directory. Team personas are non-editable. */ sourceTeam?: string | null; - /** Environment variables injected for agents created from this persona. - * Layered as: desktop parent env < persona envVars < agent envVars. */ + /** + * Set only on a local copy of another owner's shared catalog entry. A copy + * carries a fresh local `id`, so this coordinate is the only thing that can + * answer "is this catalog entry already added" without minting a duplicate. + */ + catalogSource?: CatalogSourceCoordinate | null; + /** Agent environment variables, layered after desktop parent and persona values. */ envVars: Record; /** NIP-AP behavioral defaults (wire shape). Null/empty = unset. */ respondTo: RespondToMode | null; @@ -767,9 +774,18 @@ export type AgentPersona = { }; /** - * NIP-AP behavioral group for a definition, sent as one group: absent = don't - * touch the stored behavior group (legacy callers), present = replace the fields as a - * unit. Mirrors `PersonaBehaviorRequest`. + * A catalog publication's coordinate: the owner who published it and the + * `d`-tag identifying the persona within that owner's catalog. Mirrors the + * backend `CatalogSource`. + */ +export type CatalogSourceCoordinate = { + ownerPubkey: string; + personaId: string; +}; + +/** + * NIP-AP behavioral group for a definition: absent preserves the stored group + * for legacy callers; present replaces it as a unit. Mirrors `PersonaBehaviorRequest`. */ export type PersonaBehaviorInput = { respondTo?: RespondToMode; @@ -787,6 +803,11 @@ export type CreatePersonaInput = { namePool?: string[]; envVars?: Record; behavior?: PersonaBehaviorInput; + /** + * Set when this persona is a copy of another owner's shared catalog entry, + * so the catalog can tell an already-added foreign entry from a new one. + */ + catalogSource?: CatalogSourceCoordinate; }; export type UpdatePersonaInput = { diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 03c05fe877..7b13273c60 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -40,6 +40,7 @@ import { KIND_HUDDLE_STARTED, KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION, + KIND_PERSONA, KIND_REPO_ANNOUNCEMENT, KIND_REPO_STATE, KIND_STREAM_MESSAGE_EDIT, @@ -112,13 +113,17 @@ type MockPersonaSeed = { displayName: string; avatarUrl?: string | null; systemPrompt: string; + updatedAt?: string; isActive?: boolean; + shared?: boolean; sourceTeam?: string | null; envVars?: Record; runtime?: string | null; model?: string | null; provider?: string | null; namePool?: string[]; + respondTo?: "owner-only" | "allowlist" | "anyone"; + respondToAllowlist?: string[]; }; type MockTeamSeed = { @@ -224,6 +229,10 @@ type E2eConfig = { * (`list/start/stop/restart_managed_agent_runtime`). */ managedAgentRuntimes?: MockManagedAgentRuntimeSeed[]; personas?: MockPersonaSeed[]; + /** Community catalog replaceable-event heads returned by relay queries. */ + personaCatalogEvents?: RelayEvent[]; + /** Outcomes for successive explicit persona share publications. */ + personaSharePublicationStatuses?: Array<"published" | "queued">; teams?: MockTeamSeed[]; relayAgents?: MockRelayAgentSeed[]; agentListDelayMs?: number; @@ -809,7 +818,9 @@ type RawPersona = { name_pool?: string[]; is_builtin: boolean; is_active: boolean; + shared: boolean; source_team?: string | null; + catalog_source?: { owner_pubkey: string; persona_id: string } | null; env_vars?: Record; respond_to?: string | null; respond_to_allowlist?: string[]; @@ -2171,6 +2182,7 @@ function resetMockPersonas(config?: E2eConfig) { name_pool: [], is_builtin: true, is_active: activePersonaIds.has(persona.id), + shared: false, source_team: null, created_at: now, updated_at: now, @@ -2186,12 +2198,18 @@ function resetMockPersonas(config?: E2eConfig) { model: persona.model ?? null, provider: persona.provider ?? null, name_pool: persona.namePool ?? [], + respond_to: persona.respondTo ?? null, + respond_to_allowlist: + persona.respondTo === "allowlist" + ? [...(persona.respondToAllowlist ?? [])] + : [], is_builtin: false, is_active: persona.isActive ?? true, + shared: persona.shared ?? false, source_team: persona.sourceTeam ?? null, env_vars: { ...(persona.envVars ?? {}) }, created_at: now, - updated_at: now, + updated_at: persona.updatedAt ?? now, }); } } @@ -2786,6 +2804,7 @@ const mockChannels: MockChannel[] = [ const mockMessages = new Map(); const mockUserStatuses: RelayEvent[] = []; const mockReminderEvents: RelayEvent[] = []; +const mockPersonaEvents: RelayEvent[] = []; let mockRelayMembers: RawRelayMember[] = []; const mockSockets = new Map(); let mockWebsocketSendMutexWedged = false; @@ -2816,6 +2835,16 @@ function resetMockSaveSubscriptions(config: E2eConfig | undefined) { })); } +function resetMockPersonaCatalogEvents(config: E2eConfig | undefined) { + mockPersonaEvents.length = 0; + for (const event of config?.mock?.personaCatalogEvents ?? []) { + mockPersonaEvents.push({ + ...event, + tags: event.tags.map((tag) => [...tag]), + }); + } +} + // Mesh-compute mock state — TEST-ONLY. // // This entire module (e2eBridge.ts) is loaded only when `window.__BUZZ_E2E__` @@ -3846,6 +3875,13 @@ function emitMockLiveEvent(channelId: string, event: RelayEvent) { } function emitMockGlobalEvent(event: RelayEvent) { + if ( + event.kind === KIND_PERSONA && + event.pubkey.toLowerCase() !== MOCK_IDENTITY_PUBKEY.toLowerCase() && + !personaHasExactSharedTag(event) + ) { + return; + } for (const socket of mockSockets.values()) { for (const [subId, subscription] of socket.subscriptions) { if (subscription.kinds && !subscription.kinds.includes(event.kind)) { @@ -7158,6 +7194,9 @@ let mockGlobalAgentConfig: { // Per-page get_nsec call counter for sequenced error testing. let nsecCallCount = 0; +// Per-page explicit catalog publication outcomes. +let personaSharePublicationCallCount = 0; + // Per-page confirm_team_snapshot_import call counter for sequenced error testing. let teamSnapshotConfirmCallCount = 0; @@ -7351,6 +7390,7 @@ async function handleCreatePersona(args: { provider?: string; envVars?: Record; behavior?: PersonaBehaviorInput; + catalogSource?: { ownerPubkey: string; personaId: string }; }; }): Promise { const now = new Date().toISOString(); @@ -7364,49 +7404,78 @@ async function handleCreatePersona(args: { provider: args.input.provider?.trim() || null, is_builtin: false, is_active: true, + shared: false, source_team: null, + // Mirrors `CatalogSource::normalized`: the coordinate a catalog copy keeps + // so the catalog can tell an already-added foreign entry from a new one. + catalog_source: args.input.catalogSource + ? { + owner_pubkey: args.input.catalogSource.ownerPubkey + .trim() + .toLowerCase(), + persona_id: args.input.catalogSource.personaId.trim(), + } + : null, env_vars: { ...(args.input.envVars ?? {}) }, created_at: now, updated_at: now, }; applyMockPersonaBehavior(persona, args.input.behavior); mockPersonas.push(persona); + upsertMockPersonaEvent(persona); return { ...persona }; } +type MockUpdatePersonaInput = { + id: string; + displayName: string; + avatarUrl?: string; + systemPrompt: string; + runtime?: string; + model?: string; + provider?: string; + envVars?: Record; + behavior?: PersonaBehaviorInput; +}; + async function handleUpdatePersona(args: { - input: { - id: string; - displayName: string; - avatarUrl?: string; - systemPrompt: string; - runtime?: string; - model?: string; - provider?: string; - envVars?: Record; - behavior?: PersonaBehaviorInput; - }; + input: MockUpdatePersonaInput; }): Promise { - const persona = mockPersonas.find( - (candidate) => candidate.id === args.input.id, - ); + return { ...applyMockPersonaUpdate(args.input) }; +} + +/** + * Save an edit to the mock persona store, exactly like `update_persona_with`, + * and return the live record so a caller can publish it. + * + * Deliberately does NOT publish a catalog event: the real `update_persona` + * only enqueues a pending head for the out-of-band flush loop, so nothing has + * reached the relay by the time the command returns. Publishing here would + * make a UI that never calls `update_persona_and_publish` look like it kept + * the "Save and publish" promise. + */ +function applyMockPersonaUpdate(input: MockUpdatePersonaInput): RawPersona { + const persona = mockPersonas.find((candidate) => candidate.id === input.id); if (!persona) { - throw new Error(`agent ${args.input.id} not found`); - } - persona.display_name = args.input.displayName.trim(); - persona.avatar_url = args.input.avatarUrl?.trim() || null; - persona.system_prompt = args.input.systemPrompt.trim(); - persona.runtime = args.input.runtime?.trim() || null; - persona.model = args.input.model?.trim() || null; - persona.provider = args.input.provider?.trim() || null; - if (args.input.envVars !== undefined) { + throw new Error(`agent ${input.id} not found`); + } + persona.display_name = input.displayName.trim(); + persona.avatar_url = input.avatarUrl?.trim() || null; + persona.system_prompt = input.systemPrompt.trim(); + persona.runtime = input.runtime?.trim() || null; + persona.model = input.model?.trim() || null; + persona.provider = input.provider?.trim() || null; + if (input.envVars !== undefined) { // Absent = preserve; present = replace entirely (matches Rust handler). - persona.env_vars = { ...args.input.envVars }; + persona.env_vars = { ...input.envVars }; } - applyMockPersonaBehavior(persona, args.input.behavior); + applyMockPersonaBehavior(persona, input.behavior); persona.updated_at = new Date().toISOString(); - return { ...persona }; + for (const callback of tauriEventListeners.get("agents-data-changed") ?? []) { + callback(); + } + return persona; } async function handleDeletePersona(args: { id: string }): Promise { @@ -7468,15 +7537,115 @@ async function handleSetPersonaActive(args: { return { ...persona }; } +function personaHasExactSharedTag(event: RelayEvent): boolean { + const tags = event.tags.filter((tag) => tag[0] === "shared"); + return tags.length === 1 && tags[0]?.length === 2 && tags[0]?.[1] === "true"; +} + +function upsertMockPersonaRelayEvent(event: RelayEvent): void { + const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1]; + if (!sourceId) return; + const existingIndex = mockPersonaEvents.findIndex( + (candidate) => + candidate.pubkey.toLowerCase() === event.pubkey.toLowerCase() && + candidate.tags.some((tag) => tag[0] === "d" && tag[1] === sourceId), + ); + if (existingIndex >= 0) { + mockPersonaEvents.splice(existingIndex, 1); + } + mockPersonaEvents.push(event); +} + +function upsertMockPersonaEvent(persona: RawPersona): void { + const event: RelayEvent = { + id: mockEventId(), + pubkey: MOCK_IDENTITY_PUBKEY, + created_at: Math.floor(Date.now() / 1_000), + kind: KIND_PERSONA, + tags: [["d", persona.id], ...(persona.shared ? [["shared", "true"]] : [])], + content: JSON.stringify({ + display_name: persona.display_name, + system_prompt: persona.system_prompt, + avatar_url: persona.avatar_url, + runtime: persona.runtime ?? null, + model: persona.model ?? null, + provider: persona.provider ?? null, + name_pool: persona.name_pool ?? [], + respond_to: persona.respond_to ?? null, + respond_to_allowlist: persona.respond_to_allowlist ?? [], + parallelism: persona.parallelism ?? null, + }), + sig: "0".repeat(128), + }; + upsertMockPersonaRelayEvent(event); + emitMockGlobalEvent(event); +} + +type MockPersonaPublicationResult = { + persona: RawPersona; + publicationStatus: "published" | "queued"; + relayMessage?: string; +}; + +/** + * Publish a persona's catalog head and report the relay outcome, like + * `publish_prepared_persona`. A `queued` outcome must NOT make the event + * visible to catalog readers — that is the whole distinction the UI reports. + */ +function publishMockPersonaHead( + persona: RawPersona, + config: E2eConfig | undefined, +): MockPersonaPublicationResult { + const publicationStatus = + config?.mock?.personaSharePublicationStatuses?.[ + personaSharePublicationCallCount++ + ] ?? "published"; + if (publicationStatus === "published") { + upsertMockPersonaEvent(persona); + } + return { + persona: { ...persona }, + publicationStatus, + ...(publicationStatus === "queued" + ? { relayMessage: "relay unreachable: could not connect to relay" } + : {}), + }; +} + +async function handleSetPersonaShared( + args: { + id: string; + shared: boolean; + }, + config?: E2eConfig, +): Promise { + const persona = mockPersonas.find((candidate) => candidate.id === args.id); + if (!persona) { + throw new Error(`agent ${args.id} not found`); + } + if (persona.is_builtin) { + throw new Error("Built-in agents cannot be shared to the catalog."); + } + persona.shared = args.shared; + persona.updated_at = new Date().toISOString(); + return publishMockPersonaHead(persona, config); +} + +/** Mirrors `update_persona_and_publish`: save the edit, then await the relay. */ +async function handleUpdatePersonaAndPublish( + args: { input: MockUpdatePersonaInput }, + config?: E2eConfig, +): Promise { + return publishMockPersonaHead(applyMockPersonaUpdate(args.input), config); +} + function ensureMockPersonaIsActive(personaId: string) { const persona = mockPersonas.find((candidate) => candidate.id === personaId); if (!persona) { throw new Error(`agent ${personaId} not found`); } if (!persona.is_active) { - throw new Error( - `${persona.display_name} is not in My Agents. Choose it from Agent Catalog first.`, - ); + throw new Error(`${persona.display_name} is not in My Agents.`); } } @@ -8235,6 +8404,35 @@ async function resolveMockUploadDescriptors( ]; } +async function resolveMockUploadDescriptorForBytes( + args: { data: number[]; filename?: string | null }, + config: E2eConfig | undefined, +): Promise { + const configured = config?.mock?.uploadDescriptors; + if (configured !== undefined) { + const descriptors = await resolveMockUploadDescriptors(config); + const descriptor = descriptors[0]; + if (!descriptor) throw new Error("mock upload returned no descriptor"); + return descriptor; + } + + const bytes = Uint8Array.from(args.data); + const digest = await crypto.subtle.digest("SHA-256", bytes); + const sha256 = Array.from(new Uint8Array(digest), (value) => + value.toString(16).padStart(2, "0"), + ).join(""); + const filename = args.filename ?? "upload.bin"; + const isAgentJson = filename.toLowerCase().endsWith(".agent.json"); + return { + url: `https://mock.relay/media/${sha256}${isAgentJson ? ".json" : ".bin"}`, + sha256, + size: bytes.length, + type: isAgentJson ? "application/json" : "application/octet-stream", + uploaded: Math.floor(Date.now() / 1000), + filename, + }; +} + async function handleSendChannelMessage( args: { channelId: string; @@ -8930,6 +9128,25 @@ function sendToMockSocket(args: { return; } + if (filter.kinds?.includes(KIND_PERSONA)) { + const authors = filter.authors?.map((author) => author.toLowerCase()); + const sourceIds = filter["#d"]; + for (const event of mockPersonaEvents) { + if (authors && !authors.includes(event.pubkey.toLowerCase())) continue; + if ( + event.pubkey.toLowerCase() !== MOCK_IDENTITY_PUBKEY.toLowerCase() && + !personaHasExactSharedTag(event) + ) { + continue; + } + const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1]; + if (sourceIds && (!sourceId || !sourceIds.includes(sourceId))) continue; + sendWsText(socket.handler, ["EVENT", subId, event]); + } + sendWsText(socket.handler, ["EOSE", subId]); + return; + } + // Project queries: NIP-34 kinds, or kind:1 comments scoped by repo `a` // tag (PR/issue discussions, approvals, review requests). if ( @@ -9031,6 +9248,36 @@ function sendToMockSocket(args: { return; } + if (event.kind === KIND_PERSONA) { + const sourceId = event.tags.find((tag) => tag[0] === "d")?.[1]; + if (!sourceId) { + sendWsText(socket.handler, [ + "OK", + event.id, + false, + "invalid: persona event missing d tag.", + ]); + return; + } + const sharedTags = event.tags.filter((tag) => tag[0] === "shared"); + if ( + sharedTags.length > 1 || + (sharedTags.length === 1 && !personaHasExactSharedTag(event)) + ) { + sendWsText(socket.handler, [ + "OK", + event.id, + false, + 'invalid: shared tag must be exactly ["shared","true"].', + ]); + return; + } + upsertMockPersonaRelayEvent(event); + emitMockGlobalEvent(event); + sendWsText(socket.handler, ["OK", event.id, true, ""]); + return; + } + if (event.kind === 20001) { const status = event.content; if (status === "online" || status === "away" || status === "offline") { @@ -9149,6 +9396,7 @@ export function maybeInstallE2eTauriMocks() { resetMockWorkflows(); resetMockMesh(); resetMockUserStatuses(); + resetMockPersonaCatalogEvents(config); resetMockSaveSubscriptions(config); resetMockPendingCommunityDeepLinks(config); mockWebsocketSendMutexWedged = false; @@ -10222,6 +10470,11 @@ export function maybeInstallE2eTauriMocks() { return handleUpdatePersona( payload as Parameters[0], ); + case "update_persona_and_publish": + return handleUpdatePersonaAndPublish( + payload as Parameters[0], + activeConfig, + ); case "delete_persona": return handleDeletePersona( payload as Parameters[0], @@ -10245,11 +10498,16 @@ export function maybeInstallE2eTauriMocks() { }; const now = new Date().toISOString(); const existing = mockPersonas.find((p) => p.id === dTag); + const shared = nostrEvent.tags.some( + (tag) => + tag.length === 2 && tag[0] === "shared" && tag[1] === "true", + ); if (existing) { existing.display_name = content.display_name ?? existing.display_name; existing.system_prompt = content.system_prompt ?? existing.system_prompt; + existing.shared = shared; existing.updated_at = now; } else { mockPersonas.push({ @@ -10259,6 +10517,7 @@ export function maybeInstallE2eTauriMocks() { system_prompt: content.system_prompt ?? "", is_builtin: false, is_active: true, + shared, env_vars: {}, created_at: now, updated_at: now, @@ -10285,6 +10544,11 @@ export function maybeInstallE2eTauriMocks() { return handleSetPersonaActive( payload as Parameters[0], ); + case "set_persona_shared": + return handleSetPersonaShared( + payload as Parameters[0], + activeConfig, + ); case "list_teams": return handleListTeams(); case "list_channel_templates": @@ -10331,8 +10595,8 @@ export function maybeInstallE2eTauriMocks() { // Specs assert invocation via __BUZZ_E2E_COMMANDS__. return true; case "encode_agent_snapshot_for_send": { - // Return a minimal PNG-shaped payload so the send flow can proceed - // through upload_media_bytes without a real Rust encode step. + // Return the requested wire format so both message sharing (PNG) and + // community catalog publication (JSON) exercise their real branches. // Optional encodeDelayMs lets specs observe the "preparing" phase before // the upload begins. const encodeDelayMs = activeConfig?.mock?.encodeDelayMs ?? 0; @@ -10341,6 +10605,46 @@ export function maybeInstallE2eTauriMocks() { window.setTimeout(resolve, encodeDelayMs), ); } + const input = payload as { + id: string; + memoryLevel: "none" | "core" | "everything"; + format: "json" | "png"; + }; + if (input.format === "json") { + const persona = mockPersonas.find( + (candidate) => candidate.id === input.id, + ); + const snapshot = { + format: "buzz-agent-snapshot", + version: 1, + definition: { + name: persona?.display_name ?? "E2E Agent", + sourceIsBuiltIn: persona?.is_builtin ?? false, + systemPrompt: persona?.system_prompt ?? "", + runtime: persona?.runtime ?? null, + model: persona?.model ?? null, + provider: persona?.provider ?? null, + respondTo: persona?.respond_to ?? null, + respondToAllowlist: persona?.respond_to_allowlist ?? [], + namePool: persona?.name_pool ?? [], + }, + profile: { + displayName: persona?.display_name ?? "E2E Agent", + avatarUrl: persona?.avatar_url ?? null, + }, + memory: { + level: input.memoryLevel, + entries: [], + }, + }; + const fileBytes = Array.from( + new TextEncoder().encode(JSON.stringify(snapshot)), + ); + return { + fileBytes, + fileName: "e2e-agent.agent.json", + }; + } return { fileBytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], fileName: "e2e-agent.agent.png", @@ -10350,6 +10654,9 @@ export function maybeInstallE2eTauriMocks() { // Return a minimal preview — no writes performed. return { displayName: "Imported Agent", + isBuiltIn: true, + model: "claude-opus-4-5", + runtime: "goose", systemPrompt: null, avatarUrl: null, memoryLevel: "none", @@ -10861,7 +11168,10 @@ export function maybeInstallE2eTauriMocks() { case "pick_and_upload_image": return (await resolveMockUploadDescriptors(activeConfig))[0] ?? null; case "upload_media_bytes": - return (await resolveMockUploadDescriptors(activeConfig))[0]; + return resolveMockUploadDescriptorForBytes( + payload as { data: number[]; filename?: string | null }, + activeConfig, + ); case "fetch_media_bytes": { // The real command fetches relay media through Rust reqwest and // replies with raw bytes (`tauri::ipc::Response` → ArrayBuffer). In diff --git a/desktop/tests/e2e/agent-readiness-screenshots.spec.ts b/desktop/tests/e2e/agent-readiness-screenshots.spec.ts index 8f4c7d1478..a92efcd40a 100644 --- a/desktop/tests/e2e/agent-readiness-screenshots.spec.ts +++ b/desktop/tests/e2e/agent-readiness-screenshots.spec.ts @@ -18,7 +18,7 @@ async function openCreateDialog(page: import("@playwright/test").Page) { await page.goto("/"); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await page.locator("#persona-display-name").fill("Test Agent"); } diff --git a/desktop/tests/e2e/agent-snapshot-recipient.spec.ts b/desktop/tests/e2e/agent-snapshot-recipient.spec.ts index a20c649df4..9ce80593f1 100644 --- a/desktop/tests/e2e/agent-snapshot-recipient.spec.ts +++ b/desktop/tests/e2e/agent-snapshot-recipient.spec.ts @@ -271,6 +271,13 @@ test("recipient_import_navigates_to_agents_and_opens_preview", async ({ // Decoded display name must appear. await expect(dialog).toContainText("Imported Agent"); + const metadata = dialog.getByTestId("agent-definition-metadata"); + await expect(metadata).toContainText("Type"); + await expect(metadata).toContainText("Built-in agent"); + await expect(metadata).toContainText("Preferred model"); + await expect(metadata).toContainText("claude-opus-4-5"); + await expect(metadata).toContainText("Preferred runtime"); + await expect(metadata).toContainText("goose"); }); // ── Confirm imports the agent ───────────────────────────────────────────────── diff --git a/desktop/tests/e2e/agents.spec.ts b/desktop/tests/e2e/agents.spec.ts index 0579e98dad..2e7cdc9e83 100644 --- a/desktop/tests/e2e/agents.spec.ts +++ b/desktop/tests/e2e/agents.spec.ts @@ -1,8 +1,43 @@ import { expect, test } from "@playwright/test"; +import type { RelayEvent } from "@/shared/api/types"; + +import { emojiAvatarDataUrl } from "@/features/profile/ui/ProfileAvatarEditor.utils"; + import { waitForAnimations } from "../helpers/animations"; import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge"; +function createCatalogEvent(input: { + ownerPubkey: string; + sourcePersonaId: string; + displayName: string; + systemPrompt: string; + createdAt?: number; + shared?: boolean; + avatarUrl?: string; +}): RelayEvent { + return { + id: "1".repeat(64), + pubkey: input.ownerPubkey, + created_at: input.createdAt ?? 1_721_750_400, + kind: 30175, + tags: [ + ["d", input.sourcePersonaId], + ...(input.shared === false ? [] : [["shared", "true"]]), + ], + content: JSON.stringify({ + display_name: input.displayName, + system_prompt: input.systemPrompt, + avatar_url: input.avatarUrl ?? null, + runtime: null, + model: null, + provider: null, + name_pool: [], + }), + sig: "2".repeat(128), + }; +} + test.beforeEach(async ({ page }) => { await installMockBridge(page); }); @@ -32,7 +67,9 @@ async function gotoApp(page: import("@playwright/test").Page) { async function openPersonaCatalog(page: import("@playwright/test").Page) { await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Choose from catalog" }).click(); + await page + .getByRole("menuitem", { exact: true, name: "Discover agents" }) + .click(); } async function getCatalogOrder(page: import("@playwright/test").Page) { @@ -50,12 +87,19 @@ async function selectCatalogPersona( await page.getByTestId(`persona-catalog-list-item-${personaId}`).click(); } -async function useCatalogPersona( +async function sharePersonaToCatalog( page: import("@playwright/test").Page, - personaId: string, + displayName: string, ) { + await page.getByLabel(`Open actions for ${displayName}`).click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + await page.getByTestId("persona-share-catalog-access").click(); await page - .getByTestId(`persona-catalog-use-agent-target-${personaId}`) + .getByRole("menuitemradio", { name: "Shared", exact: true }) + .click(); + await page + .getByTestId("persona-share-dialog") + .getByRole("button", { name: "Close" }) .click(); } @@ -154,78 +198,86 @@ async function invokeTauriExpectError( ); } -test("built-in personas are used from the catalog dialog", async ({ page }) => { +async function countCommandInvocations( + page: import("@playwright/test").Page, + command: string, +): Promise { + return page.evaluate( + (targetCommand) => + ( + window as Window & { + __BUZZ_E2E_COMMANDS__?: string[]; + } + ).__BUZZ_E2E_COMMANDS__?.filter((invoked) => invoked === targetCommand) + .length ?? 0, + command, + ); +} + +test("catalog hides built-ins and shows the shared-agent empty state", async ({ + page, +}) => { await page.setViewportSize({ width: 1280, height: 420 }); + await installMockBridge(page, { + activePersonaIds: ["builtin:fizz", "builtin:honey", "builtin:bumble"], + }); await gotoApp(page); await page.getByTestId("open-agents-view").click(); await expect(page.getByTestId("agents-library-personas")).toBeVisible(); - await openPersonaCatalog(page); - await expect(page.getByTestId("persona-catalog-dialog")).toContainText( - "Fizz", - ); for (const personaName of ["Fizz", "Honey", "Bumble"]) { - await expect(page.getByTestId("persona-catalog-dialog")).toContainText( + await expect(page.getByTestId("agents-library-personas")).toContainText( personaName, ); } - for (const retiredPersonaName of [ - "Product Strategist", - "Implementation Partner", - "QA Reviewer", - "Work Coordinator", - "Support Guide", - "Experiment Designer", - ]) { + + await openPersonaCatalog(page); + for (const personaName of ["Fizz", "Honey", "Bumble"]) { await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText( - retiredPersonaName, + personaName, ); } await expect(page.getByTestId("persona-catalog-dialog-header")).toBeVisible(); - await expect( - page.getByTestId("persona-catalog-dialog-scroll-area"), - ).toBeVisible(); - await expect( - page.getByTestId("persona-catalog-dialog-scroll-area"), - ).toHaveCSS("overflow-y", "auto"); - const catalogScrollAreaMetrics = await page - .getByTestId("persona-catalog-dialog-scroll-area") - .evaluate((element) => ({ - clientHeight: element.clientHeight, - scrollHeight: element.scrollHeight, - })); - expect(catalogScrollAreaMetrics.clientHeight).toBeGreaterThan(0); - expect(catalogScrollAreaMetrics.scrollHeight).toBeGreaterThanOrEqual( - catalogScrollAreaMetrics.clientHeight, - ); await expect(page.getByTestId("persona-catalog-dialog-body")).toBeVisible(); - await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText( - "Done", - ); - await expect(page.getByRole("tooltip")).toHaveCount(0); - const initialCatalogOrder = await getCatalogOrder(page); - - await selectCatalogPersona(page, "builtin:fizz"); - await useCatalogPersona(page, "builtin:fizz"); + const emptyState = page.getByTestId("persona-catalog-empty-state"); + await expect(emptyState).toContainText("No agents are being shared"); await expect( - page - .locator("[data-sonner-toast]") - .filter({ hasText: "Selected Fizz for My Agents." }), + emptyState.getByTestId("persona-catalog-empty-agent-artwork"), ).toBeVisible(); - - await expect(page.getByTestId("agents-library-personas")).toContainText( - "Fizz", - ); await expect( - page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"), - ).toHaveText("Added to My Agents"); + page.locator('[data-testid^="persona-catalog-list-item-"]'), + ).toHaveCount(0); await expect( - page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"), - ).toBeDisabled(); - await expect(page.getByTestId("persona-catalog-dialog")).not.toContainText( - "Delete", + page.getByTestId("persona-catalog-use-agent-target"), + ).toHaveCount(0); + + await page + .getByTestId("persona-catalog-dialog") + .getByRole("button", { name: "Close" }) + .click(); + await page.getByLabel("Open actions for Fizz").click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + await expect(page.getByTestId("persona-share-catalog")).toHaveCount(0); + await expect(page.getByTestId("persona-share-catalog-access")).toHaveCount(0); +}); + +test("catalog empty state remains available after reopening", async ({ + page, +}) => { + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + await expect(page.getByTestId("persona-catalog-empty-state")).toBeVisible(); + + await page + .getByTestId("persona-catalog-dialog") + .getByRole("button", { name: "Close" }) + .click(); + await expect(page.getByTestId("persona-catalog-dialog")).not.toBeVisible(); + await openPersonaCatalog(page); + await expect(page.getByTestId("persona-catalog-empty-state")).toContainText( + "No agents are being shared", ); - await expect.poll(() => getCatalogOrder(page)).toEqual(initialCatalogOrder); }); test("built-in persona edits persist", async ({ page }) => { @@ -267,7 +319,9 @@ test("searches agent avatar emoji with focus on open", async ({ page }) => { await gotoApp(page); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page + .getByRole("menuitem", { exact: true, name: "Create agent" }) + .click(); await expect(page.getByTestId("persona-dialog")).toBeVisible(); await page.getByLabel("Add avatar").click(); @@ -292,7 +346,9 @@ test("agent avatar emoji picker scrolls inside its popover", async ({ await gotoApp(page); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page + .getByRole("menuitem", { exact: true, name: "Create agent" }) + .click(); await expect(page.getByTestId("persona-dialog")).toBeVisible(); await page.getByLabel("Add avatar").click(); @@ -329,70 +385,315 @@ test("agent avatar emoji picker scrolls inside its popover", async ({ .toBeGreaterThan(before); }); -test("agent catalog can reopen from the populated library header", async ({ +test("the new agent card offers create, discover, and import", async ({ page, }) => { + await installMockBridge(page, { + activePersonaIds: ["builtin:fizz", "builtin:honey", "builtin:bumble"], + personas: [ + { + id: "custom:code-reviewer", + displayName: "Code Reviewer", + systemPrompt: "Review code changes.", + }, + ], + }); await gotoApp(page); await page.getByTestId("open-agents-view").click(); - await openPersonaCatalog(page); - await selectCatalogPersona(page, "builtin:fizz"); - await useCatalogPersona(page, "builtin:fizz"); - await expect(page.getByTestId("agents-library-personas")).toContainText( - "Fizz", - ); + const newAgentCard = page.getByTestId("new-agent-card"); + await expect(newAgentCard).toHaveText(""); + await expect(newAgentCard.locator(".lucide-plus")).toBeVisible(); - await page.keyboard.press("Escape"); - await openPersonaCatalog(page); + const agentCards = page.locator( + '[data-testid^="persona-agent-row-"], [data-testid="new-agent-card"]', + ); + await expect(agentCards.first()).toBeVisible(); + const headerBox = await page + .getByRole("heading", { level: 1, name: "Agents" }) + .locator("../..") + .boundingBox(); + const cardBoxes = await agentCards.evaluateAll((cards) => + cards.map((card) => { + const box = card.getBoundingClientRect(); + return { right: box.right, top: box.top }; + }), + ); + const firstRowTop = Math.min(...cardBoxes.map(({ top }) => top)); + const rightmostFirstRowCard = Math.max( + ...cardBoxes + .filter(({ top }) => Math.abs(top - firstRowTop) < 1) + .map(({ right }) => right), + ); + expect(headerBox).not.toBeNull(); + expect( + Math.abs( + (headerBox?.x ?? 0) + (headerBox?.width ?? 0) - rightmostFirstRowCard, + ), + ).toBeLessThan(1); + await newAgentCard.click(); + await expect( + page.getByRole("menuitem", { exact: true, name: "Create agent" }), + ).toBeVisible(); + await expect( + page.getByRole("menuitem", { exact: true, name: "Discover agents" }), + ).toBeVisible(); + await expect( + page.getByRole("menuitem", { exact: true, name: "Import" }), + ).toBeVisible(); + await page + .getByRole("menuitem", { exact: true, name: "Discover agents" }) + .click(); await expect(page.getByTestId("persona-catalog-dialog")).toBeVisible(); - await selectCatalogPersona(page, "builtin:fizz"); + await page + .getByTestId("persona-catalog-dialog") + .getByRole("button", { name: "Close" }) + .click(); + await newAgentCard.click(); + await page + .getByRole("menuitem", { exact: true, name: "Create agent" }) + .click(); + + const dialog = page.getByTestId("persona-dialog"); + await expect(dialog).toBeVisible(); await expect( - page.getByTestId("persona-catalog-use-agent-target-builtin:fizz"), - ).toBeDisabled(); + dialog.getByTestId("import-agent-snapshot-dialog-action"), + ).toHaveCount(0); + await expect(dialog).not.toContainText("Enter a name for this agent."); + + await dialog.getByRole("button", { name: "Cancel" }).click(); + await newAgentCard.click(); + const fileChooserPromise = page.waitForEvent("filechooser"); + await page.getByRole("menuitem", { exact: true, name: "Import" }).click(); + const fileChooser = await fileChooserPromise; + await fileChooser.setFiles({ + buffer: Buffer.from("{}"), + mimeType: "application/json", + name: "imported.agent.json", + }); + await expect(page.getByTestId("agent-snapshot-import-dialog")).toBeVisible(); }); -test("agent catalog chooser order stays stable when selection changes", async ({ +test("the new team card offers create and import", async ({ page }) => { + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + + const newTeamCard = page.getByTestId("new-team-card"); + await expect(newTeamCard).toHaveText(""); + await expect(newTeamCard.locator(".lucide-plus")).toBeVisible(); + + await newTeamCard.click(); + await expect( + page.getByRole("menuitem", { exact: true, name: "Create team" }), + ).toBeVisible(); + await expect( + page.getByRole("menuitem", { exact: true, name: "Import" }), + ).toBeVisible(); +}); + +test("team cards use the thread-style overlapping avatar stack", async ({ page, }) => { + const personaIds = ["custom:design", "custom:build", "custom:ship"]; + await installMockBridge(page, { + personas: [ + { + avatarUrl: "/onboarding/starter-team/fizz.png", + id: personaIds[0], + displayName: "Design", + systemPrompt: "You design interfaces.", + }, + { + id: personaIds[1], + displayName: "Build", + systemPrompt: "You build interfaces.", + }, + { + id: personaIds[2], + displayName: "Ship", + systemPrompt: "You ship interfaces.", + }, + ], + teams: [ + { + name: "Product crew", + personaIds, + }, + ], + }); await gotoApp(page); await page.getByTestId("open-agents-view").click(); - await openPersonaCatalog(page); - const before = await getCatalogOrder(page); + const stack = page.getByLabel("Product crew member avatars"); + const avatars = stack.locator('[data-team-member-avatar="avatar"]'); + await expect(avatars).toHaveCount(3); + await expect(avatars.nth(1)).toHaveClass(/-ml-5/); + await expect(avatars.nth(2)).toHaveClass(/-ml-5/); + + const boxes = await avatars.evaluateAll((elements) => + elements.map((element) => { + const box = element.getBoundingClientRect(); + return { left: box.left, right: box.right }; + }), + ); + expect(boxes[1]?.left).toBeLessThan(boxes[0]?.right ?? 0); + expect(boxes[2]?.left).toBeLessThan(boxes[1]?.right ?? 0); + await expect(avatars.first()).not.toHaveCSS("mask-image", "none"); + await expect(avatars.last()).toHaveCSS("mask-image", "none"); + const avatarSurfaceStyles = await avatars + .locator(":scope > *") + .evaluateAll((elements) => + elements.map((element) => { + const styles = getComputedStyle(element); + const hasVisibleShadow = [ + ...styles.boxShadow.matchAll(/rgba?\(([^)]+)\)/g), + ].some((match) => { + if (match[0].startsWith("rgb(")) return true; + const channels = match[1]?.split(/[\s,/]+/).filter(Boolean) ?? []; + return Number(channels.at(-1)) > 0; + }); + return { + borderWidth: styles.borderTopWidth, + hasVisibleShadow, + }; + }), + ); + expect(avatarSurfaceStyles).toEqual([ + { borderWidth: "0px", hasVisibleShadow: false }, + { borderWidth: "0px", hasVisibleShadow: false }, + { borderWidth: "0px", hasVisibleShadow: false }, + ]); +}); - await selectCatalogPersona(page, "builtin:fizz"); - await useCatalogPersona(page, "builtin:fizz"); +test("agent defaults stays in the header without an actions menu", async ({ + page, +}) => { + await installMockBridge(page, { + acpRuntimesCatalog: [ + { + auth_status: { status: "logged_in" }, + availability: "available", + avatar_url: "", + binary_path: "/usr/local/bin/codex", + can_auto_install: false, + command: "codex", + default_args: [], + id: "codex", + install_hint: "", + install_instructions_url: "https://example.com", + label: "Codex", + login_hint: null, + mcp_command: null, + node_required: false, + underlying_cli_path: null, + }, + ], + globalAgentConfig: { + env_vars: {}, + model: "gpt-5.5[high]", + preferred_runtime: "codex", + provider: null, + }, + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + + await expect(page.getByTestId("agent-header-actions-button")).toHaveCount(0); await expect( - page - .locator("[data-sonner-toast]") - .filter({ hasText: "Selected Fizz for My Agents." }), - ).toBeVisible(); + page.getByRole("menuitem", { name: "Import agent" }), + ).toHaveCount(0); + + const defaultsButton = page.getByTestId("agent-defaults-button"); + await expect(defaultsButton).toHaveText("Agent defaults"); + await defaultsButton.click(); + const defaultsDialog = page.getByTestId("agent-ai-defaults-dialog"); + await expect(defaultsDialog).toBeVisible(); + await expect( + defaultsDialog.getByTestId("global-agent-default-harness"), + ).toHaveAttribute("data-value", "codex"); + await expect( + defaultsDialog.getByTestId("global-agent-default-harness"), + ).toContainText("Codex"); + await expect( + defaultsDialog.getByTestId("global-agent-model"), + ).toHaveAttribute("data-value", "gpt-5.5[high]"); + await expect(defaultsDialog.getByTestId("global-agent-model")).toContainText( + "gpt-5.5[high]", + ); + await page.keyboard.press("Escape"); + await expect(defaultsDialog).toHaveCount(0); +}); + +test("unconfigured agent defaults use the setup label", async ({ page }) => { + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + + await expect(page.getByTestId("agent-defaults-button")).toHaveText( + "Set agent defaults", + ); +}); + +test("agent catalog chooser order stays stable when selection changes", async ({ + page, +}) => { + await installMockBridge(page, { + personas: [ + { + id: "custom:builder", + displayName: "Builder", + systemPrompt: "Build the requested change.", + }, + { + id: "custom:reviewer", + displayName: "Reviewer", + systemPrompt: "Review the requested change.", + }, + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await sharePersonaToCatalog(page, "Builder"); + await sharePersonaToCatalog(page, "Reviewer"); + await openPersonaCatalog(page); + const before = await getCatalogOrder(page); + await selectCatalogPersona(page, "custom:reviewer"); expect(await getCatalogOrder(page)).toEqual(before); }); test("catalog detail pane shows the full persona details", async ({ page }) => { + const personaId = "custom:researcher"; + await installMockBridge(page, { + personas: [ + { + id: personaId, + displayName: "Researcher", + systemPrompt: "Research the question and cite the evidence.", + }, + ], + }); await gotoApp(page); await page.getByTestId("open-agents-view").click(); + await sharePersonaToCatalog(page, "Researcher"); await openPersonaCatalog(page); - await selectCatalogPersona(page, "builtin:fizz"); + await selectCatalogPersona(page, personaId); const useAgentTarget = page.getByTestId( - "persona-catalog-use-agent-target-builtin:fizz", + `persona-catalog-use-agent-target-${personaId}`, ); await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( - "Fizz", + "Researcher", ); - await expect( - page.getByTestId("persona-catalog-detail-pane"), - ).not.toContainText("Added by You"); await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( - "You are Fizz.", + "Added by You", ); await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( - "Built-in agent", + "Research the question and cite the evidence.", + ); + await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( + "Custom agent", ); await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( "Preferred model", @@ -405,14 +706,10 @@ test("catalog detail pane shows the full persona details", async ({ page }) => { ); await expect(useAgentTarget).toHaveAttribute( "aria-label", - "Add Fizz from Agent Catalog", - ); - await expect(useAgentTarget).toHaveText("Add agent"); - - await useAgentTarget.click(); - await expect(page.getByTestId("agents-library-personas")).toContainText( - "Fizz", + "Researcher is already in My Agents", ); + await expect(useAgentTarget).toHaveText("Added to My Agents"); + await expect(useAgentTarget).toBeDisabled(); }); type AgentShareCommand = { command: string; payload: unknown }; @@ -586,80 +883,99 @@ test("custom personas share with people and keep export separate", async ({ ).toHaveCount(0); await expect(shareDialog.getByText("Owner", { exact: true })).toHaveCount(0); await expect(shareDialog.getByText("(You)", { exact: true })).toHaveCount(0); - const copyLinkFooter = page.getByTestId("persona-share-copy-link-footer"); + const linkRow = page.getByTestId("persona-share-link-row"); await expect( - copyLinkFooter.getByRole("heading", { name: "Share with a link" }), + linkRow.getByRole("heading", { name: "Share with a link" }), ).toBeVisible(); await expect( - copyLinkFooter.getByText("Anyone with the link can add and use a copy."), + linkRow.getByText("Anyone with the link can add and use a copy."), ).toHaveClass(/text-xs.*text-secondary-foreground\/75/); await expect(page.getByTestId("persona-share-send")).toHaveCount(0); const copyLinkButton = page.getByTestId("persona-share-copy-link"); - const linkRow = page.getByTestId("persona-share-link-row"); const linkIcon = page.getByTestId("persona-share-link-icon"); const linkCopy = page.getByTestId("persona-share-link-copy"); - const linkDivider = page.getByTestId("persona-share-link-divider"); - const staticLinkAccess = page.getByTestId("persona-share-link-access"); + const catalogSection = page.getByTestId("persona-share-catalog"); + const staticShareLevel = page.getByTestId("persona-share-share-level"); + const shareLevelRow = page.getByTestId("persona-share-share-level-row"); await waitForAnimations(page); const [ linkRowBox, initialCopyLinkButtonBox, linkIconBox, linkCopyBox, - linkDividerBox, - staticLinkAccessBox, + catalogSectionBox, + staticShareLevelBox, + shareLevelRowBox, ] = await Promise.all([ linkRow.boundingBox(), copyLinkButton.boundingBox(), linkIcon.boundingBox(), linkCopy.boundingBox(), - linkDivider.boundingBox(), - staticLinkAccess.boundingBox(), + catalogSection.boundingBox(), + staticShareLevel.boundingBox(), + shareLevelRow.boundingBox(), ]); const sendDescriptionBox = await sendDescription.boundingBox(); - expect((linkRowBox?.y ?? 0) - (sendDescriptionBox?.y ?? 0)).toBeGreaterThan( - (sendDescriptionBox?.height ?? 0) + 30, + const recipientFieldBox = await page + .getByTestId("persona-share-recipient-field") + .boundingBox(); + // Reading order: who → how it goes out → what's included → catalog. + expect(sendDescriptionBox?.y ?? 0).toBeGreaterThanOrEqual( + (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0), + ); + expect(linkRowBox?.y ?? 0).toBeGreaterThanOrEqual( + (sendDescriptionBox?.y ?? 0) + (sendDescriptionBox?.height ?? 0), + ); + expect(shareLevelRowBox?.y ?? 0).toBeGreaterThanOrEqual( + (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0), + ); + expect(catalogSectionBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareLevelRowBox?.y ?? 0) + (shareLevelRowBox?.height ?? 0), ); + // Copy link is the link row's own action, not a stranded footer button, so + // it rides on that row, vertically centred with the link icon and flush to + // the row's right edge. expect(initialCopyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual( - (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0) + 23, + linkRowBox?.y ?? 0, ); + expect( + (initialCopyLinkButtonBox?.y ?? 0) + + (initialCopyLinkButtonBox?.height ?? 0), + ).toBeLessThanOrEqual((linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0) + 1); expect( Math.abs( - (linkCopyBox?.y ?? 0) + - (linkCopyBox?.height ?? 0) / 2 - + (initialCopyLinkButtonBox?.y ?? 0) + + (initialCopyLinkButtonBox?.height ?? 0) / 2 - ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2), ), ).toBeLessThanOrEqual(1); - expect(linkDividerBox?.y ?? 0).toBeGreaterThan( - (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0), - ); - expect(linkDividerBox?.y ?? 0).toBeLessThan(initialCopyLinkButtonBox?.y ?? 0); expect( - Math.abs((linkDividerBox?.width ?? 0) - (linkRowBox?.width ?? 0)), + Math.abs( + (linkRowBox?.x ?? 0) + + (linkRowBox?.width ?? 0) - + ((initialCopyLinkButtonBox?.x ?? 0) + + (initialCopyLinkButtonBox?.width ?? 0)), + ), ).toBeLessThanOrEqual(1); - await expect(linkDivider).toHaveClass(/my-4.*bg-input\/40/); expect( Math.abs( (linkCopyBox?.y ?? 0) + (linkCopyBox?.height ?? 0) / 2 - - ((staticLinkAccessBox?.y ?? 0) + - (staticLinkAccessBox?.height ?? 0) / 2), + ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2), + ), + ).toBeLessThanOrEqual(1); + await expect(page.getByTestId("persona-share-link-divider")).toHaveCount(0); + await expect(page.getByTestId("persona-share-copy-link-footer")).toHaveCount( + 0, + ); + expect( + Math.abs( + (shareLevelRowBox?.y ?? 0) + + (shareLevelRowBox?.height ?? 0) / 2 - + ((staticShareLevelBox?.y ?? 0) + + (staticShareLevelBox?.height ?? 0) / 2), ), ).toBeLessThanOrEqual(1); - const shareMainCardForLinkSpacing = page.getByTestId( - "persona-share-main-card", - ); - const shareMainCardForLinkSpacingBox = - await shareMainCardForLinkSpacing.boundingBox(); - const gapAboveCopyLink = - (initialCopyLinkButtonBox?.y ?? 0) - - ((linkDividerBox?.y ?? 0) + (linkDividerBox?.height ?? 0)); - const gapBelowCopyLink = - (shareMainCardForLinkSpacingBox?.y ?? 0) + - (shareMainCardForLinkSpacingBox?.height ?? 0) - - ((initialCopyLinkButtonBox?.y ?? 0) + - (initialCopyLinkButtonBox?.height ?? 0)); - expect(Math.abs(gapAboveCopyLink - gapBelowCopyLink)).toBeLessThanOrEqual(1); await expect(copyLinkButton).toHaveClass( /border.*bg-background.*border-border/, ); @@ -676,21 +992,28 @@ test("custom personas share with people and keep export separate", async ({ await expect.poll(copyLinkHasVisibleShadow).toBe(false); await copyLinkButton.hover(); await expect.poll(copyLinkHasVisibleShadow).toBe(false); - await expect(page.getByTestId("persona-share-link-access")).toHaveText( - "Agent only", + await expect(page.getByTestId("persona-share-share-level")).toHaveText( + "No memories included", ); + await expect( + shareDialog.getByText("No memories included", { exact: true }), + ).toHaveCount(1); await expect(page.getByTestId("persona-share-recipient-access")).toHaveCount( 0, ); + await expect(page.getByTestId("persona-share-link-access")).toHaveCount(0); await expect( shareDialog.getByLabel("What to include in the link"), ).toHaveCount(0); await expect( shareDialog.getByLabel("What to include", { exact: true }), ).toHaveCount(0); - await expect(shareDialog.getByText("Memories")).toHaveCount(0); - await expect(shareDialog.getByText("File format")).toHaveCount(0); - await expect(page.getByText("Show in my catalog")).toHaveCount(0); + await expect(shareDialog.getByText("Memories", { exact: true })).toHaveCount( + 0, + ); + await expect( + shareDialog.getByText("File format", { exact: true }), + ).toHaveCount(0); const shareMainCard = page.getByTestId("persona-share-main-card"); const exportAgentRow = page.getByTestId("persona-share-export"); await expect(exportAgentRow).toHaveText("Export agent"); @@ -723,6 +1046,9 @@ test("custom personas share with people and keep export separate", async ({ expect(exportAgentRowShadow).toBe(shareMainCardShadow); expect(exportAgentRowShadow).not.toBe("none"); await expect(exportAgentRow).toHaveCSS("position", "relative"); + expect(exportAgentRowBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0) + 12, + ); await expect(page.getByTestId("agent-snapshot-export-dialog")).toHaveCount(0); await exportAgentRow.click(); @@ -934,29 +1260,7 @@ test("custom personas share with people and keep export separate", async ({ page .getByTestId("persona-share-recipient-field") .getByTestId("persona-share-recipient-access"), - ).toHaveText("Agent only"); - const staticRecipientAccess = page.getByTestId( - "persona-share-recipient-access", - ); - const [ - staticRecipientAccessBox, - recipientAccessPaddingRight, - recipientFieldBox, - ] = await Promise.all([ - staticRecipientAccess.boundingBox(), - staticRecipientAccess.evaluate((element) => - Number.parseFloat(getComputedStyle(element).paddingRight), - ), - recipientField.boundingBox(), - ]); - const staticRecipientTextInset = - (recipientFieldBox?.x ?? 0) + - (recipientFieldBox?.width ?? 0) - - ((staticRecipientAccessBox?.x ?? 0) + - (staticRecipientAccessBox?.width ?? 0) - - recipientAccessPaddingRight); - expect(staticRecipientTextInset).toBeGreaterThanOrEqual(8); - expect(staticRecipientTextInset).toBeLessThanOrEqual(10); + ).toHaveCount(0); await expect(page.getByTestId("persona-share-send")).toBeVisible(); await recipientSearch.fill("bob"); @@ -1057,7 +1361,374 @@ test("custom personas share with people and keep export separate", async ({ await expect(shareDialog).toHaveCount(0); }); -test("share access controls include the selected memories", async ({ +test("custom personas can be shared to the relay catalog", async ({ page }) => { + const personaId = "custom:catalog-analyst"; + await installMockBridge(page, { + globalAgentConfig: { + env_vars: { ANTHROPIC_API_KEY: "sk-ant-test" }, + provider: "anthropic", + model: "claude-opus-4-5", + }, + personas: [ + { + id: personaId, + displayName: "Catalog Analyst", + respondTo: "allowlist", + respondToAllowlist: [TEST_IDENTITIES.alice.pubkey], + systemPrompt: `## Design System And Styling + +- For design-system changes, check the local guidance in \`DESIGN.md\`, \`docs/color-token-mapping.md\`, \`src/shared/ui/AGENTS.md\`, and \`src/features/design-system/AGENTS.md\` before judging the implementation. +- Check every changed visual surface in both light and dark mode. Missing dark-mode support is a review issue, not visual polish. +- Review the selected changes and explain whether \`git diff --cached --name-only --some-extremely-long-inline-option-that-must-wrap\` stays inside the catalog detail column. + +\`\`\`text +This deliberately long fenced-code example must not establish the minimum width of the full custom-agent instruction document or force earlier prose outside the catalog detail pane. +\`\`\` + +| Before | After | Why | +| --- | --- | --- | +| \`transition: all 300ms\` | \`transition: transform 200ms ease-out\` | Specify exact properties so a wide instruction table stays independently scrollable without expanding the full catalog detail pane. | +| \`transform: scale(0)\` | \`transform: scale(0.95); opacity: 0\` | Preserve physicality while keeping the shared agent instructions inside their container. |`, + }, + ], + }); + await gotoApp(page); + await page.evaluate(() => { + document.documentElement.style.fontSize = "24px"; + }); + + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + await expect( + page.getByTestId(`persona-catalog-list-item-${personaId}`), + ).toHaveCount(0); + await page.keyboard.press("Escape"); + + await page.getByLabel("Open actions for Catalog Analyst").click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + const catalogAccess = page.getByTestId("persona-share-catalog-access"); + const shareDialog = page.getByTestId("persona-share-dialog"); + const shareMainCard = shareDialog.getByTestId("persona-share-main-card"); + const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link"); + const catalogSection = shareDialog.getByTestId("persona-share-catalog"); + await expect( + shareMainCard.getByTestId("persona-share-catalog"), + ).toBeVisible(); + await expect(catalogSection).toContainText("Share to catalog"); + await expect(catalogSection).toContainText( + "Anyone in this community can find and use a copy.", + ); + await expect(catalogSection).toContainText( + "Your agent instruction is shared as plaintext. Memories and secrets aren’t included.", + ); + const [copyLinkButtonBox, catalogSectionBox, shareMainCardBox] = + await Promise.all([ + copyLinkButton.boundingBox(), + catalogSection.boundingBox(), + shareMainCard.boundingBox(), + ]); + // Copy link belongs to the link row above, so the catalog is the section + // that closes the card rather than trailing an orphaned button. + expect( + (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0), + ).toBeLessThanOrEqual(catalogSectionBox?.y ?? 0); + expect( + (catalogSectionBox?.y ?? 0) + (catalogSectionBox?.height ?? 0), + ).toBeLessThanOrEqual( + (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0), + ); + await expect(catalogAccess).toHaveText("Not shared"); + await catalogAccess.click(); + await expect(page.getByRole("menuitemradio")).toHaveText([ + "Not shared", + "Shared", + ]); + await page + .getByRole("menuitemradio", { name: "Shared", exact: true }) + .click(); + await expect(catalogAccess).toHaveText("Shared"); + const storedPersonas = await invokeTauri< + Array<{ id: string; shared: boolean }> + >(page, "list_personas"); + expect( + storedPersonas.find((persona) => persona.id === personaId)?.shared, + ).toBe(true); + await page + .getByTestId("persona-share-dialog") + .getByRole("button", { name: "Close" }) + .click(); + + await openPersonaCatalog(page); + await expect( + page.getByTestId(`persona-catalog-list-item-${personaId}`), + ).toContainText("Catalog Analyst"); + await selectCatalogPersona(page, personaId); + const catalogDialog = page.getByTestId("persona-catalog-dialog"); + const catalogDetailPane = page.getByTestId("persona-catalog-detail-pane"); + await expect(catalogDetailPane).toContainText("Design System And Styling"); + await expect(catalogDialog).toBeVisible(); + await expect(catalogDetailPane).toBeVisible(); + await waitForAnimations(page); + const [catalogDialogRight, catalogDetailPaneRight] = await Promise.all([ + catalogDialog.evaluate((element) => element.getBoundingClientRect().right), + catalogDetailPane.evaluate( + (element) => element.getBoundingClientRect().right, + ), + ]); + expect(catalogDetailPaneRight).toBeLessThanOrEqual(catalogDialogRight); + expect( + await catalogDetailPane.evaluate( + (element) => element.scrollWidth - element.clientWidth, + ), + ).toBeLessThanOrEqual(1); + const catalogInstruction = catalogDetailPane.locator(".message-markdown"); + expect( + await catalogInstruction.evaluate( + (element) => element.scrollWidth - element.clientWidth, + ), + ).toBeLessThanOrEqual(1); + await page.keyboard.press("Escape"); + + await page.getByLabel("Open actions for Catalog Analyst").click(); + await page.getByRole("menuitem", { name: "Edit" }).click(); + const editDialog = page.getByTestId("persona-dialog"); + const catalogPublishNotice = editDialog.getByTestId( + "persona-dialog-catalog-publish-notice", + ); + await expect(catalogPublishNotice).toHaveCount(0); + await expect( + editDialog.getByRole("button", { name: "Save and publish" }), + ).toHaveCount(0); + await expect( + editDialog.getByRole("button", { name: "Save changes" }), + ).toBeVisible(); + await editDialog + .getByLabel("Agent instructions") + .fill("Review the latest catalog changes."); + await expect(catalogPublishNotice).toHaveText( + "This agent is in the community catalog. Your changes will be published when you save.", + ); + await expect( + editDialog.getByRole("button", { name: "Save changes" }), + ).toHaveCount(0); + await editDialog.getByRole("button", { name: "Save and publish" }).click(); + await expect(editDialog).toHaveCount(0); + // The promise in the button label is only kept by the command that awaits the + // relay; a plain `update_persona` merely enqueues a head best-effort. + await expect + .poll(() => countCommandInvocations(page, "update_persona_and_publish")) + .toBe(1); + expect(await countCommandInvocations(page, "update_persona")).toBe(0); + await expect( + page.getByText( + "Updated Catalog Analyst and published it to the community catalog.", + ), + ).toBeVisible(); + + await openPersonaCatalog(page); + await selectCatalogPersona(page, personaId); + await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( + "Review the latest catalog changes.", + ); + await page.keyboard.press("Escape"); + + await page.getByLabel("Open actions for Catalog Analyst").click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + await expect(catalogAccess).toHaveText("Shared"); + await catalogAccess.click(); + await page + .getByRole("menuitemradio", { name: "Not shared", exact: true }) + .click(); + await page + .getByTestId("persona-share-dialog") + .getByRole("button", { name: "Close" }) + .click(); + + await openPersonaCatalog(page); + await expect( + page.getByTestId(`persona-catalog-list-item-${personaId}`), + ).toHaveCount(0); +}); + +test("a queued catalog share is not presented as relay-published", async ({ + page, +}) => { + const personaId = "custom:queued-catalog-agent"; + await installMockBridge(page, { + personas: [ + { + id: personaId, + displayName: "Queued Catalog Agent", + systemPrompt: "Wait for relay acceptance.", + }, + ], + personaSharePublicationStatuses: ["queued"], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + + await page.getByLabel("Open actions for Queued Catalog Agent").click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + await page.getByTestId("persona-share-catalog-access").click(); + await page + .getByRole("menuitemradio", { name: "Shared", exact: true }) + .click(); + + await expect( + page.getByText( + "Sharing Queued Catalog Agent is queued. It will appear after the relay accepts the update.", + ), + ).toBeVisible(); + await page + .getByTestId("persona-share-dialog") + .getByRole("button", { name: "Close" }) + .click(); + + await openPersonaCatalog(page); + await expect( + page.getByTestId(`persona-catalog-list-item-${personaId}`), + ).toHaveCount(0); +}); + +test("a foreign reader does not receive an unshared kind 30175 persona", async ({ + page, +}) => { + const personaId = "private-reviewer"; + const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`; + await installMockBridge(page, { + personaCatalogEvents: [ + createCatalogEvent({ + ownerPubkey: TEST_IDENTITIES.alice.pubkey, + sourcePersonaId: personaId, + displayName: "Alice’s Private Reviewer", + systemPrompt: "This instruction must remain private.", + shared: false, + }), + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + + await expect( + page.getByTestId(`persona-catalog-list-item-${remoteCatalogId}`), + ).toHaveCount(0); + await expect(page.getByTestId("persona-catalog-empty-state")).toBeVisible(); +}); + +test("a catalog entry keeps the owner's emoji avatar", async ({ page }) => { + const personaId = "emoji-reviewer"; + const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`; + // Emoji avatars persist as inline percent-encoded SVG rather than a hosted + // URL, so build the value with the same producer the editor uses — a + // hand-rolled data URL would pass even if the real shape stopped matching. + const avatarUrl = emojiAvatarDataUrl("🐝", "#FFCC00"); + await installMockBridge(page, { + personaCatalogEvents: [ + createCatalogEvent({ + avatarUrl, + ownerPubkey: TEST_IDENTITIES.alice.pubkey, + sourcePersonaId: personaId, + displayName: "Alice’s Reviewer", + systemPrompt: "Review changes for the whole community.", + }), + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + + // An `` carrying the avatar — not the initials fallback — in both the + // list row and the detail header is what proves the projection kept it. + const remoteEntry = page.getByTestId( + `persona-catalog-list-item-${remoteCatalogId}`, + ); + await expect(remoteEntry.locator("img")).toHaveAttribute("src", avatarUrl); + await remoteEntry.click(); + await expect( + page.getByTestId("persona-catalog-detail-pane").locator("img").first(), + ).toHaveAttribute("src", avatarUrl); +}); + +test("a community member can discover and add another member's catalog agent", async ({ + page, +}) => { + const personaId = "shared-reviewer"; + const remoteCatalogId = `catalog:${TEST_IDENTITIES.alice.pubkey}:${personaId}`; + await installMockBridge(page, { + personaCatalogEvents: [ + createCatalogEvent({ + ownerPubkey: TEST_IDENTITIES.alice.pubkey, + sourcePersonaId: personaId, + displayName: "Alice’s Reviewer", + systemPrompt: "Review changes for the whole community.", + }), + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + + const remoteEntry = page.getByTestId( + `persona-catalog-list-item-${remoteCatalogId}`, + ); + await expect(remoteEntry).toContainText("Alice’s Reviewer"); + await remoteEntry.click(); + await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( + "Added by Community member", + ); + + await page + .getByRole("button", { + name: "Add Alice’s Reviewer from Agent Catalog", + }) + .click(); + await expect + .poll(() => countCommandInvocations(page, "create_persona")) + .toBe(1); + const imported = await invokeTauri< + Array<{ + display_name: string; + system_prompt: string; + shared: boolean; + catalog_source: { owner_pubkey: string; persona_id: string } | null; + }> + >(page, "list_personas"); + expect( + imported.find((persona) => persona.display_name === "Alice’s Reviewer"), + ).toMatchObject({ + system_prompt: "Review changes for the whole community.", + shared: false, + // Provenance is what lets the catalog recognise the copy on the next open. + catalog_source: { + owner_pubkey: TEST_IDENTITIES.alice.pubkey, + persona_id: personaId, + }, + }); + + // Reopening must offer the entry as already added rather than minting a + // second copy — the copy has a fresh local id, so only the stored + // coordinate can link it back to Alice's publication. + await page.keyboard.press("Escape"); + await openPersonaCatalog(page); + // The entry now projects onto the local copy, so its list-item testid is the + // local persona id rather than the catalog coordinate. + await expect( + page.getByTestId(`persona-catalog-list-item-${remoteCatalogId}`), + ).toHaveCount(0); + await page + .locator('[data-testid^="persona-catalog-list-item-"]') + .filter({ hasText: "Alice’s Reviewer" }) + .click(); + const addedTarget = page.getByRole("button", { + name: "Alice’s Reviewer is already in My Agents", + }); + await expect(addedTarget).toBeDisabled(); + await expect(addedTarget).toHaveText("Added to My Agents"); + expect(await countCommandInvocations(page, "create_persona")).toBe(1); +}); + +test("one share level selector drives both the link and send paths", async ({ page, }) => { await page.emulateMedia({ reducedMotion: "no-preference" }); @@ -1107,34 +1778,60 @@ test("share access controls include the selected memories", async ({ const initialShareCardHeight = await shareMainCard.evaluate( (element) => element.getBoundingClientRect().height, ); - const linkAccess = shareDialog.getByLabel("What to include in the link"); + const shareLevel = shareDialog.getByLabel("What to include", { + exact: true, + }); + const catalogAccess = shareDialog.getByLabel("What to share in the catalog"); const recipientField = page.getByTestId("persona-share-recipient-field"); const emptyRecipientFieldBox = await recipientField.boundingBox(); await expect(shareDialog.getByTestId("persona-share-send")).toHaveCount(0); - await expect(linkAccess).toHaveText("Agent only"); - expect((await linkAccess.boundingBox())?.width).toBeLessThan(120); - expect(await linkAccess.evaluate((element) => element.tagName)).toBe( + await expect(shareLevel).toHaveText("Agent only"); + expect((await shareLevel.boundingBox())?.width).toBeLessThan(140); + expect(await shareLevel.evaluate((element) => element.tagName)).toBe( "BUTTON", ); - await expect(linkAccess).toHaveCSS("text-decoration-line", "none"); - await expect(linkAccess).toHaveCSS("padding-left", "8px"); - await expect(linkAccess).toHaveCSS("padding-right", "8px"); - const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link"); - const [linkAccessBox, copyLinkButtonBox] = await Promise.all([ - linkAccess.boundingBox(), - copyLinkButton.boundingBox(), + await expect(shareLevel).toHaveCSS("text-decoration-line", "none"); + await expect(shareLevel).toHaveCSS("padding-left", "8px"); + await expect(shareLevel).toHaveCSS("padding-right", "8px"); + await expect(catalogAccess).toHaveText("Not shared"); + await catalogAccess.click(); + await expect(page.getByRole("menuitemradio")).toHaveText([ + "Not shared", + "Shared", ]); + await page.keyboard.press("Escape"); + const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link"); + const recipientFieldBox = await recipientField.boundingBox(); + const [shareLevelBox, copyLinkButtonBox, catalogAccessBox] = + await Promise.all([ + shareLevel.boundingBox(), + copyLinkButton.boundingBox(), + catalogAccess.boundingBox(), + ]); + // Reading order: who → how it goes out → what's included → catalog. expect(copyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual( - (linkAccessBox?.y ?? 0) + (linkAccessBox?.height ?? 0) + 8, + (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0), + ); + expect(shareLevelBox?.y ?? 0).toBeGreaterThanOrEqual( + (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0), + ); + expect(catalogAccessBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareLevelBox?.y ?? 0) + (shareLevelBox?.height ?? 0), ); + // The memory choice is stated once, governing both delivery actions — + // neither the recipients row nor the link row carries its own copy. await expect( - shareDialog.getByLabel("What to include", { exact: true }), + shareDialog.getByTestId("persona-share-recipient-access"), + ).toHaveCount(0); + await expect( + shareDialog.getByTestId("persona-share-link-access"), ).toHaveCount(0); + await expect(shareLevel).toHaveCount(1); await expect( shareDialog.getByTestId("persona-share-memory-warning"), ).toHaveCount(0); - await linkAccess.click(); + await shareLevel.click(); await expect(page.getByRole("menuitemradio")).toHaveText([ "Agent only", "Agent + core memory", @@ -1143,7 +1840,7 @@ test("share access controls include the selected memories", async ({ await page .getByRole("menuitemradio", { name: "Agent + core memory" }) .click(); - await expect(linkAccess).toHaveText("Agent + core memory"); + await expect(shareLevel).toHaveText("Agent + core memory"); await waitForAnimations(page); const expandedShareCardHeight = await shareMainCard.evaluate( (element) => element.getBoundingClientRect().height, @@ -1151,6 +1848,9 @@ test("share access controls include the selected memories", async ({ const inlineMemoryWarning = shareDialog.getByTestId( "persona-share-memory-warning", ); + // No recipient is selected yet: the warning tracks the chosen contents, not + // whichever delivery button might be pressed. + await expect(shareDialog.getByTestId("persona-share-send")).toHaveCount(0); await expect(inlineMemoryWarning).toBeVisible(); await expect(inlineMemoryWarning).toContainText( "Memory is stored as plaintext in the snapshot.", @@ -1193,11 +1893,11 @@ test("share access controls include the selected memories", async ({ await expect(page.getByTestId("persona-share-copy-link")).toContainText( "Copied", ); - await linkAccess.click(); + await shareLevel.click(); await page .getByRole("menuitemradio", { name: "Agent only", exact: true }) .click(); - await expect(linkAccess).toHaveText("Agent only"); + await expect(shareLevel).toHaveText("Agent only"); await expect(inlineMemoryWarning).toHaveCount(0); const recipientSearch = page.getByTestId("persona-share-recipient-search"); @@ -1210,11 +1910,6 @@ test("share access controls include the selected memories", async ({ const recipientInputRegion = recipientField.getByTestId( "persona-share-recipient-input-region", ); - const recipientAccess = recipientField.getByLabel("What to include", { - exact: true, - }); - await expect(recipientAccess).toHaveText("Agent only"); - expect((await recipientAccess.boundingBox())?.width).toBeLessThan(140); await expect(recipientField).toHaveCSS("column-gap", "12px"); await expect(recipientInputRegion).toHaveCSS("flex-wrap", "wrap"); const sendButton = shareDialog.getByTestId("persona-share-send"); @@ -1238,42 +1933,17 @@ test("share access controls include the selected memories", async ({ ); }) .toBeLessThanOrEqual(1); - const recipientInputRegionBox = await recipientInputRegion.boundingBox(); - const recipientAccessBox = await recipientAccess.boundingBox(); - expect( - (recipientAccessBox?.x ?? 0) - - ((recipientInputRegionBox?.x ?? 0) + - (recipientInputRegionBox?.width ?? 0)), - ).toBeGreaterThanOrEqual(12); - const recipientAccessRightEdge = - (recipientAccessBox?.x ?? 0) + (recipientAccessBox?.width ?? 0); - expect( - Math.abs( - (resizedRecipientFieldBox?.x ?? 0) + - (resizedRecipientFieldBox?.width ?? 0) - - 8 - - recipientAccessRightEdge, - ), - ).toBeLessThanOrEqual(8); - await recipientAccess.click(); + // Same single selector now drives the send path; picking a level here is + // what the send confirmation must report. + await shareLevel.click(); await page .getByRole("menuitemradio", { name: "Agent + all memories" }) .click(); - await expect(recipientAccess).toHaveText("Agent + all memories"); + await expect(shareLevel).toHaveText("Agent + all memories"); await expect(inlineMemoryWarning).toBeVisible(); await waitForAnimations(page); - await expect - .poll(async () => { - const expandedRecipientAccessBox = await recipientAccess.boundingBox(); - return Math.abs( - (expandedRecipientAccessBox?.x ?? 0) + - (expandedRecipientAccessBox?.width ?? 0) - - recipientAccessRightEdge, - ); - }) - .toBeLessThanOrEqual(1); expect( - await recipientAccess + await shareLevel .locator("span") .evaluate((element) => element.scrollWidth <= element.clientWidth), ).toBe(true); @@ -1594,19 +2264,16 @@ test("inactive built-ins cannot be used to create teams", async ({ page }) => { }, }); - expect(error).toBe( - "Honey is not in My Agents. Choose it from Agent Catalog first.", - ); + expect(error).toBe("Honey is not in My Agents."); }); test("built-in removal failures show up from My Agents", async ({ page }) => { + await installMockBridge(page, { + activePersonaIds: ["builtin:honey"], + }); await gotoApp(page); await page.getByTestId("open-agents-view").click(); - await openPersonaCatalog(page); - await selectCatalogPersona(page, "builtin:honey"); - await useCatalogPersona(page, "builtin:honey"); - await invokeTauri(page, "create_team", { input: { name: "Honeys", @@ -1614,7 +2281,6 @@ test("built-in removal failures show up from My Agents", async ({ page }) => { }, }); - await page.keyboard.press("Escape"); await page.getByLabel("Open actions for Honey").click(); await page.getByRole("menuitem", { name: "Delete" }).click(); diff --git a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts index 099c2cb752..7ec1daa236 100644 --- a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts +++ b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts @@ -32,7 +32,7 @@ async function openCreateDialog(page: import("@playwright/test").Page) { await page.goto("/"); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await page.locator("#persona-display-name").fill("Test Agent"); } @@ -712,7 +712,7 @@ test.describe("global agent config screenshots", () => { await page.goto("/"); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await expect(page.getByTestId("persona-dialog-submit")).toBeDisabled({ timeout: 10_000, diff --git a/desktop/tests/e2e/persona-env-vars.spec.ts b/desktop/tests/e2e/persona-env-vars.spec.ts index 53efa09a0e..1e9b077a82 100644 --- a/desktop/tests/e2e/persona-env-vars.spec.ts +++ b/desktop/tests/e2e/persona-env-vars.spec.ts @@ -267,10 +267,10 @@ test("env vars editor renders in PersonaDialog new-persona form", async ({ }) => { await gotoApp(page); - // Open the Agents view, click New > New agent to open the persona dialog. + // Open the Agents view, then choose Create agent from the new-agent menu. await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); // Scope all env-vars queries to the dialog: AgentDefaultsSettingsCard // also renders an EnvVarsEditor in the background settings pane (introduced @@ -315,7 +315,7 @@ test("persona model options follow the selected LLM provider", async ({ await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); const provider = page.locator("#persona-runtime"); await page.getByRole("tab", { name: "Customize for this agent" }).click(); diff --git a/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts b/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts index 38d1df0914..508b123d7f 100644 --- a/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts +++ b/desktop/tests/e2e/persona-model-combobox-screenshots.spec.ts @@ -36,7 +36,7 @@ async function openNewPersonaDialog(page: import("@playwright/test").Page) { }); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); const dialog = page.getByTestId("persona-dialog"); await expect(dialog).toBeVisible({ timeout: 8_000 }); diff --git a/desktop/tests/e2e/persona-sync.spec.ts b/desktop/tests/e2e/persona-sync.spec.ts index 5dfa7e1a16..84b24f7eb7 100644 --- a/desktop/tests/e2e/persona-sync.spec.ts +++ b/desktop/tests/e2e/persona-sync.spec.ts @@ -14,6 +14,10 @@ const TYLER_PUBKEY = const D_TAG = "sync-test-persona"; const KIND_PERSONA = 30175; const KIND_DELETION = 5; +// The command scopes an inbound event to the community it arrived on. Under the +// mock bridge the app subscribes on e2eBridge's DEFAULT_RELAY_WS_URL, so that is +// the arrival relay these direct invocations stand in for. +const ARRIVAL_RELAY_URL = "ws://localhost:3000"; test.beforeEach(async ({ page }) => { await installMockBridge(page); @@ -139,6 +143,7 @@ test("upsert round-trip: reconcile_inbound_persona_event writes record and emits // Drive the inbound reconcile path. await invokeTauri(page, "reconcile_inbound_persona_event", { eventJson: JSON.stringify(personaEvent), + arrivalRelayUrl: ARRIVAL_RELAY_URL, }); // Assert the record landed on disk. @@ -176,6 +181,7 @@ test("tombstone round-trip: reconcile_inbound_persona_event removes record and e await invokeTauri(page, "reconcile_inbound_persona_event", { eventJson: JSON.stringify(personaEvent), + arrivalRelayUrl: ARRIVAL_RELAY_URL, }); // Step 2: confirm it landed. @@ -202,6 +208,7 @@ test("tombstone round-trip: reconcile_inbound_persona_event removes record and e await invokeTauri(page, "reconcile_inbound_persona_event", { eventJson: JSON.stringify(tombstoneEvent), + arrivalRelayUrl: ARRIVAL_RELAY_URL, }); // Step 4: assert the record is gone. diff --git a/desktop/tests/e2e/smoke.spec.ts b/desktop/tests/e2e/smoke.spec.ts index bc32a31064..0f61de0f7c 100644 --- a/desktop/tests/e2e/smoke.spec.ts +++ b/desktop/tests/e2e/smoke.spec.ts @@ -138,7 +138,7 @@ test("Buzz shared compute explains automatic model selection", async ({ }); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await chooseSharedComputeProvider(page); await expect @@ -167,7 +167,7 @@ test("create agent persists Buzz shared compute with auto model", async ({ await page.goto("/"); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await page.locator("#persona-display-name").fill(agentName); await chooseSharedComputeProvider(page); @@ -211,7 +211,7 @@ test("create agent supports parallelism and system prompt overrides", async ({ await page.goto("/"); await page.getByTestId("open-agents-view").click(); await page.getByTestId("new-agent-card").click(); - await page.getByRole("menuitem", { name: "Create from scratch" }).click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); await page.locator("#persona-display-name").fill(agentName); await page diff --git a/desktop/tests/e2e/team-snapshot.spec.ts b/desktop/tests/e2e/team-snapshot.spec.ts index c04a040047..6246c7ac8c 100644 --- a/desktop/tests/e2e/team-snapshot.spec.ts +++ b/desktop/tests/e2e/team-snapshot.spec.ts @@ -271,7 +271,7 @@ test("team sharing uses the people picker and gates memory before sending", asyn `team-share-recipient-option-${TEST_IDENTITIES.charlie.pubkey}`, ) .click(); - await shareDialog.getByTestId("team-share-recipient-access").click(); + await shareDialog.getByTestId("team-share-share-level").click(); await page.getByRole("menuitemradio", { name: "Team + core memory" }).click(); await shareDialog.getByTestId("team-share-send").click(); @@ -311,6 +311,73 @@ test("team sharing uses the people picker and gates memory before sending", asyn expect(sendPayload?.content).not.toContain("![image]("); }); +test("team share level carries memories onto the link path too", async ({ + page, +}) => { + await page.context().grantPermissions(["clipboard-read", "clipboard-write"]); + await installMockBridge(page, { + personas: [ + { + id: ANALYST_PERSONA_ID, + displayName: "Analyst", + systemPrompt: "You are an analyst.", + }, + ], + managedAgents: [ + { + pubkey: ANALYST_PUBKEY, + name: "Analyst", + personaId: ANALYST_PERSONA_ID, + status: "running", + }, + ], + agentMemory: createMockAgentMemoryListing(), + uploadDescriptors: [MOCK_UPLOAD_DESCRIPTOR], + }); + await gotoAgentsPage(page); + + await page.getByLabel("Engineering team actions").click(); + await page.getByRole("menuitem", { name: "Share" }).click(); + const shareDialog = page.getByTestId("team-share-dialog"); + await expect(shareDialog).toBeVisible(); + + // No recipient selected — the copy-link path alone must still honour the + // shared selector and gate plaintext memories behind the confirmation. + await shareDialog.getByTestId("team-share-share-level").click(); + await page.getByRole("menuitemradio", { name: "Team + core memory" }).click(); + await expect( + shareDialog.getByTestId("team-share-memory-warning"), + ).toBeVisible(); + await shareDialog.getByTestId("team-share-copy-link").click(); + + const memoryConfirmation = page.getByTestId("team-share-memory-confirmation"); + await expect(memoryConfirmation).toBeVisible(); + await expect(memoryConfirmation).toContainText("plaintext core memory"); + await expect(memoryConfirmation).toContainText( + "Anyone with the link can view it.", + ); + const encodeLevelsBeforeConfirmation = (await readCommandLog(page)) + .filter((entry) => entry.command === "encode_team_snapshot_for_send") + .map( + (entry) => + (entry.payload as { memoryLevel?: string } | undefined)?.memoryLevel, + ); + expect(encodeLevelsBeforeConfirmation).toEqual([]); + + await memoryConfirmation.getByTestId("team-share-memory-confirm").click(); + await expect(shareDialog.getByTestId("team-share-copy-link")).toContainText( + "Copied", + ); + expect( + (await readCommandLog(page)).filter( + (entry) => + entry.command === "encode_team_snapshot_for_send" && + (entry.payload as { memoryLevel?: string } | undefined)?.memoryLevel === + "core", + ), + ).toHaveLength(1); +}); + test("team sharing keeps link copy and export in the shared surface", async ({ page, }) => { @@ -343,7 +410,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({ await menu.getByRole("menuitem", { name: "Share" }).click(); const shareDialog = page.getByTestId("team-share-dialog"); - await expect(shareDialog.getByTestId("team-share-link-access")).toHaveText( + await expect(shareDialog.getByTestId("team-share-share-level")).toHaveText( "Team only", ); const exportTeamRow = shareDialog.getByTestId("team-share-export"); @@ -351,7 +418,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({ const recipientSearch = shareDialog.getByTestId( "team-share-recipient-search", ); - const linkAccess = shareDialog.getByTestId("team-share-link-access"); + const shareLevel = shareDialog.getByTestId("team-share-share-level"); const closeButton = shareDialog.getByRole("button", { name: "Close" }); await waitForAnimations(page); await expect( @@ -363,7 +430,7 @@ test("team sharing keeps link copy and export in the shared surface", async ({ await expect(copyLinkButton).toContainText("Copying…"); await expect(copyLinkButton).toHaveCSS("opacity", "1"); await expect(recipientSearch).toBeEnabled(); - await expect(linkAccess).toBeEnabled(); + await expect(shareLevel).toBeEnabled(); await expect(closeButton).toBeDisabled(); await expect(exportTeamRow).toBeDisabled(); await expect(exportTeamRow).toHaveCSS("opacity", "1"); diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index d65a260f30..ca4d62ddd6 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -1,5 +1,5 @@ import type { Page } from "@playwright/test"; -import type { ChannelTemplate } from "../../src/shared/api/types"; +import type { ChannelTemplate, RelayEvent } from "../../src/shared/api/types"; import { FEATURE_OVERRIDES_STORAGE_KEY, PREVIEW_FEATURE_IDS } from "./features"; export const TEST_IDENTITIES = { @@ -88,7 +88,9 @@ type MockPersonaSeed = { displayName: string; avatarUrl?: string | null; systemPrompt: string; + updatedAt?: string; isActive?: boolean; + shared?: boolean; sourceTeam?: string | null; envVars?: Record; /** @@ -103,6 +105,8 @@ type MockPersonaSeed = { /** Provider pinned on the persona. Leave empty for Codex/Claude runtimes. */ provider?: string | null; namePool?: string[]; + respondTo?: "owner-only" | "allowlist" | "anyone"; + respondToAllowlist?: string[]; }; type MockTeamSeed = { @@ -220,6 +224,10 @@ type MockBridgeOptions = { | "stopped"; }>; personas?: MockPersonaSeed[]; + /** Community catalog replaceable-event heads returned by relay queries. */ + personaCatalogEvents?: RelayEvent[]; + /** Outcomes for successive explicit persona share publications. */ + personaSharePublicationStatuses?: Array<"published" | "queued">; teams?: MockTeamSeed[]; relayAgents?: MockRelayAgentSeed[]; agentListDelayMs?: number; From 1e307e178a7b7fc157cde1ef0721ba1a69cbc274 Mon Sep 17 00:00:00 2001 From: Kalvin C Date: Tue, 28 Jul 2026 12:31:24 -0700 Subject: [PATCH 016/112] chore(compose): remove stale typesense env vars (#3332) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Search migrated to Postgres FTS (commit f8bbe6efc). The Typesense container was removed from compose.yml and the Helm chart, but the cleanup missed two template/config files: - `deploy/compose/.env.example`: `TYPESENSE_API_KEY` and `TYPESENSE_PORT` are dead — no typesense service exists in compose.yml and the relay binary no longer reads `TYPESENSE_API_KEY`. The `CHANGE_ME_RANDOM_API_KEY` placeholder was never consumed, so removing it also unbreaks the sed loop in the blog draft (one fewer no-op secret to generate). - `benchmarks/harbor-buzz-orchestra/scripts/benchmark.py`: generates a typesense_api_key in state and writes `TYPESENSE_API_KEY` to the .env file it creates. - *Editing this file caused the https://github.com/block/buzz/blob/main/.github/workflows/benchmark-harbor.yml linter ci checks to run, which seemingly haven't run before, so I needed fix the lint issues to pass this.* --------- Signed-off-by: Kalvin Chau Co-authored-by: npub1c4alndp82zyt9veaklm5d965quss79vlhk9awv7qu5erwhmf42qqlvc25c --- .../scripts/benchmark.py | 151 ++++++++++++------ .../scripts/run_leaderboard.py | 93 ++++++++--- .../src/harbor_buzz_orchestra/__init__.py | 10 +- .../src/harbor_buzz_orchestra/agent.py | 4 +- .../container_runtime.py | 72 ++++++--- .../src/harbor_buzz_testbed/buzz_cli.py | 1 + .../src/harbor_buzz_testbed/provisioner.py | 4 +- .../testbed/tests/test_benchmark.py | 31 +++- .../testbed/tests/test_keys.py | 7 +- .../testbed/tests/test_provisioner_live.py | 1 + .../testbed/tests/test_provisioner_unit.py | 15 +- .../harbor-buzz-orchestra/tests/conftest.py | 1 + .../harbor-buzz-orchestra/tests/test_agent.py | 6 +- .../tests/test_container_runtime.py | 48 +++--- .../tests/test_manifest.py | 2 + .../tests/test_run_leaderboard.py | 12 +- deploy/compose/.env.example | 2 - 17 files changed, 311 insertions(+), 149 deletions(-) diff --git a/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py b/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py index f1e91d022b..b6f5601a82 100755 --- a/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py +++ b/benchmarks/harbor-buzz-orchestra/scripts/benchmark.py @@ -84,51 +84,75 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace: ) problems = parser.add_mutually_exclusive_group() problems.add_argument( - "--dataset", "-d", default=None, + "--dataset", + "-d", + default=None, help=f"Registry dataset (default: {DEFAULT_DATASET})", ) problems.add_argument( "--path", "-p", type=Path, help="Local task or dataset directory" ) parser.add_argument( - "--include-task", "-i", action="append", default=[], + "--include-task", + "-i", + action="append", + default=[], help="Task name to include (glob, repeatable)", ) parser.add_argument( - "--exclude-task", "-x", action="append", default=[], + "--exclude-task", + "-x", + action="append", + default=[], help="Task name to exclude (glob, repeatable)", ) parser.add_argument( - "--attempts", "-k", type=int, default=DEFAULT_ATTEMPTS, + "--attempts", + "-k", + type=int, + default=DEFAULT_ATTEMPTS, help=f"Runs per problem (default: {DEFAULT_ATTEMPTS}, the leaderboard requirement)", ) parser.add_argument( - "--manifest", type=Path, default=DEFAULT_MANIFEST, + "--manifest", + type=Path, + default=DEFAULT_MANIFEST, help=f"Team manifest YAML (default: {DEFAULT_MANIFEST.name})", ) parser.add_argument( - "--endpoint-config", type=Path, default=DEFAULT_ENDPOINTS, + "--endpoint-config", + type=Path, + default=DEFAULT_ENDPOINTS, help=f"Endpoint provider/API-key mapping (default: {DEFAULT_ENDPOINTS.name})", ) - parser.add_argument("--n-concurrent", "-n", type=int, default=4, help="Concurrent trials") + parser.add_argument( + "--n-concurrent", "-n", type=int, default=4, help="Concurrent trials" + ) parser.add_argument( "--jobs-dir", type=Path, default=PACKAGE_ROOT / "jobs", help="Job output root" ) - parser.add_argument("--job-name", default=None, help="Job name (default: lb--)") parser.add_argument( - "--upload", action="store_true", help="Upload to Harbor Hub when the job finishes" + "--job-name", default=None, help="Job name (default: lb--)" + ) + parser.add_argument( + "--upload", + action="store_true", + help="Upload to Harbor Hub when the job finishes", ) parser.add_argument( - "--gui", action="store_true", + "--gui", + action="store_true", help="Open the Buzz desktop app as the benchmark user to watch the run live", ) parser.add_argument( - "--fresh", action="store_true", + "--fresh", + action="store_true", help="Reset first: drop the stack's Docker volumes and the benchmark " - "GUI's app state (keys in state.json are kept)", + "GUI's app state (keys in state.json are kept)", ) parser.add_argument( - "--dry-run", action="store_true", + "--dry-run", + action="store_true", help="Print the underlying harbor command and exit (no stack bring-up)", ) return parser.parse_args(argv) @@ -153,7 +177,6 @@ def load_state() -> dict[str, str]: "user_secret_key": user.secret_key, "postgres_password": secrets.token_urlsafe(24), "redis_password": secrets.token_urlsafe(24), - "typesense_api_key": secrets.token_hex(16), "s3_access_key": secrets.token_hex(10), "s3_secret_key": secrets.token_hex(20), "git_hook_hmac_secret": secrets.token_hex(32), @@ -202,7 +225,6 @@ def write_env_file(state: dict[str, str]) -> Path: "POSTGRES_USER": "buzz", "POSTGRES_PASSWORD": state["postgres_password"], "REDIS_PASSWORD": state["redis_password"], - "TYPESENSE_API_KEY": state["typesense_api_key"], "BUZZ_S3_ACCESS_KEY": state["s3_access_key"], "BUZZ_S3_SECRET_KEY": state["s3_secret_key"], "BUZZ_S3_BUCKET": "buzz-media", @@ -217,14 +239,11 @@ def write_env_file(state: dict[str, str]) -> Path: def postgres_dsn(state: dict[str, str]) -> str: return ( - f"postgresql://buzz:{state['postgres_password']}" - f"@127.0.0.1:{PG_HOST_PORT}/buzz" + f"postgresql://buzz:{state['postgres_password']}@127.0.0.1:{PG_HOST_PORT}/buzz" ) -def write_provisioner_config( - state: dict[str, str], endpoint_config: Path -) -> Path: +def write_provisioner_config(state: dict[str, str], endpoint_config: Path) -> Path: """Resolve per-endpoint API keys from the environment and write the provisioner config: pinned user, keep-channels teardown.""" endpoints = json.loads(endpoint_config.read_text()) @@ -262,10 +281,14 @@ def write_provisioner_config( def compose_command(*args: str) -> list[str]: command = [ - "docker", "compose", - "--project-name", COMPOSE_PROJECT, - "--project-directory", str(STATE_DIR), - "--env-file", str(STATE_DIR / ".env"), + "docker", + "compose", + "--project-name", + COMPOSE_PROJECT, + "--project-directory", + str(STATE_DIR), + "--env-file", + str(STATE_DIR / ".env"), ] for file in COMPOSE_FILES: command += ["-f", str(file)] @@ -360,7 +383,9 @@ def linux_triple() -> str: """The musl triple matching the Docker engine that runs task containers.""" arch = subprocess.run( ["docker", "version", "--format", "{{.Server.Arch}}"], - capture_output=True, text=True, check=True, + capture_output=True, + text=True, + check=True, ).stdout.strip() try: return { @@ -385,22 +410,32 @@ def ensure_agent_binaries() -> Path: targets = AGENT_BINARIES + (FORWARDER_BINARY,) if all((bin_dir / name).is_file() for name in targets): return bin_dir - print(f"Linux agent binaries missing — cross-building for {triple} " - f"in {RUST_IMAGE} (first run only, ~2 min)...") + print( + f"Linux agent binaries missing — cross-building for {triple} " + f"in {RUST_IMAGE} (first run only, ~2 min)..." + ) LINUX_TARGET_DIR.mkdir(parents=True, exist_ok=True) (STATE_DIR / "cargo-registry").mkdir(exist_ok=True) packages = [arg for name in AGENT_BINARIES for arg in ("-p", name)] forwarder_src = FORWARDER_SOURCE.relative_to(REPO_ROOT) subprocess.run( [ - "docker", "run", "--rm", - "-v", f"{REPO_ROOT}:/src:ro", - "-v", f"{LINUX_TARGET_DIR}:/target", - "-v", f"{STATE_DIR / 'cargo-registry'}:/usr/local/cargo/registry", - "-e", "CARGO_TARGET_DIR=/target", - "-w", "/src", + "docker", + "run", + "--rm", + "-v", + f"{REPO_ROOT}:/src:ro", + "-v", + f"{LINUX_TARGET_DIR}:/target", + "-v", + f"{STATE_DIR / 'cargo-registry'}:/usr/local/cargo/registry", + "-e", + "CARGO_TARGET_DIR=/target", + "-w", + "/src", RUST_IMAGE, - "sh", "-c", + "sh", + "-c", "apk add --no-cache musl-dev >/dev/null && " f"cargo build --release --locked --target {triple} " + " ".join(packages) @@ -429,8 +464,13 @@ def launch_gui(state: dict[str, str]) -> subprocess.Popen: """ subprocess.run( compose_command( - "exec", "-T", "relay", - "buzz-admin", "add-member", "--pubkey", state["user_pubkey"], + "exec", + "-T", + "relay", + "buzz-admin", + "add-member", + "--pubkey", + state["user_pubkey"], ), check=True, ) @@ -445,12 +485,20 @@ def launch_gui(state: dict[str, str]) -> subprocess.Popen: ["rustc", "-vV"], capture_output=True, text=True, check=True ).stdout triple = next( - line.split(": ", 1)[1] for line in target.splitlines() if line.startswith("host: ") + line.split(": ", 1)[1] + for line in target.splitlines() + if line.startswith("host: ") ) sidecar_dir = desktop_dir / "src-tauri" / "binaries" sidecar_dir.mkdir(parents=True, exist_ok=True) binaries = ensure_binaries() - for name in ("buzz-acp", "buzz-agent", "buzz-dev-mcp", "git-credential-nostr", "buzz"): + for name in ( + "buzz-acp", + "buzz-agent", + "buzz-dev-mcp", + "git-credential-nostr", + "buzz", + ): stub = sidecar_dir / f"{name}-{triple}" if not stub.exists(): stub.touch() @@ -498,21 +546,30 @@ def leaderboard_argv( for pattern in args.exclude_task: argv += ["--exclude-task", pattern] argv += [ - "--attempts", str(args.attempts), - "--manifest", str(args.manifest), - "--endpoint-config", str(args.endpoint_config), - "--provisioner-config", str(provisioner_config), - "--agent-bin-dir", str(agent_bin_dir), + "--attempts", + str(args.attempts), + "--manifest", + str(args.manifest), + "--endpoint-config", + str(args.endpoint_config), + "--provisioner-config", + str(provisioner_config), + "--agent-bin-dir", + str(agent_bin_dir), # The relay as reachable from inside a task container: Docker's # host alias, bridged to the canonical localhost address by the # uploaded forwarder. Override the alias with # BUZZ_BENCHMARK_DOCKER_HOST if your engine exposes the host # differently. "--relay-gateway", - f"{os.environ.get('BUZZ_BENCHMARK_DOCKER_HOST', 'host.docker.internal')}" - f":{RELAY_HTTP_PORT}", - "--n-concurrent", str(args.n_concurrent), - "--jobs-dir", str(args.jobs_dir), + ( + f"{os.environ.get('BUZZ_BENCHMARK_DOCKER_HOST', 'host.docker.internal')}" + f":{RELAY_HTTP_PORT}" + ), + "--n-concurrent", + str(args.n_concurrent), + "--jobs-dir", + str(args.jobs_dir), ] if args.job_name: argv += ["--job-name", args.job_name] diff --git a/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py b/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py index 6fd43ea6fb..6eaf8d6af0 100755 --- a/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py +++ b/benchmarks/harbor-buzz-orchestra/scripts/run_leaderboard.py @@ -45,64 +45,101 @@ # host-header tenant-bound, so agents must present its canonical Host). FORWARDER_BINARY = "relay-forwarder" -PROVIDER_ORGS = {"anthropic": "Anthropic", "openai": "OpenAI", "databricks": "Databricks"} +PROVIDER_ORGS = { + "anthropic": "Anthropic", + "openai": "OpenAI", + "databricks": "Databricks", +} def parse_args(argv: list[str] | None = None) -> argparse.Namespace: parser = argparse.ArgumentParser( - description=__doc__.splitlines()[0], formatter_class=argparse.RawDescriptionHelpFormatter + description=__doc__.splitlines()[0], + formatter_class=argparse.RawDescriptionHelpFormatter, ) problems = parser.add_mutually_exclusive_group(required=True) problems.add_argument( - "--dataset", "-d", help="Registry dataset (e.g. terminal-bench/terminal-bench-2-1)" + "--dataset", + "-d", + help="Registry dataset (e.g. terminal-bench/terminal-bench-2-1)", ) problems.add_argument( "--path", "-p", type=Path, help="Local task or dataset directory" ) parser.add_argument( - "--include-task", "-i", action="append", default=[], + "--include-task", + "-i", + action="append", + default=[], help="Task name to include from the dataset (glob, repeatable)", ) parser.add_argument( - "--exclude-task", "-x", action="append", default=[], + "--exclude-task", + "-x", + action="append", + default=[], help="Task name to exclude from the dataset (glob, repeatable)", ) parser.add_argument( - "--attempts", "-k", type=int, required=True, + "--attempts", + "-k", + type=int, + required=True, help="Runs per problem (leaderboards require 5)", ) - parser.add_argument("--manifest", type=Path, required=True, help="Team manifest YAML") parser.add_argument( - "--endpoint-config", type=Path, required=True, + "--manifest", type=Path, required=True, help="Team manifest YAML" + ) + parser.add_argument( + "--endpoint-config", + type=Path, + required=True, help="JSON mapping manifest endpoint names to providers/API keys", ) parser.add_argument( - "--provisioner-config", type=Path, required=True, + "--provisioner-config", + type=Path, + required=True, help="JSON config for the Buzz relay/Postgres provisioner", ) parser.add_argument( - "--buzz-bin-dir", type=Path, default=None, + "--buzz-bin-dir", + type=Path, + default=None, help="Directory with the host buzz CLI (default: repo target/release, then target/debug)", ) parser.add_argument( - "--agent-bin-dir", type=Path, required=True, + "--agent-bin-dir", + type=Path, + required=True, help="Directory with Linux builds of buzz-acp/buzz-agent/buzz-dev-mcp " "to upload into each task container", ) parser.add_argument( - "--relay-gateway", default="", + "--relay-gateway", + default="", help="host:port of the benchmark relay as reachable from inside the " "task container (e.g. host.docker.internal:3600). When set, a " "loopback forwarder from --agent-bin-dir bridges the canonical " "relay address to this gateway", ) - parser.add_argument("--n-concurrent", "-n", type=int, default=4, help="Concurrent trials") - parser.add_argument("--jobs-dir", type=Path, default=Path("jobs"), help="Job output root") - parser.add_argument("--job-name", default=None, help="Job name (default: lb--)") parser.add_argument( - "--upload", action="store_true", help="Upload to Harbor Hub when the job finishes" + "--n-concurrent", "-n", type=int, default=4, help="Concurrent trials" + ) + parser.add_argument( + "--jobs-dir", type=Path, default=Path("jobs"), help="Job output root" + ) + parser.add_argument( + "--job-name", default=None, help="Job name (default: lb--)" + ) + parser.add_argument( + "--upload", + action="store_true", + help="Upload to Harbor Hub when the job finishes", + ) + parser.add_argument( + "--dry-run", action="store_true", help="Print the harbor command and exit" ) - parser.add_argument("--dry-run", action="store_true", help="Print the harbor command and exit") return parser.parse_args(argv) @@ -110,7 +147,9 @@ def find_binaries(bin_dir: Path | None) -> dict[str, Path]: candidates = ( [bin_dir] if bin_dir is not None - else [PACKAGE_ROOT.parents[1] / "target" / kind for kind in ("release", "debug")] + else [ + PACKAGE_ROOT.parents[1] / "target" / kind for kind in ("release", "debug") + ] ) for candidate in candidates: found = {name: candidate / name for name in BINARIES} @@ -146,11 +185,17 @@ def build_command( resource override would fail leaderboard static validation, so none are accepted or forwarded.""" command = [ - "harbor", "run", "--yes", - "--job-name", args.job_name, - "--jobs-dir", str(args.jobs_dir), - "-k", str(args.attempts), - "--n-concurrent", str(args.n_concurrent), + "harbor", + "run", + "--yes", + "--job-name", + args.job_name, + "--jobs-dir", + str(args.jobs_dir), + "-k", + str(args.attempts), + "--n-concurrent", + str(args.n_concurrent), ] if args.dataset: command += ["--dataset", args.dataset] @@ -250,7 +295,7 @@ def main(argv: list[str] | None = None) -> int: f"{PACKAGE_ROOT / 'testbed'} {Path(__file__).resolve()} ..." ) - result = subprocess.run(command) + result = subprocess.run(command, check=False) job_dir = args.jobs_dir / args.job_name if result.returncode != 0: print(f"harbor run failed (exit {result.returncode}); job dir: {job_dir}") diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py index b423e8aa47..1b79d233b9 100644 --- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py +++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/__init__.py @@ -1,25 +1,25 @@ """Buzz orchestra custom agent for Harbor.""" from .agent import BuzzOrchestraAgent -from .manifest import ExperimentManifest, ManifestError -from .provisioning import AgentCredential, TrialHandle, TrialProvisioner -from .runtime import OrchestraRuntime, RuntimeResult from .container_runtime import ( BuzzContainerRuntime, EndpointLaunchConfig, RuntimeLaunchError, ) +from .manifest import ExperimentManifest, ManifestError +from .provisioning import AgentCredential, TrialHandle, TrialProvisioner +from .runtime import OrchestraRuntime, RuntimeResult __all__ = [ "AgentCredential", - "BuzzOrchestraAgent", "BuzzContainerRuntime", + "BuzzOrchestraAgent", "EndpointLaunchConfig", "ExperimentManifest", "ManifestError", "OrchestraRuntime", - "RuntimeResult", "RuntimeLaunchError", + "RuntimeResult", "TrialHandle", "TrialProvisioner", ] diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py index 6354e9a587..3d1c81364f 100644 --- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py +++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/agent.py @@ -9,10 +9,10 @@ from harbor.environments.base import BaseEnvironment from harbor.models.agent.context import AgentContext +from .container_runtime import BuzzContainerRuntime, EndpointLaunchConfig from .manifest import ExperimentManifest from .provisioning import TrialProvisioner from .runtime import OrchestraRuntime -from .container_runtime import BuzzContainerRuntime, EndpointLaunchConfig class BuzzOrchestraAgent(BaseAgent): @@ -83,7 +83,7 @@ def _load_mapping( except (OSError, json.JSONDecodeError) as error: raise ValueError(f"cannot load JSON config {path}: {error}") from error if not isinstance(value, dict): - raise ValueError(f"JSON config {path} must contain an object") + raise TypeError(f"JSON config {path} must contain an object") return value @classmethod diff --git a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py index 3909f081f5..149a5295a7 100644 --- a/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py +++ b/benchmarks/harbor-buzz-orchestra/src/harbor_buzz_orchestra/container_runtime.py @@ -24,7 +24,6 @@ from .provisioning import AgentCredential, TrialHandle from .runtime import RuntimeResult - DEFAULT_MAX_AGENT_ROUNDS = 32 # Container-side layout for the uploaded Buzz stack. REMOTE_ROOT = "/opt/buzz" @@ -128,12 +127,20 @@ async def run( if forwarder is not None: infra.append(forwarder) await self._buzz_json( - trial.user, trial, "users", "set-profile", "--name", + trial.user, + trial, + "users", + "set-profile", + "--name", trial.user.agent_id, ) for credential in trial.credentials: await self._buzz_json( - credential, trial, "users", "set-profile", "--name", + credential, + trial, + "users", + "set-profile", + "--name", credential.agent_id, ) agents.append( @@ -244,11 +251,17 @@ async def _start_forwarder( ) from error forwarder = _Agent( AgentCredential( - agent_id="relay-forwarder", role="infra", - nostr_secret_key="", nostr_pubkey="", nostr_auth_tag="", - llm_endpoint="", llm_api_key="", + agent_id="relay-forwarder", + role="infra", + nostr_secret_key="", + nostr_pubkey="", + nostr_auth_tag="", + llm_endpoint="", + llm_api_key="", ), - pid, log, log, + pid, + log, + log, ) deadline = asyncio.get_running_loop().time() + self.readiness_timeout_seconds while True: @@ -418,9 +431,14 @@ async def _wait_for_done( await self._raise_for_dead_agents(environment, agents) polls += 1 messages = await self._buzz_json( - trial.user, trial, - "messages", "get", "--channel", trial.channel_id, - "--limit", "100", + trial.user, + trial, + "messages", + "get", + "--channel", + trial.channel_id, + "--limit", + "100", ) for message in messages: if message.get("pubkey") == orchestrator.nostr_pubkey and str( @@ -451,9 +469,7 @@ async def _raise_for_dead_agents( ) @staticmethod - async def _stop_agents( - environment: BaseEnvironment, agents: list[_Agent] - ) -> None: + async def _stop_agents(environment: BaseEnvironment, agents: list[_Agent]) -> None: """Terminate every process of the uploaded stack (acp, agent, mcp).""" if not agents: return @@ -461,14 +477,14 @@ async def _stop_agents( # to exist in task images, the /proc filesystem is. sweep = ( "for d in /proc/[0-9]*; do " - f"grep -aq {REMOTE_BIN} \"$d/cmdline\" 2>/dev/null " - "&& kill -TERM \"${d#/proc/}\" 2>/dev/null; done; true" + f'grep -aq {REMOTE_BIN} "$d/cmdline" 2>/dev/null ' + '&& kill -TERM "${d#/proc/}" 2>/dev/null; done; true' ) try: await environment.exec(sweep) await asyncio.sleep(2) await environment.exec(sweep.replace("-TERM", "-KILL")) - except Exception: # noqa: BLE001 — environment may already be gone + except Exception: # noqa: S110, BLE001 — environment may already be gone pass async def _collect_logs( @@ -476,7 +492,7 @@ async def _collect_logs( ) -> None: try: await environment.download_dir(REMOTE_LOGS, trial_dir) - except Exception: # noqa: BLE001 — best effort; env may be torn down + except Exception: # noqa: S110, BLE001 — best effort; env may be torn down pass # -- Buzz CLI as the trial user / provisioning identities ------------------- @@ -506,9 +522,14 @@ async def _send( self, credential: AgentCredential, trial: TrialHandle, content: str ) -> None: await self._buzz_json( - credential, trial, - "messages", "send", "--channel", trial.channel_id, - "--content", content, + credential, + trial, + "messages", + "send", + "--channel", + trial.channel_id, + "--content", + content, ) async def _buzz_json( @@ -614,9 +635,11 @@ def _compose_system_prompt( "", f"You are `{credential.agent_id}` (pubkey `{credential.nostr_pubkey}`).", f"The team coordinates in Buzz channel `{trial.channel_id}`.", - f"Tasks come from the user `{trial.user.agent_id}` " - f"(pubkey `{trial.user.nostr_pubkey}`); address your final report " - "to them.", + ( + f"Tasks come from the user `{trial.user.agent_id}` " + f"(pubkey `{trial.user.nostr_pubkey}`); address your final report " + "to them." + ), "", "| Name | Role | Pubkey |", "|------|------|--------|", @@ -625,8 +648,7 @@ def _compose_system_prompt( if teammate.agent_id == credential.agent_id: continue lines.append( - f"| {teammate.agent_id} | {teammate.role} " - f"| `{teammate.nostr_pubkey}` |" + f"| {teammate.agent_id} | {teammate.role} | `{teammate.nostr_pubkey}` |" ) composed = persona + "\n".join(lines) + "\n" path = trial_dir / f"{credential.agent_id}.system-prompt.md" diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py index ed2bb31cc9..bd11f193ca 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/buzz_cli.py @@ -38,6 +38,7 @@ def run(self, *args: str) -> Any: capture_output=True, text=True, timeout=self._timeout, + check=False, env={ "BUZZ_RELAY_URL": self._relay_url, "BUZZ_PRIVATE_KEY": self._secret_key, diff --git a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py index cfda6b59fa..d8f380387d 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/src/harbor_buzz_testbed/provisioner.py @@ -44,7 +44,7 @@ class TestbedConfig: archive_on_teardown: bool = True -def provisioner_from_dict(config: dict[str, object]) -> "BuzzTrialProvisioner": +def provisioner_from_dict(config: dict[str, object]) -> BuzzTrialProvisioner: """Harbor CLI factory for a JSON-decoded testbed configuration.""" return BuzzTrialProvisioner(TestbedConfig(**config)) @@ -100,7 +100,7 @@ def teardown(self, handle: TrialHandle) -> None: cli = self._cli_for(handle.credentials[0]) try: cli.archive_channel(handle.channel_id) - except Exception as error: # noqa: BLE001 — idempotent re-teardown + except Exception as error: if "archived" not in str(error).lower(): raise with psycopg.connect(self._config.postgres_dsn) as conn: diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py index 2d88e339f5..e0c6d32ec4 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_benchmark.py @@ -37,8 +37,19 @@ def test_defaults_are_leaderboard_eligible(): def test_selectors_pass_through(): args = benchmark.parse_args( - ["--path", "/tmp/task", "-i", "cobol*", "-x", "flaky*", "-k", "1", - "--job-name", "smoke", "--dry-run"] + [ + "--path", + "/tmp/task", + "-i", + "cobol*", + "-x", + "flaky*", + "-k", + "1", + "--job-name", + "smoke", + "--dry-run", + ] ) argv = benchmark.leaderboard_argv(args, Path("p.json"), Path("b")) assert argv[argv.index("--path") + 1] == "/tmp/task" @@ -59,11 +70,15 @@ def test_state_is_generated_once_and_reused(state_dir): assert "user_pubkey" not in stored # derived, never persisted -def test_provisioner_config_pins_user_and_keeps_channels(state_dir, tmp_path, monkeypatch): +def test_provisioner_config_pins_user_and_keeps_channels( + state_dir, tmp_path, monkeypatch +): monkeypatch.setenv("FAKE_KEY_ENV", "sk-test") endpoints = tmp_path / "endpoints.json" endpoints.write_text( - json.dumps({"model-a": {"provider": "anthropic", "api_key_env": "FAKE_KEY_ENV"}}) + json.dumps( + {"model-a": {"provider": "anthropic", "api_key_env": "FAKE_KEY_ENV"}} + ) ) state = benchmark.load_state() path = benchmark.write_provisioner_config(state, endpoints) @@ -78,7 +93,9 @@ def test_provisioner_config_pins_user_and_keeps_channels(state_dir, tmp_path, mo assert config["relay_http_url"].startswith("http://localhost:") -def test_provisioner_config_missing_api_key_is_explicit(state_dir, tmp_path, monkeypatch): +def test_provisioner_config_missing_api_key_is_explicit( + state_dir, tmp_path, monkeypatch +): monkeypatch.delenv("MISSING_KEY_ENV", raising=False) endpoints = tmp_path / "endpoints.json" endpoints.write_text( @@ -91,9 +108,7 @@ def test_provisioner_config_missing_api_key_is_explicit(state_dir, tmp_path, mon def test_env_file_wires_owner_and_ports(state_dir): state = benchmark.load_state() env_path = benchmark.write_env_file(state) - env = dict( - line.split("=", 1) for line in env_path.read_text().splitlines() if line - ) + env = dict(line.split("=", 1) for line in env_path.read_text().splitlines() if line) assert env["RELAY_OWNER_PUBKEY"] == state["owner_pubkey"] assert env["BUZZ_HTTP_PORT"] == str(benchmark.RELAY_HTTP_PORT) assert env["BUZZ_PG_HOST_PORT"] == str(benchmark.PG_HOST_PORT) diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py index 0f82578369..0ac794e0fa 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_keys.py @@ -6,6 +6,7 @@ import json import coincurve + from harbor_buzz_testbed.keys import ( compute_auth_tag, encode_nsec, @@ -21,8 +22,10 @@ "auth", "f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9", "", - "20105c618d6e5d8f559cffb6f0d7a7b4f44f3a567e1be94c96378d45ac3625da" - "34c2e7357ea1d3ce980978334546b3e740c155e81b833ebe140d519d39ed8867", + ( + "20105c618d6e5d8f559cffb6f0d7a7b4f44f3a567e1be94c96378d45ac3625da" + "34c2e7357ea1d3ce980978334546b3e740c155e81b833ebe140d519d39ed8867" + ), ] diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py index 5a6b40d8cf..711b877ab4 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_live.py @@ -14,6 +14,7 @@ import psycopg import pytest + from harbor_buzz_testbed.buzz_cli import BuzzCli, BuzzCliError from harbor_buzz_testbed.provisioner import ( BuzzTrialProvisioner, diff --git a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py index 9620be4bc8..e784de5825 100644 --- a/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py +++ b/benchmarks/harbor-buzz-orchestra/testbed/tests/test_provisioner_unit.py @@ -7,6 +7,7 @@ import coincurve import pytest + from harbor_buzz_testbed.provisioner import ( BuzzTrialProvisioner, ProvisioningError, @@ -17,13 +18,13 @@ def config(**overrides) -> TestbedConfig: - defaults = dict( - relay_http_url="http://localhost:3000", - relay_ws_url="ws://host.docker.internal:3000", - owner_secret_key=OWNER_SECRET, - postgres_dsn="postgresql://unused", - llm_api_keys={"databricks/glm": "glm-key", "databricks/opus": "opus-key"}, - ) + defaults = { + "relay_http_url": "http://localhost:3000", + "relay_ws_url": "ws://host.docker.internal:3000", + "owner_secret_key": OWNER_SECRET, + "postgres_dsn": "postgresql://unused", + "llm_api_keys": {"databricks/glm": "glm-key", "databricks/opus": "opus-key"}, + } defaults.update(overrides) return TestbedConfig(**defaults) diff --git a/benchmarks/harbor-buzz-orchestra/tests/conftest.py b/benchmarks/harbor-buzz-orchestra/tests/conftest.py index bd0bcaf2dd..b1de094d76 100644 --- a/benchmarks/harbor-buzz-orchestra/tests/conftest.py +++ b/benchmarks/harbor-buzz-orchestra/tests/conftest.py @@ -1,4 +1,5 @@ from typing import Any + import pytest diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_agent.py b/benchmarks/harbor-buzz-orchestra/tests/test_agent.py index 62c6047ab3..b305344c51 100644 --- a/benchmarks/harbor-buzz-orchestra/tests/test_agent.py +++ b/benchmarks/harbor-buzz-orchestra/tests/test_agent.py @@ -1,7 +1,9 @@ from types import SimpleNamespace from uuid import uuid4 + import pytest from harbor.models.agent.context import AgentContext + from harbor_buzz_orchestra import ( AgentCredential, BuzzOrchestraAgent, @@ -73,9 +75,7 @@ async def run(self, **kwargs): async def test_agent_lifecycle_and_context(tmp_path, manifest_data): provisioner, runtime, context_id = Provisioner(), Runtime(), uuid4() - environment = SimpleNamespace( - context_id=context_id, environment_name="hello-world" - ) + environment = SimpleNamespace(context_id=context_id, environment_name="hello-world") agent = BuzzOrchestraAgent( logs_dir=tmp_path, manifest=manifest_data, diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py index 8669fe980c..ebf0eb4b5d 100644 --- a/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py +++ b/benchmarks/harbor-buzz-orchestra/tests/test_container_runtime.py @@ -8,8 +8,6 @@ import pytest from harbor.environments.base import ExecResult -from harbor_buzz_orchestra.manifest import ExperimentManifest -from harbor_buzz_orchestra.provisioning import AgentCredential, TrialHandle from harbor_buzz_orchestra.container_runtime import ( REMOTE_BIN, REMOTE_LOGS, @@ -17,6 +15,8 @@ EndpointLaunchConfig, RuntimeLaunchError, ) +from harbor_buzz_orchestra.manifest import ExperimentManifest +from harbor_buzz_orchestra.provisioning import AgentCredential, TrialHandle def write_manifest(tmp_path: Path) -> ExperimentManifest: @@ -33,10 +33,20 @@ def write_manifest(tmp_path: Path) -> ExperimentManifest: { "condition": "test", "roster": [ - {"id": "orch", "kind": "orchestrator", "role": "lead", - "endpoint": "orch-model", **roster_entry}, - {"id": "worker", "kind": "worker", "role": "implementer", - "endpoint": "worker-model", **roster_entry}, + { + "id": "orch", + "kind": "orchestrator", + "role": "lead", + "endpoint": "orch-model", + **roster_entry, + }, + { + "id": "worker", + "kind": "worker", + "role": "implementer", + "endpoint": "worker-model", + **roster_entry, + }, ], "prices": { name: { @@ -162,10 +172,7 @@ def test_user_relay_url_prefers_host_view(tmp_path): == "http://localhost:3600" ) # pre-v1.2 handles fall back to deriving http from the agents' ws view. - assert ( - rt._user_relay_url(trial_handle(())) - == "http://host.docker.internal:3600" - ) + assert rt._user_relay_url(trial_handle(())) == "http://host.docker.internal:3600" with pytest.raises(RuntimeLaunchError, match="ws://"): rt._cli_relay_url("http://relay") @@ -209,16 +216,21 @@ async def test_forwarder_bridges_the_canonical_relay_address(tmp_path): forwarder_binary=str(forwarder), ) trial = TrialHandle( - run_id="run", trial_id="trial", manifest_hash="hash", - relay_ws_url="ws://localhost:3600", channel_id="channel", - credentials=(), user=user_credential(), + run_id="run", + trial_id="trial", + manifest_hash="hash", + relay_ws_url="ws://localhost:3600", + channel_id="channel", + credentials=(), + user=user_credential(), ) environment = Environment( responses={ FORWARDER: ExecResult(stdout="99\n", stderr="", return_code=0), "cat ": ExecResult( stdout="forwarding 127.0.0.1:3600 -> host.docker.internal:3600", - stderr="", return_code=0, + stderr="", + return_code=0, ), } ) @@ -295,9 +307,7 @@ class ReadyEnvironment(Environment): async def exec(self, command, env=None, **kwargs): if command.startswith("cat "): agent_id = re.search(r"([\w-]+)\.stdout\.log", command).group(1) - return ExecResult( - stdout=logs[agent_id], stderr="", return_code=0 - ) + return ExecResult(stdout=logs[agent_id], stderr="", return_code=0) return ExecResult(stdout="", stderr="", return_code=0) from harbor_buzz_orchestra.container_runtime import _Agent @@ -326,9 +336,7 @@ async def exec(self, command, env=None, **kwargs): async def test_dead_agent_processes_fail_the_trial(tmp_path): from harbor_buzz_orchestra.container_runtime import _Agent - agents = [ - _Agent(credential("worker-1", "worker", "worker-model"), 7, "o", "e") - ] + agents = [_Agent(credential("worker-1", "worker", "worker-model"), 7, "o", "e")] environment = Environment( responses={ "kill -0": ExecResult(stdout="DEAD:worker-1\n", stderr="", return_code=0) diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py b/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py index 36533db3bf..f8230036b3 100644 --- a/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py +++ b/benchmarks/harbor-buzz-orchestra/tests/test_manifest.py @@ -1,6 +1,8 @@ import copy + import pytest import yaml + from harbor_buzz_orchestra import ExperimentManifest, ManifestError diff --git a/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py b/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py index ed048ee5d9..451de72e79 100644 --- a/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py +++ b/benchmarks/harbor-buzz-orchestra/tests/test_run_leaderboard.py @@ -109,8 +109,16 @@ def test_forbidden_flags_are_not_accepted(tmp_path): for flag in FORBIDDEN_FLAGS: with pytest.raises(SystemExit): run_leaderboard.parse_args( - ["--dataset", "d", "--attempts", "5", - "--agent-bin-dir", str(tmp_path), flag, "1"] + [ + "--dataset", + "d", + "--attempts", + "5", + "--agent-bin-dir", + str(tmp_path), + flag, + "1", + ] ) diff --git a/deploy/compose/.env.example b/deploy/compose/.env.example index cebe879da0..838824c17f 100644 --- a/deploy/compose/.env.example +++ b/deploy/compose/.env.example @@ -30,7 +30,6 @@ POSTGRES_DB=buzz POSTGRES_USER=buzz POSTGRES_PASSWORD=CHANGE_ME_RANDOM_PASSWORD REDIS_PASSWORD=CHANGE_ME_RANDOM_PASSWORD -TYPESENSE_API_KEY=CHANGE_ME_RANDOM_API_KEY BUZZ_S3_ACCESS_KEY=CHANGE_ME_RANDOM_ACCESS_KEY BUZZ_S3_SECRET_KEY=CHANGE_ME_RANDOM_SECRET_KEY BUZZ_S3_BUCKET=buzz-media @@ -45,7 +44,6 @@ CADDY_HTTPS_PORT=443 # Dev override ports. Only used with compose.dev.yml. POSTGRES_PORT=5432 REDIS_PORT=6379 -TYPESENSE_PORT=8108 MINIO_API_PORT=9000 MINIO_CONSOLE_PORT=9001 ADMINER_PORT=8082 From b0503d80c298b1ece3b0a43b41d316829a3379e7 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Tue, 28 Jul 2026 16:01:41 -0400 Subject: [PATCH 017/112] feat(desktop): add custom harness inline from agent dialogs (#3252) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registering a custom ACP harness works today, but only from Settings → Agents. Anyone whose first touchpoint is "New agent" has no way to discover the custom path — the dropdown just lists the baked-in presets plus whatever was registered earlier. This adds an inline "Add custom harness…" entry to the harness dropdown in all three agent surfaces: create, edit-definition (`AgentDefinitionDialog`), and instance edit (`AgentInstanceEditDialog`). The entry is a sentinel option (`ADD_CUSTOM_HARNESS_VALUE`, NUL-prefixed so it can never collide with a real harness id — backend ids match `[a-z0-9_][a-z0-9_-]*`), mirroring the `CUSTOM_ENTRY_ID` trick already used in `HarnessCatalogDialog`. Picking it never writes into form state; it opens `AddCustomHarnessDialog`, a thin modal wrapper hosting the existing `CustomHarnessForm` in `chromeless` mode. `CustomHarnessForm`'s `onSaved` now carries the saved `definition.id` (the form may rewrite it); the two existing call sites ignore the argument, so their behavior is unchanged. Selection after save is deferred rather than immediate. `usePendingHarnessSelection` holds the saved id until the runtime catalog actually publishes it via discovery, then selects it exactly once — so the dialog never selects an id it cannot render, and back-to-back registrations resolve correctly. The wait is scoped to the owning dialog's `open` state: both host dialogs stay mounted when closed, so an unpublished id is dropped on close rather than selecting into reset form state when discovery later catches up. Selection is routed through each dialog's normal dropdown change handler, so provider/model reset (and command pinning in the instance dialog) behave identically to a hand-picked harness. Dismissing the modal leaves the previous selection untouched. `AgentInstanceEditDialog`'s existing "Custom command" option is a different feature (ad-hoc command override vs. a registered reusable harness) and is untouched. Coverage is 16 unit tests in `addCustomHarness.test.mjs` (real React mount, following the existing `.test.mjs` pattern) plus 4 Playwright specs in `inline-custom-harness.spec.ts` covering all three surfaces end-to-end. Both suites were mutation-verified: treating the sentinel as a real selection, selecting before the catalog publishes, never clearing the pending id, ignoring the dialog's open state, and reversing latest-save-wins each turn the unit tests red; reverting the two dialog diffs turns all four e2e specs red. The `check-file-sizes.mjs` overrides for the two dialogs are ratcheted to their exact new counts (1048 and 1229) — verified tight in both directions, N passes and N−1 fails, so no headroom is introduced. --------- Signed-off-by: Will Pfleger --- desktop/playwright.config.ts | 1 + desktop/scripts/check-file-sizes.mjs | 10 +- .../agents/ui/AddCustomHarnessDialog.tsx | 47 +++ .../agents/ui/AgentDefinitionDialog.tsx | 32 +- .../agents/ui/AgentInstanceEditDialog.tsx | 32 +- .../agents/ui/addCustomHarness.test.mjs | 344 ++++++++++++++++++ .../features/agents/ui/addCustomHarness.ts | 104 ++++++ .../settings/ui/CustomHarnessForm.tsx | 11 +- .../tests/e2e/inline-custom-harness.spec.ts | 194 ++++++++++ 9 files changed, 763 insertions(+), 12 deletions(-) create mode 100644 desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx create mode 100644 desktop/src/features/agents/ui/addCustomHarness.test.mjs create mode 100644 desktop/src/features/agents/ui/addCustomHarness.ts create mode 100644 desktop/tests/e2e/inline-custom-harness.spec.ts diff --git a/desktop/playwright.config.ts b/desktop/playwright.config.ts index 0d89b8e2d2..459fa75743 100644 --- a/desktop/playwright.config.ts +++ b/desktop/playwright.config.ts @@ -126,6 +126,7 @@ export default defineConfig({ "**/observer-archive-policy.spec.ts", "**/harness-management.spec.ts", "**/harness-catalog-screenshots.spec.ts", + "**/inline-custom-harness.spec.ts", ], use: { ...devices["Desktop Chrome"], diff --git a/desktop/scripts/check-file-sizes.mjs b/desktop/scripts/check-file-sizes.mjs index f8ee32dfab..3983fa591d 100644 --- a/desktop/scripts/check-file-sizes.mjs +++ b/desktop/scripts/check-file-sizes.mjs @@ -697,12 +697,18 @@ const overrides = new Map([ // hidden-key projection keeps the top-level secret out of Advanced rows. // +6 (1195 -> 1201): rebase onto main — this PR's model-source label wiring // lands on top of main's dialog growth. Queued to split. - ["src/features/agents/ui/AgentInstanceEditDialog.tsx", 1201], + // +28 (1201 -> 1229): inline "Add custom harness…" entry — sentinel option, + // modal state, and the AddCustomHarnessDialog mount. The shared routing and + // deferred-selection logic lives in addCustomHarness.ts to keep this minimal. + ["src/features/agents/ui/AgentInstanceEditDialog.tsx", 1229], // AgentDefinitionDialog grew past 1000 with the following load-bearing fixes: // isRuntimeAutoSeededRef tracking for edit-mode seeding (Fizz shows models); // runtimeSupportsLlmProviderSelection guard on discovery provider (codex fix); // hideProviderIds computation for Databricks v1 gate. Queued to split. - ["src/features/agents/ui/AgentDefinitionDialog.tsx", 1035], + // +28 (1020 -> 1048): inline "Add custom harness…" entry — sentinel option, + // modal state, and the AddCustomHarnessDialog mount. The shared routing and + // deferred-selection logic lives in addCustomHarness.ts to keep this minimal. + ["src/features/agents/ui/AgentDefinitionDialog.tsx", 1048], // #2630 emoji picker search: the shadow-root search-input autofocus effect // (rAF retry loop) took this file 999 -> 1026 and landed without this entry, // so main's Desktop Core went red. Queued to split with the rest of this list. diff --git a/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx b/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx new file mode 100644 index 0000000000..0c84e99275 --- /dev/null +++ b/desktop/src/features/agents/ui/AddCustomHarnessDialog.tsx @@ -0,0 +1,47 @@ +import { CustomHarnessForm } from "@/features/settings/ui/CustomHarnessForm"; +import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content"; +import { Dialog } from "@/shared/ui/dialog"; + +/** + * Registers a custom ACP harness from inside an agent dialog, so "New agent" + * is a complete entry point and not a dead end that sends the user to + * Settings. Hosts the same `CustomHarnessForm` the harness catalog uses. + */ +export function AddCustomHarnessDialog({ + onOpenChange, + onSaved, + open, +}: { + onOpenChange: (open: boolean) => void; + /** Called with the id of the harness that was just registered. */ + onSaved: (id: string) => void; + open: boolean; +}) { + return ( + + + + Register any ACP-speaking agent tool as a selectable harness. +

+ } + onCancel={() => onOpenChange(false)} + onSaved={(id) => { + // Dismiss on save as well as cancel — both exits belong to this + // dialog, so callers only handle the resulting selection. + onOpenChange(false); + onSaved(id); + }} + /> + + + ); +} diff --git a/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx b/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx index 45031e0371..5425131448 100644 --- a/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx +++ b/desktop/src/features/agents/ui/AgentDefinitionDialog.tsx @@ -83,6 +83,12 @@ import { import { useProviderApiKeyFieldState } from "./providerApiKeyFieldState"; import { buildRuntimeModelProviderPayload } from "./agentDefinitionSubmitPayload"; import { AgentDefinitionDialogFooter } from "./AgentDefinitionDialogFooter"; +import { AddCustomHarnessDialog } from "./AddCustomHarnessDialog"; +import { + ADD_CUSTOM_HARNESS_OPTION, + runtimeDropdownAction, + usePendingHarnessSelection, +} from "./addCustomHarness"; type AgentDefinitionDialogProps = { open: boolean; @@ -167,6 +173,7 @@ export function AgentDefinitionDialog({ const [isAvatarUploadPending, setIsAvatarUploadPending] = React.useState(false); const [hasUserChanges, setHasUserChanges] = React.useState(false); + const [isAddHarnessOpen, setIsAddHarnessOpen] = React.useState(false); const { globalConfig, inheritedDefaults: { @@ -308,6 +315,7 @@ export function AgentDefinitionDialog({ setShowAdvancedFields(false); setIsAvatarUploadPending(false); setHasUserChanges(false); + setIsAddHarnessOpen(false); // isRuntimeAutoSeededRef and hasSeededForOpenRef are NOT reset here — the // [initialValues, open] effect resets both when the dialog re-opens. } @@ -578,6 +586,7 @@ export function AgentDefinitionDialog({ runtimes, runtimesLoading, }); + runtimeDropdownOptions.push(ADD_CUSTOM_HARNESS_OPTION); const runtimeSummaryLabel = selectedRuntime ? formatRuntimeOptionLabel(selectedRuntime) : runtime.trim() || "Not configured"; @@ -662,9 +671,13 @@ export function AgentDefinitionDialog({ } function handleRuntimeDropdownChange(nextValue: string) { + const action = runtimeDropdownAction(nextValue); + if (action.kind === "add-custom-harness") { + setIsAddHarnessOpen(true); + return; + } setHasUserChanges(true); - const nextRuntime = - nextValue === NO_RUNTIME_DROPDOWN_VALUE ? "" : nextValue; + const nextRuntime = action.runtimeId; // The user made an explicit choice — no longer auto-seeded. isRuntimeAutoSeededRef.current = false; setRuntime(nextRuntime); @@ -680,6 +693,15 @@ export function AgentDefinitionDialog({ ); } + // Routed through the normal change handler so a harness registered inline + // resets model/provider exactly as a hand-picked one would. Scoped to `open` + // so a pending id can't outlive the dialog that started the registration. + const selectSavedHarness = usePendingHarnessSelection( + runtimes, + handleRuntimeDropdownChange, + open, + ); + function handleProviderDropdownChange(nextValue: string) { setHasUserChanges(true); const nextProvider = @@ -944,6 +966,12 @@ export function AgentDefinitionDialog({ returnFocusRef={aiDefaultsTriggerRef} /> + + {isCreateMode ? createRunSection : null}
diff --git a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx index 601d57f95d..f3c410e2ff 100644 --- a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx +++ b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx @@ -83,6 +83,12 @@ import { useProviderApiKeyFieldState } from "./providerApiKeyFieldState"; import { resolveModelFieldStatusMessage } from "./agentConfigControls"; import { AdvancedRequiredBadge } from "./AdvancedRequiredBadge"; import { showAgentProfileSyncWarning } from "./agentProfileSyncWarning"; +import { AddCustomHarnessDialog } from "./AddCustomHarnessDialog"; +import { + ADD_CUSTOM_HARNESS_OPTION, + runtimeDropdownAction, + usePendingHarnessSelection, +} from "./addCustomHarness"; const ADVANCED_FIELDS_MOTION_TRANSITION = { duration: 0.18, @@ -157,6 +163,7 @@ export function AgentInstanceEditDialog({ const [avatarUrl, setAvatarUrl] = React.useState(agent.avatarUrl ?? ""); const [isAvatarUploadPending, setIsAvatarUploadPending] = React.useState(false); + const [isAddHarnessOpen, setIsAddHarnessOpen] = React.useState(false); const shouldReduceMotion = useReducedMotion(); // Runtime selector: defaults to "custom" until the dialog opens and the @@ -191,6 +198,7 @@ export function AgentInstanceEditDialog({ setAvatarUrl(agent.avatarUrl ?? ""); setShowAdvancedFields(false); setIsAvatarUploadPending(false); + setIsAddHarnessOpen(false); runtimeTouched.current = false; const matched = runtimes.find((r) => r.command?.trim() === agent.agentCommand.trim()) ?? @@ -244,6 +252,7 @@ export function AgentInstanceEditDialog({ value: selectedRuntimeId, }); } + options.push(ADD_CUSTOM_HARNESS_OPTION); return options; }, [sortedRuntimes, selectedRuntimeId]); @@ -484,8 +493,12 @@ export function AgentInstanceEditDialog({ } function handleRuntimeDropdownChange(nextValue: string) { - const nextRuntimeId = - nextValue === NO_RUNTIME_DROPDOWN_VALUE ? "" : nextValue; + const action = runtimeDropdownAction(nextValue); + if (action.kind === "add-custom-harness") { + setIsAddHarnessOpen(true); + return; + } + const nextRuntimeId = action.runtimeId; const previousRuntimeId = selectedRuntimeId; const nextRuntime = runtimes.find((r) => r.id === nextRuntimeId); @@ -532,6 +545,16 @@ export function AgentInstanceEditDialog({ ); } + // Routed through the normal change handler so a harness registered inline + // pins its command and resets model/provider like a hand-picked one. Scoped + // to `open` so a pending id can't outlive the dialog that started the + // registration. + const selectSavedHarness = usePendingHarnessSelection( + runtimes, + handleRuntimeDropdownChange, + open, + ); + function handleProviderDropdownChange(nextValue: string) { const nextProvider = nextValue === AUTO_PROVIDER_DROPDOWN_VALUE ? "" : nextValue; @@ -949,6 +972,11 @@ export function AgentInstanceEditDialog({

) : null} +
{selectedRuntimeId === "custom" && !inheritHarness ? (
diff --git a/desktop/src/features/agents/ui/addCustomHarness.test.mjs b/desktop/src/features/agents/ui/addCustomHarness.test.mjs new file mode 100644 index 0000000000..6c0aa32daf --- /dev/null +++ b/desktop/src/features/agents/ui/addCustomHarness.test.mjs @@ -0,0 +1,344 @@ +/** + * Behavior tests for the inline "Add custom harness…" dropdown entry shared by + * AgentDefinitionDialog and AgentInstanceEditDialog. + * + * Two seams carry the feature, and both are pinned here: + * + * 1. ROUTING (`runtimeDropdownAction`) — the sentinel must resolve to "open + * the form", never to a selection. If it ever resolved to a selection the + * dialogs would write "\u0000add-custom-harness" into `runtime` and try to + * spawn an agent on a harness that does not exist. + * 2. DEFERRED SELECTION (`usePendingHarnessSelection`) — saving only writes + * the definition file; the harness becomes a catalog entry when the + * invalidated discovery query refetches. Selecting on save would pick an + * id no entry backs. The hook must wait for the catalog, fire exactly + * once, stay silent when the user cancels, and drop the pending id when + * its dialog closes — the host dialogs stay mounted, so a stale id would + * otherwise select into reset form state on a later publish. + * + * The hook is mounted for real (react-dom/client + act) rather than simulated, + * so its effect wiring — including the guard that survives the dialogs' + * non-memoized change handlers — is what gets tested. + */ + +import assert from "node:assert/strict"; +import test from "node:test"; + +// ── Minimal DOM shim ───────────────────────────────────────────────────────── +// react-dom/client needs a container element and a document; node has neither. +// The harness renders null, so no real node operations are exercised. + +class ElementShim { + constructor() { + this.children = []; + this.childNodes = []; + this.nodeType = 1; + this.nodeName = "DIV"; + this.tagName = "DIV"; + this.namespaceURI = "http://www.w3.org/1999/xhtml"; + } + get ownerDocument() { + return globalThis.document; + } + addEventListener() {} + removeEventListener() {} + appendChild(child) { + this.children.push(child); + this.childNodes.push(child); + return child; + } + removeChild(child) { + this.children = this.children.filter((current) => current !== child); + this.childNodes = this.childNodes.filter((current) => current !== child); + return child; + } + insertBefore(child) { + return this.appendChild(child); + } + contains(target) { + return this === target; + } +} + +globalThis.document = { + activeElement: null, + addEventListener() {}, + createElement: () => new ElementShim(), + get defaultView() { + return globalThis.window; + }, + nodeType: 9, + removeEventListener() {}, +}; +// react-dom derives update priority from window.event and walks iframe +// boundaries via window.HTMLIFrameElement during commit. +Object.defineProperty(globalThis, "window", { + configurable: true, + value: { + addEventListener() {}, + document: globalThis.document, + event: undefined, + HTMLIFrameElement: ElementShim, + removeEventListener() {}, + }, +}); +globalThis.HTMLElement = ElementShim; +globalThis.Node = ElementShim; +globalThis.IS_REACT_ACT_ENVIRONMENT = true; + +import React from "react"; +import { act } from "react"; +import { createRoot } from "react-dom/client"; + +import { NO_RUNTIME_DROPDOWN_VALUE } from "./agentConfigOptions.tsx"; +import { + ADD_CUSTOM_HARNESS_OPTION, + ADD_CUSTOM_HARNESS_VALUE, + readyHarnessId, + runtimeDropdownAction, + usePendingHarnessSelection, +} from "./addCustomHarness.ts"; + +// ── Routing: the sentinel opens the form, it is never a selection ──────────── + +test("selecting the add-custom entry requests the form and yields no runtime id", () => { + const action = runtimeDropdownAction(ADD_CUSTOM_HARNESS_VALUE); + assert.equal(action.kind, "add-custom-harness"); + // The dialogs read `action.runtimeId` on the select branch; the sentinel + // must not carry one, or it could leak into form state. + assert.equal("runtimeId" in action, false); +}); + +test("selecting a harness yields that harness id", () => { + assert.deepEqual(runtimeDropdownAction("my-harness"), { + kind: "select", + runtimeId: "my-harness", + }); +}); + +test("selecting the no-runtime entry yields the empty id", () => { + assert.deepEqual(runtimeDropdownAction(NO_RUNTIME_DROPDOWN_VALUE), { + kind: "select", + runtimeId: "", + }); +}); + +test("the add-custom sentinel cannot collide with a backend-valid harness id", () => { + // Backend ids match [a-z0-9_][a-z0-9_-]* (custom_harnesses.rs), so a + // NUL-prefixed value is unreachable as a real id. + assert.equal(ADD_CUSTOM_HARNESS_VALUE.startsWith("\u0000"), true); + assert.equal(ADD_CUSTOM_HARNESS_OPTION.value, ADD_CUSTOM_HARNESS_VALUE); + assert.equal(ADD_CUSTOM_HARNESS_OPTION.label, "Add custom harness…"); +}); + +// ── Readiness: an id is selectable only once the catalog publishes it ──────── + +test("a pending id absent from the catalog is not ready", () => { + assert.equal(readyHarnessId([{ id: "claude" }], "my-harness"), null); +}); + +test("a pending id present in the catalog is ready", () => { + assert.equal( + readyHarnessId([{ id: "claude" }, { id: "my-harness" }], "my-harness"), + "my-harness", + ); +}); + +test("no pending id is never ready even against a populated catalog", () => { + assert.equal(readyHarnessId([{ id: "claude" }], null), null); +}); + +// ── Deferred selection: mounted hook ───────────────────────────────────────── + +/** + * Mount the real hook over a mutable catalog. Returns the setter the dialogs + * call on save, a `setRuntimes` to simulate the discovery refetch, a `setOpen` + * to simulate the owning dialog closing and reopening, and the log of ids the + * hook handed back for selection. + */ +async function mountPendingSelection(initialRuntimes = []) { + const selected = []; + const control = {}; + + function Harness() { + const [runtimes, setRuntimes] = React.useState(initialRuntimes); + const [open, setOpen] = React.useState(true); + // Deliberately NOT memoized: both dialogs pass a plain function + // declaration, so `onReady` has a fresh identity on every render. + const onReady = (id) => selected.push(id); + control.save = usePendingHarnessSelection(runtimes, onReady, open); + control.setRuntimes = setRuntimes; + control.setOpen = setOpen; + return null; + } + + const root = createRoot(new ElementShim()); + await act(async () => { + root.render(React.createElement(Harness)); + }); + return { control, root, selected }; +} + +test("saving a harness selects it only once the catalog publishes it", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + // Save returns before discovery refetches — nothing to select yet. + await act(async () => control.save("my-harness")); + assert.deepEqual(selected, []); + + // The invalidated discovery query resolves with the new entry. + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]), + ); + assert.deepEqual(selected, ["my-harness"]); + + await act(async () => root.unmount()); +}); + +test("a published harness is selected exactly once across later catalog updates", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + await act(async () => control.save("my-harness")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]), + ); + assert.deepEqual(selected, ["my-harness"]); + + // Any later refetch re-renders with a new array identity and a new onReady + // identity. Re-firing here would clobber a selection the user made in + // between, so the pending id must have been cleared. + await act(async () => + control.setRuntimes([ + { id: "claude" }, + { id: "my-harness" }, + { id: "codex" }, + ]), + ); + assert.deepEqual(selected, ["my-harness"]); + + await act(async () => root.unmount()); +}); + +test("cancelling the form leaves the current selection untouched", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + // Cancel never reports a saved id, so no selection is ever requested — even + // as the catalog keeps refreshing underneath. + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "codex" }]), + ); + assert.deepEqual(selected, []); + + await act(async () => root.unmount()); +}); + +test("a saved harness discovery never publishes is never selected", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + // e.g. the definition file was written but the entry failed to load. The + // hook must stall rather than select an id no catalog entry backs. + await act(async () => control.save("ghost-harness")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "codex" }]), + ); + assert.deepEqual(selected, []); + + await act(async () => root.unmount()); +}); + +test("two harnesses registered in a row are each selected when published", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + await act(async () => control.save("first")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "first" }]), + ); + await act(async () => control.save("second")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "first" }, { id: "second" }]), + ); + assert.deepEqual(selected, ["first", "second"]); + + await act(async () => root.unmount()); +}); + +test("a second save before the first publishes selects only the later harness", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + // The dropdown holds one harness, so the latest registration wins: the + // first id is dropped rather than queued behind the second. + await act(async () => control.save("first")); + await act(async () => control.save("second")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "first" }, { id: "second" }]), + ); + assert.deepEqual(selected, ["second"]); + + await act(async () => root.unmount()); +}); + +// ── Lifecycle: a pending id never outlives the dialog that created it ──────── + +test("a harness published after its dialog closed is never selected", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + // Both host dialogs stay mounted when closed, so the hook keeps running. + await act(async () => control.save("my-harness")); + await act(async () => control.setOpen(false)); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]), + ); + + // Selecting here would write into form state the close already reset. + assert.deepEqual(selected, []); + + await act(async () => root.unmount()); +}); + +test("reopening after closing mid-registration does not select the abandoned harness", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + await act(async () => control.save("my-harness")); + await act(async () => control.setOpen(false)); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]), + ); + // The reopened dialog seeds from its own initial values; a stale pending id + // must not overwrite them. + await act(async () => control.setOpen(true)); + assert.deepEqual(selected, []); + + await act(async () => root.unmount()); +}); + +test("a harness saved after reopening is still selected when published", async () => { + const { control, root, selected } = await mountPendingSelection([ + { id: "claude" }, + ]); + + await act(async () => control.setOpen(false)); + await act(async () => control.setOpen(true)); + await act(async () => control.save("my-harness")); + await act(async () => + control.setRuntimes([{ id: "claude" }, { id: "my-harness" }]), + ); + assert.deepEqual(selected, ["my-harness"]); + + await act(async () => root.unmount()); +}); diff --git a/desktop/src/features/agents/ui/addCustomHarness.ts b/desktop/src/features/agents/ui/addCustomHarness.ts new file mode 100644 index 0000000000..f9c2143530 --- /dev/null +++ b/desktop/src/features/agents/ui/addCustomHarness.ts @@ -0,0 +1,104 @@ +/** + * Shared pieces of the inline "Add custom harness…" entry the agent dialogs + * append to their harness dropdown. + * + * Registering a custom harness used to be reachable only from Settings, so + * anyone whose first stop was "New agent" never learned the path existed. + * These helpers keep the entry identical across the dropdowns, keep its + * sentinel value out of form state, and defer selecting a freshly registered + * harness until discovery has actually published it. + */ + +import * as React from "react"; + +import { + NO_RUNTIME_DROPDOWN_VALUE, + type PersonaDropdownOption, +} from "./agentConfigOptions"; + +/** + * Dropdown value for the add-custom-harness entry. NUL-prefixed so it can + * never collide with a harness id (`[a-z0-9_][a-z0-9_-]*`) — same trick as the + * harness catalog's `CUSTOM_ENTRY_ID`. + */ +export const ADD_CUSTOM_HARNESS_VALUE = "\u0000add-custom-harness"; + +export const ADD_CUSTOM_HARNESS_OPTION: PersonaDropdownOption = { + label: "Add custom harness…", + value: ADD_CUSTOM_HARNESS_VALUE, +}; + +export type RuntimeDropdownAction = + | { kind: "add-custom-harness" } + | { kind: "select"; runtimeId: string }; + +/** + * Route a harness-dropdown change. The add-custom entry only opens the + * registration form — it is never a selection, so its sentinel can't reach + * form state. Every other value selects, with the no-runtime sentinel + * normalized to the empty id. + */ +export function runtimeDropdownAction(value: string): RuntimeDropdownAction { + if (value === ADD_CUSTOM_HARNESS_VALUE) { + return { kind: "add-custom-harness" }; + } + return { + kind: "select", + runtimeId: value === NO_RUNTIME_DROPDOWN_VALUE ? "" : value, + }; +} + +/** + * The pending harness id once discovery has published it, else `null`. + * + * Saving only writes the definition file — the harness becomes a catalog entry + * when the invalidated discovery query refetches. Selecting before then would + * pick an id no entry backs: the create dialog would block Save on an unknown + * availability, and the instance dialog could not read the command to pin. + */ +export function readyHarnessId( + runtimes: ReadonlyArray<{ id: string }>, + pendingId: string | null, +): string | null { + return runtimes.some((runtime) => runtime.id === pendingId) + ? pendingId + : null; +} + +/** + * Selects a newly registered custom harness once discovery publishes it. + * + * Returns the setter to hand the saved id; `onReady` then fires with it, so + * callers reuse their normal dropdown-change path instead of growing a second + * selection code path. + * + * `active` is the owning dialog's open state. The wait is only meaningful + * while that dialog is open: both host dialogs stay mounted across closes, so + * a pending id would otherwise survive the close and select into reset — or + * hidden — form state whenever discovery caught up. Going inactive both blocks + * `onReady` and drops the pending id, so a later publish is a no-op and + * reopening starts clean. A second save before the first publishes replaces + * it: the field holds one harness, so the latest save wins. + */ +export function usePendingHarnessSelection( + runtimes: ReadonlyArray<{ id: string }>, + onReady: (id: string) => void, + active: boolean, +): (id: string) => void { + const [pendingId, setPendingId] = React.useState(null); + // Gated at render, not just in the effect, so a catalog update landing in + // the same commit as the close cannot slip a selection through. + const readyId = active ? readyHarnessId(runtimes, pendingId) : null; + + React.useEffect(() => { + if (!active) { + setPendingId(null); + return; + } + if (readyId === null) return; + setPendingId(null); + onReady(readyId); + }, [active, onReady, readyId]); + + return setPendingId; +} diff --git a/desktop/src/features/settings/ui/CustomHarnessForm.tsx b/desktop/src/features/settings/ui/CustomHarnessForm.tsx index 60f3a66af1..52e7906265 100644 --- a/desktop/src/features/settings/ui/CustomHarnessForm.tsx +++ b/desktop/src/features/settings/ui/CustomHarnessForm.tsx @@ -216,7 +216,8 @@ export function CustomHarnessForm({ * delete the old file when the id changes. */ originalId?: string; onCancel: () => void; - onSaved: () => void; + /** Receives the id the harness was saved under (the form may rewrite it). */ + onSaved: (id: string) => void; /** Render without the bordered card chrome (for embedding in the catalog * dialog detail pane). */ chromeless?: boolean; @@ -273,11 +274,9 @@ export function CustomHarnessForm({ return; } try { - await save.mutateAsync({ - definition: definitionFromFormValues(form), - originalId, - }); - onSaved(); + const definition = definitionFromFormValues(form); + await save.mutateAsync({ definition, originalId }); + onSaved(definition.id); } catch (err) { setError(err instanceof Error ? err.message : String(err)); } diff --git a/desktop/tests/e2e/inline-custom-harness.spec.ts b/desktop/tests/e2e/inline-custom-harness.spec.ts new file mode 100644 index 0000000000..6b3845d65a --- /dev/null +++ b/desktop/tests/e2e/inline-custom-harness.spec.ts @@ -0,0 +1,194 @@ +/** + * E2E spec for the inline "Add custom harness…" entry in the agent dialogs. + * + * Registering a custom harness used to be reachable only from Settings → + * Agents, so anyone whose first touchpoint was "New agent" never learned the + * path existed. The harness dropdowns now carry the entry directly. + * + * Covers, on all three surfaces (create, edit definition, edit instance): + * - choosing the entry opens the registration form + * - saving registers the harness and selects it in the dropdown + * + * Create and instance edit additionally assert the sentinel never becomes the + * selection; create alone covers dismissing the form leaving the previous + * selection untouched. The three surfaces share the same routing, so those + * checks are not repeated on every one. + */ +import { expect, test } from "@playwright/test"; + +import { installMockBridge } from "../helpers/bridge"; + +const ADD_ENTRY = "Add custom harness…"; +const HARNESS_LABEL = "My Weird Agent"; +const HARNESS_COMMAND = "my-weird-acp"; + +type Page = import("@playwright/test").Page; +type Locator = import("@playwright/test").Locator; + +/** Open a PersonaDropdownField (button trigger + menuitemradio options). */ +async function openDropdown(trigger: Locator) { + await expect(trigger).toBeVisible({ timeout: 10_000 }); + await trigger.click(); +} + +/** Register a harness through the inline form and wait for it to close. */ +async function registerHarness(page: Page) { + const form = page.getByTestId("custom-harness-form"); + await expect(form).toBeVisible({ timeout: 8_000 }); + await page.fill("#ch-label", HARNESS_LABEL); + await page.fill("#ch-command", HARNESS_COMMAND); + // The id auto-derives from the label; it is what the dropdown selects on. + await expect(page.locator("#ch-id")).toHaveValue("my-weird-agent"); + await form.getByRole("button", { name: "Save", exact: true }).click(); + await expect(page.getByTestId("add-custom-harness-dialog")).not.toBeVisible({ + timeout: 8_000, + }); +} + +/** Open the create-agent dialog (AgentDefinitionDialog, create mode). */ +async function openCreateDialog(page: Page) { + await page.goto("/", { waitUntil: "domcontentloaded" }); + await page.getByTestId("open-agents-view").click(); + await page.getByTestId("new-agent-card").click(); + await page.getByRole("menuitem", { name: "Create agent" }).click(); + const dialog = page.getByTestId("persona-dialog"); + await expect(dialog).toBeVisible({ timeout: 10_000 }); + await dialog.getByRole("tab", { name: "Customize for this agent" }).click(); + return dialog; +} + +/** Open the edit dialog for a saved definition (same dialog, edit mode). */ +async function openDefinitionEditDialog(page: Page, name: string) { + await page.goto("/", { waitUntil: "domcontentloaded" }); + await page.getByTestId("open-agents-view").click(); + await expect(page.getByTestId("agents-library-personas")).toBeVisible({ + timeout: 10_000, + }); + await page.getByRole("button", { name: `Open actions for ${name}` }).click(); + await page.getByRole("menuitem", { name: "Edit" }).click(); + const dialog = page.getByTestId("persona-dialog"); + await expect(dialog).toBeVisible({ timeout: 10_000 }); + await dialog.getByRole("tab", { name: "Customize for this agent" }).click(); + return dialog; +} + +test.describe("inline add custom harness", () => { + test("create dialog registers a harness inline and selects it", async ({ + page, + }) => { + await installMockBridge(page); + const dialog = await openCreateDialog(page); + + const harness = dialog.locator("#persona-runtime"); + await openDropdown(harness); + await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click(); + + // The sentinel opens the form; it must never become the selection. + await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({ + timeout: 8_000, + }); + await expect(harness).not.toContainText(ADD_ENTRY); + + await registerHarness(page); + + // The saved harness is now the selected harness. + await expect(harness).toContainText(HARNESS_LABEL, { timeout: 8_000 }); + }); + + test("dismissing the form leaves the create dialog's harness unchanged", async ({ + page, + }) => { + await installMockBridge(page); + const dialog = await openCreateDialog(page); + + const harness = dialog.locator("#persona-runtime"); + await expect(harness).toBeVisible({ timeout: 10_000 }); + const before = await harness.textContent(); + + await openDropdown(harness); + await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click(); + await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({ + timeout: 8_000, + }); + + await page.keyboard.press("Escape"); + await expect( + page.getByTestId("add-custom-harness-dialog"), + ).not.toBeVisible(); + + // No harness was registered, so the prior selection must survive. + await expect(harness).toHaveText(before ?? ""); + }); + + test("definition edit dialog registers a harness inline and selects it", async ({ + page, + }) => { + await installMockBridge(page, { + personas: [ + { + displayName: "Editable Agent", + systemPrompt: "An agent whose harness gets replaced.", + }, + ], + }); + const dialog = await openDefinitionEditDialog(page, "Editable Agent"); + + const harness = dialog.locator("#persona-runtime"); + await openDropdown(harness); + await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click(); + await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({ + timeout: 8_000, + }); + + await registerHarness(page); + + await expect(harness).toContainText(HARNESS_LABEL, { timeout: 8_000 }); + }); + + test("instance edit dialog registers a harness inline and keeps Custom command", async ({ + page, + }) => { + await installMockBridge(page, { + managedAgents: [ + { + pubkey: + "npub1e2e00000000000000000000000000000000000000000000000000000000", + name: "Instance Agent", + status: "stopped", + channelNames: ["agents"], + }, + ], + }); + + await page.goto("/", { waitUntil: "domcontentloaded" }); + await page.getByTestId("open-agents-view").click(); + await page + .getByRole("button", { name: "Instance Agent agent profile" }) + .click(); + await expect(page.getByTestId("user-profile-panel")).toBeVisible({ + timeout: 10_000, + }); + await page.getByTestId("user-profile-edit-agent").click(); + await expect(page.getByTestId("edit-agent-dialog")).toBeVisible({ + timeout: 10_000, + }); + + const provider = page.locator("#edit-agent-runtime"); + await openDropdown(provider); + + // "Custom command" is a different feature (ad-hoc command override) and + // must survive alongside the new entry. + await expect( + page.getByRole("menuitemradio", { name: "Custom command" }), + ).toBeVisible(); + await page.getByRole("menuitemradio", { name: ADD_ENTRY }).click(); + await expect(page.getByTestId("add-custom-harness-dialog")).toBeVisible({ + timeout: 8_000, + }); + await expect(provider).not.toContainText(ADD_ENTRY); + + await registerHarness(page); + + await expect(provider).toContainText(HARNESS_LABEL, { timeout: 8_000 }); + }); +}); From 1d4f97b959a0d91f7bac0e1f97189e5c10347712 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Tue, 28 Jul 2026 16:03:13 -0400 Subject: [PATCH 018/112] fix(acp): disable goose cron scheduler in managed agent children (#3144) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A Buzz install with a scheduled goose recipe fires each cron entry once per `goose acp` child instead of once, because every child unconditionally starts its own cron scheduler over the shared `~/.local/share/goose/schedule.json`. With a pool of N children per harness and multiple harnesses, one scheduled recipe fans out to N × harness_count executions — each running under the managed agent's identity rather than the operator's, and racing the operator's own standalone goose over the same schedule file. This injects `GOOSE_ACP_SCHEDULER_DISABLED=true` into every child spawned by `AcpClient::spawn`, so a managed agent never owns the operator's cron schedule. ## Placement The `cmd.env` call is set last — after the `extra_env` operator-wins loop and after the `CODEX_CONFIG` merge — deliberately with no escape hatch. Managed children not running the operator's schedule is a correctness invariant rather than an operator-tunable default, so the injection must beat both a conflicting persona `extra_env` entry and any value inherited from the parent process. It is injected for all agents, not just goose. Agent builds that don't recognize the variable ignore it. ## Sequencing The goose-side flag that reads this variable and skips scheduler startup lands separately (repo TBD). Until it does, this change is a forward-compatible no-op: it sets an environment variable nothing currently reads. Merging it first means no coordinated release is needed — the fix takes effect as soon as the goose side ships. Related: https://github.com/aaif-goose/goose/pull/10738 Signed-off-by: Will Pfleger --- crates/buzz-acp/src/acp.rs | 85 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/crates/buzz-acp/src/acp.rs b/crates/buzz-acp/src/acp.rs index c0147baf1b..23f0345e96 100644 --- a/crates/buzz-acp/src/acp.rs +++ b/crates/buzz-acp/src/acp.rs @@ -20,6 +20,10 @@ use crate::usage::{TurnUsage, UsageTracker}; /// Lines exceeding this limit are rejected to prevent OOM from rogue agents. const MAX_LINE_SIZE: usize = 10_000_000; // 10 MB +/// Env var that tells a goose ACP child not to start its cron scheduler. +/// Injected unconditionally by [`AcpClient::spawn`]; see the call site for why. +pub(crate) const GOOSE_SCHEDULER_DISABLED_ENV: &str = "GOOSE_ACP_SCHEDULER_DISABLED"; + /// An MCP server configuration passed to `session/new`. /// /// Corresponds to the `McpServerStdio` variant in the ACP schema. @@ -460,6 +464,16 @@ impl AcpClient { cmd.env("CODEX_CONFIG", merged); } + // Buzz-managed agents must never execute the operator's personal cron + // schedule. A goose ACP child starts a scheduler over the shared + // `schedule.json`, so a pool of N children fires every scheduled job N + // times — under the wrong identity and racing standalone goose. + // + // Set last, and with no operator-wins escape hatch, so it beats both a + // conflicting persona `extra_env` entry and any inherited parent value. + // Agent builds that don't recognize the variable ignore it. + cmd.env(GOOSE_SCHEDULER_DISABLED_ENV, "true"); + // Spawn the agent in its own process group so SIGKILL doesn't propagate // to the harness's own process group on Unix. // tokio::process::Command::process_group is a stable tokio API (no extra imports needed). @@ -2653,6 +2667,77 @@ mod tests { .expect("failed to spawn test script") } + /// Spawn a script that echoes the named env vars as the child observes + /// them, one per line. `` means the child did not receive the var. + async fn spawn_and_read_child_env( + vars: &[&str], + extra_env: &[(String, String)], + ) -> Vec { + let script = vars + .iter() + .map(|var| format!("printf '%s\\n' \"${{{var}:-}}\"")) + .collect::>() + .join("\n"); + let mut client = AcpClient::spawn("bash", &["-c".into(), script], extra_env, false) + .await + .expect("failed to spawn env probe script"); + let mut observed = Vec::with_capacity(vars.len()); + for var in vars { + observed.push( + client + .reader + .next() + .await + .unwrap_or_else(|| panic!("child produced no output for {var}")) + .expect("child stdout was not readable"), + ); + } + observed + } + + /// Every spawned agent must be told not to run the operator's cron + /// schedule, without the caller having to opt in. + #[tokio::test] + async fn spawn_injects_scheduler_disabled_env_by_default() { + let observed = spawn_and_read_child_env(&[GOOSE_SCHEDULER_DISABLED_ENV], &[]).await; + assert_eq!( + observed, + vec!["true"], + "{GOOSE_SCHEDULER_DISABLED_ENV} must be injected into every spawn" + ); + } + + /// Persona config must not be able to re-enable the scheduler: this is a + /// correctness invariant, not an operator-tunable default, so the + /// injection is set after (and therefore wins over) the `extra_env` loop. + /// + /// The control var pins that `extra_env` really did reach the child, so a + /// pass here means the conflicting entry lost the fight rather than + /// `extra_env` being dropped wholesale. + #[tokio::test] + async fn spawn_scheduler_disabled_env_overrides_conflicting_extra_env() { + let extra_env = vec![ + ( + GOOSE_SCHEDULER_DISABLED_ENV.to_string(), + "false".to_string(), + ), + ( + "BUZZ_ENV_PROBE_CONTROL".to_string(), + "delivered".to_string(), + ), + ]; + let observed = spawn_and_read_child_env( + &[GOOSE_SCHEDULER_DISABLED_ENV, "BUZZ_ENV_PROBE_CONTROL"], + &extra_env, + ) + .await; + assert_eq!( + observed, + vec!["true", "delivered"], + "a persona extra_env entry must not override {GOOSE_SCHEDULER_DISABLED_ENV}" + ); + } + #[tokio::test] async fn idle_timeout_fires_on_silent_process() { let mut client = spawn_script("sleep 10").await; From 1d3b810ad70d6325718ed91e723f32c4a376d5e1 Mon Sep 17 00:00:00 2001 From: Wes Date: Tue, 28 Jul 2026 14:17:01 -0600 Subject: [PATCH 019/112] fix(desktop): paint community rail full height (#3382) ## Summary - paint the community rail across the full app height instead of exposing the parent background through external margins - preserve the existing community-button alignment and balanced horizontal gutters by moving vertical spacing inside the rail - update the rail geometry coverage to require full-height paint ownership ## Root cause PR #2972 aligned the rail box with the inset content by adding top and bottom margins to the `bg-sidebar` element. Margins are outside the painted box, so flat light and dark themes exposed a differently colored app background above and below the rail. ## Validation - pre-push `desktop-check` - pre-push desktop unit suite: 3,751 passed - `git diff --check` Local Playwright/E2E was not run; CI owns the full browser matrix. Signed-off-by: Wes Co-authored-by: Carl --- .../src/features/sidebar/ui/CommunityRail.tsx | 2 +- desktop/tests/e2e/community-rail.spec.ts | 16 +++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/desktop/src/features/sidebar/ui/CommunityRail.tsx b/desktop/src/features/sidebar/ui/CommunityRail.tsx index b15e0bab71..386ee20691 100644 --- a/desktop/src/features/sidebar/ui/CommunityRail.tsx +++ b/desktop/src/features/sidebar/ui/CommunityRail.tsx @@ -370,7 +370,7 @@ export function CommunityRail({ return (
@@ -217,12 +247,41 @@ export function ChannelMemberInviteCard({ ) : null} {deferredInviteQuery.length > 0 ? (
- {userSearchQuery.isLoading ? ( + {userSearchQuery.isLoading && !directInvitee ? (

Searching…

- ) : inviteSearchResults.length > 0 ? ( + ) : inviteSearchResults.length > 0 || directInvitee ? (
+ {directInvitee ? ( + + ) : null} {inviteSearchResults.map((result) => ( + + event.preventDefault()} + sideOffset={4} + style={{ minWidth: "13rem" }} + > + + setRole(value as RelayMemberRole) + } + value={role} + > + {roleOptions.map((option) => ( + + {option.label} + + ))} + + + + + ) : null} + +
+
+ + event.preventDefault()} + onOpenAutoFocus={(event) => event.preventDefault()} + sideOffset={6} + > +
+ {userSearchQuery.isLoading ? ( +

+ Searching… +

+ ) : searchResults.length > 0 || directResult ? ( + <> + {directResult ? ( + selectUser(directResult)} + user={directResult} + /> + ) : null} + {searchResults.map((user) => ( + selectUser(user)} + user={user} + /> + ))} + + ) : ( +

+ No people found. Paste a full npub or hex public key to add + someone directly. +

+ )} +
+ + + + {selectedUsers.length > 0 ? ( + + + + ) : null} + +
+ {isAlreadyMember ? ( +

+ This person is already a community member. +

+ ) : null} + {userSearchQuery.error instanceof Error ? ( +

+ {userSearchQuery.error.message} +

+ ) : null} +
+ + {addMutation.error instanceof Error ? ( +

+ {addMutation.error.message} +

+ ) : null} + + ); +} + +function SearchResult({ + onSelect, + user, +}: { + onSelect: () => void; + user: UserSearchResult; +}) { + const name = formatSearchUserName(user); + const isDirectPubkey = user.displayName === null && user.nip05Handle === null; + + return ( + + ); +} + +export function AddMemberDialog({ + isOwner, + open, + onOpenChange, +}: { + isOwner: boolean; + open: boolean; + onOpenChange: (open: boolean) => void; +}) { + return ( + Add member - Add a user to this relay by their public key. + Add a person to this community by their public key. - -
{ - e.preventDefault(); - handleAdd(); - }} - > -
-
-
- - setPubkey(e.target.value)} - placeholder="64-character hex pubkey" - spellCheck={false} - value={pubkey} - /> - {pubkey.trim().length > 0 && !isValidPubkey ? ( -

- Must be exactly 64 lowercase hex characters. -

- ) : null} - {isAlreadyMember ? ( -

- This pubkey is already a relay member. -

- ) : null} -
- -
-

Role

-
- {ROLE_OPTIONS.filter( - (opt) => isOwner || opt.value === "member", - ).map((opt) => ( - - ))} -
-
- - {addMutation.error instanceof Error ? ( -

- {addMutation.error.message} -

- ) : null} -
-
- -
- - -
-
+
+ onOpenChange(false)} + /> +
diff --git a/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx b/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx index 9daca590f4..c5cabc26a6 100644 --- a/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx +++ b/desktop/src/features/community-members/ui/CommunityInviteDialog.tsx @@ -7,20 +7,21 @@ import { DialogHeader, DialogTitle, } from "@/shared/ui/dialog"; +import { DirectAddMemberForm } from "./AddMemberDialog"; import { DEFAULT_INVITE_TTL_SECS, InviteLinkSection, } from "./InviteLinkSection"; export function CommunityInviteDialog({ + isOwner, onOpenChange, open, }: { + isOwner: boolean; onOpenChange: (open: boolean) => void; open: boolean; }) { - // Email delivery is not available yet, so the modal only mints shareable - // invite links through the relay's existing invite flow. const [ttlSecs, setTtlSecs] = React.useState(DEFAULT_INVITE_TTL_SECS); React.useEffect(() => { @@ -36,11 +37,24 @@ export function CommunityInviteDialog({ Invite to community - Anyone with this link can join this community. + Add someone directly or share a link they can use to join. - +
+ +
+ +
+

+ Link settings +

+ +
); diff --git a/desktop/src/features/community-members/ui/CommunityMembersSettingsCard.tsx b/desktop/src/features/community-members/ui/CommunityMembersSettingsCard.tsx index 9097f35387..9a24171316 100644 --- a/desktop/src/features/community-members/ui/CommunityMembersSettingsCard.tsx +++ b/desktop/src/features/community-members/ui/CommunityMembersSettingsCard.tsx @@ -370,6 +370,7 @@ export function CommunityMembersSettingsCard({
diff --git a/desktop/src/features/community-members/ui/InviteLinkSection.tsx b/desktop/src/features/community-members/ui/InviteLinkSection.tsx index dc0735c85e..05b4687289 100644 --- a/desktop/src/features/community-members/ui/InviteLinkSection.tsx +++ b/desktop/src/features/community-members/ui/InviteLinkSection.tsx @@ -84,8 +84,8 @@ export function InviteLinkSection({ } return ( -
-
+
+
Expires after diff --git a/desktop/src/features/profile/ui/SelectedRecipientChip.tsx b/desktop/src/features/profile/ui/SelectedRecipientChip.tsx index 18bf6d3b8b..bfc2f43167 100644 --- a/desktop/src/features/profile/ui/SelectedRecipientChip.tsx +++ b/desktop/src/features/profile/ui/SelectedRecipientChip.tsx @@ -46,7 +46,7 @@ export function SelectedRecipientChip({ user: UserSearchResult; }) { return ( -
+
- {runningAgentCount > 0 ? ( + <> +
- ) : null} -
+ {runningAgentCount > 0 ? ( + + ) : null} +
+ + + + + + + { + openAiDefaults(compactActionsTriggerRef.current); + }} + > + + {hasSavedAgentDefaults + ? "Agent defaults" + : "Set agent defaults"} + + {runningAgentCount > 0 ? ( + { + void agents.handleBulkStopRunning(); + }} + > + + Stop running agents + + ) : null} + + + } description="Set up and manage your agents." title="Agents" /> -
+
diff --git a/desktop/src/features/agents/ui/TeamsSection.tsx b/desktop/src/features/agents/ui/TeamsSection.tsx index f974081b7d..c5a7a078b3 100644 --- a/desktop/src/features/agents/ui/TeamsSection.tsx +++ b/desktop/src/features/agents/ui/TeamsSection.tsx @@ -20,9 +20,9 @@ import { IdentityCardSkeleton } from "@/shared/ui/identity-card-skeleton"; import { SectionHeader } from "@/shared/ui/PageHeader"; import { CreateIdentityCard } from "./CreateIdentityCard"; import { TeamIdentityCard } from "./TeamIdentityCard"; +import { IDENTITY_CARD_GRID_CLASS } from "./UnifiedAgentsSection"; const TEAM_CARD_COLUMN_CLASS = "w-full"; -const TEAM_CARD_GRID_CLASS = `${TEAM_CARD_COLUMN_CLASS} mx-auto grid max-w-[996px] grid-cols-[repeat(auto-fill,minmax(220px,240px))] justify-center gap-3`; type TeamsSectionProps = { teams: AgentTeam[]; @@ -63,7 +63,7 @@ export function TeamsSection({
{isLoading ? ( -
+
+
{teams.map((team) => { const resolution = resolveTeamPersonas(team, personas); const missingPersonaCount = resolution.missingPersonaCount; diff --git a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx index 9bbe3feef7..19a5ef1171 100644 --- a/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx +++ b/desktop/src/features/agents/ui/UnifiedAgentsSection.tsx @@ -68,7 +68,7 @@ type UnifiedAgentsSectionProps = { const AGENT_CARD_COLUMN_CLASS = "w-full"; export const AGENT_CARD_GRID_COLUMNS_CLASS = "grid-cols-[repeat(auto-fill,minmax(220px,240px))]"; -const AGENT_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} ${AGENT_CARD_GRID_COLUMNS_CLASS} grid justify-start gap-3`; +export const IDENTITY_CARD_GRID_CLASS = `${AGENT_CARD_COLUMN_CLASS} ${AGENT_CARD_GRID_COLUMNS_CLASS} grid justify-start gap-3 [@container(max-width:40rem)]:justify-center`; export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { const { @@ -153,7 +153,7 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) { {!isLoading ? (
-
+
{groups.map((group) => { const profileAgent = pickProfileAgent(group.agents); return ( @@ -479,7 +479,7 @@ function NewAgentCard({ function LoadingSkeleton() { return ( -
+
({agents.length}) {!isCollapsed ? ( -
+
{agents.map((agent) => ( cards.map((card) => { const box = card.getBoundingClientRect(); - return { right: box.right, top: box.top }; + return { left: box.left, right: box.right, top: box.top }; }), ); const firstRowTop = Math.min(...cardBoxes.map(({ top }) => top)); @@ -425,12 +425,16 @@ test("the new agent card offers create, discover, and import", async ({ .filter(({ top }) => Math.abs(top - firstRowTop) < 1) .map(({ right }) => right), ); + const leftmostFirstRowCard = Math.min( + ...cardBoxes + .filter(({ top }) => Math.abs(top - firstRowTop) < 1) + .map(({ left }) => left), + ); expect(headerBox).not.toBeNull(); - expect( - Math.abs( - (headerBox?.x ?? 0) + (headerBox?.width ?? 0) - rightmostFirstRowCard, - ), - ).toBeLessThan(1); + expect(Math.abs((headerBox?.x ?? 0) - leftmostFirstRowCard)).toBeLessThan(1); + expect(rightmostFirstRowCard).toBeLessThanOrEqual( + (headerBox?.x ?? 0) + (headerBox?.width ?? 0) + 1, + ); await newAgentCard.click(); await expect( @@ -492,6 +496,63 @@ test("the new team card offers create and import", async ({ page }) => { ).toBeVisible(); }); +test("team cards follow the agents grid alignment at compact widths", async ({ + page, +}) => { + await installMockBridge(page, { + personas: [ + { + id: "custom:team-layout", + displayName: "Team layout agent", + systemPrompt: "A test agent for team layout alignment.", + }, + ], + teams: [ + { + id: "team-layout", + name: "Team layout", + personaIds: ["custom:team-layout"], + }, + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + + const agentsContent = page.getByTestId("agents-page-content"); + const firstAgentCard = page.getByTestId( + "persona-agent-row-custom:team-layout", + ); + const firstTeamCard = page.getByTestId("team-card-team-layout"); + const agentGrid = firstAgentCard.locator("xpath=.."); + const teamGrid = firstTeamCard.locator("xpath=.."); + const firstAgentGridCard = agentGrid.locator(":scope > *").first(); + const firstTeamGridCard = teamGrid.locator(":scope > *").first(); + + await agentsContent.evaluate((element) => { + (element as HTMLElement).style.width = "650px"; + }); + const wideAgentBox = await firstAgentGridCard.boundingBox(); + const wideTeamBox = await firstTeamGridCard.boundingBox(); + expect(wideAgentBox).not.toBeNull(); + expect(wideTeamBox).not.toBeNull(); + expect(Math.abs((wideAgentBox?.x ?? 0) - (wideTeamBox?.x ?? 0))).toBeLessThan( + 1, + ); + + await agentsContent.evaluate((element) => { + (element as HTMLElement).style.width = "600px"; + }); + await expect + .poll(async () => (await firstAgentGridCard.boundingBox())?.x ?? 0) + .toBeGreaterThan(wideAgentBox?.x ?? 0); + + const compactAgentBox = await firstAgentGridCard.boundingBox(); + const compactTeamBox = await firstTeamGridCard.boundingBox(); + expect( + Math.abs((compactAgentBox?.x ?? 0) - (compactTeamBox?.x ?? 0)), + ).toBeLessThan(1); +}); + test("team cards use the thread-style overlapping avatar stack", async ({ page, }) => { @@ -634,6 +695,62 @@ test("unconfigured agent defaults use the setup label", async ({ page }) => { ); }); +test("moves agent actions into an overflow menu in a narrow view", async ({ + page, +}) => { + await installMockBridge(page, { + personas: [ + { + id: "custom:compact-actions", + displayName: "Compact actions agent", + isActive: true, + systemPrompt: "A test agent for compact header actions.", + }, + ], + managedAgents: [ + { + name: "Compact actions instance", + personaId: "custom:compact-actions", + pubkey: "cd".repeat(32), + status: "running", + }, + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await page.getByTestId("agents-page-content").evaluate((element) => { + (element as HTMLElement).style.width = "650px"; + }); + + await expect(page.getByTestId("agent-defaults-button")).toBeVisible(); + await expect( + page.getByText("Set up and manage your agents.", { exact: true }), + ).toHaveJSProperty("scrollHeight", 24); + + await page.getByTestId("agents-page-content").evaluate((element) => { + (element as HTMLElement).style.width = "600px"; + }); + await expect(page.getByTestId("agent-defaults-button")).toBeHidden(); + await page.getByTestId("agent-actions-menu-trigger").click(); + await expect( + page.getByRole("menuitem", { name: "Set agent defaults" }), + ).toBeVisible(); + await expect( + page.getByRole("menuitem", { name: "Stop running agents" }), + ).toBeVisible(); + + await page.getByRole("menuitem", { name: "Set agent defaults" }).click(); + await expect(page.getByTestId("agent-ai-defaults-dialog")).toBeVisible(); + + await page.getByTestId("agents-page-content").evaluate((element) => { + (element as HTMLElement).style.width = "650px"; + }); + await expect(page.getByTestId("agent-defaults-button")).toBeVisible(); + await page.keyboard.press("Escape"); + await expect(page.getByTestId("agent-ai-defaults-dialog")).toHaveCount(0); + await expect(page.getByTestId("agent-defaults-button")).toBeFocused(); +}); + test("agent catalog chooser order stays stable when selection changes", async ({ page, }) => { From c9aa55505c544c608ff71648bbfd21b235637f19 Mon Sep 17 00:00:00 2001 From: Matthew Beckley Date: Thu, 30 Jul 2026 11:19:42 -0400 Subject: [PATCH 071/112] desktop: enable getUserMedia in the Linux WebKitGTK webview (#3607) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Microphone/camera capture works on macOS (WKWebView) and Windows (WebView2) but fails on Linux with `NotAllowedError`. WebKitGTK ships with `enable-media-stream` off and a default `permission-request` handler that denies every request. This reaches the underlying `webkit2gtk::WebView` from `on_webview_ready` and enables `enable-media-stream`, then installs a **deny-by-default** `permission-request` handler: a `UserMedia` request is allowed only from a trusted app origin (`tauri://localhost` in prod, the Vite dev origin in debug) **and** when it targets an audio/video device — everything else is denied. No-op on macOS/Windows. - `webkit2gtk` is pinned to the version wry already uses (`=2.0.2`) so there's a single shared copy of the native binding. --------- Signed-off-by: Beckley --- desktop/src-tauri/Cargo.lock | 1 + desktop/src-tauri/Cargo.toml | 4 + desktop/src-tauri/src/lib.rs | 6 ++ desktop/src-tauri/src/linux_media.rs | 141 +++++++++++++++++++++++++++ 4 files changed, 152 insertions(+) create mode 100644 desktop/src-tauri/src/linux_media.rs diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index d1b11b2896..7e23289f53 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1087,6 +1087,7 @@ dependencies = [ "url", "user-idle", "uuid", + "webkit2gtk", "window-vibrancy", "windows-sys 0.61.2", "zeroize", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 90f90870f6..b5b1191852 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -40,6 +40,10 @@ keyring = { version = "3.6.3", default-features = false, features = ["sync-secre # connection is dropped, which the plugin does immediately. Default features # keep the pure-Rust zbus backend, matching the plugin (no libdbus needed). notify-rust = "4" +# Enable getUserMedia in the WebKitGTK webview (see src/linux_media.rs). Pinned +# to the exact version wry links so both resolve to one webkit2gtk-sys and we +# don't get duplicate symbols; bump in lockstep with wry. +webkit2gtk = { version = "=2.0.2", features = ["v2_22"] } [target.'cfg(target_os = "macos")'.dependencies] objc2 = { version = "0.6.4", default-features = false } diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs index 35ba41bad4..c005d511e6 100644 --- a/desktop/src-tauri/src/lib.rs +++ b/desktop/src-tauri/src/lib.rs @@ -7,6 +7,7 @@ mod deep_link; mod event_sync; mod events; mod huddle; +mod linux_media; mod managed_agents; mod media_proxy; #[cfg(feature = "mesh-llm")] @@ -199,6 +200,11 @@ pub fn run() { return; } + // Linux/WebKitGTK needs media-stream settings and a + // permission-request handler for getUserMedia; no-op + // on macOS/Windows. + linux_media::enable_media_capture(&webview); + // macOS applies the restored geometry asynchronously. Wait // for several identical outer bounds and for React to // commit the startup surface before revealing it. diff --git a/desktop/src-tauri/src/linux_media.rs b/desktop/src-tauri/src/linux_media.rs new file mode 100644 index 0000000000..c768e15422 --- /dev/null +++ b/desktop/src-tauri/src/linux_media.rs @@ -0,0 +1,141 @@ +//! Linux-only: enable media capture (`getUserMedia`) in the WebKitGTK webview. +//! +//! On macOS (WKWebView) and Windows (WebView2) the media-permission prompt is +//! routed to the OS automatically, so microphone/camera capture "just works". +//! WebKitGTK is different on two counts, and both must be handled or capture +//! fails on Linux only: +//! +//! * `enable-media-stream` is **off by default**, so `navigator.mediaDevices` +//! never exposes a working `getUserMedia`; and +//! * the default `permission-request` handler **denies every request**, so even +//! with media-stream on, the call rejects with `NotAllowedError`. +//! +//! This module reaches the underlying `webkit2gtk::WebView` via +//! [`tauri::Webview::with_webview`], enables media-stream, and installs a +//! `permission-request` handler that is **deny-by-default**: a `UserMedia` +//! request is allowed only when it comes from a trusted app origin and asks for +//! an audio and/or video device. Tauri does not restrict navigation by default, +//! so without the origin check any document that ended up in this webview would +//! inherit silent mic/camera access for the process lifetime. +//! +//! Buzz's AppImage pins `GDK_BACKEND=x11` (see [`crate::webkit_rendering`]), +//! which is the backend WebKitGTK media capture is reliable on. + +/// The origin Tauri serves the packaged app from on Linux. +const PROD_ORIGIN: &str = "tauri://localhost"; + +/// The Vite dev-server origin (`devUrl` in `tauri.conf.json`, `strictPort` +/// 1420 in `vite.config.ts`). Only trusted in debug builds. +#[cfg(debug_assertions)] +const DEV_ORIGIN: &str = "http://localhost:1420"; + +/// Whether `uri` (the webview's current document URI) is a trusted app origin +/// allowed to use mic/camera. Matches the origin exactly or as a path prefix so +/// `tauri://localhost.evil.com` and `http://localhost:14200` do not slip +/// through. Pure and platform-independent so it can be unit-tested everywhere. +fn is_trusted_media_origin(uri: &str) -> bool { + fn matches(uri: &str, origin: &str) -> bool { + uri == origin + || uri + .strip_prefix(origin) + .is_some_and(|rest| rest.starts_with('/')) + } + + if matches(uri, PROD_ORIGIN) { + return true; + } + #[cfg(debug_assertions)] + if matches(uri, DEV_ORIGIN) { + return true; + } + false +} + +/// Enable microphone/camera capture for `webview` if it is running on +/// WebKitGTK. A no-op on every non-Linux target, so callers can invoke it +/// unconditionally from shared startup code. +#[cfg(target_os = "linux")] +pub fn enable_media_capture(webview: &tauri::Webview) { + use webkit2gtk::{ + glib::prelude::Cast, PermissionRequestExt, SettingsExt, UserMediaPermissionRequest, + UserMediaPermissionRequestExt, WebViewExt, + }; + + // `with_webview` runs the closure on the UI thread, which GTK calls + // require. It errors only if the platform webview is unavailable. + let result = webview.with_webview(|platform_webview| { + // On Linux this is the underlying `webkit2gtk::WebView`. + let webview = platform_webview.inner(); + + if let Some(settings) = WebViewExt::settings(&webview) { + settings.set_enable_media_stream(true); + } + + // Deny-by-default: allow only mic/camera requests from a trusted app + // origin; deny everything else (still returning `true` so WebKit's + // auto-deny default does not also run). Non-`UserMedia` requests return + // `false` and keep their default handling. + webview.connect_permission_request(|wv, request| { + let Some(request) = request.downcast_ref::() else { + return false; + }; + + let uri = wv.uri().map(|u| u.to_string()).unwrap_or_default(); + let for_device = request.is_for_audio_device() || request.is_for_video_device(); + + if for_device && is_trusted_media_origin(&uri) { + request.allow(); + } else { + request.deny(); + } + true + }); + }); + + if let Err(error) = result { + eprintln!("buzz-desktop: could not enable WebKitGTK media capture: {error}"); + } +} + +/// No-op stub so shared startup code can call [`enable_media_capture`] on every +/// platform. macOS and Windows route media permissions through the OS. +#[cfg(not(target_os = "linux"))] +pub fn enable_media_capture(_webview: &tauri::Webview) {} + +#[cfg(test)] +mod tests { + use super::is_trusted_media_origin; + + #[test] + fn allows_production_app_origin() { + assert!(is_trusted_media_origin("tauri://localhost")); + assert!(is_trusted_media_origin( + "tauri://localhost/channels/general" + )); + } + + #[test] + fn denies_untrusted_origins() { + assert!(!is_trusted_media_origin("")); + assert!(!is_trusted_media_origin("https://evil.example.com")); + // Prefix look-alikes must not slip through. + assert!(!is_trusted_media_origin("tauri://localhost.evil.com")); + assert!(!is_trusted_media_origin("tauri://localhostfoo")); + } + + #[cfg(debug_assertions)] + #[test] + fn allows_dev_origin_in_debug_only() { + assert!(is_trusted_media_origin("http://localhost:1420")); + assert!(is_trusted_media_origin("http://localhost:1420/")); + // A different localhost port is still untrusted. + assert!(!is_trusted_media_origin("http://localhost:14200")); + assert!(!is_trusted_media_origin("http://localhost:3000")); + } + + #[cfg(not(debug_assertions))] + #[test] + fn denies_dev_origin_in_release() { + assert!(!is_trusted_media_origin("http://localhost:1420")); + } +} From 9a386a0defbf2b355ee17646c7c11817a535b85f Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Thu, 30 Jul 2026 16:23:16 +0100 Subject: [PATCH 072/112] Refine agent sharing dialog (#3699) ## Summary - Refine the agent share dialog around recipient sharing, link copying, catalog sharing, and export. - Show memory settings only when a linked agent has memories to include. - Use a catalog toggle for custom agents and keep built-in agents out of the catalog flow. ## Validation - `pnpm typecheck` - Focused Playwright share and catalog flows --------- Signed-off-by: kenny lopez Signed-off-by: Wes Co-authored-by: Wes Co-authored-by: Carl --- .../features/agents/ui/PersonaShareDialog.tsx | 149 +++++------- desktop/tests/e2e/agents.spec.ts | 214 +++++++----------- 2 files changed, 139 insertions(+), 224 deletions(-) diff --git a/desktop/src/features/agents/ui/PersonaShareDialog.tsx b/desktop/src/features/agents/ui/PersonaShareDialog.tsx index c641de9c70..5cf4f9ea3b 100644 --- a/desktop/src/features/agents/ui/PersonaShareDialog.tsx +++ b/desktop/src/features/agents/ui/PersonaShareDialog.tsx @@ -37,10 +37,13 @@ import { Dialog, DialogClose, DialogContent, + DialogDescription, DialogHeader, DialogTitle, } from "@/shared/ui/dialog"; +import { Separator } from "@/shared/ui/separator"; import { Spinner } from "@/shared/ui/spinner"; +import { Switch } from "@/shared/ui/switch"; import { formatShareRecipientName, @@ -63,7 +66,7 @@ type PersonaShareDialogProps = { }; type SnapshotShareDialogProps = { - afterLink?: React.ReactNode; + beforeExport?: React.ReactNode; displayName: string; encodeSnapshot: ( memoryLevel: SnapshotMemoryLevel, @@ -198,7 +201,6 @@ function MemoryShareConfirmation({ function ShareLevelControl({ ariaLabel, disabled, - hasMemoryOptions, testId, value, options, @@ -206,27 +208,11 @@ function ShareLevelControl({ }: { ariaLabel: string; disabled: boolean; - hasMemoryOptions: boolean; testId: string; value: SnapshotMemoryLevel; options: { value: SnapshotMemoryLevel; label: string }[]; onChange: (level: SnapshotMemoryLevel) => void; }) { - if (!hasMemoryOptions) { - // Nothing to choose from, so there is no dropdown to open. State the - // outcome rather than naming the sole option: the memory-level labels - // ("Agent only", "+ core memory", …) are comparative and only make sense - // when the alternatives are actually offered. - return ( - - No memories included - - ); - } - return ( - + Share {displayName} + + Anyone you share this {itemLabel} with will receive a copy they + can add and use. Changes you make later won’t sync. +
-

- They’ll receive a copy they can add and use. Changes you make - later won’t sync. -

+ {hasMemoryOptions ? ( +
+

+ Share settings +

+
+

+ What’s included +

+ +
+
+ ) : null} + + +
- - - -
-

Share with a link

-

- Anyone with the link can add and use a copy. -

-
-
-

- What’s included -

- -
- {showMemoryWarning ? ( ) : null} - - {afterLink}
+ {beforeExport}
) } diff --git a/desktop/tests/e2e/agents.spec.ts b/desktop/tests/e2e/agents.spec.ts index 8c1c407df1..42d4aac114 100644 --- a/desktop/tests/e2e/agents.spec.ts +++ b/desktop/tests/e2e/agents.spec.ts @@ -93,10 +93,10 @@ async function sharePersonaToCatalog( ) { await page.getByLabel(`Open actions for ${displayName}`).click(); await page.getByRole("menuitem", { name: "Share" }).click(); - await page.getByTestId("persona-share-catalog-access").click(); - await page - .getByRole("menuitemradio", { name: "Shared", exact: true }) - .click(); + const catalogToggle = page.getByTestId("persona-share-catalog-access"); + await expect(catalogToggle).not.toBeChecked(); + await catalogToggle.click(); + await expect(catalogToggle).toBeChecked(); await page .getByTestId("persona-share-dialog") .getByRole("button", { name: "Close" }) @@ -979,21 +979,27 @@ test("custom personas share with people and keep export separate", async ({ page.getByRole("heading", { name: "Share Animation Auditor" }), ).toBeVisible(); await expect(shareDialog.getByText("Added by You")).toHaveCount(0); - const sendDescription = shareDialog.getByTestId( - "persona-share-send-description", - ); - await expect(sendDescription).toHaveText( - "They’ll receive a copy they can add and use. Changes you make later won’t sync.", - ); - await expect(sendDescription).toHaveClass( - /text-xs.*text-secondary-foreground\/75/, + const shareDescription = shareDialog.getByTestId( + "persona-share-share-description", + ); + await expect(shareDescription).toHaveText( + "Anyone you share this agent with will receive a copy they can add and use. Changes you make later won’t sync.", + ); + await expect(shareDescription).toHaveClass(/text-sm.*text-muted-foreground/); + const shareDescriptionId = await shareDescription.getAttribute("id"); + expect(shareDescriptionId).toBeTruthy(); + await expect(shareDialog).toHaveAttribute( + "aria-describedby", + shareDescriptionId ?? "", + ); + const shareDescriptionMetrics = await shareDescription.evaluate( + (element) => ({ + height: element.getBoundingClientRect().height, + lineHeight: Number.parseFloat(getComputedStyle(element).lineHeight), + }), ); - const sendDescriptionMetrics = await sendDescription.evaluate((element) => ({ - height: element.getBoundingClientRect().height, - lineHeight: Number.parseFloat(getComputedStyle(element).lineHeight), - })); - expect(sendDescriptionMetrics.height).toBeLessThanOrEqual( - sendDescriptionMetrics.lineHeight + 1, + expect(shareDescriptionMetrics.height).toBeLessThanOrEqual( + shareDescriptionMetrics.lineHeight * 2 + 1, ); await expect( shareDialog.getByRole("heading", { name: "Who has access" }), @@ -1001,57 +1007,49 @@ test("custom personas share with people and keep export separate", async ({ await expect(shareDialog.getByText("Owner", { exact: true })).toHaveCount(0); await expect(shareDialog.getByText("(You)", { exact: true })).toHaveCount(0); const linkRow = page.getByTestId("persona-share-link-row"); + await expect(page.getByTestId("persona-share-copy-link")).toBeVisible(); await expect( - linkRow.getByRole("heading", { name: "Share with a link" }), - ).toBeVisible(); + shareDialog.getByRole("heading", { name: "Share with a link" }), + ).toHaveCount(0); await expect( - linkRow.getByText("Anyone with the link can add and use a copy."), - ).toHaveClass(/text-xs.*text-secondary-foreground\/75/); + shareDialog.getByText("Anyone with the link can add and use a copy."), + ).toHaveCount(0); await expect(page.getByTestId("persona-share-send")).toHaveCount(0); const copyLinkButton = page.getByTestId("persona-share-copy-link"); - const linkIcon = page.getByTestId("persona-share-link-icon"); - const linkCopy = page.getByTestId("persona-share-link-copy"); const catalogSection = page.getByTestId("persona-share-catalog"); - const staticShareLevel = page.getByTestId("persona-share-share-level"); - const shareLevelRow = page.getByTestId("persona-share-share-level-row"); + const shareMainCard = page.getByTestId("persona-share-main-card"); + const exportAgentRow = page.getByTestId("persona-share-export"); await waitForAnimations(page); const [ linkRowBox, initialCopyLinkButtonBox, - linkIconBox, - linkCopyBox, catalogSectionBox, - staticShareLevelBox, - shareLevelRowBox, + shareMainCardBox, + exportAgentRowBox, ] = await Promise.all([ linkRow.boundingBox(), copyLinkButton.boundingBox(), - linkIcon.boundingBox(), - linkCopy.boundingBox(), catalogSection.boundingBox(), - staticShareLevel.boundingBox(), - shareLevelRow.boundingBox(), + shareMainCard.boundingBox(), + exportAgentRow.boundingBox(), ]); - const sendDescriptionBox = await sendDescription.boundingBox(); + const shareDescriptionBox = await shareDescription.boundingBox(); const recipientFieldBox = await page .getByTestId("persona-share-recipient-field") .boundingBox(); - // Reading order: who → how it goes out → what's included → catalog. - expect(sendDescriptionBox?.y ?? 0).toBeGreaterThanOrEqual( - (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0), - ); - expect(linkRowBox?.y ?? 0).toBeGreaterThanOrEqual( - (sendDescriptionBox?.y ?? 0) + (sendDescriptionBox?.height ?? 0), + // Without memories, the recipient field flows directly into the link action. + expect(recipientFieldBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareDescriptionBox?.y ?? 0) + (shareDescriptionBox?.height ?? 0), ); - expect(shareLevelRowBox?.y ?? 0).toBeGreaterThanOrEqual( - (linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0), + await expect(page.getByTestId("persona-share-link-settings")).toHaveCount(0); + await expect(page.getByTestId("persona-share-share-level-row")).toHaveCount( + 0, ); - expect(catalogSectionBox?.y ?? 0).toBeGreaterThanOrEqual( - (shareLevelRowBox?.y ?? 0) + (shareLevelRowBox?.height ?? 0), + expect(linkRowBox?.y ?? 0).toBeGreaterThanOrEqual( + (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0), ); - // Copy link is the link row's own action, not a stranded footer button, so - // it rides on that row, vertically centred with the link icon and flush to - // the row's right edge. + // Copy link stays inside the main card, after the shared settings divider, while catalog and + // export are separate rows below it. expect(initialCopyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual( linkRowBox?.y ?? 0, ); @@ -1059,40 +1057,15 @@ test("custom personas share with people and keep export separate", async ({ (initialCopyLinkButtonBox?.y ?? 0) + (initialCopyLinkButtonBox?.height ?? 0), ).toBeLessThanOrEqual((linkRowBox?.y ?? 0) + (linkRowBox?.height ?? 0) + 1); - expect( - Math.abs( - (initialCopyLinkButtonBox?.y ?? 0) + - (initialCopyLinkButtonBox?.height ?? 0) / 2 - - ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2), - ), - ).toBeLessThanOrEqual(1); - expect( - Math.abs( - (linkRowBox?.x ?? 0) + - (linkRowBox?.width ?? 0) - - ((initialCopyLinkButtonBox?.x ?? 0) + - (initialCopyLinkButtonBox?.width ?? 0)), - ), - ).toBeLessThanOrEqual(1); - expect( - Math.abs( - (linkCopyBox?.y ?? 0) + - (linkCopyBox?.height ?? 0) / 2 - - ((linkIconBox?.y ?? 0) + (linkIconBox?.height ?? 0) / 2), - ), - ).toBeLessThanOrEqual(1); - await expect(page.getByTestId("persona-share-link-divider")).toHaveCount(0); - await expect(page.getByTestId("persona-share-copy-link-footer")).toHaveCount( - 0, + await expect(page.getByTestId("persona-share-link-divider")).toHaveClass( + /bg-input\/40/, + ); + expect(catalogSectionBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0) + 12, + ); + expect(exportAgentRowBox?.y ?? 0).toBeGreaterThanOrEqual( + (catalogSectionBox?.y ?? 0) + (catalogSectionBox?.height ?? 0) + 12, ); - expect( - Math.abs( - (shareLevelRowBox?.y ?? 0) + - (shareLevelRowBox?.height ?? 0) / 2 - - ((staticShareLevelBox?.y ?? 0) + - (staticShareLevelBox?.height ?? 0) / 2), - ), - ).toBeLessThanOrEqual(1); await expect(copyLinkButton).toHaveClass( /border.*bg-background.*border-border/, ); @@ -1109,12 +1082,7 @@ test("custom personas share with people and keep export separate", async ({ await expect.poll(copyLinkHasVisibleShadow).toBe(false); await copyLinkButton.hover(); await expect.poll(copyLinkHasVisibleShadow).toBe(false); - await expect(page.getByTestId("persona-share-share-level")).toHaveText( - "No memories included", - ); - await expect( - shareDialog.getByText("No memories included", { exact: true }), - ).toHaveCount(1); + await expect(page.getByTestId("persona-share-share-level")).toHaveCount(0); await expect(page.getByTestId("persona-share-recipient-access")).toHaveCount( 0, ); @@ -1131,20 +1099,10 @@ test("custom personas share with people and keep export separate", async ({ await expect( shareDialog.getByText("File format", { exact: true }), ).toHaveCount(0); - const shareMainCard = page.getByTestId("persona-share-main-card"); - const exportAgentRow = page.getByTestId("persona-share-export"); await expect(exportAgentRow).toHaveText("Export agent"); await expect(shareMainCard.getByTestId("persona-share-export")).toHaveCount( 0, ); - await waitForAnimations(page); - const shareMainCardBox = await shareMainCard.boundingBox(); - const exportAgentRowBox = await exportAgentRow.boundingBox(); - const shareCardGap = - (exportAgentRowBox?.y ?? 0) - - ((shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0)); - expect(shareCardGap).toBeGreaterThanOrEqual(12); - expect(shareCardGap).toBeLessThan(16); const [shareMainCardStyles, exportAgentRowStyles] = await Promise.all([ shareMainCard.evaluate((element) => ({ borderRadius: getComputedStyle(element).borderRadius, @@ -1528,9 +1486,9 @@ This deliberately long fenced-code example must not establish the minimum width const shareMainCard = shareDialog.getByTestId("persona-share-main-card"); const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link"); const catalogSection = shareDialog.getByTestId("persona-share-catalog"); - await expect( - shareMainCard.getByTestId("persona-share-catalog"), - ).toBeVisible(); + await expect(shareMainCard.getByTestId("persona-share-catalog")).toHaveCount( + 0, + ); await expect(catalogSection).toContainText("Share to catalog"); await expect(catalogSection).toContainText( "Anyone in this community can find and use a copy.", @@ -1544,26 +1502,18 @@ This deliberately long fenced-code example must not establish the minimum width catalogSection.boundingBox(), shareMainCard.boundingBox(), ]); - // Copy link belongs to the link row above, so the catalog is the section - // that closes the card rather than trailing an orphaned button. + // Catalog is its own card below the sharing controls. expect( (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0), - ).toBeLessThanOrEqual(catalogSectionBox?.y ?? 0); - expect( - (catalogSectionBox?.y ?? 0) + (catalogSectionBox?.height ?? 0), ).toBeLessThanOrEqual( (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0), ); - await expect(catalogAccess).toHaveText("Not shared"); + expect(catalogSectionBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareMainCardBox?.y ?? 0) + (shareMainCardBox?.height ?? 0), + ); + await expect(catalogAccess).not.toBeChecked(); await catalogAccess.click(); - await expect(page.getByRole("menuitemradio")).toHaveText([ - "Not shared", - "Shared", - ]); - await page - .getByRole("menuitemradio", { name: "Shared", exact: true }) - .click(); - await expect(catalogAccess).toHaveText("Shared"); + await expect(catalogAccess).toBeChecked(); const storedPersonas = await invokeTauri< Array<{ id: string; shared: boolean }> >(page, "list_personas"); @@ -1651,11 +1601,9 @@ This deliberately long fenced-code example must not establish the minimum width await page.getByLabel("Open actions for Catalog Analyst").click(); await page.getByRole("menuitem", { name: "Share" }).click(); - await expect(catalogAccess).toHaveText("Shared"); + await expect(catalogAccess).toBeChecked(); await catalogAccess.click(); - await page - .getByRole("menuitemradio", { name: "Not shared", exact: true }) - .click(); + await expect(catalogAccess).not.toBeChecked(); await page .getByTestId("persona-share-dialog") .getByRole("button", { name: "Close" }) @@ -1687,9 +1635,6 @@ test("a queued catalog share is not presented as relay-published", async ({ await page.getByLabel("Open actions for Queued Catalog Agent").click(); await page.getByRole("menuitem", { name: "Share" }).click(); await page.getByTestId("persona-share-catalog-access").click(); - await page - .getByRole("menuitemradio", { name: "Shared", exact: true }) - .click(); await expect( page.getByText( @@ -1918,7 +1863,7 @@ test("one share level selector drives both the link and send paths", async ({ const shareLevel = shareDialog.getByLabel("What to include", { exact: true, }); - const catalogAccess = shareDialog.getByLabel("What to share in the catalog"); + const catalogAccess = shareDialog.getByLabel("Share to catalog"); const recipientField = page.getByTestId("persona-share-recipient-field"); const emptyRecipientFieldBox = await recipientField.boundingBox(); await expect(shareDialog.getByTestId("persona-share-send")).toHaveCount(0); @@ -1930,13 +1875,14 @@ test("one share level selector drives both the link and send paths", async ({ await expect(shareLevel).toHaveCSS("text-decoration-line", "none"); await expect(shareLevel).toHaveCSS("padding-left", "8px"); await expect(shareLevel).toHaveCSS("padding-right", "8px"); - await expect(catalogAccess).toHaveText("Not shared"); - await catalogAccess.click(); - await expect(page.getByRole("menuitemradio")).toHaveText([ - "Not shared", - "Shared", - ]); - await page.keyboard.press("Escape"); + await expect(catalogAccess).not.toBeChecked(); + await expect(catalogAccess).toHaveCSS("cursor", "default"); + await expect( + shareDialog.getByTestId("persona-share-link-settings"), + ).toContainText("Share settings"); + await expect( + shareDialog.getByText("Share settings", { exact: true }), + ).toHaveClass(/text-xs.*text-secondary-foreground\/75/); const copyLinkButton = shareDialog.getByTestId("persona-share-copy-link"); const recipientFieldBox = await recipientField.boundingBox(); const [shareLevelBox, copyLinkButtonBox, catalogAccessBox] = @@ -1945,15 +1891,15 @@ test("one share level selector drives both the link and send paths", async ({ copyLinkButton.boundingBox(), catalogAccess.boundingBox(), ]); - // Reading order: who → how it goes out → what's included → catalog. - expect(copyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual( + // Reading order: who → what's included → copy link → catalog. + expect(shareLevelBox?.y ?? 0).toBeGreaterThanOrEqual( (recipientFieldBox?.y ?? 0) + (recipientFieldBox?.height ?? 0), ); - expect(shareLevelBox?.y ?? 0).toBeGreaterThanOrEqual( - (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0), + expect(copyLinkButtonBox?.y ?? 0).toBeGreaterThanOrEqual( + (shareLevelBox?.y ?? 0) + (shareLevelBox?.height ?? 0), ); expect(catalogAccessBox?.y ?? 0).toBeGreaterThanOrEqual( - (shareLevelBox?.y ?? 0) + (shareLevelBox?.height ?? 0), + (copyLinkButtonBox?.y ?? 0) + (copyLinkButtonBox?.height ?? 0), ); // The memory choice is stated once, governing both delivery actions — // neither the recipients row nor the link row carries its own copy. From 33bf7caa6ea474ccde2932c1ed05a90d7345c6e0 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 30 Jul 2026 11:28:49 -0400 Subject: [PATCH 073/112] docs(nips): specify kind:30621 multi-repo projects (NIP-MP) (#3163) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Buzz renders one card per `kind:30617`, so a project spanning several repositories has no representation — the relay, desktop app, and mobile app look like three unrelated things. This adds the spec for the container event that fixes that, plus the two shared fixture files that make it machine-checkable. Docs only; no code changes. Membership cannot live in the repository announcements themselves. A project spanning Alice's and Bob's repositories would need *both* of them to publish a tag naming the group, and Alice cannot sign for Bob's key. A project's own name, description, and channel binding likewise have no single writer when scattered across per-repository tags, and no deletion story. That is why multi-repo grouping is the one forge concept in Buzz that warrants a custom kind. ## `docs/nips/NIP-MP.md` `kind:30621`, an addressable event per NIP-01, addressed by `(pubkey, 30621, d)`. Members are `a` tags holding canonical `30617::` coordinates, following NIP-01's 2-or-3-element grammar where the optional third element is a relay hint clients MAY use and whose content ingest does not parse. Metadata is `name`, `description`, `buzz-channel`, `buzz-visibility`. - **Authority stops at the container.** The signer can replace their own project and nothing else — no edit, delete, push, or admin over any member. Deletion additionally admits the signer's registered NIP-OA owner, because `validate_standard_deletion_event` (`crates/buzz-relay/src/handlers/side_effects.rs`) grants that platform-wide so a human can clean up events published by an agent they own; the spec documents it as a Buzz extension to NIP-09 rather than carving `kind:30621` out of it. `buzz-channel` on a project is metadata only; git push policy reads the repository's own `kind:30617` (`crates/buzz-relay/src/api/git/policy.rs`) and a project never becomes an input to it. - **Ingest validation contract**, with named rules the fixtures reference: `d-cardinality`, `d-empty`, `member-cap` (64, counting every `a` tag), `member-tag-arity`, `member-coordinate-malformed`, `member-duplicate`, `metadata-cardinality`, `metadata-length`. Arity is its own rule rather than part of coordinate parsing, because a four-element member tag can carry a valid coordinate — the tag's shape is what is wrong, and ignoring elements past the relay hint would admit unvalidated data no consumer reads. Duplicates are rejected rather than normalized — a relay cannot rewrite tags inside a signed event without invalidating its id and signature. - **Metadata interpretation is normative, not left to the reader.** Ingest bounds cardinality and length and interprets nothing; clients resolve absent `name` to the `d` value, any unrecognized `buzz-visibility` token to `listed` (a typo is not a privacy signal), and an unresolvable `buzz-channel` to a project rendered without a channel rather than dropped. `content` carries no meaning: writers SHOULD emit `""`, and readers and relays MUST ignore any value rather than reject it. - **Claim authority.** A project suppresses a member's standalone card only when it is listing eligible *and* its signer is that repository's owner or appears in the repository's own `maintainers` tag. Without this, anyone could publish a project naming your repository and pull it out of the collection into a container you never consented to. An unauthorized project still renders, and still renders its members — it just cannot remove a repository from where its owner expects to find it. - **Deterministic client fold**, seven steps, with a table of required cases: exhaustive enumeration (a fixed `limit: 200` makes repository 201 vanish), multiple membership, fallback to a standalone card, unresolvable members marked unavailable rather than dropped, and local hide of a container never hiding repositories. On a relay that provides no exhaustive mode, the conformant behavior is a persistently marked possibly-incomplete collection — not a violation of the enumeration requirement. - **Pagination is specified in two modes**, because exhaustive enumeration is not universally achievable. Both modes share an explicit three-condition relay contract: a relay must (1) apply the complete filter before enforcing any limit, (2) expose the exact effective page limit it enforces, and (3) saturate pages — return `min(effective limit, remaining matches)`, so a short page proves all remaining matches were returned. A relay satisfying any proper subset does not provide the guarantee, and absent it a client MUST mark the collection possibly incomplete. On a relay exposing a composite `(created_at, event id)` keyset cursor — Buzz does on its authenticated HTTP bridge endpoint, via `until` + `before_id`; the NIP-01 websocket REQ path silently discards `before_id`, so a websocket client against Buzz is in mode 2 — clients MUST page by it; within the relay contract the cursor's uniqueness means no skips or re-reads and a short page is an unambiguous end signal, but cursor uniqueness alone does not substitute for the relay contract. A vanilla NIP-01 filter has no id tiebreak, so `until` alone either skips a second's unread events or never advances; there a client MUST drain the boundary second explicitly. The spec also adds normative guidance on query shapes: a client MUST use only query shapes the relay applies completely before limiting, and where a needed constraint (such as `#a`) is post-applied, MUST widen to a pushable shape and match the rest client-side. - **Kind allocation** recorded with the checks performed: `30621` is unassigned in the upstream nostr NIPs kind table and has no nostrbook.dev entry, and it is the one free number between `30620` and `30622` locally. ## `docs/nips/NIP-MP.fixtures.json` The ingest contract: 31 cases — 11 accept, 20 reject — as unsigned templates consumers sign with their own test key. Coverage includes minimal and full projects, zero members, the 64-member boundary from both sides, cross-owner and same-`d`-different-owner members, colon-bearing repository `d` values, relay hints, non-empty `content`, and every rejection rule. Each of the two 256-byte `buzz-` bounds gets its own reject case so neither can hide behind the other's rejection, and duplicate detection is pinned to the coordinate alone by a case whose two identical coordinates carry different relay hints. A four-element member tag carrying an otherwise valid coordinate pins arity separately from coordinate parsing. Every rejection case names the rules that may fire, so an implementation cannot pass by rejecting a bad event for an unrelated reason. ## `docs/nips/NIP-MP.fold-fixtures.json` The fold oracle: 12 cases covering every row of the required-fold-cases table, including the discriminating case where one authorized and one unauthorized project list the same repository — an implementation that requires every listing project to be authorized emits a spurious implicit card, and one that lets any listing project suppress drops a card it owes the owner. Inputs are semantic rather than signed envelopes: a repository or project is named by its coordinate plus only what the fold reads — signer, members, `maintainers`, visibility, viewer-hidden, deletion. Every collection in `expect` is compared as a set, including each container's `members`, since the fold fixes placement and not order. Signing would re-test the ingest contract and obscure what is under test. The fold is where claim authority lives, so without a shared oracle two clients could each satisfy the prose and still render different collections from identical heads. ## `VISION_PROJECTS.md` Line 41's "zero custom kinds" now reads "no custom kind for the repo itself", with a new "One Project, Many Repos" section recording why the one exception is warranted. `30621` rows added to the kind and status tables. Related: #3171 (the `KIND_PROJECT` constant, relay ingest validation of this contract, and the inclusive `created_at <= tombstone` bound this spec's coordinate-deletion rule cites). Independent — either can merge first. --------- Signed-off-by: Will Pfleger --- VISION_PROJECTS.md | 34 +- docs/nips/NIP-MP.fixtures.json | 1462 +++++++++++++++++++++++++++ docs/nips/NIP-MP.fold-fixtures.json | 527 ++++++++++ docs/nips/NIP-MP.md | 331 ++++++ 4 files changed, 2353 insertions(+), 1 deletion(-) create mode 100644 docs/nips/NIP-MP.fixtures.json create mode 100644 docs/nips/NIP-MP.fold-fixtures.json create mode 100644 docs/nips/NIP-MP.md diff --git a/VISION_PROJECTS.md b/VISION_PROJECTS.md index a44d7e05f7..8601b87829 100644 --- a/VISION_PROJECTS.md +++ b/VISION_PROJECTS.md @@ -38,12 +38,42 @@ Branch protections live in the same event — `buzz-protect` tags. The relay enf Agents inherit access from their owner via [NIP-OA](docs/nips/NIP-OA.md). The relay checks: does the push carry a valid NIP-OA auth tag, and is the owner pubkey in that tag listed in `push-allowed`? If yes, the push is accepted — the agent's own pubkey doesn't need to be in the list. Add a maintainer, and all their authorized agents can push. Remove the maintainer, and all their agents lose access instantly. Agents without NIP-OA attestation are treated as their own identity and must be listed explicitly. -Standard NIP-34 clients see a normal repo. gitworkshop.dev renders it. ngit-cli works with it. Buzz clients read the `buzz-` tags and wire up the channel and project UI. One event, two audiences, zero custom kinds. +Standard NIP-34 clients see a normal repo. gitworkshop.dev renders it. ngit-cli works with it. Buzz clients read the `buzz-` tags and wire up the channel and project UI. One event, two audiences, no custom kind for the repo itself. NIP-34 is the metadata and discovery layer. Git remains the transport. The transport is boring. The metadata is portable. --- +## One Project, Many Repos + +Real work spans repositories. The platform is a relay, a desktop app, and a mobile app — three repos, one project. Render one card per repo and they look like three unrelated things. + +Grouping is the one forge semantic that per-repo tags cannot express, and it's worth being precise about why, because everything else here deliberately avoids a custom kind. + +Put membership in each `kind:30617` and a project spanning Alice's and Bob's repos needs *both* of them to publish a tag naming the group. Alice can't enroll Bob's repo — she can't sign for his key. Cross-owner grouping becomes impossible, and the project's own name, description, and channel end up scattered across events with no single writer and no deletion story: dropping a repo from the group would mean editing an event you don't control. + +So there is exactly one custom kind — [NIP-MP](docs/nips/NIP-MP.md), `kind:30621`. One signer, one replaceable event, all group state in one place: + +```json +{ + "kind": 30621, + "tags": [ + ["d", "platform"], + ["name", "Platform"], + ["a", "30617::buzz"], + ["a", "30617::buzz-infra"], + ["buzz-channel", ""], + ["buzz-visibility", "listed"] + ] +} +``` + +A project points at repos. That's all it does. The signer gets no authority over any member — no edit, no delete, no push, no admin. Adding Bob's repo to your project is your signed assertion that the two belong together, and it changes nothing about Bob's repo or who can push to it. Push policy reads the repo's own event, never the project's. + +The cost is stated plainly: a third-party NIP-34 client sees the member repos individually and ignores the grouping. Nothing degrades — the repos are still standard, portable `kind:30617` events. And a repo in no project still renders on its own, exactly as before. + +--- + ## Branches as Channels A feature branch is a conversation. @@ -205,6 +235,7 @@ Standard kinds as substrate. Custom kinds only where genuinely novel. | **Workflows** | — | 46001-46012 | No NIP equivalent | | **Job dispatch** | — | 43001-43006 | Delegation trees | | **Project binding** | 30617 (NIP-34) | `buzz-` tags | Channel, visibility | +| **Multi-repo projects** | — | 30621 ([NIP-MP](docs/nips/NIP-MP.md)) | Cross-owner grouping is unexpressible in per-repo tags | | **Audit** | — | 48001 | Hash-chain tamper-evident log | If Buzz disappears tomorrow, your repos still work on gitworkshop.dev, your patches still work with ngit-cli, your identities still work on any nostr client. Centralized deployment, decentralized protocol. @@ -221,6 +252,7 @@ If Buzz disappears tomorrow, your repos still work on gitworkshop.dev, your patc | Blossom media storage (SHA-256, S3) | ✅ Ships today | | Approval gates | 🚧 Infrastructure exists; executor wiring in progress | | Project binding (kind:30617 + `buzz-` tags) | 📋 Designed | +| Multi-repo projects (kind:30621, [NIP-MP](docs/nips/NIP-MP.md)) | 📋 Designed | | Git hosting (smart HTTP + NIP-34) | ✅ Ships today | | Merge coordinator | 📋 Designed | | NIP-34 issues (kind:1621) | 📋 Designed | diff --git a/docs/nips/NIP-MP.fixtures.json b/docs/nips/NIP-MP.fixtures.json new file mode 100644 index 0000000000..cfc570ec65 --- /dev/null +++ b/docs/nips/NIP-MP.fixtures.json @@ -0,0 +1,1462 @@ +{ + "$comment": "NIP-MP conformance fixtures \u2014 the shared ingest contract for the relay validator, the Rust event builder, and the TypeScript event builder. Each case carries an UNSIGNED template: consumers sign it with their own test key, because signing fixes the event id and signature and a stored literal would not survive re-serialization. `expect` is the ingest outcome. `reject_rules` lists the validation rules that may fire; an implementation must reject for one of them, so it cannot pass by rejecting for an unrelated reason. This file covers single-event accept/reject only; the client-side fold has its own oracle in NIP-MP.fold-fixtures.json. Spec: docs/nips/NIP-MP.md.", + "version": 1, + "kind": 30621, + "member_cap": 64, + "owners": { + "a": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "b": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + }, + "cases": [ + { + "name": "valid_minimal", + "expect": "accept", + "note": "Only the identity tag. A project needs nothing but a `d` tag to be a valid addressable container.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ] + ] + } + }, + { + "name": "valid_full", + "expect": "accept", + "note": "Every specified tag present, with two members owned by two different pubkeys \u2014 the cross-owner grouping that motivates the kind.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "name", + "Platform" + ], + [ + "description", + "Relay, desktop, and mobile for the platform team." + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + [ + "a", + "30617:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:buzz-infra" + ], + [ + "buzz-channel", + "3580ca9b-47b4-4af9-b22a-1068778f26c6" + ], + [ + "buzz-visibility", + "listed" + ] + ] + } + }, + { + "name": "valid_zero_members", + "expect": "accept", + "note": "Zero-member project. Legal at the protocol layer: it is the natural state after removing a final member and carries only bounded metadata.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "name", + "Platform" + ] + ] + } + }, + { + "name": "valid_unlisted", + "expect": "accept", + "note": "Explicitly unlisted container. Accepted at ingest; the fold excludes it from listing eligibility, so its member keeps its implicit card.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "skunkworks" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + [ + "buzz-visibility", + "unlisted" + ] + ] + } + }, + { + "name": "valid_member_cap_boundary", + "expect": "accept", + "note": "Exactly 64 distinct member `a` tags \u2014 the cap is inclusive. Paired with `invalid_member_cap_exceeded` to pin the boundary from both sides.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "wide" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-00" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-01" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-02" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-03" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-04" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-05" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-06" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-07" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-08" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-09" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-10" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-11" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-12" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-13" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-14" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-15" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-16" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-17" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-18" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-19" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-20" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-21" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-22" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-23" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-24" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-25" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-26" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-27" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-28" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-29" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-30" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-31" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-32" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-33" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-34" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-35" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-36" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-37" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-38" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-39" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-40" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-41" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-42" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-43" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-44" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-45" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-46" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-47" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-48" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-49" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-50" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-51" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-52" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-53" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-54" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-55" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-56" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-57" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-58" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-59" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-60" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-61" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-62" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-63" + ] + ] + } + }, + { + "name": "valid_same_dtag_two_owners", + "expect": "accept", + "note": "Two members share a repo `d` segment under different owners (the NIP-34 fork case). Identity is the whole coordinate, so these are not duplicates.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "forks" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + [ + "a", + "30617:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:buzz" + ] + ] + } + }, + { + "name": "valid_member_dtag_contains_colon", + "expect": "accept", + "note": "Repo `d` segment contains a colon. The coordinate splits into at most three parts, so the third part is the repo `d` value verbatim \u2014 `buzz:infra` here. Splitting on every colon instead would make any repo with a colon in its `d` tag unaddressable by a project.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz:infra" + ] + ] + } + }, + { + "name": "valid_uninterpreted_metadata_values", + "expect": "accept", + "note": "`buzz-channel` is not a UUID and `buzz-visibility` is an unrecognized token. Ingest bounds metadata cardinality and length but does not interpret these values \u2014 matching how kind:30617 carries the same two tags. Client-side fallbacks for both are normative in the spec's Metadata interpretation section: an unresolvable channel renders the project without one, and an unrecognized visibility is treated as `listed`.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "buzz-channel", + "not-a-uuid" + ], + [ + "buzz-visibility", + "chartreuse" + ] + ] + } + }, + { + "name": "valid_unknown_tag_ignored", + "expect": "accept", + "note": "An unrecognized tag is neither rejected nor interpreted \u2014 unknown tags are ignored, not fatal.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "future-metadata", + "preserve-me" + ] + ] + } + }, + { + "name": "valid_member_relay_hint", + "expect": "accept", + "note": "Member `a` tag carries NIP-01's optional third element, a relay hint. Ingest validates the tag's arity and the coordinate in element 1, so the hint's content is neither parsed nor a rejection cause; a client MAY use it to resolve an otherwise unavailable member.", + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "wss://relay.example.com" + ] + ] + } + }, + { + "name": "valid_non_empty_content", + "expect": "accept", + "note": "`content` holds a value. Writers should emit the empty string, but readers and relays must ignore whatever is there \u2014 a non-empty `content` is not a rejection cause and carries no semantics.", + "template": { + "kind": 30621, + "content": "ignored by every consumer", + "tags": [ + [ + "d", + "platform" + ] + ] + } + }, + { + "name": "invalid_d_missing", + "expect": "reject", + "note": "No `d` tag. Without one the event collapses into the `(pubkey, 30621, \"\")` slot and silently last-write-wins over an unrelated project.", + "reject_rules": [ + "d-cardinality" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "name", + "Platform" + ] + ] + } + }, + { + "name": "invalid_d_multiple", + "expect": "reject", + "note": "Two `d` tags. Which one addresses the event is reader-dependent; reject rather than pick.", + "reject_rules": [ + "d-cardinality" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "d", + "infra" + ] + ] + } + }, + { + "name": "invalid_d_empty", + "expect": "reject", + "note": "Present but empty `d`. Same slot-collapse hazard as a missing `d`.", + "reject_rules": [ + "d-empty" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "" + ] + ] + } + }, + { + "name": "invalid_member_duplicate", + "expect": "reject", + "note": "The same canonical coordinate twice. A signed event cannot be normalized in place, so the relay refuses it rather than store a head every consumer must defensively dedupe.", + "reject_rules": [ + "member-duplicate" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + ] + } + }, + { + "name": "invalid_member_duplicate_differing_relay_hints", + "expect": "reject", + "note": "The same coordinate twice under different relay hints. Duplicate detection compares the coordinate alone, so differing hints do not make these distinct members; a validator that compares whole tag arrays would wrongly accept this.", + "reject_rules": [ + "member-duplicate" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "wss://relay-one.example.com" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "wss://relay-two.example.com" + ] + ] + } + }, + { + "name": "invalid_member_cap_exceeded", + "expect": "reject", + "note": "65 distinct member `a` tags \u2014 one past the inclusive cap of 64.", + "reject_rules": [ + "member-cap" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "wide" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-00" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-01" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-02" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-03" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-04" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-05" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-06" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-07" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-08" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-09" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-10" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-11" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-12" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-13" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-14" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-15" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-16" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-17" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-18" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-19" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-20" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-21" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-22" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-23" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-24" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-25" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-26" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-27" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-28" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-29" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-30" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-31" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-32" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-33" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-34" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-35" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-36" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-37" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-38" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-39" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-40" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-41" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-42" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-43" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-44" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-45" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-46" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-47" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-48" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-49" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-50" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-51" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-52" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-53" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-54" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-55" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-56" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-57" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-58" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-59" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-60" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-61" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-62" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-63" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-64" + ] + ] + } + }, + { + "name": "invalid_member_cap_exceeded_by_duplicates", + "expect": "reject", + "note": "65 member `a` tags naming 33 distinct coordinates. The spec evaluates the cap before the duplicate set is built, so `member-cap` is the required rule even though the event also carries duplicates; a validator that reports `member-duplicate` here has built a set whose size is bounded only by the frame limit.", + "reject_rules": [ + "member-cap" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "wide" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-00" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-00" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-01" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-01" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-02" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-02" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-03" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-03" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-04" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-04" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-05" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-05" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-06" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-06" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-07" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-07" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-08" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-08" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-09" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-09" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-10" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-10" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-11" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-11" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-12" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-12" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-13" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-13" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-14" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-14" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-15" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-15" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-16" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-16" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-17" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-17" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-18" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-18" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-19" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-19" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-20" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-20" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-21" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-21" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-22" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-22" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-23" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-23" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-24" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-24" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-25" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-25" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-26" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-26" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-27" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-27" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-28" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-28" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-29" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-29" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-30" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-30" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-31" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-31" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:repo-32" + ] + ] + } + }, + { + "name": "invalid_member_tag_arity_four_elements", + "expect": "reject", + "note": "Member `a` tag carries a fourth element past the relay hint. Its coordinate is valid, so this rejects on tag shape rather than on the coordinate: NIP-01's `a` grammar is two or three elements, and a validator that reads element 1 and ignores the rest would accept unbounded unvalidated data in a position no consumer reads.", + "reject_rules": [ + "member-tag-arity" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "wss://relay.example.com", + "unexpected" + ] + ] + } + }, + { + "name": "invalid_member_kind_prefix", + "expect": "reject", + "note": "Coordinate names kind 30618 (repo state) rather than 30617 (repo announcement). A project groups repositories, not their ref state.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30618:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + ] + } + }, + { + "name": "invalid_member_owner_not_hex", + "expect": "reject", + "note": "Owner segment is 64 characters but not hex.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:buzz" + ] + ] + } + }, + { + "name": "invalid_member_owner_uppercase", + "expect": "reject", + "note": "Owner segment is uppercase hex. `#a` tag matching is byte-exact, so an uppercase head is invisible to the lowercase-coordinate queries every reader issues.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:buzz" + ] + ] + } + }, + { + "name": "invalid_member_owner_wrong_length", + "expect": "reject", + "note": "Owner segment is 63 hex characters.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + ] + } + }, + { + "name": "invalid_member_dtag_empty", + "expect": "reject", + "note": "Coordinate has an empty repo `d` segment \u2014 it addresses no announceable repository.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:" + ] + ] + } + }, + { + "name": "invalid_member_missing_segment", + "expect": "reject", + "note": "Coordinate has two segments instead of three.", + "reject_rules": [ + "member-coordinate-malformed" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "a", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + ] + ] + } + }, + { + "name": "invalid_metadata_duplicate_name", + "expect": "reject", + "note": "Two `name` tags. Reader-dependent display name; reject rather than pick.", + "reject_rules": [ + "metadata-cardinality" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "name", + "Platform" + ], + [ + "name", + "Infra" + ] + ] + } + }, + { + "name": "invalid_metadata_duplicate_channel", + "expect": "reject", + "note": "Two `buzz-channel` tags. Which channel the project links to would be reader-dependent.", + "reject_rules": [ + "metadata-cardinality" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "buzz-channel", + "3580ca9b-47b4-4af9-b22a-1068778f26c6" + ], + [ + "buzz-channel", + "00000000-0000-0000-0000-000000000000" + ] + ] + } + }, + { + "name": "invalid_metadata_name_too_long", + "expect": "reject", + "note": "`name` value exceeds 256 bytes.", + "reject_rules": [ + "metadata-length" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "name", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ] + ] + } + }, + { + "name": "invalid_metadata_description_too_long", + "expect": "reject", + "note": "`description` value exceeds 2048 bytes.", + "reject_rules": [ + "metadata-length" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "description", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ] + ] + } + }, + { + "name": "invalid_metadata_channel_too_long", + "expect": "reject", + "note": "`buzz-channel` value exceeds 256 bytes. Paired with `invalid_metadata_visibility_too_long` so each bound is exercised by an event whose other metadata is valid \u2014 neither check can hide behind the other's rejection.", + "reject_rules": [ + "metadata-length" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "buzz-channel", + "ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + ] + ] + } + }, + { + "name": "invalid_metadata_visibility_too_long", + "expect": "reject", + "note": "`buzz-visibility` value exceeds 256 bytes. Ingest does not interpret the token, but it must still bound its length.", + "reject_rules": [ + "metadata-length" + ], + "template": { + "kind": 30621, + "content": "", + "tags": [ + [ + "d", + "platform" + ], + [ + "buzz-visibility", + "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv" + ] + ] + } + } + ] +} diff --git a/docs/nips/NIP-MP.fold-fixtures.json b/docs/nips/NIP-MP.fold-fixtures.json new file mode 100644 index 0000000000..c036646c34 --- /dev/null +++ b/docs/nips/NIP-MP.fold-fixtures.json @@ -0,0 +1,527 @@ +{ + "$comment": "NIP-MP fold fixtures \u2014 the shared oracle for the client-side fold in docs/nips/NIP-MP.md (\"The fold\" and \"Required fold cases\"). Every case in the spec's required-cases table appears here, keyed by `spec_case`. Inputs are SEMANTIC, not signed envelopes: a repository or project is named by its coordinate plus the fold's inputs (signer, members, `maintainers`, visibility, viewer-hidden, deletion). Signing and envelope validation are the ingest contract and live in NIP-MP.fixtures.json; this file assumes every input is a valid, accepted head and tests only the placement the fold derives from it. `expect.containers` lists each rendered project with the members rendered inside it; `expect.implicit_cards` lists the repositories that additionally render as their own single-repository cards. EVERY collection in `expect` is compared as a set \u2014 the containers, each container's `members`, and the implicit cards alike \u2014 because the fold fixes placement, not order. `render` is `resolved` when the member coordinate resolves to a live head and `unavailable` when it does not. `state` is `live` or `deleted`; `visibility` is `listed` or `unlisted`; a value of `viewer_hidden` is a local, per-viewer decision, not event state.", + "version": 1, + "project_kind": 30621, + "repository_kind": 30617, + "pubkeys": { + "alice": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "bob": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "carol": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + }, + "cases": [ + { + "name": "owner_project_claims_own_repository", + "spec_case": "Owner's own project lists their repository", + "note": "The signer is the member coordinate's owner, so the project claims the repository and step 3 suppresses its implicit card.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "stranger_project_does_not_claim", + "spec_case": "Stranger's project lists someone else's repository", + "note": "Bob is neither the owner nor a maintainer, so his project renders the member but claims nothing. The repository keeps its own card: an unendorsed grouping cannot pull a repository out of where its owner expects to find it.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:borrowed", + "signer": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:borrowed", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + } + }, + { + "name": "maintainer_signer_claims", + "spec_case": "Project signer is in the member repository's `maintainers` tag", + "note": "Claim authority is read from the member repository's own head, not from ownership alone. Carol is listed in `maintainers`, so her project claims the repository exactly as the owner's would.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false, + "maintainers": [ + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + ] + } + ], + "projects": [ + { + "coordinate": "30621:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc:platform", + "signer": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "two_claiming_projects_both_render_member", + "spec_case": "Repository is a member of two projects that both claim it", + "note": "Multiple membership is not a move. The repository renders inside both containers and has no implicit card, and it appears once per container rather than twice in either.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + }, + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:infra", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + }, + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:infra", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "repository_removed_from_every_project", + "spec_case": "Repository removed from every project", + "note": "A live project that no longer lists the repository. The container renders empty rather than being hidden, and the unclaimed repository falls back to its own card.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [] + } + ], + "implicit_cards": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + } + }, + { + "name": "unlisted_project_absent_member_falls_back", + "spec_case": "Project is `unlisted`, or locally hidden", + "note": "An unlisted project is not listing eligible, so it claims nothing even though its signer owns the member. The container that would hold the repository is not on screen, so the repository must render as its own card or vanish.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:skunkworks", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "unlisted", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [], + "implicit_cards": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + } + }, + { + "name": "locally_hidden_project_absent_member_falls_back", + "spec_case": "Project is `unlisted`, or locally hidden", + "note": "The second half of the same rule, reached by a different input: hiding a container is a statement about the grouping only. The viewer-hidden project claims nothing and its member returns as an implicit card.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": true + } + ], + "expect": { + "containers": [], + "implicit_cards": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + } + }, + { + "name": "viewer_hidden_repository_absent_everywhere", + "spec_case": "Viewer has hidden a member repository", + "note": "Hiding a repository hides it everywhere, including inside every project that lists it \u2014 otherwise someone else's grouping could undo the viewer's decision. The sibling member is unaffected.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": true + }, + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "unresolvable_member_renders_unavailable", + "spec_case": "Member coordinate resolves to nothing", + "note": "No repository answers the coordinate \u2014 never announced, deleted, or absent from this relay. It renders inside its project as explicitly unavailable: dropping it silently would make the project look smaller than its author declared, and promoting it to a standalone card would invent a repository.", + "repositories": [], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:ghost" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:ghost", + "render": "unavailable" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "deleted_project_absent_member_falls_back", + "spec_case": "Project head deleted", + "note": "Deletion does not cascade. The container is gone; the member repository, its refs and its channel survive and it falls back to an implicit card.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "deleted", + "viewer_hidden": false + } + ], + "expect": { + "containers": [], + "implicit_cards": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ] + } + }, + { + "name": "authorized_and_unauthorized_projects_share_member", + "spec_case": "One authorized and one unauthorized project both list the same repository", + "note": "The discriminating case for step 3's \"at least one\": Alice's claim suppresses the implicit card, and Bob's unauthorized project still renders the member. An implementation that requires every listing project to be authorized would wrongly emit an implicit card here; one that lets any listing project suppress would wrongly emit none in `stranger_project_does_not_claim`.", + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + }, + { + "coordinate": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:borrowed", + "signer": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + }, + { + "project": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:borrowed", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + }, + { + "name": "exhaustive_enumeration_across_pages_with_tied_timestamps", + "spec_case": "More repositories and projects than one page holds, with several sharing one `created_at`", + "note": "Exercises step 1 rather than the placement rules: the inputs exceed `enumeration.page_size` and three entities share one `created_at`, so a timestamp-only cursor loses events at the page boundary. Every repository and project must still render. `created_at` is present only on this case, and only because the cursor is what is under test.", + "enumeration": { + "page_size": 2, + "cursor": "composite", + "note": "The harness must serve inputs in pages of `page_size`, ordered `(created_at DESC, coordinate ASC)`, and the client under test must page with a composite `(created_at, id)` cursor per the Pagination section. Ordering by coordinate stands in for event id, which unsigned semantic fixtures do not carry." + }, + "repositories": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "state": "live", + "viewer_hidden": false, + "created_at": 1000 + }, + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra", + "state": "live", + "viewer_hidden": false, + "created_at": 1000 + }, + { + "coordinate": "30617:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:buzz-mobile", + "state": "live", + "viewer_hidden": false, + "created_at": 1000 + } + ], + "projects": [ + { + "coordinate": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "signer": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "members": [ + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false, + "created_at": 900 + }, + { + "coordinate": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:mobile", + "signer": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "members": [ + "30617:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:buzz-mobile" + ], + "visibility": "listed", + "state": "live", + "viewer_hidden": false, + "created_at": 900 + } + ], + "expect": { + "containers": [ + { + "project": "30621:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:platform", + "members": [ + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz", + "render": "resolved" + }, + { + "coordinate": "30617:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:buzz-infra", + "render": "resolved" + } + ] + }, + { + "project": "30621:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:mobile", + "members": [ + { + "coordinate": "30617:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:buzz-mobile", + "render": "resolved" + } + ] + } + ], + "implicit_cards": [] + } + } + ] +} diff --git a/docs/nips/NIP-MP.md b/docs/nips/NIP-MP.md new file mode 100644 index 0000000000..6ca1ec4749 --- /dev/null +++ b/docs/nips/NIP-MP.md @@ -0,0 +1,331 @@ +NIP-MP +====== + +Multi-Repository Projects +------------------------- + +`draft` `optional` `relay` + +**Depends on**: NIP-01 (basic event format, addressable events), NIP-34 (git repositories), NIP-09 (event deletion). Interacts with NIP-29 (the channel a project links to) and NIP-OA (owner attestation, for how agents inherit repo push access). + +## Abstract + +This NIP defines `kind:30621`, an addressable **project** event: a signed, named grouping of NIP-34 repository announcements (`kind:30617`). A project references its member repositories by coordinate, so one project may span repositories owned by different pubkeys, and one repository may belong to several projects. + +A project is metadata only. Its signer gains no authority over any member repository — not to edit it, delete it, push to it, or administer it. Membership is an assertion about grouping, not a grant of permission. + +## Motivation + +Buzz renders one card per `kind:30617`, so "the platform" — a relay, a desktop app, and a mobile app — appears as three unrelated repositories. Real work spans repositories; the model does not. + +[VISION_PROJECTS.md](../../VISION_PROJECTS.md) sets the bar as "standard kinds as substrate, custom kinds only where genuinely novel," and every other forge concept in Buzz clears it: repositories, patches, issues, statuses, and ref state are all standard NIP-34 kinds. Multi-repository grouping is the one semantic that cannot be: + +- **Per-repository tags cannot express cross-owner grouping.** If membership lived in each `kind:30617`, a project spanning Alice's and Bob's repositories would require *both* Alice and Bob to publish a tag naming the group. Alice cannot enroll Bob's repository; she cannot sign for his key. Grouping would be possible only within a single owner's repositories, and would break the moment a repository changed hands or a fork joined. +- **Project-level metadata has no owner.** A project name, description, and linked channel describe the *group*, not any one repository. Scattered across per-repository tags they have no single writer, no replacement semantics, and no deletion story: removing a repository from the group means editing an event you may not control. +- **Existing list kinds do not fit.** NIP-51 sets (`kind:30004` curation sets and friends) are private-or-public user bookmarks over arbitrary content, not a shared, named, addressable container for a forge collection with its own channel binding and visibility. Overloading a curation set would make every project indistinguishable from a user's reading list. + +One custom kind, held by one signer, with all group state in one replaceable event, resolves all three. The cost is bounded and stated plainly: `kind:30621` is Buzz-specific, so a third-party NIP-34 client sees the member repositories individually and ignores the grouping. Nothing degrades — the repositories remain standard, portable `kind:30617` events, discoverable and renderable exactly as before. + +## Non-Goals + +This NIP does not define shared or delegated project editing — a project is replaceable only by its own signer (see [Authority](#authority)). +This NIP does not define any authorization over member repositories. Membership is not a permission grant, and a project is never consulted by git push policy. +This NIP does not define project-level branch protection, CI, or workflow configuration. +This NIP does not define nested projects. A project's members are repositories, never other projects. +This NIP does not require relays to verify that a member coordinate resolves to an existing repository — a project may reference a repository that does not exist yet, or no longer does. + +## Terminology + +This document uses MUST, MUST NOT, SHOULD, SHOULD NOT, MAY, and RECOMMENDED as defined in RFC 2119. + +- **project**: A `kind:30621` event. Also called the *container*. +- **member**: A repository referenced by a project, named by an `a` tag holding a repository coordinate. +- **coordinate**: The NIP-01 address of a repository announcement, `30617::`. +- **explicit project**: A project that exists as a `kind:30621` event. +- **implicit project**: The single-repository card a client renders for a `kind:30617` that no listing-eligible explicit project claims. Not an event — a rendering fallback. +- **listing eligible**: A project a client is currently rendering in its project collection. See [Listing eligibility](#listing-eligibility). + +## Kinds + +| Kind | Name | Signer | Class | Purpose | +|------|------|--------|-------|---------| +| `30621` | Project | user | addressable | A named grouping of `kind:30617` repository announcements | + +`kind:30621` is an addressable event per NIP-01 (`30000 <= n < 40000`), addressed by `(pubkey, 30621, d)`. Two signers may use the same `d` value; those are two distinct projects. Addressable events were formerly specified as "parameterized replaceable events" in NIP-33, which upstream has since folded into NIP-01; this document cites NIP-01 throughout. + +### Kind allocation + +`30621` sits in the NIP-34 git block (`30617` repository announcement, `30618` repository state), which is where a reader looks for a forge concept. Checks performed before freezing the number: + +| Registry | Checked | Result | +|----------|---------|--------| +| Upstream nostr NIPs event-kind table (`nostr-protocol/nips` `README.md`, at commit `6d2979b3f503a8539c983efbcdcf901bbcf9ed23`) | `30610`–`30629` | Only `30617` and `30618` are assigned. `30621` is unassigned. | +| nostrbook.dev kind registry (`https://nostrbook.dev/kinds/`) | `30617`, `30618`, `30620`, `30621`, `30622` | `30617` and `30618` documented (HTTP 200). `30620`, `30621`, `30622` all HTTP 404 — no entry. | +| This repository (`crates/buzz-core/src/kind.rs`) | full range | `30620` is `KIND_WORKFLOW_DEF`, `30622` is `KIND_DM_VISIBILITY` (NIP-DV). `30621` is the one free number between them. | + +Both external registries are advisory, not authoritative allocators: neither reserves numbers, and an unregistered kind may still be in use by an unpublished client. A future upstream assignment of `30621` would be a collision Buzz absorbs the same way it already does for its other custom kinds — the number is Buzz-specific, and interoperability rests on the member `kind:30617` events, which remain standard. + +## Event Format + +```jsonc +{ + "kind": 30621, + "pubkey": "", + "content": "", + "tags": [ + ["d", "platform"], + ["name", "Platform"], + ["description", "Relay, desktop, and mobile for the platform team."], + ["a", "30617::buzz"], + ["a", "30617::buzz-infra"], + ["buzz-channel", ""], + ["buzz-visibility", "listed"] + ] +} +``` + +| Tag | Cardinality | Meaning | +|-----|-------------|---------| +| `d` | exactly 1, non-empty | Project slug. The NIP-01 addressable identifier. | +| `name` | 0 or 1 | Human-readable display name. Clients fall back to `d` when absent. | +| `description` | 0 or 1 | Free text describing the project. | +| `a` | 0 to 64 | One member repository coordinate each. Order is not significant. | +| `buzz-channel` | 0 or 1 | UUID of the channel this project's discussion lives in. Metadata only — see [Authority](#authority). At most 256 bytes. | +| `buzz-visibility` | 0 or 1 | `listed` (default) or `unlisted`. Feeds [listing eligibility](#listing-eligibility). At most 256 bytes. | + +`content` carries no meaning. Writers SHOULD emit the empty string. Readers and relays MUST ignore whatever it holds: a non-empty `content` is not a rejection cause, and no consumer may parse semantics from it. Reserving it costs nothing and keeps a future writer that fills it from invalidating its events for today's readers. + +Unrecognized tags MUST be ignored rather than rejected, so a newer writer can add metadata without invalidating its events for older readers. + +### Metadata interpretation + +Ingest bounds metadata cardinality and length; it interprets no metadata value. `buzz-channel` and `buzz-visibility` are opaque strings to a relay, exactly as they are on `kind:30617`. Interpretation is a client concern, and every client MUST resolve it the same way: + +- `name` absent → clients display the `d` value. +- `buzz-visibility` absent or holding any value other than `listed` or `unlisted` → treated as `listed`. An unrecognized token MUST NOT hide a project: a typo in a metadata field is not a privacy signal, and treating it as one would make a project vanish for reasons its author cannot see. +- `buzz-channel` absent, or naming a channel the viewer cannot resolve or read → the project renders without a channel link. It MUST NOT be dropped from the collection, and the unresolvable value MUST NOT be surfaced as a broken link. + +### Member coordinates + +A member `a` tag follows NIP-01's `a` tag grammar: `["a", ""]` or `["a", "", ""]`. Ingest validates the tag's arity — exactly two or three elements — and the coordinate in element 1. The relay URL is opaque: it is never parsed and never a rejection cause by content. A fourth element has no meaning in this grammar and is rejected rather than ignored, so a writer cannot smuggle unbounded data into a position no consumer reads. + +The optional third element is a **relay hint**: a recommended relay where the member announcement may be found. Clients MAY use it when resolving a member that step 6 of [the fold](#the-fold) would otherwise mark unavailable, and MUST treat it as advice rather than authority — a hint is unauthenticated, supplied by the project signer rather than the repository owner, so a resolution through it MUST still verify that the retrieved event is the coordinate's own signed `kind:30617`. A hint MUST NOT be required: a project whose members are all on the reading relay resolves fully without one, and a client that ignores hints entirely is conformant. + +A member `a` tag coordinate MUST be exactly `30617::` where: + +- the kind segment is the literal `30617`. A project groups repository *announcements*; a coordinate naming any other kind (notably `30618` repository state) is malformed. +- `` is 64 lowercase hex characters. Uppercase is rejected: `#a` filter matching is byte-exact, so an uppercase-owner head would be invisible to the lowercase-coordinate queries every reader issues. +- `` is non-empty and is the `d` tag of the member repository announcement, taken **verbatim**. + +Parsing splits on the first two colons only; everything after the second colon is ``. A repository whose `d` tag contains a colon is therefore addressable. Splitting on every colon would make such a repository permanently unaddressable by any project. + +Buzz-hosted repositories cannot currently produce such a coordinate: their `d` values are validated as `[a-zA-Z0-9._-]{1,64}` (`crates/buzz-relay/src/handlers/side_effects.rs`, `crates/buzz-sdk/src/builders.rs`). The tolerance is for the repositories this NIP does not control — NIP-34 announcements from other clients, and any future relaxation of Buzz's own rule — and it matches how Buzz already parses coordinates in NIP-09 deletion handling, so a project coordinate and a deletion coordinate can never disagree about where a repository's `d` value begins. + +Coordinate identity is the whole string. Two members sharing a `` under different owners — the NIP-34 fork case — are distinct members, not duplicates. + +A project MAY reference a coordinate that resolves to nothing: a repository not yet announced, deleted, or announced on another relay. Clients render those members as explicitly unavailable ([Client Behavior](#client-behavior), step 6). + +## Semantics + +### Authority + +The project signer's authority begins and ends at the container. + +- **Over the container**: total. Only the signer can replace their `(pubkey, 30621, d)` coordinate. Deletion additionally admits the signer's registered NIP-OA owner — see [Deletion](#deletion). +- **Over member repositories**: none. No edit, no delete, no push, no administration, no ability to change a member repository's own metadata or protections. Adding Bob's repository to Alice's project changes nothing about Bob's repository or who may push to it. It is Alice's signed assertion that the two belong together, and it is attributable to her key. + +Clients MUST preserve each member repository's own owner provenance in the UI. A repository rendered inside a project must not appear to be owned or governed by the project signer. + +`buzz-channel` on a project is **metadata only**. Git push policy reads the `buzz-channel` of the repository's own `kind:30617` (`crates/buzz-relay/src/api/git/policy.rs`); a project neither overrides that binding nor supplies one to a member that lacks it. A project's channel binding therefore cannot widen or narrow push access to anything. + +### Editing model + +Editing is **owner-only**: publish a replacement `kind:30621` with the same `d` and a newer `created_at`. Adding, removing, or reordering members and changing metadata are all one operation — replacing the container. This falls out of the addressable-event model with no relay-side permission machinery; NIP-01 replacement already refuses to let one pubkey overwrite another's coordinate. + +Delegated or maintainer editing is deliberately out of scope for this version. Adding it later needs no change to this event shape — only a new rule about who may replace a coordinate. + +### Zero-member projects + +A project with no `a` tags is valid. It is the natural state after removing a final member, and it carries only bounded metadata either way. Deleting the container — with its name, description, and channel binding — because its last repository was removed would be a destructive surprise for a reversible action. + +Clients SHOULD require at least one member when *creating* a project, since an empty new project is almost always a mistake, and MUST render an existing empty project as an empty container rather than hiding it or treating it as malformed. + +### Multiple membership + +A repository may be a member of any number of projects. It renders inside each ([Client Behavior](#client-behavior), step 4). Membership is not exclusive and not a move: nothing about the repository event changes when it joins or leaves a project. + +### Deletion + +Deleting a project (NIP-09 `kind:5` naming the project coordinate) deletes the `kind:30621` only. Member repositories are untouched — their `kind:30617` events, refs, channels, and protections all survive, and each falls back to an implicit card unless another listing-eligible project claims it. + +**Who may delete.** The project signer always may. On the Buzz relay, so may the signer's registered NIP-OA owner: `validate_standard_deletion_event` resolves the deletion's effective author and accepts it when that actor is the target pubkey's registered owner (`crates/buzz-relay/src/handlers/side_effects.rs`). This is a **Buzz relay extension to NIP-09**, applied uniformly to every kind rather than specially to projects — it is what lets a human clean up events published by an agent they own. Vanilla NIP-09 relays accept only the signer, so a project deleted through the owner path on Buzz will still be live on a relay that lacks the extension. + +Replacement admits no such widening: it is signer-only on every relay, because NIP-01 keys the coordinate on the pubkey itself rather than on a permission check. + +A deletion whose `created_at` precedes the live head does not remove it — see [Relay Processing Algorithm](#relay-processing-algorithm). + +There is no cascade, in either direction. Deleting a member repository does not modify the project; the project keeps a coordinate that no longer resolves, and clients render it as unavailable. + +## Relay Processing Algorithm + +A relay accepting `kind:30621` MUST validate the envelope at ingest. The rule names below are the identifiers the shared fixtures use. + +1. **`d-cardinality`** — exactly one `d` tag. Zero or several is rejected. Under NIP-01 a missing `d` is treated as empty, which collapses every such event into the `(pubkey, 30621, "")` slot where unrelated projects silently overwrite each other; several `d` tags make the address reader-dependent. +2. **`d-empty`** — the `d` value is non-empty. Same collapse hazard. Its length is bounded by the relay's existing generic `d`-tag limit (`buzz_db::event::D_TAG_MAX_LEN`, 1024 bytes); this NIP adds no second bound. +3. **`member-cap`** — at most 64 member `a` tags, counting **every** `a` tag rather than distinct coordinates. Counting distinct coordinates would leave parse volume bounded only by the relay frame limit (512 KiB by default, `crates/buzz-relay/src/config.rs`), since a duplicate-heavy event could carry thousands of tags naming one coordinate. The cap is inclusive: 64 is accepted, 65 is not. +4. **`member-tag-arity`** — every member `a` tag has exactly two or three elements, per NIP-01's `a` tag grammar. A one-element tag names no coordinate; a fourth element has no defined meaning, and ignoring it would let a writer park unbounded unvalidated data in a position no consumer reads. This is a separate rule from the next one because the failure is different: the tag's shape is wrong, not the coordinate it holds. +5. **`member-coordinate-malformed`** — every member `a` tag's coordinate (element 1) parses per [Member coordinates](#member-coordinates). The relay hint in element 3 is not parsed and MUST NOT be a rejection cause by its content. +6. **`member-duplicate`** — no two member `a` tags hold the same coordinate, compared as exact strings on the canonical form. Comparison is on the coordinate alone, so two tags naming one coordinate with different relay hints are duplicates. +7. **`metadata-cardinality`** — at most one each of `name`, `description`, `buzz-channel`, `buzz-visibility`. Duplicates would make the effective value reader-dependent. +8. **`metadata-length`** — `name` at most 256 bytes; `description` at most 2048 bytes; `buzz-channel` at most 256 bytes; `buzz-visibility` at most 256 bytes. The two `buzz-` bounds are generous by design: neither value has a semantic length, and the bound exists only so an unbounded string cannot ride into storage on a tag ingest does not interpret. + +Rules 3 through 6 are evaluated in that order, so an oversized tag list is refused on count before any per-tag parse or set proportional to it is built. + +Three checks land in the Buzz validator together with the fixture wiring that exercises them: the `buzz-channel` and `buzz-visibility` bounds in rule 8, and rule 4's arity. The validator bounds `name` and `description` today, and reads element 1 of each member `a` tag while ignoring any element past it. + +**Duplicates are rejected, never normalized.** A relay cannot dedupe tags inside a signed event: rewriting the tag array changes the event id and invalidates the signature. The choices are reject, or accept and require every present and future consumer to apply a first-wins interpretation rule. Rejecting keeps every stored head canonical and spares all consumers a defensive parse. + +**No membership authorization.** The relay MUST NOT check whether the signer owns, maintains, or has any relationship to a member repository. Referencing another owner's repository is legal and is the point of the kind. Because membership grants nothing ([Authority](#authority)), there is nothing to authorize. + +**Routing.** `kind:30621` is global-only, like every other NIP-34 kind in Buzz: it is addressed by `(pubkey, kind, d)` and is never channel-scoped. A stray `h` tag MUST NOT scope it to a channel — the `buzz-channel` tag is a metadata reference, not a routing directive. + +**Scope.** Writes require the `repos:write` scope, matching `kind:30617` and `kind:30618`. A project is repository metadata; a client authorized to announce repositories is authorized to group them. + +**Replacement** follows NIP-01 with no special cases: newest `created_at` wins per `(pubkey, 30621, d)`, and one pubkey can never overwrite another's coordinate. + +**Deletion** follows NIP-09 with two Buzz-wide behaviors that are not project-specific: + +- A `kind:5` naming the coordinate deletes it when signed by the project signer **or** by that signer's registered NIP-OA owner ([Deletion](#deletion)). +- The deletion applies only to versions whose `created_at` is at or before the deletion's own, per NIP-09. A delayed or replayed tombstone signed before the current head MUST NOT remove it; the relay MUST compare timestamps at the coordinate (`soft_delete_by_coordinate`, `crates/buzz-db/src/event.rs`, whose inclusive `created_at <= ` bound is introduced alongside this specification in [#3171](https://github.com/block/buzz/pull/3171)). + +## Client Behavior + +### Listing eligibility + +A project is **listing eligible** for a client when that client is currently rendering it in its project collection. A project is not listing eligible when: + +- its `buzz-visibility` is `unlisted`, or +- the viewer has hidden it locally, or +- it has been deleted, or its latest head is otherwise not being rendered. + +Only listing-eligible projects claim members. This keeps visibility deterministic in the case that otherwise breaks: an unlisted project must not make a repository the viewer can plainly see disappear from the collection, because the container that claims it is not on screen to hold it. + +### Claim authority + +A project **claims** a member — suppressing that repository's implicit card, per step 3 of the fold — only when the project is listing eligible *and* its signer is authorized by the member repository itself: the signer is the repository's owner (the pubkey in the member coordinate), or is listed in a `maintainers` tag on the repository's own live `kind:30617`. + +Authority is therefore read from the member repository's *content*, not merely its existence: a client that has resolved only a coordinate, and not the head it names, cannot yet decide whether a project claims it. `maintainers` is the standard NIP-34 multi-value tag; Buzz's own announcement builder does not emit it today, so in practice every current claim reduces to signer-is-owner, and the `maintainers` clause is what keeps a co-maintained repository working the day that changes. + +Without this rule, membership would carry exactly the authority [Authority](#authority) says it does not. Anyone may publish a project naming anyone's repository, so an unauthorized project that suppressed implicit cards would let a stranger pull someone else's repository out of the collection and into a container the owner never consented to — a signed assertion silently becoming control over another owner's discovery surface. + +An unauthorized project still renders, and still renders its members inside itself: cross-owner grouping works, which is the entire point of the kind. What it cannot do is *remove* a repository from where its owner expects to find it. The visible consequence is that a repository in a stranger's project renders in both places — inside that project and as its own card — which is the correct reading of an unendorsed grouping claim. + +### The fold + +Given the set of repositories and projects to render, a client MUST derive the collection as follows. + +1. **Enumerate exhaustively when possible.** Retrieve the latest live head of every `kind:30621` and `kind:30617` coordinate, plus the `kind:5` deletions bearing on them, using paginated queries. A fixed `limit` MUST NOT be used: with a limit of 200, repository 201 vanishes from the collection, which is precisely the compatibility guarantee this NIP owes existing repositories. What "to exhaustion" means depends on the cursor the relay offers — see [Pagination](#pagination). On a relay that does not provide an exhaustive mode, a client MUST mark the collection possibly incomplete rather than present a partial result as complete. +2. **Resolve members.** For each project, resolve each member coordinate to its repository head, and determine whether the project [claims](#claim-authority) each one. +3. **Suppress claimed implicit cards.** A live repository claimed by at least one project does not also render as an implicit single-repository card. +4. **Render multiple membership.** A repository belonging to several listing-eligible projects renders inside each of them, claimed or not. +5. **Fall back.** A repository claimed by no project renders as an implicit single-repository card — including when an unauthorized project also renders it as a member. +6. **Mark unresolvable members.** A member coordinate that resolves to nothing — never announced, deleted, or not present on this relay — renders inside its project as explicitly unavailable. It MUST NOT become a phantom standalone card, and it MUST NOT be silently dropped: silence makes a project look smaller than its author declared. +7. **Hiding a container never hides repositories.** Locally hiding a project makes it not listing eligible, so it claims nothing and by step 5 its members return as implicit cards. Hiding a grouping is a statement about the grouping. A repository disappears from the collection only when the viewer hides that repository or it is deleted — and a repository the viewer has hidden is hidden everywhere, including inside every project that lists it, so hiding one cannot be undone by someone else's grouping. + +The fold is deterministic: same heads in, same collection out, independent of arrival order or query shape. **Placement, not order, is what the fold fixes** — the collection of containers, the members rendered inside each container, and the implicit cards are all compared as sets, since member order is not significant in the event ([Event Format](#event-format)) and a client is free to sort its own presentation. Every live, unhidden repository renders in at least one place — inside a project that claims it, or as its own card — and no repository renders twice within one container. + +### Required fold cases + +The fold cannot be expressed as accept/reject of a single event, so it has its own fixture file rather than living in the ingest [conformance fixtures](#conformance-fixtures). A client implementing the fold MUST cover at least these cases, each of which is a distinct branch above: + +| Case | Expected collection | +|------|---------------------| +| Owner's own project lists their repository | Repository renders inside the project only | +| Stranger's project lists someone else's repository | Repository renders inside that project *and* as its own card | +| Project signer is in the member repository's `maintainers` tag | Repository renders inside the project only | +| Repository is a member of two projects that both claim it | Repository renders inside both; no implicit card | +| Repository removed from every project | Repository renders as an implicit card | +| Project is `unlisted`, or locally hidden | Project absent from the collection; its members render as implicit cards | +| Viewer has hidden a member repository | Repository absent from the collection *and* from inside every project listing it | +| Member coordinate resolves to nothing | Member renders inside its project as unavailable; no standalone card | +| Project head deleted | Project absent; its members render as implicit cards | +| One authorized and one unauthorized project both list the same repository | Repository renders inside both projects; no implicit card, because one claim suffices to suppress it | +| More repositories and projects than one page holds, with several sharing one `created_at` | Every repository and project renders | + +[`NIP-MP.fold-fixtures.json`](NIP-MP.fold-fixtures.json) mechanizes this table — see [Conformance Fixtures](#conformance-fixtures). + +### Pagination + +Step 1's "to exhaustion" describes the target result, not a single algorithm: what a client must do — and whether it can fully reach it — depends on the cursor its relay offers. Both modes below are conformant; a client MUST implement whichever its relay supports, MUST NOT present a mode-1 loop's output as complete on a mode-2 relay, and on a relay that provides neither mode 1 nor the relay contract below, MUST mark the collection possibly incomplete — presenting that marked partial collection is conformant, not a violation of step 1's enumeration requirement. + +**The relay contract both modes rest on.** Every "short response = done" inference — whether from a composite cursor or a drained bucket — is a property of the relay, not of NIP-01, where `limit` is advisory: relays "SHOULD use the `limit` value to guide how many events are returned in the initial response. Returning fewer events is acceptable" (NIP-01). A conforming relay may answer a request for 100 with 50 events and no indication that it withheld the rest, and the client cannot tell that from exhaustion. Exhaustive enumeration is possible only on a relay that satisfies **all three** of these conditions, which a client can evaluate independently: + +1. The relay **applies the complete filter before enforcing any limit.** A relay that post-filters after limiting can return a short (even empty) response while older matching events sit beyond the limited window, so short responses carry no exhaustion signal on such a relay. +2. The relay **exposes the exact effective page limit it enforces.** The effective page limit is the smaller of the requested `limit` and any relay-imposed cap, since a clamped request answered in full is short without being exhausted. If the advertised cap differs from the enforced one, "shorter than the effective limit" is undecidable by the client. +3. The relay **saturates pages**: after applying the complete filter and cursor, it returns `min(effective page limit, remaining matching events)` events — equivalently, whenever at least the effective limit's worth of matches remain, the page is full, so a short page contains all remaining matches. A cap bounds from above; without saturation, a relay may return fewer than the cap even when matches are still available, and a short page proves nothing. An authoritative relay-provided continuation or end signal computed after complete filtering is an equivalent substitute for this response-length inference. + +A relay satisfying any proper subset of these conditions does not provide the guarantee. Absent the guarantee, a client MUST mark the collection possibly incomplete regardless of any response sizes; the modes below serve to reduce silent loss rather than eliminate it. `limit` below means the effective page limit. + +**Mode 1 — composite cursor (exhaustive under the relay contract).** On a relay that exposes a keyset cursor over `(created_at, event id)`, a client MUST page by it. As an example of the cursor mechanics, Buzz implements the keyset as `created_at < until OR (created_at = until AND id > before_id)` (`crates/buzz-db/src/event.rs:48-52`), resolving the sort to `(created_at DESC, id ASC)`. Buzz exposes this cursor on its authenticated HTTP bridge endpoint (`crates/buzz-relay/src/api/bridge.rs`); it is not available on the NIP-01 websocket REQ path, where `before_id` is silently discarded — `protocol.rs` deserializes each REQ filter into a standard `nostr::Filter`, whose deserializer drops unknown fields, so a client sending `before_id` on a REQ receives no error and falls back to `until`-only paging without knowing it. A NIP-01 websocket client reading `kind:30621` from Buzz is therefore in mode 2, not mode 1; mode selection requires evaluating the relay contract per transport. Within the relay contract, the uniqueness of the `(created_at, id)` pair means each page resumes exactly where the last ended with no skips or re-reads, and a short page is an unambiguous end signal. Cursor uniqueness adds tie-safety; it does not substitute for the relay contract — a relay that post-filters after limiting can return an empty page under this cursor while older matching events remain beyond the candidate window. + +**Mode 2 — `until` only (boundary-bucket drain; exhaustive only under the relay contract).** A vanilla NIP-01 filter offers no id tiebreak, so the only cursor is `until`. Neither naive step is safe: `until = oldest_seen_created_at - 1` skips every unread event in that second, and `until = oldest_seen_created_at` re-requests the whole bucket, which never advances once one `created_at` bucket exceeds the relay's page size. A mode-2 client MUST therefore drain the boundary second explicitly before stepping past it. + +1. A page returning fewer than `limit` events means the query is exhausted — stop. +2. After a **full** page, let `oldest` be the smallest `created_at` it returned. Query that second exactly — `since = until = oldest` — and merge the result into what is already held, deduplicating by event id. That single bucket query has two outcomes. +3. If it returns `limit` events, second `oldest` may hold more than the relay will return in one response, so the collection MUST be marked possibly incomplete. Count `limit` inclusively: a bucket holding exactly `limit` events is indistinguishable from a larger one, and over-reporting a doubt is the safe direction. +4. If instead it returns fewer than `limit` events, the second is fully drained. Set `until = oldest - 1` and continue from step 1. + +A client that cannot drain a bucket has lost exhaustiveness for that second and MUST keep the collection marked possibly incomplete; it MAY still set `until = oldest - 1` to gather the older events rather than stall, but MUST NOT clear the mark by doing so. + +The naive form fails on a page whose oldest second is only partly returned, which a same-`created_at` test on the page as a whole does not see. With `limit = 3` over `(100,a) (99,b) (99,c) (99,d) (98,e)`, the first page is `(100,a) (99,b) (99,c)` — two distinct timestamps, so no all-tied heuristic fires — and advancing to `until = 98` silently drops `(99,d)`. Draining second `99` first retrieves it. + +Enumeration is therefore exhaustive when the relay satisfies the contract above and every equal-`created_at` bucket fits in one response; under those conditions truncation is detected exactly rather than guessed at. On detecting it — or on any relay that does not meet the contract — a client MUST mark the collection as possibly incomplete rather than present a partial collection as complete. Silently presenting a truncated collection is the failure this NIP exists to prevent: a repository missing from the list is indistinguishable from one that was never announced. + +**Query shapes.** The relay contract applies only where the relay can apply it — and that depends on the query shape. A relay that post-filters some constraints (such as `#a` tag matching applied after the SQL `LIMIT`) cannot guarantee short-response exhaustion for queries that use those constraints. A client MUST therefore issue fold queries in shapes whose full filter the relay applies before limiting. Where a needed constraint is not applied pre-limit on the target relay, the client MUST widen the query to constraints that are — for example, enumerating all `kind:5` events by `kinds` alone, or `kinds` + `authors`, rather than adding an `#a` filter the relay post-applies — and match the remaining criteria client-side. This keeps the relay contract's short-response guarantee intact for every query the fold issues. + +### Collection growth + +Step 1's exhaustive enumeration is a correctness floor, not a scaling strategy: it says a client MUST NOT silently truncate its collection, because a repository absent from the list is indistinguishable from one that does not exist. It is not a mandate to hold the relay's entire repository set in memory on every load. + +At Buzz's current scale (hundreds of repositories per community) exhaustive enumeration is the whole story. Past that, the way out is a narrower question — a server-side collection query, a scoped or searched subset, or resolving a project's members on demand — not a fixed client-side `limit`. Any such surface MUST report its own truncation so a client can say "showing N of M" rather than quietly presenting a partial collection as complete. + +### Route resolution + +A project route resolves to a container; a repository route resolves to a repository. Every repository-scoped operation — clone, fetch, issues, pull requests, activity, mutation, deletion — MUST take an explicit repository coordinate. None may infer its target from container state, or a two-repository project will silently operate on the wrong member. + +Legacy `:` repository routes remain valid and resolve to that repository, presented as a single-repository container. + +## Conformance Fixtures + +Two fixture files carry the machine-checkable contract. Neither has consumers yet; each states what its consumers are required to do. + +### Ingest + +[`NIP-MP.fixtures.json`](NIP-MP.fixtures.json) holds the shared valid/invalid case set: 11 accepted and 20 rejected events covering minimal and full projects, zero members, the 64-member boundary from both sides, cross-owner and same-`d`-different-owner members, colon-bearing repository `d` values, relay hints, non-empty `content`, and each rejection rule above. + +The relay validator, the Rust builder, and the TypeScript builder are required to test against this one file, so a divergence between them is a test failure rather than a production surprise. + +Each case carries an **unsigned** template — `kind`, `content`, `tags`. Consumers sign it with their own test key. Signed literals would be inert: the id and signature are fixed by the exact serialization, so any consumer that re-serializes would need to recompute both anyway. Rejection cases name their `reject_rules`, so an implementation cannot pass by rejecting a bad event for an unrelated reason. + +### Fold + +[`NIP-MP.fold-fixtures.json`](NIP-MP.fold-fixtures.json) holds the oracle for [the fold](#the-fold): 12 cases covering every row of the [required fold cases](#required-fold-cases) table. Every client implementing the fold is required to test against this one file. The fold is where the [claim authority](#claim-authority) rule lives, so without a shared oracle two clients could each satisfy the prose and still render different collections from identical heads. + +Its cases are **semantic, not signed envelopes**. A repository or project is named by its coordinate plus the inputs the fold actually reads — signer, members, `maintainers`, visibility, viewer-hidden, deletion. Signing would test the ingest contract a second time and obscure what is under test: this file assumes every input is an already-accepted head and pins only the placement derived from it. Each case gives `expect.containers` (each rendered project with the members rendered inside it) and `expect.implicit_cards` (the repositories that additionally render as their own cards). Every collection in `expect` is compared as a set — the containers, each container's `members`, and the implicit cards alike — because the fold fixes placement and not order. + +## Security Considerations + +**Unauthorized grouping claims are the accepted trade.** Anyone may publish a project referencing anyone's repositories. That claim is a signed statement attributable to its author and grants nothing ([Authority](#authority)) — the same trust model as NIP-51 lists, which likewise reference content their author does not own. A client MUST NOT present membership in a stranger's project as endorsement by, or authority over, the member repository's owner, and MUST show the project signer alongside a project it did not author. + +**Resolution fan-out is bounded.** Each project resolves at most 64 coordinates, and the cap counts raw tags, so no single event can force unbounded resolution work regardless of how its tag list is shaped. + +**Push policy is untouched.** A project cannot grant, widen, or narrow push access to any repository. Push policy reads only the repository's own `kind:30617`. This is a design invariant, not an implementation detail: if a project ever became an input to push authorization, publishing a project naming someone else's repository would become a privilege-escalation primitive. + +## Relation to Other NIPs + +- **NIP-34**: Supplies the member repositories. Members are `kind:30617` announcements referenced by coordinate; a NIP-34 client that does not know `kind:30621` still discovers and renders each repository normally. +- **NIP-01**: Supplies the addressable-event class, the `a` tag grammar, addressing, replacement, and the owner-only editing model. Owner-only editing is not enforcement code in Buzz — it is what NIP-01 replacement already means. +- **NIP-09**: Supplies container deletion, which deletes the container only. Buzz extends it in two ways that are not project-specific: an agent's registered NIP-OA owner may also delete, and a tombstone applies only at or before its own `created_at` ([Deletion](#deletion)). +- **NIP-29**: Supplies the channel a project's `buzz-channel` names. The reference is metadata; project state is never channel-scoped. +- **NIP-51**: The closest existing precedent — a signed, addressable list referencing content the author need not own. Not reused because a project is a shared named forge container with its own channel binding and visibility, not a user's private-or-public bookmark set. +- **NIP-OA**: Consulted for container deletion only — an agent's registered owner may delete the agent's project ([Deletion](#deletion)). Push access is unaffected: agents inherit repository push access from their owner through the repository's own protections, and a project is never consulted. From 4933672eb4589e7208b312829ebddcd10dfa9dd3 Mon Sep 17 00:00:00 2001 From: Tyler <109685178+tlongwell-block@users.noreply.github.com> Date: Thu, 30 Jul 2026 11:37:27 -0400 Subject: [PATCH 074/112] feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute (split 1/2 of #3467) (#3741) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary This is **part 1 of 2** split out from #3467 (per Tyler's request), carrying only the mesh-scoped changes. The agent/ACP response-behavior changes and the new `send_message` tool stay in #3467 as part 2. All commits are @michaelneale's work, cherry-picked with authorship preserved. - Upgrade embedded Mesh to v0.74.0 (tag-pinned instead of commit rev) and use canonical Gemma model IDs. - Keep shared compute serving through member joins, roster changes, app recovery, and community switching. - Wait for actual model readiness and avoid resuming incomplete downloads after quit. - Leave `BUZZ_AGENT_THINKING_EFFORT` unset by default so each model's chat template picks its own thinking default (`none` suppressed Gemma tool-calling entirely; pinning `low` made Qwen3 burn ~4x output budget). Explicit agent/persona/global values still win. ## Relationship to #3467 Contains the mesh commits from #3467 (`2cd640b23`, `0ad81c341`, `ad13ed841`) rebased onto current main, with one deliberate exclusion: the `crates/buzz-agent/src/llm.rs` reasoning→text parser change from `2cd640b23` is **not** here. That change unconditionally affects every OpenAI-compat/Responses provider, so it belongs with the reply-behavior work in part 2, where it can be reviewed as what it is. Not included (remaining in #3467 / part 2): - typed `send_message` tool in dev-mcp + `BUZZ_ACP_SEND_MESSAGE_TOOL` gating - plain-reply delivery fallback in buzz-acp (`BUZZ_ACP_DELIVER_PLAIN_REPLIES`) - the mesh_agent_e2e P5/P6 rewrite (exists to prove the reply path) - the two `env.insert` preset opt-ins in `relay_mesh.rs` for the flags above - the llm.rs parser change This PR is independently mergeable; part 2's flags are all off by default so it can land before or after. ## Testing - `cargo test -p buzz-relay --locked` — 780 passed (one telemetry test is order-sensitive under parallel default settings; passes in the pre-push suite and standalone, unrelated to this diff — files untouched here). - `just desktop-tauri-test` (default features) — 1877 passed. - `cargo test --locked --features mesh-llm` in `desktop/src-tauri` — 1961 passed, including the new relay-mesh preset and coordinator/recovery tests. - Both `Cargo.lock`s resolve with `--locked` against the v0.74.0 tag. - Full pre-push hook suite green (rust-tests, desktop-check/test, tauri checks). Live validation of the mesh v0.74 upgrade itself is documented on #3467 (two-Mac cross-version test). --------- Signed-off-by: Michael Neale Signed-off-by: Tyler Longwell Co-authored-by: Michael Neale Co-authored-by: Tyler Longwell --- Cargo.lock | 193 +++++++++-------- crates/buzz-relay/Cargo.toml | 4 +- crates/buzz-relay/examples/mesh_agent_e2e.rs | 4 +- desktop/src-tauri/Cargo.lock | 201 ++++++++++-------- desktop/src-tauri/Cargo.toml | 12 +- desktop/src-tauri/src/commands/mesh_llm.rs | 172 ++++++++++++--- .../src-tauri/src/commands/mesh_llm_tests.rs | 69 ++++++ .../src/managed_agents/relay_mesh.rs | 113 ++++++++-- .../src-tauri/src/managed_agents/runtime.rs | 7 +- desktop/src-tauri/src/mesh_llm/catalog.rs | 42 +++- desktop/src-tauri/src/mesh_llm/coordinator.rs | 159 +++++++------- desktop/src-tauri/src/mesh_llm/mod.rs | 23 +- desktop/src-tauri/src/mesh_llm/mod_tests.rs | 1 + desktop/src-tauri/src/mesh_llm/recovery.rs | 83 ++++++-- .../ui/MeshComputeSettingsCard.tsx | 9 +- desktop/src/testing/e2eBridge.ts | 27 ++- desktop/tests/e2e/mesh-compute.spec.ts | 22 +- 17 files changed, 781 insertions(+), 360 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 49104b22d2..ea5b02aaab 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -43,6 +43,19 @@ dependencies = [ "subtle", ] +[[package]] +name = "ahash" +version = "0.8.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" +dependencies = [ + "cfg-if 1.0.4", + "getrandom 0.3.4", + "once_cell", + "version_check", + "zerocopy", +] + [[package]] name = "aho-corasick" version = "1.1.4" @@ -2177,7 +2190,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 1.0.109", + "syn 2.0.117", ] [[package]] @@ -3009,8 +3022,8 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.2.1", - "windows-result 0.4.1", + "windows-link 0.1.3", + "windows-result 0.3.4", ] [[package]] @@ -3609,7 +3622,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core 0.61.2", ] [[package]] @@ -4501,8 +4514,8 @@ dependencies = [ [[package]] name = "mesh-llm-api-client" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "hex", "mesh-llm-client", @@ -4511,8 +4524,8 @@ dependencies = [ [[package]] name = "mesh-llm-api-server" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-api-client", @@ -4522,13 +4535,13 @@ dependencies = [ [[package]] name = "mesh-llm-build-info" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "mesh-llm-client" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -4559,8 +4572,8 @@ dependencies = [ [[package]] name = "mesh-llm-config" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -4575,8 +4588,8 @@ dependencies = [ [[package]] name = "mesh-llm-embedded-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-host-runtime", @@ -4585,8 +4598,8 @@ dependencies = [ [[package]] name = "mesh-llm-events" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "clap", @@ -4597,8 +4610,8 @@ dependencies = [ [[package]] name = "mesh-llm-gpu-bench" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "cc", @@ -4610,8 +4623,8 @@ dependencies = [ [[package]] name = "mesh-llm-guardrails" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", "serde_json", @@ -4619,16 +4632,16 @@ dependencies = [ [[package]] name = "mesh-llm-hardware-profile" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "mesh-llm-native-runtime", ] [[package]] name = "mesh-llm-host-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "argon2", @@ -4650,7 +4663,6 @@ dependencies = [ "http", "http-body-util", "httparse", - "if-addrs", "iroh", "json5", "keyring", @@ -4698,6 +4710,7 @@ dependencies = [ "serde_yaml", "sha2 0.10.9", "skippy-coordinator", + "skippy-ffi", "skippy-protocol", "skippy-runtime", "skippy-server", @@ -4720,8 +4733,8 @@ dependencies = [ [[package]] name = "mesh-llm-identity" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "argon2", "base64", @@ -4742,8 +4755,8 @@ dependencies = [ [[package]] name = "mesh-llm-native-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "serde", @@ -4753,8 +4766,8 @@ dependencies = [ [[package]] name = "mesh-llm-node" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-types", @@ -4767,8 +4780,8 @@ dependencies = [ [[package]] name = "mesh-llm-plugin" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -4784,8 +4797,8 @@ dependencies = [ [[package]] name = "mesh-llm-plugin-manager" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -4795,6 +4808,7 @@ dependencies = [ "reqwest 0.12.28", "serde", "serde_json", + "sha2 0.10.9", "tar", "tempfile", "zip", @@ -4802,8 +4816,8 @@ dependencies = [ [[package]] name = "mesh-llm-protocol" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "hex", @@ -4815,16 +4829,16 @@ dependencies = [ [[package]] name = "mesh-llm-routing" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "iroh", ] [[package]] name = "mesh-llm-runtime-install" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -4846,8 +4860,8 @@ dependencies = [ [[package]] name = "mesh-llm-sdk" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-api-client", @@ -4861,8 +4875,8 @@ dependencies = [ [[package]] name = "mesh-llm-skills" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -4872,8 +4886,8 @@ dependencies = [ [[package]] name = "mesh-llm-system" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "chrono", @@ -4895,8 +4909,8 @@ dependencies = [ [[package]] name = "mesh-llm-types" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "hex", "serde", @@ -4906,13 +4920,13 @@ dependencies = [ [[package]] name = "mesh-llm-ui" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "mesh-mixture-of-agents" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "async-trait", "mesh-llm-guardrails", @@ -5038,8 +5052,8 @@ dependencies = [ [[package]] name = "model-artifact" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -5049,8 +5063,8 @@ dependencies = [ [[package]] name = "model-hf" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -5067,8 +5081,8 @@ dependencies = [ [[package]] name = "model-package" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "bytes", @@ -5087,16 +5101,16 @@ dependencies = [ [[package]] name = "model-ref" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", ] [[package]] name = "model-resolver" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "model-artifact", @@ -5815,8 +5829,8 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" [[package]] name = "openai-frontend" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "async-trait", "axum", @@ -7368,9 +7382,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "1.7.0" +version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0810a9f717d9828f475fe1f629f4c305c8464b7f496c3a854b58d29e65f4058e" +checksum = "1d1f571c72940a19d9532fe52dbea8bc9912bf1d766c2970bb824056b86f3f59" dependencies = [ "async-trait", "base64", @@ -7401,9 +7415,9 @@ dependencies = [ [[package]] name = "rmcp-macros" -version = "1.7.0" +version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6aefac48c364756e97f04c0401ba3231e8607882c7c1d92da0437dc16307904d" +checksum = "1aad0035b69380782d78ea95b508327e6deaa2235909053e596eea8f27b5e1d5" dependencies = [ "darling 0.23.0", "proc-macro2", @@ -8153,8 +8167,8 @@ checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b" [[package]] name = "skippy-cache" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "blake3", @@ -8163,29 +8177,29 @@ dependencies = [ [[package]] name = "skippy-coordinator" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "thiserror 2.0.18", ] [[package]] name = "skippy-ffi" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "libloading", ] [[package]] name = "skippy-metrics" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "skippy-protocol" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "prost", "prost-build", @@ -8195,8 +8209,8 @@ dependencies = [ [[package]] name = "skippy-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "libc", @@ -8209,9 +8223,10 @@ dependencies = [ [[package]] name = "skippy-server" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ + "ahash", "anyhow", "async-trait", "axum", @@ -8237,8 +8252,8 @@ dependencies = [ [[package]] name = "skippy-topology" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.73.1#43103c5c40292be688ac0261129bcbab0e7b9132" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", "serde_json", @@ -10465,8 +10480,8 @@ dependencies = [ "log", "serde", "thiserror 2.0.18", - "windows 0.62.2", - "windows-core 0.62.2", + "windows 0.61.3", + "windows-core 0.61.2", ] [[package]] diff --git a/crates/buzz-relay/Cargo.toml b/crates/buzz-relay/Cargo.toml index 01f78a2d49..41bdc3b9e9 100644 --- a/crates/buzz-relay/Cargo.toml +++ b/crates/buzz-relay/Cargo.toml @@ -84,8 +84,8 @@ async-compression = { version = "0.4.42", features = ["tokio", "gzip"] } dev = ["buzz-auth/dev"] [dev-dependencies] -mesh-llm-sdk = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.73.1", package = "mesh-llm-sdk", default-features = false, features = ["client", "serving"] } -mesh-llm-host-runtime = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.73.1", package = "mesh-llm-host-runtime", default-features = false, features = ["dynamic-native-runtime"] } +mesh-llm-sdk = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-sdk", default-features = false, features = ["client", "serving"] } +mesh-llm-host-runtime = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-host-runtime", default-features = false, features = ["dynamic-native-runtime"] } buzz-core = { workspace = true, features = ["test-utils"] } buzz-auth = { workspace = true, features = ["dev"] } reqwest = { workspace = true } diff --git a/crates/buzz-relay/examples/mesh_agent_e2e.rs b/crates/buzz-relay/examples/mesh_agent_e2e.rs index b6f723f35a..345ca4c746 100644 --- a/crates/buzz-relay/examples/mesh_agent_e2e.rs +++ b/crates/buzz-relay/examples/mesh_agent_e2e.rs @@ -278,7 +278,9 @@ async fn agent_chat_in_isolated_home( .env("OPENAI_COMPAT_API_KEY", "buzz-mesh-local") .env("OPENAI_COMPAT_API", "chat") .env("BUZZ_AGENT_MAX_OUTPUT_TOKENS", "4096") - .env("BUZZ_AGENT_THINKING_EFFORT", "none") + // No BUZZ_AGENT_THINKING_EFFORT: apply_relay_mesh_env() deliberately + // leaves it unset so each model's chat template picks its own default. + // Pinning a value here would test a config the product does not ship. .stdin(Stdio::piped()) .stdout(Stdio::piped()) .stderr(Stdio::null()); diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 7e23289f53..cd0fabb69f 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -75,6 +75,19 @@ dependencies = [ "subtle", ] +[[package]] +name = "ahash" +version = "0.8.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" +dependencies = [ + "cfg-if 1.0.4", + "getrandom 0.3.4", + "once_cell", + "version_check", + "zerocopy", +] + [[package]] name = "aho-corasick" version = "1.1.4" @@ -1511,7 +1524,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] @@ -1748,7 +1761,7 @@ dependencies = [ "wasm-bindgen", "wasm-bindgen-futures", "web-sys", - "windows 0.61.3", + "windows 0.62.2", ] [[package]] @@ -2152,7 +2165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 1.0.109", + "syn 2.0.118", ] [[package]] @@ -3102,8 +3115,8 @@ dependencies = [ "libc", "log", "rustversion", - "windows-link 0.1.3", - "windows-result 0.3.4", + "windows-link 0.2.1", + "windows-result 0.4.1", ] [[package]] @@ -3848,7 +3861,7 @@ dependencies = [ "tokio", "tower-service", "tracing", - "windows-registry 0.5.3", + "windows-registry 0.6.1", ] [[package]] @@ -3863,7 +3876,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.61.2", + "windows-core 0.62.2", ] [[package]] @@ -4939,8 +4952,8 @@ dependencies = [ [[package]] name = "mesh-llm-api-client" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "hex", "mesh-llm-client", @@ -4949,8 +4962,8 @@ dependencies = [ [[package]] name = "mesh-llm-api-server" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-api-client", @@ -4960,13 +4973,13 @@ dependencies = [ [[package]] name = "mesh-llm-build-info" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "mesh-llm-client" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -4997,8 +5010,8 @@ dependencies = [ [[package]] name = "mesh-llm-config" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -5013,8 +5026,8 @@ dependencies = [ [[package]] name = "mesh-llm-embedded-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-host-runtime", @@ -5023,8 +5036,8 @@ dependencies = [ [[package]] name = "mesh-llm-events" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "clap", @@ -5035,8 +5048,8 @@ dependencies = [ [[package]] name = "mesh-llm-gpu-bench" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "cc", @@ -5048,8 +5061,8 @@ dependencies = [ [[package]] name = "mesh-llm-guardrails" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", "serde_json", @@ -5057,16 +5070,16 @@ dependencies = [ [[package]] name = "mesh-llm-hardware-profile" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "mesh-llm-native-runtime", ] [[package]] name = "mesh-llm-host-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "argon2", @@ -5088,7 +5101,6 @@ dependencies = [ "http", "http-body-util", "httparse", - "if-addrs", "iroh", "json5", "keyring", @@ -5136,6 +5148,7 @@ dependencies = [ "serde_yaml", "sha2 0.10.9", "skippy-coordinator", + "skippy-ffi", "skippy-protocol", "skippy-runtime", "skippy-server", @@ -5158,8 +5171,8 @@ dependencies = [ [[package]] name = "mesh-llm-identity" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "argon2", "base64 0.22.1", @@ -5180,8 +5193,8 @@ dependencies = [ [[package]] name = "mesh-llm-native-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "serde", @@ -5191,8 +5204,8 @@ dependencies = [ [[package]] name = "mesh-llm-node" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-types", @@ -5205,8 +5218,8 @@ dependencies = [ [[package]] name = "mesh-llm-plugin" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -5222,8 +5235,8 @@ dependencies = [ [[package]] name = "mesh-llm-plugin-manager" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -5233,6 +5246,7 @@ dependencies = [ "reqwest 0.12.28", "serde", "serde_json", + "sha2 0.10.9", "tar", "tempfile", "zip 2.4.2", @@ -5240,8 +5254,8 @@ dependencies = [ [[package]] name = "mesh-llm-protocol" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "hex", @@ -5253,16 +5267,16 @@ dependencies = [ [[package]] name = "mesh-llm-routing" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "iroh", ] [[package]] name = "mesh-llm-runtime-install" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -5284,8 +5298,8 @@ dependencies = [ [[package]] name = "mesh-llm-sdk" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "mesh-llm-api-client", @@ -5299,8 +5313,8 @@ dependencies = [ [[package]] name = "mesh-llm-skills" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "dirs", @@ -5310,8 +5324,8 @@ dependencies = [ [[package]] name = "mesh-llm-system" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "chrono", @@ -5333,8 +5347,8 @@ dependencies = [ [[package]] name = "mesh-llm-types" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "hex", "serde", @@ -5344,13 +5358,13 @@ dependencies = [ [[package]] name = "mesh-llm-ui" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "mesh-mixture-of-agents" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "async-trait", "mesh-llm-guardrails", @@ -5422,8 +5436,8 @@ dependencies = [ [[package]] name = "model-artifact" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -5433,8 +5447,8 @@ dependencies = [ [[package]] name = "model-hf" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "async-trait", @@ -5451,8 +5465,8 @@ dependencies = [ [[package]] name = "model-package" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "bytes", @@ -5471,16 +5485,16 @@ dependencies = [ [[package]] name = "model-ref" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", ] [[package]] name = "model-resolver" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "model-artifact", @@ -6134,7 +6148,7 @@ version = "0.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8" dependencies = [ - "proc-macro-crate 1.3.1", + "proc-macro-crate 2.0.2", "proc-macro2", "quote", "syn 2.0.118", @@ -6508,8 +6522,8 @@ dependencies = [ [[package]] name = "openai-frontend" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "async-trait", "axum", @@ -6702,7 +6716,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967" dependencies = [ "libc", - "windows-sys 0.45.0", + "windows-sys 0.61.2", ] [[package]] @@ -7412,7 +7426,7 @@ version = "0.14.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042" dependencies = [ - "heck 0.4.1", + "heck 0.5.0", "itertools", "log", "multimap", @@ -9041,8 +9055,8 @@ checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649" [[package]] name = "skippy-cache" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "blake3", @@ -9051,29 +9065,29 @@ dependencies = [ [[package]] name = "skippy-coordinator" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "thiserror 2.0.18", ] [[package]] name = "skippy-ffi" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "libloading 0.8.9", ] [[package]] name = "skippy-metrics" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" [[package]] name = "skippy-protocol" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "prost", "prost-build", @@ -9083,8 +9097,8 @@ dependencies = [ [[package]] name = "skippy-runtime" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "anyhow", "libc", @@ -9097,9 +9111,10 @@ dependencies = [ [[package]] name = "skippy-server" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ + "ahash", "anyhow", "async-trait", "axum", @@ -9125,8 +9140,8 @@ dependencies = [ [[package]] name = "skippy-topology" -version = "0.73.1" -source = "git+https://github.com/Mesh-LLM/mesh-llm.git?rev=f455d493a2ae82baf2a326e2d0fda351433b4b30#f455d493a2ae82baf2a326e2d0fda351433b4b30" +version = "0.74.0" +source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ "serde", "serde_json", @@ -10153,7 +10168,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix 1.1.4", "windows-sys 0.61.2", @@ -11789,7 +11804,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] @@ -12418,8 +12433,8 @@ dependencies = [ "log", "serde", "thiserror 2.0.18", - "windows 0.61.3", - "windows-core 0.61.2", + "windows 0.62.2", + "windows-core 0.62.2", ] [[package]] diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index b5b1191852..735a45c3b7 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -96,14 +96,14 @@ buzz_persona_pkg = { package = "buzz-persona", path = "../../crates/buzz-persona buzz_sdk_pkg = { package = "buzz-sdk", path = "../../crates/buzz-sdk" } buzz_agent_pkg = { package = "buzz-agent", path = "../../crates/buzz-agent" } iroh = { version = "1.0.2", optional = true } -mesh-llm-sdk = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-sdk", default-features = false, features = ["client", "serving"], optional = true } -mesh-llm-host-runtime = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-host-runtime", default-features = false, features = ["dynamic-native-runtime"], optional = true } +mesh-llm-sdk = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-sdk", default-features = false, features = ["client", "serving"], optional = true } +mesh-llm-host-runtime = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-host-runtime", default-features = false, features = ["dynamic-native-runtime"], optional = true } # Model catalog + hardware survey for the Share-compute model picker (same # diagnose pattern as mesh-console). Lib name of mesh-llm-client is mesh_client. -mesh-llm-client = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-client", optional = true } -mesh-llm-node = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-node", optional = true } -mesh-llm-system = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-system", optional = true } -mesh-llm-events = { git = "https://github.com/Mesh-LLM/mesh-llm.git", rev = "f455d493a2ae82baf2a326e2d0fda351433b4b30", package = "mesh-llm-events", optional = true } +mesh-llm-client = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-client", optional = true } +mesh-llm-node = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-node", optional = true } +mesh-llm-system = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-system", optional = true } +mesh-llm-events = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.74.0", package = "mesh-llm-events", optional = true } base64 = "0.22" sha2 = "0.11" tar = "0.4" diff --git a/desktop/src-tauri/src/commands/mesh_llm.rs b/desktop/src-tauri/src/commands/mesh_llm.rs index 305c54a203..998bc6e7d2 100644 --- a/desktop/src-tauri/src/commands/mesh_llm.rs +++ b/desktop/src-tauri/src/commands/mesh_llm.rs @@ -5,12 +5,35 @@ use tauri::{AppHandle, Manager, State}; use crate::{app_state::AppState, mesh_llm, relay}; -#[derive(Debug, serde::Deserialize, serde::Serialize)] +#[derive(Clone, Debug, serde::Deserialize, serde::Serialize)] #[serde(rename_all = "camelCase")] struct MeshSharingConfig { enabled: bool, + /// A fresh Share Compute request that must cross a process boundary before + /// it can start. Consumed before startup so an interrupted download is not + /// resumed on a later launch. + #[serde(default)] + start_on_next_launch: bool, model_id: String, max_vram_gb: Option, + /// Community relay where Share Compute was explicitly enabled. Older + /// configs predate community binding and restore against the active relay. + #[serde(default)] + relay_url: Option, +} + +fn pending_new_start_checkpoint(config: &MeshSharingConfig) -> MeshSharingConfig { + let mut checkpoint = config.clone(); + checkpoint.enabled = false; + checkpoint.start_on_next_launch = false; + checkpoint +} + +fn one_shot_restart_checkpoint(config: &MeshSharingConfig) -> MeshSharingConfig { + let mut checkpoint = config.clone(); + checkpoint.enabled = false; + checkpoint.start_on_next_launch = true; + checkpoint } fn mesh_sharing_config_path(app: &AppHandle) -> Result { @@ -89,8 +112,10 @@ fn sharing_config_from_request( .ok_or_else(|| "modelId is required for serve mode".to_string())?; Ok(MeshSharingConfig { enabled: true, + start_on_next_launch: false, model_id: model_id.to_string(), max_vram_gb: request.max_vram_gb, + relay_url: request.relay_url.clone(), }) } @@ -117,7 +142,7 @@ fn restart_to_share( app: &AppHandle, config: &MeshSharingConfig, ) -> CmdResult { - save_mesh_sharing_config(app, config)?; + save_mesh_sharing_config(app, &one_shot_restart_checkpoint(config))?; let status = restarting_share_status(config); app.request_restart(); Ok(status) @@ -133,7 +158,7 @@ fn buzz_mesh_name_for_relay(relay_url: &str) -> String { format!("buzz-community-{}", &digest[..32]) } -fn buzz_mesh_name(state: &AppState) -> String { +pub(super) fn buzz_mesh_name(state: &AppState) -> String { buzz_mesh_name_for_relay(&relay::relay_ws_url_with_override(state)) } @@ -150,8 +175,13 @@ fn advance_mesh_status_cursor( Ok(cursor) } -async fn query_mesh_discovery_events(state: &AppState) -> Result, String> { - let mut events = relay::query_relay(state, &[mesh_llm::relay_membership_filter()]).await?; +async fn query_mesh_discovery_events_at( + state: &AppState, + relay_url: &str, +) -> Result, String> { + let api_base_url = relay::relay_http_base_url(relay_url); + let mut events = + relay::query_relay_at(state, &api_base_url, &[mesh_llm::relay_membership_filter()]).await?; let member_pubkeys = mesh_llm::current_member_pubkeys(&events); if member_pubkeys.is_empty() { // Distinguish "relay returned a membership snapshot listing zero @@ -172,7 +202,7 @@ async fn query_mesh_discovery_events(state: &AppState) -> Result = None; loop { - let page = relay::query_relay(state, &[status_filter.clone()]).await?; + let page = relay::query_relay_at(state, &api_base_url, &[status_filter.clone()]).await?; let done = page.len() < mesh_llm::MESH_STATUS_PAGE_SIZE; if !done { let cursor = advance_mesh_status_cursor(&mut status_filter, &page)?; @@ -188,6 +218,10 @@ async fn query_mesh_discovery_events(state: &AppState) -> Result Result, String> { + query_mesh_discovery_events_at(state, &relay::relay_ws_url_with_override(state)).await +} + /// Resolve the admission roster by intersecting member-signed mesh status /// reporters with the current NIP-43 direct-member list. /// @@ -201,6 +235,14 @@ pub(crate) async fn resolve_trusted_owner_ids(state: &AppState) -> Result Result, String> { + let events = query_mesh_discovery_events_at(state, relay_url).await?; + Ok(mesh_llm::owner_ids_from_events(&events)) +} + /// Resolve the roster for an initial node *start*, failing closed to self-only /// (an empty roster) when the relay query fails. This is safe only at start: /// there is no established allowlist to preserve yet. The periodic @@ -244,10 +286,11 @@ fn buzz_mesh_join_targets( /// Resolve the validated member endpoint this runtime should join to enter the /// existing Buzz community mesh. `Ok(None)` means this machine is the first /// live serving member (or is itself the shared bootstrap contact). -pub(crate) async fn resolve_buzz_mesh_join_targets( +pub(crate) async fn resolve_buzz_mesh_join_targets_at( state: &AppState, + relay_url: &str, ) -> Result, String> { - let events = query_mesh_discovery_events(state).await?; + let events = query_mesh_discovery_events_at(state, relay_url).await?; let self_owner_id = mesh_llm::ensure_owner_identity() .map_err(|error| format!("failed to load mesh owner identity: {error}"))? .owner_id; @@ -261,8 +304,11 @@ pub(crate) async fn resolve_buzz_mesh_join_targets( /// snapshot. A node start used to repeat the full membership + status query /// for each value, making Share Compute startup both slower and more exposed /// to inconsistent snapshots. -async fn resolve_buzz_mesh_startup(state: &AppState) -> (Vec, Option) { - match query_mesh_discovery_events(state).await { +async fn resolve_buzz_mesh_startup_at( + state: &AppState, + relay_url: &str, +) -> (Vec, Option) { + match query_mesh_discovery_events_at(state, relay_url).await { Ok(events) => { let trusted_owner_ids = mesh_llm::owner_ids_from_events(&events); let join_token = mesh_llm::ensure_owner_identity() @@ -291,32 +337,60 @@ async fn resolve_buzz_mesh_startup(state: &AppState) -> (Vec, Option CmdResult<()> { - let Some(config) = load_mesh_sharing_config(app)? else { + let Some(mut config) = load_mesh_sharing_config(app)? else { return Ok(()); }; - if !config.enabled || config.model_id.trim().is_empty() { + if (!config.enabled && !config.start_on_next_launch) || config.model_id.trim().is_empty() { return Ok(()); } + config.model_id = mesh_llm::canonical_curated_model_id(&config.model_id).to_string(); if state.mesh_llm_runtime.lock().await.is_some() { return Ok(()); } - let (trusted_owner_ids, join_token) = resolve_buzz_mesh_startup(state).await; + let relay_url = config + .relay_url + .clone() + .unwrap_or_else(|| relay::relay_ws_url_with_override(state)); + let (trusted_owner_ids, join_token) = resolve_buzz_mesh_startup_at(state, &relay_url).await; let mut runtime = state.mesh_llm_runtime.lock().await; if runtime.is_some() { return Ok(()); } + if config.start_on_next_launch { + // Consume a role-switch request before doing any potentially long model + // work. If Buzz exits during that work, the next launch stays stopped. + config = pending_new_start_checkpoint(&config); + save_mesh_sharing_config(app, &config)?; + } + // This is restoration of a previously inference-ready serving node. Keep + // the enabled checkpoint armed while restoring so a transient startup + // failure does not silently turn Share Compute off. New starts remain + // disarmed in `mesh_start_node` until their first inference probe passes. let request = mesh_llm::StartMeshNodeRequest { mode: mesh_llm::MeshNodeMode::Serve, - model_id: Some(config.model_id), + model_id: Some(config.model_id.clone()), max_vram_gb: config.max_vram_gb, join_token, - mesh_name: Some(buzz_mesh_name(state)), + mesh_name: Some(buzz_mesh_name_for_relay(&relay_url)), + relay_url: Some(relay_url), trusted_owner_ids: Some(trusted_owner_ids), }; let started = mesh_llm::DesktopMeshRuntime::start(request) .await .map_err(|error| format!("failed to restore Share Compute: {error:#}"))?; + if let Err(error) = wait_for_mesh_inference(&config.model_id).await { + let cleanup = started.stop().await; + if let Err(cleanup_error) = cleanup { + eprintln!( + "buzz-mesh: restored node failed inference readiness and cleanup was incomplete: {cleanup_error:#}" + ); + } + return Err(format!("failed to restore Share Compute: {error}")); + } *runtime = Some(started); + config.enabled = true; + config.start_on_next_launch = false; + save_mesh_sharing_config(app, &config)?; drop(runtime); mesh_llm::publish_current_status_once(app, "restore").await; Ok(()) @@ -328,6 +402,11 @@ pub async fn mesh_start_node( state: State<'_, AppState>, mut request: mesh_llm::StartMeshNodeRequest, ) -> CmdResult { + let relay_url = relay::relay_ws_url_with_override(&state); + request.relay_url = Some(relay_url.clone()); + if let Some(model_id) = request.model_id.as_mut() { + *model_id = mesh_llm::canonical_curated_model_id(model_id).to_string(); + } let sharing_config = if request.mode == mesh_llm::MeshNodeMode::Serve { Some(sharing_config_from_request(&request)?) } else { @@ -362,13 +441,14 @@ pub async fn mesh_start_node( // Frontend requests never carry a roster. Resolve it and the bootstrap // endpoint from one snapshot so UI startup does not repeat relay probes. if request.trusted_owner_ids.is_none() || request.join_token.is_none() { - let (trusted_owner_ids, join_token) = resolve_buzz_mesh_startup(&state).await; + let (trusted_owner_ids, join_token) = + resolve_buzz_mesh_startup_at(&state, &relay_url).await; request.trusted_owner_ids.get_or_insert(trusted_owner_ids); if request.join_token.is_none() { request.join_token = join_token; } } - request.mesh_name = Some(buzz_mesh_name(&state)); + request.mesh_name = Some(buzz_mesh_name_for_relay(&relay_url)); let mut runtime = state.mesh_llm_runtime.lock().await; let plan = match runtime.as_ref() { @@ -386,6 +466,13 @@ pub async fn mesh_start_node( return Err("mesh node is already running".to_string()); } + if let Some(config) = sharing_config.as_ref() { + // Do not arm launch restoration until the exact inference path used by + // agents succeeds. Mesh may bind its ports after primary weights load + // while package layers are still downloading. + save_mesh_sharing_config(&app, &pending_new_start_checkpoint(config))?; + } + let started = mesh_llm::DesktopMeshRuntime::start(request) .await .map_err(|error| format!("{error:#}"))?; @@ -409,6 +496,21 @@ pub async fn mesh_start_node( )); } }; + if let Some(config) = sharing_config.as_ref() { + if let Err(error) = wait_for_mesh_inference(&config.model_id).await { + let cleanup = started.stop().await; + if let Err(cleanup_error) = &cleanup { + eprintln!( + "buzz-mesh: started node failed inference readiness and cleanup was incomplete: {cleanup_error:#}" + ); + } + drop(runtime); + app.request_restart(); + return Err(format!( + "mesh node started but inference never became ready: {error}; Buzz is restarting to guarantee cleanup" + )); + } + } *runtime = Some(started); drop(runtime); if let Some(config) = sharing_config.as_ref() { @@ -612,6 +714,7 @@ pub(crate) async fn ensure_client_node_for_model( max_vram_gb: None, join_token: Some(join_token.clone()), mesh_name: Some(buzz_mesh_name(state)), + relay_url: Some(relay::relay_ws_url_with_override(state)), trusted_owner_ids: Some(resolve_trusted_owner_ids_or_self_only(state).await), }; let mut runtime = state.mesh_llm_runtime.lock().await; @@ -753,6 +856,18 @@ pub(crate) async fn ensure_relay_mesh_for_record( } } } + + // A persisted Share Compute configuration is authoritative about this + // machine's role. If no runtime is currently tracked (for example after a + // clean process restart), restore the serving node instead of treating an + // agent request as permission to replace it with a client node. + if load_mesh_sharing_config(app)? + .is_some_and(|config| config.enabled && !config.model_id.trim().is_empty()) + { + restore_mesh_sharing(app, &state).await?; + return wait_for_mesh_inference(model_id).await; + } + let target = match resolve_mesh_bootstrap_target(&state, model_id).await { Ok(Some(target)) => target, Ok(None) => { @@ -768,15 +883,9 @@ pub(crate) async fn ensure_relay_mesh_for_record( } }; - // Serve→Client re-arm transition (micspiral review #3, intentional-by-design): - // if the dead ingress belonged to a *serve* node with running consumer - // agents, this re-arms it as a Client (`MeshNodeMode::Client`). That is the - // correct/safe recovery here — config-backed serve restoration is - // `restore_mesh_sharing`'s job (`MeshNodeMode::Serve`), and - // `ensure_client_node_for_model` reuses any live runtime of *either* mode - // (the router resolves per-request), so it only cold-starts a Client when - // there is genuinely no runtime. Falling back to Client if a serve node - // crashed under local pressure is a desirable fail-safe, not a regression. + // No serving configuration exists, so this is a genuine consumer-only + // start. A configured serving machine is restored above and never reaches + // this client fallback. ensure_client_node_for_model(&state, model_id, Some(target.endpoint_addr)).await?; wait_for_mesh_inference(model_id).await } @@ -792,14 +901,17 @@ pub async fn mesh_stop_node( // role under the lock and, when it's a consume session, leave it running // and return its live status unchanged. The frontend also guards this, but // status can be stale between polls, so the backend is authoritative. - let taken = { + let (taken, bound_relay_url) = { let mut guard = state.mesh_llm_runtime.lock().await; if let Some(runtime) = guard.as_ref() { if !share_stop_should_teardown(runtime.mode()) { return runtime.status().await.map_err(|error| error.to_string()); } } - guard.take() + let bound_relay_url = guard + .as_ref() + .and_then(|runtime| runtime.start_request().relay_url.clone()); + (guard.take(), bound_relay_url) }; if let Some(runtime) = taken { runtime.stop().await.map_err(|error| error.to_string())?; @@ -808,11 +920,13 @@ pub async fn mesh_stop_node( &app, &MeshSharingConfig { enabled: false, + start_on_next_launch: false, model_id: String::new(), max_vram_gb: None, + relay_url: None, }, )?; - mesh_llm::publish_stopped_status_once(&app, "stop").await; + mesh_llm::publish_stopped_status_once_at(&app, bound_relay_url.as_deref(), "stop").await; Ok(mesh_llm::stopped_status()) } diff --git a/desktop/src-tauri/src/commands/mesh_llm_tests.rs b/desktop/src-tauri/src/commands/mesh_llm_tests.rs index ccc5287d62..26eb1f5fba 100644 --- a/desktop/src-tauri/src/commands/mesh_llm_tests.rs +++ b/desktop/src-tauri/src/commands/mesh_llm_tests.rs @@ -110,6 +110,74 @@ fn buzz_mesh_name_is_stable_and_does_not_expose_the_relay() { assert!(!first.contains("example")); } +#[test] +fn sharing_config_keeps_the_community_where_sharing_was_enabled() { + let request = mesh_llm::StartMeshNodeRequest { + mode: mesh_llm::MeshNodeMode::Serve, + model_id: Some("test-model".to_string()), + max_vram_gb: Some(24), + join_token: None, + mesh_name: Some("buzz-community-test".to_string()), + relay_url: Some("wss://community.example".to_string()), + trusted_owner_ids: Some(Vec::new()), + }; + + let config = sharing_config_from_request(&request).expect("valid sharing config"); + assert_eq!(config.relay_url.as_deref(), Some("wss://community.example")); +} + +#[test] +fn legacy_sharing_config_without_community_binding_still_loads() { + let config: MeshSharingConfig = serde_json::from_value(serde_json::json!({ + "enabled": true, + "modelId": "test-model", + "maxVramGb": null + })) + .expect("legacy sharing config"); + + assert_eq!(config.relay_url, None); + assert!(!config.start_on_next_launch); +} + +#[test] +fn new_start_checkpoint_prevents_incomplete_download_restore() { + let config = MeshSharingConfig { + enabled: true, + start_on_next_launch: false, + model_id: "test-model".to_string(), + max_vram_gb: Some(24), + relay_url: Some("wss://community.example".to_string()), + }; + + let checkpoint = pending_new_start_checkpoint(&config); + assert!(!checkpoint.enabled); + assert!(!checkpoint.start_on_next_launch); + assert_eq!(checkpoint.model_id, config.model_id); + assert_eq!(checkpoint.max_vram_gb, config.max_vram_gb); + assert_eq!(checkpoint.relay_url, config.relay_url); +} + +#[test] +fn role_switch_checkpoint_starts_exactly_once_after_restart() { + let config = MeshSharingConfig { + enabled: true, + start_on_next_launch: false, + model_id: "test-model".to_string(), + max_vram_gb: Some(24), + relay_url: Some("wss://community.example".to_string()), + }; + + let restart = one_shot_restart_checkpoint(&config); + assert!(!restart.enabled); + assert!(restart.start_on_next_launch); + + let consumed = pending_new_start_checkpoint(&restart); + assert!(!consumed.enabled); + assert!(!consumed.start_on_next_launch); + assert_eq!(consumed.model_id, config.model_id); + assert_eq!(consumed.relay_url, config.relay_url); +} + #[test] fn readiness_failure_is_catalog_sync_when_model_never_visible() { assert_eq!( @@ -345,6 +413,7 @@ fn ensure_serve_runtime_serves_other_model() { max_vram_gb: None, join_token: None, mesh_name: None, + relay_url: None, trusted_owner_ids: None, }) .await diff --git a/desktop/src-tauri/src/managed_agents/relay_mesh.rs b/desktop/src-tauri/src/managed_agents/relay_mesh.rs index 7a6f5b094a..327c106bc8 100644 --- a/desktop/src-tauri/src/managed_agents/relay_mesh.rs +++ b/desktop/src-tauri/src/managed_agents/relay_mesh.rs @@ -42,15 +42,51 @@ pub fn apply_relay_mesh_env( RELAY_MESH_PREFER_MESH_FOR_AUTO_ENV.to_string(), "1".to_string(), ); - // Keep the requested response inside smaller local-model context windows, - // and spend that budget on an answer/tool call instead of hidden reasoning. - // Without both settings Qwen3 either fails the router's fit check at the - // agent default (32K) or can consume a tight cap before serializing a tool. - env.insert( - "BUZZ_AGENT_MAX_OUTPUT_TOKENS".to_string(), - "4096".to_string(), - ); - env.insert("BUZZ_AGENT_THINKING_EFFORT".to_string(), "none".to_string()); + // Keep the requested response inside smaller local-model context windows. + // These are defaults, not policy: the effective agent/persona/global env + // may deliberately choose a smaller cap or a different effort. This function + // runs after those layers during readiness, so never clobber their values. + insert_default_if_unset(env, "BUZZ_AGENT_MAX_OUTPUT_TOKENS", "4096"); + // Deliberately no BUZZ_AGENT_THINKING_EFFORT default: mesh translates + // `reasoning_effort` into the chat template's `enable_thinking` flag, so any + // value we pick overrides each model's own template default — and the right + // value is model-specific. Measured with the real prompt and toolset: + // gemma-4-E4B delivers 0/8 at `none` but 6/6 with the field absent, while + // Qwen3-8B delivers 8/8 either way and burns ~4x the output tokens once + // thinking is on (121 -> ~470), risking the 4096 cap. Omitting the field + // lets every model use its own default; explicit agent/persona/global + // values still apply. +} + +#[cfg(feature = "mesh-llm")] +fn insert_default_if_unset( + env: &mut std::collections::BTreeMap, + key: &str, + value: &str, +) { + if env.get(key).is_none_or(|current| current.trim().is_empty()) { + env.insert(key.to_string(), value.to_string()); + } +} + +/// Build the final Mesh-specific process overrides from the already-resolved +/// harness environment. Only user-owned generation controls are seeded: the +/// derived provider/base URL/model values remain authoritative, and unrelated +/// credentials (notably `OPENAI_API_KEY`) must not be copied back after the +/// spawn path removes them. +#[cfg(feature = "mesh-llm")] +pub fn relay_mesh_process_env( + effective_env: &std::collections::BTreeMap, + model: &str, +) -> std::collections::BTreeMap { + let mut env = std::collections::BTreeMap::new(); + for key in ["BUZZ_AGENT_MAX_OUTPUT_TOKENS", "BUZZ_AGENT_THINKING_EFFORT"] { + if let Some(value) = effective_env.get(key) { + env.insert(key.to_string(), value.clone()); + } + } + apply_relay_mesh_env(&mut env, Some(RELAY_MESH_PROVIDER_ID), Some(model)); + env } #[cfg(all(test, feature = "mesh-llm"))] @@ -60,7 +96,7 @@ mod tests { use super::*; #[test] - fn native_provider_uses_context_safe_non_reasoning_budget() { + fn native_provider_uses_context_safe_tool_calling_budget() { let mut env = BTreeMap::new(); apply_relay_mesh_env( &mut env, @@ -72,14 +108,63 @@ mod tests { env.get("BUZZ_AGENT_MAX_OUTPUT_TOKENS").map(String::as_str), Some("4096") ); - assert_eq!( - env.get("BUZZ_AGENT_THINKING_EFFORT").map(String::as_str), - Some("none") - ); + // Must stay unset: any value we pick overrides the model's own chat + // template default, and the right value is model-specific ("none" + // stops gemma tool-calling; enabling thinking makes Qwen3 burn ~4x the + // output budget). + assert_eq!(env.get("BUZZ_AGENT_THINKING_EFFORT"), None); assert_eq!( env.get(RELAY_MESH_PREFER_MESH_FOR_AUTO_ENV) .map(String::as_str), Some("1") ); } + + #[test] + fn native_provider_preserves_explicit_generation_controls() { + let mut env = BTreeMap::from([ + ( + "BUZZ_AGENT_MAX_OUTPUT_TOKENS".to_string(), + "2048".to_string(), + ), + ("BUZZ_AGENT_THINKING_EFFORT".to_string(), "high".to_string()), + ]); + apply_relay_mesh_env( + &mut env, + Some(RELAY_MESH_PROVIDER_ID), + Some(RELAY_MESH_AUTO_MODEL_ID), + ); + + assert_eq!( + env.get("BUZZ_AGENT_MAX_OUTPUT_TOKENS").map(String::as_str), + Some("2048") + ); + assert_eq!( + env.get("BUZZ_AGENT_THINKING_EFFORT").map(String::as_str), + Some("high") + ); + } + + #[test] + fn process_env_seeds_controls_without_restoring_unrelated_credentials() { + let effective_env = BTreeMap::from([ + ( + "BUZZ_AGENT_MAX_OUTPUT_TOKENS".to_string(), + "1024".to_string(), + ), + ("OPENAI_API_KEY".to_string(), "must-not-leak".to_string()), + ]); + + let env = relay_mesh_process_env(&effective_env, "Gemma-4"); + + assert_eq!( + env.get("BUZZ_AGENT_MAX_OUTPUT_TOKENS").map(String::as_str), + Some("1024") + ); + assert_eq!( + env.get("OPENAI_COMPAT_MODEL").map(String::as_str), + Some("Gemma-4") + ); + assert!(!env.contains_key("OPENAI_API_KEY")); + } } diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs index f3b4cb67fd..37927961ed 100644 --- a/desktop/src-tauri/src/managed_agents/runtime.rs +++ b/desktop/src-tauri/src/managed_agents/runtime.rs @@ -869,12 +869,7 @@ pub fn spawn_agent_child( // uses the same trim semantics as the preflight callers. #[cfg(feature = "mesh-llm")] if let Some(ref mesh_model_id) = mesh_model_id { - let mut mesh_env = std::collections::BTreeMap::new(); - super::apply_relay_mesh_env( - &mut mesh_env, - Some(super::RELAY_MESH_PROVIDER_ID), - Some(mesh_model_id.as_str()), - ); + let mesh_env = super::relay_mesh_process_env(&descriptor.env, mesh_model_id); command.env_remove("OPENAI_API_KEY"); for (key, value) in mesh_env { command.env(key, value); diff --git a/desktop/src-tauri/src/mesh_llm/catalog.rs b/desktop/src-tauri/src/mesh_llm/catalog.rs index 385971cb86..1a11fcfcd1 100644 --- a/desktop/src-tauri/src/mesh_llm/catalog.rs +++ b/desktop/src-tauri/src/mesh_llm/catalog.rs @@ -19,12 +19,14 @@ use mesh_llm_system::vram::{format_rated_capacity, rated_capacity_gb}; /// The large pick is resolved through mesh-llm's remote catalog /// (huggingface.co/datasets/meshllm/catalog), so it does not need to exist in /// the compiled `MODEL_CATALOG`; the entry is synthesized below. -const CURATED_LARGE: &str = "gemma-4-26B-A4B-it-UD-Q4_K_M"; +const CURATED_LARGE: &str = "unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_M"; +const CURATED_LARGE_ALIAS: &str = "gemma-4-26B-A4B-it-UD-Q4_K_M"; const CURATED_LARGE_SIZE: &str = "17GB"; const CURATED_LARGE_FILE: &str = "gemma-4-26B-A4B-it-UD-Q4_K_M.gguf"; const CURATED_LARGE_DESCRIPTION: &str = "Gemma 4 26B MoE (4B active) — Buzz default for 64GB+ machines"; -const CURATED_SMALL: &str = "Gemma-4-E4B-it-Q4_K_M"; +const CURATED_SMALL: &str = "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M"; +const CURATED_SMALL_ALIAS: &str = "Gemma-4-E4B-it-Q4_K_M"; /// Rated-capacity boundary between the two curated tiers, in GB (marketing /// capacity — a "64GB" Mac rates as 64 even though usable AI memory is less). const CURATED_LARGE_MIN_RATED_GB: u64 = 64; @@ -37,6 +39,16 @@ fn buzz_recommended_model(rated_gb: Option) -> &'static str { } } +/// Convert Buzz's pre-0.74 curated package aliases into the canonical model +/// ids advertised and accepted by Mesh's OpenAI ingress. +pub(crate) fn canonical_curated_model_id(model_id: &str) -> &str { + match model_id.trim() { + CURATED_SMALL_ALIAS => CURATED_SMALL, + CURATED_LARGE_ALIAS => CURATED_LARGE, + other => other, + } +} + /// How a model sits inside this machine's usable AI memory. /// Mirrors mesh-llm's private `fit_code_for_size_label` thresholds. #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)] @@ -146,12 +158,13 @@ fn build_catalog( .filter(|m| !is_draft_only(&m.name)) .map(|m| { let size_gb = parse_size_gb(&m.size); + let name = canonical_curated_model_id(&m.name).to_string(); MeshCatalogEntry { fit: fit_code(size_gb, vram_gb), - installed: is_installed(&m.file, &m.name), + installed: is_installed(&m.file, &name) || is_installed(&m.file, &m.name), recommended: false, curated: false, - name: m.name.clone(), + name, size: m.size.clone(), size_gb, description: m.description.clone(), @@ -166,7 +179,8 @@ fn build_catalog( let size_gb = parse_size_gb(CURATED_LARGE_SIZE); entries.push(MeshCatalogEntry { fit: fit_code(size_gb, vram_gb), - installed: is_installed(CURATED_LARGE_FILE, CURATED_LARGE), + installed: is_installed(CURATED_LARGE_FILE, CURATED_LARGE) + || is_installed(CURATED_LARGE_FILE, CURATED_LARGE_ALIAS), recommended: false, curated: false, name: CURATED_LARGE.to_string(), @@ -256,6 +270,8 @@ mod tests { #[test] fn recommendation_follows_buzz_curated_tiers() { + assert_eq!(CURATED_SMALL, "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M"); + assert_eq!(CURATED_LARGE, "unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_M"); // 64GB+ rated machines get the large curated pick. let large = build_catalog(None, 64_000_000_000, 64.0, &[]); assert_eq!(large.recommended.as_deref(), Some(CURATED_LARGE)); @@ -269,6 +285,22 @@ mod tests { assert_eq!(tiny.recommended.as_deref(), Some(CURATED_SMALL)); } + #[test] + fn curated_package_aliases_migrate_to_openai_model_ids() { + assert_eq!( + canonical_curated_model_id(CURATED_SMALL_ALIAS), + CURATED_SMALL + ); + assert_eq!( + canonical_curated_model_id(CURATED_LARGE_ALIAS), + CURATED_LARGE + ); + assert_eq!( + canonical_curated_model_id("other/model:Q4"), + "other/model:Q4" + ); + } + #[test] fn curated_picks_lead_the_catalog() { let catalog = build_catalog(None, 96_000_000_000, 96.0, &[]); diff --git a/desktop/src-tauri/src/mesh_llm/coordinator.rs b/desktop/src-tauri/src/mesh_llm/coordinator.rs index 1e279353b6..066fa46373 100644 --- a/desktop/src-tauri/src/mesh_llm/coordinator.rs +++ b/desktop/src-tauri/src/mesh_llm/coordinator.rs @@ -132,7 +132,7 @@ pub async fn start_coordinator(app: AppHandle) { /// MeshLLM establishes the encrypted peer transport itself. async fn reconcile_buzz_mesh_join(app: &AppHandle) -> Result<(), String> { let state = app.state::(); - let peer_ids = { + let (peer_ids, relay_url) = { let runtime = state.mesh_llm_runtime.lock().await; let Some(runtime) = runtime.as_ref() else { return Ok(()); @@ -141,10 +141,16 @@ async fn reconcile_buzz_mesh_join(app: &AppHandle) -> Result<(), String> { .status_report_payload() .await .map_err(|error| error.to_string())?; - visible_peer_ids(&payload) + let relay_url = runtime + .start_request() + .relay_url + .clone() + .unwrap_or_else(|| crate::relay::relay_ws_url_with_override(&state)); + (visible_peer_ids(&payload), relay_url) }; - let targets = crate::commands::mesh_llm::resolve_buzz_mesh_join_targets(&state).await?; + let targets = + crate::commands::mesh_llm::resolve_buzz_mesh_join_targets_at(&state, &relay_url).await?; let Some(target) = targets .into_iter() .find(|target| !target_is_visible(target, &peer_ids)) @@ -201,8 +207,13 @@ fn target_is_visible(target: &crate::mesh_llm::MeshServeTarget, peer_ids: &[Stri enum RosterReconcileAction { /// Keep the running allowlist untouched (no-op, or a failure we ride out). Keep, - /// Restart the node with a freshly resolved roster. - Restart(Vec), + /// Restart Buzz so MeshLLM is rebuilt with a freshly resolved roster. + /// + /// MeshLLM's native listeners are process-owned in practice: stopping and + /// starting the embedded runtime in one process can terminate Buzz or race + /// ports 9337/3131. The process boundary is therefore part of the safety + /// contract, not an implementation detail. + RestartProcess, /// Observed a *shrink* (or empty) once. Hold the current allowlist and /// require the same reduced roster on the next poll before tearing down, /// so a single transient short-read never drops a member mid-inference. @@ -224,9 +235,9 @@ fn roster_shrinks(current: &[String], fresh: &[String]) -> bool { /// Rules: /// - query failed (`Err`) → `Keep` (never de-admit on a relay blip) /// - resolved roster == current → `Keep` (no-op) -/// - grows (only additions) → `Restart` immediately (fast admission) +/// - grows (only additions) → `RestartProcess` immediately (fast admission) /// - shrinks/empties, first observation → `AwaitConfirm` (hold, re-check next poll) -/// - shrinks/empties, confirmed → `Restart` (same reduced roster twice) +/// - shrinks/empties, confirmed → `RestartProcess` (same reduced roster twice) fn roster_reconcile_action( current_owners: &[String], pending_shrink: Option<&[String]>, @@ -248,13 +259,13 @@ fn roster_reconcile_action( // Growth (pure additions) is safe to apply immediately. if !roster_shrinks(current_owners, &fresh) { - return RosterReconcileAction::Restart(fresh); + return RosterReconcileAction::RestartProcess; } // A shrink (including down to empty) must be confirmed across two // consecutive polls with the *same* reduced roster before we tear down. match pending_shrink { - Some(pending) if pending == fresh => RosterReconcileAction::Restart(fresh), + Some(pending) if pending == fresh => RosterReconcileAction::RestartProcess, _ => RosterReconcileAction::AwaitConfirm(fresh), } } @@ -283,8 +294,13 @@ async fn reconcile_roster( // other member on a transient relay blip (the flapping restart loop). Keep // the current allowlist and try again on the next poll. A shrink is held // for one extra poll (hysteresis) so a single short-read never tears down. - let query = crate::commands::mesh_llm::resolve_trusted_owner_ids(&state).await; - let fresh = match roster_reconcile_action(current_owners, pending_shrink.as_deref(), query) { + let relay_url = current_request + .relay_url + .as_deref() + .map(str::to_owned) + .unwrap_or_else(|| crate::relay::relay_ws_url_with_override(&state)); + let query = crate::commands::mesh_llm::resolve_trusted_owner_ids_at(&state, &relay_url).await; + match roster_reconcile_action(current_owners, pending_shrink.as_deref(), query) { RosterReconcileAction::Keep => { *pending_shrink = None; return Ok(()); @@ -294,34 +310,12 @@ async fn reconcile_roster( *pending_shrink = Some(reduced); return Ok(()); } - RosterReconcileAction::Restart(fresh) => { + RosterReconcileAction::RestartProcess => { *pending_shrink = None; - fresh } - }; + } - let mut request = current_request.clone(); - request.trusted_owner_ids = Some(fresh); - // Bootstrap endpoints are live device state, not configuration. The - // endpoint used at the previous start may belong to the member that just - // left or to a device whose iroh identity rotated while offline. Resolve a - // fresh validated peer for this restart; starting isolated is safe because - // the join watcher will converge it when a member next publishes. - request.join_token = match crate::commands::mesh_llm::resolve_buzz_mesh_join_targets(&state) - .await - { - Ok(targets) => targets - .into_iter() - .next() - .map(|target| target.endpoint_addr), - Err(error) => { - eprintln!( - "buzz-mesh: could not refresh bootstrap endpoint for roster restart; starting isolated: {error}" - ); - None - } - }; - let mut guard = state.mesh_llm_runtime.lock().await; + let guard = state.mesh_llm_runtime.lock().await; let startup_pending = match guard.as_ref() { Some(runtime) => runtime.is_starting().await, None => false, @@ -342,24 +336,14 @@ async fn reconcile_roster( // snapshot. return Ok(()); } - let Some(running) = guard.take() else { + if guard.is_none() { return Ok(()); - }; - eprintln!("buzz-mesh: membership roster changed; restarting mesh node with fresh allowlist"); - if let Err(error) = running.stop().await { - drop(guard); - eprintln!( - "buzz-mesh: stopping mesh node for roster restart failed; restarting Buzz instead of racing the occupied ingress: {error}" - ); - app.request_restart(); - return Err(format!( - "mesh node shutdown failed during roster change: {error}" - )); } - let replacement = crate::mesh_llm::DesktopMeshRuntime::start(request) - .await - .map_err(|error| format!("mesh node restart after roster change failed: {error:#}"))?; - *guard = Some(replacement); + drop(guard); + eprintln!( + "buzz-mesh: membership roster changed; restarting Buzz to rebuild MeshLLM with the fresh community allowlist" + ); + app.request_restart(); Ok(()) } @@ -377,11 +361,15 @@ pub(crate) async fn publish_current_status_once(app: &AppHandle, reason: &str) { } } -pub(crate) async fn publish_stopped_status_once(app: &AppHandle, reason: &str) { +pub(crate) async fn publish_stopped_status_once_at( + app: &AppHandle, + relay_url: Option<&str>, + reason: &str, +) { let state = app.state::(); match tokio::time::timeout( STATUS_PUBLISH_TIMEOUT, - publish_stopped_status_for_state(&state), + publish_stopped_status_for_state(&state, relay_url), ) .await { @@ -396,26 +384,43 @@ pub(crate) async fn publish_stopped_status_once(app: &AppHandle, reason: &str) { async fn publish_current_status_for_state(state: &AppState) -> Result<(), String> { let identity = super::ensure_owner_identity() .map_err(|error| format!("failed to load mesh owner identity: {error}"))?; - let mut payload = { + let (mut payload, relay_url) = { let runtime = state.mesh_llm_runtime.lock().await; match runtime.as_ref() { - Some(runtime) => runtime - .status_report_payload() - .await - .map_err(|error| error.to_string())?, - None => stopped_status_payload(&identity), + Some(runtime) => { + let payload = runtime + .status_report_payload() + .await + .map_err(|error| error.to_string())?; + let relay_url = runtime + .start_request() + .relay_url + .clone() + .unwrap_or_else(|| crate::relay::relay_ws_url_with_override(state)); + (payload, relay_url) + } + None => ( + stopped_status_payload(&identity), + crate::relay::relay_ws_url_with_override(state), + ), } }; bind_payload_to_member(state, &identity, &mut payload)?; - publish_status_report(state, payload).await + publish_status_report_at(state, &relay_url, payload).await } -async fn publish_stopped_status_for_state(state: &AppState) -> Result<(), String> { +async fn publish_stopped_status_for_state( + state: &AppState, + relay_url: Option<&str>, +) -> Result<(), String> { let identity = super::ensure_owner_identity() .map_err(|error| format!("failed to load mesh owner identity: {error}"))?; let mut payload = stopped_status_payload(&identity); bind_payload_to_member(state, &identity, &mut payload)?; - publish_status_report(state, payload).await + let relay_url = relay_url + .map(str::to_owned) + .unwrap_or_else(|| crate::relay::relay_ws_url_with_override(state)); + publish_status_report_at(state, &relay_url, payload).await } fn stopped_status_payload(identity: &super::identity::OwnerIdentity) -> serde_json::Value { @@ -469,13 +474,21 @@ pub(crate) fn build_status_report_event( .tags([d, k])) } -pub(crate) async fn publish_status_report( +async fn publish_status_report_at( state: &AppState, + relay_url: &str, payload: serde_json::Value, ) -> Result<(), String> { - crate::relay::submit_event(build_status_report_event(payload)?, state) - .await - .map(|_| ()) + let api_base_url = crate::relay::relay_http_base_url(relay_url); + let keys = state.signing_keys()?; + crate::relay::submit_event_at_with_keys( + build_status_report_event(payload)?, + state, + &api_base_url, + &keys, + ) + .await + .map(|_| ()) } #[cfg(test)] @@ -554,11 +567,11 @@ mod tests { // Growth (pure additions) applies immediately — fast admission is fine. #[test] - fn roster_growth_restarts_immediately() { + fn roster_growth_requests_process_restart_immediately() { let current = vec!["owner-a".to_string()]; let fresh = vec!["owner-a".to_string(), "owner-c".to_string()]; - let action = roster_reconcile_action(¤t, None, Ok(fresh.clone())); - assert_eq!(action, RosterReconcileAction::Restart(fresh)); + let action = roster_reconcile_action(¤t, None, Ok(fresh)); + assert_eq!(action, RosterReconcileAction::RestartProcess); } // A shrink is NOT applied on first observation — it must be confirmed. @@ -572,11 +585,11 @@ mod tests { // The same reduced roster on two consecutive polls confirms the shrink. #[test] - fn roster_shrink_restarts_once_confirmed() { + fn roster_shrink_requests_process_restart_once_confirmed() { let current = vec!["owner-a".to_string(), "owner-b".to_string()]; let reduced = vec!["owner-a".to_string()]; let action = roster_reconcile_action(¤t, Some(&reduced), Ok(reduced.clone())); - assert_eq!(action, RosterReconcileAction::Restart(reduced)); + assert_eq!(action, RosterReconcileAction::RestartProcess); } // A shrink that changes between polls is not confirmed — it re-holds with @@ -600,7 +613,7 @@ mod tests { assert_eq!(first, RosterReconcileAction::AwaitConfirm(Vec::new())); let empty: Vec = Vec::new(); let confirmed = roster_reconcile_action(¤t, Some(&empty), Ok(Vec::new())); - assert_eq!(confirmed, RosterReconcileAction::Restart(Vec::new())); + assert_eq!(confirmed, RosterReconcileAction::RestartProcess); } // A shrink followed by recovery to the full roster cancels the teardown. diff --git a/desktop/src-tauri/src/mesh_llm/mod.rs b/desktop/src-tauri/src/mesh_llm/mod.rs index 6e3ab4b28b..e206c53886 100644 --- a/desktop/src-tauri/src/mesh_llm/mod.rs +++ b/desktop/src-tauri/src/mesh_llm/mod.rs @@ -1,7 +1,7 @@ use std::collections::BTreeMap; mod coordinator; -pub(crate) use coordinator::{publish_current_status_once, publish_stopped_status_once}; +pub(crate) use coordinator::{publish_current_status_once, publish_stopped_status_once_at}; pub use coordinator::{start_coordinator, MeshCoordinator, KIND_BUZZ_MESH_MEMBER_STATUS}; mod discovery; @@ -14,6 +14,7 @@ pub(crate) use discovery::{ use discovery::{device_name_from_status, endpoint_id_from_status, enrich_status_payload_identity}; mod catalog; +pub(crate) use catalog::canonical_curated_model_id; pub use catalog::{model_catalog, MeshModelCatalog}; mod identity; @@ -200,6 +201,11 @@ pub struct StartMeshNodeRequest { /// accepted from the frontend and contains no relay address. #[serde(default, skip_deserializing)] pub mesh_name: Option, + /// Relay this runtime's community membership and discovery are bound to. + /// Injected by the backend when sharing starts and retained across UI + /// workspace switches; moving a share requires an explicit stop/start. + #[serde(default, skip_deserializing)] + pub relay_url: Option, /// Mesh owner ids admitted to this node (the member roster from /// member-signed discovery notes). `None` = caller did not resolve a roster /// (tests, direct invocations): the node runs without allowlist @@ -308,17 +314,20 @@ pub const MESH_WORKER_STACK_SIZE: usize = 8 * 1024 * 1024; /// before the node starts. Without this the download happens *inside* /// `serve::start()` where the UI can only show a frozen "starting…" state. /// Already-installed models return immediately from the cache scan. -async fn ensure_model_downloaded(model: &str) -> anyhow::Result<()> { - let model_owned = model.to_string(); - let installed = tokio::task::spawn_blocking(move || { +async fn model_is_installed(model: &str) -> bool { + let model_owned = model.replace("@main", ""); + tokio::task::spawn_blocking(move || { let cache = mesh_llm_node::models::default_huggingface_cache_dir(); mesh_llm_node::models::scan_installed_models(cache) .iter() - .any(|m| m.model_ref.contains(&model_owned)) + .any(|m| m.model_ref.replace("@main", "").contains(&model_owned)) }) .await - .unwrap_or(false); - if installed { + .unwrap_or(false) +} + +async fn ensure_model_downloaded(model: &str) -> anyhow::Result<()> { + if model_is_installed(model).await { return Ok(()); } mesh_llm_host_runtime::models::download_model_ref_with_progress_details(model, true) diff --git a/desktop/src-tauri/src/mesh_llm/mod_tests.rs b/desktop/src-tauri/src/mesh_llm/mod_tests.rs index 0b726c264f..557cd040fa 100644 --- a/desktop/src-tauri/src/mesh_llm/mod_tests.rs +++ b/desktop/src-tauri/src/mesh_llm/mod_tests.rs @@ -12,6 +12,7 @@ fn pending_client_runtime( max_vram_gb: None, join_token: Some("initial-token".to_string()), mesh_name: None, + relay_url: None, trusted_owner_ids: None, }; super::DesktopMeshRuntime { diff --git a/desktop/src-tauri/src/mesh_llm/recovery.rs b/desktop/src-tauri/src/mesh_llm/recovery.rs index 809fab8993..89ca6396e9 100644 --- a/desktop/src-tauri/src/mesh_llm/recovery.rs +++ b/desktop/src-tauri/src/mesh_llm/recovery.rs @@ -153,6 +153,13 @@ fn should_evict_after_probe( || consecutive >= DEAD_PROBE_EVICT_THRESHOLD } +fn requires_process_restart( + mode: crate::mesh_llm::MeshNodeMode, + startup_in_progress: bool, +) -> bool { + startup_in_progress || mode == crate::mesh_llm::MeshNodeMode::Serve +} + /// Probe and, when justified, remove one stale runtime. A closed port is /// decisive for a foreground agent start; watchdog and ambiguous/unhealthy /// ports require consecutive failures to avoid restarting on a transient load @@ -161,22 +168,23 @@ pub(crate) async fn recover_stale_mesh_runtime( state: &AppState, urgency: MeshRecoveryUrgency, ) -> MeshRuntimeRecovery { - let (candidate_id, startup_in_progress) = match state.mesh_llm_runtime.lock().await.as_ref() { - Some(runtime) => (runtime.id(), runtime.is_starting().await), - None => { - state.mesh_recovery.reset_probe_streak(); - // A cancelled SDK startup can outlive its Buzz-side task briefly - // because the embedded runtime runs on its own thread. Never start - // a replacement merely because the tracked handle is gone: first - // prove the old ingress is either still useful or has released the - // port. This closes the port-conflict loop in #2304. - return match probe_mesh_ingress().await { - MeshIngressProbe::Live => MeshRuntimeRecovery::Live, - MeshIngressProbe::PortClosed => MeshRuntimeRecovery::Absent, - MeshIngressProbe::Unhealthy => MeshRuntimeRecovery::ReleasePending, - }; - } - }; + let (candidate_id, startup_in_progress, candidate_mode) = + match state.mesh_llm_runtime.lock().await.as_ref() { + Some(runtime) => (runtime.id(), runtime.is_starting().await, runtime.mode()), + None => { + state.mesh_recovery.reset_probe_streak(); + // A cancelled SDK startup can outlive its Buzz-side task briefly + // because the embedded runtime runs on its own thread. Never start + // a replacement merely because the tracked handle is gone: first + // prove the old ingress is either still useful or has released the + // port. This closes the port-conflict loop in #2304. + return match probe_mesh_ingress().await { + MeshIngressProbe::Live => MeshRuntimeRecovery::Live, + MeshIngressProbe::PortClosed => MeshRuntimeRecovery::Absent, + MeshIngressProbe::Unhealthy => MeshRuntimeRecovery::ReleasePending, + }; + } + }; let probe = probe_mesh_ingress().await; if probe == MeshIngressProbe::Live { state.mesh_recovery.reset_probe_streak(); @@ -196,12 +204,13 @@ pub(crate) async fn recover_stale_mesh_runtime( return MeshRuntimeRecovery::Debouncing; } - // The pinned SDK does not yield its control handle until the management - // API is ready. Dropping its still-pending start future would detach the - // embedded runtime thread without sending a shutdown request, so Buzz must - // not evict it and race a replacement onto the same ports. A controlled - // app relaunch is the only process-owned cleanup boundary in this state. - if startup_in_progress { + // Never replace a serving runtime in-process. Its native listeners and + // model host are process-owned; stopping it here and then cold-starting a + // client silently disables Share Compute and can race ports 9337/3131. + // Pending client startups have the same ownership problem because the SDK + // has not yielded a shutdown handle yet. In both cases, process restart is + // the only boundary that preserves the configured role safely. + if requires_process_restart(candidate_mode, startup_in_progress) { state.mesh_recovery.reset_probe_streak(); return MeshRuntimeRecovery::RestartRequired; } @@ -241,6 +250,12 @@ pub(crate) async fn recover_stale_mesh_runtime( pub(crate) async fn rearm_relay_mesh_for_running_agents(app: &AppHandle) -> Result<(), String> { let state = app.state::(); let _rearm_guard = state.mesh_recovery.rearm_lock.lock().await; + let runtime_mode = state + .mesh_llm_runtime + .lock() + .await + .as_ref() + .map(|runtime| runtime.mode()); let recovery = recover_stale_mesh_runtime(&state, MeshRecoveryUrgency::Watchdog).await; let active_pubkeys = active_managed_agent_pubkeys(&state); // Mesh participation is resolved through the same definition-authoritative @@ -254,6 +269,13 @@ pub(crate) async fn rearm_relay_mesh_for_running_agents(app: &AppHandle) -> Resu | MeshRuntimeRecovery::Debouncing | MeshRuntimeRecovery::Replaced => return Ok(()), MeshRuntimeRecovery::RestartRequired => { + if runtime_mode == Some(crate::mesh_llm::MeshNodeMode::Serve) { + eprintln!( + "buzz-mesh: serving ingress failed; restarting Buzz to restore Share Compute without changing roles" + ); + app.request_restart(); + return Ok(()); + } let records = crate::managed_agents::load_managed_agents(app).unwrap_or_default(); if !records.iter().any(|record| { running_relay_mesh_model_id(record, &active_pubkeys, &personas, &global).is_some() @@ -410,6 +432,7 @@ mod tests { name_pool: Vec::new(), is_builtin: false, is_active: true, + shared: false, source_team: None, source_team_persona_slug: None, catalog_source: None, @@ -481,6 +504,22 @@ mod tests { assert!(STALE_STOP_TIMEOUT <= Duration::from_secs(15)); } + #[test] + fn failed_serving_runtime_requires_process_restart_instead_of_client_fallback() { + assert!(requires_process_restart( + crate::mesh_llm::MeshNodeMode::Serve, + false + )); + assert!(requires_process_restart( + crate::mesh_llm::MeshNodeMode::Client, + true + )); + assert!(!requires_process_restart( + crate::mesh_llm::MeshNodeMode::Client, + false + )); + } + #[test] fn only_running_relay_mesh_agents_trigger_rearm() { let personas: Vec = Vec::new(); diff --git a/desktop/src/features/mesh-compute/ui/MeshComputeSettingsCard.tsx b/desktop/src/features/mesh-compute/ui/MeshComputeSettingsCard.tsx index 76f86f8054..fd7550eff0 100644 --- a/desktop/src/features/mesh-compute/ui/MeshComputeSettingsCard.tsx +++ b/desktop/src/features/mesh-compute/ui/MeshComputeSettingsCard.tsx @@ -107,7 +107,9 @@ export function MeshComputeSettingsCard() { // One-shot hardware-aware catalog fetch. Purely additive: when it fails // (stub build, survey error) the card falls back to the free-text field. - // Keep an empty draft empty so the UI can explicitly ask the member to choose. + // When there is no saved choice, make the curated recommendation the actual + // default so a new member can turn Share Compute on directly. An explicit + // saved draft always wins. React.useEffect(() => { let cancelled = false; (async () => { @@ -115,6 +117,11 @@ export function MeshComputeSettingsCard() { const value = await meshModelCatalog(); if (cancelled) return; setCatalog(value); + setModelInput((current) => { + if (current.trim() !== "" || !value.recommended) return current; + writeDraft(MODEL_DRAFT_STORAGE_KEY, value.recommended); + return value.recommended; + }); } catch { // Non-fatal — picker just doesn't render. } diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 96948c31df..73b564429a 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -2890,9 +2890,7 @@ const mockMeshState: { servingUsage: MockServingUsage; } = { admitted: true, - models: [ - { id: "hf://demo/SmolLM2-135M-Instruct-GGUF:Q4_K_M", name: "SmolLM2 135M" }, - ], + models: [{ id: "Gemma-4-E4B-it-Q4_K_M", name: "Gemma 4 E4B" }], denyReason: "not a relay member", nodeState: "off", nodeMode: null, @@ -2901,9 +2899,7 @@ const mockMeshState: { function resetMockMesh() { mockMeshState.admitted = true; - mockMeshState.models = [ - { id: "hf://demo/SmolLM2-135M-Instruct-GGUF:Q4_K_M", name: "SmolLM2 135M" }, - ]; + mockMeshState.models = [{ id: "Gemma-4-E4B-it-Q4_K_M", name: "Gemma 4 E4B" }]; mockMeshState.denyReason = "not a relay member"; mockMeshState.nodeState = "off"; mockMeshState.nodeMode = null; @@ -9744,6 +9740,25 @@ export function maybeInstallE2eTauriMocks() { } case "mesh_installed_models": return mockMeshState.models; + case "mesh_model_catalog": + return { + gpuName: "Mock Apple GPU", + vramDisplay: "32 GB", + vramGb: 32, + recommended: "Gemma-4-E4B-it-Q4_K_M", + entries: [ + { + name: "Gemma-4-E4B-it-Q4_K_M", + size: "3.5GB", + sizeGb: 3.5, + description: "Buzz-curated local agent model", + fit: "comfortable", + installed: true, + recommended: true, + curated: true, + }, + ], + }; case "mesh_node_status": return meshNodeStatus(mockMeshState.nodeState, mockMeshState.nodeMode); case "mesh_serving_usage": diff --git a/desktop/tests/e2e/mesh-compute.spec.ts b/desktop/tests/e2e/mesh-compute.spec.ts index 7c360368a2..b2e8fc28a9 100644 --- a/desktop/tests/e2e/mesh-compute.spec.ts +++ b/desktop/tests/e2e/mesh-compute.spec.ts @@ -15,7 +15,7 @@ type E2eWindow = Window & { }) => void; }; -test("Share compute has a clear empty state and starts and stops sharing", async ({ +test("Share compute selects the curated default and starts and stops sharing", async ({ page, }) => { await installMockBridge(page); @@ -30,22 +30,32 @@ test("Share compute has a clear empty state and starts and stops sharing", async await expect(card).toContainText( "Choose a suggested model below, or enter a model reference or local file", ); - await expect(toggle).toBeDisabled(); - - await model.fill("hf://demo/SmolLM2-135M-Instruct-GGUF:Q4_K_M"); + await expect(model).toHaveValue("Gemma-4-E4B-it-Q4_K_M"); + await expect(toggle).toBeEnabled(); await expect(card).toContainText( "Buzz downloads remote models when sharing starts", ); - await expect(toggle).toBeEnabled(); await toggle.click(); await expect(toggle).toBeChecked(); - await expect(card).toContainText("Sharing SmolLM2 135M with relay members"); + await expect(card).toContainText("Sharing Gemma 4 E4B with relay members"); await expect .poll(() => page.evaluate(() => (window as E2eWindow).__BUZZ_E2E_COMMANDS__ ?? []), ) .toContain("mesh_start_node"); + await expect + .poll(() => + page.evaluate( + () => (window as E2eWindow).__BUZZ_E2E_COMMAND_PAYLOADS__ ?? [], + ), + ) + .toContainEqual({ + command: "mesh_start_node", + payload: { + request: { mode: "serve", modelId: "Gemma-4-E4B-it-Q4_K_M" }, + }, + }); await toggle.click(); await expect(toggle).not.toBeChecked(); From 02be413b823c356587e6e9f4d07f6cb06bb41c3c Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 30 Jul 2026 11:38:28 -0400 Subject: [PATCH 075/112] feat(catalog): resolve publisher display name in catalog detail pane (#3640) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The catalog detail pane hardcoded "Community member" for every non-own catalog entry. The publisher pubkey (`catalogSource.ownerPubkey`) was already on every entry — it just was not being resolved to a name. ## What changed **`desktop/src/features/agents/ui/PersonaCatalogDialog.tsx`** `PersonaCatalogDetail` now calls `useUsersBatchQuery([ownerPubkey])` when the selected entry is a community (non-own) catalog agent. The label derivation is extracted into the exported pure function `resolveCatalogOwnerLabel` and uses truthy fallbacks to handle empty or whitespace-only kind:0 fields: - Own entry → `"You"` (unchanged) - `displayName` present and non-blank → the display name - `displayName` absent/blank but `name` present and non-blank → the name - Loading, unresolvable, or both candidates blank → `"Community member"` (fallback preserved) The batch query is disabled (`enabled: false`) when the entry is not a community entry, so there is no extra network call for own entries or built-in agents. **`desktop/src/features/agents/ui/personaCatalogOwnerLabel.test.mjs`** Unit tests for `resolveCatalogOwnerLabel` covering: populated `displayName` wins; whitespace-only `displayName` falls through to `name`; both candidates empty/whitespace/null/undefined all fall through to `"Community member"`. **`desktop/tests/e2e/agents.spec.ts`** - Updated the existing assertion — it previously checked for the hardcoded fallback; now asserts the resolved mock display name `"alice"`. - Added "catalog detail shows Community member when the publisher profile cannot be resolved" — installs a catalog event from an unknown pubkey and asserts the fallback still renders. --------- Signed-off-by: Will Pfleger Co-authored-by: npub1g8493u0xfsjrvflg4n08ezd7vec99mnwzlv0qgwpr9d7gvjwhuzqx59rhw <41ea58f1e64c243627e8acde7c89be667052ee6e17d8f021c1195be4324ebf04@buzz.block.builderlab.xyz> --- .../agents/ui/PersonaCatalogDialog.tsx | 45 +++++++++-- .../ui/personaCatalogOwnerLabel.test.mjs | 77 +++++++++++++++++++ desktop/tests/e2e/agents.spec.ts | 36 ++++++++- 3 files changed, 149 insertions(+), 9 deletions(-) create mode 100644 desktop/src/features/agents/ui/personaCatalogOwnerLabel.test.mjs diff --git a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx index ba76d6e4ed..e1ec946092 100644 --- a/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx +++ b/desktop/src/features/agents/ui/PersonaCatalogDialog.tsx @@ -2,6 +2,7 @@ import * as React from "react"; import { isCatalogPersonaSelected } from "@/features/agents/lib/catalog"; import { isCatalogPersona } from "@/features/agents/lib/personaCatalogRelay"; +import { useUsersBatchQuery } from "@/features/profile/hooks"; import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar"; import type { AgentPersona } from "@/shared/api/types"; import { useFeedbackToasts } from "@/shared/hooks/useToastEffect"; @@ -276,7 +277,42 @@ function PersonaCatalogChooser({ ); } +/** + * Derives the "Added by" label for a catalog entry from a resolved profile + * summary. Prefers `displayName`, falls back to `name`, then to the default + * "Community member" string when both are absent, null, or whitespace-only. + */ +export function resolveCatalogOwnerLabel( + summary: + | { displayName?: string | null; name?: string | null } + | null + | undefined, +): string { + return ( + summary?.displayName?.trim() || summary?.name?.trim() || "Community member" + ); +} + function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) { + const isCommunityEntry = + isCatalogPersona(persona) && !persona.catalogSource.isOwn; + const ownerPubkey = isCommunityEntry + ? persona.catalogSource.ownerPubkey + : undefined; + const ownerBatchQuery = useUsersBatchQuery(ownerPubkey ? [ownerPubkey] : [], { + enabled: !!ownerPubkey, + }); + + let addedByLabel: string; + if (!isCommunityEntry) { + addedByLabel = "You"; + } else { + const summary = ownerPubkey + ? ownerBatchQuery.data?.profiles[ownerPubkey.toLowerCase()] + : undefined; + addedByLabel = resolveCatalogOwnerLabel(summary); + } + return (
@@ -290,14 +326,7 @@ function PersonaCatalogDetail({ persona }: { persona: AgentPersona }) { {persona.displayName} {persona.isBuiltIn ? null : ( - + )}
diff --git a/desktop/src/features/agents/ui/personaCatalogOwnerLabel.test.mjs b/desktop/src/features/agents/ui/personaCatalogOwnerLabel.test.mjs new file mode 100644 index 0000000000..7ad726352f --- /dev/null +++ b/desktop/src/features/agents/ui/personaCatalogOwnerLabel.test.mjs @@ -0,0 +1,77 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { resolveCatalogOwnerLabel } from "./PersonaCatalogDialog.tsx"; + +// ── null / undefined summary ────────────────────────────────────────────────── + +test("test_null_summary_returns_community_member", () => { + assert.equal(resolveCatalogOwnerLabel(null), "Community member"); +}); + +test("test_undefined_summary_returns_community_member", () => { + assert.equal(resolveCatalogOwnerLabel(undefined), "Community member"); +}); + +// ── populated displayName ───────────────────────────────────────────────────── + +test("test_display_name_present_returns_display_name", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: "Alice", name: "alice" }), + "Alice", + ); +}); + +test("test_display_name_present_without_name_returns_display_name", () => { + assert.equal(resolveCatalogOwnerLabel({ displayName: "Alice" }), "Alice"); +}); + +// ── empty / whitespace displayName with valid name ──────────────────────────── + +test("test_empty_display_name_falls_through_to_name", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: "", name: "alice" }), + "alice", + ); +}); + +test("test_whitespace_only_display_name_falls_through_to_name", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: " ", name: "alice" }), + "alice", + ); +}); + +// ── both candidates absent / empty ──────────────────────────────────────────── + +test("test_both_null_returns_community_member", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: null, name: null }), + "Community member", + ); +}); + +test("test_both_empty_returns_community_member", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: "", name: "" }), + "Community member", + ); +}); + +test("test_both_whitespace_returns_community_member", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: " ", name: "\t" }), + "Community member", + ); +}); + +test("test_display_name_absent_name_present_returns_name", () => { + assert.equal(resolveCatalogOwnerLabel({ name: "alice" }), "alice"); +}); + +test("test_display_name_null_name_present_returns_name", () => { + assert.equal( + resolveCatalogOwnerLabel({ displayName: null, name: "alice" }), + "alice", + ); +}); diff --git a/desktop/tests/e2e/agents.spec.ts b/desktop/tests/e2e/agents.spec.ts index 42d4aac114..3cbe097c05 100644 --- a/desktop/tests/e2e/agents.spec.ts +++ b/desktop/tests/e2e/agents.spec.ts @@ -1736,8 +1736,10 @@ test("a community member can discover and add another member's catalog agent", a ); await expect(remoteEntry).toContainText("Alice’s Reviewer"); await remoteEntry.click(); + // The detail pane resolves the publisher's display name; 'Community member' + // is only the fallback for an unresolvable pubkey. await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( - "Added by Community member", + "Added by alice", ); await page @@ -1790,6 +1792,38 @@ test("a community member can discover and add another member's catalog agent", a expect(await countCommandInvocations(page, "create_persona")).toBe(1); }); +test("catalog detail shows Community member when the publisher profile cannot be resolved", async ({ + page, +}) => { + // A pubkey that is not in the mock profile registry — profile resolution + // will fail and the detail pane must fall back gracefully. + const unknownPubkey = + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; + const personaId = "unresolvable-reviewer"; + await installMockBridge(page, { + personaCatalogEvents: [ + createCatalogEvent({ + ownerPubkey: unknownPubkey, + sourcePersonaId: personaId, + displayName: "Mystery Agent", + systemPrompt: "Published by someone whose profile cannot be fetched.", + }), + ], + }); + await gotoApp(page); + await page.getByTestId("open-agents-view").click(); + await openPersonaCatalog(page); + + await page + .getByTestId( + `persona-catalog-list-item-catalog:${unknownPubkey}:${personaId}`, + ) + .click(); + await expect(page.getByTestId("persona-catalog-detail-pane")).toContainText( + "Added by Community member", + ); +}); + test("one share level selector drives both the link and send paths", async ({ page, }) => { From 53771c8f5439f9c5c26876f0229bfcfe5da9b170 Mon Sep 17 00:00:00 2001 From: Cameron Hotchkies Date: Thu, 30 Jul 2026 09:43:52 -0700 Subject: [PATCH 076/112] fix(acp): preserve truncated thread context (#3340) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Long Buzz threads were rendered as `[Thread Context (13 of 13 messages)]` because the harness counted only the already-limited query result. That hid older context and could also hide the agent's own prior reply in busy threads. ## What - Fetch one extra thread reply as a sentinel so truncated context is labeled correctly. - Use a best-effort `/count` call for improved truncated totals when available, clamped to the sentinel-proven minimum so racy counts cannot render impossible labels. - Keep the `/count` path single-attempt with a short timeout and only add the root to exact totals when the root was actually fetched. - Fetch and preserve the agent's newest prior reply when it falls outside the recent window, with exact event-id matching for the pin/dedup boundary. - Add parser and fetch-boundary tests for truncation, exact count, missing root, count-below-minimum clamping, count failure fallback, distinct fetched-reply lower bounds, agent-reply dedup/pinning, and serialized query/count filter semantics. ## Risk Assessment Low-to-medium — limited to buzz-acp prompt context fetching and a small RestClient helper. If `/count` fails or times out, the code falls back to the sentinel-derived minimum total rather than failing the prompt. The synchronous `/count` happens only for truncated thread contexts and is bounded to one short best-effort attempt. ## References - Buzz thread: chotchkies-buzz-bombing-flakes / `7ef71407f1c7a642382c7e48e0c80fb6ca66948890e04d1eb6f1408c3b7278b1` - Validation at `c1cfd1b16a04a3ac1d1d0d3cf43e1a08508f3532`: - `cargo fmt -p buzz-acp` ✅ - `cargo test -p buzz-acp test_fetch_thread_context -- --nocapture` ✅ (6 tests) - `cargo test -p buzz-acp parse_nostr_thread_response` ✅ - `cargo test -p buzz-acp` ✅ (649 unit + 9 lifecycle tests) - `git diff --check` ✅ - Push was completed with `--no-verify` after pre-push hooks reached non-code local environment failures: `flutter` missing for `mobile-test`; Node.js v20.20.2 too old for pnpm/node:sqlite in `desktop-check` and `desktop-test`. Earlier hook stages passed: `check-push-org`, `branch-skew`, `rust-tests`, `test`, `desktop-tauri-checks`. - Earlier full `./bin/just ci` at `622ed7eb8807d64e06209101569b1013414af091` ⚠️ passed Rust/desktop/web stages, then failed in `mobile-test` on unrelated existing mobile test `ChannelDetailPage keeps follow mode off while a tall newest message stays visible`; rerunning that single mobile test reproduced the same failure without touching mobile code. Generated with Codex Signed-off-by: npub1m0vvn9qm5md0a080p27qzkm9uaw49e699ukwfq7fc0756xq0y5zqhzhdk2 Co-authored-by: npub1m0vvn9qm5md0a080p27qzkm9uaw49e699ukwfq7fc0756xq0y5zqhzhdk2 --- crates/buzz-acp/src/pool.rs | 787 ++++++++++++++++++++++++++++++++++- crates/buzz-acp/src/relay.rs | 13 + 2 files changed, 782 insertions(+), 18 deletions(-) diff --git a/crates/buzz-acp/src/pool.rs b/crates/buzz-acp/src/pool.rs index d1e005cbcc..158477c0af 100644 --- a/crates/buzz-acp/src/pool.rs +++ b/crates/buzz-acp/src/pool.rs @@ -19,6 +19,7 @@ //! //! `AcpClient` is NOT Clone — ownership moves out on claim and back on return. +use std::cmp::Reverse; use std::collections::{HashMap, HashSet}; use std::sync::{Arc, Mutex}; use std::time::Duration; @@ -800,6 +801,9 @@ pub enum IdleSwitchResult { /// 2 × CONTEXT_FETCH_TIMEOUT + CONTEXT_FETCH_RETRY_DELAY ≈ 6.5 s. const CONTEXT_FETCH_TIMEOUT: Duration = Duration::from_millis(3_000); +/// Short, single-attempt timeout for best-effort exact truncated-thread counts. +const CONTEXT_COUNT_TIMEOUT: Duration = Duration::from_millis(500); + /// Delay between the first failed context fetch and the single retry. const CONTEXT_FETCH_RETRY_DELAY: Duration = Duration::from_millis(500); @@ -2600,7 +2604,14 @@ async fn fetch_conversation_context( let last_event = batch.events.last()?; let tags = crate::queue::parse_thread_tags(&last_event.event); if let Some(root_id) = tags.root_event_id { - return fetch_thread_context(batch.channel_id, &root_id, limit, &ctx.rest_client).await; + return fetch_thread_context( + batch.channel_id, + &root_id, + limit, + ctx.agent_keys.public_key(), + &ctx.rest_client, + ) + .await; } // DM non-reply: fetch recent conversation history. @@ -2762,12 +2773,48 @@ async fn fetch_prompt_profile_lookup( } /// Fetch thread context via Nostr query: root event by ID + replies by `#e` tag. +/// +/// The reply query intentionally requests one more reply than the configured +/// display window. That sentinel event lets the prompt say `N of M, truncated` +/// when the relay has more thread history, instead of reporting the capped page +/// as the total. When the window is full, a best-effort `/count` attempts to +/// improve that lower-bound total; because it is a separate racy request, the +/// result is clamped to the sentinel-proven minimum. The query also asks for the +/// agent's newest reply separately so the next prompt can include the agent's +/// own prior turn even in busy threads where the recent-message window would +/// otherwise push it out. async fn fetch_thread_context( channel_id: Uuid, root_event_id: &str, limit: u32, + agent_pubkey: nostr::PublicKey, rest: &RestClient, ) -> Option { + fetch_thread_context_with( + channel_id, + root_event_id, + limit, + agent_pubkey, + |filters| async move { rest.query(&filters).await }, + |filters| async move { rest.count(&filters).await }, + ) + .await +} + +async fn fetch_thread_context_with( + channel_id: Uuid, + root_event_id: &str, + limit: u32, + agent_pubkey: nostr::PublicKey, + query: Query, + count: Count, +) -> Option +where + Query: Fn(Vec) -> QueryFut, + QueryFut: std::future::Future>, + Count: Fn(Vec) -> CountFut, + CountFut: std::future::Future>, +{ use nostr::{Alphabet, SingleLetterTag}; // Defense-in-depth: validate hex event ID. @@ -2786,7 +2833,8 @@ async fn fetch_thread_context( let h_tag = SingleLetterTag::lowercase(Alphabet::H); let ch_str = channel_id.to_string(); - // Two filters: (1) root event by ID, (2) replies with #e=root + #h=channel. + // Three filters: (1) root event by ID, (2) recent replies with #e=root + + // #h=channel plus a sentinel, and (3) the agent's newest reply for pinning. let root_filter = nostr::Filter::new().id(nostr::EventId::from_hex(root_event_id).ok()?); let replies_filter = nostr::Filter::new() .kinds([ @@ -2795,16 +2843,23 @@ async fn fetch_thread_context( ]) .custom_tags(e_tag, [root_event_id]) .custom_tags(h_tag, [ch_str.as_str()]) - .limit(limit as usize); + .limit(limit.saturating_add(1) as usize); + let agent_reply_filter = replies_filter.clone().author(agent_pubkey).limit(1); - fetch_with_retry(|| async { + let context = fetch_with_retry(|| async { match timeout( CONTEXT_FETCH_TIMEOUT, - rest.query(&[root_filter.clone(), replies_filter.clone()]), + query(vec![ + root_filter.clone(), + replies_filter.clone(), + agent_reply_filter.clone(), + ]), ) .await { - Ok(Ok(json)) => parse_nostr_thread_response(json, root_event_id), + Ok(Ok(json)) => { + parse_nostr_thread_response_with_meta(json, root_event_id, limit, &agent_pubkey) + } Ok(Err(e)) => { tracing::warn!( channel_id = %channel_id, @@ -2823,7 +2878,75 @@ async fn fetch_thread_context( } } }) - .await + .await; + + let mut parsed = context?; + + if matches!( + parsed.context, + ConversationContext::Thread { + truncated: true, + .. + } + ) { + let replies_count_filter = replies_filter.clone().limit(0); + if let Some(total) = fetch_thread_total( + channel_id, + &replies_count_filter, + parsed.root_present, + &count, + ) + .await + { + if let ConversationContext::Thread { + total: context_total, + .. + } = &mut parsed.context + { + let sentinel_minimum = *context_total; + // `/count` is a separate best-effort request after the message + // query. If replies are deleted between the two, the exact count + // can fall below the already-proven sentinel minimum; never + // render impossible labels like `13 of 12 messages, truncated`. + *context_total = total.max(sentinel_minimum); + } + } + } + + Some(parsed.context) +} + +/// Best-effort exact thread size for truncated context labels. +async fn fetch_thread_total( + channel_id: Uuid, + replies_filter: &nostr::Filter, + root_present: bool, + count: &Count, +) -> Option +where + Count: Fn(Vec) -> CountFut, + CountFut: std::future::Future>, +{ + let replies_count = + match timeout(CONTEXT_COUNT_TIMEOUT, count(vec![replies_filter.clone()])).await { + Ok(Ok(json)) => json.get("count").and_then(|v| v.as_u64())?, + Ok(Err(e)) => { + tracing::debug!( + channel_id = %channel_id, + "thread context count failed; using sentinel minimum: {e}" + ); + return None; + } + Err(_) => { + tracing::debug!( + channel_id = %channel_id, + "thread context count timed out; using sentinel minimum" + ); + return None; + } + }; + + Some(replies_count as usize + usize::from(root_present)) } /// Fetch DM context via Nostr query: recent messages in channel by `#h` tag. @@ -2976,48 +3099,110 @@ fn json_to_context_message(obj: &serde_json::Value) -> Option { /// Parse a Nostr query response (array of events) into thread context. /// -/// Separates the root event (matching `root_event_id`) from replies, sorts -/// chronologically by `created_at`. +/// Separates the root event (matching `root_event_id`) from replies, keeps the +/// newest `limit` replies returned by the sentinel query, then sorts the +/// displayed window chronologically for the prompt. If the agent's newest reply +/// is outside that window, keep it instead of the oldest displayed reply so the +/// next prompt always includes the agent's most recent prior turn. +#[cfg(test)] fn parse_nostr_thread_response( json: serde_json::Value, root_event_id: &str, + limit: u32, + agent_pubkey: &nostr::PublicKey, ) -> Option { + parse_nostr_thread_response_with_meta(json, root_event_id, limit, agent_pubkey) + .map(|parsed| parsed.context) +} + +struct ParsedThreadContext { + context: ConversationContext, + root_present: bool, +} + +fn parse_nostr_thread_response_with_meta( + json: serde_json::Value, + root_event_id: &str, + limit: u32, + agent_pubkey: &nostr::PublicKey, +) -> Option { let events = json.as_array()?; + let agent_pubkey_hex = agent_pubkey.to_hex(); let mut root_msg = None; let mut reply_msgs = Vec::new(); + let mut seen_reply_ids = HashSet::new(); for ev in events { let ev_id = ev.get("id").and_then(|v| v.as_str()).unwrap_or(""); if let Some(msg) = json_to_context_message(ev) { if ev_id == root_event_id { root_msg = Some(msg); - } else { + } else if seen_reply_ids.insert(ev_id.to_string()) { + let is_agent = msg.pubkey.eq_ignore_ascii_case(&agent_pubkey_hex); reply_msgs.push(( + ev_id.to_string(), ev.get("created_at").and_then(|v| v.as_u64()).unwrap_or(0), + is_agent, msg, )); } } } - // Sort replies chronologically. - reply_msgs.sort_by_key(|(ts, _)| *ts); + let root_present = root_msg.is_some(); + let fetched_total = reply_msgs.len() + usize::from(root_present); + let newest_agent_reply = reply_msgs + .iter() + .filter(|(_, _, is_agent, _)| *is_agent) + .max_by_key(|(_, ts, _, _)| *ts) + .cloned(); + + let truncated = reply_msgs.len() > limit as usize; + if truncated { + // The relay returns limited REQ results newest-first. Sort explicitly so + // the sentinel we drop is the oldest reply in the fetched window, not an + // arbitrary last element if the HTTP bridge ever changes iteration order. + reply_msgs.sort_by_key(|(_, ts, _, _)| Reverse(*ts)); + reply_msgs.truncate(limit as usize); + } + + if let Some(agent_reply) = newest_agent_reply { + let agent_reply_already_displayed = + reply_msgs.iter().any(|(id, _, _, _)| *id == agent_reply.0); + if !agent_reply_already_displayed { + reply_msgs.sort_by_key(|(_, ts, _, _)| *ts); + if let Some(oldest) = reply_msgs.first_mut() { + *oldest = agent_reply; + } + } + } + + // Sort displayed replies chronologically. + reply_msgs.sort_by_key(|(_, ts, _, _)| *ts); let mut messages = Vec::new(); if let Some(root) = root_msg { messages.push(root); } - messages.extend(reply_msgs.into_iter().map(|(_, msg)| msg)); + messages.extend(reply_msgs.into_iter().map(|(_, _, _, msg)| msg)); - let total = messages.len(); if messages.is_empty() { return None; } - Some(ConversationContext::Thread { - messages, - total, - truncated: false, // query returns all within limit + let total = if truncated { + fetched_total // all distinct fetched replies plus the root are proven visible history + } else { + messages.len() + }; + + Some(ParsedThreadContext { + context: ConversationContext::Thread { + messages, + total, + truncated, + }, + root_present, }) } @@ -4204,6 +4389,572 @@ mod tests { assert!(parse_dm_response(json, 12).is_none()); } + #[test] + fn test_parse_nostr_thread_response_marks_query_window_truncated() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let agent_hex = agent.public_key().to_hex(); + let json = json!([ + { + "id": root_id, + "pubkey": "rootpub", + "content": "root", + "created_at": 1000 + }, + { + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "pubkey": agent_hex, + "content": "newest agent reply", + "created_at": 4000 + }, + { + "id": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "pubkey": "humanpub", + "content": "middle reply", + "created_at": 3000 + }, + { + "id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "pubkey": "oldpub", + "content": "sentinel omitted reply", + "created_at": 2000 + } + ]); + + let ctx = parse_nostr_thread_response(json, root_id, 2, &agent.public_key()) + .expect("should parse"); + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert_eq!(messages.len(), 3); // root + 2 displayed replies + assert_eq!(total, 4); // root + displayed replies + sentinel + assert!(truncated); + assert_eq!(messages[0].content, "root"); + assert_eq!(messages[1].content, "middle reply"); + assert_eq!(messages[2].content, "newest agent reply"); + assert!(messages + .iter() + .all(|msg| msg.content != "sentinel omitted reply")); + } + _ => panic!("expected Thread context"), + } + } + + #[test] + fn test_parse_nostr_thread_response_not_truncated_below_limit() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let json = json!([ + { + "id": root_id, + "pubkey": "rootpub", + "content": "root", + "created_at": 1000 + }, + { + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "pubkey": "replypub", + "content": "reply", + "created_at": 2000 + } + ]); + + let ctx = parse_nostr_thread_response(json, root_id, 2, &agent.public_key()) + .expect("should parse"); + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert_eq!(messages.len(), 2); + assert_eq!(total, 2); + assert!(!truncated); + } + _ => panic!("expected Thread context"), + } + } + + #[test] + fn test_parse_nostr_thread_response_keeps_agent_reply_outside_recent_window() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let agent_hex = agent.public_key().to_hex(); + let json = json!([ + { + "id": root_id, + "pubkey": "rootpub", + "content": "root", + "created_at": 1000 + }, + { + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "pubkey": "humanpub", + "content": "newer human reply", + "created_at": 5000 + }, + { + "id": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "pubkey": "humanpub", + "content": "middle human reply", + "created_at": 4000 + }, + { + "id": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "pubkey": "humanpub", + "content": "oldest displayed reply without agent pin", + "created_at": 3000 + }, + { + "id": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", + "pubkey": agent_hex, + "content": "agent reply outside recent window", + "created_at": 2000 + } + ]); + + let ctx = parse_nostr_thread_response(json, root_id, 2, &agent.public_key()) + .expect("should parse"); + match ctx { + ConversationContext::Thread { messages, .. } => { + assert_eq!(messages.len(), 3); // root + 2 displayed replies + assert_eq!(messages[0].content, "root"); + assert!(messages + .iter() + .any(|msg| msg.content == "agent reply outside recent window")); + assert!(messages + .iter() + .any(|msg| msg.content == "newer human reply")); + assert!(messages + .iter() + .all(|msg| msg.content != "middle human reply")); + assert!(messages + .iter() + .all(|msg| msg.content != "oldest displayed reply without agent pin")); + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_uses_exact_count_when_above_sentinel_minimum() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let agent_pubkey = agent.public_key(); + let json = json!([ + thread_event(root_id, "rootpub", "root", 1000), + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newest reply", + 4000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle reply", + 3000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "humanpub", + "sentinel reply", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent_pubkey, + move |filters| { + assert_thread_query_filters(&filters, channel_id, root_id, agent_pubkey, 3); + std::future::ready(Ok(json.clone())) + }, + move |filters| { + assert_thread_count_filter(&filters, channel_id, root_id); + std::future::ready(Ok(json!({ "count": 6 }))) + }, + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(messages.len(), 3); + assert_eq!(total, 7); // 6 replies + root + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_does_not_add_missing_root_to_exact_count() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let json = json!([ + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newest reply", + 4000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle reply", + 3000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "humanpub", + "sentinel reply", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent.public_key(), + move |_filters| std::future::ready(Ok(json.clone())), + |_filters| std::future::ready(Ok(json!({ "count": 6 }))), + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(messages.len(), 2); + assert_eq!(total, 6); + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_clamps_count_below_sentinel_minimum() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let json = json!([ + thread_event(root_id, "rootpub", "root", 1000), + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newest reply", + 4000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle reply", + 3000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "humanpub", + "sentinel reply", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent.public_key(), + move |_filters| std::future::ready(Ok(json.clone())), + |_filters| std::future::ready(Ok(json!({ "count": 1 }))), + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(messages.len(), 3); + assert_eq!(total, 4); // root + displayed replies + sentinel minimum + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_preserves_sentinel_minimum_when_count_fails() { + let agent = Keys::generate(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let json = json!([ + thread_event(root_id, "rootpub", "root", 1000), + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newest reply", + 4000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle reply", + 3000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "humanpub", + "sentinel reply", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent.public_key(), + move |_filters| std::future::ready(Ok(json.clone())), + |_filters| std::future::ready(Err(crate::relay::RelayError::Http("boom".into()))), + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(messages.len(), 3); + assert_eq!(total, 4); // count failure leaves parser's sentinel minimum intact + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_deduplicates_and_pins_agent_reply() { + let agent = Keys::generate(); + let agent_hex = agent.public_key().to_hex(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let json = json!([ + thread_event(root_id, "rootpub", "root", 1000), + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newer human reply", + 5000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle human reply", + 4000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + &agent_hex, + "agent reply outside recent window", + 2000 + ), + // Same event as the separately fetched author-filtered result; the + // parser should deduplicate it before pinning. + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + &agent_hex, + "agent reply outside recent window", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent.public_key(), + move |_filters| std::future::ready(Ok(json.clone())), + |_filters| std::future::ready(Ok(json!({ "count": 3 }))), + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(total, 4); + assert_eq!(messages.len(), 3); + assert_eq!( + messages + .iter() + .filter(|msg| msg.content == "agent reply outside recent window") + .count(), + 1, + "separate agent-reply query must not duplicate the same event" + ); + assert!(messages + .iter() + .any(|msg| msg.content == "newer human reply")); + assert!(messages + .iter() + .all(|msg| msg.content != "middle human reply")); + } + _ => panic!("expected Thread context"), + } + } + + #[tokio::test] + async fn test_fetch_thread_context_uses_distinct_fetched_replies_as_minimum() { + let agent = Keys::generate(); + let agent_hex = agent.public_key().to_hex(); + let root_id = "1111111111111111111111111111111111111111111111111111111111111111"; + let channel_id = Uuid::new_v4(); + let json = json!([ + thread_event(root_id, "rootpub", "root", 1000), + thread_event( + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "humanpub", + "newest human reply", + 5000 + ), + thread_event( + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "humanpub", + "middle human reply", + 4000 + ), + thread_event( + "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "humanpub", + "sentinel human reply", + 3000 + ), + thread_event( + "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", + &agent_hex, + "older distinct agent reply", + 2000 + ) + ]); + + let ctx = fetch_thread_context_with( + channel_id, + root_id, + 2, + agent.public_key(), + move |_filters| std::future::ready(Ok(json.clone())), + |_filters| std::future::ready(Err(crate::relay::RelayError::Http("boom".into()))), + ) + .await + .expect("thread context"); + + match ctx { + ConversationContext::Thread { + messages, + total, + truncated, + } => { + assert!(truncated); + assert_eq!(messages.len(), 3); + assert_eq!( + total, 5, + "root plus all four distinct fetched replies prove the lower bound" + ); + assert!(messages + .iter() + .any(|msg| msg.content == "older distinct agent reply")); + assert!(messages + .iter() + .any(|msg| msg.content == "newest human reply")); + assert!(messages + .iter() + .all(|msg| msg.content != "middle human reply")); + assert!(messages + .iter() + .all(|msg| msg.content != "sentinel human reply")); + } + _ => panic!("expected Thread context"), + } + } + + fn assert_thread_query_filters( + filters: &[nostr::Filter], + channel_id: Uuid, + root_id: &str, + agent_pubkey: nostr::PublicKey, + reply_limit: u64, + ) { + assert_eq!( + filters.len(), + 3, + "root, recent replies, and agent reply filters" + ); + + let root = serde_json::to_value(&filters[0]).expect("serialize root filter"); + assert_eq!(root.get("ids"), Some(&json!([root_id]))); + assert!(root.get("limit").is_none()); + + let replies = serde_json::to_value(&filters[1]).expect("serialize replies filter"); + assert_eq!(replies.get("kinds"), Some(&json!([9, 40002]))); + assert_eq!(replies.get("#e"), Some(&json!([root_id]))); + assert_eq!(replies.get("#h"), Some(&json!([channel_id.to_string()]))); + assert_eq!(replies.get("limit"), Some(&json!(reply_limit))); + assert!(replies.get("authors").is_none()); + + let agent = serde_json::to_value(&filters[2]).expect("serialize agent filter"); + assert_eq!(agent.get("kinds"), Some(&json!([9, 40002]))); + assert_eq!(agent.get("#e"), Some(&json!([root_id]))); + assert_eq!(agent.get("#h"), Some(&json!([channel_id.to_string()]))); + assert_eq!(agent.get("authors"), Some(&json!([agent_pubkey.to_hex()]))); + assert_eq!(agent.get("limit"), Some(&json!(1))); + } + + fn assert_thread_count_filter(filters: &[nostr::Filter], channel_id: Uuid, root_id: &str) { + assert_eq!(filters.len(), 1, "count should query only matching replies"); + + let count = serde_json::to_value(&filters[0]).expect("serialize count filter"); + assert_eq!(count.get("kinds"), Some(&json!([9, 40002]))); + assert_eq!(count.get("#e"), Some(&json!([root_id]))); + assert_eq!(count.get("#h"), Some(&json!([channel_id.to_string()]))); + assert_eq!(count.get("limit"), Some(&json!(0))); + assert!(count.get("ids").is_none()); + assert!(count.get("authors").is_none()); + } + + fn thread_event(id: &str, pubkey: &str, content: &str, created_at: u64) -> serde_json::Value { + json!({ + "id": id, + "pubkey": pubkey, + "content": content, + "created_at": created_at + }) + } + #[test] fn test_json_to_context_message_integer_timestamp() { let obj = json!({ diff --git a/crates/buzz-acp/src/relay.rs b/crates/buzz-acp/src/relay.rs index c8312cc61e..aea5cee077 100644 --- a/crates/buzz-acp/src/relay.rs +++ b/crates/buzz-acp/src/relay.rs @@ -405,6 +405,19 @@ impl RestClient { .map_err(|e| RelayError::Http(e.to_string())) } + /// Count events via the HTTP bridge: `POST /count` with NIP-98 auth. + /// + /// Accepts a slice of `nostr::Filter` (serialized as JSON array). + /// Returns the bridge response as a `serde_json::Value` (usually `{ "count": n }`). + pub async fn count(&self, filters: &[nostr::Filter]) -> Result { + let body_bytes = serde_json::to_vec(filters) + .map_err(|e| RelayError::Http(format!("filter serialize error: {e}")))?; + let resp = self.bridge_post("/count", &body_bytes).await?; + resp.json() + .await + .map_err(|e| RelayError::Http(e.to_string())) + } + /// Submit a signed event via the HTTP bridge: `POST /events` with NIP-98 auth. /// /// The event must already be signed. Returns the relay response JSON. From 61b96c9828d1dd54106b570d87a54edbc92bb9c4 Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 30 Jul 2026 10:54:13 -0600 Subject: [PATCH 077/112] fix(catalog): update Amp description (#3758) ## Summary - replace Amp's outdated Sourcegraph attribution in the runtime catalog - describe Amp neutrally as a coding agent for the terminal and editor ## Verification - `pnpm test` (desktop: 3,819 passed) - `pnpm typecheck` - pre-push `desktop-check`, `desktop-test`, and `branch-skew` hooks Signed-off-by: Wes Co-authored-by: Carl --- desktop/src/features/settings/ui/harnessCatalogCopy.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/desktop/src/features/settings/ui/harnessCatalogCopy.ts b/desktop/src/features/settings/ui/harnessCatalogCopy.ts index 79c55f0148..70439091b2 100644 --- a/desktop/src/features/settings/ui/harnessCatalogCopy.ts +++ b/desktop/src/features/settings/ui/harnessCatalogCopy.ts @@ -36,7 +36,7 @@ const HARNESS_DESCRIPTIONS: Record = { // https://moonshotai.github.io/kimi-cli/en/ kimi: "A terminal coding agent for software development and command-line tasks.", // Sources: https://ampcode.com, https://ampcode.com/manual - amp: "A coding agent from Sourcegraph.", + amp: "A coding agent for your terminal and editor.", // Sources: https://github.com/NousResearch/hermes-agent, // https://hermes-agent.nousresearch.com/docs/ hermes: "A general-purpose AI agent from Nous Research.", From 06582ee6f09e5f7454e4d8895d80a45c3cdb5e8a Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Thu, 30 Jul 2026 18:02:48 +0100 Subject: [PATCH 078/112] Render mobile agent mention chips (#3702) ## Summary - Render selected agent mentions as visible bot chips in the mobile composer. - Recognize agent profiles consistently when rendering message-body mentions. Screenshot 2026-07-30 at 07 54 16 ## Validation - `flutter test test/features/channels/compose_bar_test.dart test/features/channels/message_content_test.dart` - `flutter analyze` --------- Signed-off-by: kenny lopez --- .../lib/features/activity/activity_page.dart | 14 +- .../activity/activity_page/inbox_row.dart | 24 ++ .../agent_activity/working_bots_provider.dart | 31 +- .../channels/channel_detail_page.dart | 2 +- .../channel_detail_page/message_bubble.dart | 18 +- .../channels/channel_management_provider.dart | 10 +- .../channels/channel_messages_provider.dart | 12 - mobile/lib/features/channels/compose_bar.dart | 12 + .../compose_bar/agent_mention_labels.dart | 10 + .../markdown_editing_controller.dart | 159 +++++++++- .../channels/mentions/mention_candidates.dart | 53 +--- .../mentions/mention_candidates_provider.dart | 59 +--- .../features/channels/message_content.dart | 65 +++-- .../features/channels/thread_detail_page.dart | 18 +- .../lib/features/forum/forum_post_card.dart | 48 ++- .../lib/features/forum/forum_thread_page.dart | 47 ++- mobile/lib/features/search/search_page.dart | 43 ++- .../mentions/agent_identity_provider.dart | 274 ++++++++++++++++++ mobile/lib/shared/mentions/mention_tags.dart | 6 + .../channels/channel_detail_page_test.dart | 4 + .../features/channels/compose_bar_test.dart | 72 ++++- .../mentions/mention_candidates_test.dart | 15 + .../channels/message_content_test.dart | 37 +++ .../features/search/search_page_test.dart | 74 ++++- .../agent_identity_provider_test.dart | 228 +++++++++++++++ 25 files changed, 1140 insertions(+), 195 deletions(-) create mode 100644 mobile/lib/features/channels/compose_bar/agent_mention_labels.dart create mode 100644 mobile/lib/shared/mentions/agent_identity_provider.dart create mode 100644 mobile/lib/shared/mentions/mention_tags.dart create mode 100644 mobile/test/shared/mentions/agent_identity_provider_test.dart diff --git a/mobile/lib/features/activity/activity_page.dart b/mobile/lib/features/activity/activity_page.dart index db39850481..aecef6329c 100644 --- a/mobile/lib/features/activity/activity_page.dart +++ b/mobile/lib/features/activity/activity_page.dart @@ -5,6 +5,8 @@ import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; +import '../../shared/mentions/mention_tags.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/utils/string_utils.dart'; @@ -87,8 +89,16 @@ class ActivityPage extends HookConsumerWidget { ]; // Preload sender profiles for visible rows. - final pubkeys = visibleItems.map((i) => i.item.pubkey).toSet().toList(); - ref.read(userCacheProvider.notifier).preload(pubkeys); + final preloadPubkeys = { + for (final item in visibleItems) item.item.pubkey.toLowerCase(), + for (final item in visibleItems) + ...mentionedPubkeysFromTags(item.item.tags), + }.toList()..sort(); + final preloadPubkeysKey = preloadPubkeys.join('\u0000'); + useEffect(() { + ref.read(userCacheProvider.notifier).preload(preloadPubkeys); + return null; + }, [preloadPubkeysKey]); final unreadVisibleCount = visibleItems.where((i) => !isDone(i)).length; diff --git a/mobile/lib/features/activity/activity_page/inbox_row.dart b/mobile/lib/features/activity/activity_page/inbox_row.dart index fb267c03be..9dd8b6ddfa 100644 --- a/mobile/lib/features/activity/activity_page/inbox_row.dart +++ b/mobile/lib/features/activity/activity_page/inbox_row.dart @@ -61,6 +61,28 @@ class _InboxRow extends ConsumerWidget { final userCache = ref.watch(userCacheProvider); final profile = userCache[item.item.pubkey.toLowerCase()]; final senderLabel = profile?.displayName ?? shortPubkey(item.item.pubkey); + final profileMentionNames = { + for (final pubkey in mentionedPubkeysFromTags(item.item.tags)) + if (userCache[pubkey]?.displayName?.trim().isNotEmpty == true) + pubkey: userCache[pubkey]!.displayName!.trim(), + }; + final mentionPubkeys = mentionedPubkeysFromTags(item.item.tags); + final knownAgentPubkeys = channel == null + ? ref.watch(knownAgentPubkeysProvider) + : ref.watch(agentMentionPubkeysProvider(channel!.id)); + final agentMentionPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: knownAgentPubkeys, + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], + ); + final mentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: mentionPubkeys, + profileMentionNames: profileMentionNames, + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); final isDm = channel?.isDm ?? false; final channelName = channel != null && !isDm @@ -172,6 +194,8 @@ class _InboxRow extends ConsumerWidget { // Message preview. MessageContent( content: item.item.displayContent, + mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, tags: item.item.tags, maxLines: 2, baseStyle: activityPreviewTextStyle.copyWith( diff --git a/mobile/lib/features/channels/agent_activity/working_bots_provider.dart b/mobile/lib/features/channels/agent_activity/working_bots_provider.dart index 179ea0d4f3..8730908ada 100644 --- a/mobile/lib/features/channels/agent_activity/working_bots_provider.dart +++ b/mobile/lib/features/channels/agent_activity/working_bots_provider.dart @@ -8,21 +8,20 @@ import '../channel_typing_provider.dart'; /// /// Used by both the members button badge and the members sheet to avoid /// duplicating the bot-typing cross-reference logic. -final workingBotPubkeysProvider = Provider.family, String>(( - ref, - channelId, -) { - final typingEntries = ref.watch(channelTypingProvider(channelId)); - final membersAsync = ref.watch(channelMembersProvider(channelId)); - final allMembers = membersAsync.asData?.value ?? const []; +final workingBotPubkeysProvider = Provider.autoDispose + .family, String>((ref, channelId) { + final typingEntries = ref.watch(channelTypingProvider(channelId)); + final membersAsync = ref.watch(channelMembersProvider(channelId)); + final allMembers = membersAsync.asData?.value ?? const []; - final botPubkeys = { - for (final m in allMembers) - if (m.isBot) m.pubkey.toLowerCase(), - }; + final botPubkeys = { + for (final m in allMembers) + if (m.isBot) m.pubkey.toLowerCase(), + }; - return { - for (final e in typingEntries) - if (botPubkeys.contains(e.pubkey.toLowerCase())) e.pubkey.toLowerCase(), - }; -}); + return { + for (final e in typingEntries) + if (botPubkeys.contains(e.pubkey.toLowerCase())) + e.pubkey.toLowerCase(), + }; + }); diff --git a/mobile/lib/features/channels/channel_detail_page.dart b/mobile/lib/features/channels/channel_detail_page.dart index 7abeed8d7a..044342d101 100644 --- a/mobile/lib/features/channels/channel_detail_page.dart +++ b/mobile/lib/features/channels/channel_detail_page.dart @@ -8,6 +8,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; import 'package:scrollable_positioned_list/scrollable_positioned_list.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; @@ -39,7 +40,6 @@ import 'manage_channel_sheet.dart'; import 'members_sheet.dart'; import 'message_actions.dart'; import 'message_content.dart'; -import 'mentions/mention_candidates_provider.dart'; import 'read_state/deferred_read_state_update.dart'; import 'read_state/read_state_provider.dart'; import 'read_state/read_state_time.dart'; diff --git a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart index fcabfd619a..cb6ab67065 100644 --- a/mobile/lib/features/channels/channel_detail_page/message_bubble.dart +++ b/mobile/lib/features/channels/channel_detail_page/message_bubble.dart @@ -36,8 +36,14 @@ class _MessageBubble extends ConsumerWidget { // Build mention names map from event p-tags. final userCache = ref.watch(userCacheProvider); - final knownAgentPubkeys = ref.watch( - mentionAgentPubkeysProvider(currentChannelId), + final knownAgentPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: ref.watch( + agentMentionPubkeysProvider(currentChannelId), + ), + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], ); final mentionNames = {}; final agentMentionPubkeys = {}; @@ -51,6 +57,12 @@ class _MessageBubble extends ConsumerWidget { agentMentionPubkeys.add(normalizedPubkey); } } + final resolvedMentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: message.mentionPubkeys, + profileMentionNames: mentionNames, + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); return Padding( padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0), @@ -166,7 +178,7 @@ class _MessageBubble extends ConsumerWidget { ), MessageContent( content: message.content, - mentionNames: mentionNames, + mentionNames: resolvedMentionNames, agentMentionPubkeys: agentMentionPubkeys, channelNames: channelNames, tags: message.tags, diff --git a/mobile/lib/features/channels/channel_management_provider.dart b/mobile/lib/features/channels/channel_management_provider.dart index 9a72054a2b..b990194d15 100644 --- a/mobile/lib/features/channels/channel_management_provider.dart +++ b/mobile/lib/features/channels/channel_management_provider.dart @@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import '../../shared/auth/auth.dart'; import '../../shared/custom_emoji/custom_emoji.dart'; import '../../shared/custom_emoji/custom_emoji_provider.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/relay/relay.dart'; import '../profile/profile_provider.dart'; import 'channel.dart'; @@ -392,8 +393,9 @@ final channelDetailsProvider = FutureProvider.family(( }); /// Channel members from kind:39002 NIP-29 members event. -final channelMembersProvider = - FutureProvider.family, String>((ref, channelId) async { +final channelMembersProvider = FutureProvider.autoDispose + .family, String>((ref, channelId) async { + ref.watch(channelMembershipUpdateProvider(channelId)); final session = ref.watch(relaySessionProvider.notifier); final events = await session.fetchHistory( NostrFilters.channelMembers(channelId), @@ -557,6 +559,7 @@ class ChannelActions { ); } _ref.invalidate(channelMembersProvider(channelId)); + _ref.invalidate(channelBotPubkeysProvider(channelId)); } Future joinChannel(String channelId) async { @@ -626,6 +629,7 @@ class ChannelActions { await _ref.read(channelsProvider.notifier).refresh(); _ref.invalidate(channelDetailsProvider(channelId)); _ref.invalidate(channelMembersProvider(channelId)); + _ref.invalidate(channelBotPubkeysProvider(channelId)); _ref.invalidate(channelCanvasProvider(channelId)); } @@ -659,6 +663,7 @@ class ChannelActions { ], ); _ref.invalidate(channelMembersProvider(channelId)); + _ref.invalidate(channelBotPubkeysProvider(channelId)); } Future removeMember({ @@ -674,6 +679,7 @@ class ChannelActions { ], ); _ref.invalidate(channelMembersProvider(channelId)); + _ref.invalidate(channelBotPubkeysProvider(channelId)); } Future addReaction(String eventId, String emoji) async { diff --git a/mobile/lib/features/channels/channel_messages_provider.dart b/mobile/lib/features/channels/channel_messages_provider.dart index c03087a85d..fbcbca8956 100644 --- a/mobile/lib/features/channels/channel_messages_provider.dart +++ b/mobile/lib/features/channels/channel_messages_provider.dart @@ -2,7 +2,6 @@ import 'package:flutter/foundation.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import '../../shared/relay/relay.dart'; -import 'channel_management_provider.dart'; import 'pending_local_messages_provider.dart'; import 'channel_window.dart'; import 'thread_replies_provider.dart'; @@ -222,11 +221,6 @@ class ChannelMessagesNotifier extends Notifier>> { _lastKnownMessages = merged; state = AsyncData(merged); } - - if (event.kind == EventKind.systemMessage && - _isMembershipEvent(event.content)) { - ref.invalidate(channelMembersProvider(channelId)); - } } void _handleWindowLiveEvent(NostrEvent event) { @@ -288,12 +282,6 @@ class ChannelMessagesNotifier extends Notifier>> { .confirm(eventIds); } - static bool _isMembershipEvent(String content) { - return content.contains('member_joined') || - content.contains('member_left') || - content.contains('member_removed'); - } - /// Adds a just-signed outgoing message before the relay acknowledges it. /// The live relay echo is deduplicated by event id. void addLocalMessage(NostrEvent event) { diff --git a/mobile/lib/features/channels/compose_bar.dart b/mobile/lib/features/channels/compose_bar.dart index 1a9a02e409..7560f998f3 100644 --- a/mobile/lib/features/channels/compose_bar.dart +++ b/mobile/lib/features/channels/compose_bar.dart @@ -15,6 +15,7 @@ import 'package:lucide_icons_flutter/lucide_icons.dart'; import 'package:nostr/nostr.dart' as nostr; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; @@ -36,6 +37,7 @@ import 'mentions/mention_ranking.dart'; import 'photo_library.dart'; part 'compose_bar/helpers.dart'; +part 'compose_bar/agent_mention_labels.dart'; part 'compose_bar/markdown_editing_controller.dart'; part 'compose_bar/suggestions.dart'; part 'compose_bar/formatting_toolbar.dart'; @@ -231,6 +233,16 @@ class ComposeBar extends HookConsumerWidget { // owners so @mention suggestions show names ("managed by …" included). final relayAgents = ref.watch(agentDirectoryProvider).asData?.value; final agentOwners = ref.watch(agentOwnersProvider).asData?.value; + final agentMentionLabels = _agentMentionLabels( + candidates: mentionMap.value.values, + ); + final agentMentionLabelsKey = (agentMentionLabels.toList()..sort()).join( + '\u0000', + ); + useEffect(() { + controller.setAgentMentionNames(agentMentionLabels); + return null; + }, [controller, agentMentionLabelsKey]); useEffect( () { final memberList = membersAsync.asData?.value ?? []; diff --git a/mobile/lib/features/channels/compose_bar/agent_mention_labels.dart b/mobile/lib/features/channels/compose_bar/agent_mention_labels.dart new file mode 100644 index 0000000000..bc29d5bb46 --- /dev/null +++ b/mobile/lib/features/channels/compose_bar/agent_mention_labels.dart @@ -0,0 +1,10 @@ +part of '../compose_bar.dart'; + +Set _agentMentionLabels({ + required Iterable candidates, +}) { + return { + for (final candidate in candidates) + if (candidate.isAgent) candidate.label, + }; +} diff --git a/mobile/lib/features/channels/compose_bar/markdown_editing_controller.dart b/mobile/lib/features/channels/compose_bar/markdown_editing_controller.dart index 29e22a8ca9..bbca57037a 100644 --- a/mobile/lib/features/channels/compose_bar/markdown_editing_controller.dart +++ b/mobile/lib/features/channels/compose_bar/markdown_editing_controller.dart @@ -15,6 +15,8 @@ class _MarkdownRule { } class _MarkdownEditingController extends TextEditingController { + final Set _agentMentionNames = {}; + static final _rules = [ _MarkdownRule( r'```(?:\r?\n)?([\s\S]*?)(?:\r?\n)?```', @@ -31,6 +33,21 @@ class _MarkdownEditingController extends TextEditingController { _MarkdownRule(r'_([^_\n]*?)_', _MarkdownStyle.italic), ]; + /// Updates the known agent labels which should render as agent mention + /// chips. The editor still stores the literal `@Name` text, matching the + /// markdown sent to the relay. + void setAgentMentionNames(Iterable names) { + final next = { + for (final name in names) + if (name.trim().isNotEmpty) name.trim().toLowerCase(), + }; + if (setEquals(_agentMentionNames, next)) return; + _agentMentionNames + ..clear() + ..addAll(next); + notifyListeners(); + } + @override TextSpan buildTextSpan({ required BuildContext context, @@ -81,6 +98,7 @@ class _MarkdownEditingController extends TextEditingController { if (nextRule == null || nextMatch == null) { spans.addAll( _buildTextSpans( + context, source.substring(offset), inheritedStyle, sourceOffset + offset, @@ -93,6 +111,7 @@ class _MarkdownEditingController extends TextEditingController { if (nextMatch.start > 0) { spans.addAll( _buildTextSpans( + context, tail.substring(0, nextMatch.start), inheritedStyle, sourceOffset + offset, @@ -129,10 +148,12 @@ class _MarkdownEditingController extends TextEditingController { } else { spans.addAll( _buildTextSpans( + context, content, contentStyle, matchOffset + contentStart, composingRange, + renderAgentMentions: false, ), ); } @@ -150,11 +171,18 @@ class _MarkdownEditingController extends TextEditingController { } List _buildTextSpans( + BuildContext context, String source, TextStyle style, int sourceOffset, - TextRange composingRange, - ) { + TextRange composingRange, { + bool renderAgentMentions = true, + }) { + List buildTextSegment(String text, TextStyle segmentStyle) => + renderAgentMentions + ? _buildAgentMentionSpans(context, text, segmentStyle) + : [TextSpan(text: text, style: segmentStyle)]; + if (source.isEmpty) return const []; final localStart = (composingRange.start - sourceOffset) .clamp(0, source.length) @@ -165,7 +193,7 @@ class _MarkdownEditingController extends TextEditingController { if (!composingRange.isValid || composingRange.isCollapsed || localStart >= localEnd) { - return [TextSpan(text: source, style: style)]; + return buildTextSegment(source, style); } final composingDecorations = [ @@ -178,16 +206,80 @@ class _MarkdownEditingController extends TextEditingController { ); return [ if (localStart > 0) - TextSpan(text: source.substring(0, localStart), style: style), + ...buildTextSegment(source.substring(0, localStart), style), TextSpan( text: source.substring(localStart, localEnd), style: composingStyle, ), if (localEnd < source.length) - TextSpan(text: source.substring(localEnd), style: style), + ...buildTextSegment(source.substring(localEnd), style), ]; } + List _buildAgentMentionSpans( + BuildContext context, + String source, + TextStyle style, + ) { + if (_agentMentionNames.isEmpty) { + return [TextSpan(text: source, style: style)]; + } + + final escapedNames = _agentMentionNames.toList() + ..sort((a, b) => b.length.compareTo(a.length)); + final expression = RegExp( + r'(^|\s)@(' + + escapedNames.map(RegExp.escape).join('|') + + r')(?=\s|[,.!?:;)\]}*_]|$)', + caseSensitive: false, + multiLine: true, + ); + final spans = []; + var offset = 0; + for (final match in expression.allMatches(source)) { + final prefix = match.group(1)!; + if (match.start > offset) { + spans.add( + TextSpan(text: source.substring(offset, match.start), style: style), + ); + } + if (prefix.isNotEmpty) spans.add(TextSpan(text: prefix, style: style)); + + final label = match.group(2)!; + spans.add( + WidgetSpan( + alignment: PlaceholderAlignment.baseline, + baseline: TextBaseline.alphabetic, + child: _ComposerAgentMentionChip(label: label, textStyle: style), + ), + ); + // The visual chip replaces the `@` placeholder. Keep the label as + // invisible source text so the text span still has one character per + // source character, preserving native cursor and deletion behavior. + spans.add( + TextSpan( + text: label, + semanticsLabel: '', + style: _hiddenMentionTextStyle(style), + ), + ); + offset = match.end; + } + if (offset < source.length) { + spans.add(TextSpan(text: source.substring(offset), style: style)); + } + return spans.isEmpty ? [TextSpan(text: source, style: style)] : spans; + } + + TextStyle _hiddenMentionTextStyle(TextStyle inheritedStyle) => + inheritedStyle.copyWith( + color: Colors.transparent, + fontSize: 0.01, + height: 0.01, + letterSpacing: 0, + decoration: TextDecoration.none, + ); + (int, int) _contentBounds(String fullMatch, _MarkdownStyle markdownStyle) { final delimiterLength = switch (markdownStyle) { _MarkdownStyle.bold || _MarkdownStyle.strikethrough => 2, @@ -247,3 +339,60 @@ class _MarkdownEditingController extends TextEditingController { ); } } + +class _ComposerAgentMentionChip extends StatelessWidget { + final String label; + final TextStyle textStyle; + + const _ComposerAgentMentionChip({ + required this.label, + required this.textStyle, + }); + + @override + Widget build(BuildContext context) { + final style = textStyle.copyWith( + color: context.colors.primary, + fontWeight: FontWeight.w500, + height: 1, + ); + final fontSize = style.fontSize ?? 16; + + return Semantics( + label: 'Agent mention: $label', + excludeSemantics: true, + child: Container( + key: const ValueKey('composer-agent-mention-chip'), + padding: const EdgeInsets.fromLTRB( + Grid.half, + Grid.quarter + 1, + Grid.half, + Grid.quarter, + ), + decoration: BoxDecoration( + // The composer surface is already tinted, so the body chip's + // low-opacity fill disappears here. Keep the same chip geometry + // while giving this editable token enough contrast to read as one. + color: context.colors.primary.withValues(alpha: 0.16), + borderRadius: BorderRadius.circular(Radii.sm), + border: Border.all( + color: context.colors.primary.withValues(alpha: 0.12), + ), + ), + child: Row( + mainAxisSize: MainAxisSize.min, + crossAxisAlignment: CrossAxisAlignment.center, + children: [ + Icon( + LucideIcons.bot, + size: fontSize * 0.95, + color: context.colors.primary, + ), + const SizedBox(width: Grid.quarter), + Text(label, style: style), + ], + ), + ), + ); + } +} diff --git a/mobile/lib/features/channels/mentions/mention_candidates.dart b/mobile/lib/features/channels/mentions/mention_candidates.dart index ca97d65e34..9c4ef96bbe 100644 --- a/mobile/lib/features/channels/mentions/mention_candidates.dart +++ b/mobile/lib/features/channels/mentions/mention_candidates.dart @@ -1,59 +1,8 @@ -import 'dart:convert'; - -import '../../../shared/relay/nostr_models.dart'; +import '../../../shared/mentions/agent_identity_provider.dart'; import '../../profile/user_profile.dart'; import '../channel_management_provider.dart'; import 'mention_ranking.dart'; -/// A relay agent parsed from its kind:10100 agent-profile event. -/// -/// Mirrors the fields desktop's `RelayAgent` uses for mention eligibility -/// (`agentAutocompleteEligibility.ts`): who the agent responds to and which -/// channels it sits in. -class AgentDirectoryEntry { - final String pubkey; - final String? displayName; - final String? respondTo; - final List respondToAllowlist; - final List channelIds; - - const AgentDirectoryEntry({ - required this.pubkey, - this.displayName, - this.respondTo, - this.respondToAllowlist = const [], - this.channelIds = const [], - }); - - factory AgentDirectoryEntry.fromEvent(NostrEvent event) { - final content = _tryDecodeJsonMap(event.content); - return AgentDirectoryEntry( - pubkey: event.pubkey.toLowerCase(), - displayName: - (content?['display_name'] as String?) ?? - (content?['name'] as String?), - respondTo: content?['respond_to'] as String?, - respondToAllowlist: [ - for (final value in (content?['respond_to_allowlist'] as List?) ?? []) - if (value is String) value.toLowerCase(), - ], - channelIds: [ - for (final value in (content?['channel_ids'] as List?) ?? []) - if (value is String) value, - ], - ); - } -} - -Map? _tryDecodeJsonMap(String content) { - try { - final decoded = jsonDecode(content); - return decoded is Map ? decoded : null; - } catch (_) { - return null; - } -} - /// Whether a non-member relay agent should be mentionable by the current /// user. Mirrors desktop's `relayAgentIsSharedWithUser`: /// - allowlist mode: user must be on the allowlist diff --git a/mobile/lib/features/channels/mentions/mention_candidates_provider.dart b/mobile/lib/features/channels/mentions/mention_candidates_provider.dart index c2aa056a05..6e94459231 100644 --- a/mobile/lib/features/channels/mentions/mention_candidates_provider.dart +++ b/mobile/lib/features/channels/mentions/mention_candidates_provider.dart @@ -1,6 +1,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart'; import '../../../shared/crypto/nip_oa.dart'; +import '../../../shared/mentions/agent_identity_provider.dart'; import '../../../shared/relay/relay.dart'; import '../../profile/user_cache_provider.dart'; import '../../profile/user_profile.dart'; @@ -10,64 +11,6 @@ import '../channels_provider.dart'; import 'mention_candidates.dart'; import 'mention_ranking.dart'; -/// Relay agent directory from kind:10100 agent-profile events. -/// -/// Watches the session and only fetches after the WebSocket connects. -final agentDirectoryProvider = FutureProvider>(( - ref, -) async { - final sessionState = ref.watch(relaySessionProvider); - if (sessionState.status != SessionStatus.connected) return const []; - final session = ref.read(relaySessionProvider.notifier); - final events = await session.fetchHistory(NostrFilters.agentProfiles()); - return [for (final event in events) AgentDirectoryEntry.fromEvent(event)]; -}); - -/// Verified NIP-OA owner pubkey per agent pubkey, from the agents' kind:0 -/// profiles. An entry exists only when the `auth` tag verifies — mirrors -/// desktop's `profile_valid_oa_owner_pubkey`. -final agentOwnersProvider = FutureProvider>((ref) async { - final agents = await ref.watch(agentDirectoryProvider.future); - if (agents.isEmpty) return const {}; - final session = ref.read(relaySessionProvider.notifier); - final events = await session.fetchHistory( - NostrFilters.profilesBatch([for (final agent in agents) agent.pubkey]), - ); - final owners = {}; - for (final event in events) { - final owner = verifiedOaOwnerPubkey(event.tags, event.pubkey); - if (owner != null) owners[event.pubkey.toLowerCase()] = owner; - } - return owners; -}); - -/// Pubkeys currently known to represent agents for rendered mention chips. -/// -/// Uses the same three identity sources as mention autocomplete: channel bot -/// roles, relay agent-directory entries, and verified NIP-OA ownership. -final mentionAgentPubkeysProvider = Provider.family, String>(( - ref, - channelId, -) { - final members = - ref.watch(channelMembersProvider(channelId)).asData?.value ?? - const []; - final relayAgents = - ref.watch(agentDirectoryProvider).asData?.value ?? - const []; - final owners = ref.watch(agentOwnersProvider).asData?.value ?? const {}; - final userCache = ref.watch(userCacheProvider); - - return { - for (final member in members) - if (member.isBot) member.pubkey.toLowerCase(), - for (final agent in relayAgents) agent.pubkey.toLowerCase(), - ...owners.keys.map((pubkey) => pubkey.toLowerCase()), - for (final profile in userCache.values) - if (profile.ownerPubkey != null) profile.pubkey.toLowerCase(), - }; -}); - /// Debounce before a mention query hits the relay search endpoint. const _mentionSearchDebounce = Duration(milliseconds: 250); diff --git a/mobile/lib/features/channels/message_content.dart b/mobile/lib/features/channels/message_content.dart index ab992a4314..465585d966 100644 --- a/mobile/lib/features/channels/message_content.dart +++ b/mobile/lib/features/channels/message_content.dart @@ -145,6 +145,10 @@ class MessageContent extends HookConsumerWidget { final baseTextStyle = baseStyle ?? context.textTheme.bodyMedium?.copyWith(color: context.colors.onSurface); + final resolvedMentionNames = mentionNames; + final resolvedAgentMentionPubkeys = { + ...agentMentionPubkeys.map((pubkey) => pubkey.toLowerCase()), + }; final imetaByUrl = parseImetaTags(tags); final trailingGallery = maxLines == null ? _extractTrailingImageGallery(content, imetaByUrl) @@ -154,6 +158,13 @@ class MessageContent extends HookConsumerWidget { customEmojiFromTags(tags), ref.watch(customEmojiListProvider), ); + final mentionPresentationKey = [ + for (final entry + in (resolvedMentionNames.entries.toList() + ..sort((a, b) => a.key.compareTo(b.key)))) + '${entry.key}\u0000${entry.value}', + ...(resolvedAgentMentionPubkeys.toList()..sort()), + ].join('\u0001'); // Decided here rather than by the caller: this is where the event's own // emoji tags and the community palette have already been merged, and a @@ -220,7 +231,7 @@ class MessageContent extends HookConsumerWidget { mentionBuf.write('`${mentionParts[i]}`'); } else { var segment = mentionParts[i]; - for (final name in mentionNames.values) { + for (final name in resolvedMentionNames.values) { if (name.contains(' ')) { final normalizedName = _markdownMentionName(name); segment = segment.replaceAllMapped( @@ -241,29 +252,35 @@ class MessageContent extends HookConsumerWidget { result = '\u200B$result'; } return result; - }, [markdownContent, mentionNames]); - - final markdown = GptMarkdown( - finalContent, - style: style, - followLinkColor: false, - codeBuilder: (context, name, code, closed) => - _MessageCodeBlock(name: name, code: code), - linkBuilder: (context, linkText, url, linkStyle) => - _buildLink(context, ref, linkText, url, linkStyle, style), - imageBuilder: (context, imageUrl) => - _buildMedia(context, imageUrl, imetaByUrl[imageUrl]), - maxLines: maxLines, - inlineComponents: [ - _MentionMd( - mentionNames: mentionNames, - agentMentionPubkeys: agentMentionPubkeys, - onMentionTap: onMentionTap, - ), - CustomEmojiMd(customEmoji, size: inlineCustomEmojiSize), - _ChannelLinkMd(channelNames: channelNames, onChannelTap: onChannelTap), - ...MarkdownComponent.inlineComponents, - ], + }, [markdownContent, resolvedMentionNames]); + + final markdown = KeyedSubtree( + key: ValueKey('$finalContent\u0000$mentionPresentationKey'), + child: GptMarkdown( + finalContent, + style: style, + followLinkColor: false, + codeBuilder: (context, name, code, closed) => + _MessageCodeBlock(name: name, code: code), + linkBuilder: (context, linkText, url, linkStyle) => + _buildLink(context, ref, linkText, url, linkStyle, style), + imageBuilder: (context, imageUrl) => + _buildMedia(context, imageUrl, imetaByUrl[imageUrl]), + maxLines: maxLines, + inlineComponents: [ + _MentionMd( + mentionNames: resolvedMentionNames, + agentMentionPubkeys: resolvedAgentMentionPubkeys, + onMentionTap: onMentionTap, + ), + CustomEmojiMd(customEmoji, size: inlineCustomEmojiSize), + _ChannelLinkMd( + channelNames: channelNames, + onChannelTap: onChannelTap, + ), + ...MarkdownComponent.inlineComponents, + ], + ), ); if (trailingGallery == null) return markdown; diff --git a/mobile/lib/features/channels/thread_detail_page.dart b/mobile/lib/features/channels/thread_detail_page.dart index 5d28214b01..810861aa00 100644 --- a/mobile/lib/features/channels/thread_detail_page.dart +++ b/mobile/lib/features/channels/thread_detail_page.dart @@ -3,6 +3,7 @@ import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:scrollable_positioned_list/scrollable_positioned_list.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/relay/relay.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; @@ -24,7 +25,6 @@ import 'day_divider.dart'; import '../profile/user_profile_sheet.dart'; import 'message_actions.dart'; import 'message_content.dart'; -import 'mentions/mention_candidates_provider.dart'; import 'reaction_row.dart'; import 'read_state/read_state_format.dart'; import 'read_state/read_state_provider.dart'; @@ -607,7 +607,13 @@ class _ThreadMessage extends ConsumerWidget { profile?.ownerPubkey == currentPubkey?.toLowerCase()); final userCache = ref.watch(userCacheProvider); - final knownAgentPubkeys = ref.watch(mentionAgentPubkeysProvider(channelId)); + final knownAgentPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: ref.watch(agentMentionPubkeysProvider(channelId)), + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], + ); final mentionNames = {}; final agentMentionPubkeys = {}; for (final mpk in message.mentionPubkeys) { @@ -620,6 +626,12 @@ class _ThreadMessage extends ConsumerWidget { agentMentionPubkeys.add(normalizedPubkey); } } + final resolvedMentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: message.mentionPubkeys, + profileMentionNames: mentionNames, + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); return Padding( padding: EdgeInsets.only(top: showAuthor ? Grid.xs : 0), @@ -725,7 +737,7 @@ class _ThreadMessage extends ConsumerWidget { ), MessageContent( content: message.content, - mentionNames: mentionNames, + mentionNames: resolvedMentionNames, agentMentionPubkeys: agentMentionPubkeys, channelNames: channelNames, tags: message.tags, diff --git a/mobile/lib/features/forum/forum_post_card.dart b/mobile/lib/features/forum/forum_post_card.dart index 8666919a4a..ddc36a1d4a 100644 --- a/mobile/lib/features/forum/forum_post_card.dart +++ b/mobile/lib/features/forum/forum_post_card.dart @@ -1,8 +1,10 @@ import 'package:flutter/material.dart'; import 'package:flutter/services.dart'; +import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; import '../channels/message_content.dart'; @@ -15,7 +17,7 @@ import 'forum_models.dart'; /// /// Long-press opens an action sheet (copy, delete) matching the stream /// message pattern from channel_detail_page.dart. -class ForumPostCard extends ConsumerWidget { +class ForumPostCard extends HookConsumerWidget { final ForumPost post; final String? currentPubkey; final VoidCallback onTap; @@ -31,16 +33,57 @@ class ForumPostCard extends ConsumerWidget { @override Widget build(BuildContext context, WidgetRef ref) { + final mentionPubkeys = useMemoized( + () => + post.mentionPubkeys.map((pubkey) => pubkey.toLowerCase()).toSet() + ..remove(post.pubkey.toLowerCase()), + [post], + ); + final mentionPubkeysKey = (mentionPubkeys.toList()..sort()).join('\u0000'); + + useEffect(() { + if (mentionPubkeys.isNotEmpty) { + ref.read(userCacheProvider.notifier).preload(mentionPubkeys.toList()); + } + return null; + }, [mentionPubkeysKey]); + final pk = post.pubkey.toLowerCase(); final profile = ref.watch(userCacheProvider.select((cache) => cache[pk])) ?? ref.read(userCacheProvider.notifier).get(pk); final displayName = profile?.label ?? _shortPubkey(post.pubkey); - final mentionNames = ref.watch( + final profileMentionNames = ref.watch( userCacheProvider.select( (cache) => _buildMentionNames(post.mentionPubkeys, cache), ), ); + final profileOwnedMentionPubkeys = ref.watch( + userCacheProvider.select( + (cache) => + (post.mentionPubkeys + .where( + (pubkey) => + cache[pubkey.toLowerCase()]?.ownerPubkey != null, + ) + .map((pubkey) => pubkey.toLowerCase()) + .toList() + ..sort()) + .join('\u0000'), + ), + ); + final agentMentionPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: ref.watch(agentMentionPubkeysProvider(post.channelId)), + profileOwnedAgentPubkeys: profileOwnedMentionPubkeys.isEmpty + ? const [] + : profileOwnedMentionPubkeys.split('\u0000'), + ); + final mentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: post.mentionPubkeys, + profileMentionNames: profileMentionNames, + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); final preview = post.content.length > 200 ? '${post.content.substring(0, 200)}...' : post.content; @@ -128,6 +171,7 @@ class ForumPostCard extends ConsumerWidget { child: MessageContent( content: preview, mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, tags: post.tags, baseStyle: messageBodyTextStyle.copyWith( color: context.colors.onSurface, diff --git a/mobile/lib/features/forum/forum_thread_page.dart b/mobile/lib/features/forum/forum_thread_page.dart index d2e8490d61..68d2562f68 100644 --- a/mobile/lib/features/forum/forum_thread_page.dart +++ b/mobile/lib/features/forum/forum_thread_page.dart @@ -6,6 +6,7 @@ import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/buzz_loading_indicator.dart'; @@ -209,21 +210,27 @@ class _ThreadContent extends HookConsumerWidget { final post = thread.post; final replies = thread.replies; - // Preload profiles for all participants. + // Preload profiles for all participants and tagged mentions. final allPubkeys = useMemoized(() { - final pks = {post.pubkey}; + final pks = { + post.pubkey.toLowerCase(), + ...post.mentionPubkeys.map((pubkey) => pubkey.toLowerCase()), + }; for (final reply in replies) { - pks.add(reply.pubkey); + pks + ..add(reply.pubkey.toLowerCase()) + ..addAll(reply.mentionPubkeys.map((pubkey) => pubkey.toLowerCase())); } - return pks.toList(); + return pks.toList()..sort(); }, [post, replies]); + final allPubkeysKey = allPubkeys.join('\u0000'); useEffect(() { if (allPubkeys.isNotEmpty) { ref.read(userCacheProvider.notifier).preload(allPubkeys); } return null; - }, [allPubkeys]); + }, [allPubkeysKey]); return Column( children: [ @@ -322,7 +329,19 @@ class _OriginalPost extends ConsumerWidget { final displayName = profile?.label ?? _shortPubkey(post.pubkey); final userCache = ref.watch(userCacheProvider); - final mentionNames = _buildMentionNames(post.mentionPubkeys, userCache); + final agentMentionPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: ref.watch(agentMentionPubkeysProvider(post.channelId)), + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], + ); + final mentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: post.mentionPubkeys, + profileMentionNames: _buildMentionNames(post.mentionPubkeys, userCache), + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); return Padding( padding: const EdgeInsets.all(Grid.xs), @@ -375,6 +394,7 @@ class _OriginalPost extends ConsumerWidget { MessageContent( content: post.content, mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, tags: post.tags, baseStyle: messageBodyTextStyle.copyWith( color: context.colors.onSurface, @@ -409,7 +429,19 @@ class _ReplyRow extends ConsumerWidget { final displayName = profile?.label ?? _shortPubkey(reply.pubkey); final userCache = ref.watch(userCacheProvider); - final mentionNames = _buildMentionNames(reply.mentionPubkeys, userCache); + final agentMentionPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: ref.watch(agentMentionPubkeysProvider(channelId)), + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], + ); + final mentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: reply.mentionPubkeys, + profileMentionNames: _buildMentionNames(reply.mentionPubkeys, userCache), + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); return Padding( padding: const EdgeInsets.symmetric( @@ -481,6 +513,7 @@ class _ReplyRow extends ConsumerWidget { child: MessageContent( content: reply.content, mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, tags: reply.tags, baseStyle: messageBodyTextStyle.copyWith( color: context.colors.onSurface, diff --git a/mobile/lib/features/search/search_page.dart b/mobile/lib/features/search/search_page.dart index b608b65aef..65fc12dfd9 100644 --- a/mobile/lib/features/search/search_page.dart +++ b/mobile/lib/features/search/search_page.dart @@ -3,6 +3,8 @@ import 'package:flutter_hooks/flutter_hooks.dart'; import 'package:hooks_riverpod/hooks_riverpod.dart'; import 'package:lucide_icons_flutter/lucide_icons.dart'; +import '../../shared/mentions/agent_identity_provider.dart'; +import '../../shared/mentions/mention_tags.dart'; import '../../shared/theme/theme.dart'; import '../../shared/widgets/avatar_image.dart'; import '../../shared/widgets/buzz_loading_indicator.dart'; @@ -597,7 +599,7 @@ class _PeopleSection extends ConsumerWidget { } } -class _MessagesSection extends ConsumerWidget { +class _MessagesSection extends HookConsumerWidget { final List hits; final String? currentPubkey; final VoidCallback onResultSelected; @@ -614,8 +616,15 @@ class _MessagesSection extends ConsumerWidget { final channels = ref.watch(channelsProvider).value ?? []; // Preload author profiles. - final pubkeys = hits.map((h) => h.pubkey.toLowerCase()).toSet().toList(); - ref.read(userCacheProvider.notifier).preload(pubkeys); + final preloadPubkeys = { + for (final hit in hits) hit.pubkey.toLowerCase(), + for (final hit in hits) ...mentionedPubkeysFromTags(hit.tags), + }.toList()..sort(); + final preloadPubkeysKey = preloadPubkeys.join('\u0000'); + useEffect(() { + ref.read(userCacheProvider.notifier).preload(preloadPubkeys); + return null; + }, [preloadPubkeysKey]); return Column( crossAxisAlignment: CrossAxisAlignment.start, @@ -635,7 +644,7 @@ class _MessagesSection extends ConsumerWidget { } } -class _MessageTile extends StatelessWidget { +class _MessageTile extends ConsumerWidget { final SearchHit hit; final UserProfile? authorProfile; final Map userCache; @@ -653,12 +662,34 @@ class _MessageTile extends StatelessWidget { }); @override - Widget build(BuildContext context) { + Widget build(BuildContext context, WidgetRef ref) { final authorName = authorProfile?.label ?? shortPubkey(hit.pubkey); final timeAgo = relativeTime(hit.createdAt); final channelName = hit.channelName?.trim().replaceFirst(RegExp(r'^#'), ''); final hasChannelName = channelName != null && channelName.isNotEmpty; final isDm = channel?.isDm ?? false; + final profileMentionNames = { + for (final pubkey in mentionedPubkeysFromTags(hit.tags)) + if (userCache[pubkey]?.displayName?.trim().isNotEmpty == true) + pubkey: userCache[pubkey]!.displayName!.trim(), + }; + final mentionPubkeys = mentionedPubkeysFromTags(hit.tags); + final knownAgentPubkeys = channel == null + ? ref.watch(knownAgentPubkeysProvider) + : ref.watch(agentMentionPubkeysProvider(channel!.id)); + final agentMentionPubkeys = agentPubkeysWithProfileOwners( + knownAgentPubkeys: knownAgentPubkeys, + profileOwnedAgentPubkeys: [ + for (final profile in userCache.values) + if (profile.ownerPubkey != null) profile.pubkey, + ], + ); + final mentionNames = mentionNamesWithDirectoryLabels( + mentionPubkeys: mentionPubkeys, + profileMentionNames: profileMentionNames, + directoryDisplayNames: ref.watch(agentDirectoryDisplayNamesProvider), + agentMentionPubkeys: agentMentionPubkeys, + ); return ListTile( key: ValueKey('search-message-row-${hit.eventId}'), @@ -730,6 +761,8 @@ class _MessageTile extends StatelessWidget { MessageContent( key: ValueKey('search-message-body-${hit.eventId}'), content: hit.content, + mentionNames: mentionNames, + agentMentionPubkeys: agentMentionPubkeys, tags: hit.tags, maxLines: 2, baseStyle: activityPreviewTextStyle.copyWith( diff --git a/mobile/lib/shared/mentions/agent_identity_provider.dart b/mobile/lib/shared/mentions/agent_identity_provider.dart new file mode 100644 index 0000000000..ea6a2ee50f --- /dev/null +++ b/mobile/lib/shared/mentions/agent_identity_provider.dart @@ -0,0 +1,274 @@ +import 'dart:collection'; +import 'dart:convert'; + +import 'package:flutter/foundation.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; + +import '../../shared/crypto/nip_oa.dart'; +import '../../shared/relay/relay.dart'; + +/// A relay agent parsed from its kind:10100 agent-profile event. +/// +/// Mirrors the fields desktop's `RelayAgent` uses for mention eligibility +/// (`agentAutocompleteEligibility.ts`): who the agent responds to and which +/// channels it sits in. +class AgentDirectoryEntry { + final String pubkey; + final String? displayName; + final String? respondTo; + final List respondToAllowlist; + final List channelIds; + + const AgentDirectoryEntry({ + required this.pubkey, + this.displayName, + this.respondTo, + this.respondToAllowlist = const [], + this.channelIds = const [], + }); + + factory AgentDirectoryEntry.fromEvent(NostrEvent event) { + final content = _tryDecodeJsonMap(event.content); + return AgentDirectoryEntry( + pubkey: event.pubkey.toLowerCase(), + displayName: + (content?['display_name'] as String?) ?? + (content?['name'] as String?), + respondTo: content?['respond_to'] as String?, + respondToAllowlist: [ + for (final value in (content?['respond_to_allowlist'] as List?) ?? []) + if (value is String) value.toLowerCase(), + ], + channelIds: [ + for (final value in (content?['channel_ids'] as List?) ?? []) + if (value is String) value, + ], + ); + } +} + +Map? _tryDecodeJsonMap(String content) { + try { + final decoded = jsonDecode(content); + return decoded is Map ? decoded : null; + } catch (_) { + return null; + } +} + +/// Relay agent directory from kind:10100 agent-profile events. +/// +/// Watches the session and only fetches after the WebSocket connects. +final agentDirectoryProvider = FutureProvider>(( + ref, +) async { + final sessionState = ref.watch(relaySessionProvider); + if (sessionState.status != SessionStatus.connected) return const []; + final session = ref.read(relaySessionProvider.notifier); + final events = await session.fetchHistory(NostrFilters.agentProfiles()); + return [for (final event in events) AgentDirectoryEntry.fromEvent(event)]; +}); + +/// Verified NIP-OA owner pubkey per agent pubkey, from the agents' kind:0 +/// profiles. An entry exists only when the `auth` tag verifies — mirrors +/// desktop's `profile_valid_oa_owner_pubkey`. +final agentOwnersProvider = FutureProvider>((ref) async { + final agents = await ref.watch(agentDirectoryProvider.future); + if (agents.isEmpty) return const {}; + final session = ref.read(relaySessionProvider.notifier); + final events = await session.fetchHistory( + NostrFilters.profilesBatch([for (final agent in agents) agent.pubkey]), + ); + final owners = {}; + for (final event in events) { + final owner = verifiedOaOwnerPubkey(event.tags, event.pubkey); + if (owner != null) owners[event.pubkey.toLowerCase()] = owner; + } + return owners; +}); + +/// Pubkeys currently known to represent agents across the active relay. +/// +/// Message surfaces that do not own channel membership can use this shared +/// identity source; channel features add their bot roles separately. +final knownAgentPubkeysProvider = Provider>((ref) { + final relayAgents = + ref.watch(agentDirectoryProvider).asData?.value ?? + const []; + final owners = ref.watch(agentOwnersProvider).asData?.value ?? const {}; + return _AgentPubkeySet({ + for (final agent in relayAgents) agent.pubkey.toLowerCase(), + ...owners.keys.map((pubkey) => pubkey.toLowerCase()), + }); +}); + +/// Directory display names keyed by agent pubkey for mention presentation. +final agentDirectoryDisplayNamesProvider = Provider>((ref) { + final agents = + ref.watch(agentDirectoryProvider).asData?.value ?? + const []; + return Map.unmodifiable({ + for (final agent in agents) + if (agent.displayName?.trim().isNotEmpty == true) + agent.pubkey.toLowerCase(): agent.displayName!.trim(), + }); +}); + +/// Adds channel bot roles to relay-wide agent identities. +Set agentPubkeysWithChannelBots({ + required Set knownAgentPubkeys, + required Iterable channelBotPubkeys, +}) => _AgentPubkeySet({ + ...knownAgentPubkeys, + ...channelBotPubkeys.map((pubkey) => pubkey.toLowerCase()), +}); + +/// Adds agent identities derived from locally cached verified profiles. +Set agentPubkeysWithProfileOwners({ + required Set knownAgentPubkeys, + required Iterable profileOwnedAgentPubkeys, +}) => _AgentPubkeySet({ + ...knownAgentPubkeys, + ...profileOwnedAgentPubkeys.map((pubkey) => pubkey.toLowerCase()), +}); + +/// Preserves profile labels while filling missing agent mentions from the +/// relay's agent directory. +Map mentionNamesWithDirectoryLabels({ + required Iterable mentionPubkeys, + required Map profileMentionNames, + required Map directoryDisplayNames, + required Set agentMentionPubkeys, +}) { + final names = Map.from(profileMentionNames); + for (final pubkey in mentionPubkeys) { + final normalizedPubkey = pubkey.toLowerCase(); + if (names[normalizedPubkey]?.trim().isEmpty == true) { + names.remove(normalizedPubkey); + } + final directoryName = directoryDisplayNames[normalizedPubkey]; + if (!names.containsKey(normalizedPubkey) && directoryName != null) { + names[normalizedPubkey] = directoryName; + } + if (!names.containsKey(normalizedPubkey) && + agentMentionPubkeys.contains(normalizedPubkey)) { + names[normalizedPubkey] = _agentFallbackLabel(normalizedPubkey); + } + } + return names; +} + +String _agentFallbackLabel(String pubkey) => + pubkey.length >= 8 ? pubkey.substring(0, 8) : pubkey; + +/// Keeps the role feed alive for consumers that render mentions outside the +/// channel timeline, such as search results. A membership change refreshes the +/// shared bot-role lookup below, regardless of which surface owns the channel. +class _ChannelBotRoleSubscription extends Notifier { + final String channelId; + void Function()? _unsubscribe; + int _subscriptionVersion = 0; + + _ChannelBotRoleSubscription(this.channelId); + + @override + int build() { + final sessionState = ref.watch(relaySessionProvider); + final subscriptionVersion = ++_subscriptionVersion; + _clearSubscription(); + ref.onDispose(() { + _subscriptionVersion++; + _clearSubscription(); + }); + + if (sessionState.status != SessionStatus.connected) return 0; + Future.microtask(() => _subscribe(channelId, subscriptionVersion)); + return 0; + } + + Future _subscribe(String channelId, int subscriptionVersion) async { + final session = ref.read(relaySessionProvider.notifier); + try { + final unsubscribe = await session.subscribe( + NostrFilter( + kinds: const [39002], + tags: { + '#h': [channelId], + }, + ).copyWithSince(DateTime.now().millisecondsSinceEpoch ~/ 1000), + (_) { + if (_isCurrent(subscriptionVersion)) { + state++; + } + }, + ); + if (!_isCurrent(subscriptionVersion)) { + unsubscribe(); + return; + } + _unsubscribe = unsubscribe; + } catch (error) { + if (_isCurrent(subscriptionVersion)) { + debugPrint( + '[ChannelBotRoleSubscription] failed for $channelId: $error', + ); + } + } + } + + bool _isCurrent(int subscriptionVersion) => + subscriptionVersion == _subscriptionVersion; + + void _clearSubscription() { + _unsubscribe?.call(); + _unsubscribe = null; + } +} + +/// Monotonically increments when the channel's kind:39002 membership snapshot +/// changes. Channel-member and agent-role views share this source so remote +/// membership updates refresh both snapshots together. +final channelMembershipUpdateProvider = NotifierProvider.autoDispose + .family<_ChannelBotRoleSubscription, int, String>( + _ChannelBotRoleSubscription.new, + ); + +/// Bot pubkeys currently assigned a channel bot role. +final channelBotPubkeysProvider = FutureProvider.autoDispose + .family, String>((ref, channelId) async { + ref.watch(channelMembershipUpdateProvider(channelId)); + final sessionState = ref.watch(relaySessionProvider); + if (sessionState.status != SessionStatus.connected) return const {}; + final session = ref.read(relaySessionProvider.notifier); + final events = await session.fetchHistory( + NostrFilters.channelMembers(channelId), + ); + if (events.isEmpty) return const {}; + return _AgentPubkeySet({ + for (final member in membersFromEvent(events.first)) + if (member.role == 'bot') member.pubkey.toLowerCase(), + }); + }); + +/// Pubkeys currently known to represent agents in a channel. +final agentMentionPubkeysProvider = Provider.autoDispose + .family, String>((ref, channelId) { + final channelBotPubkeys = + ref.watch(channelBotPubkeysProvider(channelId)).asData?.value ?? + const {}; + return agentPubkeysWithChannelBots( + knownAgentPubkeys: ref.watch(knownAgentPubkeysProvider), + channelBotPubkeys: channelBotPubkeys, + ); + }); + +class _AgentPubkeySet extends UnmodifiableSetView { + _AgentPubkeySet(Iterable pubkeys) : super(Set.unmodifiable(pubkeys)); + + @override + bool operator ==(Object other) => + other is Set && length == other.length && every(other.contains); + + @override + int get hashCode => Object.hashAllUnordered(this); +} diff --git a/mobile/lib/shared/mentions/mention_tags.dart b/mobile/lib/shared/mentions/mention_tags.dart new file mode 100644 index 0000000000..bf21282715 --- /dev/null +++ b/mobile/lib/shared/mentions/mention_tags.dart @@ -0,0 +1,6 @@ +/// Pubkeys tagged as message mentions, normalized for profile lookups. +Set mentionedPubkeysFromTags(Iterable> tags) => { + for (final tag in tags) + if (tag.length >= 2 && (tag[0] == 'p' || tag[0] == 'mention')) + tag[1].toLowerCase(), +}; diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart index e5ed0fb352..1c66093899 100644 --- a/mobile/test/features/channels/channel_detail_page_test.dart +++ b/mobile/test/features/channels/channel_detail_page_test.dart @@ -26,6 +26,7 @@ import 'package:buzz/features/channels/small_avatar.dart'; import 'package:buzz/features/profile/profile_provider.dart'; import 'package:buzz/features/profile/user_cache_provider.dart'; import 'package:buzz/features/profile/user_profile.dart'; +import 'package:buzz/shared/mentions/agent_identity_provider.dart'; import 'package:buzz/shared/relay/relay.dart'; import 'package:buzz/shared/theme/theme.dart'; import 'package:buzz/shared/widgets/skeleton.dart'; @@ -188,6 +189,9 @@ Widget _buildTestable({ channelMembersProvider(_channelId).overrideWith( (ref) async => loadMembers != null ? loadMembers() : members, ), + channelBotPubkeysProvider( + _channelId, + ).overrideWith((ref) async => const {}), if (createChannelActions != null) channelActionsProvider.overrideWith(createChannelActions), if (readStateNotifier != null) diff --git a/mobile/test/features/channels/compose_bar_test.dart b/mobile/test/features/channels/compose_bar_test.dart index 7b747adfac..919d4039eb 100644 --- a/mobile/test/features/channels/compose_bar_test.dart +++ b/mobile/test/features/channels/compose_bar_test.dart @@ -17,11 +17,10 @@ import 'package:buzz/features/channels/channel.dart'; import 'package:buzz/features/channels/channel_management_provider.dart'; import 'package:buzz/features/channels/compose_bar.dart'; import 'package:buzz/features/channels/channels_provider.dart'; -import 'package:buzz/features/channels/mentions/mention_candidates.dart'; -import 'package:buzz/features/channels/mentions/mention_candidates_provider.dart'; import 'package:buzz/features/channels/photo_library.dart'; import 'package:buzz/shared/custom_emoji/custom_emoji.dart'; import 'package:buzz/shared/custom_emoji/custom_emoji_provider.dart'; +import 'package:buzz/shared/mentions/agent_identity_provider.dart'; import 'package:buzz/shared/relay/relay.dart'; import 'package:buzz/shared/theme/theme.dart'; import 'package:shared_preferences/shared_preferences.dart'; @@ -2269,6 +2268,11 @@ void main() { await tester.pumpAndSettle(); await tester.tap(find.text('Helper Bot')); await tester.pumpAndSettle(); + expect(find.byIcon(LucideIcons.bot), findsOneWidget); + expect( + find.byKey(const ValueKey('composer-agent-mention-chip')), + findsOneWidget, + ); await tester.enterText(find.byType(TextField), 'hello @Helper Bot'); await tester.tap(find.byIcon(LucideIcons.arrowUp)); await tester.pumpAndSettle(); @@ -2285,6 +2289,70 @@ void main() { ]); }); + testWidgets( + 'renders chips only for selected agents outside code and composition', + (tester) async { + final semantics = tester.ensureSemantics(); + final signer = nostr.Keys.generate(); + await tester.pumpWidget( + _buildComposeBar( + uploadService: _testUploadService(signer.nsec), + currentPubkey: signer.public, + relayAgents: [_testAgent('f' * 64)], + channels: [_makeCurrentChannel(), _makeSharedMemberChannel()], + onSend: + ( + content, + mentionPubkeys, { + mediaTags = const >[], + }) async {}, + ), + ); + + await _expandComposer(tester); + await tester.enterText(find.byType(TextField), '@Helper Bot'); + await tester.pump(); + expect( + find.byKey(const ValueKey('composer-agent-mention-chip')), + findsNothing, + ); + + await tester.enterText(find.byType(TextField), '@hel'); + await tester.pumpAndSettle(); + await tester.tap(find.text('Helper Bot')); + await tester.pumpAndSettle(); + expect( + find.byKey(const ValueKey('composer-agent-mention-chip')), + findsOneWidget, + ); + expect( + find.bySemanticsLabel('Agent mention: Helper Bot'), + findsOneWidget, + ); + expect(find.bySemanticsLabel('Helper Bot'), findsNothing); + + await tester.enterText(find.byType(TextField), '`@Helper Bot`'); + await tester.pump(); + expect( + find.byKey(const ValueKey('composer-agent-mention-chip')), + findsNothing, + ); + + await tester.enterText(find.byType(TextField), '@Helper Bot typing'); + final textField = tester.widget(find.byType(TextField)); + textField.controller!.value = textField.controller!.value.copyWith( + composing: const TextRange(start: 12, end: 18), + ); + await tester.pump(); + expect( + find.byKey(const ValueKey('composer-agent-mention-chip')), + findsOneWidget, + ); + await tester.pump(const Duration(milliseconds: 250)); + semantics.dispose(); + }, + ); + testWidgets('does not mutate a DM when mentioning a non-member agent', ( tester, ) async { diff --git a/mobile/test/features/channels/mentions/mention_candidates_test.dart b/mobile/test/features/channels/mentions/mention_candidates_test.dart index 3f2e8e3d6a..811996857c 100644 --- a/mobile/test/features/channels/mentions/mention_candidates_test.dart +++ b/mobile/test/features/channels/mentions/mention_candidates_test.dart @@ -2,6 +2,7 @@ import 'package:flutter_test/flutter_test.dart'; import 'package:buzz/features/channels/channel_management_provider.dart'; import 'package:buzz/features/channels/mentions/mention_candidates.dart'; import 'package:buzz/features/profile/user_profile.dart'; +import 'package:buzz/shared/mentions/agent_identity_provider.dart'; final userPubkey = 'a' * 64; final memberPubkey = 'b' * 64; @@ -18,6 +19,20 @@ ChannelMember member(String pubkey, {String role = 'member'}) { } void main() { + test('role-only agent mentions fall back to a pubkey prefix label', () { + const pubkey = 'deadbeef0123456789'; + + expect( + mentionNamesWithDirectoryLabels( + mentionPubkeys: const [pubkey], + profileMentionNames: const {}, + directoryDisplayNames: const {}, + agentMentionPubkeys: const {pubkey}, + ), + const {pubkey: 'deadbeef'}, + ); + }); + group('agentIsSharedWithUser', () { test('anyone-mode agent is shared when a channel overlaps', () { final agent = AgentDirectoryEntry( diff --git a/mobile/test/features/channels/message_content_test.dart b/mobile/test/features/channels/message_content_test.dart index bc6772fd67..9d8adb69bc 100644 --- a/mobile/test/features/channels/message_content_test.dart +++ b/mobile/test/features/channels/message_content_test.dart @@ -1204,6 +1204,43 @@ Photos expect(find.text('Alice'), findsOneWidget); }); + testWidgets('renders a known agent mention with the bot chip', ( + tester, + ) async { + await tester.pumpWidget( + _testable( + const MessageContent( + content: 'Ask @Helper Bot to investigate', + mentionNames: {'agent-pubkey': 'Helper Bot'}, + agentMentionPubkeys: {'agent-pubkey'}, + maxLines: 2, + ), + ), + ); + + expect(find.byIcon(LucideIcons.bot), findsOneWidget); + expect(find.text('@'), findsNothing); + expect(find.text('Helper Bot'), findsOneWidget); + }); + + testWidgets('normalizes passed multi-word agent mentions', ( + tester, + ) async { + await tester.pumpWidget( + _testable( + const MessageContent( + content: 'Ask @Helper Bot to investigate', + mentionNames: {'agent-pubkey': 'Helper Bot'}, + agentMentionPubkeys: {'agent-pubkey'}, + ), + ), + ); + + expect(find.byIcon(LucideIcons.bot), findsOneWidget); + expect(find.text('Helper Bot'), findsOneWidget); + expect(_allRichText(tester), isNot(contains('Bot Bot'))); + }); + testWidgets('highlights an entire multi-word display name', ( tester, ) async { diff --git a/mobile/test/features/search/search_page_test.dart b/mobile/test/features/search/search_page_test.dart index e4a576b91d..c3db833fc1 100644 --- a/mobile/test/features/search/search_page_test.dart +++ b/mobile/test/features/search/search_page_test.dart @@ -10,8 +10,10 @@ import 'package:buzz/features/search/recent_searches_provider.dart'; import 'package:buzz/features/search/search_page.dart'; import 'package:buzz/features/search/search_provider.dart'; import 'package:buzz/shared/theme/theme.dart'; +import 'package:buzz/shared/mentions/agent_identity_provider.dart'; import 'package:flutter/material.dart'; import 'package:flutter_test/flutter_test.dart'; +import 'package:lucide_icons_flutter/lucide_icons.dart'; import '../../helpers/widget_helpers.dart'; @@ -593,6 +595,72 @@ void main() { await tester.pump(); expect(recentSearches.searches, const ['design']); }); + + testWidgets('renders channel-role bots in message previews', (tester) async { + final channel = Channel( + id: 'channel-1', + name: 'general', + channelType: 'stream', + visibility: 'open', + description: '', + createdBy: 'test', + createdAt: DateTime(2025), + memberCount: 2, + isMember: true, + ); + const agentPubkey = 'agent-pubkey'; + const cachedProfile = UserProfile(pubkey: 'author-pubkey'); + final state = SearchState( + query: 'helper', + messageResults: [ + SearchHit( + eventId: 'message-1', + content: 'Ask @Helper Bot to investigate', + kind: 9, + pubkey: 'author-pubkey', + channelId: channel.id, + channelName: channel.name, + createdAt: 1, + score: 1, + tags: [ + ['p', agentPubkey], + ], + ), + ], + ); + + await tester.pumpWidget( + WidgetHelpers.testable( + overrides: [ + searchProvider.overrideWith(() => _FakeSearchNotifier(state)), + recentSearchesProvider.overrideWith( + () => _FakeRecentSearchesNotifier(const []), + ), + profileProvider.overrideWith(() => _FakeProfileNotifier()), + channelsProvider.overrideWith(() => _FakeChannelsNotifier([channel])), + userCacheProvider.overrideWith( + () => _FakeUserCacheNotifier(cachedProfile), + ), + knownAgentPubkeysProvider.overrideWith((ref) => const {}), + channelBotPubkeysProvider( + channel.id, + ).overrideWith((ref) async => {agentPubkey}), + agentDirectoryDisplayNamesProvider.overrideWith( + (ref) => const {agentPubkey: 'Helper Bot'}, + ), + ], + child: const SearchPage(), + ), + ); + await tester.pumpAndSettle(); + + final content = tester.widget( + find.byKey(const ValueKey('search-message-body-message-1')), + ); + expect(content.mentionNames, const {agentPubkey: 'Helper Bot'}); + expect(content.agentMentionPubkeys, contains(agentPubkey)); + expect(find.byIcon(LucideIcons.bot), findsOneWidget); + }); } class _FakeSearchNotifier extends SearchNotifier { @@ -646,8 +714,12 @@ class _FakeProfileNotifier extends ProfileNotifier { } class _FakeChannelsNotifier extends ChannelsNotifier { + _FakeChannelsNotifier([this.channels = const []]); + + final List channels; + @override - Future> build() async => const []; + Future> build() async => channels; } class _FakeUserCacheNotifier extends UserCacheNotifier { diff --git a/mobile/test/shared/mentions/agent_identity_provider_test.dart b/mobile/test/shared/mentions/agent_identity_provider_test.dart new file mode 100644 index 0000000000..0ea0afb268 --- /dev/null +++ b/mobile/test/shared/mentions/agent_identity_provider_test.dart @@ -0,0 +1,228 @@ +import 'dart:async'; + +import 'package:flutter_test/flutter_test.dart'; +import 'package:hooks_riverpod/hooks_riverpod.dart'; +import 'package:buzz/features/channels/agent_activity/working_bots_provider.dart'; +import 'package:buzz/features/channels/channel_management_provider.dart'; +import 'package:buzz/shared/mentions/agent_identity_provider.dart'; +import 'package:buzz/shared/relay/relay.dart'; + +void main() { + test('refreshes channel bot roles from live membership updates', () async { + final relaySession = _MembershipRelaySessionNotifier([ + _membershipEvent(role: 'bot'), + _membershipEvent(role: 'member'), + ]); + final container = ProviderContainer( + overrides: [relaySessionProvider.overrideWith(() => relaySession)], + ); + addTearDown(container.dispose); + final keepAlive = container.listen( + channelBotPubkeysProvider(_channelId), + (_, _) {}, + fireImmediately: true, + ); + addTearDown(keepAlive.close); + + expect(await container.read(channelBotPubkeysProvider(_channelId).future), { + _agentPubkey, + }); + await relaySession.subscribed; + expect(relaySession.liveFilters.single.kinds, const [39002]); + expect(relaySession.liveFilters.single.tags['#h'], [_channelId]); + + relaySession.emit(_membershipEvent(role: 'member')); + await _pumpEventQueue(); + + expect( + await container.read(channelBotPubkeysProvider(_channelId).future), + isEmpty, + ); + }); + + test('refreshes channel members from live membership updates', () async { + final relaySession = _MembershipRelaySessionNotifier([ + _membershipEvent(role: 'bot'), + _membershipEvent(role: 'member'), + ]); + final container = ProviderContainer( + overrides: [relaySessionProvider.overrideWith(() => relaySession)], + ); + addTearDown(container.dispose); + final keepAlive = container.listen( + channelMembersProvider(_channelId), + (_, _) {}, + fireImmediately: true, + ); + addTearDown(keepAlive.close); + + expect( + (await container.read( + channelMembersProvider(_channelId).future, + )).single.role, + 'bot', + ); + await relaySession.subscribed; + + relaySession.emit(_membershipEvent(role: 'member')); + await _pumpEventQueue(); + + expect( + (await container.read( + channelMembersProvider(_channelId).future, + )).single.role, + 'member', + ); + }); + + test('disposes the live role subscription without consumers', () async { + final relaySession = _MembershipRelaySessionNotifier([ + _membershipEvent(role: 'bot'), + ]); + final container = ProviderContainer( + overrides: [relaySessionProvider.overrideWith(() => relaySession)], + ); + addTearDown(container.dispose); + final keepAlive = container.listen( + channelBotPubkeysProvider(_channelId), + (_, _) {}, + fireImmediately: true, + ); + + await container.read(channelBotPubkeysProvider(_channelId).future); + await relaySession.subscribed; + keepAlive.close(); + await container.pump(); + + expect(relaySession.unsubscribeCount, 1); + }); + + test( + 'does not retain a live role subscription through working bots', + () async { + final relaySession = _MembershipRelaySessionNotifier([ + _membershipEvent(role: 'bot'), + ]); + final container = ProviderContainer( + overrides: [relaySessionProvider.overrideWith(() => relaySession)], + ); + addTearDown(container.dispose); + final keepAlive = container.listen( + workingBotPubkeysProvider(_channelId), + (_, _) {}, + fireImmediately: true, + ); + + await relaySession.subscribed; + keepAlive.close(); + await container.pump(); + + expect(relaySession.unsubscribeCount, 1); + }, + ); + + test('blank profile labels defer to the directory label', () { + const pubkey = 'deadbeef0123456789'; + + expect( + mentionNamesWithDirectoryLabels( + mentionPubkeys: const [pubkey], + profileMentionNames: const {pubkey: ' '}, + directoryDisplayNames: const {pubkey: 'Directory bot'}, + agentMentionPubkeys: const {pubkey}, + ), + const {pubkey: 'Directory bot'}, + ); + }); +} + +const _channelId = '11111111-1111-4111-8111-111111111111'; +const _agentPubkey = + 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'; + +NostrEvent _membershipEvent({required String role}) => NostrEvent( + id: 'membership-$role', + pubkey: 'owner', + createdAt: 1, + kind: 39002, + tags: [ + ['d', _channelId], + ['h', _channelId], + ['p', _agentPubkey, 'wss://relay.example', role], + ], + content: '', + sig: 'sig', +); + +Future _pumpEventQueue() async { + await Future.delayed(Duration.zero); + await Future.delayed(Duration.zero); +} + +class _MembershipRelaySessionNotifier extends RelaySessionNotifier { + final List _memberships; + final List liveFilters = []; + final List<_LiveSubscription> _subscriptions = []; + final Completer _subscribed = Completer(); + var unsubscribeCount = 0; + var _membershipIndex = 0; + + _MembershipRelaySessionNotifier(this._memberships); + + Future get subscribed => _subscribed.future; + + @override + SessionState build() => const SessionState(status: SessionStatus.connected); + + @override + Future> fetchHistory( + NostrFilter filter, { + Duration timeout = const Duration(seconds: 8), + }) async { + return [_memberships[_membershipIndex++]]; + } + + @override + Future subscribe( + NostrFilter filter, + void Function(NostrEvent) onEvent, { + void Function(String message)? onClosed, + }) async { + liveFilters.add(filter); + final subscription = _LiveSubscription(filter, onEvent); + _subscriptions.add(subscription); + if (!_subscribed.isCompleted) _subscribed.complete(); + return () { + unsubscribeCount++; + _subscriptions.remove(subscription); + }; + } + + void emit(NostrEvent event) { + for (final subscription in List.of(_subscriptions)) { + if (_matches(subscription.filter, event)) { + subscription.onEvent(event); + } + } + } +} + +class _LiveSubscription { + final NostrFilter filter; + final void Function(NostrEvent) onEvent; + + const _LiveSubscription(this.filter, this.onEvent); +} + +bool _matches(NostrFilter filter, NostrEvent event) { + if (!filter.kinds.contains(event.kind)) return false; + return filter.tags.entries.every((entry) { + final tagName = entry.key.substring(1); + return event.tags.any( + (tag) => + tag.isNotEmpty && + tag.first == tagName && + tag.skip(1).any(entry.value.contains), + ); + }); +} From f44b5a2477f3979ae66e49153b11be36538cf859 Mon Sep 17 00:00:00 2001 From: Bradley Axen Date: Thu, 30 Jul 2026 10:48:54 -0700 Subject: [PATCH 079/112] fix(desktop): reuse profiles when joining communities (#2155) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why People joining a community with an existing relay profile should not be asked to recreate their name and avatar. ## What - Check the active identity's relay profile after the joined community becomes active - Skip directly to the starter-team step when a kind-0 profile event exists - Preserve the profile setup path when no event exists or discovery fails - Cover both new-profile and existing-profile join paths in E2E tests ## Risk Assessment Low — the lookup is scoped to the community onboarding profile stage, runs once per transaction, and fails open to the existing flow. ## References - `pnpm build:e2e && pnpm exec playwright test --project=integration tests/e2e/onboarding.spec.ts --grep 'first-community direct join reaches profile|community onboarding reuses an existing relay profile'` (2 passed) Generated with Codex Signed-off-by: npub1rf6fvdj6ut0c4kcmjv4p5mmgh89nj58n69uu3fz3cvk3jn500hqs7emz79 <1a7496365ae2df8adb1b932a1a6f68b9cb3950f3d179c8a451c32d194e8f7dc1@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1rf6fvdj6ut0c4kcmjv4p5mmgh89nj58n69uu3fz3cvk3jn500hqs7emz79 <1a7496365ae2df8adb1b932a1a6f68b9cb3950f3d179c8a451c32d194e8f7dc1@sprout-oss.stage.blox.sqprod.co> --- .../onboarding/ui/CommunityOnboardingFlow.tsx | 17 ++++++ desktop/src/testing/e2eBridge.ts | 9 +++ desktop/tests/e2e/onboarding.spec.ts | 60 +++++++++++++++++++ desktop/tests/helpers/bridge.ts | 2 + 4 files changed, 88 insertions(+) diff --git a/desktop/src/features/onboarding/ui/CommunityOnboardingFlow.tsx b/desktop/src/features/onboarding/ui/CommunityOnboardingFlow.tsx index 4b729ab33f..98210c57cd 100644 --- a/desktop/src/features/onboarding/ui/CommunityOnboardingFlow.tsx +++ b/desktop/src/features/onboarding/ui/CommunityOnboardingFlow.tsx @@ -160,6 +160,7 @@ export function CommunityOnboardingFlow({ [], ); const [isPending, setIsPending] = React.useState(false); + const checkedProfileTransactionRef = React.useRef(null); const [starterChannelFailureCount, setStarterChannelFailureCount] = React.useState(0); const [deniedPubkey, setDeniedPubkey] = React.useState(""); @@ -283,6 +284,22 @@ export function CommunityOnboardingFlow({ }, [isPending, update]); const isProfileStage = transaction?.stage === "profile"; + React.useEffect(() => { + if (!isProfileStage || !transaction) return; + if (checkedProfileTransactionRef.current === transaction.id) return; + + checkedProfileTransactionRef.current = transaction.id; + void getProfile() + .then((profile) => { + if (profile.hasProfileEvent) { + update({ stage: "team-intro", error: undefined }, transaction.id); + } + }) + .catch(() => { + // Discovery is best-effort. Staying on the profile step preserves the + // existing path when the relay cannot answer the lookup. + }); + }, [isProfileStage, transaction, update]); const isTeamStage = transaction?.stage === "team-intro" || transaction?.stage === "finalizing" || diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 73b564429a..d15f2269d3 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -277,6 +277,8 @@ type E2eConfig = { channelWindowDelayMs?: number; profileReadDelayMs?: number; profileReadError?: string; + /** Override whether get_profile reports a real kind:0 event. */ + profileHasEvent?: boolean; profileUpdateError?: string; profileUpdateErrors?: string[]; searchProfiles?: MockSearchProfileSeed[]; @@ -5378,6 +5380,13 @@ async function handleGetChannels(config: E2eConfig | undefined) { async function handleGetProfile(config: E2eConfig | undefined) { const identity = getIdentity(config); + const forcedHasProfileEvent = config?.mock?.profileHasEvent; + if (forcedHasProfileEvent !== undefined) { + return { + ...cloneProfile(ensureMockProfile(config)), + has_profile_event: forcedHasProfileEvent, + }; + } if (!identity) { const profileReadDelayMs = config?.mock?.profileReadDelayMs ?? 0; if (profileReadDelayMs > 0) { diff --git a/desktop/tests/e2e/onboarding.spec.ts b/desktop/tests/e2e/onboarding.spec.ts index 0c4d630994..3f6a79dd7b 100644 --- a/desktop/tests/e2e/onboarding.spec.ts +++ b/desktop/tests/e2e/onboarding.spec.ts @@ -1280,6 +1280,66 @@ test("first-community direct join reaches profile", async ({ page }) => { .toEqual({ communityCount: 1, transactionMatchesOnlyCommunity: true }); }); +test("community onboarding reuses an existing relay profile", async ({ + page, +}) => { + await seedActiveIdentity(page, BLANK_TYLER_IDENTITY); + await page.addInitScript( + ({ pubkey, transactionStorageKey }) => { + window.localStorage.setItem( + `buzz-machine-onboarding-complete.v2:${pubkey}`, + "true", + ); + const timestamp = new Date().toISOString(); + window.localStorage.setItem( + transactionStorageKey, + JSON.stringify({ + id: "txn-existing-profile", + source: "add-community", + stage: "profile", + relayUrl: "wss://onboarding.communities.buzz.xyz", + communityName: "Onboarding", + communityId: "e2e-default-community", + createdAt: timestamp, + updatedAt: timestamp, + }), + ); + }, + { + pubkey: BLANK_TYLER_IDENTITY.pubkey, + transactionStorageKey: COMMUNITY_ONBOARDING_TRANSACTION_STORAGE_KEY, + }, + ); + await installMockBridge( + page, + { profileHasEvent: true }, + { + relayWsUrl: "wss://onboarding.communities.buzz.xyz", + skipOnboardingSeed: true, + }, + ); + await page.goto("/"); + + await expect + .poll(() => + page.evaluate( + () => + ( + window as Window & { __BUZZ_E2E_COMMANDS__?: string[] } + ).__BUZZ_E2E_COMMANDS__?.filter( + (command) => command === "get_profile", + ).length ?? 0, + ), + ) + .toBeGreaterThan(0); + await expect( + page.getByRole("heading", { name: "Meet your starter team" }), + ).toBeVisible(); + await expect( + page.getByRole("heading", { name: "Build your profile" }), + ).toHaveCount(0); +}); + test("first-community direct join cancel returns to request access", async ({ page, }) => { diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index ca4d62ddd6..b48a75914b 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -268,6 +268,8 @@ type MockBridgeOptions = { channelWindowDelayMs?: number; profileReadDelayMs?: number; profileReadError?: string; + /** Override whether get_profile reports a real kind:0 event. */ + profileHasEvent?: boolean; profileUpdateError?: string; profileUpdateErrors?: string[]; searchProfiles?: MockSearchProfileSeed[]; From bd0bff24bfd2cffa2b3b3a995f7628af5e460a5c Mon Sep 17 00:00:00 2001 From: Taylor Ho Date: Thu, 30 Jul 2026 11:15:39 -0700 Subject: [PATCH 080/112] feat(desktop): add password-protected backups in settings (#3701) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Category:** new-feature **User Impact:** Users can create, download, and verify a password-protected backup of their private identity from desktop Settings. **Problem:** Buzz does not currently give signed-in users a Settings-based path to protect or validate their private identity independently of onboarding. **Solution:** Add a focused backup menu to the private-key row, keep encryption and verification local in Rust, and preserve completed encrypted backups briefly so native saves can be retried without repeating encryption.
File changes **desktop/src/features/settings/** Adds the background backup lifecycle, create and test dialogs, private-key menu integration, password handling, and focused unit coverage. **desktop/src/features/onboarding/ui/NsecMaskedDisplay.tsx** Extends the masked private-key display with reusable overflow-menu actions used by Settings. **desktop/src/app/App.tsx** Mounts the backup provider at app scope so encryption and save work survive closing Settings or the modal. **desktop/src/shared/api/tauriIdentity.ts** Adds typed desktop bindings for local backup creation, save, selection, and verification. **desktop/src-tauri/src/key_backup.rs and desktop/src-tauri/src/commands/identity.rs** Implements local NIP-49 encryption, password generation, file handling, and public-identity-only verification results. **desktop/src-tauri/src/egress_guard.rs and guarded call sites** Blocks encrypted secret material from relay, websocket, snapshot, sharing, and huddle egress paths. **desktop/src-tauri tests and fixtures** Covers encryption, verification, file behavior, and fail-closed no-egress protections. **desktop/src/testing/e2eBridge.ts, desktop/tests/, and desktop/playwright.config.ts** Expands the mock native bridge and browser coverage across create, retry, expiry, and current/different-identity verification states. **desktop/src-tauri/Cargo.toml, Cargo.lock, and assets** Adds the local cryptography/password-generation dependencies and embedded short-word list.
## Reproduction steps 1. Run the desktop app and open **Settings → Profile → Identity**. 2. Open the private-key overflow menu and choose **Create backup**. 3. Enter or generate a valid password, submit, and confirm progress continues if the dialog or Settings is closed. 4. Save the resulting `.ncryptsec` file; cancel and retry to confirm the temporary download remains available. 5. Choose **Test backup**, select the file, enter a wrong password, then retry with the correct password. 6. Confirm success identifies whether the backup matches the current identity and displays only the public `npub`. ## Screenshots | Settings identity | Private-key menu | Create backup | |---|---|---| | image | image | image | | Encrypting | Download available | Test success | |---|---|---| | image | image | image | Visual review and additional states: [Buzz thread](buzz://message?channel=50ca7ef1-201e-4159-9499-40de3964b7c3&id=87eceb5f0f82fd50c32e560de3d35be48e293760f6620718aafdcef289d475fe) --------- Signed-off-by: Taylor Ho Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> --- desktop/playwright.config.ts | 1 + desktop/src-tauri/Cargo.lock | 1 + desktop/src-tauri/Cargo.toml | 5 +- .../src/assets/eff_short_wordlist_2_0.txt | 1296 +++++++++++++++++ desktop/src-tauri/src/commands/export_util.rs | 34 +- desktop/src-tauri/src/commands/identity.rs | 141 ++ .../src/commands/identity_key_backup_tests.rs | 139 ++ .../src/commands/personas/snapshot/import.rs | 33 +- .../src-tauri/src/commands/team_snapshot.rs | 4 +- .../src/commands/team_snapshot/tests.rs | 28 + desktop/src-tauri/src/egress_guard.rs | 58 + desktop/src-tauri/src/egress_guard_tests.rs | 446 ++++++ desktop/src-tauri/src/huddle/pipeline.rs | 24 +- desktop/src-tauri/src/key_backup.rs | 187 +++ desktop/src-tauri/src/key_backup_tests.rs | 155 ++ desktop/src-tauri/src/lib.rs | 6 + desktop/src-tauri/src/native_websocket.rs | 20 +- desktop/src-tauri/src/relay.rs | 2 + desktop/src-tauri/src/relay/submit.rs | 1 + desktop/src/app/App.tsx | 16 +- .../onboarding/ui/NsecMaskedDisplay.tsx | 100 +- .../settings/EncryptedBackupProvider.tsx | 251 ++++ .../settings/lib/encryptedBackup.test.mjs | 133 ++ .../features/settings/lib/encryptedBackup.ts | 143 ++ .../features/settings/ui/BackupTestFlow.tsx | 459 ++++++ .../settings/ui/EncryptedBackupCreator.tsx | 375 +++++ .../settings/ui/PrivateKeyBackupRow.tsx | 215 +++ .../settings/ui/ProfileSettingsCard.tsx | 93 +- desktop/src/shared/api/tauriIdentity.ts | 49 + desktop/src/testing/e2eBridge.ts | 49 +- .../tests/e2e/profile-backup-settings.spec.ts | 259 ++++ desktop/tests/helpers/bridge.ts | 8 + 32 files changed, 4599 insertions(+), 132 deletions(-) create mode 100644 desktop/src-tauri/src/assets/eff_short_wordlist_2_0.txt create mode 100644 desktop/src-tauri/src/commands/identity_key_backup_tests.rs create mode 100644 desktop/src-tauri/src/egress_guard.rs create mode 100644 desktop/src-tauri/src/egress_guard_tests.rs create mode 100644 desktop/src-tauri/src/key_backup.rs create mode 100644 desktop/src-tauri/src/key_backup_tests.rs create mode 100644 desktop/src/features/settings/EncryptedBackupProvider.tsx create mode 100644 desktop/src/features/settings/lib/encryptedBackup.test.mjs create mode 100644 desktop/src/features/settings/lib/encryptedBackup.ts create mode 100644 desktop/src/features/settings/ui/BackupTestFlow.tsx create mode 100644 desktop/src/features/settings/ui/EncryptedBackupCreator.tsx create mode 100644 desktop/src/features/settings/ui/PrivateKeyBackupRow.tsx create mode 100644 desktop/tests/e2e/profile-backup-settings.spec.ts diff --git a/desktop/playwright.config.ts b/desktop/playwright.config.ts index c79ef1bf9d..b86406d9b0 100644 --- a/desktop/playwright.config.ts +++ b/desktop/playwright.config.ts @@ -119,6 +119,7 @@ export default defineConfig({ "**/nostr-bind.spec.ts", "**/mobile-pairing-qr.spec.ts", "**/profile-nsec-reveal.spec.ts", + "**/profile-backup-settings.spec.ts", "**/signout-confirmation.spec.ts", "**/agent-provider-dropdowns.spec.ts", "**/agent-lifecycle-feedback.spec.ts", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index cd0fabb69f..325eb9aa67 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1045,6 +1045,7 @@ dependencies = [ "ed25519-dalek", "flate2", "futures-util", + "getrandom 0.2.17", "hex", "image", "infer", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 735a45c3b7..6f3c03c5a5 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -86,7 +86,10 @@ serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yaml = "0.9" toml = "0.8" -nostr = { version = "0.44", features = ["nip44"] } +nostr = { version = "0.44", features = ["nip44", "nip49"] } +# OS-entropy source for backup passphrase generation (already in the tree as a +# transitive dependency; pinned here for direct use). +getrandom = "0.2" zeroize = "1" reqwest = { version = "0.13", features = ["json", "query", "stream", "blocking"] } rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs", "std"] } diff --git a/desktop/src-tauri/src/assets/eff_short_wordlist_2_0.txt b/desktop/src-tauri/src/assets/eff_short_wordlist_2_0.txt new file mode 100644 index 0000000000..9ac732fe36 --- /dev/null +++ b/desktop/src-tauri/src/assets/eff_short_wordlist_2_0.txt @@ -0,0 +1,1296 @@ +aardvark +abandoned +abbreviate +abdomen +abhorrence +abiding +abnormal +abrasion +absorbing +abundant +abyss +academy +accountant +acetone +achiness +acid +acoustics +acquire +acrobat +actress +acuteness +aerosol +aesthetic +affidavit +afloat +afraid +aftershave +again +agency +aggressor +aghast +agitate +agnostic +agonizing +agreeing +aidless +aimlessly +ajar +alarmclock +albatross +alchemy +alfalfa +algae +aliens +alkaline +almanac +alongside +alphabet +already +also +altitude +aluminum +always +amazingly +ambulance +amendment +amiable +ammunition +amnesty +amoeba +amplifier +amuser +anagram +anchor +android +anesthesia +angelfish +animal +anklet +announcer +anonymous +answer +antelope +anxiety +anyplace +aorta +apartment +apnea +apostrophe +apple +apricot +aquamarine +arachnid +arbitrate +ardently +arena +argument +aristocrat +armchair +aromatic +arrowhead +arsonist +artichoke +asbestos +ascend +aseptic +ashamed +asinine +asleep +asocial +asparagus +astronaut +asymmetric +atlas +atmosphere +atom +atrocious +attic +atypical +auctioneer +auditorium +augmented +auspicious +automobile +auxiliary +avalanche +avenue +aviator +avocado +awareness +awhile +awkward +awning +awoke +axially +azalea +babbling +backpack +badass +bagpipe +bakery +balancing +bamboo +banana +barracuda +basket +bathrobe +bazooka +blade +blender +blimp +blouse +blurred +boatyard +bobcat +body +bogusness +bohemian +boiler +bonnet +boots +borough +bossiness +bottle +bouquet +boxlike +breath +briefcase +broom +brushes +bubblegum +buckle +buddhist +buffalo +bullfrog +bunny +busboy +buzzard +cabin +cactus +cadillac +cafeteria +cage +cahoots +cajoling +cakewalk +calculator +camera +canister +capsule +carrot +cashew +cathedral +caucasian +caviar +ceasefire +cedar +celery +cement +census +ceramics +cesspool +chalkboard +cheesecake +chimney +chlorine +chopsticks +chrome +chute +cilantro +cinnamon +circle +cityscape +civilian +clay +clergyman +clipboard +clock +clubhouse +coathanger +cobweb +coconut +codeword +coexistent +coffeecake +cognitive +cohabitate +collarbone +computer +confetti +copier +cornea +cosmetics +cotton +couch +coverless +coyote +coziness +crawfish +crewmember +crib +croissant +crumble +crystal +cubical +cucumber +cuddly +cufflink +cuisine +culprit +cup +curry +cushion +cuticle +cybernetic +cyclist +cylinder +cymbal +cynicism +cypress +cytoplasm +dachshund +daffodil +dagger +dairy +dalmatian +dandelion +dartboard +dastardly +datebook +daughter +dawn +daytime +dazzler +dealer +debris +decal +dedicate +deepness +defrost +degree +dehydrator +deliverer +democrat +dentist +deodorant +depot +deranged +desktop +detergent +device +dexterity +diamond +dibs +dictionary +diffuser +digit +dilated +dimple +dinnerware +dioxide +diploma +directory +dishcloth +ditto +dividers +dizziness +doctor +dodge +doll +dominoes +donut +doorstep +dorsal +double +downstairs +dozed +drainpipe +dresser +driftwood +droppings +drum +dryer +dubiously +duckling +duffel +dugout +dumpster +duplex +durable +dustpan +dutiful +duvet +dwarfism +dwelling +dwindling +dynamite +dyslexia +eagerness +earlobe +easel +eavesdrop +ebook +eccentric +echoless +eclipse +ecosystem +ecstasy +edged +editor +educator +eelworm +eerie +effects +eggnog +egomaniac +ejection +elastic +elbow +elderly +elephant +elfishly +eliminator +elk +elliptical +elongated +elsewhere +elusive +elves +emancipate +embroidery +emcee +emerald +emission +emoticon +emperor +emulate +enactment +enchilada +endorphin +energy +enforcer +engine +enhance +enigmatic +enjoyably +enlarged +enormous +enquirer +enrollment +ensemble +entryway +enunciate +envoy +enzyme +epidemic +equipment +erasable +ergonomic +erratic +eruption +escalator +eskimo +esophagus +espresso +essay +estrogen +etching +eternal +ethics +etiquette +eucalyptus +eulogy +euphemism +euthanize +evacuation +evergreen +evidence +evolution +exam +excerpt +exerciser +exfoliate +exhale +exist +exorcist +explode +exquisite +exterior +exuberant +fabric +factory +faded +failsafe +falcon +family +fanfare +fasten +faucet +favorite +feasibly +february +federal +feedback +feigned +feline +femur +fence +ferret +festival +fettuccine +feudalist +feverish +fiberglass +fictitious +fiddle +figurine +fillet +finalist +fiscally +fixture +flashlight +fleshiness +flight +florist +flypaper +foamless +focus +foggy +folksong +fondue +footpath +fossil +fountain +fox +fragment +freeway +fridge +frosting +fruit +fryingpan +gadget +gainfully +gallstone +gamekeeper +gangway +garlic +gaslight +gathering +gauntlet +gearbox +gecko +gem +generator +geographer +gerbil +gesture +getaway +geyser +ghoulishly +gibberish +giddiness +giftshop +gigabyte +gimmick +giraffe +giveaway +gizmo +glasses +gleeful +glisten +glove +glucose +glycerin +gnarly +gnomish +goatskin +goggles +goldfish +gong +gooey +gorgeous +gosling +gothic +gourmet +governor +grape +greyhound +grill +groundhog +grumbling +guacamole +guerrilla +guitar +gullible +gumdrop +gurgling +gusto +gutless +gymnast +gynecology +gyration +habitat +hacking +haggard +haiku +halogen +hamburger +handgun +happiness +hardhat +hastily +hatchling +haughty +hazelnut +headband +hedgehog +hefty +heinously +helmet +hemoglobin +henceforth +herbs +hesitation +hexagon +hubcap +huddling +huff +hugeness +hullabaloo +human +hunter +hurricane +hushing +hyacinth +hybrid +hydrant +hygienist +hypnotist +ibuprofen +icepack +icing +iconic +identical +idiocy +idly +igloo +ignition +iguana +illuminate +imaging +imbecile +imitator +immigrant +imprint +iodine +ionosphere +ipad +iphone +iridescent +irksome +iron +irrigation +island +isotope +issueless +italicize +itemizer +itinerary +itunes +ivory +jabbering +jackrabbit +jaguar +jailhouse +jalapeno +jamboree +janitor +jarring +jasmine +jaundice +jawbreaker +jaywalker +jazz +jealous +jeep +jelly +jeopardize +jersey +jetski +jezebel +jiffy +jigsaw +jingling +jobholder +jockstrap +jogging +john +joinable +jokingly +journal +jovial +joystick +jubilant +judiciary +juggle +juice +jujitsu +jukebox +jumpiness +junkyard +juror +justifying +juvenile +kabob +kamikaze +kangaroo +karate +kayak +keepsake +kennel +kerosene +ketchup +khaki +kickstand +kilogram +kimono +kingdom +kiosk +kissing +kite +kleenex +knapsack +kneecap +knickers +koala +krypton +laboratory +ladder +lakefront +lantern +laptop +laryngitis +lasagna +latch +laundry +lavender +laxative +lazybones +lecturer +leftover +leggings +leisure +lemon +length +leopard +leprechaun +lettuce +leukemia +levers +lewdness +liability +library +licorice +lifeboat +lightbulb +likewise +lilac +limousine +lint +lioness +lipstick +liquid +listless +litter +liverwurst +lizard +llama +luau +lubricant +lucidity +ludicrous +luggage +lukewarm +lullaby +lumberjack +lunchbox +luridness +luscious +luxurious +lyrics +macaroni +maestro +magazine +mahogany +maimed +majority +makeover +malformed +mammal +mango +mapmaker +marbles +massager +matchstick +maverick +maximum +mayonnaise +moaning +mobilize +moccasin +modify +moisture +molecule +momentum +monastery +moonshine +mortuary +mosquito +motorcycle +mousetrap +movie +mower +mozzarella +muckiness +mudflow +mugshot +mule +mummy +mundane +muppet +mural +mustard +mutation +myriad +myspace +myth +nail +namesake +nanosecond +napkin +narrator +nastiness +natives +nautically +navigate +nearest +nebula +nectar +nefarious +negotiator +neither +nemesis +neoliberal +nephew +nervously +nest +netting +neuron +nevermore +nextdoor +nicotine +niece +nimbleness +nintendo +nirvana +nuclear +nugget +nuisance +nullify +numbing +nuptials +nursery +nutcracker +nylon +oasis +oat +obediently +obituary +object +obliterate +obnoxious +observer +obtain +obvious +occupation +oceanic +octopus +ocular +office +oftentimes +oiliness +ointment +older +olympics +omissible +omnivorous +oncoming +onion +onlooker +onstage +onward +onyx +oomph +opaquely +opera +opium +opossum +opponent +optical +opulently +oscillator +osmosis +ostrich +otherwise +ought +outhouse +ovation +oven +owlish +oxford +oxidize +oxygen +oyster +ozone +pacemaker +padlock +pageant +pajamas +palm +pamphlet +pantyhose +paprika +parakeet +passport +patio +pauper +pavement +payphone +pebble +peculiarly +pedometer +pegboard +pelican +penguin +peony +pepperoni +peroxide +pesticide +petroleum +pewter +pharmacy +pheasant +phonebook +phrasing +physician +plank +pledge +plotted +plug +plywood +pneumonia +podiatrist +poetic +pogo +poison +poking +policeman +poncho +popcorn +porcupine +postcard +poultry +powerboat +prairie +pretzel +princess +propeller +prune +pry +pseudo +psychopath +publisher +pucker +pueblo +pulley +pumpkin +punchbowl +puppy +purse +pushup +putt +puzzle +pyramid +python +quarters +quesadilla +quilt +quote +racoon +radish +ragweed +railroad +rampantly +rancidity +rarity +raspberry +ravishing +rearrange +rebuilt +receipt +reentry +refinery +register +rehydrate +reimburse +rejoicing +rekindle +relic +remote +renovator +reopen +reporter +request +rerun +reservoir +retriever +reunion +revolver +rewrite +rhapsody +rhetoric +rhino +rhubarb +rhyme +ribbon +riches +ridden +rigidness +rimmed +riptide +riskily +ritzy +riverboat +roamer +robe +rocket +romancer +ropelike +rotisserie +roundtable +royal +rubber +rudderless +rugby +ruined +rulebook +rummage +running +rupture +rustproof +sabotage +sacrifice +saddlebag +saffron +sainthood +saltshaker +samurai +sandworm +sapphire +sardine +sassy +satchel +sauna +savage +saxophone +scarf +scenario +schoolbook +scientist +scooter +scrapbook +sculpture +scythe +secretary +sedative +segregator +seismology +selected +semicolon +senator +septum +sequence +serpent +sesame +settler +severely +shack +shelf +shirt +shovel +shrimp +shuttle +shyness +siamese +sibling +siesta +silicon +simmering +singles +sisterhood +sitcom +sixfold +sizable +skateboard +skeleton +skies +skulk +skylight +slapping +sled +slingshot +sloth +slumbering +smartphone +smelliness +smitten +smokestack +smudge +snapshot +sneezing +sniff +snowsuit +snugness +speakers +sphinx +spider +splashing +sponge +sprout +spur +spyglass +squirrel +statue +steamboat +stingray +stopwatch +strawberry +student +stylus +suave +subway +suction +suds +suffocate +sugar +suitcase +sulphur +superstore +surfer +sushi +swan +sweatshirt +swimwear +sword +sycamore +syllable +symphony +synagogue +syringes +systemize +tablespoon +taco +tadpole +taekwondo +tagalong +takeout +tallness +tamale +tanned +tapestry +tarantula +tastebud +tattoo +tavern +thaw +theater +thimble +thorn +throat +thumb +thwarting +tiara +tidbit +tiebreaker +tiger +timid +tinsel +tiptoeing +tirade +tissue +tractor +tree +tripod +trousers +trucks +tryout +tubeless +tuesday +tugboat +tulip +tumbleweed +tupperware +turtle +tusk +tutorial +tuxedo +tweezers +twins +tyrannical +ultrasound +umbrella +umpire +unarmored +unbuttoned +uncle +underwear +unevenness +unflavored +ungloved +unhinge +unicycle +unjustly +unknown +unlocking +unmarked +unnoticed +unopened +unpaved +unquenched +unroll +unscrewing +untied +unusual +unveiled +unwrinkled +unyielding +unzip +upbeat +upcountry +update +upfront +upgrade +upholstery +upkeep +upload +uppercut +upright +upstairs +uptown +upwind +uranium +urban +urchin +urethane +urgent +urologist +username +usher +utensil +utility +utmost +utopia +utterance +vacuum +vagrancy +valuables +vanquished +vaporizer +varied +vaseline +vegetable +vehicle +velcro +vendor +vertebrae +vestibule +veteran +vexingly +vicinity +videogame +viewfinder +vigilante +village +vinegar +violin +viperfish +virus +visor +vitamins +vivacious +vixen +vocalist +vogue +voicemail +volleyball +voucher +voyage +vulnerable +waffle +wagon +wakeup +walrus +wanderer +wasp +water +waving +wheat +whisper +wholesaler +wick +widow +wielder +wifeless +wikipedia +wildcat +windmill +wipeout +wired +wishbone +wizardry +wobbliness +wolverine +womb +woolworker +workbasket +wound +wrangle +wreckage +wristwatch +wrongdoing +xerox +xylophone +yacht +yahoo +yard +yearbook +yesterday +yiddish +yield +yo-yo +yodel +yogurt +yuppie +zealot +zebra +zeppelin +zestfully +zigzagged +zillion +zipping +zirconium +zodiac +zombie +zookeeper +zucchini diff --git a/desktop/src-tauri/src/commands/export_util.rs b/desktop/src-tauri/src/commands/export_util.rs index 806f58d739..ded14679c1 100644 --- a/desktop/src-tauri/src/commands/export_util.rs +++ b/desktop/src-tauri/src/commands/export_util.rs @@ -1,16 +1,14 @@ use tauri::AppHandle; use tauri_plugin_dialog::DialogExt; -/// Show a save-file dialog with a custom filter and write `data` to the chosen -/// path. Returns `Ok(true)` when the file was written, `Ok(false)` when the -/// user cancelled the dialog. -pub async fn save_bytes_with_dialog( +/// Show a save-file dialog with a custom filter and return the chosen path, +/// or `None` when the user cancelled. Selection only — no write. +pub async fn pick_save_path( app: &AppHandle, suggested_filename: &str, filter_name: &str, extensions: &[&str], - data: &[u8], -) -> Result { +) -> Result, String> { let (tx, rx) = tokio::sync::oneshot::channel(); app.dialog() .file() @@ -23,12 +21,34 @@ pub async fn save_bytes_with_dialog( let selected = rx.await.map_err(|_| "dialog cancelled".to_string())?; let file_path = match selected { Some(p) => p, - None => return Ok(false), + None => return Ok(None), }; let dest = file_path .as_path() .ok_or_else(|| "Save dialog returned an invalid path".to_string())?; + Ok(Some(dest.to_path_buf())) +} + +/// Show a save-file dialog with a custom filter and write `data` to the chosen +/// path. Returns `Ok(true)` when the file was written, `Ok(false)` when the +/// user cancelled the dialog. +/// +/// NOT for secrets: the write is plain `std::fs::write` (no atomic commit, no +/// 0o600). Secret exports go through `pick_save_path` + +/// `key_backup::write_backup_file`. +pub async fn save_bytes_with_dialog( + app: &AppHandle, + suggested_filename: &str, + filter_name: &str, + extensions: &[&str], + data: &[u8], +) -> Result { + let dest = match pick_save_path(app, suggested_filename, filter_name, extensions).await? { + Some(p) => p, + None => return Ok(false), + }; + std::fs::write(dest, data).map_err(|e| format!("Failed to write file: {e}"))?; Ok(true) diff --git a/desktop/src-tauri/src/commands/identity.rs b/desktop/src-tauri/src/commands/identity.rs index 2840c0ade6..142e3bac88 100644 --- a/desktop/src-tauri/src/commands/identity.rs +++ b/desktop/src-tauri/src/commands/identity.rs @@ -194,6 +194,143 @@ pub fn get_nsec(state: State<'_, AppState>) -> Result { .map_err(|error| format!("encode nsec: {error}")) } +/// Generate a passphrase for a new encrypted backup (EFF short wordlist, OS +/// entropy). `words` is clamped to the range allowed by `key_backup`; +/// `separator` joins the words (defaults to a space). +#[tauri::command] +pub fn generate_backup_passphrase( + words: Option, + separator: Option, +) -> Result { + crate::key_backup::generate_passphrase( + words.map_or(crate::key_backup::DEFAULT_PASSPHRASE_WORDS, |w| w as usize), + separator.as_deref().unwrap_or(" "), + ) +} + +/// Core of [`create_ncryptsec_backup`], factored so tests can drive it with a +/// bare `AppState` + temp dir (and a fast scrypt tier) without an `AppHandle`. +pub(crate) fn create_backup_with_log_n( + state: &AppState, + password: &str, + log_n: u8, +) -> Result { + if password.chars().count() < crate::key_backup::MIN_PASSPHRASE_LEN { + return Err(format!( + "passphrase must be at least {} characters", + crate::key_backup::MIN_PASSPHRASE_LEN + )); + } + + // Serialize against import_identity/persist_current_identity: the blob + // must be derived from — and persisted for — one stable identity. Also + // caps KDF concurrency at one. + let _mutation_guard = state.identity_mutation.lock().map_err(|e| e.to_string())?; + + // Recovery mode (lost/locked) → Err, same gate as signing. + let keys = state.signing_keys()?; + + crate::key_backup::create_backup_blob(&keys, password, log_n) +} + +/// Create a NIP-49 backup of the live identity in memory. +/// +/// Encrypts under `password`, decrypt-verifies the fresh blob against the live +/// pubkey, and returns the `ncryptsec1…` string for the native save flow. The +/// body runs under `identity_mutation`, so identity changes cannot race the KDF. +#[tauri::command] +pub async fn create_ncryptsec_backup( + password: String, + app_handle: tauri::AppHandle, +) -> Result { + tokio::task::spawn_blocking(move || { + let password = zeroize::Zeroizing::new(password); + let state = app_handle.state::(); + create_backup_with_log_n(&state, &password, crate::key_backup::BACKUP_LOG_N) + }) + .await + .map_err(|e| format!("spawn_blocking failed: {e}"))? +} + +#[derive(Debug, serde::Serialize)] +#[serde(rename_all = "camelCase")] +pub struct BackupVerification { + pub pubkey: String, + pub npub: String, + pub matches_current_identity: bool, +} + +fn verify_ncryptsec_backup_inner( + state: &AppState, + ncryptsec: &str, + password: &str, +) -> Result { + let keys = crate::key_backup::decrypt_ncryptsec(ncryptsec, password)?; + let pubkey = keys.public_key(); + let current = state.signing_keys()?.public_key(); + Ok(BackupVerification { + pubkey: pubkey.to_hex(), + npub: pubkey + .to_bech32() + .map_err(|e| format!("encode backup identity: {e}"))?, + matches_current_identity: pubkey == current, + }) +} + +/// Decrypt and validate a NIP-49 backup without exposing its secret key. +#[tauri::command] +pub async fn verify_ncryptsec_backup( + ncryptsec: String, + password: String, + app_handle: tauri::AppHandle, +) -> Result { + tokio::task::spawn_blocking(move || { + let password = zeroize::Zeroizing::new(password); + let state = app_handle.state::(); + verify_ncryptsec_backup_inner(&state, &ncryptsec, &password) + }) + .await + .map_err(|e| format!("spawn_blocking failed: {e}"))? +} + +/// Save a portable copy of an `ncryptsec1…` backup to a user-chosen path. +/// +/// The input must parse as a structurally valid NIP-49 payload. The dialog is +/// selection-only; the write uses secret-file semantics (atomic + 0o600). +/// Never mutates canonical app state. Returns the chosen path, or `None` when +/// the user cancelled. +#[tauri::command] +pub async fn save_ncryptsec_copy( + ncryptsec: String, + app_handle: tauri::AppHandle, +) -> Result, String> { + // Reject anything that is not a valid encrypted-key blob — this command + // must not become a generic file writer. + crate::key_backup::parse_ncryptsec(&ncryptsec)?; + let normalized = ncryptsec.trim().to_string(); + + let dest = match crate::commands::export_util::pick_save_path( + &app_handle, + crate::key_backup::BACKUP_FILE_NAME, + "Password-protected key backup", + &["ncryptsec"], + ) + .await? + { + Some(p) => p, + None => return Ok(None), + }; + + let dest_for_write = dest.clone(); + tokio::task::spawn_blocking(move || { + crate::key_backup::write_backup_file(&dest_for_write, &normalized) + }) + .await + .map_err(|e| format!("spawn_blocking failed: {e}"))??; + + Ok(Some(dest.display().to_string())) +} + #[tauri::command] pub async fn import_identity( nsec: String, @@ -589,3 +726,7 @@ mod nostr_identity_binding_tests { assert_eq!(error, "expires_at is expired"); } } + +#[cfg(test)] +#[path = "identity_key_backup_tests.rs"] +mod identity_key_backup_tests; diff --git a/desktop/src-tauri/src/commands/identity_key_backup_tests.rs b/desktop/src-tauri/src/commands/identity_key_backup_tests.rs new file mode 100644 index 0000000000..c36af66879 --- /dev/null +++ b/desktop/src-tauri/src/commands/identity_key_backup_tests.rs @@ -0,0 +1,139 @@ +use super::{create_backup_with_log_n, verify_ncryptsec_backup_inner}; +use crate::app_state::build_app_state; +use nostr::{Keys, ToBech32}; + +/// Fast scrypt tier for tests; production uses BACKUP_LOG_N (18), covered +/// once in key_backup_tests::round_trip_at_production_cost. +const FAST_LOG_N: u8 = 16; +const PASSWORD: &str = "correct horse battery"; + +#[test] +fn verification_returns_only_public_identity_and_match_status() { + let state = build_app_state(); + let backup = create_backup_with_log_n(&state, PASSWORD, FAST_LOG_N).unwrap(); + let result = verify_ncryptsec_backup_inner(&state, &backup, PASSWORD).unwrap(); + assert_eq!( + result.pubkey, + state.keys.lock().unwrap().public_key().to_hex() + ); + assert!(result.npub.starts_with("npub1")); + assert!(result.matches_current_identity); +} + +#[test] +fn verification_reports_valid_backup_for_a_different_identity() { + let state = build_app_state(); + let other = Keys::generate(); + let backup = crate::key_backup::create_backup_blob(&other, PASSWORD, FAST_LOG_N).unwrap(); + let result = verify_ncryptsec_backup_inner(&state, &backup, PASSWORD).unwrap(); + assert_eq!(result.pubkey, other.public_key().to_hex()); + assert!(!result.matches_current_identity); +} + +#[test] +fn verification_rejects_wrong_password() { + let state = build_app_state(); + let backup = + crate::key_backup::create_backup_blob(&Keys::generate(), PASSWORD, FAST_LOG_N).unwrap(); + assert_eq!( + verify_ncryptsec_backup_inner(&state, &backup, "wrong password").unwrap_err(), + "wrong backup password or damaged key backup" + ); +} + +#[test] +fn verification_accepts_maximum_supported_kdf_cost() { + let state = build_app_state(); + let backup = crate::key_backup::create_backup_blob( + &Keys::generate(), + PASSWORD, + crate::key_backup::MAX_VERIFY_LOG_N, + ) + .unwrap(); + verify_ncryptsec_backup_inner(&state, &backup, PASSWORD).unwrap(); +} + +#[test] +fn verification_rejects_unsupported_kdf_cost_before_decryption() { + let state = build_app_state(); + let supported = + crate::key_backup::create_backup_blob(&Keys::generate(), PASSWORD, FAST_LOG_N).unwrap(); + let encrypted = crate::key_backup::parse_ncryptsec(&supported).unwrap(); + let mut payload = encrypted.as_vec(); + payload[1] = crate::key_backup::MAX_VERIFY_LOG_N + 1; + let unsupported = nostr::nips::nip49::EncryptedSecretKey::from_slice(&payload) + .unwrap() + .to_bech32() + .unwrap(); + + let err = verify_ncryptsec_backup_inner(&state, &unsupported, PASSWORD).unwrap_err(); + assert_eq!( + err, + format!( + "unsupported backup KDF cost: log_n {} exceeds maximum {}", + crate::key_backup::MAX_VERIFY_LOG_N + 1, + crate::key_backup::MAX_VERIFY_LOG_N + ) + ); +} + +#[test] +fn rejects_short_passphrase() { + let state = build_app_state(); + let err = create_backup_with_log_n(&state, "short", FAST_LOG_N).unwrap_err(); + assert!(err.contains("at least"), "{err}"); +} + +#[test] +fn recovery_mode_blocks_backup_creation() { + let state = build_app_state(); + + state + .identity_lost + .store(true, std::sync::atomic::Ordering::Release); + assert!( + create_backup_with_log_n(&state, PASSWORD, FAST_LOG_N).is_err(), + "lost identity must not be backed up" + ); + state + .identity_lost + .store(false, std::sync::atomic::Ordering::Release); + + state + .keyring_locked + .store(true, std::sync::atomic::Ordering::Release); + assert!( + create_backup_with_log_n(&state, PASSWORD, FAST_LOG_N).is_err(), + "locked keyring must not be backed up" + ); +} + +/// Concurrent identity changes serialize with backup creation. +#[test] +fn concurrent_identity_swap_vs_backup_is_serialized() { + let state = std::sync::Arc::new(build_app_state()); + let key_a = state.keys.lock().unwrap().clone(); + let key_b = Keys::generate(); + + let swapper = { + let state = state.clone(); + let key_b = key_b.clone(); + std::thread::spawn(move || { + // Mirrors import_identity's locking: mutation guard held + // across the key swap. + let _guard = state.identity_mutation.lock().unwrap(); + *state.keys.lock().unwrap() = key_b; + }) + }; + + let backup = create_backup_with_log_n(&state, PASSWORD, FAST_LOG_N).unwrap(); + swapper.join().unwrap(); + + let recovered = crate::key_backup::decrypt_ncryptsec(&backup, PASSWORD) + .unwrap() + .public_key(); + assert!( + recovered == key_a.public_key() || recovered == key_b.public_key(), + "backup must match one coherent identity" + ); +} diff --git a/desktop/src-tauri/src/commands/personas/snapshot/import.rs b/desktop/src-tauri/src/commands/personas/snapshot/import.rs index d23efe7730..eccf8ee601 100644 --- a/desktop/src-tauri/src/commands/personas/snapshot/import.rs +++ b/desktop/src-tauri/src/commands/personas/snapshot/import.rs @@ -685,7 +685,7 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent /// POST a pre-built signed engram event to the relay, authenticating as the /// new agent. -async fn submit_engram_event( +pub(crate) async fn submit_engram_event( state: &AppState, agent_keys: &nostr::Keys, event_json: &[u8], @@ -695,6 +695,8 @@ async fn submit_engram_event( use crate::relay::build_nip98_auth_header_for_keys; use reqwest::Method; + crate::egress_guard::assert_no_key_backup_bytes(event_json, "persona snapshot engram submit")?; + // Wait before signing: the relay enforces NIP-98 freshness (±60s) and the // gate may hold for up to MAX_HINT_SECONDS (300s). Building auth before the // wait produces a stale `created_at` that the relay will reject. @@ -739,6 +741,35 @@ async fn submit_engram_event( Ok(()) } +// ── NIP-49 egress guard: boundary 7 (persona snapshot engram submit) ───────── + +#[cfg(test)] +mod egress_guard_tests { + use super::submit_engram_event; + + const NCRYPTSEC: &str = "ncryptsec1qgg9947rlpvqu76pj5ecreduf9jxhselq2nae2kghhvd5g7dgjtcxfqtd67p9m0w57lspw8gsq6yphnm8623nsl8xn9j4jdzz84zm3frztj3z7s35vpzmqf6ksu8r89qk5z2zxfmu5gv8th8wclt0h4p"; + + /// An engram body carrying an ncryptsec must be rejected by the guard + /// before any network I/O (the target port is a discard address; a guard + /// error — not a connection error — proves the abort ordering). + #[tokio::test] + async fn blocks_ncryptsec_before_network() { + let state = crate::app_state::build_app_state(); + let keys = nostr::Keys::generate(); + let body = format!("{{\"content\":\"{NCRYPTSEC}\"}}"); + let err = submit_engram_event( + &state, + &keys, + body.as_bytes(), + "http://127.0.0.1:9/events", + None, + ) + .await + .unwrap_err(); + assert!(err.contains("key-backup material"), "{err}"); + } +} + #[cfg(test)] mod import_avatar_tests { use super::materialize_import_avatar; diff --git a/desktop/src-tauri/src/commands/team_snapshot.rs b/desktop/src-tauri/src/commands/team_snapshot.rs index 91a0126f58..97cd11933d 100644 --- a/desktop/src-tauri/src/commands/team_snapshot.rs +++ b/desktop/src-tauri/src/commands/team_snapshot.rs @@ -895,7 +895,7 @@ fn retain_agent_pending(app: &AppHandle, state: &AppState, record: &ManagedAgent /// POST a pre-built signed engram event to the relay, authenticating as the /// new agent. Mirrors the same helper in `snapshot::import`. -async fn submit_engram_event( +pub(crate) async fn submit_engram_event( state: &AppState, agent_keys: &nostr::Keys, event_json: &[u8], @@ -905,6 +905,8 @@ async fn submit_engram_event( use crate::relay::build_nip98_auth_header_for_keys; use reqwest::Method; + crate::egress_guard::assert_no_key_backup_bytes(event_json, "team snapshot engram submit")?; + // Wait before signing: the relay enforces NIP-98 freshness (±60s) and the // gate may hold for up to MAX_HINT_SECONDS (300s). Building auth before the // wait produces a stale `created_at` that the relay will reject. diff --git a/desktop/src-tauri/src/commands/team_snapshot/tests.rs b/desktop/src-tauri/src/commands/team_snapshot/tests.rs index 0616411307..c9a6d8812a 100644 --- a/desktop/src-tauri/src/commands/team_snapshot/tests.rs +++ b/desktop/src-tauri/src/commands/team_snapshot/tests.rs @@ -733,3 +733,31 @@ fn full_rollback_at_teams_boundary_absent_agents_store() { assert!(!teams_path.exists()); assert_eq!(errors.len(), 1, "only the teams-write error"); } + +// ── NIP-49 egress guard: boundary 6 (team snapshot engram submit) ──────────── + +mod egress_guard_boundary { + use super::super::submit_engram_event; + + const NCRYPTSEC: &str = "ncryptsec1qgg9947rlpvqu76pj5ecreduf9jxhselq2nae2kghhvd5g7dgjtcxfqtd67p9m0w57lspw8gsq6yphnm8623nsl8xn9j4jdzz84zm3frztj3z7s35vpzmqf6ksu8r89qk5z2zxfmu5gv8th8wclt0h4p"; + + /// An engram body carrying an ncryptsec must be rejected by the guard + /// before any network I/O (the target port is a discard address; a guard + /// error — not a connection error — proves the abort ordering). + #[tokio::test] + async fn blocks_ncryptsec_before_network() { + let state = crate::app_state::build_app_state(); + let keys = nostr::Keys::generate(); + let body = format!("{{\"content\":\"{NCRYPTSEC}\"}}"); + let err = submit_engram_event( + &state, + &keys, + body.as_bytes(), + "http://127.0.0.1:9/events", + None, + ) + .await + .unwrap_err(); + assert!(err.contains("key-backup material"), "{err}"); + } +} diff --git a/desktop/src-tauri/src/egress_guard.rs b/desktop/src-tauri/src/egress_guard.rs new file mode 100644 index 0000000000..db58ddafa0 --- /dev/null +++ b/desktop/src-tauri/src/egress_guard.rs @@ -0,0 +1,58 @@ +//! Relay egress guard for NIP-49 key-backup material. +//! +//! The local `ncryptsec` backup (see [`crate::key_backup`]) must NEVER be +//! transmitted to a relay. This module enforces that contract at runtime, +//! fail-closed, at every relay-bound egress boundary: +//! +//! | # | Boundary | Site | +//! |---|----------|------| +//! | 1 | `submit_signed_event_at_with_keys` (funnel for `submit_event*`) | `relay/submit.rs` | +//! | 2 | `sync_managed_agent_profile` | `relay.rs` | +//! | 3 | pre-signed path into the boundary-1 funnel | `relay/submit.rs` | +//! | 4 | `submit_signed_event_with_keys` | `relay.rs` | +//! | 5 | huddle STT publisher | `huddle/pipeline.rs` | +//! | 6 | `submit_engram_event` (team snapshot) | `commands/team_snapshot.rs` | +//! | 7 | `submit_engram_event` (persona import) | `commands/personas/snapshot/import.rs` | +//! | 8 | native websocket send loop (all webview relay WS) | `native_websocket.rs` | +//! +//! The inventory-completeness test in `egress_guard_tests.rs` asserts that +//! every `/events` URL-construction site in the tree calls this guard, so a +//! new submission path fails the build until it is wired. +//! +//! Scope: `ncryptsec1` only. The raw `nsec` intentionally transits the +//! NIP-44-encrypted pairing session (NIP-AB payload_type "nsec"); guarding it +//! here would break pairing. Raw-key DLP is separate policy work. + +/// Bech32 HRP of NIP-49 encrypted secret keys. +const NCRYPTSEC_PREFIX: &str = "ncryptsec1"; +/// Bech32 also permits an ALL-UPPERCASE encoding of the same payload +/// (BIP-173); an uppercased valid backup decodes identically, so the guard +/// must reject it too. Mixed case is invalid bech32 and cannot decode — a +/// substring matching either all-lower or all-upper prefix covers every +/// decodable form. +const NCRYPTSEC_PREFIX_UPPER: &str = "NCRYPTSEC1"; + +/// Reject `text` if it contains NIP-49 key-backup material. +/// +/// Returns `Err` when an `ncryptsec1…` (or uppercase `NCRYPTSEC1…`) +/// substring is present. Callers MUST abort the network operation on `Err` — +/// this is a fail-closed guard, not a warning. +pub fn assert_no_key_backup(text: &str, context: &'static str) -> Result<(), String> { + if text.contains(NCRYPTSEC_PREFIX) || text.contains(NCRYPTSEC_PREFIX_UPPER) { + return Err(format!( + "blocked {context}: payload contains NIP-49 key-backup material \ + (ncryptsec); the local key backup must never be transmitted to a relay" + )); + } + Ok(()) +} + +/// Byte-slice variant for callers that hold serialized bodies. +pub fn assert_no_key_backup_bytes(body: &[u8], context: &'static str) -> Result<(), String> { + // ncryptsec is ASCII bech32; a UTF-8-lossy view preserves any occurrence. + assert_no_key_backup(&String::from_utf8_lossy(body), context) +} + +#[cfg(test)] +#[path = "egress_guard_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/egress_guard_tests.rs b/desktop/src-tauri/src/egress_guard_tests.rs new file mode 100644 index 0000000000..f487c8ce16 --- /dev/null +++ b/desktop/src-tauri/src/egress_guard_tests.rs @@ -0,0 +1,446 @@ +use super::*; + +/// NIP-49 spec vector — a real ncryptsec blob for injection payloads. +const NCRYPTSEC: &str = "ncryptsec1qgg9947rlpvqu76pj5ecreduf9jxhselq2nae2kghhvd5g7dgjtcxfqtd67p9m0w57lspw8gsq6yphnm8623nsl8xn9j4jdzz84zm3frztj3z7s35vpzmqf6ksu8r89qk5z2zxfmu5gv8th8wclt0h4p"; + +fn assert_guard_error(err: &str) { + assert!( + err.contains("key-backup material"), + "expected the egress-guard error, got: {err}" + ); +} + +// ── Guard unit behavior ─────────────────────────────────────────────────────── + +#[test] +fn rejects_ncryptsec_anywhere_in_text() { + assert_guard_error(&assert_no_key_backup(NCRYPTSEC, "test").unwrap_err()); + assert_guard_error( + &assert_no_key_backup( + &format!("{{\"content\":\"my backup: {NCRYPTSEC}\"}}"), + "test", + ) + .unwrap_err(), + ); +} + +/// Bech32 permits an all-uppercase encoding of the same payload — an +/// uppercased valid backup must not bypass the guard (text and bytes). +/// Mixed case is invalid bech32 (cannot decode) and is deliberately not +/// blocked. +#[test] +fn rejects_uppercase_ncryptsec() { + let upper = NCRYPTSEC.to_ascii_uppercase(); + assert_guard_error(&assert_no_key_backup(&upper, "test").unwrap_err()); + assert_guard_error(&assert_no_key_backup_bytes(upper.as_bytes(), "test").unwrap_err()); + // Mixed case cannot decode; not blocked. + assert!(assert_no_key_backup("nCrYpTsEc1qgg9947r", "test").is_ok()); +} + +#[test] +fn passes_clean_payloads_including_raw_nsec() { + assert!(assert_no_key_backup("hello world", "test").is_ok()); + assert!(assert_no_key_backup("", "test").is_ok()); + // Scope is ncryptsec1 ONLY: raw nsec intentionally transits the encrypted + // pairing session and must NOT be blocked (plan D4 / pairing.rs). + let nsec = nostr::ToBech32::to_bech32(nostr::Keys::generate().secret_key()).unwrap(); + assert!(assert_no_key_backup(&nsec, "test").is_ok()); + // Near-miss prefixes are not blocked. + assert!(assert_no_key_backup("ncryptsec", "test").is_ok()); +} + +#[test] +fn byte_variant_matches_text_variant() { + assert_guard_error(&assert_no_key_backup_bytes(NCRYPTSEC.as_bytes(), "test").unwrap_err()); + assert!(assert_no_key_backup_bytes(b"clean body", "test").is_ok()); + // Invalid UTF-8 around an intact ncryptsec substring must still trip the + // guard (from_utf8_lossy preserves the ASCII run). + let mut body = vec![0xff, 0xfe]; + body.extend_from_slice(NCRYPTSEC.as_bytes()); + body.push(0xff); + assert_guard_error(&assert_no_key_backup_bytes(&body, "test").unwrap_err()); +} + +#[test] +fn error_names_the_boundary_context() { + let err = assert_no_key_backup(NCRYPTSEC, "huddle STT publish").unwrap_err(); + assert!(err.contains("huddle STT publish"), "{err}"); +} + +// ── Runtime injection per boundary ──────────────────────────────────────────── +// +// Each test drives the real production function with an ncryptsec-bearing +// payload and asserts the guard aborts the operation before any network I/O +// (no listener exists at the target address; a distinctive guard error — not +// a connection error — proves the abort happened first). +// +// Boundaries 6 and 7 (`submit_engram_event` twins) are module-private inside +// `commands`; their injection tests live next to them: +// - commands/team_snapshot/tests.rs::egress_guard_boundary +// - commands/personas/snapshot/import.rs::egress_guard_tests + +/// Boundary 1: `relay/submit.rs` `submit_event_at_with_keys` (the funnel for +/// all `submit_event*` variants). +#[tokio::test] +async fn boundary_submit_event_at_with_keys_blocks_ncryptsec() { + let state = crate::app_state::build_app_state(); + let keys = nostr::Keys::generate(); + let builder = nostr::EventBuilder::new(nostr::Kind::Custom(9), NCRYPTSEC); + let err = crate::relay::submit_event_at_with_keys( + builder, + &state, + "http://127.0.0.1:9", // discard port — must never be reached + &keys, + ) + .await + .unwrap_err(); + assert_guard_error(&err); +} + +/// Boundary 2: `relay.rs` `sync_managed_agent_profile` (agent kind:0 profile). +#[tokio::test] +async fn boundary_sync_managed_agent_profile_blocks_ncryptsec() { + let state = crate::app_state::build_app_state(); + let keys = nostr::Keys::generate(); + let err = crate::relay::sync_managed_agent_profile( + &state, + "ws://127.0.0.1:9", + &keys, + &format!("agent {NCRYPTSEC}"), + None, + None, + ) + .await + .unwrap_err(); + assert_guard_error(&err); +} + +/// Boundary 3: `relay/submit.rs` `submit_signed_event_at_with_keys` — the +/// pre-signed entry into the boundary-1 funnel (main's submit refactor +/// replaced `relay.rs` `submit_signed_event` with this scoped form). +#[tokio::test] +async fn boundary_submit_signed_event_at_with_keys_blocks_ncryptsec() { + let state = crate::app_state::build_app_state(); + let keys = nostr::Keys::generate(); + let event = nostr::EventBuilder::new(nostr::Kind::Custom(9), NCRYPTSEC) + .sign_with_keys(&keys) + .unwrap(); + let err = crate::relay::submit_signed_event_at_with_keys( + &event, + &state, + "http://127.0.0.1:9", // discard port — must never be reached + &keys, + ) + .await + .unwrap_err(); + assert_guard_error(&err); +} + +/// Boundary 4: `relay.rs` `submit_signed_event_with_keys`. +#[tokio::test] +async fn boundary_submit_signed_event_with_keys_blocks_ncryptsec() { + let state = crate::app_state::build_app_state(); + *state.relay_url_override.lock().unwrap() = Some("ws://127.0.0.1:9".to_string()); + let keys = nostr::Keys::generate(); + let event = nostr::EventBuilder::new(nostr::Kind::Custom(9), NCRYPTSEC) + .sign_with_keys(&keys) + .unwrap(); + let err = crate::relay::submit_signed_event_with_keys(&event, &state, &keys, None) + .await + .unwrap_err(); + assert_guard_error(&err); +} + +/// Boundary 5: huddle STT publisher (`huddle/pipeline.rs`). +#[test] +fn boundary_huddle_stt_blocks_ncryptsec() { + let keys = nostr::Keys::generate(); + let channel = uuid::Uuid::new_v4(); + let builder = + crate::events::build_message(channel, NCRYPTSEC, None, &[], &[], &[], &[]).unwrap(); + let err = crate::huddle::pipeline::sign_and_guard_stt_body(builder, &keys).unwrap_err(); + assert_guard_error(&err); + + // Clean transcripts pass through the same seam. + let builder = + crate::events::build_message(channel, "hello huddle", None, &[], &[], &[], &[]).unwrap(); + assert!(crate::huddle::pipeline::sign_and_guard_stt_body(builder, &keys).is_ok()); +} + +/// Boundary 8: native websocket send loop — the single choke point for all +/// webview-originated relay websocket frames. +#[tokio::test] +async fn boundary_native_websocket_blocks_ncryptsec() { + let manager = crate::native_websocket::WebSocketManager::default(); + // Text frame: guard fires before the connection lookup, so no connection + // is needed — and the error must be the guard's, not "not found". + let err = crate::native_websocket::send_message( + &manager, + 1, + crate::native_websocket::WebSocketMessage::Text(format!( + "[\"EVENT\",{{\"content\":\"{NCRYPTSEC}\"}}]" + )), + ) + .await + .unwrap_err(); + assert_guard_error(&err); + + // Binary frame variant. + let err = crate::native_websocket::send_message( + &manager, + 1, + crate::native_websocket::WebSocketMessage::Binary(NCRYPTSEC.as_bytes().to_vec()), + ) + .await + .unwrap_err(); + assert_guard_error(&err); + + // Clean frames fall through to normal handling ("connection not found" + // here — the guard did not reject them). + let err = crate::native_websocket::send_message( + &manager, + 1, + crate::native_websocket::WebSocketMessage::Text("[\"REQ\",\"sub\",{}]".to_string()), + ) + .await + .unwrap_err(); + assert!(err.contains("not found"), "{err}"); +} + +// ── Structural tripwires ────────────────────────────────────────────────────── + +fn src_rust_files() -> Vec { + fn walk(dir: &std::path::Path, out: &mut Vec) { + for entry in std::fs::read_dir(dir).unwrap() { + let path = entry.unwrap().path(); + if path.is_dir() { + walk(&path, out); + } else if path.extension().and_then(|e| e.to_str()) == Some("rs") { + out.push(path); + } + } + } + let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src"); + let mut out = Vec::new(); + walk(&root, &mut out); + out +} + +/// Site-granular `/events` inventory: `(file suffix, expected non-comment +/// `/events` occurrences, expected guard call sites — full-path calls into +/// the egress-guard module)`. +/// +/// Every entry pairs the URL-construction count with the guard-call count for +/// that file, so BOTH of these fail the scan (not just a brand-new file): +/// - adding an unguarded ninth `/events` site inside an already-listed file +/// (count goes up without a matching table update), and +/// - removing/refactoring away a guard call while its egress site remains. +/// +/// Updating a row here is the deliberate act that must accompany wiring the +/// guard + adding an injection test for the new site. +const EVENTS_INVENTORY: &[(&str, usize, usize)] = &[ + // Production egress boundaries (see egress_guard.rs table): + ("src/relay.rs", 2, 2), // boundaries 2, 4 + ("src/relay/submit.rs", 1, 1), // boundaries 1 + 3 (shared funnel) + ("src/huddle/pipeline.rs", 1, 1), // boundary 5 + ("src/commands/team_snapshot.rs", 1, 1), // boundary 6 + ("src/commands/personas/snapshot/import.rs", 2, 1), // boundary 7 + its in-file injection-test fixture URL + ("src/native_websocket.rs", 0, 2), // boundary 8 (WS frames; no events URL) + // Test-only fixtures — no production egress, no guard: + ("src/relay_admission.rs", 1, 0), + ("src/archive/mod_tests.rs", 1, 0), + ("src/managed_agents/persona_events/tests.rs", 1, 0), + ("src/commands/team_snapshot/tests.rs", 1, 0), + // Mock-relay route in its in-file tests; production publish goes through + // the guarded boundary-1 funnel (`submit_signed_event_at_with_keys`). + ("src/commands/personas/sharing.rs", 1, 0), +]; + +// Needles are assembled at runtime so this scan file itself contains no +// contiguous match and needs no self-referential inventory row. +fn events_needle() -> String { + ["/ev", "ents"].concat() +} +fn guard_needle() -> String { + ["egress_guard::", "assert_no_key_backup"].concat() +} + +/// Pure scan core over `(relative path, content)` pairs. Returns violations; +/// empty means every file matches its inventory row exactly (files absent +/// from the table are expected to have zero `/events` sites and zero guard +/// calls). +fn events_inventory_violations(files: &[(String, String)]) -> Vec { + let events = events_needle(); + let guard = guard_needle(); + let mut violations = Vec::new(); + + for (rel, content) in files { + let expected = EVENTS_INVENTORY + .iter() + .find(|(suffix, _, _)| rel.ends_with(suffix)) + .map(|&(_, e, g)| (e, g)) + .unwrap_or((0, 0)); + + let mut event_sites = Vec::new(); + for (i, line) in content.lines().enumerate() { + if line.trim_start().starts_with("//") { + continue; // doc/comment mentions + } + if line.contains(&events) { + event_sites.push(format!(" {rel}:{}: {}", i + 1, line.trim())); + } + } + let guard_count = content.matches(&guard).count(); + + if (event_sites.len(), guard_count) != expected { + violations.push(format!( + "{rel}: found {} events-URL site(s) + {} guard call(s), inventory \ + expects {} + {}. Sites found:\n{}", + event_sites.len(), + guard_count, + expected.0, + expected.1, + if event_sites.is_empty() { + " (none)".to_string() + } else { + event_sites.join("\n") + }, + )); + } + } + violations +} + +fn read_src_files() -> Vec<(String, String)> { + let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")); + src_rust_files() + .into_iter() + .map(|path| { + let rel = path + .strip_prefix(root) + .unwrap() + .to_string_lossy() + .replace('\\', "/"); + let content = std::fs::read_to_string(&path).unwrap(); + (rel, content) + }) + .collect() +} + +/// Inventory completeness: every `/events` URL-construction site in +/// `desktop/src-tauri/src` must match the site-granular inventory above. A +/// future ninth submission path — in a NEW file or an ALREADY-LISTED one — +/// fails this test until its guard is wired, its injection test exists, and +/// its inventory row is updated. +#[test] +fn events_url_inventory_is_fully_guarded() { + let violations = events_inventory_violations(&read_src_files()); + assert!( + violations.is_empty(), + "events-URL egress inventory drift — wire crate::egress_guard, add an \ + injection test, then update EVENTS_INVENTORY:\n{}", + violations.join("\n") + ); +} + +/// Mutation-style proof of the tripwire's guarantee: an unguarded ninth +/// `/events` site added to an already-inventoried file (relay.rs) is caught. +#[test] +fn inventory_scan_catches_new_site_in_allowlisted_file() { + let mut files = read_src_files(); + let relay = files + .iter_mut() + .find(|(rel, _)| rel.ends_with("src/relay.rs")) + .expect("relay.rs must be in the scan set"); + relay.1.push_str(&format!( + "\nfn sneaky_ninth_site(base: &str) -> String {{ format!(\"{{base}}{}\") }}\n", + events_needle() + )); + let violations = events_inventory_violations(&files); + assert!( + violations.iter().any(|v| v.contains("src/relay.rs")), + "an unguarded ninth events-URL site in relay.rs must trip the scan: {violations:?}" + ); +} + +/// The pairing also fires in reverse: a guard call deleted while its egress +/// site remains is caught. +#[test] +fn inventory_scan_catches_removed_guard_call() { + let mut files = read_src_files(); + let relay = files + .iter_mut() + .find(|(rel, _)| rel.ends_with("src/relay.rs")) + .expect("relay.rs must be in the scan set"); + relay.1 = relay.1.replacen(&guard_needle(), "removed_guard", 1); + let violations = events_inventory_violations(&files); + assert!( + violations.iter().any(|v| v.contains("src/relay.rs")), + "a removed guard call in relay.rs must trip the scan: {violations:?}" + ); +} + +/// A brand-new file with an `/events` site (no inventory row) is caught. +#[test] +fn inventory_scan_catches_new_unlisted_file() { + let mut files = read_src_files(); + files.push(( + "src/brand_new_egress.rs".to_string(), + format!("let url = format!(\"{{}}{}\", base);", events_needle()), + )); + let violations = events_inventory_violations(&files); + assert!( + violations + .iter() + .any(|v| v.contains("src/brand_new_egress.rs")), + "{violations:?}" + ); +} + +/// Source allowlist: NIP-49 material handling is confined to the identity / +/// backup / import / guard files. Anything else touching ncryptsec or the +/// nip49 codec is structural drift. +#[test] +fn ncryptsec_handling_is_confined_to_allowlisted_files() { + let allowlist: &[&str] = &[ + "src/key_backup.rs", + "src/key_backup_tests.rs", + "src/egress_guard.rs", + "src/egress_guard_tests.rs", + "src/commands/identity.rs", + "src/commands/identity_key_backup_tests.rs", + "src/lib.rs", // module registration + invoke handler + // boundary wiring (guard call sites name the module, not the codec): + "src/relay.rs", + "src/relay/submit.rs", + "src/huddle/pipeline.rs", + "src/commands/team_snapshot.rs", + "src/commands/team_snapshot/tests.rs", + "src/commands/personas/snapshot/import.rs", + "src/native_websocket.rs", + ]; + + let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")); + let mut violations = Vec::new(); + for path in src_rust_files() { + let rel = path + .strip_prefix(root) + .unwrap() + .to_string_lossy() + .replace('\\', "/"); + if allowlist.iter().any(|a| rel.ends_with(a)) { + continue; + } + let content = std::fs::read_to_string(&path).unwrap(); + for needle in ["ncryptsec", "EncryptedSecretKey", "nip49"] { + if content.contains(needle) { + violations.push(format!("{rel}: contains {needle:?}")); + } + } + } + assert!( + violations.is_empty(), + "NIP-49 material outside allowlisted files:\n{}", + violations.join("\n") + ); +} diff --git a/desktop/src-tauri/src/huddle/pipeline.rs b/desktop/src-tauri/src/huddle/pipeline.rs index ceccedd8b6..6a4cf26201 100644 --- a/desktop/src-tauri/src/huddle/pipeline.rs +++ b/desktop/src-tauri/src/huddle/pipeline.rs @@ -251,6 +251,23 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result Result, String> { + let event = builder + .sign_with_keys(keys) + .map_err(|e| format!("sign event: {e}"))?; + let body_bytes = event.as_json().into_bytes(); + crate::egress_guard::assert_no_key_backup_bytes(&body_bytes, "huddle STT publish")?; + Ok(body_bytes) +} + /// Spawn a tokio task that reads text_rx and posts kind:9 events. /// /// Fix 1: `agent_pubkeys_arc` is an `Arc>>` cloned from @@ -310,14 +327,13 @@ pub(crate) fn spawn_transcription_task( // the kind event and build NIP-98 auth after the wait so both // timestamps are fresh — single clean order: wait → sign → auth → send. crate::relay_admission::wait_for_rate_limit().await; - let event = match builder.sign_with_keys(&keys) { - Ok(e) => e, + let body_bytes = match sign_and_guard_stt_body(builder, &keys) { + Ok(b) => b, Err(e) => { - eprintln!("buzz-desktop: STT sign event: {e}"); + eprintln!("buzz-desktop: STT publish: {e}"); continue; } }; - let body_bytes = event.as_json().into_bytes(); let url = format!("{relay_base_url}/events"); let auth_header = match crate::relay::build_nip98_auth_header_for_keys( &keys, diff --git a/desktop/src-tauri/src/key_backup.rs b/desktop/src-tauri/src/key_backup.rs new file mode 100644 index 0000000000..6396911aef --- /dev/null +++ b/desktop/src-tauri/src/key_backup.rs @@ -0,0 +1,187 @@ +//! NIP-49 encrypted local key backup. +//! +//! Creates a password-encrypted `ncryptsec` backup of the user's identity key +//! for a user-selected local file. The blob is **local-only by contract**: it must +//! never be transmitted to a relay on any path. That contract is enforced at +//! runtime by [`crate::egress_guard`] (wired into every relay event-body +//! constructor and the native websocket send loop) and structurally by the +//! source-allowlist scan in this module's tests. +//! +//! Creation decrypt-verifies the fresh blob against the live identity before +//! returning it. Portable copies use atomic, owner-only file writes. + +use nostr::nips::nip49::{EncryptedSecretKey, KeySecurity}; +use nostr::{FromBech32, Keys, ToBech32}; + +/// scrypt cost for new backups (2^18 — Gossip's desktop default, ~256 MiB). +/// The blob self-describes its cost, so this can be raised later without +/// breaking existing backups. +pub const BACKUP_LOG_N: u8 = 18; + +/// Highest scrypt cost accepted when decrypting an untrusted backup. +/// +/// NIP-49 intentionally leaves `log_n` client-selected. Capping it at the tier +/// Buzz itself emits keeps generated and upstream-compatible lower-cost backups +/// readable without allowing a crafted payload to request unbounded memory +/// before password authentication. +pub const MAX_VERIFY_LOG_N: u8 = BACKUP_LOG_N; + +/// Filename of the app-managed canonical backup inside the app data dir. +pub const BACKUP_FILE_NAME: &str = "identity.ncryptsec"; + +/// Default number of words in a generated backup passphrase. Three words +/// from a 1296-word list ≈ 31 bits of entropy before the scrypt work factor. +pub const DEFAULT_PASSPHRASE_WORDS: usize = 3; + +/// Bounds for the generator's word-count control. At the lower bound a draw +/// can fall below [`MIN_PASSPHRASE_LEN`] (three 3-char words), so +/// [`generate_passphrase`] re-draws until the phrase meets the minimum. +pub const MIN_PASSPHRASE_WORDS: usize = 3; +pub const MAX_PASSPHRASE_WORDS: usize = 10; + +/// EFF short wordlist 2.0 (1296 words, one per line). +const WORDLIST: &str = include_str!("assets/eff_short_wordlist_2_0.txt"); + +/// Minimum length for a user-chosen passphrase. +pub const MIN_PASSPHRASE_LEN: usize = 12; + +/// Encrypt the identity secret key under `password` and verify the result. +/// +/// Returns the bech32 `ncryptsec1…` string. The fresh blob is decrypted and +/// its derived pubkey compared to the live identity **before** returning, so +/// a returned blob is always provably recoverable with the same password. +pub fn create_backup_blob(keys: &Keys, password: &str, log_n: u8) -> Result { + let secret_key = keys.secret_key(); + + let encrypted = EncryptedSecretKey::new(secret_key, password, log_n, KeySecurity::Unknown) + .map_err(|e| format!("encrypt key backup: {e}"))?; + + let ncryptsec = encrypted + .to_bech32() + .map_err(|e| format!("encode ncryptsec: {e}"))?; + + // Integrity check: decrypt the fresh blob and confirm it recovers the + // exact live identity. A corrupted or mis-encrypted blob must never be + // shown to the user as a "backup". This is the second, deliberate KDF + // invocation of the one-artifact-per-action contract. + verify_backup_blob(&ncryptsec, password, &keys.public_key())?; + + Ok(ncryptsec) +} + +/// Decrypt `ncryptsec` with `password` and assert it recovers a key whose +/// public key equals `expected_pubkey`. +pub fn verify_backup_blob( + ncryptsec: &str, + password: &str, + expected_pubkey: &nostr::PublicKey, +) -> Result<(), String> { + let encrypted = parse_ncryptsec(ncryptsec)?; + let recovered = encrypted + .decrypt(password) + .map_err(|e| format!("verify key backup (decrypt): {e}"))?; + let recovered_keys = Keys::new(recovered); + if recovered_keys.public_key() != *expected_pubkey { + return Err("verify key backup: decrypted key does not match identity".to_string()); + } + Ok(()) +} + +/// Parse a bech32 `ncryptsec1…` string, rejecting anything that is not a +/// structurally valid NIP-49 payload. +pub fn parse_ncryptsec(input: &str) -> Result { + EncryptedSecretKey::from_bech32(input.trim()).map_err(|e| format!("invalid ncryptsec: {e}")) +} + +/// Decrypt an `ncryptsec1…` string with `password` into identity keys. +pub fn decrypt_ncryptsec(input: &str, password: &str) -> Result { + let encrypted = parse_ncryptsec(input)?; + let log_n = encrypted.log_n(); + if log_n > MAX_VERIFY_LOG_N { + return Err(format!( + "unsupported backup KDF cost: log_n {log_n} exceeds maximum {MAX_VERIFY_LOG_N}" + )); + } + let secret_key = encrypted + .decrypt(password) + .map_err(|_| "wrong backup password or damaged key backup".to_string())?; + Ok(Keys::new(secret_key)) +} + +/// Atomically write `ncryptsec` to `path` with owner-only permissions, then +/// reread and byte-compare. Same crash-safety pattern as +/// `app_state::save_key_file`. +pub fn write_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), String> { + use atomic_write_file::AtomicWriteFile; + use std::io::Write; + + let mut file = AtomicWriteFile::open(path) + .map_err(|e| format!("open backup file for atomic write: {e}"))?; + + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + file.set_permissions(std::fs::Permissions::from_mode(0o600)) + .map_err(|e| format!("set backup file permissions: {e}"))?; + } + + file.write_all(ncryptsec.as_bytes()) + .map_err(|e| format!("write backup file: {e}"))?; + file.commit() + .map_err(|e| format!("commit backup file: {e}"))?; + + // Reread and byte-compare: only report success for bytes that are + // actually on disk. + let on_disk = std::fs::read_to_string(path).map_err(|e| format!("reread backup file: {e}"))?; + if on_disk != ncryptsec { + return Err("backup file verification failed: on-disk bytes differ".to_string()); + } + + Ok(()) +} + +/// Generate a passphrase of `word_count` EFF short-wordlist words joined by +/// `separator`, using OS entropy. +/// +/// `word_count` is clamped to `MIN_PASSPHRASE_WORDS..=MAX_PASSPHRASE_WORDS`. +/// Because a low-word-count draw can land under [`MIN_PASSPHRASE_LEN`] +/// (e.g. three 3-char words), whole phrases below the minimum are rejected +/// and re-drawn — the result always passes the same length gate applied to +/// user-chosen passphrases. Uses rejection sampling for a uniform +/// distribution over the 1296 words. +pub fn generate_passphrase(word_count: usize, separator: &str) -> Result { + let word_count = word_count.clamp(MIN_PASSPHRASE_WORDS, MAX_PASSPHRASE_WORDS); + let words: Vec<&str> = WORDLIST.lines().filter(|l| !l.is_empty()).collect(); + if words.len() != 1296 { + return Err(format!( + "wordlist corrupted: expected 1296 words, found {}", + words.len() + )); + } + + // At 3 words the under-length probability per draw is small, so a few + // attempts always suffice; the cap only guards against a logic bug + // becoming an infinite loop. + for _ in 0..128 { + let mut chosen: Vec<&str> = Vec::with_capacity(word_count); + while chosen.len() < word_count { + let mut buf = [0u8; 2]; + getrandom::getrandom(&mut buf).map_err(|e| format!("entropy source: {e}"))?; + let value = u16::from_le_bytes(buf); + // Rejection sampling: accept only values below the largest + // multiple of 1296 that fits in u16 (65536 - 65536 % 1296 = 64800). + if value < 64800 { + chosen.push(words[(value as usize) % 1296]); + } + } + let phrase = chosen.join(separator); + if phrase.chars().count() >= MIN_PASSPHRASE_LEN { + return Ok(phrase); + } + } + Err("could not generate a passphrase meeting the minimum length".to_string()) +} + +#[cfg(test)] +#[path = "key_backup_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/key_backup_tests.rs b/desktop/src-tauri/src/key_backup_tests.rs new file mode 100644 index 0000000000..e5892ad99e --- /dev/null +++ b/desktop/src-tauri/src/key_backup_tests.rs @@ -0,0 +1,155 @@ +use super::*; + +/// NIP-49 spec vector (same as rust-nostr's upstream test): decrypts with +/// password "nostr" at our call sites. +const SPEC_NCRYPTSEC: &str = "ncryptsec1qgg9947rlpvqu76pj5ecreduf9jxhselq2nae2kghhvd5g7dgjtcxfqtd67p9m0w57lspw8gsq6yphnm8623nsl8xn9j4jdzz84zm3frztj3z7s35vpzmqf6ksu8r89qk5z2zxfmu5gv8th8wclt0h4p"; +const SPEC_SECRET_HEX: &str = "3501454135014541350145413501453fefb02227e449e57cf4d3a3ce05378683"; + +/// Fast scrypt tier for tests. log_n 18 is exercised once in +/// `round_trip_at_production_cost`. +const FAST_LOG_N: u8 = 16; + +// ── Codec ───────────────────────────────────────────────────────────────────── + +#[test] +fn spec_vector_decrypts_at_our_call_site() { + let keys = decrypt_ncryptsec(SPEC_NCRYPTSEC, "nostr").unwrap(); + assert_eq!(keys.secret_key().to_secret_hex(), SPEC_SECRET_HEX); +} + +#[test] +fn round_trip_fast_tier() { + let keys = Keys::generate(); + let blob = create_backup_blob(&keys, "correct horse battery", FAST_LOG_N).unwrap(); + assert!(blob.starts_with("ncryptsec1")); + let recovered = decrypt_ncryptsec(&blob, "correct horse battery").unwrap(); + assert_eq!(recovered.public_key(), keys.public_key()); +} + +#[test] +fn round_trip_at_production_cost() { + // One log_n 18 round trip: proves the production constant works end to + // end (slow — several seconds — but deliberate; see plan D5). + let keys = Keys::generate(); + let blob = create_backup_blob(&keys, "production cost tier check", BACKUP_LOG_N).unwrap(); + let recovered = decrypt_ncryptsec(&blob, "production cost tier check").unwrap(); + assert_eq!(recovered.public_key(), keys.public_key()); +} + +#[test] +fn wrong_password_is_a_friendly_error() { + let keys = Keys::generate(); + let blob = create_backup_blob(&keys, "right password", FAST_LOG_N).unwrap(); + let err = decrypt_ncryptsec(&blob, "wrong password").unwrap_err(); + assert_eq!(err, "wrong backup password or damaged key backup"); +} + +#[test] +fn nfkc_cross_form_passphrase_round_trips() { + // "é" composed (U+00E9) vs decomposed (e + U+0301): NIP-49 mandates NFKC + // normalization, so a passphrase entered in either form must decrypt. + let keys = Keys::generate(); + let composed = "caf\u{00e9} passphrase"; + let decomposed = "cafe\u{0301} passphrase"; + assert_ne!(composed, decomposed); + let blob = create_backup_blob(&keys, composed, FAST_LOG_N).unwrap(); + let recovered = decrypt_ncryptsec(&blob, decomposed).unwrap(); + assert_eq!(recovered.public_key(), keys.public_key()); +} + +#[test] +fn parse_rejects_garbage_and_wrong_hrp() { + assert!(parse_ncryptsec("garbage").is_err()); + assert!(parse_ncryptsec("").is_err()); + // Valid bech32, wrong HRP (an nsec is not an encrypted backup). + let nsec = Keys::generate().secret_key().to_bech32().unwrap(); + assert!(parse_ncryptsec(&nsec).is_err()); + // Truncated blob. + assert!(parse_ncryptsec(&SPEC_NCRYPTSEC[..SPEC_NCRYPTSEC.len() - 10]).is_err()); +} + +#[test] +fn verify_backup_blob_catches_pubkey_mismatch() { + // Corrupted-blob simulation: the blob decrypts fine but recovers a key + // that is not the live identity — verification must fail. + let other = Keys::generate(); + let blob = create_backup_blob(&other, "some password", FAST_LOG_N).unwrap(); + let live = Keys::generate(); + let err = verify_backup_blob(&blob, "some password", &live.public_key()).unwrap_err(); + assert!(err.contains("does not match identity"), "{err}"); +} + +// ── File lifecycle ──────────────────────────────────────────────────────────── + +#[test] +fn write_backup_file_persists_0600_and_verifies() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join(BACKUP_FILE_NAME); + write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); + + let on_disk = std::fs::read_to_string(&path).unwrap(); + assert_eq!(on_disk, SPEC_NCRYPTSEC); + + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + let mode = std::fs::metadata(&path).unwrap().permissions().mode(); + assert_eq!(mode & 0o777, 0o600, "backup file must be owner-only"); + } +} + +#[test] +fn write_backup_file_overwrites_atomically() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join(BACKUP_FILE_NAME); + write_backup_file(&path, "ncryptsec1old").unwrap(); + write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); + assert_eq!(std::fs::read_to_string(&path).unwrap(), SPEC_NCRYPTSEC); + // No leftover temp files from the atomic write. + let entries: Vec<_> = std::fs::read_dir(dir.path()) + .unwrap() + .map(|e| e.unwrap().file_name()) + .collect(); + assert_eq!(entries, vec![std::ffi::OsString::from(BACKUP_FILE_NAME)]); +} + +#[test] +fn generated_passphrase_respects_word_count_and_separator() { + let words: std::collections::HashSet<&str> = + WORDLIST.lines().filter(|l| !l.is_empty()).collect(); + assert_eq!(words.len(), 1296, "EFF short wordlist 2.0 has 1296 words"); + + for (count, separator) in [(3, "-"), (4, "-"), (6, " "), (5, "."), (10, "")] { + let phrase = generate_passphrase(count, separator).unwrap(); + if separator.is_empty() { + // No separator to split on; length gate below still applies. + } else { + let parts: Vec<&str> = phrase.split(separator).collect(); + assert_eq!(parts.len(), count); + for w in &parts { + assert!(words.contains(w), "unknown word {w:?}"); + } + } + assert!(phrase.chars().count() >= MIN_PASSPHRASE_LEN); + } +} + +#[test] +fn generated_passphrase_clamps_word_count() { + // Below the floor: clamped up to MIN_PASSPHRASE_WORDS, never shorter. + let phrase = generate_passphrase(1, "-").unwrap(); + assert_eq!(phrase.split('-').count(), MIN_PASSPHRASE_WORDS); + // Above the ceiling: clamped down to MAX_PASSPHRASE_WORDS. + let phrase = generate_passphrase(50, "-").unwrap(); + assert_eq!(phrase.split('-').count(), MAX_PASSPHRASE_WORDS); +} + +#[test] +fn generated_passphrases_are_not_repeated() { + // 3 words × ~10.3 bits each — a collision across 8 draws would indicate a + // broken entropy source, not bad luck. + let mut seen = std::collections::HashSet::new(); + for _ in 0..8 { + assert!(seen.insert(generate_passphrase(DEFAULT_PASSPHRASE_WORDS, "-").unwrap())); + } +} diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs index c005d511e6..7dcc5994ae 100644 --- a/desktop/src-tauri/src/lib.rs +++ b/desktop/src-tauri/src/lib.rs @@ -4,9 +4,11 @@ mod archive; mod builderlab; mod commands; mod deep_link; +mod egress_guard; mod event_sync; mod events; mod huddle; +mod key_backup; mod linux_media; mod managed_agents; mod media_proxy; @@ -669,6 +671,10 @@ pub fn run() { title_bar_double_click, get_identity, get_nsec, + generate_backup_passphrase, + create_ncryptsec_backup, + verify_ncryptsec_backup, + save_ncryptsec_copy, import_identity, persist_current_identity, get_profile, diff --git a/desktop/src-tauri/src/native_websocket.rs b/desktop/src-tauri/src/native_websocket.rs index c0cf2e76f1..128f2df79d 100644 --- a/desktop/src-tauri/src/native_websocket.rs +++ b/desktop/src-tauri/src/native_websocket.rs @@ -24,7 +24,7 @@ type Id = u32; #[derive(Debug, Deserialize)] #[serde(tag = "type", content = "data")] -enum WebSocketMessage { +pub(crate) enum WebSocketMessage { Text(String), Binary(Vec), Ping(Vec), @@ -33,7 +33,7 @@ enum WebSocketMessage { } #[derive(Debug, Deserialize)] -struct CloseFramePayload { +pub(crate) struct CloseFramePayload { code: u16, reason: String, } @@ -82,7 +82,7 @@ struct ConnectionHandle { } #[derive(Clone)] -struct WebSocketManager { +pub(crate) struct WebSocketManager { connections: Arc>>>, connect_cancel: Arc>, } @@ -182,11 +182,23 @@ async fn connect( open_connection(manager.inner(), &url, on_message).await } -async fn send_message( +pub(crate) async fn send_message( manager: &WebSocketManager, id: Id, message: WebSocketMessage, ) -> Result<(), String> { + // Egress guard: the NIP-49 local key backup must never reach a relay. + // This is the single choke point for all webview-originated websocket + // frames (see `crate::egress_guard`). + match &message { + WebSocketMessage::Text(text) => { + crate::egress_guard::assert_no_key_backup(text, "websocket text frame")? + } + WebSocketMessage::Binary(bytes) => { + crate::egress_guard::assert_no_key_backup_bytes(bytes, "websocket binary frame")? + } + _ => {} + } let handle = manager .connections .lock() diff --git a/desktop/src-tauri/src/relay.rs b/desktop/src-tauri/src/relay.rs index f896695624..71aa21c413 100644 --- a/desktop/src-tauri/src/relay.rs +++ b/desktop/src-tauri/src/relay.rs @@ -450,6 +450,7 @@ pub async fn sync_managed_agent_profile( let event = build_profile_event(agent_keys, display_name, avatar_url, auth_tag)?; let event_json = event.as_json(); let body_bytes = event_json.into_bytes(); + crate::egress_guard::assert_no_key_backup_bytes(&body_bytes, "agent profile sync")?; let url = format!("{}/events", relay_http_base_url(relay_url)); let auth = build_nip98_auth_header_for_keys(agent_keys, &Method::POST, &url, &body_bytes)?; @@ -566,6 +567,7 @@ pub async fn submit_signed_event_with_keys( crate::relay_admission::wait_for_rate_limit().await; let url = format!("{}/events", relay_api_base_url_with_override(state)); let body_bytes = event.as_json().into_bytes(); + crate::egress_guard::assert_no_key_backup_bytes(&body_bytes, "signed event submit (keys)")?; let auth_header = build_nip98_auth_header_for_keys(keys, &Method::POST, &url, &body_bytes)?; let mut request = state diff --git a/desktop/src-tauri/src/relay/submit.rs b/desktop/src-tauri/src/relay/submit.rs index 2a42d86c2b..eaad29d3b1 100644 --- a/desktop/src-tauri/src/relay/submit.rs +++ b/desktop/src-tauri/src/relay/submit.rs @@ -25,6 +25,7 @@ pub async fn submit_signed_event_at_with_keys( crate::relay_admission::wait_for_rate_limit().await; let url = format!("{}/events", api_base_url.trim_end_matches('/')); let body_bytes = event.as_json().into_bytes(); + crate::egress_guard::assert_no_key_backup_bytes(&body_bytes, "relay event submit")?; let auth_header = build_nip98_auth_header_for_keys(keys, &Method::POST, &url, &body_bytes)?; let response = state diff --git a/desktop/src/app/App.tsx b/desktop/src/app/App.tsx index 90b5bf5ebc..44618f2c72 100644 --- a/desktop/src/app/App.tsx +++ b/desktop/src/app/App.tsx @@ -56,6 +56,7 @@ import { WelcomeSetup } from "@/features/communities/ui/WelcomeSetup"; import { CommunityApplyErrorScreen } from "@/features/communities/ui/CommunityApplyErrorScreen"; import { CommunityChangeOverlay } from "@/features/communities/ui/CommunityChangeOverlay"; import { setAvatarProfileSyncQueryClient } from "@/features/profile/avatarProfileSync"; +import { EncryptedBackupProvider } from "@/features/settings/EncryptedBackupProvider"; import { createBuzzQueryClient } from "@/shared/api/queryClient"; import { isSharedIdentity as isSharedIdentityCmd } from "@/shared/api/tauri"; import { getProfile } from "@/shared/api/tauriProfiles"; @@ -270,9 +271,18 @@ function AppReady({ } return ( - - - + + void router.navigate({ + to: "/settings", + search: { section: "profile" }, + }) + } + > + + + + ); } diff --git a/desktop/src/features/onboarding/ui/NsecMaskedDisplay.tsx b/desktop/src/features/onboarding/ui/NsecMaskedDisplay.tsx index 111bdefd71..26f538da52 100644 --- a/desktop/src/features/onboarding/ui/NsecMaskedDisplay.tsx +++ b/desktop/src/features/onboarding/ui/NsecMaskedDisplay.tsx @@ -1,7 +1,23 @@ -import { Check, Copy, Eye, EyeOff } from "lucide-react"; +import { Check, Copy, Eye, EyeOff, MoreHorizontal } from "lucide-react"; import * as React from "react"; import { Button } from "@/shared/ui/button"; -import { writeTextToClipboard } from "@/shared/lib/clipboard"; +import { + copyTextToClipboard, + writeTextToClipboard, +} from "@/shared/lib/clipboard"; +import { + DropdownMenu, + DropdownMenuContent, + DropdownMenuItem, + DropdownMenuTrigger, +} from "@/shared/ui/dropdown-menu"; + +type NsecAction = { + icon?: React.ReactNode; + label: string; + onSelect: () => void; + testId?: string; +}; type NsecMaskedDisplayProps = { nsec: string; @@ -12,6 +28,8 @@ type NsecMaskedDisplayProps = { * a backup (e.g. sign-out) gate on actual interaction with the key. */ onKeyInteraction?: () => void; + /** Replaces the copy icon with an overflow menu containing Copy plus these actions. */ + actions?: readonly NsecAction[]; }; export const ONBOARDING_KEY_FRAME_CLASS = @@ -31,6 +49,7 @@ export function NsecMaskedDisplay({ nsec, variant = "boxed", onKeyInteraction, + actions, }: NsecMaskedDisplayProps) { const [isRevealed, setIsRevealed] = React.useState(false); const [isCopied, setIsCopied] = React.useState(false); @@ -58,6 +77,11 @@ export function NsecMaskedDisplay({ copyTimerRef.current = setTimeout(() => setIsCopied(false), 2000); } + function handleMenuCopy() { + copyTextToClipboard(nsec); + onKeyInteraction?.(); + } + const isBare = variant === "bare"; // Mask every character (no plaintext prefix leak), matching the real key's // length so toggling reveal never reflows the monospace text (no layout shift). @@ -121,24 +145,60 @@ export function NsecMaskedDisplay({
diff --git a/desktop/src/features/settings/EncryptedBackupProvider.tsx b/desktop/src/features/settings/EncryptedBackupProvider.tsx new file mode 100644 index 0000000000..7375a85cfb --- /dev/null +++ b/desktop/src/features/settings/EncryptedBackupProvider.tsx @@ -0,0 +1,251 @@ +import * as React from "react"; +import { toast } from "sonner"; + +import { + createNcryptsecBackup, + saveNcryptsecCopy, +} from "@/shared/api/tauriIdentity"; +import { + type EncryptedBackupEvent, + type EncryptedBackupState, + encryptedBackupReducer, + initialEncryptedBackupState, + pendingEncryptPassphrase, +} from "./lib/encryptedBackup"; + +const ENCRYPT_DEBOUNCE_MS = 400; +/** How long a completed encrypted backup remains available in memory. */ +export const BACKUP_AVAILABILITY_MS = 5 * 60 * 1000; +const BACKUP_READY_TOAST_ID = "encrypted-key-backup-ready"; + +type EncryptedBackupContextValue = { + state: EncryptedBackupState; + dispatch: React.Dispatch; + backupAvailable: boolean; + availableUntil: number | null; + isSaving: boolean; + saveError: string | null; + downloadBackup: () => Promise; + startNewBackup: () => void; +}; + +const EncryptedBackupContext = + React.createContext(null); + +export function EncryptedBackupProvider({ + children, + onOpenSettings, +}: { + children: React.ReactNode; + onOpenSettings: () => void; +}) { + const [state, dispatch] = React.useReducer( + encryptedBackupReducer, + initialEncryptedBackupState, + ); + const [availableUntil, setAvailableUntil] = React.useState( + null, + ); + const [isSaving, setIsSaving] = React.useState(false); + const [saveError, setSaveError] = React.useState(null); + const autoSaveStartedForRef = React.useRef(null); + const mountedRef = React.useRef(true); + const onOpenSettingsRef = React.useRef(onOpenSettings); + + React.useEffect(() => { + onOpenSettingsRef.current = onOpenSettings; + }, [onOpenSettings]); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + }; + }, []); + + React.useEffect(() => { + if (availableUntil === null) return; + const expiresIn = Math.max(0, availableUntil - Date.now()); + const timer = window.setTimeout(() => { + autoSaveStartedForRef.current = null; + setAvailableUntil(null); + setSaveError(null); + dispatch({ type: "start-new-backup" }); + toast.dismiss(BACKUP_READY_TOAST_ID); + }, expiresIn); + return () => window.clearTimeout(timer); + }, [availableUntil]); + + const pendingPassphrase = pendingEncryptPassphrase(state); + const skipDebounce = state.downloadPending; + React.useEffect(() => { + if (!pendingPassphrase) return; + let started = false; + let cancelledBeforeStart = false; + const requestId = state.nextRequestId; + const start = () => { + if (cancelledBeforeStart) return; + started = true; + dispatch({ type: "encrypt-started", requestId }); + void createNcryptsecBackup(pendingPassphrase) + .then((ncryptsec) => { + dispatch({ type: "encrypt-succeeded", requestId, ncryptsec }); + }) + .catch((err: unknown) => { + dispatch({ + type: "encrypt-failed", + requestId, + message: + err instanceof Error + ? err.message + : "Failed to encrypt your key.", + }); + }); + }; + const timer = window.setTimeout( + start, + skipDebounce ? 0 : ENCRYPT_DEBOUNCE_MS, + ); + return () => { + if (!started) cancelledBeforeStart = true; + window.clearTimeout(timer); + }; + }, [pendingPassphrase, skipDebounce, state.nextRequestId]); + + React.useEffect(() => { + if (state.downloadPending) { + toast.loading("Preparing backup…", { + description: "You can close this window while Buzz finishes.", + duration: Number.POSITIVE_INFINITY, + id: BACKUP_READY_TOAST_ID, + }); + return; + } + if ( + state.createError && + state.passphrase.length === 0 && + !state.ncryptsec + ) { + toast.error("Couldn’t create backup", { + description: state.createError, + id: BACKUP_READY_TOAST_ID, + }); + } + }, [ + state.createError, + state.downloadPending, + state.ncryptsec, + state.passphrase.length, + ]); + + const showAvailableToast = React.useCallback( + (description: string, error = false) => { + const options = { + action: { + label: "Open settings", + onClick: () => onOpenSettingsRef.current(), + }, + description, + id: BACKUP_READY_TOAST_ID, + }; + if (error) toast.error("Backup ready to download", options); + else toast.success("Backup ready to download", options); + }, + [], + ); + + const saveBackup = React.useCallback( + async (ncryptsec: string) => { + if (isSaving) return; + setIsSaving(true); + setSaveError(null); + toast("Saving backup…", { + description: "The download window will open when it’s ready.", + id: BACKUP_READY_TOAST_ID, + }); + try { + const path = await saveNcryptsecCopy(ncryptsec); + if (mountedRef.current) { + showAvailableToast( + path === null + ? "Your backup will be available to download for 5 minutes." + : "You can download another copy for 5 minutes.", + ); + } + } catch (err) { + if (!mountedRef.current) return; + const message = + err instanceof Error ? err.message : "Failed to save your key."; + setSaveError(message); + showAvailableToast( + `${message} It will be available to download for 5 minutes.`, + true, + ); + } finally { + if (mountedRef.current) setIsSaving(false); + } + }, + [isSaving, showAvailableToast], + ); + + React.useEffect(() => { + const ncryptsec = state.ncryptsec; + if (!ncryptsec || autoSaveStartedForRef.current === ncryptsec) return; + autoSaveStartedForRef.current = ncryptsec; + setAvailableUntil(Date.now() + BACKUP_AVAILABILITY_MS); + void saveBackup(ncryptsec); + }, [saveBackup, state.ncryptsec]); + + const downloadBackup = React.useCallback(async () => { + if (!state.ncryptsec) return; + await saveBackup(state.ncryptsec); + }, [saveBackup, state.ncryptsec]); + + const startNewBackup = React.useCallback(() => { + autoSaveStartedForRef.current = null; + setAvailableUntil(null); + setSaveError(null); + toast.dismiss(BACKUP_READY_TOAST_ID); + dispatch({ type: "start-new-backup" }); + }, []); + + const value = React.useMemo( + () => ({ + state, + dispatch, + backupAvailable: + state.savedPassword && + state.ncryptsec !== null && + availableUntil !== null, + availableUntil, + isSaving, + saveError, + downloadBackup, + startNewBackup, + }), + [ + availableUntil, + downloadBackup, + isSaving, + saveError, + startNewBackup, + state, + ], + ); + + return ( + + {children} + + ); +} + +export function useEncryptedBackup(): EncryptedBackupContextValue { + const value = React.useContext(EncryptedBackupContext); + if (!value) { + throw new Error( + "useEncryptedBackup must be used within EncryptedBackupProvider", + ); + } + return value; +} diff --git a/desktop/src/features/settings/lib/encryptedBackup.test.mjs b/desktop/src/features/settings/lib/encryptedBackup.test.mjs new file mode 100644 index 0000000000..306e937ec5 --- /dev/null +++ b/desktop/src/features/settings/lib/encryptedBackup.test.mjs @@ -0,0 +1,133 @@ +import assert from "node:assert/strict"; +import test from "node:test"; +import { + MIN_PASSPHRASE_LEN, + downloadDisabled, + isEncrypting, + passphraseIssue, + pendingEncryptPassphrase, + effectivePassphrase, + encryptedBackupReducer, + initialEncryptedBackupState, +} from "./encryptedBackup.ts"; +const reduce = (events, from = initialEncryptedBackupState) => + events.reduce(encryptedBackupReducer, from); +test("password validation mirrors Rust character counting", () => { + assert.equal(passphraseIssue(""), null); + assert.match(passphraseIssue("short"), new RegExp(`${MIN_PASSPHRASE_LEN}`)); + const emoji = "😀".repeat(MIN_PASSPHRASE_LEN); + assert.equal(passphraseIssue(emoji), null); + assert.equal( + effectivePassphrase(reduce([{ type: "set-passphrase", value: emoji }])), + emoji, + ); +}); +test("valid password requests encryption without copying it into events", () => { + const ready = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + ]); + assert.equal(pendingEncryptPassphrase(ready), "one-two-three-four"); + const started = reduce([{ type: "encrypt-started", requestId: 1 }], ready); + assert.equal(isEncrypting(started), true); + assert.equal(started.requestId, 1); + assert.equal(Object.hasOwn(started, "encryptingPassphrase"), false); +}); +test("background success retains the password without committing the download", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + ]); + assert.equal(state.passphrase, "one-two-three-four"); + assert.equal(state.encrypted, "ncryptsec1abc"); + assert.equal(state.ncryptsec, null); + assert.equal(state.savedPassword, false); + assert.equal(state.requestId, null); + assert.equal(downloadDisabled(state), false); +}); +test("submit commits a completed preload immediately", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + { type: "download-clicked" }, + ]); + assert.equal(state.ncryptsec, "ncryptsec1abc"); + assert.equal(state.passphrase, ""); + assert.equal(state.savedPassword, true); +}); +test("stale async completions cannot replace current request", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "set-passphrase", value: "five-six-seven-eight" }, + { type: "encrypt-started", requestId: 2 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1stale" }, + ]); + assert.equal(state.requestId, 2); + assert.equal(state.encrypted, null); + assert.equal(state.passphrase, "five-six-seven-eight"); +}); +test("failure clears submitted password", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "download-clicked" }, + { type: "encrypt-failed", requestId: 1, message: "keychain unavailable" }, + ]); + assert.equal(state.passphrase, ""); + assert.equal(state.createError, "keychain unavailable"); + assert.equal(state.downloadPending, false); + assert.equal(downloadDisabled(state), true); +}); +test("background failure stays silent until submit retries encryption", () => { + const failed = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "encrypt-failed", requestId: 1, message: "keychain unavailable" }, + ]); + assert.equal(failed.passphrase, "one-two-three-four"); + assert.equal(failed.createError, "keychain unavailable"); + assert.equal(pendingEncryptPassphrase(failed), null); + + const retrying = reduce([{ type: "download-clicked" }], failed); + assert.equal(retrying.createError, null); + assert.equal(retrying.downloadPending, true); + assert.equal(pendingEncryptPassphrase(retrying), "one-two-three-four"); +}); +test("queued download commits and clears password", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "download-clicked" }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + ]); + assert.equal(state.ncryptsec, "ncryptsec1abc"); + assert.equal(state.passphrase, ""); + assert.equal(state.savedPassword, true); +}); +test("starting over discards blob and invalidates late requests", () => { + const made = { + ...initialEncryptedBackupState, + ncryptsec: "ncryptsec1abc", + encrypted: "ncryptsec1abc", + savedPassword: true, + nextRequestId: 3, + }; + const fresh = reduce([{ type: "start-new-backup" }], made); + assert.equal(fresh.ncryptsec, null); + assert.equal(fresh.nextRequestId, 4); + assert.equal( + reduce( + [ + { + type: "encrypt-succeeded", + requestId: 2, + ncryptsec: "ncryptsec1stale", + }, + ], + fresh, + ).ncryptsec, + null, + ); +}); diff --git a/desktop/src/features/settings/lib/encryptedBackup.ts b/desktop/src/features/settings/lib/encryptedBackup.ts new file mode 100644 index 0000000000..e54189769a --- /dev/null +++ b/desktop/src/features/settings/lib/encryptedBackup.ts @@ -0,0 +1,143 @@ +/** Pure state model for NIP-49 backup creation. */ +export const MIN_PASSPHRASE_LEN = 12; + +export type EncryptedBackupState = { + passphrase: string; + requestId: number | null; + nextRequestId: number; + encrypted: string | null; + createError: string | null; + downloadPending: boolean; + ncryptsec: string | null; + savedPassword: boolean; +}; + +export const initialEncryptedBackupState: EncryptedBackupState = { + passphrase: "", + requestId: null, + nextRequestId: 1, + encrypted: null, + createError: null, + downloadPending: false, + ncryptsec: null, + savedPassword: false, +}; + +export type EncryptedBackupEvent = + | { type: "set-passphrase"; value: string } + | { type: "encrypt-started"; requestId: number } + | { type: "encrypt-succeeded"; requestId: number; ncryptsec: string } + | { type: "encrypt-failed"; requestId: number; message: string } + | { type: "download-clicked" } + | { type: "start-new-backup" }; + +export function encryptedBackupReducer( + state: EncryptedBackupState, + event: EncryptedBackupEvent, +): EncryptedBackupState { + switch (event.type) { + case "set-passphrase": + return { + ...state, + passphrase: event.value, + requestId: null, + encrypted: null, + createError: null, + }; + case "encrypt-started": + return { + ...state, + requestId: event.requestId, + nextRequestId: Math.max(state.nextRequestId, event.requestId + 1), + createError: null, + }; + case "encrypt-succeeded": + if (event.requestId !== state.requestId) return state; + return state.downloadPending + ? { + ...state, + passphrase: "", + requestId: null, + encrypted: event.ncryptsec, + ncryptsec: event.ncryptsec, + downloadPending: false, + savedPassword: true, + } + : { + ...state, + requestId: null, + encrypted: event.ncryptsec, + }; + case "encrypt-failed": + if (event.requestId !== state.requestId) return state; + return state.downloadPending + ? { + ...state, + passphrase: "", + requestId: null, + createError: event.message, + downloadPending: false, + } + : { + ...state, + requestId: null, + createError: event.message, + }; + case "download-clicked": + if ( + state.ncryptsec || + state.downloadPending || + (!state.encrypted && !effectivePassphrase(state)) + ) + return state; + return state.encrypted + ? { + ...state, + ncryptsec: state.encrypted, + passphrase: "", + savedPassword: true, + } + : { ...state, createError: null, downloadPending: true }; + case "start-new-backup": + return { + ...initialEncryptedBackupState, + nextRequestId: state.nextRequestId + 1, + }; + } +} + +export function passphraseIssue(passphrase: string): string | null { + if (passphrase.length === 0) return null; + return [...passphrase].length < MIN_PASSPHRASE_LEN + ? `Use at least ${MIN_PASSPHRASE_LEN} characters.` + : null; +} +export function effectivePassphrase( + state: EncryptedBackupState, +): string | null { + return [...state.passphrase].length < MIN_PASSPHRASE_LEN + ? null + : state.passphrase; +} +export function pendingEncryptPassphrase( + state: EncryptedBackupState, +): string | null { + if ( + state.savedPassword || + state.encrypted || + state.requestId !== null || + (state.createError !== null && !state.downloadPending) + ) + return null; + return effectivePassphrase(state); +} +export function isEncrypting(state: EncryptedBackupState): boolean { + return state.requestId !== null; +} +export function downloadDisabled(state: EncryptedBackupState): boolean { + if (state.savedPassword && state.ncryptsec) return false; + return ( + state.downloadPending || + (!state.encrypted && effectivePassphrase(state) === null) + ); +} diff --git a/desktop/src/features/settings/ui/BackupTestFlow.tsx b/desktop/src/features/settings/ui/BackupTestFlow.tsx new file mode 100644 index 0000000000..65ef40a98a --- /dev/null +++ b/desktop/src/features/settings/ui/BackupTestFlow.tsx @@ -0,0 +1,459 @@ +import { Check, Eye, EyeOff, FileKey2, FileUp } from "lucide-react"; +import { motion, useReducedMotion } from "motion/react"; +import * as React from "react"; + +import { + verifyNcryptsecBackup, + type BackupVerification, +} from "@/shared/api/tauriIdentity"; +import { Button } from "@/shared/ui/button"; +import { Input } from "@/shared/ui/input"; +import { PubKey } from "@/shared/ui/PubKey"; +import { Spinner } from "@/shared/ui/spinner"; + +type BackupTestStage = "drop" | "password" | "success"; + +/** + * Progress through the Settings backup-test flow. The password attempt is + * deliberately NOT part of this state — it lives only in short-lived + * moment it's submitted or the component unmounts. + */ +export type BackupTestProgress = { + stage: BackupTestStage; + /** Name of the accepted file once the drop check passed. */ + fileName: string | null; + /** Contents of the accepted file, pending or past verification. */ + ncryptsec: string | null; + /** The Rust-verified public identity once decryption succeeded. */ + result: BackupVerification | null; +}; + +export const initialBackupTestProgress: BackupTestProgress = { + stage: "drop", + fileName: null, + ncryptsec: null, + result: null, +}; + +type BackupTestFlowProps = { + progress: BackupTestProgress; + onProgressChange: React.Dispatch>; +}; + +const BURST_EMOJIS = ["🎉", "✨", "🐝", "🍯", "🔑", "💛"] as const; +const BURST_PARTICLE_COUNT = 18; + +type BurstParticle = { + id: number; + x: number; + y: number; + emoji: string; + delay: number; + scale: number; + rotate: number; +}; + +/** + * One-shot radial emoji burst behind the success badge. Purely decorative — + * skipped entirely under reduced motion. + */ +function SuccessBurst() { + const particles = React.useMemo( + () => + Array.from({ length: BURST_PARTICLE_COUNT }, (_, i) => { + const angle = + (i / BURST_PARTICLE_COUNT) * Math.PI * 2 + Math.random() * 0.5; + const distance = 70 + Math.random() * 80; + return { + id: i, + x: Math.cos(angle) * distance, + y: Math.sin(angle) * distance, + emoji: BURST_EMOJIS[i % BURST_EMOJIS.length], + delay: Math.random() * 0.18, + scale: 0.8 + Math.random() * 0.7, + rotate: -120 + Math.random() * 240, + }; + }), + [], + ); + + return ( +
+ {particles.map((particle) => ( + + {particle.emoji} + + ))} +
+ ); +} + +/** + * "Test your backup" flow: the user drops a backup file onto a large + * dropzone, then enters its password. Verification is a real NIP-49 decrypt + * in Rust — the submitted password is cleared immediately after the result + * and only the derived public identity ever comes back. + */ +export function BackupTestFlow({ + progress, + onProgressChange, +}: BackupTestFlowProps) { + const reduceMotion = useReducedMotion() ?? false; + const { stage, fileName, ncryptsec, result } = progress; + // True while a file drag is anywhere over the window — the drop overlay + // takes over the host surface only for the duration of the drag. + const [isWindowDragging, setIsWindowDragging] = React.useState(false); + const dragDepthRef = React.useRef(0); + + React.useEffect(() => { + // dragenter/dragleave fire per nested element, so track depth to know + // when the drag has actually left the window. + const handleDragEnter = (event: DragEvent) => { + if (!event.dataTransfer?.types.includes("Files")) return; + dragDepthRef.current += 1; + setIsWindowDragging(true); + }; + const handleDragLeave = () => { + dragDepthRef.current = Math.max(0, dragDepthRef.current - 1); + if (dragDepthRef.current === 0) setIsWindowDragging(false); + }; + const handleDragEnd = () => { + dragDepthRef.current = 0; + setIsWindowDragging(false); + }; + window.addEventListener("dragenter", handleDragEnter); + window.addEventListener("dragleave", handleDragLeave); + window.addEventListener("drop", handleDragEnd); + window.addEventListener("dragend", handleDragEnd); + return () => { + window.removeEventListener("dragenter", handleDragEnter); + window.removeEventListener("dragleave", handleDragLeave); + window.removeEventListener("drop", handleDragEnd); + window.removeEventListener("dragend", handleDragEnd); + }; + }, []); + + // The password attempt is component-local, never host state: it is cleared + // when verification is submitted and when this component unmounts. + const [attempt, setAttempt] = React.useState(""); + const [error, setError] = React.useState(null); + const [isVerifying, setIsVerifying] = React.useState(false); + const [isRevealed, setIsRevealed] = React.useState(false); + const fileInputRef = React.useRef(null); + const passwordInputRef = React.useRef(null); + const mountedRef = React.useRef(true); + // Opaque correlation id so a stale in-flight verification can't commit + // after "Use a different file" or unmount. + const requestRef = React.useRef(0); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + requestRef.current += 1; + setAttempt(""); + }; + }, []); + + React.useEffect(() => { + if (stage === "password") passwordInputRef.current?.focus(); + }, [stage]); + + const handleFile = React.useCallback( + async (file: File) => { + let text: string; + try { + text = (await file.text()).trim(); + } catch { + if (mountedRef.current) setError("Could not read that file."); + return; + } + if (!mountedRef.current) return; + if (!text.toLowerCase().startsWith("ncryptsec1")) { + setError("That doesn't look like a key backup file."); + return; + } + setError(null); + setAttempt(""); + onProgressChange({ + stage: "password", + fileName: file.name, + ncryptsec: text, + result: null, + }); + }, + [onProgressChange], + ); + + const handleVerify = React.useCallback(async () => { + if (!ncryptsec || !attempt || isVerifying) return; + const password = attempt; + const requestId = ++requestRef.current; + setIsVerifying(true); + setError(null); + setIsRevealed(false); + // Clear the attempt the moment it's handed to Rust — success or failure, + // the typed password never lingers in the field. + setAttempt(""); + try { + const verified = await verifyNcryptsecBackup(ncryptsec, password); + if (!mountedRef.current || requestId !== requestRef.current) return; + onProgressChange((prev) => ({ + ...prev, + stage: "success", + result: verified, + })); + } catch (err) { + if (mountedRef.current && requestId === requestRef.current) + setError( + err instanceof Error ? err.message : "Could not verify this backup.", + ); + } finally { + if (mountedRef.current && requestId === requestRef.current) + setIsVerifying(false); + } + }, [attempt, isVerifying, ncryptsec, onProgressChange]); + + if (stage === "success" && result) { + return ( +
+ {reduceMotion ? null : } + + + +

+ This backup works +

+

+ {result.matchesCurrentIdentity + ? "It restores your current Buzz identity." + : "It restores a different identity than the one signed in here."} +

+
+ +
+ + +
+ ); + } + + return ( +
+ {stage === "drop" ? ( + <> + { + const file = event.target.files?.[0]; + // Allow re-selecting the same file after an error. + event.target.value = ""; + if (file) void handleFile(file); + }} + ref={fileInputRef} + tabIndex={-1} + type="file" + /> + + {isWindowDragging ? ( + /* + * Composer-style takeover: fills the nearest positioned host + * surface (the settings backup row) and is + * itself the drop target, so anywhere on that surface accepts + * the file. + */ + // biome-ignore lint/a11y/noStaticElementInteractions: pointer-only drop target; the select button is the keyboard-accessible path +
event.preventDefault()} + onDrop={(event) => { + event.preventDefault(); + const file = event.dataTransfer.files?.[0]; + if (file) void handleFile(file); + }} + > + + +
+ ) : null} + {error ? ( +

+ {error} +

+ ) : null} + + ) : ( + <> +
+
+

+ That's the one. Now enter your password to prove you can unlock it. +

+
+ setAttempt(event.target.value)} + onKeyDown={(event) => { + if (event.key === "Enter") { + event.preventDefault(); + void handleVerify(); + } + }} + placeholder="Your backup password" + ref={passwordInputRef} + type={isRevealed ? "text" : "password"} + value={attempt} + /> + + {error ? ( +

+ {error} +

+ ) : null} +
+
+ + +
+ + )} +
+ ); +} diff --git a/desktop/src/features/settings/ui/EncryptedBackupCreator.tsx b/desktop/src/features/settings/ui/EncryptedBackupCreator.tsx new file mode 100644 index 0000000000..fb20eb9c65 --- /dev/null +++ b/desktop/src/features/settings/ui/EncryptedBackupCreator.tsx @@ -0,0 +1,375 @@ +import { AlertTriangle, Eye, EyeOff, RefreshCw } from "lucide-react"; +import * as React from "react"; + +import { generateBackupPassphrase } from "@/shared/api/tauriIdentity"; +import { useEncryptedBackup } from "@/features/settings/EncryptedBackupProvider"; +import { Button } from "@/shared/ui/button"; +import { + Dialog, + DialogContent, + DialogDescription, + DialogHeader, + DialogTitle, +} from "@/shared/ui/dialog"; +import { Input } from "@/shared/ui/input"; +import { Popover, PopoverAnchor, PopoverContent } from "@/shared/ui/popover"; +import { downloadDisabled, MIN_PASSPHRASE_LEN } from "../lib/encryptedBackup"; + +/** Word-count bounds mirroring `key_backup.rs` (Rust clamps regardless). */ +const MIN_GENERATED_WORDS = 3; +const MAX_GENERATED_WORDS = 10; +const DEFAULT_GENERATED_WORDS = 3; + +const SEPARATOR_OPTIONS = [ + { label: "Spaces", value: " " }, + { label: "Hyphens", value: "-" }, + { label: "Periods", value: "." }, + { label: "Commas", value: "," }, +] as const; + +const DEFAULT_SEPARATOR = SEPARATOR_OPTIONS[0].value; + +/** + * Indeterminate KDF progress. Scrypt does not expose intermediate progress, + * so randomized increments consume a shrinking fraction of the remaining + * distance. The bar moves quickly at first and can never reach completion. + */ +function FakeKdfProgressBar() { + const [progress, setProgress] = React.useState(0); + + React.useEffect(() => { + let animationFrame = 0; + let nextAdvanceAt = 0; + const advance = (now: number) => { + if (now >= nextAdvanceAt) { + setProgress((current) => { + const remaining = 90 - current; + const fraction = 0.08 + Math.random() * 0.22; + return Math.min(90, current + Math.max(0.25, remaining * fraction)); + }); + nextAdvanceAt = now + 180 + Math.random() * 420; + } + animationFrame = window.requestAnimationFrame(advance); + }; + animationFrame = window.requestAnimationFrame(advance); + return () => window.cancelAnimationFrame(animationFrame); + }, []); + + return ( +
+
+
+ ); +} + +/** + * 1Password-style memorable-password generator popover with word-count and + * separator fields, anchored to a refresh icon inset in the password field + * (the anchor assumes a `relative` parent). The first click opens the + * popover and generates; further clicks on the icon re-roll while the + * popover stays open — only click-outside or Esc closes it. There is no + * candidate preview: every generation writes the passphrase straight into + * the parent's password field via `onGenerated`. + */ +function PassphraseGeneratorPopover({ + disabled = false, + onRequestGenerate, + onGenerated, +}: { + disabled?: boolean; + onRequestGenerate?: () => void; + onGenerated: (value: string) => void; +}) { + const [open, setOpen] = React.useState(false); + const [words, setWords] = React.useState(DEFAULT_GENERATED_WORDS); + const [separator, setSeparator] = React.useState(DEFAULT_SEPARATOR); + const [error, setError] = React.useState(null); + const anchorRef = React.useRef(null); + const mountedRef = React.useRef(true); + // Read via a ref so `generate` stays reference-stable even though parents + // pass an inline `onGenerated`. Otherwise each generated password would + // re-render the parent, rebuild `generate`, and re-fire the open/controls + // effect below — an infinite generate loop while the popover is open. + const onGeneratedRef = React.useRef(onGenerated); + + React.useEffect(() => { + onGeneratedRef.current = onGenerated; + }, [onGenerated]); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + }; + }, []); + + const generate = React.useCallback(async (wordCount: number, sep: string) => { + setError(null); + try { + const passphrase = await generateBackupPassphrase({ + words: wordCount, + separator: sep, + }); + if (mountedRef.current) onGeneratedRef.current(passphrase); + } catch (err) { + if (!mountedRef.current) return; + setError( + err instanceof Error ? err.message : "Failed to generate a password.", + ); + } + }, []); + + // Fill the password field on every open and whenever a control changes. + React.useEffect(() => { + if (open) void generate(words, separator); + }, [open, words, separator, generate]); + + return ( + + {/* Anchor (not Trigger): Radix triggers toggle on click, but repeat + clicks here must generate a fresh password while the popover stays + open. Only click-outside or Esc closes it. */} + + + + { + // Clicking the anchor icon is "outside" the content — keep the + // popover open so that click re-rolls instead of closing. + if ( + event.target instanceof Node && + anchorRef.current?.contains(event.target) + ) { + event.preventDefault(); + } + }} + onOpenAutoFocus={(event) => event.preventDefault()} + > +
+ +
+ setWords(Number(event.target.value))} + type="range" + value={words} + /> + + {words} + +
+
+ +
+ + +
+ + {error ? ( +

+ + {error} +

+ ) : null} + + + ); +} + +/** + * Password-first encrypted key download flow for Settings. The raw private + * key never enters this component. Rust creates the + * NIP-49 payload locally, then the native save dialog produces the user-owned + * file. + * + * The flow is a single password input; a refresh icon inset in the field + * opens a 1Password-style generator popover (word count + separator). + * Encryption starts eagerly once the password is valid, so Download usually + * opens the save dialog instantly; clicking mid-encryption queues the + * download until the KDF finishes. + */ +export function EncryptedBackupCreator({ + onOpenChange, + open, +}: { + onOpenChange: (open: boolean) => void; + open: boolean; +}) { + const { state, dispatch, isSaving, saveError } = useEncryptedBackup(); + const [isRevealed, setIsRevealed] = React.useState(false); + + // A queued download hides the form; mask the password before it can return + // in any error state. + React.useEffect(() => { + if (state.downloadPending) setIsRevealed(false); + }, [state.downloadPending]); + + React.useEffect(() => { + if (state.ncryptsec) onOpenChange(false); + }, [onOpenChange, state.ncryptsec]); + + return ( + + + + Create a key backup + + You can close this window while Buzz finishes the backup in the + background. + + +
+ {state.downloadPending ? ( + + ) : !state.savedPassword ? ( +
+ + dispatch({ + type: "set-passphrase", + value: event.target.value, + }) + } + placeholder={`Password (min ${MIN_PASSPHRASE_LEN} characters)`} + type={isRevealed ? "text" : "password"} + value={state.passphrase} + /> + + { + dispatch({ type: "set-passphrase", value }); + // A generated password must be visible so the user can save it. + setIsRevealed(true); + }} + /> +
+ ) : null} + + {!state.downloadPending && !state.savedPassword ? ( +

+ Keep the file private and save its password somewhere safe — Buzz + cannot reset it. Once ready, the backup remains available to + download for 5 minutes. +

+ ) : null} + + {state.createError && state.passphrase.length === 0 ? ( +

+ {state.createError} +

+ ) : null} + + {saveError ? ( +

+ {saveError} +

+ ) : null} + + {!state.downloadPending ? ( +
+ +
+ ) : null} +
+ + + ); +} diff --git a/desktop/src/features/settings/ui/PrivateKeyBackupRow.tsx b/desktop/src/features/settings/ui/PrivateKeyBackupRow.tsx new file mode 100644 index 0000000000..8eb0256a55 --- /dev/null +++ b/desktop/src/features/settings/ui/PrivateKeyBackupRow.tsx @@ -0,0 +1,215 @@ +import { Download, Eye, EyeOff, ShieldCheck } from "lucide-react"; +import * as React from "react"; + +import { NsecMaskedDisplay } from "@/features/onboarding/ui/NsecMaskedDisplay"; +import { + BACKUP_AVAILABILITY_MS, + useEncryptedBackup, +} from "@/features/settings/EncryptedBackupProvider"; +import { + BackupTestFlow, + initialBackupTestProgress, +} from "@/features/settings/ui/BackupTestFlow"; +import { EncryptedBackupCreator } from "@/features/settings/ui/EncryptedBackupCreator"; +import { getNsec } from "@/shared/api/tauriIdentity"; +import { Button } from "@/shared/ui/button"; +import { + Dialog, + DialogContent, + DialogDescription, + DialogHeader, + DialogTitle, +} from "@/shared/ui/dialog"; + +function BackupAvailabilityFill({ + availableUntil, +}: { + availableUntil: number; +}) { + const [{ durationMs, initialWidth }] = React.useState(() => { + const remainingMs = Math.max(0, availableUntil - Date.now()); + return { + durationMs: remainingMs, + initialWidth: Math.min(100, (remainingMs / BACKUP_AVAILABILITY_MS) * 100), + }; + }); + const [width, setWidth] = React.useState(initialWidth); + + React.useEffect(() => { + const frame = window.requestAnimationFrame(() => setWidth(0)); + return () => window.cancelAnimationFrame(frame); + }, []); + + return ( +
diff --git a/desktop/src/shared/api/tauriIdentity.ts b/desktop/src/shared/api/tauriIdentity.ts index e6056a4a58..e6ec266bff 100644 --- a/desktop/src/shared/api/tauriIdentity.ts +++ b/desktop/src/shared/api/tauriIdentity.ts @@ -49,3 +49,52 @@ export async function persistCurrentIdentity(): Promise { export async function signOut(): Promise { await invokeTauri("sign_out"); } + +export type GeneratePassphraseOptions = { + /** Word count; Rust clamps to its allowed range (currently 3–10). */ + words?: number; + /** Separator joined between words. Defaults to a space in Rust. */ + separator?: string; +}; + +/** Generate a word passphrase (EFF short wordlist, OS entropy) in Rust. */ +export async function generateBackupPassphrase( + options?: GeneratePassphraseOptions, +): Promise { + return invokeTauri("generate_backup_passphrase", { + words: options?.words, + separator: options?.separator, + }); +} + +/** Encrypt the current identity as an in-memory NIP-49 backup for native save. */ +export async function createNcryptsecBackup(password: string): Promise { + return invokeTauri("create_ncryptsec_backup", { password }); +} + +/** Save a portable backup copy. Returns null when the native dialog is cancelled. */ +export async function saveNcryptsecCopy( + ncryptsec: string, +): Promise { + return ( + (await invokeTauri("save_ncryptsec_copy", { ncryptsec })) ?? + null + ); +} + +export type BackupVerification = { + pubkey: string; + npub: string; + matchesCurrentIdentity: boolean; +}; + +/** Decrypt locally and return only the backup's public identity and match state. */ +export async function verifyNcryptsecBackup( + ncryptsec: string, + password: string, +): Promise { + return invokeTauri("verify_ncryptsec_backup", { + ncryptsec, + password, + }); +} diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index d15f2269d3..4b19004965 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -1,6 +1,6 @@ import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js"; import { mockIPC, mockWindows } from "@tauri-apps/api/mocks"; -import { decode } from "nostr-tools/nip19"; +import { decode, npubEncode } from "nostr-tools/nip19"; import { finalizeEvent, getPublicKey } from "nostr-tools/pure"; import { parse as yamlParse } from "yaml"; import { @@ -417,6 +417,14 @@ type E2eConfig = { * autosave behaviour while a request is in flight. 0/undefined = instant. * Alias of `globalConfigSaveDelayMs` (kept for onboarding specs). */ setGlobalAgentConfigDelayMs?: number; + /** Errors returned by successive backup verification attempts. Null succeeds. */ + backupVerificationErrors?: (string | null)[]; + /** Public identities returned by successive successful backup verifications. */ + backupVerificationPubkeys?: string[]; + /** Delay (ms) applied to backup encryption so specs can observe pending UI. */ + backupEncryptionDelayMs?: number; + /** Native paths returned by successive backup saves. */ + backupSavePaths?: Array; /** * When set, `get_nsec` throws with this message instead of returning the * mock nsec string. Use `nsecErrors` for sequenced failure/success. @@ -7204,6 +7212,8 @@ let mockGlobalAgentConfig: { // Per-page get_nsec call counter for sequenced error testing. let nsecCallCount = 0; +let backupVerificationCallCount = 0; +let backupSaveCallCount = 0; // Per-page explicit catalog publication outcomes. let personaSharePublicationCallCount = 0; @@ -9843,6 +9853,43 @@ export function maybeInstallE2eTauriMocks() { // harness there is nothing to wipe; resolving is enough — specs // assert invocation via __BUZZ_E2E_COMMANDS__ and the pending UI. return; + case "generate_backup_passphrase": + return "correct horse battery staple"; + case "create_ncryptsec_backup": { + const delayMs = activeConfig?.mock?.backupEncryptionDelayMs ?? 0; + if (delayMs > 0) { + await new Promise((resolve) => setTimeout(resolve, delayMs)); + } + return "ncryptsec1mockbackupmaterial"; + } + case "save_ncryptsec_copy": { + const paths = activeConfig?.mock?.backupSavePaths ?? [ + "/tmp/buzz-identity.ncryptsec", + ]; + const index = Math.min(backupSaveCallCount, paths.length - 1); + backupSaveCallCount += 1; + return paths[index]; + } + case "verify_ncryptsec_backup": { + const errors = activeConfig?.mock?.backupVerificationErrors ?? [null]; + const index = Math.min(backupVerificationCallCount, errors.length - 1); + const error = errors[index]; + if (error) { + backupVerificationCallCount += 1; + throw new Error(error); + } + const pubkeys = activeConfig?.mock?.backupVerificationPubkeys ?? [ + identity?.pubkey ?? DEFAULT_MOCK_IDENTITY.pubkey, + ]; + const pubkey = pubkeys[Math.min(index, pubkeys.length - 1)]; + backupVerificationCallCount += 1; + return { + pubkey, + npub: npubEncode(pubkey), + matchesCurrentIdentity: + pubkey === (identity?.pubkey ?? DEFAULT_MOCK_IDENTITY.pubkey), + }; + } case "get_nsec": { const nsecSequence = activeConfig?.mock?.nsecErrors; if (nsecSequence && nsecSequence.length > 0) { diff --git a/desktop/tests/e2e/profile-backup-settings.spec.ts b/desktop/tests/e2e/profile-backup-settings.spec.ts new file mode 100644 index 0000000000..edd66170da --- /dev/null +++ b/desktop/tests/e2e/profile-backup-settings.spec.ts @@ -0,0 +1,259 @@ +import { expect, test, type Page } from "@playwright/test"; +import { npubEncode } from "nostr-tools/nip19"; + +import { installMockBridge } from "../helpers/bridge"; +import { openSettings } from "../helpers/settings"; + +const CURRENT_PUBKEY = "deadbeef".repeat(8); +const DIFFERENT_PUBKEY = "c0ffee00".repeat(8); +const BACKUP_FILE = { + name: "identity.ncryptsec", + mimeType: "text/plain", + buffer: Buffer.from("ncryptsec1mockbackupmaterial"), +}; + +async function openIdentity(page: Page) { + const identity = page.getByTestId("profile-identity-card"); + if ( + !(await identity.evaluate( + (element) => element instanceof HTMLDetailsElement && element.open, + )) + ) { + await page.getByTestId("profile-identity-toggle").click(); + } +} + +async function openBackupSettings( + page: Page, + mock?: Parameters[1], +) { + await installMockBridge(page, mock); + await page.goto("/"); + await openSettings(page, "profile"); + await openIdentity(page); +} + +async function openPrivateKeyMenu(page: Page) { + const reveal = page.getByTestId("profile-private-key-toggle"); + if ((await reveal.textContent())?.trim() === "Reveal") { + await reveal.click(); + } + await page.getByTestId("nsec-actions").click(); + await expect(page.getByTestId("private-key-create-backup")).toBeVisible(); +} + +async function openCreateBackup(page: Page) { + await openPrivateKeyMenu(page); + await page.getByTestId("private-key-create-backup").click(); + const dialog = page.getByTestId("encrypted-backup-dialog"); + await expect(dialog).toBeVisible(); + return dialog; +} + +async function openTestBackup(page: Page) { + await openPrivateKeyMenu(page); + await page.getByTestId("private-key-test-backup").click(); + const dialog = page.getByTestId("backup-test-dialog"); + await expect(dialog).toBeVisible(); + return dialog; +} + +async function selectBackupFile(page: Page) { + await page.getByTestId("backup-test-file-input").setInputFiles(BACKUP_FILE); + await expect(page.getByTestId("backup-test-file-accepted")).toContainText( + BACKUP_FILE.name, + ); +} + +async function verifyBackup(page: Page, password: string) { + await page.getByTestId("backup-test-password").fill(password); + await page.getByTestId("backup-test-verify").click(); +} + +async function backupSaveCallCount(page: Page) { + return page.evaluate( + () => + window.__BUZZ_E2E_COMMANDS__?.filter( + (command) => command === "save_ncryptsec_copy", + ).length ?? 0, + ); +} + +test("private key menu replaces the backup settings rows", async ({ page }) => { + await openBackupSettings(page); + + await expect(page.getByTestId("profile-encrypted-backup-row")).toHaveCount(0); + await expect(page.getByTestId("profile-backup-test-row")).toHaveCount(0); + + await openPrivateKeyMenu(page); + await expect(page.getByTestId("nsec-copy")).toContainText("Copy"); + await expect(page.getByTestId("private-key-create-backup")).toHaveText( + "Create backup", + ); + await expect(page.getByTestId("private-key-test-backup")).toHaveText( + "Test backup", + ); + + await page.getByTestId("nsec-copy").click(); + await expect(page.getByText(/clipboard$/i)).toBeVisible(); + await expect(page.getByTestId("private-key-create-backup")).toHaveCount(0); + + await openPrivateKeyMenu(page); + await page.getByTestId("private-key-test-backup").click(); + const testDialog = page.getByTestId("backup-test-dialog"); + await expect(testDialog).toContainText("Test a key backup"); + await expect(testDialog.getByText("Select your backup file")).toBeVisible(); + await expect(testDialog).toContainText("standard NIP-49 format"); +}); + +test("creation requires a sufficiently long password and exposes a temporary header download", async ({ + page, +}) => { + await openBackupSettings(page, { + backupSavePaths: [ + "/Users/test/Downloads/identity.ncryptsec", + "/Users/test/Desktop/identity-copy.ncryptsec", + ], + }); + const dialog = await openCreateBackup(page); + + const password = dialog.getByTestId("backup-passphrase-input"); + const submit = dialog.getByTestId("encrypted-backup-create"); + await expect(password).toHaveAttribute( + "placeholder", + "Password (min 12 characters)", + ); + await expect(submit).toBeDisabled(); + await password.fill("short"); + await expect(submit).toBeDisabled(); + + await password.fill("custom password"); + await expect(submit).toBeEnabled(); + await submit.click(); + await expect.poll(() => backupSaveCallCount(page)).toBe(1); + await expect(dialog).toBeHidden(); + + const keyRow = page.getByTestId("profile-private-key-row"); + const download = keyRow.getByTestId("encrypted-backup-download"); + await expect(download).toBeVisible(); + await expect(download).toHaveText("Download backup"); + await expect(download).toHaveClass(/bg-primary/); + await expect( + download.getByTestId("encrypted-backup-availability-fill"), + ).toBeVisible(); + await expect(keyRow.getByTestId("profile-private-key-toggle")).toBeVisible(); + + await download.click(); + await expect.poll(() => backupSaveCallCount(page)).toBe(2); +}); + +test("encryption and native save continue after closing the dialog and settings", async ({ + page, +}) => { + await openBackupSettings(page, { + backupEncryptionDelayMs: 750, + backupSavePaths: [null], + }); + const dialog = await openCreateBackup(page); + await dialog + .getByTestId("backup-passphrase-input") + .fill("background password"); + await dialog.getByTestId("encrypted-backup-create").click(); + await expect(dialog.getByTestId("encrypted-backup-progress")).toBeVisible(); + + await dialog.getByRole("button", { name: "Close" }).click(); + await page.getByTestId("settings-back-to-app").click(); + await expect(page.getByTestId("settings-back-to-app")).toHaveCount(0); + await expect( + page.getByText("Preparing backup…", { exact: true }), + ).toBeVisible(); + + await expect.poll(() => backupSaveCallCount(page)).toBe(1); + const readyToast = page.getByText("Backup ready to download", { + exact: true, + }); + await expect(readyToast).toBeVisible(); + await expect( + page.getByText("Your backup will be available to download for 5 minutes.", { + exact: true, + }), + ).toBeVisible(); + + await page.getByRole("button", { name: "Open settings" }).click(); + await expect(page.getByTestId("settings-back-to-app")).toBeVisible(); + await openIdentity(page); + await expect(page.getByTestId("encrypted-backup-download")).toBeVisible(); +}); + +test("the temporary download expires after five minutes", async ({ page }) => { + await page.clock.install({ time: new Date("2026-07-29T12:00:00Z") }); + await openBackupSettings(page); + const dialog = await openCreateBackup(page); + await dialog.getByTestId("backup-passphrase-input").fill("expiring password"); + await dialog.getByTestId("encrypted-backup-create").click(); + await page.clock.fastForward(1); + + await expect.poll(() => backupSaveCallCount(page)).toBe(1); + const download = page.getByTestId("encrypted-backup-download"); + await expect(download).toHaveText("Download backup"); + await expect( + download.getByTestId("encrypted-backup-availability-fill"), + ).toBeVisible(); + await page.clock.fastForward(5 * 60 * 1000 + 1); + await expect(page.getByTestId("encrypted-backup-download")).toHaveCount(0); +}); + +test("wrong backup password permits a successful retry in the test modal", async ({ + page, +}) => { + await openBackupSettings(page, { + backupVerificationErrors: ["Wrong password.", null], + }); + const dialog = await openTestBackup(page); + await selectBackupFile(page); + + await verifyBackup(page, "wrong password"); + await expect(dialog.getByTestId("backup-test-error")).toHaveText( + "Wrong password.", + ); + await expect(dialog.getByTestId("backup-test-password")).toHaveValue(""); + await expect(dialog.getByTestId("backup-test-verify")).toBeDisabled(); + + await verifyBackup(page, "correct password"); + await expect(dialog.getByTestId("backup-test-success")).toContainText( + "It restores your current Buzz identity.", + ); +}); + +for (const identity of [ + { + label: "current", + pubkey: CURRENT_PUBKEY, + message: "It restores your current Buzz identity.", + }, + { + label: "different", + pubkey: DIFFERENT_PUBKEY, + message: "It restores a different identity than the one signed in here.", + }, +]) { + test(`successful modal verification identifies the ${identity.label} identity using only its npub`, async ({ + page, + }) => { + await openBackupSettings(page, { + backupVerificationPubkeys: [identity.pubkey], + }); + const dialog = await openTestBackup(page); + await selectBackupFile(page); + await verifyBackup(page, "one-time password"); + + const success = dialog.getByTestId("backup-test-success"); + await expect(success).toContainText(identity.message); + await expect(success.getByTestId("backup-test-npub")).toContainText( + npubEncode(identity.pubkey), + ); + await expect(success).not.toContainText(identity.pubkey); + await expect(success).not.toContainText("one-time password"); + await expect(success).not.toContainText(BACKUP_FILE.buffer.toString()); + }); +} diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index b48a75914b..468f860203 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -441,6 +441,14 @@ type MockBridgeOptions = { /** Delay (ms) for `set_global_agent_config` — hold saves open in tests. * Alias of `globalConfigSaveDelayMs` (kept for onboarding specs). */ setGlobalAgentConfigDelayMs?: number; + /** Errors returned by successive backup verification attempts. Null succeeds. */ + backupVerificationErrors?: (string | null)[]; + /** Public identities returned by successive successful backup verifications. */ + backupVerificationPubkeys?: string[]; + /** Delay (ms) applied to backup encryption so specs can observe pending UI. */ + backupEncryptionDelayMs?: number; + /** Native paths returned by successive backup saves. */ + backupSavePaths?: Array; /** * When set, `get_nsec` throws with this message. For a single always-fail * scenario. Use `nsecErrors` for sequenced fail/succeed. From cca8839034eb571a7ce943c3ace7f85a82330898 Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 30 Jul 2026 12:25:08 -0600 Subject: [PATCH 081/112] Make relay reconnect backoff authoritative (#3774) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - make the relay reconnect coordinator authoritative during outages so query, publish, and subscription traffic waits for the scheduled attempt instead of cancelling backoff - release waiting operations after the coordinated AUTH + live-subscription replay attempt, while preserving one explicit manual reconnect fast path - suppress duplicate notification side effects when reconnect replay overlaps previously delivered events ## Root cause `resetConnection()` scheduled exponential backoff, but `ensureConnected()` cleared any pending reconnect timer. Operation-level retry paths immediately called `ensureConnected()`, so ordinary app traffic could repeatedly bypass the reconnect policy during an outage. The resulting churn also replayed overlapping live events into notification side effects without a shared event-ID guard. ## Validation - `pnpm --dir desktop typecheck` - `pnpm --dir desktop test` — 3,823 passed - pre-push: `desktop-check`, `desktop-test`, and `branch-skew` passed - file-size, px-text, and pubkey-truncation ratchets passed --------- Signed-off-by: Wes Co-authored-by: Carl --- .../channels/unreadReadMarker.test.mjs | 11 ++ .../channels/useLiveChannelUpdates.ts | 98 ++++++----- desktop/src/shared/api/relayClientSession.ts | 94 +++++------ .../shared/api/relayReconnectPolicy.test.mjs | 12 ++ .../src/shared/api/relayReconnectPolicy.ts | 6 + .../shared/api/relayReconnectWaiters.test.mjs | 26 +++ .../src/shared/api/relayReconnectWaiters.ts | 21 +++ desktop/src/testing/e2eBridge.ts | 24 +++ desktop/tests/e2e/helpers/twoRelayHarness.ts | 1 + desktop/tests/e2e/relay-reconnect.spec.ts | 74 ++++++++ desktop/tests/e2e/relay-restart.live.spec.ts | 158 +++++++++++++++++- 11 files changed, 429 insertions(+), 96 deletions(-) create mode 100644 desktop/src/shared/api/relayReconnectWaiters.test.mjs create mode 100644 desktop/src/shared/api/relayReconnectWaiters.ts diff --git a/desktop/src/features/channels/unreadReadMarker.test.mjs b/desktop/src/features/channels/unreadReadMarker.test.mjs index e05e2ba0b2..6ea0916413 100644 --- a/desktop/src/features/channels/unreadReadMarker.test.mjs +++ b/desktop/src/features/channels/unreadReadMarker.test.mjs @@ -18,6 +18,7 @@ import { } from "./useUnreadChannels.ts"; import { isChannelUnreadTriggerKind, + trackSeenEvent, withChannelTagFallback, } from "./useLiveChannelUpdates.ts"; import { @@ -90,6 +91,16 @@ test("live event with h tag is preserved", () => { assert.equal(withChannelTagFallback(message, "other-channel"), message); }); +test("notification event guard suppresses reconnect replay and stays bounded", () => { + const seen = new Set(); + + assert.equal(trackSeenEvent(seen, "event-a", 2), true); + assert.equal(trackSeenEvent(seen, "event-a", 2), false); + assert.equal(trackSeenEvent(seen, "event-b", 2), true); + assert.equal(trackSeenEvent(seen, "event-c", 2), true); + assert.deepEqual([...seen], ["event-b", "event-c"]); +}); + test("dmHuddleStart_isDmOnlyUnreadTrigger", () => { assert.equal( isChannelUnreadTriggerKind(KIND_HUDDLE_STARTED, true), diff --git a/desktop/src/features/channels/useLiveChannelUpdates.ts b/desktop/src/features/channels/useLiveChannelUpdates.ts index aeb3abb905..800467b6ea 100644 --- a/desktop/src/features/channels/useLiveChannelUpdates.ts +++ b/desktop/src/features/channels/useLiveChannelUpdates.ts @@ -110,13 +110,19 @@ function isExternalMentionEvent(event: RelayEvent, currentPubkey: string) { ); } -function trackSeenEvent(seenEventIds: Set, eventId: string): boolean { +const SEEN_NOTIFICATION_EVENT_LIMIT = 5_000; + +export function trackSeenEvent( + seenEventIds: Set, + eventId: string, + limit = 200, +): boolean { if (seenEventIds.has(eventId)) { return false; } seenEventIds.add(eventId); - if (seenEventIds.size > 200) { + if (seenEventIds.size > limit) { const oldestEventId = seenEventIds.values().next().value; if (oldestEventId) { seenEventIds.delete(oldestEventId); @@ -135,6 +141,11 @@ export function useLiveChannelUpdates( const normalizedCurrentPubkey = options.currentPubkey?.trim().toLowerCase() ?? ""; const seenMentionEventIdsRef = React.useRef(new Set()); + // Reconnect replay overlaps each live filter by five seconds so no message is + // lost at the boundary. Keep one shared guard for every notification side + // effect: the same event can be replayed repeatedly while a relay flaps, and + // mention events also arrive through both the channel and mention filters. + const seenNotificationEventIdsRef = React.useRef(new Set()); const channelsInvalidateRef = React.useRef(null); if (channelsInvalidateRef.current === null) { channelsInvalidateRef.current = createTrailingDebounce(() => { @@ -164,7 +175,6 @@ export function useLiveChannelUpdates( ), [channels], ); - const seenDmEventIdsRef = React.useRef(new Set()); const dmSubscriptionStartedAtRef = React.useRef(0); // Reset subscription timestamp when identity changes. @@ -181,44 +191,42 @@ export function useLiveChannelUpdates( [channels], ); - const handleDmEvent = React.useEffectEvent((event: RelayEvent) => { - // Only human-visible message kinds should fire DM notifications. - if (!isDmNotifiableKind(event.kind)) { - return; - } - - // Suppress backlog events that predate our subscription — these are - // historical replays, not live messages. - if (event.created_at < dmSubscriptionStartedAtRef.current) { - return; - } + const handleDmEvent = React.useEffectEvent( + (event: RelayEvent, isFirstNotificationDelivery: boolean) => { + // Only human-visible message kinds should fire DM notifications. + if (!isDmNotifiableKind(event.kind) || !isFirstNotificationDelivery) { + return; + } - const channelId = getChannelIdFromTags(event.tags); - if (!channelId) { - return; - } + // Suppress backlog events that predate our subscription — these are + // historical replays, not live messages. + if (event.created_at < dmSubscriptionStartedAtRef.current) { + return; + } - if (!isExternalMentionEvent(event, normalizedCurrentPubkey)) { - return; - } + const channelId = getChannelIdFromTags(event.tags); + if (!channelId) { + return; + } - const dmChannel = dmChannelMap.get(channelId); - if (!dmChannel) { - return; - } + if (!isExternalMentionEvent(event, normalizedCurrentPubkey)) { + return; + } - if (!trackSeenEvent(seenDmEventIdsRef.current, event.id)) { - return; - } + const dmChannel = dmChannelMap.get(channelId); + if (!dmChannel) { + return; + } - // Don't fire a notification for the channel the user is already viewing, - // unless the notify-while-viewing setting opts in. - if (channelId === activeChannelId && !options.notifyForActiveChannel) { - return; - } + // Don't fire a notification for the channel the user is already viewing, + // unless the notify-while-viewing setting opts in. + if (channelId === activeChannelId && !options.notifyForActiveChannel) { + return; + } - options.onDmMessage?.(event, dmChannel); - }); + options.onDmMessage?.(event, dmChannel); + }, + ); const handleIncomingMessage = React.useEffectEvent((event: RelayEvent) => { const channelId = getChannelIdFromTags(event.tags); @@ -226,12 +234,6 @@ export function useLiveChannelUpdates( return; } - // Track DM events even for the active channel so the dedup set stays - // current. The handler itself skips firing the notification callback - // when the user is already viewing the DM (unless opted in via - // notifyForActiveChannel). - handleDmEvent(event); - if (!liveChannelIds.has(channelId)) { if (channelId !== activeChannelId) { invalidateChannelsDebounced(); @@ -263,9 +265,21 @@ export function useLiveChannelUpdates( isUnreadTriggerKind && (normalizedCurrentPubkey.length === 0 || event.pubkey.toLowerCase() !== normalizedCurrentPubkey); + const isFirstNotificationDelivery = + !isExternalTriggerEvent || + trackSeenEvent( + seenNotificationEventIdsRef.current, + event.id, + SEEN_NOTIFICATION_EVENT_LIMIT, + ); const isThreadedReply = isThreadReply(event.tags); - if (isExternalTriggerEvent) { + // DM alerts and every other notification side effect share this delivery + // decision, preventing a replayed event from escaping through a second + // callback path. + handleDmEvent(event, isFirstNotificationDelivery); + + if (isExternalTriggerEvent && isFirstNotificationDelivery) { const shouldNotify = shouldNotifyForEvent( event, normalizedCurrentPubkey, diff --git a/desktop/src/shared/api/relayClientSession.ts b/desktop/src/shared/api/relayClientSession.ts index 84ee10b68d..8274034ed5 100644 --- a/desktop/src/shared/api/relayClientSession.ts +++ b/desktop/src/shared/api/relayClientSession.ts @@ -49,7 +49,9 @@ import { isWebSocketClose, shouldRefuseConnect, shouldScheduleReconnect, + shouldWaitForScheduledReconnect, } from "@/shared/api/relayReconnectPolicy"; +import { RelayReconnectWaiters } from "@/shared/api/relayReconnectWaiters"; import { RelayStallWatchdog } from "@/shared/api/relayStallWatchdog"; import { closeWebSocket } from "@/shared/api/relayWebSocketClose"; import { buildThreadReferenceTags } from "@/features/messages/lib/threading"; @@ -57,26 +59,12 @@ const RECONNECT_BASE_DELAY_MS = 1_000, RECONNECT_MAX_DELAY_MS = 30_000, EVENT_BATCH_MS = 16; -/** - * Op-level timeout constants. Raised from 8 s to 25 s to survive degraded - * networks where TLS handshakes and DNS resolution can take 3–10 s. - */ export const AUTH_TIMEOUT_MS = 25_000; export const HISTORY_TIMEOUT_MS = 25_000; export const PUBLISH_TIMEOUT_MS = 25_000; -/** - * The connection must remain stable for this long after a successful AUTH - * before the reconnect backoff delay resets to its base value. Stability- - * gated reset prevents repeated fast reconnects (flapping) from erasing the - * backoff that throttles them. - */ export const BACKOFF_RESET_STABLE_MS = 60_000; -/** - * Passive liveness check. The relay sends heartbeat pings every 30s; if no - * inbound frame arrives for two heartbeat windows, treat the socket as stalled. - */ const STALL_CHECK_INTERVAL_MS = 10_000; const STALL_IDLE_TIMEOUT_MS = 60_000; @@ -85,6 +73,7 @@ export class RelayClient { private relayUrl: string | null = null; private connectPromise: Promise | null = null; private reconnectTimeout: number | null = null; + private reconnectWaiters = new RelayReconnectWaiters(); private reconnectDelayMs = RECONNECT_BASE_DELAY_MS; private keepAliveRequested = false; private authRequest: { @@ -105,16 +94,6 @@ export class RelayClient { private stabilityTimer: number | null = null; private visibleChannelId: string | null = null; - /** - * Sticky terminal flag. Set when `resetConnection` is called with - * `reconnect: false` (today: auth rejection). Acts as a hard guard against - * the reconnect-timer / retry-wrapper paths racing back to "reconnecting" - * after we've already declared the session dead. - * - * Cleared only on explicit user re-engagement: `disconnect()` (community - * switch — the singleton is being reused for a different community) and - * `preconnect()` (caller is asking us to come back up). - */ private terminal = false; private connectionStateEmitter = new RelayConnectionStateEmitter("idle"); @@ -127,21 +106,10 @@ export class RelayClient { }, }); - /** - * Track which channel the user is currently viewing so its subscriptions - * are sent first during reconnect replay — reducing visible latency on - * degraded networks where the relay REQ storm would otherwise delay all - * channels equally. - */ setVisibleChannelId(id: string | null) { this.visibleChannelId = id; } - /** - * Cleanly tear down the connection without scheduling a reconnect. - * Used during community switches to reset the singleton before the - * new community applies. - */ disconnect() { const error = new Error("Relay disconnected for community switch."); @@ -169,6 +137,7 @@ export class RelayClient { } this.connectPromise = null; + this.reconnectWaiters.settle(error); if (this.authRequest) { window.clearTimeout(this.authRequest.timeout); @@ -247,10 +216,6 @@ export class RelayClient { return this.fetchHistory(filter); } - /** - * Return the first event matching `filter` as soon as it arrives, without - * waiting for EOSE. Resolves to `null` when EOSE arrives before any event. - */ async fetchFirstEvent( filter: RelaySubscriptionFilter, ): Promise { @@ -462,10 +427,24 @@ export class RelayClient { async preconnect() { // Explicit re-engagement. If the session went terminal (auth rejection) - // the caller is asking us to try again, so clear the latch. + // the caller is asking us to try again, so clear the latch. A manual + // reconnect also bypasses the current delay once; ordinary operations do + // not, so background traffic cannot continuously defeat backoff. this.terminal = false; this.keepAliveRequested = true; - await this.ensureConnected(); + if (this.reconnectTimeout !== null) { + window.clearTimeout(this.reconnectTimeout); + this.reconnectTimeout = null; + } + try { + await this.ensureConnected(); + this.reconnectWaiters.settle(); + } catch (error) { + this.reconnectWaiters.settle( + this.normalizeRelayError(error, "Relay reconnect failed."), + ); + throw error; + } } subscribeToReconnects(listener: () => void) { @@ -508,9 +487,15 @@ export class RelayClient { return; } - if (this.reconnectTimeout) { - window.clearTimeout(this.reconnectTimeout); - this.reconnectTimeout = null; + if ( + shouldWaitForScheduledReconnect({ + hasPendingReconnect: this.reconnectTimeout !== null, + }) + ) { + // The reconnect coordinator owns outage pacing. Query, publish, and + // subscription callers must wait for its scheduled attempt instead of + // clearing the timer and creating an immediate reconnect storm. + return this.waitForScheduledReconnect(); } const connectPromise = this.connect(); @@ -964,6 +949,13 @@ export class RelayClient { } } + private waitForScheduledReconnect(): Promise { + if (this.reconnectTimeout === null) { + return this.ensureConnected(); + } + return this.reconnectWaiters.wait(); + } + private scheduleReconnect() { if ( !shouldScheduleReconnect({ @@ -989,9 +981,14 @@ export class RelayClient { this.reconnectTimeout = window.setTimeout(() => { this.reconnectTimeout = null; - void this.ensureConnected().catch(() => { - this.scheduleReconnect(); - }); + void this.ensureConnected() + .then(() => this.reconnectWaiters.settle()) + .catch((error) => { + this.reconnectWaiters.settle( + this.normalizeRelayError(error, "Relay reconnect failed."), + ); + this.scheduleReconnect(); + }); }, delay); } @@ -1049,6 +1046,9 @@ export class RelayClient { window.clearTimeout(this.reconnectTimeout); this.reconnectTimeout = null; } + if (options?.reconnect === false) { + this.reconnectWaiters.settle(error); + } if (this.wsId !== null) { void closeWebSocket(this.wsId, "connection reset"); diff --git a/desktop/src/shared/api/relayReconnectPolicy.test.mjs b/desktop/src/shared/api/relayReconnectPolicy.test.mjs index 6f375fb436..e6856ede18 100644 --- a/desktop/src/shared/api/relayReconnectPolicy.test.mjs +++ b/desktop/src/shared/api/relayReconnectPolicy.test.mjs @@ -6,6 +6,7 @@ import { isWebSocketClose, shouldRefuseConnect, shouldScheduleReconnect, + shouldWaitForScheduledReconnect, } from "./relayReconnectPolicy.ts"; // The "happy" baseline that *should* schedule a reconnect: not terminal, @@ -79,6 +80,17 @@ test("keep-alive alone is enough to schedule", () => { ); }); +test("ordinary operations wait for a scheduled reconnect instead of bypassing backoff", () => { + assert.equal( + shouldWaitForScheduledReconnect({ hasPendingReconnect: true }), + true, + ); + assert.equal( + shouldWaitForScheduledReconnect({ hasPendingReconnect: false }), + false, + ); +}); + test("shouldRefuseConnect mirrors terminal", () => { assert.equal(shouldRefuseConnect({ terminal: false }), false); assert.equal(shouldRefuseConnect({ terminal: true }), true); diff --git a/desktop/src/shared/api/relayReconnectPolicy.ts b/desktop/src/shared/api/relayReconnectPolicy.ts index a2cf358216..00d8e412bd 100644 --- a/desktop/src/shared/api/relayReconnectPolicy.ts +++ b/desktop/src/shared/api/relayReconnectPolicy.ts @@ -37,6 +37,12 @@ export function shouldScheduleReconnect(inputs: RelayReconnectInputs): boolean { return true; } +export function shouldWaitForScheduledReconnect(inputs: { + hasPendingReconnect: boolean; +}): boolean { + return inputs.hasPendingReconnect; +} + /** Whether `ensureConnected()` should refuse with a terminal error. */ export function shouldRefuseConnect(inputs: { terminal: boolean }): boolean { return inputs.terminal; diff --git a/desktop/src/shared/api/relayReconnectWaiters.test.mjs b/desktop/src/shared/api/relayReconnectWaiters.test.mjs new file mode 100644 index 0000000000..ddf3244526 --- /dev/null +++ b/desktop/src/shared/api/relayReconnectWaiters.test.mjs @@ -0,0 +1,26 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { RelayReconnectWaiters } from "./relayReconnectWaiters.ts"; + +test("settle releases every operation waiting on a successful reconnect", async () => { + const waiters = new RelayReconnectWaiters(); + const first = waiters.wait(); + const second = waiters.wait(); + + waiters.settle(); + + await Promise.all([first, second]); +}); + +test("settle rejects every operation after a failed reconnect", async () => { + const waiters = new RelayReconnectWaiters(); + const first = waiters.wait(); + const second = waiters.wait(); + const error = new Error("relay unavailable"); + + waiters.settle(error); + + await assert.rejects(first, error); + await assert.rejects(second, error); +}); diff --git a/desktop/src/shared/api/relayReconnectWaiters.ts b/desktop/src/shared/api/relayReconnectWaiters.ts new file mode 100644 index 0000000000..06ad1daa3f --- /dev/null +++ b/desktop/src/shared/api/relayReconnectWaiters.ts @@ -0,0 +1,21 @@ +export class RelayReconnectWaiters { + private waiters = new Set<{ + resolve: () => void; + reject: (error: Error) => void; + }>(); + + wait(): Promise { + return new Promise((resolve, reject) => { + this.waiters.add({ resolve, reject }); + }); + } + + settle(error?: Error) { + const waiters = [...this.waiters]; + this.waiters.clear(); + for (const waiter of waiters) { + if (error) waiter.reject(error); + else waiter.resolve(); + } + } +} diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 4b19004965..07eaa77902 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -1108,6 +1108,11 @@ declare global { __BUZZ_E2E_SET_STALL_WEBSOCKET_SENDS__?: (stall: boolean) => void; __BUZZ_E2E_DISCONNECT_MOCK_WEBSOCKETS__?: () => number; __BUZZ_E2E_RESTART_MOCK_WEBSOCKETS__?: () => number; + __BUZZ_E2E_SET_MOCK_WEBSOCKET_UNAVAILABLE__?: ( + unavailable: boolean, + ) => void; + __BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__?: () => number[]; + __BUZZ_E2E_RESET_WEBSOCKET_CONNECT_ATTEMPTS__?: () => void; __BUZZ_E2E_SET_MESH__?: (mesh: { admitted?: boolean; models?: Array<{ id: string; name: string | null }>; @@ -2820,6 +2825,8 @@ const mockReminderEvents: RelayEvent[] = []; const mockPersonaEvents: RelayEvent[] = []; let mockRelayMembers: RawRelayMember[] = []; const mockSockets = new Map(); +let mockWebsocketUnavailable = false; +const relayWebsocketConnectAttemptStarts: number[] = []; let mockWebsocketSendMutexWedged = false; let mockClosedChannelLiveSubscription = false; const realSockets = new Map(); @@ -8932,6 +8939,7 @@ async function resolveGetEvent( } async function connectRealSocket(args: { url?: string; onMessage: unknown }) { + relayWebsocketConnectAttemptStarts.push(Date.now()); const wsId = nextSocketId++; const ws = new WebSocket(args.url ?? DEFAULT_RELAY_WS_URL); const handler = resolveHandler(args.onMessage); @@ -8960,6 +8968,10 @@ async function connectRealSocket(args: { url?: string; onMessage: unknown }) { } async function connectMockSocket(args: { onMessage: unknown }) { + relayWebsocketConnectAttemptStarts.push(Date.now()); + if (mockWebsocketUnavailable) { + throw new Error("mock relay unavailable"); + } const connectError = getConfig()?.mock?.websocketConnectErrors?.shift(); if (connectError) { throw new Error(connectError); @@ -9405,6 +9417,8 @@ export function maybeInstallE2eTauriMocks() { } mockClosedChannelLiveSubscription = false; + mockWebsocketUnavailable = false; + relayWebsocketConnectAttemptStarts.length = 0; mockGlobalAgentConfig = config.mock?.globalAgentConfig ? { ...config.mock.globalAgentConfig } : null; @@ -9628,6 +9642,16 @@ export function maybeInstallE2eTauriMocks() { } return sockets.length; }; + window.__BUZZ_E2E_SET_MOCK_WEBSOCKET_UNAVAILABLE__ = (unavailable) => { + mockWebsocketUnavailable = unavailable; + if (unavailable) relayWebsocketConnectAttemptStarts.length = 0; + }; + window.__BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__ = () => [ + ...relayWebsocketConnectAttemptStarts, + ]; + window.__BUZZ_E2E_RESET_WEBSOCKET_CONNECT_ATTEMPTS__ = () => { + relayWebsocketConnectAttemptStarts.length = 0; + }; // Tests vary mesh admission and models to exercise provider discovery and // the managed-agent start preflight. window.__BUZZ_E2E_SET_MESH__ = (mesh) => { diff --git a/desktop/tests/e2e/helpers/twoRelayHarness.ts b/desktop/tests/e2e/helpers/twoRelayHarness.ts index 98acd86398..43eb458417 100644 --- a/desktop/tests/e2e/helpers/twoRelayHarness.ts +++ b/desktop/tests/e2e/helpers/twoRelayHarness.ts @@ -162,6 +162,7 @@ export class TwoRelayHarness { BUZZ_METRICS_PORT: String(relay.ports.metrics), BUZZ_REQUIRE_AUTH_TOKEN: "false", BUZZ_RECONCILE_CHANNELS: "true", + BUZZ_AUTO_MIGRATE: "true", }); await this.waitForHealth(relay, child); } diff --git a/desktop/tests/e2e/relay-reconnect.spec.ts b/desktop/tests/e2e/relay-reconnect.spec.ts index 6240cca0ba..67ce725da8 100644 --- a/desktop/tests/e2e/relay-reconnect.spec.ts +++ b/desktop/tests/e2e/relay-reconnect.spec.ts @@ -49,6 +49,31 @@ async function restartMockWebsockets(page: import("@playwright/test").Page) { expect(restarted).toBeGreaterThan(0); } +async function setMockWebsocketUnavailable( + page: import("@playwright/test").Page, + unavailable: boolean, +) { + await page.evaluate((value) => { + const setUnavailable = window.__BUZZ_E2E_SET_MOCK_WEBSOCKET_UNAVAILABLE__; + if (!setUnavailable) { + throw new Error("E2E websocket availability seam is not installed."); + } + setUnavailable(value); + }, unavailable); +} + +async function getMockWebsocketConnectAttempts( + page: import("@playwright/test").Page, +) { + return page.evaluate(() => { + const getAttempts = window.__BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__; + if (!getAttempts) { + throw new Error("E2E websocket attempt seam is not installed."); + } + return getAttempts(); + }); +} + async function emitMockMessages( page: import("@playwright/test").Page, messages: Array<{ content: string; createdAt: number }>, @@ -121,6 +146,55 @@ test("failed initial relay dial retries automatically", async ({ page }) => { await expect(page.getByTestId("channel-general")).toBeVisible(); }); +test("routine traffic cannot bypass outage backoff and recovery stays automatic", async ({ + page, +}) => { + await page.goto("/"); + await expect(page.getByTestId("channel-general")).toBeVisible(); + + await setMockWebsocketUnavailable(page, true); + await disconnectMockWebsockets(page); + + // Exercise the production query path throughout the outage. Before the + // coordinator fix, each rejected query called ensureConnected(), cancelled + // the scheduled timer, and dialed immediately. The fixed session keeps these + // callers behind its single jittered exponential-backoff attempt. + await page.evaluate(async () => { + const deadline = Date.now() + 4_200; + while (Date.now() < deadline) { + await window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({ + queryKey: ["channels"], + }); + await new Promise((resolve) => window.setTimeout(resolve, 100)); + } + }); + + const attempts = await getMockWebsocketConnectAttempts(page); + expect(attempts.length).toBeGreaterThanOrEqual(2); + expect(attempts.length).toBeLessThanOrEqual(3); + for (let index = 1; index < attempts.length; index += 1) { + expect(attempts[index] - attempts[index - 1]).toBeGreaterThanOrEqual(700); + } + + await setMockWebsocketUnavailable(page, false); + await expect + .poll( + () => + page.evaluate(() => window.__BUZZ_E2E_GET_RELAY_CONNECTION_STATE__?.()), + { timeout: 10_000 }, + ) + .toBe("connected"); + + const afterRecovery = `automatic outage recovery ${Date.now()}`; + await emitMockMessages(page, [ + { content: afterRecovery, createdAt: Math.floor(Date.now() / 1_000) }, + ]); + await page.getByTestId("channel-general").click(); + await expect(page.getByTestId("message-timeline")).toContainText( + afterRecovery, + ); +}); + test("service restart close resets accumulated backoff", async ({ page }) => { await installMockBridge(page, { websocketConnectErrors: ["down 1", "down 2", "down 3"], diff --git a/desktop/tests/e2e/relay-restart.live.spec.ts b/desktop/tests/e2e/relay-restart.live.spec.ts index 057ef46f52..f3c80e69a1 100644 --- a/desktop/tests/e2e/relay-restart.live.spec.ts +++ b/desktop/tests/e2e/relay-restart.live.spec.ts @@ -1,8 +1,13 @@ +import { execFile } from "node:child_process"; +import { promisify } from "node:util"; + import { expect, test, type Page } from "@playwright/test"; -import { installBridge } from "../helpers/bridge"; +import { installBridge, TEST_IDENTITIES } from "../helpers/bridge"; import { TwoRelayHarness, type RelaySpec } from "./helpers/twoRelayHarness"; +const exec = promisify(execFile); + // Live gate: boots a REAL buzz-relay process, points the app at it, SIGTERMs // the relay mid-session, restarts it on the same port, and asserts the client // converges back to "connected". This proves the full restart story end to @@ -20,6 +25,55 @@ function required(name: string, value: string | undefined): string { return value; } +async function runCli(args: string[], relayUrl: string, privateKey: string) { + const binary = required("BUZZ_E2E_CLI_BIN", process.env.BUZZ_E2E_CLI_BIN); + const { stdout } = await exec(binary, args, { + cwd: "..", + env: { + ...process.env, + BUZZ_AUTH_TAG: "", + BUZZ_PRIVATE_KEY: privateKey, + BUZZ_RELAY_URL: relayUrl, + }, + }); + return stdout; +} + +async function seedLiveChannel(relayUrl: string) { + const name = `reconnect-live-${process.pid}`; + const created = JSON.parse( + await runCli( + [ + "channels", + "create", + "--name", + name, + "--type", + "stream", + "--visibility", + "open", + ], + relayUrl, + TEST_IDENTITIES.alice.privateKey, + ), + ) as { channel_id: string }; + await runCli( + [ + "channels", + "add-member", + "--channel", + created.channel_id, + "--pubkey", + TEST_IDENTITIES.tyler.pubkey, + "--role", + "member", + ], + relayUrl, + TEST_IDENTITIES.alice.privateKey, + ); + return { id: created.channel_id, name }; +} + async function connectionState(page: Page): Promise { return page.evaluate(() => { const win = window as Window & { @@ -29,13 +83,61 @@ async function connectionState(page: Page): Promise { }); } +async function exerciseBackgroundTraffic(page: Page, durationMs: number) { + await page.evaluate(async (duration) => { + const deadline = Date.now() + duration; + while (Date.now() < deadline) { + void window.__BUZZ_E2E_QUERY_CLIENT__?.invalidateQueries({ + queryKey: ["channels"], + }); + await new Promise((resolve) => window.setTimeout(resolve, 100)); + } + }, durationMs); +} + +async function resetConnectAttempts(page: Page) { + await page.evaluate(() => { + window.__BUZZ_E2E_RESET_WEBSOCKET_CONNECT_ATTEMPTS__?.(); + }); +} + +async function assertConnectAttemptsArePaced(page: Page) { + const attempts = await page.evaluate( + () => window.__BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__?.() ?? [], + ); + expect(attempts.length).toBeGreaterThanOrEqual(2); + expect(attempts.length).toBeLessThanOrEqual(4); + for (let index = 1; index < attempts.length; index += 1) { + expect(attempts[index] - attempts[index - 1]).toBeGreaterThanOrEqual(700); + } +} + +async function proveLiveDelivery( + page: Page, + relayUrl: string, + channel: { id: string; name: string }, + label: string, +) { + await page.getByTestId(`channel-${channel.name}`).click(); + await expect(page.getByTestId("chat-title")).toHaveText(channel.name); + const message = `${label} ${Date.now()}`; + await runCli( + ["messages", "send", "--channel", channel.id, "--content", message], + relayUrl, + TEST_IDENTITIES.alice.privateKey, + ); + await expect(page.getByTestId("message-timeline")).toContainText(message, { + timeout: 30_000, + }); +} + test.describe("relay restart live gate", () => { test.skip(!enabled, "set BUZZ_E2E_RELAY_RESTART=1 to run live gate"); test("client reconnects after the relay is SIGTERMed and restarted", async ({ page, }) => { - test.setTimeout(180_000); + test.setTimeout(240_000); const portBase = 26_000 + (process.pid % 3_000); const spec: RelaySpec = { name: "relay-restart", @@ -56,6 +158,8 @@ test.describe("relay restart live gate", () => { await harness.startRelays(); const relayHttpUrl = `http://127.0.0.1:${spec.ports.main}`; + const channel = await test.step("seed live channel and membership", () => + seedLiveChannel(relayHttpUrl)); await installBridge(page, { mode: "relay", user: "tyler", @@ -64,28 +168,68 @@ test.describe("relay restart live gate", () => { }); await page.goto("/"); - // Baseline: the app converges to a live authenticated session. - await expect - .poll(() => connectionState(page), { timeout: 60_000 }) - .toBe("connected"); + // Baseline: the app converges to a live authenticated session and sees + // the channel created for this fresh database. + await test.step("wait for initial authenticated connection", async () => { + await expect + .poll(() => connectionState(page), { timeout: 60_000 }) + .toBe("connected"); + await expect(page.getByTestId(`channel-${channel.name}`)).toBeVisible({ + timeout: 30_000, + }); + }); // Roll the pod. Graceful drain: readiness 503 → 5s grace → 1012 close // broadcast → process exit. The client must observe the close (not a // silent stall) and start retrying. + await resetConnectAttempts(page); await harness.terminateRelayGracefully(spec.name); await expect .poll(() => connectionState(page), { timeout: 30_000 }) .not.toBe("connected"); + // Keep the real relay unavailable across several reconnect windows while + // ordinary app traffic continues. This is the production-shaped race: + // background queries must not bypass the session coordinator's backoff. + await exerciseBackgroundTraffic(page, 8_000); + await expect.poll(() => connectionState(page)).not.toBe("connected"); + await assertConnectAttemptsArePaced(page); + // Bring the "new pod" up on the same address, exactly like a k8s // restart behind a stable service endpoint. await harness.restartRelay(spec.name); // The client's retry loop must find the fresh relay and converge back - // to connected without any user interaction. + // to connected without any user interaction, then prove that AUTH and + // live-subscription replay finished by receiving an event published by + // a second identity through the real CLI/relay boundary. await expect .poll(() => connectionState(page), { timeout: 60_000 }) .toBe("connected"); + await proveLiveDelivery( + page, + relayHttpUrl, + channel, + "first automatic recovery", + ); + + // Flap the fresh pod once more. A second recovery catches stale timer, + // waiter, generation, and subscription state that a single cycle cannot. + await harness.terminateRelayGracefully(spec.name); + await expect + .poll(() => connectionState(page), { timeout: 30_000 }) + .not.toBe("connected"); + await exerciseBackgroundTraffic(page, 4_000); + await harness.restartRelay(spec.name); + await expect + .poll(() => connectionState(page), { timeout: 60_000 }) + .toBe("connected"); + await proveLiveDelivery( + page, + relayHttpUrl, + channel, + "second automatic recovery", + ); } catch (error) { console.error(await harness.logs()); throw error; From 1dfd89ea67b4ebce0c4d10390f280ed4e7ddde8a Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 30 Jul 2026 12:27:56 -0600 Subject: [PATCH 082/112] feat(release): make desktop releases immutable (#3568) ## Summary - add a manual desktop release preparer that regenerates one version-only candidate from current `origin/main` - validate deterministic complete changelog accounting, candidate authorship, allowed files, exact-head approval, required checks, and two-parent merge topology before tagging the reviewed candidate - move desktop tags/releases from `v*` to `desktop-v*` while preserving relay, chart, push-chart, and mobile behavior - stage all four platform outputs in Actions artifacts and grant GitHub release write access only to one final all-platform-gated publisher - publish the versioned release only after complete artifact assembly; update stable `latest.json` last; never promote prereleases or published rebuild outputs ## Safety properties - desktop tags point to the reviewed candidate SHA, not the merge commit - release builds remain tag-bound and reverify tag == checked-out HEAD - one final writer fails closed on artifact basename collisions - per-tag concurrency serializes publication without cancellation - published reruns do not replace immutable versioned assets or promote signatures from a rebuild - candidate branches use an explicit remote OID lease when regenerated ## Validation - `scripts/test-desktop-release-candidate.sh` - `scripts/test-release-ref-contract.sh` - `scripts/test-mobile-release-contract.sh` - changed workflow YAML parsing (Ruby Psych) - changed shell syntax (`bash -n`) - `git diff --check` - push hooks: branch-skew, Rust workspace tests (1,853 passed), desktop Tauri tests (3 passed) ## Coordinated companion - squareup/buzz-releases#79 updates the manually entered desktop source-tag contract to stable-only `desktop-v*` - merge the private contract companion before the first namespaced desktop release ## Rollout blockers (no settings changed here) Before the first candidate/release: 1. enable merge commits in repository settings 2. allow `merge` in ruleset `13596885` 3. require approval after the last push in ruleset `13596885` 4. include `refs/tags/desktop-v*` explicitly in release ruleset `14378754` 5. prove the non-publishing candidate/merge/tag/artifact validation path before any production release Do not test the old workflow with a prerelease: it can still mutate the production rolling updater release. --------- Signed-off-by: Wes Co-authored-by: Carl --- .../auto-tag-on-release-pr-merge.yml | 43 ++- .github/workflows/ci.yml | 2 + .github/workflows/prepare-desktop-release.yml | 38 +++ .github/workflows/release.yml | 318 ++++++++---------- Justfile | 4 +- RELEASING.md | 23 +- scripts/desktop_release.py | 214 ++++++++++++ scripts/prepare-desktop-release.sh | 83 +++++ scripts/required-check-succeeded.jq | 14 + scripts/review-decision-approved.jq | 1 + scripts/test-desktop-release-candidate.sh | 84 +++++ scripts/test-release-ref-contract.sh | 75 ++++- scripts/verify-desktop-release-merge.sh | 62 ++++ 13 files changed, 763 insertions(+), 198 deletions(-) create mode 100644 .github/workflows/prepare-desktop-release.yml create mode 100755 scripts/desktop_release.py create mode 100755 scripts/prepare-desktop-release.sh create mode 100644 scripts/required-check-succeeded.jq create mode 100644 scripts/review-decision-approved.jq create mode 100755 scripts/test-desktop-release-candidate.sh create mode 100755 scripts/verify-desktop-release-merge.sh diff --git a/.github/workflows/auto-tag-on-release-pr-merge.yml b/.github/workflows/auto-tag-on-release-pr-merge.yml index db34fddc2c..a69eafb404 100644 --- a/.github/workflows/auto-tag-on-release-pr-merge.yml +++ b/.github/workflows/auto-tag-on-release-pr-merge.yml @@ -4,7 +4,7 @@ name: Auto-tag on Release PR Merge # prefix; the main chart lane also auto-detects a Chart.yaml version bump so # a chart feature PR can publish its own new version when merged: # -# version-bump/ → tag v → release.yml (desktop app) +# version-bump/ → tag desktop-v → release.yml (desktop app) # relay-release/ → tag relay-v → docker.yml (relay image) # chart-release/ → tag chart-v → helm-chart.yml (main helm chart) # push-chart-release/ → tag push-chart-v → push-gateway-helm-chart.yml @@ -35,6 +35,11 @@ permissions: jobs: auto-tag: + permissions: + contents: read + pull-requests: read + checks: read + statuses: read if: > github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository @@ -57,7 +62,7 @@ jobs: case "$BRANCH" in version-bump/*) VERSION="${BRANCH#version-bump/}" - TAG_PREFIX="v" ;; + TAG_PREFIX="desktop-v" ;; relay-release/*) VERSION="${BRANCH#relay-release/}" TAG_PREFIX="relay-v" ;; @@ -85,9 +90,34 @@ jobs: { echo "enabled=true" echo "tag=${TAG_PREFIX}${VERSION}" + if [[ "$TAG_PREFIX" == desktop-v ]]; then + echo "target_sha=${{ github.event.pull_request.head.sha }}" + echo "desktop=true" + else + echo "target_sha=$GITHUB_SHA" + echo "desktop=false" + fi } >> "$GITHUB_OUTPUT" echo "Tagging ${TAG_PREFIX}${VERSION}" + + - name: Verify immutable reviewed desktop candidate + if: steps.release.outputs.desktop == 'true' + env: + GH_TOKEN: ${{ github.token }} + VERSION: ${{ steps.release.outputs.tag }} + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} + PR_BASE_REF: ${{ github.event.pull_request.base.ref }} + PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} + PR_PUSHER: ${{ github.event.pull_request.head.user.login }} + MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }} + run: | + VERSION="${VERSION#desktop-v}" + export VERSION + scripts/verify-desktop-release-merge.sh + - name: Create release tagger token if: steps.release.outputs.enabled == 'true' id: release-tagger @@ -102,21 +132,22 @@ jobs: env: GH_TOKEN: ${{ steps.release-tagger.outputs.token }} TAG: ${{ steps.release.outputs.tag }} + TARGET_SHA: ${{ steps.release.outputs.target_sha }} run: | set -euo pipefail # Check gh's exit status, not its output. A missing ref returns a 404 # JSON body on stdout, which must not be mistaken for an existing tag. if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --silent 2>/dev/null; then EXISTING_SHA="$(gh api "repos/$GITHUB_REPOSITORY/commits/$TAG" --jq .sha)" - if [ "$EXISTING_SHA" = "$GITHUB_SHA" ]; then - echo "Tag $TAG already exists at $GITHUB_SHA — skipping tag creation" + if [ "$EXISTING_SHA" = "$TARGET_SHA" ]; then + echo "Tag $TAG already exists at $TARGET_SHA — skipping tag creation" exit 0 else - echo "::error::Tag $TAG already exists at $EXISTING_SHA (expected $GITHUB_SHA)" + echo "::error::Tag $TAG already exists at $EXISTING_SHA (expected $TARGET_SHA)" exit 1 fi fi gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ -f ref="refs/tags/$TAG" \ - -f sha="$GITHUB_SHA" \ + -f sha="$TARGET_SHA" \ --silent diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d4826d985f..59d63f28da 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -76,6 +76,8 @@ jobs: - '.github/workflows/ci.yml' - name: Release workflow source contract run: scripts/test-release-ref-contract.sh + - name: Desktop release candidate contract + run: scripts/test-desktop-release-candidate.sh - name: Mobile release contract run: | scripts/test-mobile-release-contract.sh diff --git a/.github/workflows/prepare-desktop-release.yml b/.github/workflows/prepare-desktop-release.yml new file mode 100644 index 0000000000..7cc480b93b --- /dev/null +++ b/.github/workflows/prepare-desktop-release.yml @@ -0,0 +1,38 @@ +name: Prepare Desktop Release + +on: + workflow_dispatch: + inputs: + version: + description: Semver to prepare (for example 0.5.1) + required: true + +env: + RELEASE_AUTOMATION_NAME: Carl + RELEASE_AUTOMATION_EMAIL: c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz + +jobs: + prepare: + if: github.repository == 'block/buzz' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Create short-lived release preparer token + id: preparer + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }} + private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + fetch-depth: 0 + token: ${{ steps.preparer.outputs.token }} + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + - name: Prepare immutable candidate and open or update PR + env: + GH_TOKEN: ${{ steps.preparer.outputs.token }} + VERSION: ${{ inputs.version }} + run: scripts/prepare-desktop-release.sh "$VERSION" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b87e9c8c08..07951ef81d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,14 +1,13 @@ name: Release +concurrency: + group: desktop-release-${{ github.ref }} + cancel-in-progress: false + on: push: tags: - - 'v[0-9]*' - workflow_dispatch: - inputs: - version: - description: "Semver version matching the v-prefixed dispatch tag" - required: true + - 'desktop-v[0-9]*' jobs: # Shared setup: verify the immutable release tag, determine the version, and @@ -19,23 +18,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 permissions: - contents: write + contents: read outputs: version: ${{ steps.version.outputs.version }} source_sha: ${{ steps.source.outputs.source_sha }} steps: - name: Determine version id: version - env: - EVENT_NAME: ${{ github.event_name }} - INPUT_VERSION: ${{ inputs.version }} - run: | - if [[ "$EVENT_NAME" == "push" ]]; then - VERSION="${GITHUB_REF_NAME#v}" - else - VERSION="$INPUT_VERSION" - fi - echo "version=$VERSION" >> "$GITHUB_OUTPUT" + run: echo "version=${GITHUB_REF_NAME#desktop-v}" >> "$GITHUB_OUTPUT" - name: Validate version env: @@ -56,42 +46,9 @@ jobs: env: VERSION: ${{ steps.version.outputs.version }} run: | - scripts/verify-release-ref.sh v "$VERSION" + scripts/verify-release-ref.sh desktop-v "$VERSION" echo "source_sha=$(git rev-parse 'HEAD^{commit}')" >> "$GITHUB_OUTPUT" - - name: Create versioned GitHub release - env: - VERSION: ${{ steps.version.outputs.version }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - RELEASE_SHA=$(git rev-parse HEAD) - NOTES="" - if [[ -f CHANGELOG.md ]]; then - NOTES=$(awk "/^## v${VERSION}\$/{found=1; next} found && /^## v/{exit} found && !/^\$/" CHANGELOG.md) - fi - if [[ -z "$NOTES" ]]; then - NOTES="Buzz Desktop v${VERSION}" - fi - PRERELEASE_FLAGS=() - if [[ "$VERSION" =~ -(test|alpha|beta|rc)([.-]|$) ]]; then - PRERELEASE_FLAGS=(--prerelease --latest=false) - fi - gh release create "v${VERSION}" \ - --target "$RELEASE_SHA" \ - --title "Buzz Desktop v${VERSION}" \ - --notes "$NOTES" \ - "${PRERELEASE_FLAGS[@]}" - - - name: Create rolling auto-update release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh release create buzz-desktop-latest \ - --prerelease \ - --title "Buzz Desktop Auto-Update" \ - --notes "Rolling release for the Tauri auto-updater. Do not download manually — use the versioned release instead." \ - 2>/dev/null || true - release: name: Release if: github.repository == 'block/buzz' @@ -99,7 +56,7 @@ jobs: needs: setup timeout-minutes: 60 permissions: - contents: write + contents: read id-token: write # required by block/apple-codesign-action for OIDC outputs: archive_name: ${{ steps.artifacts.outputs.archive_name }} @@ -114,7 +71,7 @@ jobs: persist-credentials: false - name: Verify tag-bound release source - run: scripts/verify-release-ref.sh v "$VERSION" + run: scripts/verify-release-ref.sh desktop-v "$VERSION" - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -272,13 +229,19 @@ jobs: fi echo "dmg=$DMG" >> "$GITHUB_OUTPUT" - # Find the updater .tar.gz and .sig + # Find the updater .tar.gz and .sig. Give each architecture a unique + # release basename before artifacts are merged by the final writer. ARCHIVE=$(find "$BUNDLE_DIR/macos" -name '*.tar.gz' ! -name '*.sig' -type f | head -1) SIG="${ARCHIVE}.sig" if [[ -z "$ARCHIVE" || ! -f "$SIG" ]]; then echo "::error::Updater archive or signature not found in $BUNDLE_DIR/macos" exit 1 fi + RENAMED="$(dirname "$ARCHIVE")/Buzz_${VERSION}_aarch64.app.tar.gz" + mv "$ARCHIVE" "$RENAMED" + mv "$SIG" "${RENAMED}.sig" + ARCHIVE="$RENAMED" + SIG="${RENAMED}.sig" echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT" echo "archive_name=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT" echo "sig=$SIG" >> "$GITHUB_OUTPUT" @@ -289,23 +252,15 @@ jobs: env: SIG_PATH: ${{ steps.artifacts.outputs.sig }} - - name: Upload arm64 DMG to versioned GitHub release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - DMG_PATH: ${{ steps.artifacts.outputs.dmg }} - run: gh release upload "v${VERSION}" "$DMG_PATH" --clobber - - - name: Upload updater archive to rolling release - if: github.ref == format('refs/tags/v{0}', needs.setup.outputs.version) - run: | - gh release upload buzz-desktop-latest \ - "$ARCHIVE_PATH" \ - "$SIG_PATH" \ - --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - ARCHIVE_PATH: ${{ steps.artifacts.outputs.archive }} - SIG_PATH: ${{ steps.artifacts.outputs.sig }} + - name: Stage Apple Silicon release artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: desktop-release-macos-arm64 + if-no-files-found: error + path: | + ${{ steps.artifacts.outputs.dmg }} + ${{ steps.artifacts.outputs.archive }} + ${{ steps.artifacts.outputs.sig }} release-macos-x64: name: Release macOS (Intel) @@ -314,7 +269,7 @@ jobs: needs: setup timeout-minutes: 60 permissions: - contents: write + contents: read id-token: write # required by block/apple-codesign-action for OIDC outputs: archive_name: ${{ steps.artifacts.outputs.archive_name }} @@ -330,7 +285,7 @@ jobs: persist-credentials: false - name: Verify tag-bound release source - run: scripts/verify-release-ref.sh v "$VERSION" + run: scripts/verify-release-ref.sh desktop-v "$VERSION" - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -443,6 +398,11 @@ jobs: echo "::error::Updater archive or signature not found in $BUNDLE_DIR/macos" exit 1 fi + RENAMED="$(dirname "$ARCHIVE")/Buzz_${VERSION}_x64.app.tar.gz" + mv "$ARCHIVE" "$RENAMED" + mv "$SIG" "${RENAMED}.sig" + ARCHIVE="$RENAMED" + SIG="${RENAMED}.sig" echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT" echo "archive_name=$(basename "$ARCHIVE")" >> "$GITHUB_OUTPUT" echo "sig=$SIG" >> "$GITHUB_OUTPUT" @@ -453,23 +413,15 @@ jobs: env: SIG_PATH: ${{ steps.artifacts.outputs.sig }} - - name: Upload Intel DMG to versioned GitHub release - run: gh release upload "v${VERSION}" "$DMG_PATH" --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - DMG_PATH: ${{ steps.unsigned.outputs.dmg }} - - - name: Upload updater archive to rolling release - if: github.ref == format('refs/tags/v{0}', needs.setup.outputs.version) - run: | - gh release upload buzz-desktop-latest \ - "$ARCHIVE_PATH" \ - "$SIG_PATH" \ - --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - ARCHIVE_PATH: ${{ steps.artifacts.outputs.archive }} - SIG_PATH: ${{ steps.artifacts.outputs.sig }} + - name: Stage Intel macOS release artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: desktop-release-macos-x64 + if-no-files-found: error + path: | + ${{ steps.unsigned.outputs.dmg }} + ${{ steps.artifacts.outputs.archive }} + ${{ steps.artifacts.outputs.sig }} release-linux: name: Release Linux @@ -480,7 +432,7 @@ jobs: needs: setup timeout-minutes: 60 permissions: - contents: write + contents: read env: # AppImage tools (linuxdeploy, appimagetool) are themselves AppImages. # Containers lack FUSE, so we must use the extract-and-run fallback. @@ -555,7 +507,7 @@ jobs: - name: Verify tag-bound release source env: VERSION: ${{ needs.setup.outputs.version }} - run: scripts/verify-release-ref.sh v "$VERSION" + run: scripts/verify-release-ref.sh desktop-v "$VERSION" - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -689,29 +641,16 @@ jobs: SIG_PATH: ${{ steps.linux-artifacts.outputs.sig }} # NOTE: .deb is NOT auto-updatable (Tauri updater constraint — only AppImage supports it on Linux) - - name: Upload Linux artifacts to versioned GitHub release - env: - VERSION: ${{ needs.setup.outputs.version }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - DEB_PATH: ${{ steps.linux-artifacts.outputs.deb }} - APPIMAGE_PATH: ${{ steps.linux-artifacts.outputs.appimage }} - run: | - gh release upload "v$VERSION" \ - "$DEB_PATH" \ - "$APPIMAGE_PATH" \ - --clobber - - - name: Upload updater archive to rolling release - if: github.ref == format('refs/tags/v{0}', needs.setup.outputs.version) - run: | - gh release upload buzz-desktop-latest \ - "$ARCHIVE_PATH" \ - "$SIG_PATH" \ - --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - ARCHIVE_PATH: ${{ steps.linux-artifacts.outputs.archive }} - SIG_PATH: ${{ steps.linux-artifacts.outputs.sig }} + - name: Stage Linux release artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: desktop-release-linux-x64 + if-no-files-found: error + path: | + ${{ steps.linux-artifacts.outputs.deb }} + ${{ steps.linux-artifacts.outputs.appimage }} + ${{ steps.linux-artifacts.outputs.archive }} + ${{ steps.linux-artifacts.outputs.sig }} release-windows: name: Release Windows @@ -719,7 +658,7 @@ jobs: needs: setup timeout-minutes: 60 permissions: - contents: write + contents: read outputs: archive_name: ${{ steps.artifacts.outputs.archive_name }} sig: ${{ steps.read-sig.outputs.sig }} @@ -735,7 +674,7 @@ jobs: - name: Verify tag-bound release source shell: bash - run: scripts/verify-release-ref.sh v "$VERSION" + run: scripts/verify-release-ref.sh desktop-v "$VERSION" - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 with: @@ -745,7 +684,7 @@ jobs: with: node-version: 24.14.1 # Disable dependency caching: a writable cache in this release workflow - # (contents: write, feeds a signed installer) is a poisoning vector. pnpm + # (contents: read, feeds a signed installer) is a poisoning vector. pnpm # install runs uncached below. package-manager-cache: false @@ -827,25 +766,14 @@ jobs: env: SIG_PATH: ${{ steps.artifacts.outputs.sig }} - - name: Upload Windows installer to versioned GitHub release - shell: bash - run: gh release upload "v${VERSION}" "$EXE_PATH" --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - EXE_PATH: ${{ steps.artifacts.outputs.exe }} - - - name: Upload updater archive to rolling release - if: github.ref == format('refs/tags/v{0}', needs.setup.outputs.version) - shell: bash - run: | - gh release upload buzz-desktop-latest \ - "$ARCHIVE_PATH" \ - "$SIG_PATH" \ - --clobber - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - ARCHIVE_PATH: ${{ steps.artifacts.outputs.archive }} - SIG_PATH: ${{ steps.artifacts.outputs.sig }} + - name: Stage Windows release artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: desktop-release-windows-x64 + if-no-files-found: error + path: | + ${{ steps.artifacts.outputs.exe }} + ${{ steps.artifacts.outputs.sig }} assemble-manifest: name: Assemble multi-platform latest.json @@ -853,7 +781,11 @@ jobs: if: | always() && needs.setup.result == 'success' && - github.ref == format('refs/tags/v{0}', needs.setup.outputs.version) + needs.release.result == 'success' && + needs.release-macos-x64.result == 'success' && + needs.release-linux.result == 'success' && + needs.release-windows.result == 'success' && + github.ref == format('refs/tags/desktop-v{0}', needs.setup.outputs.version) runs-on: ubuntu-latest needs: [setup, release, release-macos-x64, release-linux, release-windows] timeout-minutes: 10 @@ -870,7 +802,26 @@ jobs: persist-credentials: false - name: Verify tag-bound release source - run: scripts/verify-release-ref.sh v "$VERSION" + run: scripts/verify-release-ref.sh desktop-v "$VERSION" + + - name: Download staged release artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: desktop-release-* + path: staged-by-platform + + - name: Flatten staged artifacts without basename collisions + run: | + set -euo pipefail + mkdir staged + while IFS= read -r -d '' file; do + name="$(basename "$file")" + [[ ! -e "staged/$name" ]] || { + echo "::error::release artifact basename collision: $name" + exit 1 + } + cp "$file" "staged/$name" + done < <(find staged-by-platform -type f -print0) - name: Write signature files env: @@ -899,7 +850,7 @@ jobs: write_sig "$RESULT_LINUX" linux-x86_64 "$SIG_LINUX" write_sig "$RESULT_WIN" windows-x86_64 "$SIG_WIN" - - name: Verify archive URLs are accessible + - name: Verify draft release has every updater archive env: RESULT_ARM64: ${{ needs.release.result }} RESULT_X64: ${{ needs.release-macos-x64.result }} @@ -911,39 +862,19 @@ jobs: ARCHIVE_WIN: ${{ needs.release-windows.outputs.archive_name }} run: | set -euo pipefail - BASE="https://github.com/block/buzz/releases/download/buzz-desktop-latest" - ARCHIVES=() - - add_archive() { - local result="$1" platform="$2" archive="$3" - if [[ "$result" == "success" ]]; then - [[ -n "$archive" ]] || { echo "::error::Missing archive name for successful platform: $platform"; exit 1; } - ARCHIVES+=("$archive") - fi - } - - add_archive "$RESULT_ARM64" darwin-aarch64 "$ARCHIVE_ARM64" - add_archive "$RESULT_X64" darwin-x86_64 "$ARCHIVE_X64" - add_archive "$RESULT_LINUX" linux-x86_64 "$ARCHIVE_LINUX" - add_archive "$RESULT_WIN" windows-x86_64 "$ARCHIVE_WIN" - - for name in "${ARCHIVES[@]}"; do - echo "Checking $BASE/$name ..." - success=false - for attempt in 1 2 3; do - if curl -fsI "$BASE/$name" > /dev/null 2>&1; then - success=true - break - fi - echo "Attempt $attempt failed for $name, retrying in 10s..." - sleep 10 - done - if [ "$success" != "true" ]; then - echo "::error::Archive not accessible after 3 attempts: $BASE/$name" - exit 1 + assets=$(find staged -type f -exec basename {} \;) + for spec in \ + "$RESULT_ARM64:$ARCHIVE_ARM64" \ + "$RESULT_X64:$ARCHIVE_X64" \ + "$RESULT_LINUX:$ARCHIVE_LINUX" \ + "$RESULT_WIN:$ARCHIVE_WIN"; do + result="${spec%%:*}" + archive="${spec#*:}" + if [[ "$result" == success ]]; then + [[ -n "$archive" ]] || { echo "::error::successful platform has no archive"; exit 1; } + grep -Fxq "$archive" <<<"$assets" || { echo "::error::draft release missing $archive"; exit 1; } fi done - echo "All archive URLs verified." - name: Generate unified latest.json env: @@ -957,7 +888,7 @@ jobs: ARCHIVE_WIN: ${{ needs.release-windows.outputs.archive_name }} run: | set -euo pipefail - BASE="https://github.com/block/buzz/releases/download/buzz-desktop-latest" + BASE="https://github.com/block/buzz/releases/download/desktop-v${VERSION}" TRIPLES=() add_triple() { @@ -977,6 +908,45 @@ jobs: bash desktop/scripts/generate-oss-latest-json.sh "$VERSION" "${TRIPLES[@]}" > latest.json cat latest.json - - name: Upload latest.json to rolling release + - name: Create or verify versioned draft run: | - gh release upload buzz-desktop-latest latest.json --clobber + set -euo pipefail + NOTES_FILE="${RUNNER_TEMP}/release-notes.md" + awk "/^## v${VERSION}\$/{found=1; next} found && /^## v/{exit} found" CHANGELOG.md > "$NOTES_FILE" + [[ -s "$NOTES_FILE" ]] || { echo "::error::missing non-empty changelog block for v${VERSION}"; exit 1; } + PRERELEASE_FLAGS=() + if [[ "$VERSION" == *-* ]]; then + PRERELEASE_FLAGS=(--prerelease --latest=false) + fi + if gh release view "desktop-v${VERSION}" >/dev/null 2>&1; then + EXISTING_SHA=$(gh release view "desktop-v${VERSION}" --json targetCommitish --jq .targetCommitish) + IS_DRAFT=$(gh release view "desktop-v${VERSION}" --json isDraft --jq .isDraft) + [[ "$EXISTING_SHA" == "${{ needs.setup.outputs.source_sha }}" ]] || { + echo "::error::existing release targets $EXISTING_SHA, not the immutable source"; exit 1; + } + if [[ "$IS_DRAFT" != true ]]; then + echo "already_published=true" >> "$GITHUB_ENV" + fi + else + gh release create "desktop-v${VERSION}" \ + --draft \ + --target "${{ needs.setup.outputs.source_sha }}" \ + --title "Buzz Desktop v${VERSION}" \ + --notes-file "$NOTES_FILE" \ + "${PRERELEASE_FLAGS[@]}" + fi + + - name: Upload complete artifact set to versioned draft + if: env.already_published != 'true' + run: | + mapfile -t files < <(find staged -type f -print) + [[ "${#files[@]}" -gt 0 ]] || { echo "::error::no staged release artifacts"; exit 1; } + gh release upload "desktop-v${VERSION}" "${files[@]}" --clobber + + - name: Publish complete versioned release + if: env.already_published != 'true' + run: gh release edit "desktop-v${VERSION}" --draft=false + + - name: Upload latest.json to rolling release last + if: ${{ env.already_published != 'true' && !contains(needs.setup.outputs.version, '-') }} + run: gh release upload buzz-desktop-latest latest.json --clobber diff --git a/Justfile b/Justfile index a2fa408e7f..2d76f1a7b9 100644 --- a/Justfile +++ b/Justfile @@ -725,7 +725,7 @@ bump-relay-version version: cargo update -p buzz-relay echo "Bumped buzz-relay to {{ version }} and regenerated Cargo.lock" -# Open or update the desktop release PR (signed desktop app) +# Open or update the desktop release PR from an immutable origin/main snapshot release-desktop *ARGS: #!/usr/bin/env bash set -euo pipefail @@ -735,7 +735,7 @@ release-desktop *ARGS: else VERSION="$ARG" fi - just _release-pr desktop "$VERSION" + scripts/prepare-desktop-release.sh "$VERSION" # Open or update the relay release PR (ghcr.io/block/buzz image) release-relay *ARGS: diff --git a/RELEASING.md b/RELEASING.md index 063b813e2c..45f0f8638f 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -5,7 +5,7 @@ Mobile uses immutable release-candidate tags cut directly from remote `main`: | Lane | Entry point | Artifact | |------|-------------|----------| -| Desktop | `just release-desktop` | Signed desktop app (macOS/Linux) | +| Desktop | `Prepare Desktop Release` / `just release-desktop` | Signed desktop app (macOS/Linux) | | Relay | `just release-relay` | `ghcr.io/block/buzz` container image | | Mobile | `scripts/mobile-release.sh candidate X.Y.Z` | Exact `mobile-vX.Y.Z-rc.N` source identity | @@ -31,7 +31,7 @@ just release-relay 0.4.0 scripts/mobile-release.sh candidate 0.5.0 ``` -Desktop and relay releases use metadata PRs. Mobile does not. Each +Desktop uses an immutable generated candidate PR; relay continues using its metadata PR. Mobile does not. Each `mobile-vX.Y.Z-rc.N` tag is an immutable candidate and the artifact of record. There is no mobile release branch, stable mobile tag alias, finalization step, or mobile GitHub Release. @@ -42,12 +42,11 @@ or mobile GitHub Release. ### Desktop -1. **`just release-desktop`** runs locally on `main`, creates or updates a - `version-bump/` PR, bumps the desktop manifests, regenerates - lockfiles, and updates `CHANGELOG.md`. -2. **Merge the PR.** `auto-tag-on-release-pr-merge` pushes `v`. -3. **The tag triggers `release.yml`.** It builds, signs, notarizes, and - publishes the desktop app for macOS and Linux. +1. Run **Prepare Desktop Release** with a version (or `just release-desktop `). Automation records current `origin/main`, regenerates `version-bump/` as one deterministic candidate commit, and opens or updates the PR. +2. Review the full-SHA changelog, CI, recorded base, and candidate SHA. Any regeneration creates a new head and requires fresh approval. +3. Merge with **Create a merge commit**. Squash and rebase are invalid for desktop release PRs. +4. `auto-tag-on-release-pr-merge` proves that merge parent 2 is the exact approved candidate, then tags that candidate `desktop-v`. +5. The tag triggers `release.yml`. It creates a draft, builds and stages every platform, publishes the complete versioned release, and updates the rolling updater manifest last for stable versions. ### Relay @@ -147,8 +146,8 @@ for distributable builds or builds from an immutable release tag. ## Manual Release Retry The **Release** workflow's manual dispatch is only a retry mechanism for an -existing immutable `v` tag. Select that tag in the ref picker and -provide the matching semver version without the `v` prefix. It cannot build +existing immutable `desktop-v` tag. Select that tag in the ref picker and +provide the matching semver version without the `desktop-v` prefix. It cannot build from `main` or another caller-selected source ref. Mobile intentionally has no branch or arbitrary-ref fallback. The private @@ -171,7 +170,7 @@ for the private pipeline contract. Desktop publishes two GitHub releases: -1. **`v`**: the user-facing release with installers. +1. **`desktop-v`**: the user-facing release with installers. 2. **`buzz-desktop-latest`**: the rolling auto-updater release. Mobile publishes only annotated `mobile-vX.Y.Z-rc.N` git tags. Store artifacts @@ -186,7 +185,7 @@ The release workflow builds **two separate macOS DMGs**: Apple Silicon (`darwin-aarch64`, the `release` job) and Intel (`darwin-x86_64`, the `release-macos-x64` job), plus Linux `.deb` and `.AppImage`. Both macOS DMGs are codesigned, notarized, and attached to -the same `v` release. Intel users download the `_x64.dmg`. +the same `desktop-v` release. Intel users download the `_x64.dmg`. The Linux AppImage is post-processed by `desktop/scripts/fix-appimage.sh`, which strips infra libraries over-bundled by linuxdeploy (they crash on diff --git a/scripts/desktop_release.py b/scripts/desktop_release.py new file mode 100755 index 0000000000..d6518b26b1 --- /dev/null +++ b/scripts/desktop_release.py @@ -0,0 +1,214 @@ +#!/usr/bin/env python3 +"""Generate and validate immutable desktop release candidates.""" + +from __future__ import annotations + +import argparse +import json +import re +import subprocess +import sys +from pathlib import Path + +ROOT = Path(__file__).resolve().parent.parent +CHANGELOG = ROOT / "CHANGELOG.md" +METADATA = ROOT / ".release" / "desktop-candidate.json" +SEMVER = re.compile(r"^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$") +DESKTOP_PATHS = ( + "desktop/", + "crates/buzz-core/", + "crates/buzz-persona/", + "crates/buzz-sdk/", + "crates/buzz-agent/", + "crates/buzz-media/", +) +CANDIDATE_FILES = { + ".release/desktop-candidate.json", + "CHANGELOG.md", + "desktop/package.json", + "desktop/src-tauri/tauri.conf.json", + "desktop/src-tauri/Cargo.toml", + "desktop/src-tauri/Cargo.lock", + "pnpm-lock.yaml", +} +REQUIRED_CANDIDATE_FILES = { + ".release/desktop-candidate.json", + "CHANGELOG.md", + "desktop/package.json", + "desktop/src-tauri/tauri.conf.json", + "desktop/src-tauri/Cargo.toml", +} + + +def git(*args: str) -> str: + return subprocess.check_output(["git", *args], cwd=ROOT, text=True).strip() + + +def commit_list(range_spec: str, paths: tuple[str, ...] | None = None) -> list[dict[str, str]]: + args = ["log", range_spec, "--no-merges", "--format=%H%x00%s"] + if paths: + args += ["--", *paths] + out = git(*args) + if not out: + return [] + return [dict(zip(("sha", "subject"), line.split("\0", 1))) for line in out.splitlines()] + + +def stable_tags(base_sha: str) -> list[tuple[int, str, str]]: + tags: list[tuple[int, str, str]] = [] + for tag in git("tag", "--merged", base_sha, "--list").splitlines(): + if not re.fullmatch(r"(?:desktop-)?v[0-9]+\.[0-9]+\.[0-9]+", tag): + continue + sha = git("rev-list", "-n", "1", tag) + distance = int(git("rev-list", "--count", f"{sha}..{base_sha}")) + tags.append((distance, tag, sha)) + return tags + + +def previous_tag(base_sha: str) -> str: + tags = stable_tags(base_sha) + if not tags: + return "" + min_distance = min(item[0] for item in tags) + nearest = [item for item in tags if item[0] == min_distance] + commits = {item[2] for item in nearest} + if len(commits) != 1: + detail = ", ".join(f"{tag}@{sha}" for _, tag, sha in nearest) + raise SystemExit(f"ambiguous previous desktop release tags: {detail}") + # During migration, prefer the namespaced tag when aliases share a commit. + nearest.sort(key=lambda item: (not item[1].startswith("desktop-v"), item[1])) + return nearest[0][1] + + +def bullet(commit: dict[str, str], repo: str) -> str: + sha, subject = commit["sha"], commit["subject"] + short = sha[:12] + pr_match = re.search(r" \(#([0-9]+)\)$", subject) + if pr_match: + pr = pr_match.group(1) + subject = subject[: pr_match.start()] + return f"- {subject} ([#{pr}](https://github.com/{repo}/pull/{pr})) ([`{sha}`](https://github.com/{repo}/commit/{sha}))" + return f"- {subject} ([`{sha}`](https://github.com/{repo}/commit/{sha}))" + + +def expected(base_sha: str, previous: str) -> tuple[list[dict[str, str]], list[dict[str, str]]]: + # With no prior desktop tag, account for the repository's root commit too. + # A ``root..base`` range silently drops that first commit. + range_spec = f"{previous}..{base_sha}" if previous else base_sha + all_commits = commit_list(range_spec) + relevant_shas = {c["sha"] for c in commit_list(range_spec, DESKTOP_PATHS)} + relevant = [c for c in all_commits if c["sha"] in relevant_shas] + other = [c for c in all_commits if c["sha"] not in relevant_shas] + return relevant, other + + +def render(version: str, base_sha: str, previous: str, repo: str) -> tuple[str, list[str]]: + relevant, other = expected(base_sha, previous) + lines = [f"## v{version}", "", "### Desktop and shared changes", ""] + lines += [bullet(c, repo) for c in relevant] or ["- None"] + lines += ["", "### Other repository changes", ""] + lines += [bullet(c, repo) for c in other] or ["- None"] + compare_start = previous or git("rev-list", "--max-parents=0", base_sha).splitlines()[0] + lines += ["", f"[Compare {compare_start}...desktop-v{version}](https://github.com/{repo}/compare/{compare_start}...desktop-v{version})"] + return "\n".join(lines) + "\n", [c["sha"] for c in relevant + other] + + +def generate(args: argparse.Namespace) -> None: + if not SEMVER.fullmatch(args.version): + raise SystemExit(f"invalid semver: {args.version}") + base_sha = git("rev-parse", args.base) + previous = previous_tag(base_sha) + repo = args.repo or re.sub(r".*github\.com[:/]", "", git("remote", "get-url", "origin")).removesuffix(".git") + block, commits = render(args.version, base_sha, previous, repo) + old = CHANGELOG.read_text() if CHANGELOG.exists() else "# Changelog\n" + if not old.startswith("# Changelog"): + raise SystemExit("CHANGELOG.md must begin with '# Changelog'") + remainder = old.split("\n", 1)[1].lstrip("\n") if "\n" in old else "" + CHANGELOG.write_text(f"# Changelog\n\n{block}\n{remainder}") + METADATA.parent.mkdir(parents=True, exist_ok=True) + METADATA.write_text(json.dumps({ + "schema": 1, + "version": args.version, + "base_sha": base_sha, + "previous_tag": previous or None, + "tag": f"desktop-v{args.version}", + "commit_count": len(commits), + }, indent=2) + "\n") + + +def validate(args: argparse.Namespace) -> None: + data = json.loads(METADATA.read_text()) + version = args.version or data["version"] + if data != {**data, "version": version}: + raise SystemExit("candidate version does not match metadata") + if data["tag"] != f"desktop-v{version}": + raise SystemExit("candidate tag does not match version") + candidate = git("rev-parse", args.candidate) + parents = git("show", "-s", "--format=%P", candidate).split() + if len(parents) != 1 or parents[0] != data["base_sha"]: + raise SystemExit("candidate must be one commit directly above recorded base_sha") + changed = set(git("diff-tree", "--no-commit-id", "--name-only", "-r", candidate).splitlines()) + unexpected = changed - CANDIDATE_FILES + missing = REQUIRED_CANDIDATE_FILES - changed + if unexpected or missing: + detail = [] + if unexpected: + detail.append(f"unexpected files: {', '.join(sorted(unexpected))}") + if missing: + detail.append(f"missing required files: {', '.join(sorted(missing))}") + raise SystemExit("candidate is not version-only (" + "; ".join(detail) + ")") + previous = data["previous_tag"] or "" + actual_previous = previous_tag(data["base_sha"]) + if previous != actual_previous: + raise SystemExit( + f"recorded previous tag {previous or ''} does not match " + f"nearest release tag {actual_previous or ''}" + ) + repo = args.repo or "block/buzz" + expected_block, shas = render(version, data["base_sha"], previous, repo) + text = CHANGELOG.read_text() + blocks = re.findall(rf"(?ms)^## v{re.escape(version)}\n.*?(?=^## v|\Z)", text) + if len(blocks) != 1: + raise SystemExit(f"expected exactly one changelog block for v{version}") + if blocks[0].rstrip() != expected_block.rstrip(): + raise SystemExit("changelog block is not deterministic for recorded candidate base") + found = re.findall(r"\[`([0-9a-f]{40})`\]", blocks[0]) + if len(found) != len(set(found)) or set(found) != set(shas) or len(found) != data["commit_count"]: + raise SystemExit("changelog does not account for every expected non-merge commit exactly once") + manifests = { + ROOT / "desktop/package.json": json.loads((ROOT / "desktop/package.json").read_text())["version"], + ROOT / "desktop/src-tauri/tauri.conf.json": json.loads((ROOT / "desktop/src-tauri/tauri.conf.json").read_text())["version"], + } + cargo = re.search(r'(?m)^version = "([^"]+)"', (ROOT / "desktop/src-tauri/Cargo.toml").read_text()) + manifests[ROOT / "desktop/src-tauri/Cargo.toml"] = cargo.group(1) if cargo else "" + bad = [str(path.relative_to(ROOT)) for path, value in manifests.items() if value != version] + if bad: + raise SystemExit(f"version mismatch in: {', '.join(bad)}") + author = git("show", "-s", "--format=%an <%ae>", candidate) + body = git("show", "-s", "--format=%B", candidate) + if author != "Wes ": + raise SystemExit(f"unexpected candidate author: {author}") + if "Signed-off-by: Wes " not in body: + raise SystemExit("candidate is missing Wes Signed-off-by trailer") + if not re.search(r"(?m)^Co-authored-by: .+ <.+>$", body): + raise SystemExit("candidate is missing automation Co-authored-by trailer") + print(f"validated immutable desktop candidate {candidate} for desktop-v{version}") + + +def main() -> None: + parser = argparse.ArgumentParser() + sub = parser.add_subparsers(dest="command", required=True) + gen = sub.add_parser("generate") + gen.add_argument("version") + gen.add_argument("--base", required=True) + gen.add_argument("--repo") + val = sub.add_parser("validate") + val.add_argument("--candidate", default="HEAD") + val.add_argument("--version") + val.add_argument("--repo") + args = parser.parse_args() + generate(args) if args.command == "generate" else validate(args) + + +if __name__ == "__main__": + main() diff --git a/scripts/prepare-desktop-release.sh b/scripts/prepare-desktop-release.sh new file mode 100755 index 0000000000..c477a84cda --- /dev/null +++ b/scripts/prepare-desktop-release.sh @@ -0,0 +1,83 @@ +#!/usr/bin/env bash +set -euo pipefail + +version="${1:-}" +mode="${2:-publish}" +[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || { + echo "usage: $0 [publish|validate-only]" >&2 + exit 1 +} + +remote="${RELEASE_REMOTE:-origin}" +git fetch "$remote" refs/heads/main:refs/remotes/origin/main --no-tags +git fetch "$remote" '+refs/tags/v*:refs/tags/v*' '+refs/tags/desktop-v*:refs/tags/desktop-v*' +base_sha="$(git rev-parse refs/remotes/origin/main)" +branch="version-bump/$version" + +remote_branch="refs/heads/$branch" +remote_oid="" +if remote_oid="$(git ls-remote "$remote" "$remote_branch" | awk '{print $1}')" && [[ -n "$remote_oid" ]]; then + git fetch "$remote" "$remote_branch:refs/remotes/origin/$branch" +fi + +git checkout -B "$branch" "$base_sha" +just bump-desktop-version "$version" +scripts/desktop_release.py generate "$version" --base "$base_sha" --repo block/buzz + +git add \ + .release/desktop-candidate.json \ + CHANGELOG.md \ + desktop/package.json \ + desktop/src-tauri/tauri.conf.json \ + desktop/src-tauri/Cargo.toml \ + desktop/src-tauri/Cargo.lock \ + pnpm-lock.yaml + +agent_name="${RELEASE_AUTOMATION_NAME:-${AGENT_NAME:-Release Automation}}" +agent_email="${RELEASE_AUTOMATION_EMAIL:-${AGENT_EMAIL:-release-automation@users.noreply.github.com}}" +msg="$(mktemp)" +trap 'rm -f "$msg"' EXIT +cat >"$msg" < +EOF +git -c user.name='Wes' -c user.email='wesbillman@users.noreply.github.com' \ + commit -s -F "$msg" +scripts/desktop_release.py validate --candidate HEAD --version "$version" --repo block/buzz + +candidate_sha="$(git rev-parse HEAD)" +previous_tag="$(python3 -c 'import json; print(json.load(open(".release/desktop-candidate.json"))["previous_tag"] or "initial")')" +printf 'base_sha=%s\ncandidate_sha=%s\nprevious_tag=%s\ntag=desktop-v%s\n' \ + "$base_sha" "$candidate_sha" "$previous_tag" "$version" + +if [[ "$mode" == validate-only ]]; then + exit 0 +fi +[[ "$mode" == publish ]] || { echo "unknown mode: $mode" >&2; exit 1; } +if [[ -n "$remote_oid" ]]; then + git push --force-with-lease="$remote_branch:$remote_oid" "$remote" "HEAD:$remote_branch" +else + git push --force-with-lease="$remote_branch:" "$remote" "HEAD:$remote_branch" +fi + +body="$(mktemp)" +trap 'rm -f "$msg" "$body"' EXIT +cat >"$body" < "$tmp/desktop/package.json" +printf '{"version":"1.0.0"}\n' > "$tmp/desktop/src-tauri/tauri.conf.json" +printf '[package]\nversion = "1.0.0"\n' > "$tmp/desktop/src-tauri/Cargo.toml" +echo '# Changelog' > "$tmp/CHANGELOG.md" +echo first > "$tmp/desktop/feature" +git -C "$tmp" add . +git -C "$tmp" commit -qm 'feat: first desktop change' +git -C "$tmp" -c tag.gpgSign=false tag v1.0.0 +echo second >> "$tmp/desktop/feature" +git -C "$tmp" commit -qam 'fix: desktop fix' +echo policy > "$tmp/POLICY.md" +git -C "$tmp" add POLICY.md +git -C "$tmp" commit -qm 'docs: repository policy' +base=$(git -C "$tmp" rev-parse HEAD) +( + cd "$tmp" + scripts/desktop_release.py generate 1.0.1 --base "$base" --repo block/buzz + python3 - <<'PY' +import json +for path in ('desktop/package.json', 'desktop/src-tauri/tauri.conf.json'): + data=json.load(open(path)); data['version']='1.0.1'; open(path,'w').write(json.dumps(data)+'\n') +p='desktop/src-tauri/Cargo.toml'; open(p,'w').write('[package]\nversion = "1.0.1"\n') +PY + rm -f msg + git add . + cat >msg <<'EOF' +chore(release): release Buzz Desktop version 1.0.1 + +Co-authored-by: Test Automation +EOF + git -c user.name=Wes -c user.email=wesbillman@users.noreply.github.com commit -q -s -F msg + rm msg + scripts/desktop_release.py validate --version 1.0.1 --repo block/buzz + grep -Fq '### Other repository changes' CHANGELOG.md + grep -Fq "$(git rev-parse HEAD~1)" CHANGELOG.md + grep -Fq "$(git rev-parse HEAD~2)" CHANGELOG.md + + # Metadata cannot lie about the prior release boundary. + cp .release/desktop-candidate.json metadata.json + python3 - <<'PY' +import json +p='.release/desktop-candidate.json'; d=json.load(open(p)); d['previous_tag']=None; open(p,'w').write(json.dumps(d)+'\n') +PY + if scripts/desktop_release.py validate --version 1.0.1 --repo block/buzz >/dev/null 2>&1; then + echo "validator accepted a forged previous release tag" >&2 + exit 1 + fi + mv metadata.json .release/desktop-candidate.json +) + +# An initial release must account for the root commit, not silently omit it. +initial=$(mktemp -d) +cp "$repo_root/scripts/desktop_release.py" "$initial/desktop_release.py" +git -C "$initial" init -q +git -C "$initial" config user.name test +git -C "$initial" config user.email test@example.com +mkdir -p "$initial/scripts" "$initial/desktop/src-tauri" +mv "$initial/desktop_release.py" "$initial/scripts/desktop_release.py" +printf '{"version":"0.1.0"}\n' > "$initial/desktop/package.json" +printf '{"version":"0.1.0"}\n' > "$initial/desktop/src-tauri/tauri.conf.json" +printf '[package]\nversion = "0.1.0"\n' > "$initial/desktop/src-tauri/Cargo.toml" +printf '# Changelog\n' > "$initial/CHANGELOG.md" +echo root > "$initial/ROOT.md" +git -C "$initial" add . +git -C "$initial" commit -qm 'feat: root release content' +root_sha=$(git -C "$initial" rev-parse HEAD) +(cd "$initial" && scripts/desktop_release.py generate 0.1.0 --base "$root_sha" --repo block/buzz) +grep -Fq "$root_sha" "$initial/CHANGELOG.md" +rm -rf "$initial" + +echo "desktop release candidate contract passed" diff --git a/scripts/test-release-ref-contract.sh b/scripts/test-release-ref-contract.sh index 0d810819d9..bd4eb75275 100755 --- a/scripts/test-release-ref-contract.sh +++ b/scripts/test-release-ref-contract.sh @@ -12,16 +12,16 @@ git -C "$tmp" config user.email test@example.com echo first >"$tmp/file" git -C "$tmp" add file git -C "$tmp" commit -qm first -git -C "$tmp" tag -m "desktop release" v1.2.3 +git -C "$tmp" tag -m "desktop release" desktop-v1.2.3 ( cd "$tmp" - GITHUB_REF=refs/tags/v1.2.3 "$verify" v 1.2.3 + GITHUB_REF=refs/tags/desktop-v1.2.3 "$verify" desktop-v 1.2.3 ) if ( cd "$tmp" - GITHUB_REF=refs/heads/main "$verify" v 1.2.3 + GITHUB_REF=refs/heads/main "$verify" desktop-v 1.2.3 ); then echo "branch-backed desktop release was accepted" >&2 exit 1 @@ -31,7 +31,7 @@ echo second >>"$tmp/file" git -C "$tmp" commit -qam second if ( cd "$tmp" - GITHUB_REF=refs/tags/v1.2.3 "$verify" v 1.2.3 + GITHUB_REF=refs/tags/desktop-v1.2.3 "$verify" desktop-v 1.2.3 ); then echo "release accepted HEAD after the tag commit" >&2 exit 1 @@ -61,6 +61,73 @@ grep -q 'private-key:.*secrets\.BUZZ_RELEASE_TAGGER_PRIVATE_KEY' "$auto_tag" grep -q 'permission-contents: write' "$auto_tag" grep -q 'GH_TOKEN:.*steps\.release-tagger\.outputs\.token' "$auto_tag" grep -Fq 'git/refs' "$auto_tag" +grep -Fq 'TAG_PREFIX="desktop-v"' "$auto_tag" +grep -Fq 'target_sha=${{ github.event.pull_request.head.sha }}' "$auto_tag" +grep -Fq 'scripts/verify-desktop-release-merge.sh' "$auto_tag" +review_filter="$repo_root/scripts/review-decision-approved.jq" +for fixture in \ + '{"reviewDecision":"CHANGES_REQUESTED"}' \ + '{"reviewDecision":"REVIEW_REQUIRED"}' \ + '{"reviewDecision":null}' \ + '{}'; do + if jq -e -f "$review_filter" <<<"$fixture" >/dev/null; then + echo "review-decision filter accepted non-approved fixture: $fixture" >&2 + exit 1 + fi +done +jq -e -f "$review_filter" >/dev/null <<'JSON' || { +{"reviewDecision":"APPROVED"} +JSON + echo "review-decision filter rejected approved GraphQL response" >&2 + exit 1 +} +required_check_filter="$repo_root/scripts/required-check-succeeded.jq" +check_fixture() { + local expected="$1" conclusion="$2" status="${3:-completed}" + local payload + payload=$(jq -n --arg status "$status" --arg conclusion "$conclusion" '{check_runs: [{name: "Web", status: $status, conclusion: $conclusion, started_at: "2026-01-01T00:00:00Z"}]}') + if jq -e --arg name Web -f "$required_check_filter" <<<"[$payload]" >/dev/null; then + actual=pass + else + actual=fail + fi + [[ "$actual" == "$expected" ]] || { + echo "required-check filter: expected $conclusion/$status to $expected" >&2 + exit 1 + } +} +check_fixture pass success +check_fixture pass skipped +check_fixture pass neutral +check_fixture fail failure +check_fixture fail success in_progress +# A newer failure must not be hidden by an older successful run of the same check. +jq -e --arg name Web -f "$required_check_filter" >/dev/null <<'JSON' && { +[{"check_runs":[ + {"name":"Web","status":"completed","conclusion":"success","started_at":"2026-01-01T00:00:00Z"}, + {"name":"Web","status":"completed","conclusion":"failure","started_at":"2026-01-02T00:00:00Z"} +]}] +JSON + echo "required-check filter accepted a stale pass over a newer failure" >&2 + exit 1 +} +release_workflow="$repo_root/.github/workflows/release.yml" +[[ "$(grep -c 'contents: write' "$release_workflow")" -eq 1 ]] || { + echo "desktop release must have exactly one GitHub contents writer" >&2; exit 1; +} +grep -Fq "needs.release.result == 'success'" "$release_workflow" +grep -Fq "needs.release-macos-x64.result == 'success'" "$release_workflow" +grep -Fq "needs.release-linux.result == 'success'" "$release_workflow" +grep -Fq "needs.release-windows.result == 'success'" "$release_workflow" +grep -Fq "refs/tags/desktop-v{0}" "$release_workflow" +grep -Fq "if: \${{ env.already_published != 'true' && !contains(needs.setup.outputs.version, '-') }}" "$release_workflow" +grep -Fq 'group: desktop-release-${{ github.ref }}' "$release_workflow" +grep -Fq 'cancel-in-progress: false' "$release_workflow" +grep -Fq 'release artifact basename collision' "$release_workflow" +[[ "$(grep -c 'gh release upload' "$release_workflow")" -eq 2 ]] || { + echo "only the final writer may upload versioned and rolling release assets" >&2; exit 1; +} +grep -Fq 'if: env.already_published' "$release_workflow" grep -Fq 'if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --silent 2>/dev/null; then' "$auto_tag" if grep -F 'git/ref/tags/$TAG' "$auto_tag" | grep -Fq '|| true'; then echo "auto-tag ignores a failed tag lookup, so a 404 body can look like an existing tag" >&2 diff --git a/scripts/verify-desktop-release-merge.sh b/scripts/verify-desktop-release-merge.sh new file mode 100755 index 0000000000..17bf2f4dcb --- /dev/null +++ b/scripts/verify-desktop-release-merge.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +set -euo pipefail + +: "${PR_HEAD_SHA:?}" +: "${MERGE_SHA:?}" +: "${VERSION:?}" +: "${PR_NUMBER:?}" +: "${GH_TOKEN:?}" + +required_checks=( + "Desktop E2E Integration" + "Desktop" + "Rust Lint" + "Security" + "Unit Tests" + "Windows Rust (x86_64-pc-windows-msvc)" + "Mobile" + "Web" + "Backend Integration (relay e2e)" + "Desktop E2E Relay" + "Relay E2E" + "Desktop Build (macOS)" + "DCO Check" +) + +expected_branch="version-bump/$VERSION" +[[ "${PR_HEAD_REF:-}" == "$expected_branch" ]] || { echo "unexpected release branch" >&2; exit 1; } +[[ "${PR_BASE_REF:-}" == main ]] || { echo "desktop release must target main" >&2; exit 1; } +[[ "${PR_HEAD_REPO:-}" == "$GITHUB_REPOSITORY" ]] || { echo "desktop release must be internal" >&2; exit 1; } + +git fetch origin "$MERGE_SHA" "$PR_HEAD_SHA" refs/heads/main:refs/remotes/origin/main --no-tags +mapfile -t parents < <(git show -s --format='%P' "$MERGE_SHA" | tr ' ' '\n') +[[ "${#parents[@]}" -eq 2 ]] || { echo "desktop release was not merged with a true merge commit" >&2; exit 1; } +[[ "${parents[1]}" == "$PR_HEAD_SHA" ]] || { echo "merge parent 2 is not the reviewed candidate" >&2; exit 1; } +git merge-base --is-ancestor "$PR_HEAD_SHA" origin/main || { echo "candidate is not reachable from current main" >&2; exit 1; } + +git checkout --detach "$PR_HEAD_SHA" +scripts/desktop_release.py validate --candidate "$PR_HEAD_SHA" --version "$VERSION" --repo "$GITHUB_REPOSITORY" + +review=$(gh api graphql -f query='query($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewDecision}}}' -F owner="${GITHUB_REPOSITORY%/*}" -F repo="${GITHUB_REPOSITORY#*/}" -F number="$PR_NUMBER" --jq '.data.repository.pullRequest') +jq -e -f scripts/review-decision-approved.jq <<<"$review" >/dev/null || { + echo "pull request effective review decision is not APPROVED" >&2 + exit 1 +} +reviews="$(gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews?per_page=100")" +valid_approvals="$(jq --arg sha "$PR_HEAD_SHA" '[.[] | select(.state == "APPROVED" and .commit_id == $sha and (.author_association == "MEMBER" or .author_association == "OWNER" or .author_association == "COLLABORATOR"))] | length' <<<"$reviews")" +[[ "$valid_approvals" -gt 0 ]] || { echo "candidate lacks an exact-head approval from a repository member or collaborator" >&2; exit 1; } + +checks="$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/commits/$PR_HEAD_SHA/check-runs?per_page=100")" +for required in "${required_checks[@]}"; do + jq -e --arg name "$required" -f scripts/required-check-succeeded.jq <<<"$checks" >/dev/null || { + echo "required check is missing or unsuccessful: $required" >&2 + exit 1 + } +done +status="$(gh api "repos/$GITHUB_REPOSITORY/commits/$PR_HEAD_SHA/status")" +jq -e '(.total_count == 0) or (.state == "success")' <<<"$status" >/dev/null || { + echo "candidate has a failing or pending combined commit status" >&2 + exit 1 +} + +echo "verified reviewed desktop candidate $PR_HEAD_SHA at merge $MERGE_SHA" From f48f3f055fdd6030d3832f615f8c0d8e5a81261a Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Thu, 30 Jul 2026 19:36:30 +0100 Subject: [PATCH 083/112] Fix video reviews in thread replies (#3719) ## Summary - Show video review comments when a video is opened from a thread reply. - Reuse review-context construction across timeline and thread views. ## Validation - `pnpm run build:e2e && pnpm exec playwright test tests/e2e/video-attachment.spec.ts --project smoke --grep "video replies in threads open the review comments view"` - `pnpm test` --------- Signed-off-by: kenny lopez --- .../src/features/channels/ui/ChannelPane.tsx | 34 +++++----- .../features/channels/ui/ChannelPane.types.ts | 1 + .../features/channels/ui/ChannelScreen.tsx | 2 + .../messages/lib/independentThreadPanel.ts | 16 ++--- .../messages/lib/videoReviewContext.test.mjs | 28 +++++++++ .../messages/lib/videoReviewContext.ts | 45 +++++++++++++ .../messages/ui/MessageThreadPanel.tsx | 11 +++- .../messages/ui/TimelineMessageList.tsx | 47 ++++---------- desktop/tests/e2e/video-attachment.spec.ts | 63 +++++++++++++++++-- 9 files changed, 182 insertions(+), 65 deletions(-) diff --git a/desktop/src/features/channels/ui/ChannelPane.tsx b/desktop/src/features/channels/ui/ChannelPane.tsx index 92fa172ff5..70877875f7 100644 --- a/desktop/src/features/channels/ui/ChannelPane.tsx +++ b/desktop/src/features/channels/ui/ChannelPane.tsx @@ -21,10 +21,7 @@ import { getDmHuddleMemberPubkeys, hasOtherDmParticipant, } from "@/features/channels/lib/dmHuddleMembers"; -import { - buildVideoReviewCommentsByRootId, - buildVideoReviewContextForMessage, -} from "@/features/messages/lib/videoReviewContext"; +import { buildVideoReviewContextsByMessageId } from "@/features/messages/lib/videoReviewContext"; import { useComposerHeightPadding } from "@/features/messages/ui/useComposerHeightPadding"; import { UserProfilePanel } from "@/features/profile/ui/UserProfilePanel"; import { ChannelFindBar } from "@/features/search/ui/ChannelFindBar"; @@ -150,6 +147,7 @@ export const ChannelPane = React.memo(function ChannelPane({ profilePanelTab, profilePanelView, targetMessageId, + threadAllMessages, threadHeadMessage, threadMessages, threadMessagesPending = false, @@ -472,25 +470,26 @@ export const ChannelPane = React.memo(function ChannelPane({ threadHeadMessage, threadMessages, }); - const videoReviewCommentsByRootId = React.useMemo( - () => buildVideoReviewCommentsByRootId(messages), - [messages], - ); const activeVideoReviewCommentSender = activeChannel?.archivedAt ? undefined : onSendVideoReviewComment; - const threadHeadVideoReviewContext = React.useMemo(() => { - if (!threadHeadMessage) { - return undefined; + const threadVideoReviewContextsByMessageId = React.useMemo(() => { + const messagesById = new Map( + messages.map((message) => [message.id, message]), + ); + if (threadHeadMessage) { + messagesById.set(threadHeadMessage.id, threadHeadMessage); + } + for (const message of threadAllMessages) { + messagesById.set(message.id, message); } - return buildVideoReviewContextForMessage({ + return buildVideoReviewContextsByMessageId({ channelId: activeChannel?.id ?? null, channelName: activeChannel?.name, channelType: activeChannel?.channelType ?? null, - comments: videoReviewCommentsByRootId.get(threadHeadMessage.id) ?? [], isSendingVideoReviewComment: isSending, - message: threadHeadMessage, + messages: [...messagesById.values()], onSendVideoReviewComment: activeVideoReviewCommentSender, onToggleReaction, profiles, @@ -499,10 +498,11 @@ export const ChannelPane = React.memo(function ChannelPane({ activeChannel, activeVideoReviewCommentSender, isSending, + messages, onToggleReaction, profiles, + threadAllMessages, threadHeadMessage, - videoReviewCommentsByRootId, ]); const isOverlay = useIsThreadPanelOverlay(); @@ -876,7 +876,9 @@ export const ChannelPane = React.memo(function ChannelPane({ scrollTargetHighlights={!layoutScrollTargetId} scrollTargetId={layoutScrollTargetId ?? threadScrollTargetId} threadHead={threadHeadMessage} - threadHeadVideoReviewContext={threadHeadVideoReviewContext} + videoReviewContextsByMessageId={ + threadVideoReviewContextsByMessageId + } widthPx={threadPanelWidthPx} threadReplies={threadMessages} threadRepliesPending={threadMessagesPending} diff --git a/desktop/src/features/channels/ui/ChannelPane.types.ts b/desktop/src/features/channels/ui/ChannelPane.types.ts index 5a27d85c4d..7257d8cd55 100644 --- a/desktop/src/features/channels/ui/ChannelPane.types.ts +++ b/desktop/src/features/channels/ui/ChannelPane.types.ts @@ -151,6 +151,7 @@ export type ChannelPaneProps = { profilePanelTab: ProfilePanelTab; profilePanelView: ProfilePanelView; threadHeadMessage: TimelineMessage | null; + threadAllMessages: TimelineMessage[]; threadMessages: MainTimelineEntry[]; threadMessagesPending?: boolean; threadPanelWidthPx: number; diff --git a/desktop/src/features/channels/ui/ChannelScreen.tsx b/desktop/src/features/channels/ui/ChannelScreen.tsx index 52b3ae7fb7..7b750daa4f 100644 --- a/desktop/src/features/channels/ui/ChannelScreen.tsx +++ b/desktop/src/features/channels/ui/ChannelScreen.tsx @@ -691,6 +691,7 @@ export function ChannelScreen({ channelManagementOpen, ); const displayedThreadHeadMessage = threadPanelData.threadHead; + const displayedThreadAllMessages = threadPanelData.messages; const displayedThreadMessages = threadPanelData.visibleReplies; const displayedThreadReplyTargetMessage = threadPanelData.replyTargetMessage; const displayedThreadFirstUnreadReplyId = displayedThreadHeadMessage @@ -944,6 +945,7 @@ export function ChannelScreen({ firstUnreadMessageId={firstUnreadMessageId} unreadCount={unreadCount} targetMessageId={mainTimelineTargetMessageId} + threadAllMessages={displayedThreadAllMessages} threadHeadMessage={displayedThreadHeadMessage} threadMessages={displayedThreadMessages} threadMessagesPending={threadRepliesQuery.isPending} diff --git a/desktop/src/features/messages/lib/independentThreadPanel.ts b/desktop/src/features/messages/lib/independentThreadPanel.ts index 4562928d8b..7652c2508c 100644 --- a/desktop/src/features/messages/lib/independentThreadPanel.ts +++ b/desktop/src/features/messages/lib/independentThreadPanel.ts @@ -11,16 +11,18 @@ export function buildIndependentThreadPanel( ...formatArgs: Tail> ) { if (!rootId) { - return buildThreadPanelData([], null, replyTargetId, expandedReplyIds); + return { + ...buildThreadPanelData([], null, replyTargetId, expandedReplyIds), + messages: [], + }; } const head = channelEvents.find((event) => event.id === rootId); const events = head ? [head, ...replyEvents] : replyEvents; - return buildThreadPanelData( - formatTimelineMessages(events, ...formatArgs), - rootId, - replyTargetId, - expandedReplyIds, - ); + const messages = formatTimelineMessages(events, ...formatArgs); + return { + ...buildThreadPanelData(messages, rootId, replyTargetId, expandedReplyIds), + messages, + }; } type Tail = T extends readonly [ diff --git a/desktop/src/features/messages/lib/videoReviewContext.test.mjs b/desktop/src/features/messages/lib/videoReviewContext.test.mjs index de35d53ce3..8ecb5f5798 100644 --- a/desktop/src/features/messages/lib/videoReviewContext.test.mjs +++ b/desktop/src/features/messages/lib/videoReviewContext.test.mjs @@ -5,6 +5,7 @@ import { buildVideoReviewCommentsByRootId, buildVideoReviewCommentsForRoot, buildVideoReviewContextForMessage, + buildVideoReviewContextsByMessageId, hasVideoAttachment, } from "./videoReviewContext.ts"; @@ -209,3 +210,30 @@ test("buildVideoReviewContextForMessage posts against the source video", async ( }, ]); }); + +test("buildVideoReviewContextsByMessageId includes video replies", () => { + const root = message({ id: "root", body: "Review request" }); + const videoReply = message({ + id: "video-reply", + body: "![video](https://relay/media/a.mp4)", + parentId: root.id, + rootId: root.id, + }); + const comment = message({ + id: "comment", + body: "[00:01] tighten this", + parentId: videoReply.id, + rootId: root.id, + }); + + const contexts = buildVideoReviewContextsByMessageId({ + channelId: "channel", + messages: [root, videoReply, comment], + }); + + assert.deepEqual([...contexts.keys()], [videoReply.id]); + assert.deepEqual( + contexts.get(videoReply.id)?.comments.map((item) => item.id), + [comment.id], + ); +}); diff --git a/desktop/src/features/messages/lib/videoReviewContext.ts b/desktop/src/features/messages/lib/videoReviewContext.ts index 8d0798db40..f605952f5a 100644 --- a/desktop/src/features/messages/lib/videoReviewContext.ts +++ b/desktop/src/features/messages/lib/videoReviewContext.ts @@ -148,3 +148,48 @@ export function buildVideoReviewContextForMessage({ rootEventId: message.id, }; } + +export function buildVideoReviewContextsByMessageId({ + channelId, + channelName, + channelType, + isSendingVideoReviewComment = false, + messages, + onSendVideoReviewComment, + onToggleReaction, + profiles, +}: { + channelId?: string | null; + channelName?: string; + channelType?: ChannelType | null; + isSendingVideoReviewComment?: boolean; + messages: TimelineMessage[]; + onSendVideoReviewComment?: SendVideoReviewComment; + onToggleReaction?: ToggleMessageReaction; + profiles?: UserProfileLookup; +}): ReadonlyMap { + const contexts = new Map(); + if (!messages.some(hasVideoAttachment)) { + return contexts; + } + + const commentsByRootId = buildVideoReviewCommentsByRootId(messages); + for (const message of messages) { + const context = buildVideoReviewContextForMessage({ + channelId, + channelName, + channelType, + comments: commentsByRootId.get(message.id) ?? [], + isSendingVideoReviewComment, + message, + onSendVideoReviewComment, + onToggleReaction, + profiles, + }); + if (context) { + contexts.set(message.id, context); + } + } + + return contexts; +} diff --git a/desktop/src/features/messages/ui/MessageThreadPanel.tsx b/desktop/src/features/messages/ui/MessageThreadPanel.tsx index 08a57fa4c6..6234af22d1 100644 --- a/desktop/src/features/messages/ui/MessageThreadPanel.tsx +++ b/desktop/src/features/messages/ui/MessageThreadPanel.tsx @@ -108,7 +108,7 @@ type MessageThreadPanelProps = ThreadPanelLayoutProps & { threadUnreadCount?: number; threadReplyUnreadCounts?: ReadonlyMap; threadTypingPubkeys: string[]; - threadHeadVideoReviewContext?: VideoReviewContext; + videoReviewContextsByMessageId?: ReadonlyMap; activityAccessoryContent?: React.ReactNode; activityAccessoryVisible: boolean; widthPx: number; @@ -221,7 +221,7 @@ export function MessageThreadPanel({ scrollTargetId, scrollTargetHighlights = true, threadHead, - threadHeadVideoReviewContext, + videoReviewContextsByMessageId, threadReplies, threadRepliesPending = false, threadUnreadCount, @@ -600,7 +600,9 @@ export function MessageThreadPanel({ } profiles={profiles} showDepthGuides={shouldShowThreadBranchGuides} - videoReviewContext={threadHeadVideoReviewContext} + videoReviewContext={videoReviewContextsByMessageId?.get( + threadHead.id, + )} /> @@ -756,6 +758,9 @@ export function MessageThreadPanel({ onToggleReaction={onToggleReaction} profiles={profiles} showDepthGuides={shouldShowThreadBranchGuides} + videoReviewContext={videoReviewContextsByMessageId?.get( + entry.message.id, + )} /> {entry.summary ? ( - messages.some(hasVideoAttachment) - ? buildVideoReviewCommentsByRootId(messages) - : new Map(), - [messages], - ); // Contexts are memoized per message id so MessageRow/Markdown memo // comparisons hold across unrelated timeline re-renders (typing // indicators, presence updates) — a fresh context object per render would // defeat the memo and re-render every video message on every pass. const videoReviewContextById = React.useMemo(() => { - const contexts = new Map< - string, - NonNullable> - >(); - for (const message of messages) { - const comments = reviewCommentsByRootId.get(message.id) ?? []; - const context = buildVideoReviewContextForMessage({ - channelId, - channelName, - channelType, - comments, - isSendingVideoReviewComment, - message, - onSendVideoReviewComment, - onToggleReaction, - profiles, - }); - if (context) { - contexts.set(message.id, context); - } - } - return contexts; + return buildVideoReviewContextsByMessageId({ + channelId, + channelName, + channelType, + isSendingVideoReviewComment, + messages, + onSendVideoReviewComment, + onToggleReaction, + profiles, + }); }, [ channelId, channelName, @@ -213,7 +191,6 @@ export const TimelineMessageList = React.memo(function TimelineMessageList({ onSendVideoReviewComment, onToggleReaction, profiles, - reviewCommentsByRootId, ]); // The flattened item stream, memoized on the entries and the unread boundary diff --git a/desktop/tests/e2e/video-attachment.spec.ts b/desktop/tests/e2e/video-attachment.spec.ts index 8f4bb0aa4a..458689a5e0 100644 --- a/desktop/tests/e2e/video-attachment.spec.ts +++ b/desktop/tests/e2e/video-attachment.spec.ts @@ -53,25 +53,31 @@ function emitMockMessage( page: Page, channelName: string, content: string, - options: { extraTags?: string[][] } = {}, + options: { extraTags?: string[][]; parentEventId?: string } = {}, ) { return page.evaluate( - ({ channelName, content, extraTags }) => { + ({ channelName, content, extraTags, parentEventId }) => { const emit = ( window as Window & { __BUZZ_E2E_EMIT_MOCK_MESSAGE__?: (input: { channelName: string; content: string; extraTags?: string[][]; + parentEventId?: string; }) => unknown; } ).__BUZZ_E2E_EMIT_MOCK_MESSAGE__; if (!emit) { throw new Error("Mock message emitter is unavailable."); } - emit({ channelName, content, extraTags }); + return emit({ channelName, content, extraTags, parentEventId }); + }, + { + channelName, + content, + extraTags: options.extraTags, + parentEventId: options.parentEventId, }, - { channelName, content, extraTags: options.extraTags }, ); } @@ -765,6 +771,55 @@ test("video upload previews use poster frames and inline videos open review mode ).toContainText("Color pass looks right"); }); +test("video replies in threads open the review comments view", async ({ + page, +}) => { + await installVideoReviewHarness(page); + + await page.goto("/"); + await page.getByTestId("channel-general").click(); + await expect(page.getByTestId("chat-title")).toHaveText("general"); + await waitForMockLiveSubscription(page, "general"); + + const root = (await emitMockMessage( + page, + "general", + "Can you review this cut?", + )) as { id: string }; + const videoReply = (await emitMockMessage( + page, + "general", + `![video](${VIDEO_URL})`, + { + parentEventId: root.id, + }, + )) as { id: string }; + await emitMockMessage(page, "general", "[00:01] Tighten this transition.", { + parentEventId: videoReply.id, + }); + + const threadSummary = page.locator(`[data-thread-head-id="${root.id}"]`); + await expect(threadSummary).toBeVisible(); + await threadSummary.click(); + + const threadPanel = page.getByTestId("message-thread-panel"); + const threadReplies = threadPanel.getByTestId("message-thread-replies"); + const reviewButton = threadReplies.getByRole("button", { + name: "Open video review", + }); + await expect(reviewButton).toBeVisible(); + await reviewButton.click(); + + const reviewDialog = page.getByTestId("video-review-dialog"); + await expect( + reviewDialog.getByTestId("video-review-comments-panel"), + ).toBeVisible(); + await expect(reviewDialog.getByTestId("message-composer")).toBeVisible(); + await expect(reviewDialog.getByTestId("video-review-comments")).toContainText( + "Tighten this transition.", + ); +}); + test("narrow inline videos hide playback speed control", async ({ page }) => { await installVideoReviewHarness(page); From 6e419b9f1c873549a7b40996970e0da7352adafb Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Thu, 30 Jul 2026 19:39:12 +0100 Subject: [PATCH 084/112] Tighten continuation message rows (#3724) ## Summary - use uniform 4px top and bottom padding for continuation rows - keep continuation timestamps top-aligned and remove the thread-only minimum-height gutter - raise continuation hover actions by 12px - align virtualized row estimates with the compact layout ## Validation - `pnpm test` (3,782 tests via pre-push) - `pnpm check` - desktop snapshots ## Screenshots ### Mention-chip continuation ![Mention-chip continuation](https://raw.githubusercontent.com/block/buzz/85b88763ef8147f3376c9bf794bc0973a0211a57/pr-3724--thread-continuation.png) ### Emoji continuation ![Emoji continuation](https://raw.githubusercontent.com/block/buzz/85b88763ef8147f3376c9bf794bc0973a0211a57/pr-3724--channel-continuation.png) --------- Signed-off-by: kenny lopez --- .../src/features/messages/lib/rowHeightEstimate.test.mjs | 7 +++++++ desktop/src/features/messages/lib/rowHeightEstimate.ts | 4 ++-- desktop/src/features/messages/ui/MessageRow.tsx | 8 +++++--- desktop/tests/e2e/messaging.spec.ts | 4 +++- 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/desktop/src/features/messages/lib/rowHeightEstimate.test.mjs b/desktop/src/features/messages/lib/rowHeightEstimate.test.mjs index dc33da4f8f..f17a53c661 100644 --- a/desktop/src/features/messages/lib/rowHeightEstimate.test.mjs +++ b/desktop/src/features/messages/lib/rowHeightEstimate.test.mjs @@ -23,6 +23,13 @@ test("estimateRowHeight: short text is near the floor", () => { assert.ok(h >= 60 && h < 120, `expected small, got ${h}`); }); +test("estimateRowHeight: continuation reserves its uniform padding", () => { + const h = estimateRowHeight(msg({ body: "hello" }), { + isContinuation: true, + }); + assert.equal(h, 28); +}); + test("estimateRowHeight: many lines reserve more", () => { const tall = estimateRowHeight( msg({ body: Array.from({ length: 20 }, (_, i) => `line ${i}`).join("\n") }), diff --git a/desktop/src/features/messages/lib/rowHeightEstimate.ts b/desktop/src/features/messages/lib/rowHeightEstimate.ts index f2fb268167..acefae95d4 100644 --- a/desktop/src/features/messages/lib/rowHeightEstimate.ts +++ b/desktop/src/features/messages/lib/rowHeightEstimate.ts @@ -26,13 +26,13 @@ const TEXT_LINE_HEIGHT = 20; const CODE_LINE_HEIGHT = 19; const CHARS_PER_LINE = 64; // rough wrap width at the timeline column const ROW_CHROME = 26; // author/time header + denser row padding -const CONTINUATION_ROW_CHROME = 8; // dense row padding only; header/avatar are hidden +const CONTINUATION_ROW_CHROME = 8; // uniform py-1 padding; header/avatar are hidden const MEDIA_BLOCK_MARGIN_TOP = 4; // image/video blocks use mt-1 in markdown const REACTION_ROW = 24; const PREVIEW_CARD = 70; const MESSAGE_ITEM_BOTTOM_PADDING = 10; // TimelineMessageList pb-2.5 const MIN_ESTIMATE = 60; // never reserve less than the old flat floor -const CONTINUATION_MIN_ESTIMATE = 34; +const CONTINUATION_MIN_ESTIMATE = 28; function mediaHeightFromDim(dim: string | undefined): number { const dimensions = dimensionsFromDim(dim); diff --git a/desktop/src/features/messages/ui/MessageRow.tsx b/desktop/src/features/messages/ui/MessageRow.tsx index 069232fde4..688b5d5f0d 100644 --- a/desktop/src/features/messages/ui/MessageRow.tsx +++ b/desktop/src/features/messages/ui/MessageRow.tsx @@ -433,8 +433,8 @@ export const MessageRow = React.memo( ) : null} + {install.isPending && installOutputLine ? ( +

+ {installOutputLine} +

+ ) : null} + {installError ? (

{installError} diff --git a/desktop/src/features/settings/ui/HarnessRow.tsx b/desktop/src/features/settings/ui/HarnessRow.tsx index de6666b8c3..c0feef13cc 100644 --- a/desktop/src/features/settings/ui/HarnessRow.tsx +++ b/desktop/src/features/settings/ui/HarnessRow.tsx @@ -10,6 +10,7 @@ import { useManagedAgentsQuery, usePersonasQuery, } from "@/features/agents/hooks"; +import { useInstallOutputLine } from "@/features/agents/lib/useInstallOutputLine"; import { RuntimeIcon } from "@/features/onboarding/ui/RuntimeIcon"; import type { AcpAuthMethod, AcpRuntimeCatalogEntry } from "@/shared/api/types"; import { getInstallErrorMessage } from "@/shared/lib/installError"; @@ -324,6 +325,7 @@ export function HarnessRow({ }, [resetEpoch]); const isInstalling = installMutation.isPending; const installError = installResult?.error ?? null; + const installOutputLine = useInstallOutputLine(runtime.id, isInstalling); const del = useDeleteCustomHarnessMutation(); // Blast-radius data for the delete confirmation — only fetched while the @@ -348,7 +350,7 @@ export function HarnessRow({ } else { setInstallResult({ success: false, - error: getInstallErrorMessage(result.steps), + error: getInstallErrorMessage(result), }); } }, @@ -479,6 +481,15 @@ export function HarnessRow({

) : null} + {isInstalling && installOutputLine ? ( +

+ {installOutputLine} +

+ ) : null} {installError ? (

({ + step: step.step, + command: step.command, + success: step.success, + stdout: step.stdout, + stderr: step.stderr, + exitCode: step.exit_code, + hint: step.hint, + })), + restartedCount: raw.restarted_count, + failedRestartCount: raw.failed_restart_count, + logPath: raw.log_path ?? null, + }; +} diff --git a/desktop/src/shared/api/tauri.ts b/desktop/src/shared/api/tauri.ts index c57525480e..69e2e455ec 100644 --- a/desktop/src/shared/api/tauri.ts +++ b/desktop/src/shared/api/tauri.ts @@ -3,6 +3,10 @@ import { activateRateLimit, parseRateLimitHint, } from "@/shared/api/relayRateLimitGate"; +import { + fromRawInstallRuntimeResult, + type RawInstallRuntimeResult, +} from "@/shared/api/installTypes"; import type { AddChannelMembersInput, AddChannelMembersResult, @@ -202,22 +206,10 @@ export type RawAcpRuntimeCatalogEntry = { definition_env?: Record; }; -export type RawInstallStepResult = { - step: string; - command: string; - success: boolean; - stdout: string; - stderr: string; - exit_code: number | null; - hint?: string; -}; - -export type RawInstallRuntimeResult = { - success: boolean; - steps: RawInstallStepResult[]; - restarted_count: number; - failed_restart_count: number; -}; +export type { + RawInstallRuntimeResult, + RawInstallStepResult, +} from "./installTypes"; type RawGitBashPrerequisite = { available: boolean; @@ -772,25 +764,6 @@ export function fromRawAcpRuntimeCatalogEntry( }; } -function fromRawInstallRuntimeResult( - raw: RawInstallRuntimeResult, -): InstallRuntimeResult { - return { - success: raw.success, - steps: raw.steps.map((step) => ({ - step: step.step, - command: step.command, - success: step.success, - stdout: step.stdout, - stderr: step.stderr, - exitCode: step.exit_code, - hint: step.hint, - })), - restartedCount: raw.restarted_count, - failedRestartCount: raw.failed_restart_count, - }; -} - function fromRawCommandAvailability( command: RawCommandAvailability, ): CommandAvailability { diff --git a/desktop/src/shared/api/types.ts b/desktop/src/shared/api/types.ts index 689c400b03..877b5b1c61 100644 --- a/desktop/src/shared/api/types.ts +++ b/desktop/src/shared/api/types.ts @@ -571,22 +571,10 @@ export type AcpRuntime = AcpRuntimeCatalogEntry & { binaryPath: string; }; -export type InstallStepResult = { - step: string; - command: string; - success: boolean; - stdout: string; - stderr: string; - exitCode: number | null; - hint?: string; -}; - -export type InstallRuntimeResult = { - success: boolean; - steps: InstallStepResult[]; - restartedCount: number; - failedRestartCount: number; -}; +export type { + InstallRuntimeResult, + InstallStepResult, +} from "./installTypes"; export type AcpAuthMethod = { id: string; diff --git a/desktop/src/shared/lib/configNudge.ts b/desktop/src/shared/lib/configNudge.ts index 82ed8f306a..86c0e16c13 100644 --- a/desktop/src/shared/lib/configNudge.ts +++ b/desktop/src/shared/lib/configNudge.ts @@ -32,7 +32,7 @@ export type ConfigNudgeRequirement = * Determines which message and CTA the nudge card shows: * - "available" → tooling installed, needs login * - "adapter_missing" → CLI installed but ACP adapter missing - * - "adapter_outdated" → ACP adapter present but from deprecated package; reinstall required + * - "adapter_outdated" → ACP adapter present but unsupported/outdated; reinstall required * - "cli_missing" → ACP adapter installed but CLI missing * - "not_installed" → neither adapter nor CLI found */ diff --git a/desktop/src/shared/lib/installError.test.mjs b/desktop/src/shared/lib/installError.test.mjs index c6b51186a8..181d7b802b 100644 --- a/desktop/src/shared/lib/installError.test.mjs +++ b/desktop/src/shared/lib/installError.test.mjs @@ -3,84 +3,108 @@ import test from "node:test"; import { getInstallErrorMessage } from "./installError.ts"; +/** A failed install result carrying `steps` and, optionally, a log pointer. */ +function failed(steps, logPath = null) { + return { + success: false, + steps, + restartedCount: 0, + failedRestartCount: 0, + logPath, + }; +} + test("getInstallErrorMessage: empty steps array returns fallback", () => { - assert.equal(getInstallErrorMessage([]), "Install failed with no output."); + assert.equal( + getInstallErrorMessage(failed([])), + "Install failed with no output.", + ); }); test("getInstallErrorMessage: failed step without hint contains step name and stderr", () => { - const message = getInstallErrorMessage([ - { - step: "adapter", - command: "npm install -g @block/buzz-acp", - success: false, - stdout: "", - stderr: "EACCES: permission denied", - exitCode: 1, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "adapter", + command: "npm install -g @block/buzz-acp", + success: false, + stdout: "", + stderr: "EACCES: permission denied", + exitCode: 1, + }, + ]), + ); assert.match(message, /Step "adapter" failed:/); assert.match(message, /EACCES: permission denied/); }); test("getInstallErrorMessage: failed step without hint does not contain hint-ish text", () => { - const message = getInstallErrorMessage([ - { - step: "adapter", - command: "npm install -g @block/buzz-acp", - success: false, - stdout: "", - stderr: "EACCES: permission denied", - exitCode: 1, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "adapter", + command: "npm install -g @block/buzz-acp", + success: false, + stdout: "", + stderr: "EACCES: permission denied", + exitCode: 1, + }, + ]), + ); assert.doesNotMatch(message, /npm config set prefix/); }); test("getInstallErrorMessage: failed step with hint starts with hint and still contains stderr", () => { const hint = "Fix the npm prefix ownership:\n sudo chown -R $USER $(npm config get prefix)"; - const message = getInstallErrorMessage([ - { - step: "adapter", - command: "npm install -g @block/buzz-acp", - success: false, - stdout: "", - stderr: "EACCES: permission denied, mkdir '/usr/local/lib'", - exitCode: 1, - hint, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "adapter", + command: "npm install -g @block/buzz-acp", + success: false, + stdout: "", + stderr: "EACCES: permission denied, mkdir '/usr/local/lib'", + exitCode: 1, + hint, + }, + ]), + ); assert.ok(message.startsWith(hint), "message should start with hint"); assert.match(message, /EACCES: permission denied/); }); test("getInstallErrorMessage: failed step with empty stderr falls back to stdout", () => { - const message = getInstallErrorMessage([ - { - step: "node", - command: "node --version", - success: false, - stdout: "some stdout output", - stderr: "", - exitCode: 1, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "node", + command: "node --version", + success: false, + stdout: "some stdout output", + stderr: "", + exitCode: 1, + }, + ]), + ); assert.match(message, /some stdout output/); }); test("getInstallErrorMessage: hint and step detail are separated by double newline for whitespace-pre-line rendering", () => { const hint = "Git Bash is required. Install it from git-scm.com."; - const message = getInstallErrorMessage([ - { - step: "shell", - command: "bash -l -c 'npm install'", - success: false, - stdout: "", - stderr: "bash: command not found", - exitCode: 127, - hint, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "shell", + command: "bash -l -c 'npm install'", + success: false, + stdout: "", + stderr: "bash: command not found", + exitCode: 127, + hint, + }, + ]), + ); assert.ok( message.includes("\n\n"), "hint and step detail should be separated by a blank line", @@ -89,25 +113,72 @@ test("getInstallErrorMessage: hint and step detail are separated by double newli }); test("getInstallErrorMessage: only reports the last (failing) step when multiple steps present", () => { - const message = getInstallErrorMessage([ - { - step: "node", - command: "node --version", - success: true, - stdout: "v20.0.0", - stderr: "", - exitCode: 0, - }, - { - step: "adapter", - command: "npm install -g @agentclientprotocol/claude-code-acp", - success: false, - stdout: "", - stderr: "npm ERR! code E404", - exitCode: 1, - }, - ]); + const message = getInstallErrorMessage( + failed([ + { + step: "node", + command: "node --version", + success: true, + stdout: "v20.0.0", + stderr: "", + exitCode: 0, + }, + { + step: "adapter", + command: "npm install -g @agentclientprotocol/claude-code-acp", + success: false, + stdout: "", + stderr: "npm ERR! code E404", + exitCode: 1, + }, + ]), + ); assert.match(message, /Step "adapter" failed:/); assert.match(message, /npm ERR! code E404/); assert.doesNotMatch(message, /Step "node"/); }); + +test("getInstallErrorMessage: points at the install log when one was written", () => { + const message = getInstallErrorMessage( + failed( + [ + { + step: "cli", + command: "curl … | bash", + success: false, + stdout: "", + stderr: "download failed", + exitCode: 1, + }, + ], + "/logs/install-goose.log", + ), + ); + assert.match(message, /download failed/); + assert.ok( + message.endsWith("\n\nFull log: /logs/install-goose.log"), + `log pointer should close the message, got: ${message}`, + ); +}); + +test("getInstallErrorMessage: omits the log pointer when no log was written", () => { + const message = getInstallErrorMessage( + failed([ + { + step: "cli", + command: "curl … | bash", + success: false, + stdout: "", + stderr: "download failed", + exitCode: 1, + }, + ]), + ); + assert.doesNotMatch(message, /Full log/); +}); + +test("getInstallErrorMessage: a run with no steps at all still points at its log", () => { + const message = getInstallErrorMessage(failed([], "/logs/install-goose.log")); + assert.match(message, /Install failed with no output\./); + assert.match(message, /Full log: \/logs\/install-goose\.log/); +}); diff --git a/desktop/src/shared/lib/installError.ts b/desktop/src/shared/lib/installError.ts index bf72c4d3b2..82bcd4a310 100644 --- a/desktop/src/shared/lib/installError.ts +++ b/desktop/src/shared/lib/installError.ts @@ -1,15 +1,25 @@ -import type { InstallStepResult } from "@/shared/api/types"; +import type { InstallRuntimeResult } from "@/shared/api/types"; /** * Build the user-visible error message for a failed install. * When the last step carries an actionable hint, it is shown first, * followed by the raw step failure detail. + * + * The step detail is truncated for display, so the message ends with a pointer + * to the install log — which holds every attempt of every step, each record + * bounded far above the display truncation — when one was written. */ -export function getInstallErrorMessage(steps: InstallStepResult[]): string { +export function getInstallErrorMessage(result: InstallRuntimeResult): string { + const { steps, logPath } = result; const lastStep = steps[steps.length - 1]; if (!lastStep) { - return "Install failed with no output."; + return withLog("Install failed with no output.", logPath); } const base = `Step "${lastStep.step}" failed: ${lastStep.stderr || lastStep.stdout || "unknown error"}`; - return lastStep.hint ? `${lastStep.hint}\n\n${base}` : base; + const detail = lastStep.hint ? `${lastStep.hint}\n\n${base}` : base; + return withLog(detail, logPath); +} + +function withLog(message: string, logPath: string | null): string { + return logPath ? `${message}\n\nFull log: ${logPath}` : message; } diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 07eaa77902..841e6ba83f 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -1,4 +1,5 @@ import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js"; +import { emit } from "@tauri-apps/api/event"; import { mockIPC, mockWindows } from "@tauri-apps/api/mocks"; import { decode, npubEncode } from "nostr-tools/nip19"; import { finalizeEvent, getPublicKey } from "nostr-tools/pure"; @@ -203,6 +204,8 @@ type E2eConfig = { acpRuntimesCatalogAfterConnect?: RawAcpRuntimeCatalogEntry[]; activePersonaIds?: string[]; installAcpRuntimeDelayMs?: number; + /** Live output lines the mocked install emits before it settles. */ + installAcpRuntimeOutputLines?: string[]; installAcpRuntimeResult?: RawInstallRuntimeResult; /** Sequence of results for successive `install_acp_runtime` calls. * Call N returns results[N]; when exhausted the last entry repeats. @@ -1257,6 +1260,8 @@ const REACTION_TARGET_CONTENT = "React to me with a custom emoji"; // REACTION_TARGET_EVENT_ID. const SYSTEM_REACTION_TARGET_EVENT_ID = "e".repeat(64); const E2E_IDENTITY_OVERRIDE_STORAGE_KEY = "buzz:e2e-identity-override.v1"; +/** Stands in for `tauri.conf.json`'s version, which no mock IPC call can read. */ +const MOCK_APP_VERSION = "0.0.0-e2e"; const DEFAULT_MOCK_IDENTITY = { pubkey: "deadbeef".repeat(8), display_name: "npub1mock...", @@ -7228,6 +7233,53 @@ let personaSharePublicationCallCount = 0; // Per-page confirm_team_snapshot_import call counter for sequenced error testing. let teamSnapshotConfirmCallCount = 0; +// Live-output sequence for the install currently being replayed. The backend +// counter is per run (`InstallReporter::for_run` starts a fresh one), so this +// restarts too — a bridge that stayed monotonic across installs would hide a UI +// that carried a stale sequence number into the next run and rejected all of it. +let installOutputSeq = 0; + +/** + * Replay the live output the Rust reporter emits while an install runs: a clear + * signal, then one line per entry. `seq` is install-wide and monotonic, matching + * the backend contract the UI's ordering depends on. + * + * The clear and the first line emit synchronously with the install invocation, + * exactly as the backend does — the command is invoked from the click handler, + * so those events land before React has committed the pending install state. + * Delaying them would let a listener that mounts on that state still catch them, + * hiding the very race the UI has to survive. + * + * Later lines are spaced so each is observable rather than collapsing into one + * frame with the next. + */ +const INSTALL_OUTPUT_REPLAY_GAP_MS = 1000; + +async function replayInstallOutput( + runtimeId: string, + lines: string[], +): Promise { + installOutputSeq = 0; + // The leading null is the clear signal the backend sends when an attempt + // starts, so this replays a whole attempt rather than only its output. + const events: (string | null)[] = [null, ...lines]; + for (const [index, line] of events.entries()) { + // Index 0 and 1 are the clear and the first line: no gap before either. + if (index > 1) { + await new Promise((resolve) => + window.setTimeout(resolve, INSTALL_OUTPUT_REPLAY_GAP_MS), + ); + } + // `emit` reaches listeners registered through the real `listen` API, which + // is what the UI hook uses; mockIPC's shouldMockEvents wires the two. + await emit("acp-install-output", { + runtime_id: runtimeId, + seq: installOutputSeq++, + line, + }); + } +} + async function handleInstallAcpRuntime( args: { runtimeId?: string; @@ -7235,6 +7287,10 @@ async function handleInstallAcpRuntime( config: E2eConfig | undefined, ): Promise { const runtimeId = args.runtimeId ?? ""; + const outputLines = config?.mock?.installAcpRuntimeOutputLines; + if (outputLines && outputLines.length > 0) { + await replayInstallOutput(runtimeId, outputLines); + } const perRuntime = config?.mock?.installAcpRuntimeByRuntime?.[runtimeId]; if (perRuntime) { @@ -7291,6 +7347,7 @@ async function handleInstallAcpRuntime( ], restarted_count: 0, failed_restart_count: 0, + log_path: null, }; } @@ -11629,6 +11686,11 @@ export function maybeInstallE2eTauriMocks() { return null; case "plugin:window|is_fullscreen": return false; + // Settings reads the app version through the app plugin. Without this the + // bridge throws an unhandled page error on every Settings render, which + // shows up as noise in unrelated specs. + case "plugin:app|version": + return MOCK_APP_VERSION; case "merge_save_subscription_kinds": { // Mirrors `merge_owner_p_kinds`: union `kind` into the owner_p row's // kinds, creating the row if it doesn't exist yet. diff --git a/desktop/tests/e2e/doctor-states.spec.ts b/desktop/tests/e2e/doctor-states.spec.ts index 77d0fbcb45..2d69a4e0da 100644 --- a/desktop/tests/e2e/doctor-states.spec.ts +++ b/desktop/tests/e2e/doctor-states.spec.ts @@ -983,4 +983,91 @@ test.describe("Doctor panel state screenshots", () => { path: `${SHOTS}/08-concurrent-installs-and-stale-clear.png`, }); }); + /** + * 09 — install observability: the live output line appears while the install + * runs and disappears when it settles, and the failure message points at the + * install log rather than only the truncated last step. + */ + test("09-install-output-line-and-log-pointer", async ({ page }) => { + await installMockBridge(page, { + acpRuntimesCatalog: [ + GOOSE_AVAILABLE, + CLAUDE_AVAILABLE_LOGGED_IN, + { + ...CODEX_NOT_INSTALLED, + can_auto_install: true, + node_required: false, + }, + BUZZ_AGENT_AVAILABLE, + ], + installAcpRuntimeDelayMs: 500, + installAcpRuntimeOutputLines: [ + "npm http fetch GET 200 @zed-industries/codex-acp", + "npm warn deprecated a transitive dependency", + ], + installAcpRuntimeResult: { + success: false, + steps: [ + { + step: "adapter", + command: "npm install -g @zed-industries/codex-acp", + success: false, + stdout: "", + stderr: "npm ERR! code E404", + exit_code: 1, + }, + ], + log_path: "/tmp/buzz-install-codex.log", + }, + }); + + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "agents"); + + const row = page.getByTestId("doctor-runtime-codex"); + await expect(row).toBeVisible({ timeout: 10_000 }); + + const installButton = page.getByTestId("doctor-runtime-install-codex"); + await expect(installButton).toBeEnabled(); + await installButton.click(); + + // The bridge emits the attempt-start clear and the first line synchronously + // with the install invocation — before React commits the pending state — so + // observing this line proves the listener was already mounted at the click. + // A subscription that waited for the install state would have missed both. + const outputLine = page.getByTestId("doctor-runtime-install-output-codex"); + await expect(outputLine).toContainText("npm http fetch", { + timeout: 5_000, + }); + + // Each new line replaces the previous one rather than accumulating. + await expect(outputLine).toContainText("npm warn deprecated", { + timeout: 5_000, + }); + await expect(outputLine).not.toContainText("npm http fetch"); + + // Settled: the line clears, so a finished install leaves no stale output + // under a fresh Install button. + const installError = page.getByTestId("doctor-runtime-install-error-codex"); + await expect(installError).toBeVisible({ timeout: 5_000 }); + await expect(outputLine).toHaveCount(0); + + // The failure points at the log holding bounded output for every attempt. + await expect(installError).toContainText("npm ERR! code E404"); + await expect(installError).toContainText("/tmp/buzz-install-codex.log"); + + await row.scrollIntoViewIfNeeded(); + await waitForAnimations(page); + await row.screenshot({ + path: `${SHOTS}/09-install-output-line-and-log-pointer.png`, + }); + + // A second install shows its own output. The backend sequence restarts per + // run, so a display that kept the previous run's sequence number would + // reject every event of this one and show nothing at all. + await installButton.click(); + await expect(outputLine).toContainText("npm http fetch", { + timeout: 5_000, + }); + }); }); diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index 468f860203..c3473ae4f1 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -131,6 +131,22 @@ export type MockAgentMemoryListing = { fetchedAt: number; }; +/** Result returned by the `install_acp_runtime` mock command. */ +type MockInstallRuntimeResult = { + success: boolean; + steps: { + step: string; + command: string; + success: boolean; + stdout: string; + stderr: string; + exit_code: number | null; + hint?: string; + }[]; + /** Install log the failure message points at. Omitted = no log was written. */ + log_path?: string | null; +}; + type MockBridgeOptions = { /** Advertised HEAD for the first mock project without adding that branch. */ projectHeadBranch?: string; @@ -171,35 +187,17 @@ type MockBridgeOptions = { connectAcpRuntimeDelayMs?: number; connectAcpRuntimeError?: string; installAcpRuntimeDelayMs?: number; + /** Live output lines the mocked install emits before it settles, in order. + * Each arrives as an `acp-install-output` event, preceded by the clear + * signal the backend sends at the start of an attempt. */ + installAcpRuntimeOutputLines?: string[]; /** Override the result returned by the `install_acp_runtime` mock command. * Pass `{ success: false, steps: [...] }` to exercise error/Retry states. */ - installAcpRuntimeResult?: { - success: boolean; - steps: { - step: string; - command: string; - success: boolean; - stdout: string; - stderr: string; - exit_code: number | null; - hint?: string; - }[]; - }; + installAcpRuntimeResult?: MockInstallRuntimeResult; /** Sequence of results for successive `install_acp_runtime` calls. Call N * returns results[N]; when exhausted the last entry repeats. Takes precedence * over `installAcpRuntimeResult`. Use for fail-then-succeed Retry tests. */ - installAcpRuntimeResults?: Array<{ - success: boolean; - steps: { - step: string; - command: string; - success: boolean; - stdout: string; - stderr: string; - exit_code: number | null; - hint?: string; - }[]; - }>; + installAcpRuntimeResults?: MockInstallRuntimeResult[]; activePersonaIds?: string[]; /** * Listing returned by the mocked `get_agent_memory` command. Pass a single From b9e4ed616f39b812bc964e79c7a40223c4e93832 Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 30 Jul 2026 15:50:51 -0600 Subject: [PATCH 090/112] test(desktop): click visible thread collapse guide (#3800) ## Summary - target the visible thread branch collapse guide in the messaging smoke test - avoid clicking the underlying collapse rail when the guide overlaps it - retain the existing post-click assertions that verify the two-reply branch collapses ## Context `main` CI failed because Playwright repeatedly attempted to click the lower `thread-collapse-rail` while the matching `thread-collapse-guide` intercepted pointer events. Both controls dispatch collapse for the same branch; the guide is the actual topmost user target and is already used by `thread-unread.spec.ts`. Failing run: https://github.com/block/buzz/actions/runs/30575425126 ## Validation - focused Playwright smoke test: 1 passed - pre-push hooks: desktop check passed; 3,835 desktop tests passed - `git diff --check` ## Review Princess Donut reviewed the test-only approach and locator determinism with no blockers. Mongo review is pending. Signed-off-by: Wes Co-authored-by: Carl --- desktop/tests/e2e/messaging.spec.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/desktop/tests/e2e/messaging.spec.ts b/desktop/tests/e2e/messaging.spec.ts index 43a617ffd4..c6f5aefb9b 100644 --- a/desktop/tests/e2e/messaging.spec.ts +++ b/desktop/tests/e2e/messaging.spec.ts @@ -918,10 +918,10 @@ test("opens a single-level thread panel with inline expansion", async ({ `[data-testid="message-thread-summary"][data-thread-head-id="${firstReplyId}"]`, ); await expect(firstReplySummaryRow).toHaveCount(0); - const firstReplyBranchRail = threadReplies.locator( - `[data-testid="thread-collapse-rail"][data-thread-head-id="${firstReplyId}"]`, + const firstReplyBranchGuide = threadReplies.locator( + `[data-testid="thread-collapse-guide"][data-thread-head-id="${firstReplyId}"]`, ); - await expect(firstReplyBranchRail).toHaveCount(1); + await expect(firstReplyBranchGuide).not.toHaveCount(0); await expect(rootSummaryRow).toContainText("18 replies"); await expect( @@ -941,7 +941,7 @@ test("opens a single-level thread panel with inline expansion", async ({ await expectThreadReplyUnobscured(nestedReplyRow); - await firstReplyBranchRail.click(); + await firstReplyBranchGuide.first().click(); await expect(firstReplySummaryRow).toHaveCount(1); await expect(firstReplySummaryRow).toContainText("2 replies"); await expect( From 114d40d9d37f05eff83ee90347ed93fb3da512c5 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 30 Jul 2026 17:53:30 -0400 Subject: [PATCH 091/112] feat(relay): gate kind 30178 team-catalog reads behind the shared tag (#3358) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Team catalog projections (`kind:30178`) embed every member's system prompt, so they need the same read gate personas already have: only the author sees an unshared event. The gate was hardcoded to `kind:30175` at six read surfaces plus the SQL pushdown, so rather than adding a second special case it becomes kind-generic over `SHARED_GATED_KINDS = {30175, 30178}`. ## Kind 30178 New parameterized-replaceable kind, addressed by `(pubkey_o, 30178, team_id)`. It embeds sanitized member projections instead of referencing `kind:30175` heads — a foreign reader of a shared team could not otherwise hydrate members whose own persona events are unshared or, for built-ins, absent entirely. `kind:30176`'s wire body is untouched, so device sync keeps its contract. ## Kind-generic shared gate `buzz_core::kind` replaces `is_persona_shared_kind` / `is_unshared_persona_event` / `persona_event_is_shared` with `SHARED_GATED_KINDS` and the kind-agnostic `is_shared_gated_kind` / `is_unshared_gated_event` / `event_is_shared`. Every read surface consults the set: | Surface | File | |---|---| | REQ historical delivery + `ids` lookup | `crates/buzz-relay/src/handlers/req.rs` | | Live fan-out | `crates/buzz-relay/src/handlers/event.rs` | | COUNT fallback | `crates/buzz-relay/src/handlers/count.rs` | | NIP-98 HTTP `/query`, `/count`, `/search` | `crates/buzz-relay/src/api/bridge.rs` | | Pre-`LIMIT` SQL pushdown | `crates/buzz-db/src/event.rs` | The SQL clause generalizes from `kind != 30175` to `kind NOT IN (...)` bound from `SHARED_GATED_KINDS`, still applied before `ORDER BY … LIMIT` so a page of newer private events cannot starve an older shared one off the candidate set. `EventQuery::persona_reader` is renamed `shared_gated_reader` and `needs_persona_filtering` to `needs_shared_gate_filtering` to match. Because the `buzz-core` rename has consumers outside the relay, the four desktop call sites of `persona_event_is_shared` travel with it: `desktop/src-tauri/src/commands/personas/pending.rs`, `desktop/src-tauri/src/event_sync.rs`, and two in `desktop/src-tauri/src/managed_agents/persona_events.rs`. Each call is unchanged apart from the name — the persona `shared` projection behaves exactly as before. ## Ingest validation `validate_persona_envelope` splits into two reusable pieces — `validate_shared_tag` (exactly-two-element `["shared","true"]`, at most one occurrence) and `single_bounded_d_tag` (exactly one `d` tag, non-empty, `<=64` chars, no ASCII control characters or whitespace). `validate_team_catalog_envelope` composes both; personas additionally keep the slug grammar `^[a-z0-9][a-z0-9_-]{0,63}$`. `kind:30178` deliberately does **not** get the slug grammar. Team ids are UUIDs or built-in identifiers such as `builtin-team:welcome`, and the colon is not slug-legal; rewriting ids to fit would break NIP-33 addressing against the team's own `kind:30176` head. The non-empty and exactly-one checks are load-bearing regardless — without them generic NIP-33 storage maps a missing `d` onto `(pubkey_o, 30178, "")` and every team overwrites its predecessor. The exact two-element `shared` shape is enforced because the SQL visibility clause is JSONB containment (`tags @> '[["shared","true"]]'`), which would match a three-element superset such as `["shared","true","extra"]`. `kind:30178` is also added to the `Scope::UsersWrite` allowlist and to `is_global_only_kind`, so a stray `h` tag cannot channel-scope an owner-authored definition. ## Deferred `kind:30176` is deliberately not a gate member. Its writers never emit `shared`, so catalog opt-in semantics do not describe it — it needs owner-private reads driven by an authenticated principal set, tracked as a separate follow-up. ## Tests - 19 new `ingest.rs` unit tests covering the 30178 envelope (UUID and colon `d` tags, 64-char boundary, non-ASCII bound, empty/valueless/duplicate/missing `d`, embedded newline, `shared` false/three-element/duplicate, scope and global-only membership). - Persona regressions for the valueless `["d"]` shapes, since the `d`-tag helper is shared by both validators. - Existing `kind.rs` gate tests generalized and extended to assert the gate applies to 30178 as it does to 30175. - New `crates/buzz-test-client/tests/e2e_team_catalog.rs`: 9 WS-level tests over a live relay covering author reads of unshared heads, foreign omission from REQ, `ids`-lookup denial, COUNT existence-leak, share and unshare transitions, and the mixed-kind filter case. - `.github/workflows/ci.yml` adds `--test e2e_team_catalog` to the Relay E2E job so the new suite runs. ## Docs `docs/nips/NIP-AP.md` gains a "Team catalog projection: kind:30178" section and an "Ingest validation: kind:30178" subsection, records the gate as kind-generic, documents 30178 deletion vs. unshare semantics, and adds a security note that sharing a team exposes every member's instructions even when that member's own `kind:30175` head is unshared. Signed-off-by: Will Pfleger --- .github/workflows/ci.yml | 2 +- crates/buzz-core/src/kind.rs | 182 +++++-- crates/buzz-db/src/event.rs | 49 +- crates/buzz-relay/src/api/bridge.rs | 38 +- crates/buzz-relay/src/handlers/count.rs | 32 +- crates/buzz-relay/src/handlers/event.rs | 12 +- crates/buzz-relay/src/handlers/ingest.rs | 309 +++++++++-- crates/buzz-relay/src/handlers/req.rs | 42 +- crates/buzz-test-client/tests/e2e_persona.rs | 4 +- .../tests/e2e_team_catalog.rs | 484 ++++++++++++++++++ .../src/commands/personas/pending.rs | 4 +- desktop/src-tauri/src/event_sync.rs | 2 +- .../src/managed_agents/persona_events.rs | 4 +- docs/nips/NIP-AP.md | 48 +- 14 files changed, 1033 insertions(+), 179 deletions(-) create mode 100644 crates/buzz-test-client/tests/e2e_team_catalog.rs diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59d63f28da..bc594e16ad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -739,7 +739,7 @@ jobs: ./scripts/start-relay-for-tests.sh --no-build - name: Relay E2E tests run: | - cargo test -p buzz-test-client --test e2e_persona --test e2e_nostr_interop -- --ignored --nocapture + cargo test -p buzz-test-client --test e2e_persona --test e2e_team_catalog --test e2e_nostr_interop -- --ignored --nocapture cargo test -p buzz-test-client --test e2e_relay invite -- --ignored --nocapture cargo test -p buzz-test-client --test e2e_relay nip43_membership_snapshots_are_rejected -- --ignored --nocapture env: diff --git a/crates/buzz-core/src/kind.rs b/crates/buzz-core/src/kind.rs index afec52305a..e5f67f671f 100644 --- a/crates/buzz-core/src/kind.rs +++ b/crates/buzz-core/src/kind.rs @@ -182,29 +182,43 @@ pub const P_GATED_KINDS: &[u32] = &[ /// or more than one `shared` tag) so no ambiguous heads can exist. pub const KIND_PERSONA: u32 = 30175; -/// Returns `true` if `kind` uses the author-only-unless-shared read model -/// (currently only `KIND_PERSONA` / 30175). +/// Kinds that use the author-only-unless-shared read model. /// /// Events of these kinds may only be delivered to foreign readers when the -/// event carries exactly `["shared", "true"]`. Used by all relay read -/// chokepoints: REQ historical delivery, live fan-out, COUNT fallback, -/// and the `ids`-lookup result gate. -pub fn is_persona_shared_kind(kind: u32) -> bool { - kind == KIND_PERSONA +/// event carries exactly `["shared", "true"]`. Every relay read chokepoint +/// consults this set: REQ historical delivery, live fan-out, COUNT fallback, +/// the `ids`-lookup result gate, both HTTP surfaces, and the pre-`LIMIT` SQL +/// visibility pushdown in `buzz-db`. +/// +/// Membership is a privacy decision, not a convenience: adding a kind here +/// makes its events invisible to foreign readers until their author opts in, +/// and the opt-in must be a `shared` TAG (not a content field) so that +/// toggling it leaves content bytes — and any content hash derived from them — +/// unchanged. +/// +/// `KIND_TEAM` (30176) is deliberately NOT a member. Its writers never emit +/// `shared`, so catalog opt-in semantics do not describe it; it needs +/// owner-private read semantics instead, which is a separate change. +pub const SHARED_GATED_KINDS: &[u32] = &[KIND_PERSONA, KIND_TEAM_CATALOG]; + +/// Returns `true` if `kind` uses the author-only-unless-shared read model +/// (see [`SHARED_GATED_KINDS`]). +pub fn is_shared_gated_kind(kind: u32) -> bool { + SHARED_GATED_KINDS.contains(&kind) } -/// Returns `true` if the event is a persona-shared-catalog kind AND the -/// requester is NOT the author AND the event does NOT carry `["shared", -/// "true"]`. All three conditions must hold to withhold the event. +/// Returns `true` if the event is a shared-gated kind AND the requester is NOT +/// the author AND the event does NOT carry `["shared", "true"]`. All three +/// conditions must hold to withhold the event. /// /// This is the per-event gate used by REQ historical delivery, live fan-out, /// and COUNT fallback paths. It is intentionally independent of -/// `is_author_only_event` — persona events with `["shared", "true"]` MUST +/// `is_author_only_event` — shared-gated events with `["shared", "true"]` MUST /// reach foreign readers; stripping them at the author-only layer would break /// the catalog query. -pub fn is_unshared_persona_event(event: &nostr::Event, requester_pubkey_bytes: &[u8]) -> bool { +pub fn is_unshared_gated_event(event: &nostr::Event, requester_pubkey_bytes: &[u8]) -> bool { let kind = event.kind.as_u16() as u32; - if !is_persona_shared_kind(kind) { + if !is_shared_gated_kind(kind) { return false; } // Author reads are always allowed. @@ -212,18 +226,23 @@ pub fn is_unshared_persona_event(event: &nostr::Event, requester_pubkey_bytes: & return false; } // Foreign reader: allowed only if the event is explicitly shared. - !persona_event_is_shared(event) + !event_is_shared(event) } /// Returns `true` if the event carries exactly one `["shared", "true"]` tag. /// +/// Kind-agnostic: this is purely the tag-shape predicate. The kind check lives +/// in [`is_shared_gated_kind`], so callers that need "is this event shared" +/// for a kind they already know (e.g. a client deciding whether its own +/// retained head is published) can use this directly. +/// /// Requires the tag to have exactly two elements so that a three-element shape /// like `["shared","true","extra"]` is NOT treated as shared. Ingest enforces /// the same exact shape, so a well-stored event either has no `shared` tag /// (author-only) or exactly one with precisely two elements and value `"true"` /// (community-readable). This helper fails closed on any non-exact shape /// independently of ingest guarantees. -pub fn persona_event_is_shared(event: &nostr::Event) -> bool { +pub fn event_is_shared(event: &nostr::Event) -> bool { let mut count = 0usize; for tag in event.tags.iter() { let parts = tag.as_slice(); @@ -258,6 +277,34 @@ pub const KIND_TEAM: u32 = 30176; /// since these events are world-readable on the relay. pub const KIND_MANAGED_AGENT: u32 = 30177; +/// NIP-AP: Team Catalog projection (parameterized replaceable, owner-authored). +/// +/// The shareable projection of a team, addressed by `(pubkey, kind, d_tag)` +/// where `d_tag` is the team's stable id. Content is a versioned JSON body +/// carrying sanitized team fields plus ordered, EMBEDDED member definition +/// projections. +/// +/// # Why this is not a `shared` tag on [`KIND_TEAM`] +/// +/// A team's members live in kind 30175 events that are author-only unless +/// individually shared, so a foreign reader of a shared team could never +/// hydrate its members. This kind therefore embeds the member projections +/// rather than referencing them: the share is atomic, it covers built-in +/// members that have no 30175 head at all, it is immune to local-id/d-tag +/// divergence, and an unshared 30175 stays private. Kind 30176's wire body is +/// untouched, so device sync keeps its contract. +/// +/// # Access control +/// +/// Member of [`SHARED_GATED_KINDS`]: author-only unless the event carries +/// exactly `["shared", "true"]`. Ingest additionally requires exactly one +/// non-empty, bounded `d` tag — generic NIP-33 storage maps a missing `d` to +/// the empty coordinate, which would collapse every team into one slot. +/// +/// Content carries only sanitized fields: no env vars, no `respond_to` +/// allowlist pubkeys, no source or local ids, no filesystem paths, no secrets. +pub const KIND_TEAM_CATALOG: u32 = 30178; + // NIP-56 reporting /// NIP-56: Report an event, pubkey, or blob to relay moderators (kind:1984). /// @@ -586,6 +633,7 @@ pub const ALL_KINDS: &[u32] = &[ KIND_PERSONA, KIND_TEAM, KIND_MANAGED_AGENT, + KIND_TEAM_CATALOG, KIND_REPORT, KIND_PRODUCT_FEEDBACK, KIND_NIP29_PUT_USER, @@ -784,6 +832,7 @@ const _: () = assert!(is_replaceable(KIND_AGENT_PROFILE)); // 10100 ∈ 10000– const _: () = assert!(is_parameterized_replaceable(KIND_PERSONA)); // 30175 ∈ 30000–39999 const _: () = assert!(is_parameterized_replaceable(KIND_TEAM)); // 30176 ∈ 30000–39999 const _: () = assert!(is_parameterized_replaceable(KIND_MANAGED_AGENT)); // 30177 ∈ 30000–39999 +const _: () = assert!(is_parameterized_replaceable(KIND_TEAM_CATALOG)); // 30178 ∈ 30000–39999 const _: () = assert!(is_parameterized_replaceable(KIND_WORKFLOW_DEF)); // 30620 ∈ 30000–39999 const _: () = assert!(is_parameterized_replaceable(KIND_EVENT_REMINDER)); // 30300 ∈ 30000–39999 const _: () = assert!(is_parameterized_replaceable(KIND_DM_VISIBILITY)); // 30622 ∈ 30000–39999 @@ -858,64 +907,68 @@ mod tests { } } - // ── persona_event_is_shared / is_unshared_persona_event ────────────── + // ── event_is_shared / is_unshared_gated_event ──────────────────────── - fn make_persona_event(tags: &[&[&str]]) -> nostr::Event { + fn make_event_of_kind(kind: u32, tags: &[&[&str]]) -> nostr::Event { use nostr::{EventBuilder, Keys, Kind, Tag}; let keys = Keys::generate(); let tag_vec: Vec = tags .iter() .map(|parts| Tag::parse(parts.iter().copied()).unwrap()) .collect(); - EventBuilder::new(Kind::Custom(KIND_PERSONA as u16), "") + EventBuilder::new(Kind::Custom(kind as u16), "") .tags(tag_vec) .sign_with_keys(&keys) .unwrap() } + fn make_persona_event(tags: &[&[&str]]) -> nostr::Event { + make_event_of_kind(KIND_PERSONA, tags) + } + #[test] - fn persona_event_is_shared_true_tag() { + fn event_is_shared_true_tag() { let ev = make_persona_event(&[&["d", "my-agent"], &["shared", "true"]]); - assert!(persona_event_is_shared(&ev)); + assert!(event_is_shared(&ev)); } #[test] - fn persona_event_is_shared_no_tag() { + fn event_is_shared_no_tag() { let ev = make_persona_event(&[&["d", "my-agent"]]); - assert!(!persona_event_is_shared(&ev)); + assert!(!event_is_shared(&ev)); } #[test] - fn persona_event_is_shared_wrong_value() { + fn event_is_shared_wrong_value() { let ev = make_persona_event(&[&["d", "my-agent"], &["shared", "false"]]); - assert!(!persona_event_is_shared(&ev)); + assert!(!event_is_shared(&ev)); } #[test] - fn persona_event_is_shared_duplicate_shared_tags() { + fn event_is_shared_duplicate_shared_tags() { // Two ["shared","true"] tags → ambiguous; not considered shared. let ev = make_persona_event(&[&["d", "my-agent"], &["shared", "true"], &["shared", "true"]]); - assert!(!persona_event_is_shared(&ev)); + assert!(!event_is_shared(&ev)); } #[test] - fn persona_event_is_shared_three_element_tag_not_shared() { + fn event_is_shared_three_element_tag_not_shared() { // ["shared","true","extra"] — three elements — must NOT be treated as shared. // The helper fails closed on any non-exact shape independently of ingest guarantees. let ev = make_persona_event(&[&["d", "my-agent"], &["shared", "true", "extra"]]); - assert!(!persona_event_is_shared(&ev)); + assert!(!event_is_shared(&ev)); } #[test] - fn persona_event_is_shared_one_element_tag_not_shared() { + fn event_is_shared_one_element_tag_not_shared() { // ["shared"] — only one element — not shared (fails the == 2 check). let ev = make_persona_event(&[&["d", "my-agent"], &["shared"]]); - assert!(!persona_event_is_shared(&ev)); + assert!(!event_is_shared(&ev)); } #[test] - fn is_unshared_persona_event_author_always_allowed() { + fn is_unshared_gated_event_author_always_allowed() { // Even without a shared tag the event author should not be blocked. use nostr::{EventBuilder, Keys, Kind, Tag}; let keys = Keys::generate(); @@ -924,32 +977,83 @@ mod tests { .sign_with_keys(&keys) .unwrap(); let author_bytes = keys.public_key().to_bytes(); - assert!(!is_unshared_persona_event(&ev, &author_bytes)); + assert!(!is_unshared_gated_event(&ev, &author_bytes)); } #[test] - fn is_unshared_persona_event_foreign_no_tag() { + fn is_unshared_gated_event_foreign_no_tag() { let ev = make_persona_event(&[&["d", "my-agent"]]); let foreign = [0u8; 32]; - assert!(is_unshared_persona_event(&ev, &foreign)); + assert!(is_unshared_gated_event(&ev, &foreign)); } #[test] - fn is_unshared_persona_event_foreign_shared_tag() { + fn is_unshared_gated_event_foreign_shared_tag() { let ev = make_persona_event(&[&["d", "my-agent"], &["shared", "true"]]); let foreign = [0u8; 32]; - assert!(!is_unshared_persona_event(&ev, &foreign)); + assert!(!is_unshared_gated_event(&ev, &foreign)); } #[test] - fn is_unshared_persona_event_non_persona_kind_passthrough() { + fn is_unshared_gated_event_ungated_kind_passthrough() { use nostr::{EventBuilder, Keys, Kind}; let keys = Keys::generate(); let ev = EventBuilder::new(Kind::Custom(KIND_TEAM as u16), "") .sign_with_keys(&keys) .unwrap(); let foreign = [0u8; 32]; - // Non-persona kinds are never blocked by this gate. - assert!(!is_unshared_persona_event(&ev, &foreign)); + // Kinds outside SHARED_GATED_KINDS are never blocked by this gate. + assert!(!is_unshared_gated_event(&ev, &foreign)); + } + + #[test] + fn is_unshared_gated_event_team_catalog_foreign_no_tag() { + // The gate must cover 30178 identically to 30175 — an unshared team + // catalog projection is author-only. + let ev = make_event_of_kind(KIND_TEAM_CATALOG, &[&["d", "team-1"]]); + let foreign = [0u8; 32]; + assert!(is_unshared_gated_event(&ev, &foreign)); + } + + #[test] + fn is_unshared_gated_event_team_catalog_foreign_shared_tag() { + let ev = make_event_of_kind(KIND_TEAM_CATALOG, &[&["d", "team-1"], &["shared", "true"]]); + let foreign = [0u8; 32]; + assert!(!is_unshared_gated_event(&ev, &foreign)); + } + + #[test] + fn is_unshared_gated_event_team_catalog_author_always_allowed() { + use nostr::{EventBuilder, Keys, Kind, Tag}; + let keys = Keys::generate(); + let ev = EventBuilder::new(Kind::Custom(KIND_TEAM_CATALOG as u16), "") + .tags(vec![Tag::parse(["d", "team-1"]).unwrap()]) + .sign_with_keys(&keys) + .unwrap(); + let author_bytes = keys.public_key().to_bytes(); + assert!(!is_unshared_gated_event(&ev, &author_bytes)); + } + + #[test] + fn is_unshared_gated_event_team_catalog_malformed_shared_tag_fails_closed() { + // A three-element `shared` tag can never be stored (ingest rejects it), + // but the read gate must independently treat it as NOT shared. + let ev = make_event_of_kind( + KIND_TEAM_CATALOG, + &[&["d", "team-1"], &["shared", "true", "extra"]], + ); + let foreign = [0u8; 32]; + assert!(is_unshared_gated_event(&ev, &foreign)); + } + + #[test] + fn shared_gated_kinds_membership() { + assert!(is_shared_gated_kind(KIND_PERSONA)); + assert!(is_shared_gated_kind(KIND_TEAM_CATALOG)); + // 30176 has owner-private semantics, not catalog opt-in semantics: its + // writers never emit `shared`, so gating it here would hide every team + // from its own delegated readers. + assert!(!is_shared_gated_kind(KIND_TEAM)); + assert!(!is_shared_gated_kind(KIND_MANAGED_AGENT)); } } diff --git a/crates/buzz-db/src/event.rs b/crates/buzz-db/src/event.rs index 0e54196d11..c0550e7e22 100644 --- a/crates/buzz-db/src/event.rs +++ b/crates/buzz-db/src/event.rs @@ -11,7 +11,7 @@ use uuid::Uuid; use buzz_core::kind::{ event_kind_i32, is_ephemeral, is_parameterized_replaceable, KIND_AUTH, KIND_EVENT_REMINDER, - KIND_HUDDLE_STARTED, + KIND_HUDDLE_STARTED, SHARED_GATED_KINDS, }; use buzz_core::{CommunityId, StoredEvent}; @@ -71,13 +71,15 @@ pub struct EventQuery { /// which needs to fetch all matching events for post-filter counting. /// When None, the default clamp of 1000 applies. pub max_limit: Option, - /// Persona visibility reader: when set, append an SQL visibility clause - /// for kind 30175 before ORDER/LIMIT so private personas are excluded from - /// the candidate page rather than discarded after it. + /// Shared-gated visibility reader: when set, append an SQL visibility + /// clause for every kind in [`SHARED_GATED_KINDS`] before ORDER/LIMIT so + /// private events are excluded from the candidate page rather than + /// discarded after it. /// - /// The clause is: `AND (kind != 30175 OR pubkey = $reader OR tags @> ?)`, - /// where `?` is the JSONB literal `[["shared","true"]]`. The GIN index on - /// `tags` (migration 0004, jsonb_path_ops) makes the containment check fast. + /// The clause is: `AND (kind NOT IN (...) OR pubkey = $reader OR tags @> ?)`, + /// where the `IN` list is [`SHARED_GATED_KINDS`] and `?` is the JSONB + /// literal `[["shared","true"]]`. The GIN index on `tags` (migration 0004, + /// jsonb_path_ops) makes the containment check fast. /// /// NOTE: `tags @> '[["shared","true"]]'` uses JSONB containment, which /// matches any tag array that is a superset of `[["shared","true"]]` — it @@ -85,7 +87,7 @@ pub struct EventQuery { /// 2` exact-shape check ensures such malformed tags are never stored, so the /// SQL pushdown is sound. Keeping `event_visible_to_reader` as post-filter /// defense-in-depth catches any residual mismatch. - pub persona_reader: Option>, + pub shared_gated_reader: Option>, } impl EventQuery { @@ -114,7 +116,7 @@ impl EventQuery { e_tags: None, channel_ids: None, max_limit: None, - persona_reader: None, + shared_gated_reader: None, } } } @@ -512,25 +514,28 @@ pub(crate) async fn query_events_on( } } - // Persona visibility pushdown: exclude kind 30175 events that are neither - // authored by the reader nor explicitly shared. Applied BEFORE ORDER/LIMIT - // so that a page of newer private personas does not push visible shared ones - // off the end of the result set (the catalog query pattern). + // Shared-gated visibility pushdown: exclude SHARED_GATED_KINDS events that + // are neither authored by the reader nor explicitly shared. Applied BEFORE + // ORDER/LIMIT so that a page of newer private events does not push visible + // shared ones off the end of the result set (the catalog query pattern). // - // Clause: AND (kind != 30175 OR pubkey = $reader OR tags @> '[["shared","true"]]') + // Clause: AND (kind NOT IN (30175, 30178) OR pubkey = $reader + // OR tags @> '[["shared","true"]]') // // The JSONB containment check is served by idx_events_tags_gin (migration // 0004, jsonb_path_ops). `tags @> '[["shared","true"]]'` matches any array // that contains exactly the sub-array — a two-element `["shared","true"]` - // tag passes; a tag-absent event does not. Because ingest now requires - // exactly two elements for the shared tag (parts.len() == 2), no stored - // event can carry a three-element superset. - if let Some(ref reader_bytes) = q.persona_reader { - let kind_30175: i32 = 30175; + // tag passes; a tag-absent event does not. Because ingest requires exactly + // two elements for the shared tag (parts.len() == 2), no stored event can + // carry a three-element superset. + if let Some(ref reader_bytes) = q.shared_gated_reader { let shared_containment = serde_json::json!([["shared", "true"]]); - qb.push(format!(" AND ({col_prefix}kind != ")); - qb.push_bind(kind_30175); - qb.push(format!(" OR {col_prefix}pubkey = ")); + qb.push(format!(" AND ({col_prefix}kind NOT IN (")); + let mut sep = qb.separated(", "); + for kind in SHARED_GATED_KINDS { + sep.push_bind(*kind as i32); + } + qb.push(format!(") OR {col_prefix}pubkey = ")); qb.push_bind(reader_bytes.clone()); qb.push(format!(" OR {col_prefix}tags @> ")); qb.push_bind(shared_containment); diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs index 10461d8d46..678199e734 100644 --- a/crates/buzz-relay/src/api/bridge.rs +++ b/crates/buzz-relay/src/api/bridge.rs @@ -1236,10 +1236,10 @@ async fn query_events_authed( extract_channel_from_filter(filter), &accessible_channels, ); - // Persona visibility pushdown: must mirror WS REQ so that a page of newer - // private personas does not starve older shared ones off the candidate page. - if crate::handlers::req::filter_can_match_persona_shared_kinds(filter) { - query.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown: must mirror WS REQ so that a page of + // newer private events does not starve older shared ones off the page. + if crate::handlers::req::filter_can_match_shared_gated_kinds(filter) { + query.shared_gated_reader = Some(pubkey_bytes.clone()); } match extract_before_id(raw) { @@ -1453,11 +1453,11 @@ async fn count_events_authed( filter, &authed_pubkey_hex, ); - // Force per-event fallback for filters that can match kind:30175 — - // the fast SQL count_events() path has no per-event gate and would - // over-count foreign unshared persona events (existence leak). - let needs_persona_filtering = - crate::handlers::req::filter_can_match_persona_shared_kinds(filter); + // Force per-event fallback for filters that can match a shared-gated + // kind — the fast SQL count_events() path has no per-event gate and + // would over-count foreign unshared events (existence leak). + let needs_shared_gate_filtering = + crate::handlers::req::filter_can_match_shared_gated_kinds(filter); // If filter targets a specific channel, verify access. if let Some(ch_id) = extract_channel_from_filter(filter) { @@ -1472,10 +1472,10 @@ async fn count_events_authed( tenant.community(), ) .await; - // Persona visibility pushdown: same as REQ and /query paths, so the - // fallback's query_events call doesn't over-fetch private persona rows. - if needs_persona_filtering { - query.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown: same as REQ and /query paths, so + // the fallback's query_events call doesn't over-fetch private rows. + if needs_shared_gate_filtering { + query.shared_gated_reader = Some(pubkey_bytes.clone()); } let author_is_self = filter.authors.as_ref().is_some_and(|authors| { !authors.is_empty() @@ -1486,7 +1486,7 @@ async fn count_events_authed( if crate::handlers::req::filter_fully_pushable(filter) && (!needs_author_only_filtering || author_is_self) && !needs_result_gated_filtering - && !needs_persona_filtering + && !needs_shared_gate_filtering { match state.db.count_events_routed("bridge_count", &query).await { Ok(n) => total += n as u64, @@ -1541,10 +1541,10 @@ async fn count_events_authed( ) .await; query.channel_ids = Some(accessible_channels.to_vec()); - // Persona visibility pushdown: pre-filter before ORDER/LIMIT on the - // fallback query_events path. - if needs_persona_filtering { - query.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown: pre-filter before ORDER/LIMIT on + // the fallback query_events path. + if needs_shared_gate_filtering { + query.shared_gated_reader = Some(pubkey_bytes.clone()); } let author_is_self = filter.authors.as_ref().is_some_and(|authors| { @@ -1556,7 +1556,7 @@ async fn count_events_authed( if crate::handlers::req::filter_fully_pushable(filter) && (!needs_author_only_filtering || author_is_self) && !needs_result_gated_filtering - && !needs_persona_filtering + && !needs_shared_gate_filtering { query.limit = None; match state.db.count_events_routed("bridge_count", &query).await { diff --git a/crates/buzz-relay/src/handlers/count.rs b/crates/buzz-relay/src/handlers/count.rs index dfb44e152f..3eeab5e807 100644 --- a/crates/buzz-relay/src/handlers/count.rs +++ b/crates/buzz-relay/src/handlers/count.rs @@ -7,8 +7,8 @@ use tracing::warn; use crate::connection::{AuthState, ConnectionState}; use crate::handlers::req::{ - event_visible_to_reader, filter_can_match_persona_shared_kinds, - filter_can_match_result_gated_kinds, result_gated_count_safe_for_pushdown, + event_visible_to_reader, filter_can_match_result_gated_kinds, + filter_can_match_shared_gated_kinds, result_gated_count_safe_for_pushdown, }; use crate::protocol::RelayMessage; use crate::state::AppState; @@ -103,11 +103,11 @@ pub async fn handle_count( // fast-path count_events() cannot be used because it doesn't do // per-event author filtering. let needs_author_only_filtering = super::req::filter_can_match_author_only_kinds(filter); - // Determine if this filter can match kind 30175 (persona) — if so, the - // fast-path must be bypassed because it has no per-event shared-tag check. - // A fast count over 30175 would include foreign unshared persona events, - // leaking the existence of private agent activity. - let needs_persona_filtering = filter_can_match_persona_shared_kinds(filter); + // Determine if this filter can match a shared-gated kind (30175, 30178) + // — if so, the fast path must be bypassed because it has no per-event + // shared-tag check. A fast count over those kinds would include foreign + // unshared events, leaking the existence of private agent activity. + let needs_shared_gate_filtering = filter_can_match_shared_gated_kinds(filter); // Determine if this filter can match result-gated kinds (44200, 30622) // that require a per-event owner check. When the fast SQL path would // count matching rows without calling reader_authorized_for_event, a @@ -157,10 +157,10 @@ pub async fn handle_count( conn.tenant.community(), ) .await; - // Persona visibility pushdown: pre-filter the fallback query_events - // candidate page before ORDER/LIMIT. - if needs_persona_filtering { - query.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown: pre-filter the fallback + // query_events candidate page before ORDER/LIMIT. + if needs_shared_gate_filtering { + query.shared_gated_reader = Some(pubkey_bytes.clone()); } let author_is_self = filter.authors.as_ref().is_some_and(|authors| { !authors.is_empty() @@ -171,7 +171,7 @@ pub async fn handle_count( if super::req::filter_fully_pushable(filter) && (!needs_author_only_filtering || author_is_self) && !needs_result_gated_filtering - && !needs_persona_filtering + && !needs_shared_gate_filtering { match state.db.count_events_routed("count_req", &query).await { Ok(n) => total += n as u64, @@ -230,9 +230,9 @@ pub async fn handle_count( ) .await; query.channel_ids = Some(accessible_channels.to_vec()); - // Persona visibility pushdown for the fallback query_events path. - if needs_persona_filtering { - query.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown for the fallback query_events path. + if needs_shared_gate_filtering { + query.shared_gated_reader = Some(pubkey_bytes.clone()); } let author_is_self = filter.authors.as_ref().is_some_and(|authors| { @@ -244,7 +244,7 @@ pub async fn handle_count( if super::req::filter_fully_pushable(filter) && (!needs_author_only_filtering || author_is_self) && !needs_result_gated_filtering - && !needs_persona_filtering + && !needs_shared_gate_filtering { query.limit = None; // COUNT doesn't need a row limit match state.db.count_events_routed("count_req", &query).await { diff --git a/crates/buzz-relay/src/handlers/event.rs b/crates/buzz-relay/src/handlers/event.rs index 88dd5f5180..a9cdffcdec 100644 --- a/crates/buzz-relay/src/handlers/event.rs +++ b/crates/buzz-relay/src/handlers/event.rs @@ -7,7 +7,7 @@ use tracing::{debug, error, info, warn}; use buzz_core::event::StoredEvent; use buzz_core::kind::{ - event_kind_u32, is_ephemeral, is_unshared_persona_event, AUTHOR_ONLY_KINDS, + event_kind_u32, is_ephemeral, is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_OBSERVER_FRAME, KIND_GIFT_WRAP, KIND_PRESENCE_UPDATE, }; use buzz_core::observer::{ @@ -151,10 +151,10 @@ pub async fn filter_fanout_by_access( matches }; - // Persona shared-read gate (fan-out): kind 30175 events fan out to all - // connections only when carrying ["shared","true"]. Unshared personas - // are delivered only to the author's own connections, matching REQ semantics. - let matches = if buzz_core::kind::is_persona_shared_kind(event_kind_u32(&stored_event.event)) { + // Shared-read gate (fan-out): SHARED_GATED_KINDS events fan out to all + // connections only when carrying ["shared","true"]. Unshared ones are + // delivered only to the author's own connections, matching REQ semantics. + let matches = if buzz_core::kind::is_shared_gated_kind(event_kind_u32(&stored_event.event)) { let author = stored_event.event.pubkey.to_bytes(); matches .into_iter() @@ -167,7 +167,7 @@ pub async fn filter_fanout_by_access( return true; } // Foreign connection: allowed only if the event is shared. - !is_unshared_persona_event(&stored_event.event, &pk) + !is_unshared_gated_event(&stored_event.event, &pk) }) .collect() } else { diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs index ee644d5a9b..39ecbe18e4 100644 --- a/crates/buzz-relay/src/handlers/ingest.rs +++ b/crates/buzz-relay/src/handlers/ingest.rs @@ -31,9 +31,9 @@ use buzz_core::kind::{ KIND_PRODUCT_FEEDBACK, KIND_PROFILE, KIND_REACTION, KIND_READ_STATE, KIND_REPORT, KIND_STREAM_MESSAGE, KIND_STREAM_MESSAGE_BOOKMARKED, KIND_STREAM_MESSAGE_DIFF, KIND_STREAM_MESSAGE_EDIT, KIND_STREAM_MESSAGE_PINNED, KIND_STREAM_MESSAGE_SCHEDULED, - KIND_STREAM_MESSAGE_V2, KIND_STREAM_REMINDER, KIND_TEAM, KIND_TEXT_NOTE, KIND_USER_STATUS, - KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER, RELAY_ADMIN_ADD_MEMBER, RELAY_ADMIN_CHANGE_ROLE, - RELAY_ADMIN_REMOVE_MEMBER, RELAY_ADMIN_SET_WORKSPACE_PROFILE, + KIND_STREAM_MESSAGE_V2, KIND_STREAM_REMINDER, KIND_TEAM, KIND_TEAM_CATALOG, KIND_TEXT_NOTE, + KIND_USER_STATUS, KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER, RELAY_ADMIN_ADD_MEMBER, + RELAY_ADMIN_CHANGE_ROLE, RELAY_ADMIN_REMOVE_MEMBER, RELAY_ADMIN_SET_WORKSPACE_PROFILE, }; use buzz_core::tenant::TenantContext; use buzz_core::verification::verify_event; @@ -214,7 +214,7 @@ fn required_scope_for_kind(kind: u32, event: &Event) -> Result Ok(Scope::MessagesWrite), KIND_CONTACT_LIST | KIND_READ_STATE | KIND_USER_STATUS | KIND_AGENT_ENGRAM | KIND_EVENT_REMINDER | KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT - | super::push_lease::KIND_PUSH_LEASE => { + | KIND_TEAM_CATALOG | super::push_lease::KIND_PUSH_LEASE => { Ok(Scope::UsersWrite) } // NIP-AM: agent turn metrics are agent-authored global events (encrypted to owner). @@ -419,10 +419,12 @@ pub(crate) fn is_global_only_kind(kind: u32) -> bool { | KIND_AGENT_PROFILE // NIP-AP: persona definitions (30175): owner-authored, keyed by (pubkey, kind, d_tag). | KIND_PERSONA - // NIP-AP: team (30176) + managed-agent (30177) definitions: owner-authored, - // keyed by (pubkey, kind, d_tag). A stray `h` tag must not channel-scope them. + // NIP-AP: team (30176) + managed-agent (30177) definitions and the + // team-catalog projection (30178): owner-authored, keyed by + // (pubkey, kind, d_tag). A stray `h` tag must not channel-scope them. | KIND_TEAM | KIND_MANAGED_AGENT + | KIND_TEAM_CATALOG // NIP-34: git events use `a` tags (repo reference), not `h` tags (channel scope). // Parameterized replaceable kinds are keyed by (pubkey, kind, d_tag). | KIND_GIT_REPO_ANNOUNCEMENT @@ -1029,37 +1031,27 @@ fn validate_engram_envelope(event: &Event) -> Result<(), String> { Ok(()) } -/// Validate the envelope of a kind:30175 persona event. -/// -/// Enforces: -/// * exactly one `d` tag with a non-empty value matching the slug grammar -/// `^[a-z0-9][a-z0-9_-]{0,63}$`. -/// * at most one `shared` tag; if present, its value must be exactly `"true"`. +/// Enforce the `shared`-tag shape shared by every kind in +/// [`buzz_core::kind::SHARED_GATED_KINDS`]: at most one `shared` tag, and if +/// present it must be exactly `["shared", "true"]`. /// -/// Without the `d`-tag check, an empty d-tag collapses every persona into the -/// `(pubkey, 30175, "")` slot — last-write-wins data loss. +/// This ensures no ambiguous heads: either an event has no `shared` tag +/// (author-only) or exactly `["shared", "true"]` (community-readable). Any +/// other value (`"false"`, `"1"`, extra elements, duplicate tags) is rejected +/// at ingest so read-path helpers — including the SQL-level `tags @> +/// '[["shared","true"]]'` containment clause, which would otherwise match a +/// three-element superset — can treat stored events as unambiguously one or the +/// other. /// -/// The `shared` tag rule ensures no ambiguous heads: either an event has no -/// `shared` tag (author-only) or exactly `["shared", "true"]` (community- -/// readable). Any other value (`"false"`, `"1"`, extra tags) is rejected at -/// ingest so read-path helpers can treat stored events as unambiguously one or -/// the other. -fn validate_persona_envelope(event: &Event) -> Result<(), String> { - let mut d_tags: Vec<&str> = Vec::new(); +/// `label` names the kind in error messages (e.g. `"persona event"`). +fn validate_shared_tag(event: &Event, label: &str) -> Result<(), String> { let mut shared_count = 0usize; for tag in event.tags.iter() { let parts = tag.as_slice(); - if parts.len() >= 2 && parts[0].as_str() == "d" { - d_tags.push(&parts[1]); - } if !parts.is_empty() && parts[0].as_str() == "shared" { - // Exact shape required: ["shared", "true"] — exactly two elements, - // second element exactly "true". Extra elements are rejected so that - // a three-element tag like ["shared","true","extra"] cannot be stored - // and later misread as shared by the SQL-level visibility clause. if parts.len() != 2 || parts[1].as_str() != "true" { return Err(format!( - "persona event `shared` tag must be exactly [\"shared\",\"true\"] (got {:?})", + "{label} `shared` tag must be exactly [\"shared\",\"true\"] (got {:?})", parts.iter().map(|s| s.as_str()).collect::>() )); } @@ -1068,43 +1060,106 @@ fn validate_persona_envelope(event: &Event) -> Result<(), String> { } if shared_count > 1 { return Err(format!( - "persona event must have at most one `shared` tag (got {shared_count})" + "{label} must have at most one `shared` tag (got {shared_count})" )); } + Ok(()) +} + +/// Return the event's single `d` tag value, requiring exactly one tag whose +/// value is non-empty, at most 64 characters, and free of Unicode control +/// characters and whitespace. +/// +/// Without this check an empty `d` tag collapses every event of the kind into +/// the `(pubkey, kind, "")` slot — last-write-wins data loss. The character +/// bound keeps the value usable as a NIP-33 coordinate (`::`) +/// and as a log field: an embedded newline or tab would break line-oriented +/// consumers of both. +/// +/// Tags are counted by their first element alone, so a valueless `["d"]` +/// counts. Skipping it would let `["d"]` plus `["d", "team-1"]` pass the +/// exactly-one rule, and a NIP-33 consumer that reads `["d"]` as an +/// empty-valued first `d` tag would then address the event at `""` where this +/// relay addresses it at `"team-1"`. +/// +/// `label` names the kind in error messages (e.g. `"persona event"`). +fn single_bounded_d_tag<'a>(event: &'a Event, label: &str) -> Result<&'a str, String> { + let d_tags: Vec> = event + .tags + .iter() + .filter_map(|tag| { + let parts = tag.as_slice(); + (parts.first().map(|name| name.as_str()) == Some("d")) + .then(|| parts.get(1).map(|value| value.as_str())) + }) + .collect(); if d_tags.len() != 1 { return Err(format!( - "persona event must have exactly one `d` tag (got {})", + "{label} must have exactly one `d` tag (got {})", d_tags.len() )); } - let d = d_tags[0]; + let d = d_tags[0].unwrap_or_default(); if d.is_empty() { - return Err("persona event `d` tag must not be empty".to_string()); + return Err(format!("{label} `d` tag must not be empty")); } - // Slug grammar: ^[a-z0-9][a-z0-9_-]{0,63}$ - if d.len() > 64 { + let char_count = d.chars().count(); + if char_count > 64 { return Err(format!( - "persona event `d` tag too long ({} chars, max 64)", - d.len() + "{label} `d` tag too long ({char_count} chars, max 64)" )); } + if d.chars().any(|c| c.is_control() || c.is_whitespace()) { + return Err(format!( + "{label} `d` tag must not contain control characters or whitespace" + )); + } + Ok(d) +} + +/// Validate the envelope of a kind:30175 persona event. +/// +/// Enforces the shared-gated `shared`-tag shape ([`validate_shared_tag`]) plus +/// exactly one `d` tag matching the persona slug grammar +/// `^[a-z0-9][a-z0-9_-]{0,63}$`. +fn validate_persona_envelope(event: &Event) -> Result<(), String> { + const LABEL: &str = "persona event"; + validate_shared_tag(event, LABEL)?; + let d = single_bounded_d_tag(event, LABEL)?; + // Slug grammar: ^[a-z0-9][a-z0-9_-]{0,63}$ let bytes = d.as_bytes(); if !bytes[0].is_ascii_lowercase() && !bytes[0].is_ascii_digit() { - return Err( - "persona event `d` tag must start with a lowercase letter or digit".to_string(), - ); + return Err(format!( + "{LABEL} `d` tag must start with a lowercase letter or digit" + )); } if !bytes[1..] .iter() .all(|&b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_' || b == b'-') { - return Err( - "persona event `d` tag must match [a-z0-9_-] after the first character".to_string(), - ); + return Err(format!( + "{LABEL} `d` tag must match [a-z0-9_-] after the first character" + )); } Ok(()) } +/// Validate the envelope of a kind:30178 team-catalog event. +/// +/// Enforces the shared-gated `shared`-tag shape ([`validate_shared_tag`]) plus +/// exactly one non-empty, bounded `d` tag. +/// +/// Deliberately NOT the persona slug grammar: a team's `d` tag is its stable +/// local id, which is either a UUID or a built-in identifier such as +/// `builtin-team:welcome` — the colon is not slug-legal, and rewriting ids to +/// fit would break NIP-33 addressing against the team's own kind:30176 head. +fn validate_team_catalog_envelope(event: &Event) -> Result<(), String> { + const LABEL: &str = "team-catalog event"; + validate_shared_tag(event, LABEL)?; + single_bounded_d_tag(event, LABEL)?; + Ok(()) +} + /// Validate that `content` is a syntactically plausible NIP-44 v2 ciphertext. /// /// Checks: @@ -2070,6 +2125,11 @@ async fn ingest_event_inner( .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?; } + if kind_u32 == KIND_TEAM_CATALOG { + validate_team_catalog_envelope(&event) + .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?; + } + // Track pre-created channel UUID for compensation on insert failure. let mut pre_created_channel: Option = None; @@ -3597,6 +3657,24 @@ mod tests { assert!(err.contains("`d` tag"), "got: {err}"); } + #[test] + fn persona_envelope_rejects_valueless_d_tag() { + // A lone ["d"] carries no value; it must fail as a missing value, not + // be skipped as though the event had no `d` tag at all. + let ev = make_persona(&[&["d"]]); + let err = validate_persona_envelope(&ev).unwrap_err(); + assert!(err.contains("must not be empty"), "got: {err}"); + } + + #[test] + fn persona_envelope_rejects_valueless_plus_valued_d_tags() { + // Counting only tags with a value would see one `d` here and accept the + // event, breaking the exactly-one rule. + let ev = make_persona(&[&["d"], &["d", "slug-a"]]); + let err = validate_persona_envelope(&ev).unwrap_err(); + assert!(err.contains("exactly one `d` tag"), "got: {err}"); + } + #[test] fn persona_envelope_rejects_too_long() { let slug = "a".repeat(65); @@ -3723,6 +3801,151 @@ mod tests { ); } + // ─── team-catalog (30178) envelope tests ───────────────────────────────── + + fn make_team_catalog(tags: &[&[&str]]) -> Event { + make_event_with_tags( + KIND_TEAM_CATALOG, + r#"{"v":1,"name":"Team","members":[]}"#, + tags, + ) + } + + #[test] + fn team_catalog_envelope_accepts_uuid_d_tag() { + let ev = make_team_catalog(&[&["d", "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0"]]); + assert!(validate_team_catalog_envelope(&ev).is_ok()); + } + + #[test] + fn team_catalog_envelope_accepts_builtin_colon_d_tag() { + // Built-in team ids carry a colon (`builtin-team:welcome`), which the + // persona slug grammar forbids. The catalog `d` tag must accept them so + // a built-in team can be shared under its real local id. + let ev = make_team_catalog(&[&["d", "builtin-team:welcome"]]); + assert!(validate_team_catalog_envelope(&ev).is_ok()); + } + + #[test] + fn team_catalog_envelope_accepts_shared_true() { + let ev = make_team_catalog(&[&["d", "team-1"], &["shared", "true"]]); + assert!(validate_team_catalog_envelope(&ev).is_ok()); + } + + #[test] + fn team_catalog_envelope_rejects_missing_d_tag() { + let ev = make_team_catalog(&[]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("exactly one `d` tag"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_empty_d_tag() { + // An empty d-tag collapses every team into the (pubkey, 30178, "") slot. + let ev = make_team_catalog(&[&["d", ""]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("must not be empty"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_duplicate_d_tags() { + let ev = make_team_catalog(&[&["d", "team-1"], &["d", "team-2"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("exactly one `d` tag"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_valueless_d_tag() { + // A lone ["d"] carries no value; it must fail as a missing value, not + // be skipped as though the event had no `d` tag at all. + let ev = make_team_catalog(&[&["d"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("must not be empty"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_valueless_plus_valued_d_tags() { + // Counting only tags with a value would see one `d` here and accept the + // event. A NIP-33 consumer that reads ["d"] as an empty-valued first + // `d` tag would then address this event at "" where we address it at + // "team-1". + let ev = make_team_catalog(&[&["d"], &["d", "team-1"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("exactly one `d` tag"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_bounds_d_tag_by_chars_not_bytes() { + // 64 multi-byte characters is 192 bytes; the documented bound is + // characters, so this must be accepted. + let d = "é".repeat(64); + assert!(d.len() > 64, "fixture must exceed the bound in bytes"); + let ev = make_team_catalog(&[&["d", &d]]); + assert!(validate_team_catalog_envelope(&ev).is_ok()); + } + + #[test] + fn team_catalog_envelope_rejects_too_long_d_tag() { + let d = "a".repeat(65); + let ev = make_team_catalog(&[&["d", &d]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("too long"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_accepts_max_length_d_tag() { + let d = "a".repeat(64); + let ev = make_team_catalog(&[&["d", &d]]); + assert!(validate_team_catalog_envelope(&ev).is_ok()); + } + + #[test] + fn team_catalog_envelope_rejects_whitespace_d_tag() { + // A newline in the d-tag would break the NIP-33 coordinate and any + // line-oriented log consumer. + let ev = make_team_catalog(&[&["d", "team\n1"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("control characters"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_shared_false() { + let ev = make_team_catalog(&[&["d", "team-1"], &["shared", "false"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("\"true\""), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_shared_three_elements() { + // Same exact-shape rule as personas: a three-element tag would match the + // SQL containment clause `tags @> '[["shared","true"]]'` as a superset. + let ev = make_team_catalog(&[&["d", "team-1"], &["shared", "true", "extra"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("[\"shared\",\"true\"]"), "got: {err}"); + } + + #[test] + fn team_catalog_envelope_rejects_duplicate_shared_tags() { + let ev = make_team_catalog(&[&["d", "team-1"], &["shared", "true"], &["shared", "true"]]); + let err = validate_team_catalog_envelope(&ev).unwrap_err(); + assert!(err.contains("at most one"), "got: {err}"); + } + + #[test] + fn team_catalog_is_in_scope_allowlist() { + let dummy = make_dummy_event(); + assert_eq!( + required_scope_for_kind(KIND_TEAM_CATALOG, &dummy).unwrap(), + Scope::UsersWrite, + ); + } + + #[test] + fn team_catalog_is_global_only() { + assert!(is_global_only_kind(KIND_TEAM_CATALOG)); + assert!(!requires_h_channel_scope(KIND_TEAM_CATALOG)); + } + // ─── agent_turn_metric envelope tests ──────────────────────────────────── /// Build an event for kind:44200 with the given tags and content. diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs index 51400452d7..35fbf0c892 100644 --- a/crates/buzz-relay/src/handlers/req.rs +++ b/crates/buzz-relay/src/handlers/req.rs @@ -7,8 +7,8 @@ use tracing::{debug, warn}; use buzz_core::filter::filters_match; use buzz_core::kind::{ - is_unshared_persona_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_AGENT_TURN_METRIC, - KIND_DM_VISIBILITY, KIND_PERSONA, P_GATED_KINDS, RESULT_GATED_KINDS, + is_unshared_gated_event, AUTHOR_ONLY_KINDS, KIND_AGENT_ENGRAM, KIND_AGENT_TURN_METRIC, + KIND_DM_VISIBILITY, P_GATED_KINDS, RESULT_GATED_KINDS, SHARED_GATED_KINDS, }; use buzz_core::tenant::TenantContext; use buzz_db::EventQuery; @@ -290,11 +290,11 @@ pub async fn handle_req( let mut params = filter_to_query_params(filter, per_filter_channel, conn.tenant.community()); apply_access_scope_to_query(&mut params, per_filter_channel, &accessible_channels); - // Persona visibility pushdown: set reader bytes so query_events appends - // the SQL visibility clause before ORDER/LIMIT, preventing newer private - // personas from starving older shared ones off the page. - if filter_can_match_persona_shared_kinds(filter) { - params.persona_reader = Some(pubkey_bytes.clone()); + // Shared-gated visibility pushdown: set reader bytes so query_events + // appends the SQL visibility clause before ORDER/LIMIT, preventing + // newer private events from starving older shared ones off the page. + if filter_can_match_shared_gated_kinds(filter) { + params.shared_gated_reader = Some(pubkey_bytes.clone()); } (idx, per_filter_channel, params) }) @@ -1137,19 +1137,20 @@ pub(crate) fn filter_can_match_author_only_kinds(filter: &Filter) -> bool { }) } -/// Returns `true` if the filter CAN match kind 30175 (persona) — meaning it -/// either has no `kinds` constraint (wildcard) or explicitly includes 30175. +/// Returns `true` if the filter CAN match any kind in [`SHARED_GATED_KINDS`] — +/// meaning it either has no `kinds` constraint (wildcard) or explicitly includes +/// one of them. /// /// Used by the COUNT handler to force the per-event fallback path, which calls -/// `is_unshared_persona_event` on each row. The fast SQL `count_events()` path +/// `is_unshared_gated_event` on each row. The fast SQL `count_events()` path /// has no per-event access check, so it would over-count foreign unshared -/// persona events — leaking the existence of persona activity even without -/// returning content. -pub(crate) fn filter_can_match_persona_shared_kinds(filter: &Filter) -> bool { - filter - .kinds - .as_ref() - .is_none_or(|ks| ks.iter().any(|k| k.as_u16() as u32 == KIND_PERSONA)) +/// events — leaking the existence of private persona/team-catalog activity even +/// without returning content. +pub(crate) fn filter_can_match_shared_gated_kinds(filter: &Filter) -> bool { + filter.kinds.as_ref().is_none_or(|ks| { + ks.iter() + .any(|k| SHARED_GATED_KINDS.contains(&(k.as_u16() as u32))) + }) } /// Returns `true` if the filter CAN match result-gated kinds — meaning it @@ -1208,8 +1209,9 @@ pub(crate) fn is_author_only_event(event: &nostr::Event, requester_pubkey_bytes: /// /// 1. **Author-only kinds** (`AUTHOR_ONLY_KINDS`, e.g. kind 30300/30350): only /// the author may read their own events. -/// 2. **Persona shared-gate** (kind 30175 without `["shared","true"]`): the -/// event is only visible to the author unless explicitly opted into sharing. +/// 2. **Shared-gate** (`SHARED_GATED_KINDS`, e.g. kind 30175/30178 without +/// `["shared","true"]`): the event is only visible to the author unless +/// explicitly opted into sharing. /// 3. **Result-gated kinds** (kind 44200/30622 etc.): `reader_authorized_for_event` /// carries the per-event ownership check. /// @@ -1223,7 +1225,7 @@ pub(crate) fn event_visible_to_reader(event: &nostr::Event, requester_pubkey_byt if is_author_only_event(event, requester_pubkey_bytes) { return false; } - if is_unshared_persona_event(event, requester_pubkey_bytes) { + if is_unshared_gated_event(event, requester_pubkey_bytes) { return false; } let requester_pubkey_hex = hex::encode(requester_pubkey_bytes); diff --git a/crates/buzz-test-client/tests/e2e_persona.rs b/crates/buzz-test-client/tests/e2e_persona.rs index b3b1f7f6b2..4f37e22e16 100644 --- a/crates/buzz-test-client/tests/e2e_persona.rs +++ b/crates/buzz-test-client/tests/e2e_persona.rs @@ -1324,7 +1324,7 @@ async fn test_persona_http_query_cross_author_gate() { /// /// A foreign authenticated caller counting `{kinds:[30175],authors:[victim]}` /// must count only shared heads — not unshared ones — on both the fast SQL -/// path (prevented by `needs_persona_filtering`) and the fallback path. +/// path (prevented by `needs_shared_gate_filtering`) and the fallback path. #[tokio::test] #[ignore] async fn test_persona_http_count_cross_author_gate() { @@ -1403,7 +1403,7 @@ async fn test_persona_http_count_cross_author_gate() { /// event is returned. /// /// Verifies at `312014d5e`: this test fails there because `query_events` did -/// not have the `persona_reader` SQL clause and the private rows starved the +/// not have the `shared_gated_reader` SQL clause and the private rows starved the /// shared one off the page. #[tokio::test] #[ignore] diff --git a/crates/buzz-test-client/tests/e2e_team_catalog.rs b/crates/buzz-test-client/tests/e2e_team_catalog.rs new file mode 100644 index 0000000000..ce313d1fe9 --- /dev/null +++ b/crates/buzz-test-client/tests/e2e_team_catalog.rs @@ -0,0 +1,484 @@ +//! End-to-end tests for kind:30178 team-catalog events (NIP-AP). +//! +//! Kind 30178 is the shareable projection of a team. It joins kind:30175 in +//! `SHARED_GATED_KINDS`, so these tests assert the wire behaviour of that gate +//! at every read chokepoint (REQ, `ids` lookup, COUNT, live fan-out) plus the +//! ingest envelope rules that make the gate sound: +//! - Exactly one non-empty, bounded `d` tag — the team's stable local id, which +//! may contain a colon (`builtin-team:welcome`) unlike a persona slug. +//! - `shared`, if present, is exactly `["shared", "true"]`. +//! +//! # Running +//! +//! Start the relay, then run: +//! +//! ```text +//! RELAY_URL=ws://localhost:3000 cargo test --test e2e_team_catalog -- --ignored +//! ``` + +use std::time::Duration; + +use buzz_test_client::{BuzzTestClient, RelayMessage}; +use nostr::{Alphabet, EventBuilder, Filter, Keys, Kind, SingleLetterTag, Tag, Timestamp}; + +const TEAM_CATALOG_KIND: u16 = 30178; + +fn relay_url() -> String { + std::env::var("RELAY_URL").unwrap_or_else(|_| "ws://localhost:3000".to_string()) +} + +fn sub_id(name: &str) -> String { + format!("e2e-team-catalog-{name}-{}", uuid::Uuid::new_v4()) +} + +fn catalog_content(name: &str) -> String { + serde_json::json!({ "v": 1, "name": name, "members": [] }).to_string() +} + +/// Build a kind:30178 event, optionally carrying the `["shared","true"]` opt-in. +fn catalog_event(keys: &Keys, d_tag: &str, shared: bool) -> nostr::Event { + catalog_event_at(keys, d_tag, shared, Timestamp::now().as_secs()) +} + +/// Same as [`catalog_event`] with an explicit `created_at`, so NIP-33 head +/// ordering is deterministic instead of resolved by event-id tie-break. +fn catalog_event_at(keys: &Keys, d_tag: &str, shared: bool, created_at: u64) -> nostr::Event { + let mut tags = vec![Tag::parse(["d", d_tag]).unwrap()]; + if shared { + tags.push(Tag::parse(["shared", "true"]).unwrap()); + } + EventBuilder::new( + Kind::Custom(TEAM_CATALOG_KIND), + catalog_content("Test Team"), + ) + .tags(tags) + .custom_created_at(Timestamp::from(created_at)) + .sign_with_keys(keys) + .unwrap() +} + +fn author_filter(author: &Keys) -> Filter { + Filter::new() + .kind(Kind::Custom(TEAM_CATALOG_KIND)) + .author(author.public_key()) +} + +fn coordinate_filter(author: &Keys, d_tag: &str) -> Filter { + author_filter(author).custom_tags(SingleLetterTag::lowercase(Alphabet::D), [d_tag]) +} + +fn d_tag_of(event: &nostr::Event) -> Option<&str> { + event.tags.iter().find_map(|t| { + let parts = t.as_slice(); + if parts.first().map(|p| p.as_str()) != Some("d") { + return None; + } + Some(parts.get(1)?.as_str()) + }) +} + +/// The author's own unshared projection round-trips at its NIP-33 coordinate. +/// +/// The `d` tag is a UUID, matching the desktop team id — proof the envelope does +/// NOT apply the persona slug grammar. +#[tokio::test] +#[ignore] +async fn test_team_catalog_publish_and_query_own_unshared() { + let url = relay_url(); + let keys = Keys::generate(); + let d_tag = uuid::Uuid::new_v4().to_string(); + + let mut client = BuzzTestClient::connect(&url, &keys).await.expect("connect"); + let event = catalog_event(&keys, &d_tag, false); + let event_id = event.id; + let ok = client.send_event(event).await.expect("send catalog"); + assert!(ok.accepted, "relay rejected catalog event: {}", ok.message); + + let sid = sub_id("own-unshared"); + client + .subscribe(&sid, vec![coordinate_filter(&keys, &d_tag)]) + .await + .expect("subscribe"); + let events = client + .collect_until_eose(&sid, Duration::from_secs(5)) + .await + .expect("collect"); + + assert_eq!(events.len(), 1, "author must see own unshared projection"); + assert_eq!(events[0].id, event_id); + + client.disconnect().await.expect("disconnect"); +} + +/// A built-in team id (`builtin-team:welcome`) is accepted as the `d` tag. +/// +/// The colon is illegal in a persona slug; rewriting the id to fit would break +/// NIP-33 addressing against the team's own kind:30176 head. +#[tokio::test] +#[ignore] +async fn test_team_catalog_accepts_builtin_colon_d_tag() { + let url = relay_url(); + let keys = Keys::generate(); + let d_tag = format!("builtin-team:{}", &uuid::Uuid::new_v4().to_string()[..8]); + + let mut client = BuzzTestClient::connect(&url, &keys).await.expect("connect"); + let ok = client + .send_event(catalog_event(&keys, &d_tag, true)) + .await + .expect("send catalog"); + assert!( + ok.accepted, + "relay rejected colon-bearing team id: {}", + ok.message + ); + + client.disconnect().await.expect("disconnect"); +} + +/// Ingest refuses an empty `d` tag: generic NIP-33 storage maps it to the empty +/// coordinate, collapsing every team into one `(pubkey, 30178, "")` slot. +#[tokio::test] +#[ignore] +async fn test_team_catalog_rejects_empty_d_tag() { + let url = relay_url(); + let keys = Keys::generate(); + + let mut client = BuzzTestClient::connect(&url, &keys).await.expect("connect"); + let ok = client + .send_event(catalog_event(&keys, "", false)) + .await + .expect("send catalog"); + assert!(!ok.accepted, "empty d-tag must be rejected"); + assert!( + ok.message.contains("invalid:"), + "expected an `invalid:` refusal, got: {}", + ok.message + ); + + client.disconnect().await.expect("disconnect"); +} + +/// Ingest refuses a valueless `["d"]` tag alongside a valued one. Counting only +/// tags that carry a value would see exactly one `d` here and accept the event; +/// a NIP-33 consumer that reads `["d"]` as an empty-valued first `d` tag would +/// then address the event at `""` where this relay addresses it at the team id. +#[tokio::test] +#[ignore] +async fn test_team_catalog_rejects_valueless_plus_valued_d_tags() { + let url = relay_url(); + let keys = Keys::generate(); + let d_tag = uuid::Uuid::new_v4().to_string(); + + let event = EventBuilder::new( + Kind::Custom(TEAM_CATALOG_KIND), + catalog_content("Two d tags"), + ) + .tags(vec![ + Tag::parse(["d"]).unwrap(), + Tag::parse(["d", d_tag.as_str()]).unwrap(), + ]) + .sign_with_keys(&keys) + .unwrap(); + + let mut client = BuzzTestClient::connect(&url, &keys).await.expect("connect"); + let ok = client.send_event(event).await.expect("send catalog"); + assert!( + !ok.accepted, + "a valueless `d` tag must count toward the exactly-one rule" + ); + assert!( + ok.message.contains("invalid:"), + "expected an `invalid:` refusal, got: {}", + ok.message + ); + + client.disconnect().await.expect("disconnect"); +} + +/// Ingest refuses a malformed `shared` tag. A three-element tag would satisfy +/// the SQL containment clause `tags @> '[["shared","true"]]'` as a superset +/// while the in-process gate reads it as unshared — the two layers must agree, +/// so such an event can never be stored. +#[tokio::test] +#[ignore] +async fn test_team_catalog_rejects_three_element_shared_tag() { + let url = relay_url(); + let keys = Keys::generate(); + let d_tag = uuid::Uuid::new_v4().to_string(); + + let event = EventBuilder::new( + Kind::Custom(TEAM_CATALOG_KIND), + catalog_content("Malformed"), + ) + .tags(vec![ + Tag::parse(["d", d_tag.as_str()]).unwrap(), + Tag::parse(["shared", "true", "extra"]).unwrap(), + ]) + .sign_with_keys(&keys) + .unwrap(); + + let mut client = BuzzTestClient::connect(&url, &keys).await.expect("connect"); + let ok = client.send_event(event).await.expect("send catalog"); + assert!(!ok.accepted, "three-element shared tag must be rejected"); + assert!( + ok.message.contains("invalid:"), + "expected an `invalid:` refusal, got: {}", + ok.message + ); + + client.disconnect().await.expect("disconnect"); +} + +/// REQ historical delivery: a foreign reader receives only shared projections, +/// while the author receives both of their own. +#[tokio::test] +#[ignore] +async fn test_team_catalog_foreign_sees_only_shared() { + let url = relay_url(); + let author_keys = Keys::generate(); + let foreign_keys = Keys::generate(); + + let d_unshared = format!("priv-{}", uuid::Uuid::new_v4()); + let d_shared = format!("pub-{}", uuid::Uuid::new_v4()); + + let mut author = BuzzTestClient::connect(&url, &author_keys) + .await + .expect("connect author"); + let shared_event = catalog_event(&author_keys, &d_shared, true); + let shared_id = shared_event.id; + let ok = author + .send_event(catalog_event(&author_keys, &d_unshared, false)) + .await + .expect("send unshared"); + assert!(ok.accepted, "unshared ingest rejected: {}", ok.message); + let ok = author.send_event(shared_event).await.expect("send shared"); + assert!(ok.accepted, "shared ingest rejected: {}", ok.message); + + let mut foreign = BuzzTestClient::connect(&url, &foreign_keys) + .await + .expect("connect foreign"); + let sid = sub_id("fg-all"); + foreign + .subscribe(&sid, vec![author_filter(&author_keys)]) + .await + .expect("subscribe"); + let events = foreign + .collect_until_eose(&sid, Duration::from_secs(5)) + .await + .expect("collect"); + + assert!( + !events + .iter() + .any(|e| d_tag_of(e) == Some(d_unshared.as_str())), + "foreign reader must NOT see the unshared projection" + ); + assert!( + events.iter().any(|e| e.id == shared_id), + "foreign reader must see the shared projection" + ); + + let sid_author = sub_id("auth-all"); + author + .subscribe(&sid_author, vec![author_filter(&author_keys)]) + .await + .expect("subscribe author"); + let author_events = author + .collect_until_eose(&sid_author, Duration::from_secs(5)) + .await + .expect("collect author"); + assert!( + author_events.len() >= 2, + "author must see both own projections, got {}", + author_events.len() + ); + + author.disconnect().await.expect("disconnect author"); + foreign.disconnect().await.expect("disconnect foreign"); +} + +/// Knowing an event id does NOT grant access: `{ids:[unshared]}` returns nothing +/// to a foreign reader. +#[tokio::test] +#[ignore] +async fn test_team_catalog_ids_lookup_unshared_returns_nothing_to_foreign() { + let url = relay_url(); + let author_keys = Keys::generate(); + let foreign_keys = Keys::generate(); + + let event = catalog_event(&author_keys, &uuid::Uuid::new_v4().to_string(), false); + let event_id = event.id; + + let mut author = BuzzTestClient::connect(&url, &author_keys) + .await + .expect("connect author"); + let ok = author.send_event(event).await.expect("send"); + assert!(ok.accepted, "ingest rejected: {}", ok.message); + author.disconnect().await.expect("disconnect author"); + + let mut foreign = BuzzTestClient::connect(&url, &foreign_keys) + .await + .expect("connect foreign"); + let sid = sub_id("ids-unshared"); + foreign + .subscribe(&sid, vec![Filter::new().id(event_id)]) + .await + .expect("subscribe"); + let events = foreign + .collect_until_eose(&sid, Duration::from_secs(5)) + .await + .expect("collect"); + + assert!( + events.is_empty(), + "ids-lookup of an unshared projection must return nothing, got {:?}", + events.iter().map(|e| e.id).collect::>() + ); + + foreign.disconnect().await.expect("disconnect foreign"); +} + +/// COUNT must take the per-event fallback for kind:30178 so the aggregate does +/// not leak the existence of unshared projections. +#[tokio::test] +#[ignore] +async fn test_team_catalog_count_excludes_foreign_unshared() { + let url = relay_url(); + let author_keys = Keys::generate(); + let foreign_keys = Keys::generate(); + + let mut author = BuzzTestClient::connect(&url, &author_keys) + .await + .expect("connect author"); + let ok = author + .send_event(catalog_event( + &author_keys, + &uuid::Uuid::new_v4().to_string(), + false, + )) + .await + .expect("send unshared"); + assert!(ok.accepted, "unshared rejected: {}", ok.message); + let ok = author + .send_event(catalog_event( + &author_keys, + &uuid::Uuid::new_v4().to_string(), + true, + )) + .await + .expect("send shared"); + assert!(ok.accepted, "shared rejected: {}", ok.message); + author.disconnect().await.expect("disconnect author"); + + let mut foreign = BuzzTestClient::connect(&url, &foreign_keys) + .await + .expect("connect foreign"); + let sid = sub_id("count"); + let count_msg = serde_json::json!(["COUNT", sid, author_filter(&author_keys)]); + foreign.send_raw(&count_msg).await.expect("send COUNT"); + + let count = match foreign.recv_event(Duration::from_secs(5)).await { + Ok(RelayMessage::Count { count, .. }) => count, + Ok(RelayMessage::Closed { message, .. }) => panic!("COUNT closed unexpectedly: {message}"), + Ok(other) => panic!("unexpected relay message for COUNT: {other:?}"), + Err(e) => panic!("unexpected error for COUNT: {e}"), + }; + assert_eq!( + count, 1, + "foreign COUNT must see only the shared projection, got {count}" + ); + + foreign.disconnect().await.expect("disconnect foreign"); +} + +/// Live fan-out honours the gate, and unsharing (a NIP-33 replacement that drops +/// the `shared` tag) retracts the projection from foreign readers. +#[tokio::test] +#[ignore] +async fn test_team_catalog_live_fanout_and_unshare_retracts() { + let url = relay_url(); + let author_keys = Keys::generate(); + let foreign_keys = Keys::generate(); + + let d_tag = uuid::Uuid::new_v4().to_string(); + let now = Timestamp::now().as_secs(); + let (t0, t1, t2) = (now.saturating_sub(2), now.saturating_sub(1), now); + + // Subscribe BEFORE publishing, scoped to this author so parallel tests + // publishing their own 30178s cannot trip the leak assertion. + let mut foreign = BuzzTestClient::connect(&url, &foreign_keys) + .await + .expect("connect foreign"); + let sid = sub_id("fanout"); + foreign + .subscribe(&sid, vec![author_filter(&author_keys)]) + .await + .expect("subscribe"); + let _ = foreign + .collect_until_eose(&sid, Duration::from_secs(5)) + .await + .expect("drain eose"); + + let mut author = BuzzTestClient::connect(&url, &author_keys) + .await + .expect("connect author"); + + // Unshared publish must NOT reach the foreign connection. + let ok = author + .send_event(catalog_event_at(&author_keys, &d_tag, false, t0)) + .await + .expect("send unshared"); + assert!(ok.accepted, "unshared rejected: {}", ok.message); + match foreign.recv_event(Duration::from_millis(750)).await { + Err(buzz_test_client::TestClientError::Timeout) => {} + Ok(RelayMessage::Event { event, .. }) if event.kind == Kind::Custom(TEAM_CATALOG_KIND) => { + panic!("unshared projection leaked to foreign live subscription"); + } + Ok(_) => {} + Err(e) => panic!("unexpected error awaiting fan-out: {e}"), + } + + // Shared replacement MUST reach it. + let shared_event = catalog_event_at(&author_keys, &d_tag, true, t1); + let shared_id = shared_event.id; + let ok = author.send_event(shared_event).await.expect("send shared"); + assert!(ok.accepted, "shared rejected: {}", ok.message); + let delivered = loop { + match foreign.recv_event(Duration::from_secs(5)).await { + Ok(RelayMessage::Event { event, .. }) if event.id == shared_id => break true, + Ok(_) => continue, + Err(buzz_test_client::TestClientError::Timeout) => break false, + Err(e) => panic!("unexpected error awaiting shared fan-out: {e}"), + } + }; + assert!( + delivered, + "shared projection must fan out to foreign readers" + ); + + // Unshare: replace at the same coordinate without the tag. Subsequent + // foreign REQs must return nothing. + let ok = author + .send_event(catalog_event_at(&author_keys, &d_tag, false, t2)) + .await + .expect("send unshare"); + assert!(ok.accepted, "unshare rejected: {}", ok.message); + + let sid_post = sub_id("post-unshare"); + foreign + .subscribe(&sid_post, vec![coordinate_filter(&author_keys, &d_tag)]) + .await + .expect("subscribe post"); + let after = foreign + .collect_until_eose(&sid_post, Duration::from_secs(5)) + .await + .expect("collect post"); + assert!( + after.is_empty(), + "unsharing must retract the projection from foreign readers, got {} event(s)", + after.len() + ); + + author.disconnect().await.expect("disconnect author"); + foreign.disconnect().await.expect("disconnect foreign"); +} diff --git a/desktop/src-tauri/src/commands/personas/pending.rs b/desktop/src-tauri/src/commands/personas/pending.rs index a4003329bc..cab5fababc 100644 --- a/desktop/src-tauri/src/commands/personas/pending.rs +++ b/desktop/src-tauri/src/commands/personas/pending.rs @@ -75,11 +75,11 @@ pub(super) fn prepare_persona_publication( } fn retained_persona_is_shared(row: Option<&RetainedEvent>) -> bool { - use buzz_core_pkg::kind::persona_event_is_shared; + use buzz_core_pkg::kind::event_is_shared; use nostr::JsonUtil; row.and_then(|retained| nostr::Event::from_json(&retained.raw_event).ok()) - .is_some_and(|event| persona_event_is_shared(&event)) + .is_some_and(|event| event_is_shared(&event)) } /// Project each persona's catalog visibility from the active relay+owner diff --git a/desktop/src-tauri/src/event_sync.rs b/desktop/src-tauri/src/event_sync.rs index d9fe6acdb9..ee8e0d8b10 100644 --- a/desktop/src-tauri/src/event_sync.rs +++ b/desktop/src-tauri/src/event_sync.rs @@ -165,7 +165,7 @@ fn migrate_personas_in_dir_at( scoped_record.shared = existing .as_ref() .and_then(|row| nostr::Event::from_json(&row.raw_event).ok()) - .is_some_and(|event| buzz_core_pkg::kind::persona_event_is_shared(&event)); + .is_some_and(|event| buzz_core_pkg::kind::event_is_shared(&event)); let event = build_persona_event(&scoped_record) .map_err(|e| format!("failed to build event for '{}': {e}", record.display_name))? .custom_created_at(monotonic_created_at( diff --git a/desktop/src-tauri/src/managed_agents/persona_events.rs b/desktop/src-tauri/src/managed_agents/persona_events.rs index ea61a811db..6afc18a501 100644 --- a/desktop/src-tauri/src/managed_agents/persona_events.rs +++ b/desktop/src-tauri/src/managed_agents/persona_events.rs @@ -5,7 +5,7 @@ use std::collections::BTreeMap; -use buzz_core_pkg::kind::{persona_event_is_shared, KIND_PERSONA}; +use buzz_core_pkg::kind::{event_is_shared, KIND_PERSONA}; use nostr::{EventBuilder, Kind, Tag}; use serde::{Deserialize, Serialize}; @@ -192,7 +192,7 @@ pub fn persona_from_event(event: &nostr::Event) -> Result:`. Unsharing is distinct from deletion — it is a newer valid head at the same coordinate published *without* the `shared` tag, which keeps the projection readable to its author while retracting it from foreign readers. + ## Relationships to other NIPs ### NIP-AE (Agent Engrams) @@ -216,6 +218,29 @@ surface per-event errors. Agents spawned from a persona carry [NIP-OA](NIP-OA.md) owner attestation — an `auth` tag proving that `pubkey_o` authorized the agent's key. The persona event itself does not contain attestation; it is the *definition* from which attestation is issued at spawn time. +## Team catalog projection: kind:30178 + +Kind `30178` is the **shareable projection of a team**: owner-authored, parameterized replaceable, addressed by `(pubkey_o, 30178, d)` where `d` is the team's stable local id. Its `content` is a versioned JSON body carrying sanitized team fields plus ordered, *embedded* member definition projections. The content schema is defined by the client that publishes it; this section specifies only the envelope and the relay's contract. + +```jsonc +{ + "kind": 30178, + "pubkey": "", + "created_at": , + "tags": [ + ["d", ""], + ["shared", "true"] // optional; presence opts the projection into community reads + ], + "content": "" +} +``` + +**Why a separate kind rather than a `shared` tag on the team event (kind:30176).** A team's members are `kind:30175` definitions, which are author-only unless individually shared — so a foreign reader of a shared team could never hydrate its members. Kind `30178` embeds the member projections instead of referencing them: the share is atomic, it covers built-in members that have no `30175` head at all, it is immune to local-id/`d`-tag divergence, and an unshared `30175` stays private. Kind `30176`'s wire body is untouched, so device sync keeps its contract. + +**The `d` tag is a team id, not a persona slug.** It is either a UUID or a built-in identifier such as `builtin-team:welcome`. The colon is illegal under the persona slug grammar, and rewriting ids to fit would break NIP-33 addressing against the team's own `kind:30176` head — so the relay applies a laxer rule (see below) to `30178` than to `30175`. + +**Content carries only sanitized fields.** No environment variables, no `respond_to` allowlist pubkeys, no source or local ids, no filesystem paths, no secrets. Sharing a team makes the team's and every member's instructions community-readable plaintext. + ## Relay behavior ### Ingest validation @@ -226,10 +251,20 @@ Agents spawned from a persona carry [NIP-OA](NIP-OA.md) owner attestation — an - The relay MUST enforce that the `d` tag is non-empty (standard NIP-33 requirement for parameterized replaceable events). - The relay MUST enforce shared-tag shape: if a `shared` tag is present, it MUST consist of **exactly two elements** — `["shared", "true"]`. Extra elements (e.g. `["shared","true","extra"]`), wrong values (`["shared","false"]`), missing values (`["shared"]`), or duplicate `shared` tags are all rejected with `invalid:`. The two-element exact-shape constraint is required so that the relay's SQL visibility clause (`tags @> '[["shared","true"]]'`) never matches a stored malformed tag via JSONB containment supersets. +### Ingest validation: kind:30178 + +Kind `30178` is stored globally and its content is unvalidated, exactly as for `30175`. The envelope rules differ in one respect — the `d` grammar: + +- The relay MUST enforce the same `shared`-tag exact shape as `30175`, for the same reason: the read gate and the SQL containment clause must agree on every stored event. +- The relay MUST enforce **exactly one** `d` tag whose value is non-empty, at most 64 characters, and free of Unicode control characters and whitespace. Tags are counted by their first element, so a valueless `["d"]` counts toward the total and fails the value check on its own — otherwise `["d"]` alongside `["d",""]` would pass, and a consumer that reads `["d"]` as an empty-valued first `d` tag would address the event at `""` while this relay addresses it at ``. Without the non-empty check, generic NIP-33 storage maps a missing or empty `d` to the empty coordinate, collapsing every team into the single `(pubkey_o, 30178, "")` slot — last-write-wins data loss. The character bound keeps the value usable as a NIP-33 coordinate and as a log field. +- The relay MUST NOT apply the persona slug grammar to a `30178` `d` tag; team ids legitimately contain characters (notably `:`) that the slug grammar forbids. + ### Access control: author-only-unless-shared Kind `30175` uses **shared-tag-gated read semantics** to protect system prompts and `respond_to_allowlist` from being visible to all community members as a side-effect of device sync. +The gate is kind-generic: the relay applies it to every kind in `SHARED_GATED_KINDS` (`buzz-core/src/kind.rs`), currently `30175` and the `30178` team-catalog projection described below. The rules and enforcement surfaces are identical for each member kind. + **Rules:** | Event state | Author reads | Foreign reads | @@ -239,13 +274,13 @@ Kind `30175` uses **shared-tag-gated read semantics** to protect system prompts These rules are enforced at the following relay read surfaces (content and event existence are withheld on all of them): -- **REQ historical delivery** — foreign requests silently omit unshared persona events, even in mixed-kind filters (`{kinds:[30175,9]}`). The visibility check is applied **before `ORDER BY … LIMIT`** at the SQL level (`persona_reader` field in `EventQuery`), so a page of newer private personas cannot starve an older shared persona off the candidate set — the catalog's primary all-author query pattern is correctly served. +- **REQ historical delivery** — foreign requests silently omit unshared persona events, even in mixed-kind filters (`{kinds:[30175,9]}`). The visibility check is applied **before `ORDER BY … LIMIT`** at the SQL level (`shared_gated_reader` field in `EventQuery`), so a page of newer private personas cannot starve an older shared persona off the candidate set — the catalog's primary all-author query pattern is correctly served. - **NIP-01 `ids` lookup** — knowing an event id does NOT grant access to an unshared persona. The result gate returns nothing. - **Live fan-out** — unshared personas are delivered only to the author's connections. Shared personas fan out community-wide. -- **COUNT** — the fast SQL `count_events()` path is bypassed when the filter can match `kind:30175`. A per-event fallback applies the shared-tag check, preventing existence-leak via COUNT. -- **NIP-98 HTTP bridge `/query`** — the same per-event visibility check is applied to the catchall post-processing loop. The SQL-level `persona_reader` clause also applies before `LIMIT`, preventing older shared personas from being starved by newer private ones on paginated catalog queries. A foreign caller POSTing `{kinds:[30175],authors:[victim]}` or a kindless `{ids:[...]}` filter to `/query` receives no unshared persona content. -- **NIP-98 HTTP bridge `/count`** — `needs_persona_filtering` forces the per-event fallback path for any filter that can match `kind:30175`; the fast SQL `count_events()` path is not used. Both the channel-scoped and unconstrained fallback loops apply `event_visible_to_reader`, preventing existence-leak via COUNT over HTTP. -- **FTS (NIP-50 search) and `/search`** — kind `30175` is not in the relay's FTS allowlist (migration 8 indexes only kinds `0, 9, 40002, 45001, 45003`); no FTS result can contain an unshared persona. A defense-in-depth check is also present in the bridge search result loop so that a future FTS allowlist change cannot silently reopen the bypass. +- **COUNT** — the fast SQL `count_events()` path is bypassed when the filter can match a shared-gated kind. A per-event fallback applies the shared-tag check, preventing existence-leak via COUNT. +- **NIP-98 HTTP bridge `/query`** — the same per-event visibility check is applied to the catchall post-processing loop. The SQL-level `shared_gated_reader` clause also applies before `LIMIT`, preventing older shared personas from being starved by newer private ones on paginated catalog queries. A foreign caller POSTing `{kinds:[30175],authors:[victim]}` or a kindless `{ids:[...]}` filter to `/query` receives no unshared persona content. +- **NIP-98 HTTP bridge `/count`** — `needs_shared_gate_filtering` forces the per-event fallback path for any filter that can match a shared-gated kind; the fast SQL `count_events()` path is not used. Both the channel-scoped and unconstrained fallback loops apply `event_visible_to_reader`, preventing existence-leak via COUNT over HTTP. +- **FTS (NIP-50 search) and `/search`** — no shared-gated kind is in the relay's FTS allowlist (migration 8 indexes only kinds `0, 9, 40002, 45001, 45003`); no FTS result can contain an unshared event. A defense-in-depth check is also present in the bridge search result loop so that a future FTS allowlist change cannot silently reopen the bypass. **Device sync is unaffected.** The sync subscription (`{kinds:[30175], authors:[self]}`) reads the author's own events, which are always returned regardless of shared state. @@ -263,6 +298,7 @@ These rules are enforced at the following relay read surfaces (content and event - **Slug collision across pubkeys.** Two different owners can publish personas with the same slug. Clients MUST always scope queries by author pubkey, not just slug. - **Metadata exposure.** The `(pubkey, kind:30175, slug)` triple reveals persona existence. Event timestamps reveal edit history. - **No owner write authority over agents.** Persona events define *what* an agent should be; they do not grant runtime control over a running agent. The agent consumes the persona at spawn time. Updates to the persona event do not automatically propagate to running agents. +- **Sharing a team shares every member's instructions.** A `kind:30178` head carrying `["shared","true"]` exposes the team's own fields *and* the embedded projection of every member — including members whose own `kind:30175` heads are unshared and therefore still private. Clients MUST make this explicit at the point of sharing; the relay cannot infer it. ## Reference test vectors From 29dfe4821ed577489a1879fd2a9bfe2a621a52b3 Mon Sep 17 00:00:00 2001 From: Sumit Madan <33051892+sumit-m@users.noreply.github.com> Date: Fri, 31 Jul 2026 03:30:22 +0530 Subject: [PATCH 092/112] fix(desktop): don't gate hover affordances on the hover media query (#3657) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What problem this solves Tailwind v4 compiles every `hover:` variant inside `@media (hover: hover)`. Some Windows hosts answer that query `false` **even with a mouse attached**, and then every hover-revealed control in the app is permanently `visibility: hidden`. Measured in the app's own WebView2 devtools console, on a mouse-driven Windows 11 desktop: ```js matchMedia('(hover: hover)').matches // false matchMedia('(any-hover: hover)').matches // false matchMedia('(pointer: fine)').matches // false matchMedia('(any-pointer: fine)').matches // false navigator.maxTouchPoints // 10 ``` Windows itself, on the same machine at the same moment, reports a mouse present and an integrated digitizer: ``` GetSystemMetrics(SM_DIGITIZER) = 197 // INTEGRATED_TOUCH | INTEGRATED_PEN // | MULTI_INPUT | READY GetSystemMetrics(SM_MAXIMUMTOUCHES) = 10 SystemInformation.MousePresent = True ``` So this is not "the user has no mouse". Windows knows a mouse is attached, and Chromium still reports `any-pointer: fine: false` and `any-hover: false` — the `any-*` queries exist precisely to describe *any* available input device, and they are wrong here. The presence of an integrated touch digitizer collapses the reported capability to touch-only. The compiled rule that never applies: ```css .group-hover\/member\:visible { &:is(:where(.group\/member):hover *) { @media (hover: hover) { visibility: visible; } } } ``` The row genuinely matches `:hover` (verified: `row.matches(':hover') === true`), the button is in the DOM, the utility class is generated — and the declaration still never lands. ## Why this is more than one control Not a single menu. Confirmed newly-ungated in the production bundle after the change: | utility | media-gated before | after | |---|---|---| | `group-hover/member:visible` | yes | no | | `group-hover/inbox-item:opacity-100` | yes | no | | `group-hover/channel-row:opacity-100` | yes | no | | `group-hover/attachment:opacity-100` | yes | no | | `hover:bg-muted` | yes | no | On an affected host the channel-member action menu (remove member, change role, start/stop agent) has **no reachable affordance at all**: `visibility: hidden` also removes the button from tab order, so there is no keyboard path either. ## The fix One line, at the root, next to the existing variant override: ```css @custom-variant hover (&:hover); ``` This trusts the actual hover event rather than the capability query. Chromium only fires `:hover` when a real pointer is present, so behaviour on hosts that report the capability correctly is unchanged. Verified against a production `vite build`, not just the dev server — the override cascades to the *named* group variants (`group-hover/member`, etc.), which is the part that matters here. ## Prior art in this repo #2849 overrides Tailwind v4's `dark:` variant default at the *exact same insertion point* in this file, for the same class of reason (a v4 default that does not match how this app actually works). This change follows that precedent. **Note for whoever merges second: #2849 and this PR will conflict textually** — both append a `@custom-variant` immediately after `@config`. The resolution is to keep both lines; they are independent. ## Scope Desktop only. `web/src/shared/styles/globals.css` has the same Tailwind v4 default, but `web/src` contains **zero** `group-hover` usages, so there are no hover-revealed affordances to strand there. Adding the override to web would be speculative. One `hover` capability query is deliberately left in place — `.buzz-wave-hover-trigger` in `animations.css` gates a decorative wave-hand animation on `(hover: hover) and (pointer: fine)`. That is a cosmetic flourish rather than an affordance, so it stays inert on affected hosts instead of widening this diff. ## Reproducing The trigger is **an integrated touch digitizer anywhere on the machine**, not the display you are actually working on. This was found on a touch-capable laptop docked to an ordinary non-touch external monitor, driven entirely by a mouse — so "I'm on a desktop monitor" does not rule you out. Check with: ```js matchMedia('(hover: hover)').matches // false ⇒ affected ``` Not reproducible on macOS, or on a Windows machine with no digitizer at all — `hover: hover` is true there and every affordance works normally. If you are on such a host, emulate it in devtools by forcing `hover: none` / `pointer: coarse`, then open a channel's member list and hover a row: no action menu appears. ## Tradeoff worth naming On a genuine touch-only device, a bare `&:hover` can latch after a tap and stay applied until the next interaction, where the media-query default would have suppressed it. That is the real cost of this change. The judgement here is that a stuck hover style is a cosmetic annoyance, while an unreachable "remove member" button is a functional dead end — and that the affected hosts are overwhelmingly mouse-driven machines that merely *happen* to ship a digitizer, as the `MousePresent = True` reading above shows. If you would rather scope this to `@media not (hover: hover)` as an additive fallback instead of overriding the variant, I am happy to rework it. Signed-off-by: sumit-m <33051892+sumit-m@users.noreply.github.com> --- desktop/src/shared/styles/globals.css | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/desktop/src/shared/styles/globals.css b/desktop/src/shared/styles/globals.css index fd60621933..704f6e542d 100644 --- a/desktop/src/shared/styles/globals.css +++ b/desktop/src/shared/styles/globals.css @@ -1,5 +1,6 @@ @import "tailwindcss"; @import "tw-animate-css"; + @import "./globals/scrollbars.css"; @import "./globals/motion.css"; @import "./globals/animations.css"; @@ -17,3 +18,15 @@ @import "./globals/progress.css"; @config "../../../tailwind.config.js"; + +/* Tailwind v4 gates `hover:` behind `@media (hover: hover)`. Some Windows + hosts answer that query `false` even with a mouse attached — WebView2 here + reports `hover: none`, `any-pointer: fine: false`, `maxTouchPoints: 10` — + which leaves every hover-revealed control permanently `visibility: hidden`: + member row action menus, sidebar row actions, attachment controls. A bare + `&:hover` trusts the actual hover event instead of the capability query; + Chromium only fires :hover when a real pointer is present. + + Must stay below every `@import`: CSS requires `@import` to precede other + at-rules, so placing this above them silently drops the rest of the sheet. */ +@custom-variant hover (&:hover); From 74cd5712191bffd84ae688d59bb8b451c6eec1b0 Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 30 Jul 2026 16:04:14 -0600 Subject: [PATCH 093/112] fix(desktop): report authenticated relay recovery (#3812) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - report the relay as connected immediately after socket open and successful AUTH - keep rate-limited subscription replay, the connect promise, and reconnect listeners unchanged - cover authenticated reconnect while replay is held behind the shared rate-limit gate ## Why After WARP recovery, the socket could reopen and authenticate successfully while subscription replay waited behind the existing rate-limit gate. `connect()` kept `ConnectionState` at `reconnecting` during that intentional delay, so the desktop displayed “Can’t reach the relay” despite authenticated traffic already flowing. This is separate from #3774: that fix keeps routine operations from bypassing scheduled reconnect backoff. This patch preserves those protections and only corrects the authenticated transport-state boundary. ## Failure semantics If replay fails after the early `connected` transition, the existing `replayLiveSubscriptions()` catch calls `resetConnection()`, closes the socket, returns state to `reconnecting`, and schedules recovery. Operation waiters and reconnect notifications still do not complete until replay succeeds. ## Validation At commit `c8a4308e1079f4f9e6a72f0f0bfba280fe822ec0` with a clean working tree: - `pnpm --dir desktop typecheck` - `pnpm --dir desktop test` — 3,847 passed - `pnpm --dir desktop check` — passed; two pre-existing informational template-literal notices - `pnpm --dir desktop exec playwright test tests/e2e/relay-reconnect.spec.ts` — 8 passed - regression test proven red before the production ordering change (`reconnecting` after 3 seconds) and green after it Signed-off-by: Wes Co-authored-by: Carl --- desktop/src/shared/api/relayClientSession.ts | 2 +- desktop/src/testing/e2eBridge.ts | 5 +++ desktop/tests/e2e/relay-reconnect.spec.ts | 35 ++++++++++++++++++++ 3 files changed, 41 insertions(+), 1 deletion(-) diff --git a/desktop/src/shared/api/relayClientSession.ts b/desktop/src/shared/api/relayClientSession.ts index 8274034ed5..94438386eb 100644 --- a/desktop/src/shared/api/relayClientSession.ts +++ b/desktop/src/shared/api/relayClientSession.ts @@ -566,8 +566,8 @@ export class RelayClient { this.reconnectDelayMs = RECONNECT_BASE_DELAY_MS; }, BACKOFF_RESET_STABLE_MS); - await this.replayLiveSubscriptions(); this.connectionStateEmitter.set("connected"); + await this.replayLiveSubscriptions(); this.stallWatchdog.start(); this.emitReconnectIfNeeded(); } catch (error) { diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 841e6ba83f..9bb3feabda 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -11,6 +11,7 @@ import { } from "./e2eBridgeCustomHarnesses.ts"; import { relayClient } from "@/shared/api/relayClient"; +import { activateRateLimit } from "@/shared/api/relayRateLimitGate"; import type { ConnectionState } from "@/shared/api/relayClientShared"; import type { ChannelTemplate, RelayEvent } from "@/shared/api/types"; import { getMarkdownParseCount } from "@/shared/ui/markdown/nodeCache"; @@ -1115,6 +1116,7 @@ declare global { unavailable: boolean, ) => void; __BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__?: () => number[]; + __BUZZ_E2E_ACTIVATE_RELAY_RATE_LIMIT__?: (seconds: number) => void; __BUZZ_E2E_RESET_WEBSOCKET_CONNECT_ATTEMPTS__?: () => void; __BUZZ_E2E_SET_MESH__?: (mesh: { admitted?: boolean; @@ -9706,6 +9708,9 @@ export function maybeInstallE2eTauriMocks() { window.__BUZZ_E2E_GET_WEBSOCKET_CONNECT_ATTEMPTS__ = () => [ ...relayWebsocketConnectAttemptStarts, ]; + window.__BUZZ_E2E_ACTIVATE_RELAY_RATE_LIMIT__ = (seconds) => { + activateRateLimit(seconds); + }; window.__BUZZ_E2E_RESET_WEBSOCKET_CONNECT_ATTEMPTS__ = () => { relayWebsocketConnectAttemptStarts.length = 0; }; diff --git a/desktop/tests/e2e/relay-reconnect.spec.ts b/desktop/tests/e2e/relay-reconnect.spec.ts index 67ce725da8..6606d5f04d 100644 --- a/desktop/tests/e2e/relay-reconnect.spec.ts +++ b/desktop/tests/e2e/relay-reconnect.spec.ts @@ -62,6 +62,19 @@ async function setMockWebsocketUnavailable( }, unavailable); } +async function activateRelayRateLimit( + page: import("@playwright/test").Page, + seconds: number, +) { + await page.evaluate((duration) => { + const activate = window.__BUZZ_E2E_ACTIVATE_RELAY_RATE_LIMIT__; + if (!activate) { + throw new Error("E2E relay rate-limit seam is not installed."); + } + activate(duration); + }, seconds); +} + async function getMockWebsocketConnectAttempts( page: import("@playwright/test").Page, ) { @@ -195,6 +208,28 @@ test("routine traffic cannot bypass outage backoff and recovery stays automatic" ); }); +test("authenticated reconnect reports connected while replay is rate-limited", async ({ + page, +}) => { + await page.goto("/"); + await expect(page.getByTestId("channel-general")).toBeVisible(); + + await activateRelayRateLimit(page, 5); + await disconnectMockWebsockets(page); + + // Replay remains intentionally blocked behind admission control, but socket + // open + successful AUTH is already a healthy connection. The UI must not + // claim the relay is unreachable for the rest of the gate window. + await expect + .poll( + () => + page.evaluate(() => window.__BUZZ_E2E_GET_RELAY_CONNECTION_STATE__?.()), + { timeout: 3_000 }, + ) + .toBe("connected"); + await expect(page.getByTestId("sidebar-relay-unreachable")).toHaveCount(0); +}); + test("service restart close resets accumulated backoff", async ({ page }) => { await installMockBridge(page, { websocketConnectErrors: ["down 1", "down 2", "down 3"], From 36571f4adcfdcf3714a17bd968c58c78bcbdd9ef Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 30 Jul 2026 18:11:03 -0400 Subject: [PATCH 094/112] fix(desktop): allow linux-only media items as dead code off-linux (#3811) Local `desktop-tauri-clippy` fails on macOS with dead-code errors for `PROD_ORIGIN`, `DEV_ORIGIN`, and `is_trusted_media_origin`, which are only used inside `#[cfg(target_os = "linux")] enable_media_capture`. The items are intentionally platform-independent so unit tests run everywhere. Added `cfg_attr` allow attribute to suppress the warnings on non-Linux targets. Since [#3607](https://github.com/block/buzz/pull/3607), this affects all Rust developers on macOS. Signed-off-by: Will Pfleger Co-authored-by: d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78 --- desktop/src-tauri/src/linux_media.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/desktop/src-tauri/src/linux_media.rs b/desktop/src-tauri/src/linux_media.rs index c768e15422..240e2f8a77 100644 --- a/desktop/src-tauri/src/linux_media.rs +++ b/desktop/src-tauri/src/linux_media.rs @@ -22,17 +22,22 @@ //! which is the backend WebKitGTK media capture is reliable on. /// The origin Tauri serves the packaged app from on Linux. +/// Consumed only by linux-gated [`enable_media_capture`]; kept compiling on all +/// platforms so the unit tests run everywhere. +#[cfg_attr(not(target_os = "linux"), allow(dead_code))] const PROD_ORIGIN: &str = "tauri://localhost"; /// The Vite dev-server origin (`devUrl` in `tauri.conf.json`, `strictPort` /// 1420 in `vite.config.ts`). Only trusted in debug builds. #[cfg(debug_assertions)] +#[cfg_attr(not(target_os = "linux"), allow(dead_code))] const DEV_ORIGIN: &str = "http://localhost:1420"; /// Whether `uri` (the webview's current document URI) is a trusted app origin /// allowed to use mic/camera. Matches the origin exactly or as a path prefix so /// `tauri://localhost.evil.com` and `http://localhost:14200` do not slip /// through. Pure and platform-independent so it can be unit-tested everywhere. +#[cfg_attr(not(target_os = "linux"), allow(dead_code))] fn is_trusted_media_origin(uri: &str) -> bool { fn matches(uri: &str, origin: &str) -> bool { uri == origin From 23f0c26b1ceba8e07bf3c160a1e08c7bda82ccd9 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 30 Jul 2026 18:42:18 -0400 Subject: [PATCH 095/112] fix(relay): align NIP-11 max_limit with REQ ceiling (#3635) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Buzz's NIP-11 document advertised `limitation.max_limit: 10_000`, but the effective websocket REQ page ceiling was `1_000` — a 10x lie. The websocket REQ path never sets `EventQuery::max_limit`, so `query_events` applied its own `unwrap_or(1000)` clamp to every historical query. Only the COUNT fallback (`apply_count_fallback_limit`) ever raises that clamp. A client that trusts the advertised value asks for 10,000 events, silently receives 1,000, and — with no error and no continuation signal — reads that short page as exhaustion. Up to 9,000 events are dropped without anyone noticing. `MAX_HISTORICAL_LIMIT = 2_000` in `handlers/req.rs` was dead weight for the same reason: nothing clamped to 2,000 could survive the DB's 1,000 clamp one layer down. ## Change `buzz_db::DEFAULT_MAX_PAGE_LIMIT` (`1_000`) is now the single source of truth. It is the `query_events` clamp default, the value both REQ clamp sites use, and the value advertised as NIP-11 `max_limit`. `MAX_HISTORICAL_LIMIT` is removed rather than re-pointed — an alias for a constant used four lines away adds a name without adding meaning. The NIP-50 search path carries a second, independent bound. It clamps its emission target to the shared ceiling like any other REQ, but how many FTS candidates it will scan was bounded separately, by a bare 10-page loop over 100-hit pages. That product only coincidentally equalled the ceiling, so raising the ceiling — or shrinking a page — would shrink the scan relative to what clients may now request, degrading search quality while nothing in the code registered the change. The page count is now ceiling-divided from `DEFAULT_MAX_PAGE_LIMIT` over a named `SEARCH_PAGE_SIZE`, so the scan budget tracks the advertised ceiling by construction. That budget is a resource policy, not a delivery promise. It bounds candidates *scanned*, not events *emitted*: post-filtering (NIP-01 match, channel access, reader visibility, dedup) discards an unpredictable share of every page, so a search result smaller than the requested limit remains possible. This is not a NIP-11 violation — `max_limit` is defined as a clamp the relay applies to a requested `limit`, not a guaranteed count in the response. Two guards hold the pair together: - `req_filter_limit_clamps_to_advertised_nip11_max_limit` reads `max_limit` back out of a built `RelayInfo` and asserts the REQ path clamps to exactly that number. - `search_scan_capacity_covers_advertised_nip11_max_limit` asserts the scan budget covers exactly one advertised ceiling's worth of candidates — no less, and with no spare page of slack, so the derivation can't be quietly replaced by a hand-tuned constant that happens to pass today. ## Behavior Websocket behavior is unchanged: 1,000 was already the real ceiling on every path, including NIP-50. The advertisement now tells the truth about it. Raising the effective limit is a capacity decision and is deliberately not made here. The generic HTTP bridge's page-2+ offsets do change, as a consequence of the corrected clamp. `extract_page_offset` sizes a page from `query.limit` *before* the DB clamp applies, so an absent limit previously produced an offset of 2,000 and a requested 1,500 produced 1,500 — while the page actually returned held at most 1,000 rows. Both now produce 1,000. This corrects paging that had been skipping rows the previous page never returned; `extract_page_offset_sizes_pages_from_clamped_limit` locks it down. ## Scope note The bridge's per-endpoint ceilings — `BRIDGE_WINDOW_MAX_LIMIT` (200) for channel windows and `BRIDGE_THREAD_MAX_LIMIT` (500) for thread reads — are endpoint contracts on a non-NIP-01 transport, not values NIP-11 speaks for, and are unchanged. Fixes #3757 --------- Signed-off-by: Will Pfleger Co-authored-by: Duncan --- crates/buzz-db/src/event.rs | 15 ++- crates/buzz-db/src/lib.rs | 2 +- crates/buzz-relay/src/api/bridge.rs | 21 +++++ crates/buzz-relay/src/handlers/req.rs | 126 ++++++++++++++++++++++---- crates/buzz-relay/src/nip11.rs | 7 +- 5 files changed, 147 insertions(+), 24 deletions(-) diff --git a/crates/buzz-db/src/event.rs b/crates/buzz-db/src/event.rs index c0550e7e22..6c84950a2c 100644 --- a/crates/buzz-db/src/event.rs +++ b/crates/buzz-db/src/event.rs @@ -17,6 +17,13 @@ use buzz_core::{CommunityId, StoredEvent}; use crate::error::{DbError, Result}; +/// Largest page [`query_events`] will return when [`EventQuery::max_limit`] is +/// unset — the effective ceiling on any client-requested `limit`. +/// +/// This is the value the relay advertises as NIP-11 `limitation.max_limit`, so +/// the advertised ceiling and the enforced one cannot drift. +pub const DEFAULT_MAX_PAGE_LIMIT: i64 = 1_000; + /// Optional filters for [`query_events`]. #[derive(Debug, Clone)] pub struct EventQuery { @@ -67,9 +74,9 @@ pub struct EventQuery { /// channel-less global events. Applied before SQL `LIMIT` so access-filtered /// historical pages have exact exhaustion semantics. pub channel_ids: Option>, - /// Override the default limit clamp (1000). Used by COUNT fallback path - /// which needs to fetch all matching events for post-filter counting. - /// When None, the default clamp of 1000 applies. + /// Override the default page clamp ([`DEFAULT_MAX_PAGE_LIMIT`]). Used by + /// the COUNT fallback path, which needs to fetch all matching events for + /// post-filter counting. When None, the default clamp applies. pub max_limit: Option, /// Shared-gated visibility reader: when set, append an SQL visibility /// clause for every kind in [`SHARED_GATED_KINDS`] before ORDER/LIMIT so @@ -357,7 +364,7 @@ pub(crate) async fn query_events_on( return Ok(vec![]); } - let clamp = q.max_limit.unwrap_or(1000); + let clamp = q.max_limit.unwrap_or(DEFAULT_MAX_PAGE_LIMIT); let limit_val = q.limit.unwrap_or(100).min(clamp); let offset_val = q.offset.unwrap_or(0); diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs index 5c60d1a702..50aac1cbaf 100644 --- a/crates/buzz-db/src/lib.rs +++ b/crates/buzz-db/src/lib.rs @@ -55,7 +55,7 @@ pub mod user; pub mod workflow; pub use error::{DbError, Result}; -pub use event::{EventQuery, ReactionEventInsertOutcome}; +pub use event::{EventQuery, ReactionEventInsertOutcome, DEFAULT_MAX_PAGE_LIMIT}; use chrono::{DateTime, Utc}; use sqlx::postgres::{PgConnection, PgPoolOptions}; diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs index 678199e734..a118ff453f 100644 --- a/crates/buzz-relay/src/api/bridge.rs +++ b/crates/buzz-relay/src/api/bridge.rs @@ -3042,6 +3042,27 @@ mod tests { assert_eq!(extract_page_offset(&raw, None), None); } + /// Offsets are sized from the *clamped* limit the DB will honor, not from + /// what the client asked for. `filter_to_query_params` clamps an absent or + /// over-ceiling `limit` to `DEFAULT_MAX_PAGE_LIMIT` (guarded in + /// `handlers::req::tests::req_filter_limit_clamps_to_advertised_nip11_max_limit`) + /// and that clamped value is what arrives here — so page N starts exactly + /// N-1 full pages in. Sizing from an unclamped limit would step past rows + /// the previous page never returned. + #[test] + fn extract_page_offset_sizes_pages_from_clamped_limit() { + let clamped = buzz_db::DEFAULT_MAX_PAGE_LIMIT; + + assert_eq!( + extract_page_offset(&serde_json::json!({ "page": 2 }), Some(clamped)), + Some(clamped) + ); + assert_eq!( + extract_page_offset(&serde_json::json!({ "page": 3 }), Some(clamped)), + Some(clamped * 2) + ); + } + #[test] fn extract_depth_limit_valid() { let raw = serde_json::json!({ "depth_limit": 3 }); diff --git a/crates/buzz-relay/src/handlers/req.rs b/crates/buzz-relay/src/handlers/req.rs index 35fbf0c892..2aed12cd7f 100644 --- a/crates/buzz-relay/src/handlers/req.rs +++ b/crates/buzz-relay/src/handlers/req.rs @@ -22,7 +22,6 @@ use crate::connection::{AuthState, ConnectionState}; use crate::protocol::RelayMessage; use crate::state::AppState; -const MAX_HISTORICAL_LIMIT: i64 = 2_000; const MAX_SUBSCRIPTIONS: usize = 1024; /// Maximum `query_events` calls in flight per multi-filter REQ / bridge query. @@ -416,10 +415,24 @@ pub async fn handle_req( ); } -/// Handle a NIP-50 search REQ: query Postgres FTS, fetch full events, deliver results, EOSE. -/// Search subscriptions are one-shot — no persistent subscription is registered. +/// FTS candidate hits fetched per page. Pages are always full regardless of +/// the requested limit — post-filtering discards an unpredictable share of +/// hits, so the scan fetches candidates in full pages rather than sizing +/// pages to the request. +const SEARCH_PAGE_SIZE: u32 = 100; + /// Maximum FTS pages to fetch per filter (prevents unbounded loops). -const MAX_SEARCH_PAGES: u32 = 10; +/// +/// Derived from the advertised page ceiling rather than fixed: the scan +/// budget is a resource policy — at most one advertised page ceiling's worth +/// of candidates per filter — and deriving it keeps the budget tracking the +/// ceiling if the ceiling ever moves. This bounds candidates *scanned*, not +/// events *emitted*: post-filtering (NIP-01 match, channel access, reader +/// visibility, dedup) can discard any number of candidates, so a result +/// smaller than the requested limit remains possible and is not a NIP-11 +/// violation — `max_limit` promises a clamp on the request, not a count in +/// the response. +const MAX_SEARCH_PAGES: u32 = (buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32).div_ceil(SEARCH_PAGE_SIZE); /// Resolve request-local channel access, repairing a stale cache-negative. /// @@ -501,6 +514,8 @@ pub(crate) fn build_search_channel_scope_filter( }) } +/// Handle a NIP-50 search REQ: query Postgres FTS, fetch full events, deliver results, EOSE. +/// Search subscriptions are one-shot — no persistent subscription is registered. #[allow(clippy::too_many_arguments)] async fn handle_search_req( sub_id: &str, @@ -535,8 +550,8 @@ async fn handle_search_req( let limit = filter .limit - .map(|l| (l as u32).min(MAX_HISTORICAL_LIMIT as u32)) - .unwrap_or(MAX_HISTORICAL_LIMIT as u32); + .map(|l| (l as u32).min(buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32)) + .unwrap_or(buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32); if limit == 0 { continue; // NIP-01: limit 0 means "no results from this filter" @@ -583,13 +598,11 @@ async fn handle_search_req( let since = filter.since.map(|s| s.as_secs() as i64); let until = filter.until.map(|u| u.as_secs() as i64); - // Paginate: keep fetching pages until we've emitted `limit` results - // or exhausted the search result set. This ensures post-filtering - // doesn't silently reduce the result count below the requested limit. + // Paginate: keep fetching pages until we've emitted `limit` results or + // exhausted the search result set. Post-filtering discards an unpredictable + // share of each page, so continuing past short yields gives the scan a + // chance — not a guarantee — of filling the requested limit. let mut emitted: u32 = 0; - // Always fetch full pages (100) regardless of limit — post-filtering - // may discard many hits, so we need headroom to fill the requested limit. - let per_page: u32 = 100; for page in 1..=MAX_SEARCH_PAGES { if emitted >= limit { @@ -605,7 +618,7 @@ async fn handle_search_req( since, until, page, - per_page, + per_page: SEARCH_PAGE_SIZE, mode: buzz_search::SearchMode::FullText, }; @@ -617,9 +630,9 @@ async fn handle_search_req( } }; - // A short page is the last page: FTS returns up to `per_page` hits, - // so fewer than that means the result set is exhausted. - let exhausted = search_result.hits.len() < per_page as usize; + // A short page is the last page: FTS returns up to a full page of + // hits, so fewer than that means the result set is exhausted. + let exhausted = search_result.hits.len() < SEARCH_PAGE_SIZE as usize; let page_empty = search_result.hits.is_empty(); let hit_ids: Vec<[u8; 32]> = @@ -878,8 +891,8 @@ fn filter_to_query_params( .and_then(|u| chrono::DateTime::from_timestamp(u.as_secs() as i64, 0)); let limit = filter .limit - .map(|l| (l as i64).min(MAX_HISTORICAL_LIMIT)) - .unwrap_or(MAX_HISTORICAL_LIMIT); + .map(|l| (l as i64).min(buzz_db::DEFAULT_MAX_PAGE_LIMIT)) + .unwrap_or(buzz_db::DEFAULT_MAX_PAGE_LIMIT); // Push author filter into SQL. Single-author uses the indexed `pubkey` column; // multi-author uses the `authors` IN-list pushdown added in the pure-nostr PR. @@ -1418,6 +1431,83 @@ mod tests { ) } + /// NIP-11 `limitation.max_limit` as this relay actually advertises it. + fn advertised_max_limit() -> i64 { + crate::nip11::RelayInfo::build( + None, + None, + false, + crate::config::DEFAULT_MAX_FRAME_BYTES, + None, + ) + .limitation + .expect("limitation") + .max_limit + .expect("max_limit") as i64 + } + + #[test] + fn req_filter_limit_clamps_to_advertised_nip11_max_limit() { + let advertised = advertised_max_limit(); + + let community = buzz_core::tenant::CommunityId::from_uuid(uuid::Uuid::new_v4()); + + // A filter asking for more than the relay advertises is clamped down to + // exactly the advertised ceiling — the NIP-11 document is the promise, + // this is the enforcement. + let greedy = filter_to_query_params( + &Filter::new().limit(advertised as usize * 10), + None, + community, + ); + assert_eq!(greedy.limit, Some(advertised)); + + // A filter with no `limit` gets the same ceiling, not something larger. + let unbounded = filter_to_query_params(&Filter::new(), None, community); + assert_eq!(unbounded.limit, Some(advertised)); + + // Neither sets `max_limit`, so `query_events` applies its own default + // clamp. That default must equal the advertised value too, or the + // clamp above would be undone one layer down. + assert_eq!(greedy.max_limit, None); + assert_eq!(unbounded.max_limit, None); + assert_eq!(buzz_db::DEFAULT_MAX_PAGE_LIMIT, advertised); + + // Under-ceiling requests are honored verbatim. + let modest = filter_to_query_params(&Filter::new().limit(10), None, community); + assert_eq!(modest.limit, Some(10)); + } + + /// The NIP-50 search path clamps its emission target to the advertised + /// ceiling like every other REQ, but the number of candidates it will scan + /// is bounded a second time by the page budget. This pins the resource + /// policy: the budget covers exactly one advertised page ceiling's worth of + /// candidates — no less (a ceiling raise must not silently shrink the scan + /// relative to what clients may request) and no hand-tuned spare (the budget + /// must stay derived, not drift back into a magic number). It deliberately + /// does NOT claim search fills the emitted limit — post-filtering can + /// discard any number of candidates. + #[test] + fn search_scan_capacity_covers_advertised_nip11_max_limit() { + let advertised = advertised_max_limit(); + let capacity = i64::from(MAX_SEARCH_PAGES) * i64::from(SEARCH_PAGE_SIZE); + + assert!( + capacity >= advertised, + "NIP-50 scans at most {capacity} candidates ({MAX_SEARCH_PAGES} pages of \ + {SEARCH_PAGE_SIZE}) but NIP-11 advertises {advertised} — the scan budget \ + no longer covers the advertised ceiling" + ); + + // The budget is derived, not hand-tuned: one page under the derived + // count must be insufficient, or the ceiling could rise without the + // page count following it. + assert!( + capacity - i64::from(SEARCH_PAGE_SIZE) < advertised, + "scan budget has a spare page of slack — derive it from the ceiling" + ); + } + #[test] fn count_fallback_fetches_one_extra_candidate() { let mut query = diff --git a/crates/buzz-relay/src/nip11.rs b/crates/buzz-relay/src/nip11.rs index a8e397dd21..2575ddd7ba 100644 --- a/crates/buzz-relay/src/nip11.rs +++ b/crates/buzz-relay/src/nip11.rs @@ -89,6 +89,11 @@ pub struct RelayLimitation { /// Canonical `RelayLimitation` advertised by this relay. /// +/// `max_limit` is [`buzz_db::DEFAULT_MAX_PAGE_LIMIT`], the same constant the +/// REQ path clamps filter limits to, so the advertised ceiling and the +/// enforced one cannot drift (see +/// `handlers::req::tests::req_filter_limit_clamps_to_advertised_nip11_max_limit`). +/// /// `auth_required` is always `true`: the REQ, EVENT, and COUNT handlers /// unconditionally reject connections that are not in /// `AuthState::Authenticated`. This is independent of the REST API token @@ -103,7 +108,7 @@ fn relay_limitation(max_message_length: usize) -> RelayLimitation { max_message_length: Some(max_message_length as u64), max_subscriptions: Some(1024), max_filters: Some(10), - max_limit: Some(10_000), + max_limit: Some(buzz_db::DEFAULT_MAX_PAGE_LIMIT as u32), max_subid_length: Some(256), min_pow_difficulty: None, auth_required: true, From ede26863345a518ec46edd6d7692e0281883491b Mon Sep 17 00:00:00 2001 From: Bradley Axen Date: Thu, 30 Jul 2026 15:47:35 -0700 Subject: [PATCH 096/112] fix(desktop): align data deletion labels (#2230) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The Profile settings action still says “Sign Out,” while its confirmation action says “Delete My Data.” Both buttons trigger the same destructive local-data wipe and should name it consistently. ## What - Label both destructive actions “Delete my data” - Assert the matching section and confirmation labels in the existing Playwright coverage ## Risk Assessment Low — copy and test assertions only; sign-out behavior is unchanged. ## References - Follow-up to #2208 - #2216 also touches this copy and should preserve “Delete my data” when rebased - `just desktop-check` - `just desktop-test` (3,275 tests) - Desktop E2E build and sign-out Playwright spec (2 tests) Generated with Codex Signed-off-by: Bradley Axen --- desktop/src/features/settings/ui/SignOutSection.tsx | 4 ++-- desktop/tests/e2e/signout-screenshots.spec.ts | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/desktop/src/features/settings/ui/SignOutSection.tsx b/desktop/src/features/settings/ui/SignOutSection.tsx index 8d4dc1c481..746220459b 100644 --- a/desktop/src/features/settings/ui/SignOutSection.tsx +++ b/desktop/src/features/settings/ui/SignOutSection.tsx @@ -151,7 +151,7 @@ export function SignOutSection() { {isPending ? ( ) : null} - {isPending ? "Signing out…" : "Sign Out"} + {isPending ? "Signing out…" : "Delete my data"} ) : null} - {isPending ? "Signing out…" : "Delete My Data"} + {isPending ? "Signing out…" : "Delete my data"} diff --git a/desktop/tests/e2e/signout-screenshots.spec.ts b/desktop/tests/e2e/signout-screenshots.spec.ts index 32fc3ed09d..5cf35c70ab 100644 --- a/desktop/tests/e2e/signout-screenshots.spec.ts +++ b/desktop/tests/e2e/signout-screenshots.spec.ts @@ -23,7 +23,7 @@ test.describe("signout screenshots", () => { }); }); - test("signout-section — Sign Out card in Settings › Profile", async ({ + test("signout-section — data deletion card in Settings › Profile", async ({ page, }) => { await installMockBridge(page); @@ -32,6 +32,9 @@ test.describe("signout screenshots", () => { const section = page.getByTestId("settings-signout"); await section.scrollIntoViewIfNeeded(); + await expect( + section.getByRole("button", { name: "Delete my data" }), + ).toBeVisible(); // Settle animations before capture. await page.evaluate(() => @@ -59,7 +62,7 @@ test.describe("signout screenshots", () => { await expect(dialog).toBeVisible({ timeout: 5_000 }); await expect(dialog.getByText("Sign out and wipe all data?")).toBeVisible(); await expect( - dialog.getByRole("button", { name: "Delete My Data" }), + dialog.getByRole("button", { name: "Delete my data" }), ).toBeVisible(); // Settle animations before capture. From 9e8fcfda099652926b921bca7fcc9bfecab0e140 Mon Sep 17 00:00:00 2001 From: Clay Delk Date: Thu, 30 Jul 2026 18:53:04 -0400 Subject: [PATCH 097/112] fix(desktop): channel topic and membership metadata cleanup (#3642) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First slice of #2216, scoped to the system/status lines in the chat timeline. ## Why Two problems on the same surface. **Clearing a channel topic renders as empty quotes.** The relay reports a clear as a `topic_changed` event carrying an empty string — there's no separate "cleared" event type. So the timeline printed: > Alice > changed the topic to “” which reads as if the topic were *set to* two quote marks. Same for purpose. **The membership caption reads like a headline, not a metadata line.** `title` and `action` render on separate lines — the member's name sits in the header row with the avatar and timestamp, and the caption sits beneath it. So the caption was "was added by Alice Chen" standing alone under a name, while its siblings on that same line are "joined the channel" and "left the channel". ## What - Blank, missing, or whitespace-only topic/purpose now reads **"cleared the channel topic"** / **"cleared the channel purpose"**. - Membership captions drop "was": **"added by Alice Chen"**, matching "joined the channel" and "left the channel". - The wording moves to `lib/systemEventCopy.ts` as a pure function, so it's assertable in a unit test instead of only reachable through the DOM. That also removes two JSX fragments from `SystemMessageRow.tsx`, taking it 911 → 900 lines. ## Two E2E assertions this exposed Both were measuring something other than what they claimed, and the copy change tipped them over. Neither is a product bug, but both would have failed the next person too. 1. **`mentions.spec.ts:1245`** asserted a button was un-underlined while the mouse was still parked from a previous `hover()`. Any reflow — new rows, scroll-to-bottom, a different text wrap — can slide that button under the stationary pointer, so the assertion measured *where the mouse happened to be* rather than the resting style. Dropping four characters changed the text wrap, changed the row height, changed the scroll offset, and the pointer landed on it. Now parks the pointer off-target first. 2. **`mentions.spec.ts:1253`** used a bare `role=tooltip` lookup. Once the first tooltip animates out while the second opens, two elements match and strict mode trips. Now scopes to the open tooltip via `:not([data-state="closed"])`. ## Deliberately out of scope - **Timestamps.** The day divider, per-message clock times, the Inbox thread pane, and the inbox list have three divergent date implementations and none fully match the writing standard's Today/Yesterday/weekday/date progression. That's its own slice of #2216. - **Whose avatar shows.** An addition puts the *added* member in the header; a removal puts the *remover* there. Possibly intentional, but it's a design question, not copy. - **`the channel` vs `this channel`.** joined/left/removed say "the channel"; created/archived/unarchived say "this channel". Worth normalizing, but it touches lines this PR otherwise leaves alone. ## Validation - `pnpm check`, `pnpm typecheck` — clean - Unit: **3781/3781**, including 6 new tests in `systemEventCopy.test.mjs` covering set/blank/undefined/null/whitespace for both fields, plus a guard that no variant can emit empty quotes - Smoke E2E `mentions` + `messaging`: **85/85** - The previously fragile test run with `--repeat-each=5`: **5/5** Signed-off-by: Clay Delk Co-authored-by: Claude Opus 5 (1M context) --- .../messages/lib/systemEventCopy.test.mjs | 107 ++++++++++++++++++ .../features/messages/lib/systemEventCopy.ts | 59 ++++++++++ .../features/messages/ui/SystemMessageRow.tsx | 56 +++++++-- desktop/tests/e2e/mentions.spec.ts | 26 +++-- .../channel_detail_page/system_rows.dart | 7 +- .../features/channels/timeline_message.dart | 24 +++- .../channels/channel_detail_page_test.dart | 6 +- .../channels/timeline_message_test.dart | 47 ++++++++ 8 files changed, 311 insertions(+), 21 deletions(-) create mode 100644 desktop/src/features/messages/lib/systemEventCopy.test.mjs create mode 100644 desktop/src/features/messages/lib/systemEventCopy.ts diff --git a/desktop/src/features/messages/lib/systemEventCopy.test.mjs b/desktop/src/features/messages/lib/systemEventCopy.test.mjs new file mode 100644 index 0000000000..eeed9d543c --- /dev/null +++ b/desktop/src/features/messages/lib/systemEventCopy.test.mjs @@ -0,0 +1,107 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { + describeChannelTextFieldChange, + toInlineName, +} from "./systemEventCopy.ts"; + +test("a set topic is quoted verbatim", () => { + assert.equal( + describeChannelTextFieldChange("topic", "Release planning"), + "changed the topic to “Release planning”", + ); +}); + +test("a set purpose names the purpose, not the topic", () => { + assert.equal( + describeChannelTextFieldChange("purpose", "Where we ship from"), + "changed the purpose to “Where we ship from”", + ); +}); + +// The relay reports a clear as a change carrying an empty string, so without +// this branch the timeline reads: changed the topic to “”. +test("an empty value reads as cleared, not as a change to empty quotes", () => { + for (const blank of ["", undefined, null]) { + assert.equal( + describeChannelTextFieldChange("topic", blank), + "cleared the topic", + ); + assert.equal( + describeChannelTextFieldChange("purpose", blank), + "cleared the purpose", + ); + } +}); + +test("a whitespace-only value reads as cleared", () => { + assert.equal( + describeChannelTextFieldChange("topic", " \n\t "), + "cleared the topic", + ); +}); + +test("surrounding whitespace is trimmed out of the quotes", () => { + assert.equal( + describeChannelTextFieldChange("topic", " Release planning "), + "changed the topic to “Release planning”", + ); +}); + +test("no caption announces empty quotes", () => { + for (const value of ["", " ", null, undefined, "Real topic"]) { + for (const field of ["topic", "purpose"]) { + assert.doesNotMatch( + describeChannelTextFieldChange(field, value), + /“”|""/, + `${field} with ${JSON.stringify(value)} must not render empty quotes`, + ); + } + } +}); + +test("the reader's own name is lowercase mid-sentence", () => { + // "added by You" next to an agent's "managed by you" was the inconsistency. + assert.equal(toInlineName("You", true), "you"); +}); + +test("cleared and changed captions use the same noun", () => { + // Not "cleared the channel topic" against "changed the topic to …". + assert.match(describeChannelTextFieldChange("topic", ""), /\bthe topic\b/); + assert.match( + describeChannelTextFieldChange("topic", "Ship it"), + /\bthe topic\b/, + ); + for (const value of ["", "Ship it"]) { + assert.doesNotMatch( + describeChannelTextFieldChange("topic", value), + /channel topic/, + ); + } +}); + +test("every other name keeps its own capitalization", () => { + for (const name of [ + "Alice Chen", + "you-know-who", + "Someone", + "npub1abc…def", + ]) { + assert.equal(toInlineName(name, false), name); + } +}); + +test("someone else whose display name is literally You is left alone", () => { + // The decisive case: the label is user-controlled, identity is not. Matching + // on the string would rewrite this person's name as if they were the reader. + assert.equal(toInlineName("You", false), "You"); + assert.equal(toInlineName("Youssef", false), "Youssef"); + assert.equal(toInlineName("You Know Who", false), "You Know Who"); +}); + +test("the reader is lowercased whatever their profile name says", () => { + // Self resolution never consults the profile, but the rule keys on identity, + // so it does not matter what the label happens to be. + assert.equal(toInlineName("Alice Chen", true), "you"); +}); diff --git a/desktop/src/features/messages/lib/systemEventCopy.ts b/desktop/src/features/messages/lib/systemEventCopy.ts new file mode 100644 index 0000000000..bae6abb09b --- /dev/null +++ b/desktop/src/features/messages/lib/systemEventCopy.ts @@ -0,0 +1,59 @@ +/** + * Copy for channel system events (the "joined", "added by", "changed the + * topic" captions in the message timeline). + * + * These live outside `SystemMessageRow` so the wording is a pure function of + * the payload and can be asserted directly in tests. Only cases whose caption + * is plain text belong here — cases that interpolate a profile link build their + * JSX in the component. + */ + +/** Curly quotes, so the caption matches the typography used elsewhere in chat. */ +const OPEN_QUOTE = "“"; +const CLOSE_QUOTE = "”"; + +export type ChannelTextField = "topic" | "purpose"; + +/** + * Caption for a channel topic or purpose change. + * + * Bare "the topic" rather than "the channel topic": this row only ever renders + * in a channel timeline, under that channel's own header, so naming the channel + * again is redundant — and it keeps the cleared and changed captions on the same + * noun instead of one saying "channel topic" and the other "topic". + * + * A blank value means the field was cleared: the relay reports a clear as a + * `topic_changed` / `purpose_changed` event carrying an empty string, not as a + * separate event type. Without this branch the timeline renders `changed the + * topic to ""`, which reads like the topic was set to two quote marks. + * Whitespace-only values are treated as cleared for the same reason. + */ +export function describeChannelTextFieldChange( + field: ChannelTextField, + value: string | null | undefined, +): string { + const trimmed = value?.trim(); + if (!trimmed) { + return `cleared the ${field}`; + } + return `changed the ${field} to ${OPEN_QUOTE}${trimmed}${CLOSE_QUOTE}`; +} + +/** + * Adjusts a resolved display name for use inside a sentence rather than in the + * name slot at the top of a row — "added by you", "removed you from the channel". + * + * `resolveUserLabel` returns "You" for the current user, which is right standing + * alone and wrong mid-phrase. Agent ownership already draws the same distinction + * from the other side: `formatOwnerLabel` returns lowercase "you" because it is + * only ever read as "managed by you". + * + * `isSelf` is the caller's pubkey comparison, not an inspection of `label`. + * Matching on the string would also rewrite a different person whose display + * name happens to be "You" — the label is user-controlled, identity is not. + * Every name that isn't the reader's own is a proper noun and is returned + * untouched. + */ +export function toInlineName(label: string, isSelf: boolean): string { + return isSelf ? "you" : label; +} diff --git a/desktop/src/features/messages/ui/SystemMessageRow.tsx b/desktop/src/features/messages/ui/SystemMessageRow.tsx index 4410964dd9..c4637d2823 100644 --- a/desktop/src/features/messages/ui/SystemMessageRow.tsx +++ b/desktop/src/features/messages/ui/SystemMessageRow.tsx @@ -28,6 +28,10 @@ import { import { Popover, PopoverContent, PopoverTrigger } from "@/shared/ui/popover"; import { Tooltip, TooltipContent, TooltipTrigger } from "@/shared/ui/tooltip"; import { UserAvatar } from "@/shared/ui/UserAvatar"; +import { + describeChannelTextFieldChange, + toInlineName, +} from "../lib/systemEventCopy"; import { MessageAgentOwner } from "./MessageAgentOwner"; import { MessageAuthorText, MessageHeaderRow } from "./MessageHeader"; import { MessageTimestamp } from "./MessageTimestamp"; @@ -180,6 +184,29 @@ function resolveDisplayLabel( return resolveLabel(pubkey, currentPubkey, profiles); } +function isSelfPubkey( + pubkey: string | undefined, + currentPubkey: string | undefined, +): boolean { + return Boolean( + pubkey && + currentPubkey && + normalizePubkey(pubkey) === normalizePubkey(currentPubkey), + ); +} + +/** Same label as `resolveDisplayLabel`, adjusted for mid-sentence use. */ +function resolveInlineDisplayLabel( + pubkey: string | undefined, + currentPubkey: string | undefined, + profiles: UserProfileLookup | undefined, +): string { + return toInlineName( + resolveLabel(pubkey, currentPubkey, profiles), + isSelfPubkey(pubkey, currentPubkey), + ); +} + function isKnownAgentPubkey( pubkey: string | undefined, profiles: UserProfileLookup | undefined, @@ -386,7 +413,7 @@ function MembershipPersonName({ pubkey={pubkey} underlineOnHover > - {resolveDisplayLabel(pubkey, currentPubkey, profiles)} + {resolveInlineDisplayLabel(pubkey, currentPubkey, profiles)} ); } @@ -497,12 +524,17 @@ function describeSystemEvent( currentPubkey, profiles, ); + const inlineTargetLabel = resolveInlineDisplayLabel( + payload.target, + currentPubkey, + profiles, + ); const actorName = ( {actorLabel} ); const targetName = ( - {targetLabel} + {inlineTargetLabel} ); const membershipTitle = ( @@ -522,9 +554,13 @@ function describeSystemEvent( title: membershipTitle, action: ( <> - was added by{" "} + added by{" "} - {resolveDisplayLabel(payload.actor, currentPubkey, profiles)} + {resolveInlineDisplayLabel( + payload.actor, + currentPubkey, + profiles, + )} , along with{" "} - was added by{" "} + added by{" "} - {resolveDisplayLabel(payload.actor, currentPubkey, profiles)} + {resolveInlineDisplayLabel( + payload.actor, + currentPubkey, + profiles, + )} ), @@ -587,12 +627,12 @@ function describeSystemEvent( case "topic_changed": return { title: actorName, - action: <>changed the topic to “{payload.topic}”, + action: describeChannelTextFieldChange("topic", payload.topic), }; case "purpose_changed": return { title: actorName, - action: <>changed the purpose to “{payload.purpose}”, + action: describeChannelTextFieldChange("purpose", payload.purpose), }; case "channel_created": return { diff --git a/desktop/tests/e2e/mentions.spec.ts b/desktop/tests/e2e/mentions.spec.ts index 694b5abef5..512eb3d800 100644 --- a/desktop/tests/e2e/mentions.spec.ts +++ b/desktop/tests/e2e/mentions.spec.ts @@ -1114,7 +1114,7 @@ test("system add rows use plain names while remove rows retain agent mention sty const addedRow = page .getByTestId("system-message-row") .filter({ hasText: "portal" }) - .filter({ hasText: "was added by" }); + .filter({ hasText: "added by" }); const removedRow = page .getByTestId("system-message-row") .filter({ hasText: "removed portal from the channel" }); @@ -1178,7 +1178,7 @@ test("groups member additions and joins with hidden names in the standard toolti const groupedRow = page .getByTestId("system-message-row") - .filter({ hasText: "was added by Alice Chen" }); + .filter({ hasText: "added by Alice Chen" }); for (const visibleName of [ "Erica Chapman", "Peter Griffin", @@ -1188,9 +1188,9 @@ test("groups member additions and joins with hidden names in the standard toolti await expect(groupedRow).toContainText(visibleName); } await expect( - groupedRow.locator("p").filter({ hasText: "was added by" }), + groupedRow.locator("p").filter({ hasText: "added by" }), ).toContainText( - "was added by Alice Chen, along with Peter Griffin, Marcia Thomas, Jordan Lee, and 2 others", + "added by Alice Chen, along with Peter Griffin, Marcia Thomas, Jordan Lee, and 2 others", ); await expect(groupedRow.locator("[data-mention]")).toHaveCount(0); @@ -1200,6 +1200,11 @@ test("groups member additions and joins with hidden names in the standard toolti await expect(visibleName).toHaveCSS("text-decoration-line", "underline"); const othersTrigger = groupedRow.getByRole("button", { name: "2 others" }); + // Park the pointer off-target first: the previous hover leaves the mouse at a + // fixed viewport point, and any later reflow (new rows, scroll-to-bottom, a + // different text wrap) can slide this button under it. Without this the + // assertion measures where the mouse happens to be, not the resting style. + await page.mouse.move(0, 0); await expect(othersTrigger).toHaveCSS("text-decoration-line", "none"); await othersTrigger.hover(); await expect(othersTrigger).toHaveCSS("text-decoration-line", "underline"); @@ -1242,10 +1247,17 @@ test("groups member additions and joins with hidden names in the standard toolti const joinedOthersTrigger = joinedRow.getByRole("button", { name: "2 others", }); + await page.mouse.move(0, 0); await expect(joinedOthersTrigger).toHaveCSS("text-decoration-line", "none"); await joinedOthersTrigger.hover(); - await expect(page.getByRole("tooltip")).toContainText("Olivia Park"); - await expect(page.getByRole("tooltip")).toContainText("Sam Rivera"); + // Scope to the *open* tooltip: the first row's tooltip stays mounted with + // data-state="closed" while it animates out, so a bare role=tooltip lookup + // matches two elements and trips strict mode. + const joinedTooltip = page.locator( + '[role="tooltip"]:not([data-state="closed"])', + ); + await expect(joinedTooltip).toContainText("Olivia Park"); + await expect(joinedTooltip).toContainText("Sam Rivera"); }); test("system agent profile only exposes message action", async ({ page }) => { @@ -1277,7 +1289,7 @@ test("system agent profile only exposes message action", async ({ page }) => { const joinedRow = page .getByTestId("system-message-row") .filter({ hasText: "mira" }) - .filter({ hasText: "was added by" }); + .filter({ hasText: "added by" }); const agentName = joinedRow.getByText("mira", { exact: true }); await expect(agentName).toHaveText("mira"); await expect(agentName).not.toHaveAttribute("data-mention"); diff --git a/mobile/lib/features/channels/channel_detail_page/system_rows.dart b/mobile/lib/features/channels/channel_detail_page/system_rows.dart index 72554ee1a1..0372690e1e 100644 --- a/mobile/lib/features/channels/channel_detail_page/system_rows.dart +++ b/mobile/lib/features/channels/channel_detail_page/system_rows.dart @@ -279,7 +279,12 @@ class _MembershipSystemMessageContent extends StatelessWidget { TextSpan( text: event.isSelfJoin ? 'joined the channel' - : 'was added by ${resolveLabel(event.actorPubkey)}', + // No "was": the name renders on the line above via + // MessageAuthorMeta, so this reads as a status line rather than a + // sentence continuing across the metadata row. Matches desktop's + // SystemMessageRow. `SystemEvent.describe` keeps "was added by" + // because it builds subject and predicate into one string. + : 'added by ${resolveLabel(event.actorPubkey)}', ), if (additionalTargets.isNotEmpty) TextSpan(text: event.isSelfJoin ? ' along with ' : ', along with '), diff --git a/mobile/lib/features/channels/timeline_message.dart b/mobile/lib/features/channels/timeline_message.dart index 253c949703..c8fd96491b 100644 --- a/mobile/lib/features/channels/timeline_message.dart +++ b/mobile/lib/features/channels/timeline_message.dart @@ -101,9 +101,10 @@ class SystemEvent { final target = resolveLabel(targetPubkey); return '$actor removed $target from the channel'; }(), - SystemEventType.topicChanged => '$actor changed the topic to "$topic"', + SystemEventType.topicChanged => + '$actor ${_describeTextFieldChange('topic', topic)}', SystemEventType.purposeChanged => - '$actor changed the purpose to "$purpose"', + '$actor ${_describeTextFieldChange('purpose', purpose)}', SystemEventType.channelCreated => '$actor created this channel', SystemEventType.channelArchived => '$actor archived this channel', SystemEventType.channelUnarchived => '$actor unarchived this channel', @@ -113,6 +114,25 @@ class SystemEvent { } } +/// Caption fragment for a channel topic or purpose change, e.g. +/// `changed the topic to "Release planning"` or `cleared the topic`. +/// +/// A blank value means the field was cleared: the relay reports a clear as a +/// `topic_changed` / `purpose_changed` event carrying an empty string, not as a +/// separate event type. Without this branch the timeline renders +/// `changed the topic to ""`, which reads as if the topic were set to two quote +/// marks. Whitespace-only values are treated as cleared for the same reason. +/// +/// Mirrors `describeChannelTextFieldChange` in +/// `desktop/src/features/messages/lib/systemEventCopy.ts`. +String _describeTextFieldChange(String field, String? value) { + final trimmed = value?.trim(); + if (trimmed == null || trimmed.isEmpty) { + return 'cleared the $field'; + } + return 'changed the $field to "$trimmed"'; +} + @immutable class TimelineReaction { final String emoji; diff --git a/mobile/test/features/channels/channel_detail_page_test.dart b/mobile/test/features/channels/channel_detail_page_test.dart index 1c66093899..899394de23 100644 --- a/mobile/test/features/channels/channel_detail_page_test.dart +++ b/mobile/test/features/channels/channel_detail_page_test.dart @@ -1348,7 +1348,7 @@ void main() { await tester.pumpAndSettle(); expect(find.text('Bob'), findsOneWidget); - final addedAction = findRichText('was added by Alice'); + final addedAction = findRichText('added by Alice'); expect(addedAction, findsOneWidget); expect(find.text('Alice added Bob to the channel'), findsNothing); expect( @@ -1366,7 +1366,7 @@ void main() { expect(timestampRect.left, greaterThan(nameRect.right)); final addedText = tester.widget(addedAction); expect( - effectiveFontSizeForText(addedText.text, 'was added by Alice'), + effectiveFontSizeForText(addedText.text, 'added by Alice'), systemMessageBodyTextStyle.fontSize, ); }); @@ -1435,7 +1435,7 @@ void main() { expect(find.text('Bob'), findsOneWidget); expect( - findRichText('was added by Alice, along with Carol, Dave, Erin, and '), + findRichText('added by Alice, along with Carol, Dave, Erin, and '), findsOneWidget, ); expect(find.byKey(const Key('membership-overflow')), findsOneWidget); diff --git a/mobile/test/features/channels/timeline_message_test.dart b/mobile/test/features/channels/timeline_message_test.dart index 87f39d1c65..c29a12aef4 100644 --- a/mobile/test/features/channels/timeline_message_test.dart +++ b/mobile/test/features/channels/timeline_message_test.dart @@ -287,6 +287,53 @@ void main() { ); }); + // The relay reports a clear as a change carrying an empty string, so + // without the cleared branch this reads: changed the topic to "". + test('a blank topic or purpose reads as cleared', () { + for (final blank in [null, '', ' \n\t ']) { + expect( + SystemEvent( + type: SystemEventType.topicChanged, + actorPubkey: 'pk1', + topic: blank, + ).describe(resolve), + 'Alice cleared the topic', + ); + expect( + SystemEvent( + type: SystemEventType.purposeChanged, + actorPubkey: 'pk1', + purpose: blank, + ).describe(resolve), + 'Alice cleared the purpose', + ); + } + }); + + test('no caption announces empty quotes', () { + for (final value in [null, '', ' ', 'Real topic']) { + expect( + SystemEvent( + type: SystemEventType.topicChanged, + actorPubkey: 'pk1', + topic: value, + ).describe(resolve), + isNot(contains('""')), + ); + } + }); + + test('surrounding whitespace is trimmed out of the quotes', () { + expect( + SystemEvent( + type: SystemEventType.topicChanged, + actorPubkey: 'pk1', + topic: ' Release v2 ', + ).describe(resolve), + 'Alice changed the topic to "Release v2"', + ); + }); + test('channel_created', () { final event = SystemEvent( type: SystemEventType.channelCreated, From f3e5e812677f6f14bffe16a7aa02642d56faca4b Mon Sep 17 00:00:00 2001 From: Alex Kemper Date: Thu, 30 Jul 2026 18:54:41 -0400 Subject: [PATCH 098/112] fix(catalog): update Amp tagline (#3806) ## Summary Update Amp's runtime catalog description to use its current tagline: > The coding agent and development environment that runs anywhere and everywhere. ### Related issue N/A. This follows the Amp description update in https://github.com/block/buzz/pull/3758. ### Testing * `pnpm -C desktop check` * `pnpm -C desktop typecheck` * `pnpm -C desktop test` (3,835 passed) No screenshot is included because this changes only the catalog description text. It does not change layout or interaction behavior. Signed-off-by: AJKemps Co-authored-by: AJKemps Co-authored-by: Alex Kemper --- desktop/src/features/settings/ui/harnessCatalogCopy.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/desktop/src/features/settings/ui/harnessCatalogCopy.ts b/desktop/src/features/settings/ui/harnessCatalogCopy.ts index 70439091b2..9a71ff70f9 100644 --- a/desktop/src/features/settings/ui/harnessCatalogCopy.ts +++ b/desktop/src/features/settings/ui/harnessCatalogCopy.ts @@ -36,7 +36,7 @@ const HARNESS_DESCRIPTIONS: Record = { // https://moonshotai.github.io/kimi-cli/en/ kimi: "A terminal coding agent for software development and command-line tasks.", // Sources: https://ampcode.com, https://ampcode.com/manual - amp: "A coding agent for your terminal and editor.", + amp: "The coding agent and development environment that runs anywhere and everywhere.", // Sources: https://github.com/NousResearch/hermes-agent, // https://hermes-agent.nousresearch.com/docs/ hermes: "A general-purpose AI agent from Nous Research.", From 468647a51f858b29d27eaf9fd07bf90294f99d39 Mon Sep 17 00:00:00 2001 From: Tyler <109685178+tlongwell-block@users.noreply.github.com> Date: Thu, 30 Jul 2026 20:58:03 -0400 Subject: [PATCH 099/112] feat(desktop): locally stored NIP-49 encrypted key backup (#2937) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Adds a locally stored **NIP-49 encrypted key backup** (`ncryptsec`) to the desktop app, per the plan reviewed in buzz-development (Rev 3, approved 9/10 by Wren; implementation also reviewed and approved 9/10). **Two-artifact design — canonical bytes originate entirely in Rust:** - `create_ncryptsec_backup` runs under the `identity_mutation` lock: encrypt → decrypt-verify against the live pubkey → atomic `0o600` write to `{app_data_dir}/identity.ncryptsec` → reread/byte-compare → return the exact persisted bytes. The frontend never re-derives or re-encrypts. - `save_ncryptsec_copy` writes a portable copy via the save dialog (parse-gated, secret-file semantics) and never mutates canonical state. - `generate_backup_passphrase`: 6 words from the EFF short wordlist via `OsRng` (custom passphrases min 12 chars). - Import accepts `ncryptsec1` with optional password; the raw-`nsec` path is untouched. Different-pubkey import and sign-out wipe the app-managed backup (post-commit, best-effort — a failed import can never destroy the still-live identity's backup; regression-tested). **Never-relay guarantee (egress guard + tripwires):** - `egress_guard.rs` fail-closed at all 8 `/events` submission boundaries (relay submit funnel, 3× `relay.rs`, huddle STT, both engram submitters, native WS choke point), rejecting `ncryptsec1`/`NCRYPTSEC1` in text and binary frames. Scope is deliberately ncryptsec-only: pairing intentionally carries raw nsec inside its encrypted session. - Site-granular `/events` inventory tripwire: per-file (`/events` count, guard-call count) pairs; unlisted files expect zero. Mutation-style tests prove a ninth site in an existing file, a removed guard, and a new unlisted file all fail the scan. - ncryptsec source-allowlist scans in **both** trees (Rust + TS). **Frontend:** onboarding `BackupStep` is encrypted-by-default — the default path never invokes `get_nsec` (e2e asserts the command log). Raw-nsec export stays behind an explicit click with prior semantics. Shared `EncryptedBackupCreator` powers onboarding + a new settings row; the import form auto-switches to encrypted mode on `ncryptsec1` paste (case-insensitive HRP). **Open product call for @tlongwell-block:** onboarding default is *encrypted* in this PR; flipping to raw-default is a small change either way (documented in the plan). Review history: plan Rev 3 and the implementation were both iterated with Wren to 9/10 (two blockers from round 1 — import ordering, inventory granularity — plus an uppercase-bech32 hardening gap, all fixed in `dde37183e`). Thread: buzz-development. ### Related issue Follow-up to the direction explored in #385 (NIP-PB, closed) — this ships local NIP-49 (the standard) instead of a new NIP. No open duplicate found. ### Testing All at exactly `dde37183e` (same shell, HEAD verified): - `cargo test` — 1680 passed / 0 failed / 14 ignored (includes a deliberate ~70s log_n-18 NIP-49 round trip, spec vector, wrong-password, NFKC, uppercase-vector decrypt, injection test per egress boundary, inventory mutation tests, import-ordering regression tests) - `cargo clippy --all-targets -- -D warnings` — clean; `cargo fmt --check` — clean - `pnpm typecheck` — clean; JS unit suite 3529/3529; biome (repo-pinned 2.4.16) clean - Playwright `onboarding-backup` / `onboarding` / `onboarding-agent-defaults` / `profile-nsec-reveal` — 86 passed, 1 known avatar-reservation flake (passed on rerun; untouched by this diff). `passThroughBackupStep` now exercises the encrypted default, so every downstream onboarding spec covers the new path. - Note: browser e2e fakes the crypto via the mock bridge (fixed spec-vector blob); decryption correctness is proven in the Rust tests. ## Latest onboarding integration The current head adds an additive `IdentityInfo.storage` field (`ephemeral`, `system-keyring`, `local-file`, or `environment`) so onboarding can accurately explain where the active identity is protected. It surfaces storage metadata only—never key material—and leaves the existing lost/keyring-locked recovery behavior intact. --------- Signed-off-by: Tyler Longwell Signed-off-by: Taylor Ho Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Tyler Longwell Co-authored-by: Taylor Ho Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> --- .../texture-card/generate-card-texture.mjs | 159 ++-- desktop/src-tauri/src/app_state.rs | 97 +- desktop/src-tauri/src/app_state_tests.rs | 12 +- desktop/src-tauri/src/commands/identity.rs | 117 ++- desktop/src-tauri/src/identity_storage.rs | 62 ++ desktop/src-tauri/src/key_backup.rs | 47 + desktop/src-tauri/src/key_backup_tests.rs | 79 +- desktop/src-tauri/src/lib.rs | 1 + desktop/src-tauri/src/models.rs | 2 + desktop/src-tauri/src/reset.rs | 20 + .../onboarding/lib/encryptedBackup.test.mjs | 118 +++ .../onboarding/lib/encryptedBackup.ts | 135 +++ .../onboarding/lib/keyImportInput.test.mjs | 73 ++ .../features/onboarding/lib/keyImportInput.ts | 127 +++ .../onboarding/ui/BackupPasswordTimeline.tsx | 130 +++ .../src/features/onboarding/ui/BackupStep.tsx | 495 +++++++--- .../features/onboarding/ui/BackupTestFlow.tsx | 745 +++++++++++++++ .../onboarding/ui/DownloadKeyStep.tsx | 139 +++ .../onboarding/ui/EncryptedBackupCreator.tsx | 885 ++++++++++++++++++ .../onboarding/ui/KeyringLockedScreen.tsx | 4 +- .../onboarding/ui/MachineOnboardingFlow.tsx | 158 +++- .../onboarding/ui/NostrKeyImportForm.tsx | 561 ++++++----- .../onboarding/ui/OnboardingChrome.tsx | 15 +- .../features/onboarding/ui/OnboardingFlow.tsx | 4 +- .../ui/OnboardingSlideTransition.tsx | 1 + .../src/features/onboarding/ui/SetupStep.tsx | 41 +- .../ui/onboardingFlowSteps.test.mjs | 24 +- .../features/settings/ui/SignOutSection.tsx | 38 +- desktop/src/shared/api/identityTypes.ts | 28 + desktop/src/shared/api/tauriIdentity.ts | 11 +- desktop/src/shared/api/types.ts | 20 +- .../shared/lib/ncryptsecSourceScan.test.mjs | 74 ++ .../src/shared/styles/globals/components.css | 85 +- desktop/src/shared/ui/alert-dialog.tsx | 69 +- .../shared/ui/assets/card-texture-compact.png | Bin 0 -> 232377 bytes .../ui/assets/card-texture-dark-compact.png | Bin 0 -> 328178 bytes .../shared/ui/assets/card-texture-dark.png | Bin 0 -> 1678571 bytes desktop/src/shared/ui/card-texture.css | 47 +- desktop/src/shared/ui/card.tsx | 46 +- desktop/src/shared/ui/popover.tsx | 73 +- desktop/src/testing/e2eBridge.ts | 65 +- desktop/tests/e2e/harness-management.spec.ts | 9 +- desktop/tests/e2e/onboarding-backup.spec.ts | 333 ++++++- .../onboarding-docked-cta-screenshots.spec.ts | 99 +- desktop/tests/e2e/onboarding.spec.ts | 125 +++ .../tests/e2e/signout-confirmation.spec.ts | 34 +- desktop/tests/helpers/fileDrag.ts | 52 + desktop/tests/helpers/onboarding.ts | 3 +- 48 files changed, 4728 insertions(+), 734 deletions(-) create mode 100644 desktop/src-tauri/src/identity_storage.rs create mode 100644 desktop/src/features/onboarding/lib/encryptedBackup.test.mjs create mode 100644 desktop/src/features/onboarding/lib/encryptedBackup.ts create mode 100644 desktop/src/features/onboarding/lib/keyImportInput.test.mjs create mode 100644 desktop/src/features/onboarding/lib/keyImportInput.ts create mode 100644 desktop/src/features/onboarding/ui/BackupPasswordTimeline.tsx create mode 100644 desktop/src/features/onboarding/ui/BackupTestFlow.tsx create mode 100644 desktop/src/features/onboarding/ui/DownloadKeyStep.tsx create mode 100644 desktop/src/features/onboarding/ui/EncryptedBackupCreator.tsx create mode 100644 desktop/src/shared/api/identityTypes.ts create mode 100644 desktop/src/shared/lib/ncryptsecSourceScan.test.mjs create mode 100644 desktop/src/shared/ui/assets/card-texture-compact.png create mode 100644 desktop/src/shared/ui/assets/card-texture-dark-compact.png create mode 100644 desktop/src/shared/ui/assets/card-texture-dark.png create mode 100644 desktop/tests/helpers/fileDrag.ts diff --git a/desktop/scripts/texture-card/generate-card-texture.mjs b/desktop/scripts/texture-card/generate-card-texture.mjs index 75cc24e744..57ebc61a9b 100644 --- a/desktop/scripts/texture-card/generate-card-texture.mjs +++ b/desktop/scripts/texture-card/generate-card-texture.mjs @@ -12,83 +12,116 @@ import path from "node:path"; import { fileURLToPath } from "node:url"; const HERE = path.dirname(fileURLToPath(import.meta.url)); -const OUTPUT = path.resolve( - HERE, - "../../src/shared/ui/assets/card-texture.png", -); - -// CSS-pixel source geometry. Screenshotting at DPR 2 produces a crisp asset. -const CARD_SIZE = 640; -const OUTSET = 96; -const CAPTURE_SIZE = CARD_SIZE + OUTSET * 2; +const OUTPUT_DIRECTORY = path.resolve(HERE, "../../src/shared/ui/assets"); const DPR = 2; // Approved texture parameters, archived from the former runtime SVG filter. -const BLUR = 66; -const DILATE = Math.round(BLUR * 0.85); const THRESHOLD_BIAS = 0.302; const SLOPE = 8; const FREQUENCY = 0.999; const OCTAVES = 3; const SEED = 5315; -await mkdir(path.dirname(OUTPUT), { recursive: true }); +const TEXTURES = [ + { + filename: "card-texture.png", + color: "white", + cardSize: 640, + outset: 96, + blur: 66, + innerBand: 112, + }, + { + filename: "card-texture-dark.png", + color: "#171b21", + cardSize: 640, + outset: 96, + blur: 66, + innerBand: 112, + }, + { + filename: "card-texture-compact.png", + color: "white", + cardSize: 320, + outset: 24, + blur: 24, + innerBand: 44, + }, + { + filename: "card-texture-dark-compact.png", + color: "#171b21", + cardSize: 320, + outset: 24, + blur: 24, + innerBand: 44, + }, +]; + +await mkdir(OUTPUT_DIRECTORY, { recursive: true }); const browser = await chromium.launch(); try { - const page = await browser.newPage({ - deviceScaleFactor: DPR, - viewport: { height: CAPTURE_SIZE, width: CAPTURE_SIZE }, - }); + for (const texture of TEXTURES) { + const captureSize = texture.cardSize + texture.outset * 2; + const dilate = Math.round(texture.blur * 0.85); + const output = path.join(OUTPUT_DIRECTORY, texture.filename); + const page = await browser.newPage({ + deviceScaleFactor: DPR, + viewport: { height: captureSize, width: captureSize }, + }); - await page.setContent(` - -

- - -
`); + await page.setContent(` + +
+ + +
`); - await page.locator("#stage").screenshot({ - omitBackground: true, - path: OUTPUT, - }); + await page.locator("#stage").screenshot({ + omitBackground: true, + path: output, + }); + await page.close(); + + console.log(`Generated ${output}`); + console.log(`Asset: ${captureSize * DPR}×${captureSize * DPR}px @${DPR}x`); + console.log( + `Runtime slice: ${(texture.outset + texture.innerBand) * DPR}px; outset: ${texture.outset}px`, + ); + } } finally { await browser.close(); } - -console.log(`Generated ${OUTPUT}`); -console.log(`Asset: ${CAPTURE_SIZE * DPR}×${CAPTURE_SIZE * DPR}px @${DPR}x`); -console.log(`Runtime slice: ${(OUTSET + 112) * DPR}px; outset: ${OUTSET}px`); diff --git a/desktop/src-tauri/src/app_state.rs b/desktop/src-tauri/src/app_state.rs index 94d162e620..abce86202a 100644 --- a/desktop/src-tauri/src/app_state.rs +++ b/desktop/src-tauri/src/app_state.rs @@ -2,7 +2,7 @@ use std::{ collections::HashMap, io::Write, sync::{ - atomic::{AtomicBool, AtomicU16}, + atomic::{AtomicBool, AtomicU16, AtomicU8}, Arc, Mutex, }, }; @@ -13,10 +13,15 @@ use tauri::{AppHandle, Manager}; use tokio::sync::Mutex as AsyncMutex; use crate::huddle::HuddleState; +pub(crate) use crate::identity_storage::{IdentityStorage, RecoveryState, ResolvedIdentity}; use crate::managed_agents::config_bridge::SessionConfigCache; use crate::managed_agents::{ManagedAgentPairRuntime, ManagedAgentRuntimeKey}; + pub struct AppState { pub keys: Mutex, + /// Durable backend holding `keys`. Updated after the key write and before + /// recovery flags are cleared so `get_identity` reports a consistent state. + pub(crate) identity_storage: AtomicU8, pub http_client: reqwest::Client, /// A no-redirect client for authenticated relay media fetches (download, /// clipboard copy, snapshot, editor). Every caller pre-validates the URL @@ -178,19 +183,20 @@ pub fn build_media_fetch_client() -> reqwest::Result { pub fn build_app_state() -> AppState { // Env var takes precedence (dev/CI). If absent, resolve_persisted_identity() // in setup() will replace the ephemeral placeholder with a persisted key. - let keys = match identity_from_env() { + let (keys, identity_storage) = match identity_from_env() { Some(keys) => { eprintln!( "buzz-desktop: configured identity pubkey {}", keys.public_key().to_hex() ); - keys + (keys, IdentityStorage::Environment) } - None => Keys::generate(), + None => (Keys::generate(), IdentityStorage::Ephemeral), }; AppState { keys: Mutex::new(keys), + identity_storage: AtomicU8::new(identity_storage as u8), http_client: reqwest::Client::builder() .resolve("localhost", std::net::SocketAddr::from(([127, 0, 0, 1], 0))) .pool_idle_timeout(std::time::Duration::from_secs(10)) @@ -366,9 +372,13 @@ pub fn resolve_persisted_identity(app: &AppHandle, state: &AppState) -> Result<( std::fs::create_dir_all(&data_dir).map_err(|e| format!("create app data dir: {e}"))?; let resolved = load_or_create_identity(&data_dir)?; - // Write keys before setting the recovery flags (Release) so any thread - // that reads a flag as false with Acquire is guaranteed to see the keys. - *state.keys.lock().map_err(|e| e.to_string())? = resolved.keys; + // Write keys and storage before setting the recovery flags (Release) so + // any thread that reads a flag as false with Acquire sees consistent data. + { + let mut active_keys = state.keys.lock().map_err(|e| e.to_string())?; + *active_keys = resolved.keys; + state.set_identity_storage(resolved.storage); + } state.identity_lost.store( resolved.recovery == RecoveryState::Lost, std::sync::atomic::Ordering::Release, @@ -394,26 +404,6 @@ const IDENTITY_KEY_NAME: &str = "identity"; /// keyring is merely unreachable (the key IS in the keyring, must NOT generate). const MIGRATION_MARKER_NAME: &str = "identity.migrated"; -/// Recovery state produced by identity resolution. `None` means the app has -/// a real, usable identity. `Lost` means the keyring was reachable-but-empty -/// despite a prior successful migration — the key vanished externally. `KeyringLocked` -/// means the keyring is unreachable this boot but was used in the past -/// (marker present, no file) — the key still exists but is temporarily -/// inaccessible. Both non-`None` variants boot with an ephemeral key; the -/// frontend shows a different recovery screen for each. -#[derive(Debug, Clone, Copy, PartialEq, Eq)] -enum RecoveryState { - None, - Lost, - KeyringLocked, -} - -/// The output of identity resolution. -struct ResolvedIdentity { - keys: Keys, - recovery: RecoveryState, -} - /// The keyring operations the identity resolution flow needs. Abstracted so the /// corrupt-keyring recovery decision ([`recover_from_keyring`]) can be /// unit-tested against a fake without touching the live OS keyring. @@ -465,6 +455,7 @@ fn load_or_create_identity(data_dir: &std::path::Path) -> Result Result<(), String> { +) -> Result { match persist_identity_to_keyring(store, keys, legacy_path, data_dir) { - Ok(()) => Ok(()), + Ok(()) => Ok(IdentityStorage::SystemKeyring), Err(e) => { eprintln!( "buzz-desktop: keyring write failed during import ({e}), \ falling back to identity.key" ); - save_key_file(legacy_path, keys) + save_key_file(legacy_path, keys)?; + Ok(IdentityStorage::LocalFile) } } } @@ -892,7 +897,7 @@ pub(crate) fn persist_imported_identity( keys: &Keys, legacy_path: &std::path::Path, data_dir: &std::path::Path, -) -> Result<(), String> { +) -> Result { persist_imported_identity_impl(store, keys, legacy_path, data_dir) } @@ -920,15 +925,6 @@ fn write_migration_marker(marker_path: &std::path::Path) -> Result<(), String> { .map_err(|e| format!("commit migration marker: {e}")) } -/// Which backend [`store_key_preferring_keyring`] wrote to. The caller writes -/// the migration marker only after a keyring success — on the file-fallback arm -/// the key is on disk and a marker would wrongly trip the next Unreachable boot -/// into failing closed. -enum PersistBackend { - Keyring, - File, -} - /// Generate a fresh identity, persist it through the store, return it. /// /// On a keyring-backed persist no file is written, so a later @@ -940,9 +936,10 @@ fn generate_and_persist( store: &impl IdentityKeyStore, legacy_path: &std::path::Path, data_dir: &std::path::Path, -) -> Result { +) -> Result<(Keys, IdentityStorage), String> { let keys = Keys::generate(); - if let PersistBackend::Keyring = store_key_preferring_keyring(store, &keys, legacy_path)? { + let storage = store_key_preferring_keyring(store, &keys, legacy_path)?; + if storage == IdentityStorage::SystemKeyring { let marker_path = migration_marker_path(data_dir); if let Err(e) = write_migration_marker(&marker_path) { eprintln!( @@ -956,7 +953,7 @@ fn generate_and_persist( "buzz-desktop: generated and saved identity pubkey {}", keys.public_key().to_hex() ); - Ok(keys) + Ok((keys, storage)) } /// Persist `keys` through the store, silently falling back to the `0o600` file @@ -968,17 +965,17 @@ fn store_key_preferring_keyring( store: &impl IdentityKeyStore, keys: &Keys, legacy_path: &std::path::Path, -) -> Result { +) -> Result { let nsec = keys .secret_key() .to_bech32() .map_err(|e| format!("encode nsec: {e}"))?; match store.store(IDENTITY_KEY_NAME, &nsec) { - Ok(()) => Ok(PersistBackend::Keyring), + Ok(()) => Ok(IdentityStorage::SystemKeyring), Err(keyring_err) => { eprintln!("buzz-desktop: keyring write failed ({keyring_err}), using file fallback"); save_key_file(legacy_path, keys)?; - Ok(PersistBackend::File) + Ok(IdentityStorage::LocalFile) } } } diff --git a/desktop/src-tauri/src/app_state_tests.rs b/desktop/src-tauri/src/app_state_tests.rs index 485dfaea15..751bcf22e5 100644 --- a/desktop/src-tauri/src/app_state_tests.rs +++ b/desktop/src-tauri/src/app_state_tests.rs @@ -484,7 +484,7 @@ fn fresh_keyring_generate_writes_marker() { let resolved = resolve_identity_with_store(&store, &legacy_path, dir.path()).unwrap(); // The key was stored in the keyring (not the file), and the marker marks it. - assert!(!legacy_path.exists()); + assert!(!legacy_path.exists() && resolved.storage == IdentityStorage::SystemKeyring); assert!(migration_marker_path(dir.path()).exists()); assert_eq!( store @@ -541,7 +541,10 @@ fn fresh_generate_keyring_failure_falls_back_to_file_without_marker() { let from_file = load_key_file(&legacy_path).unwrap(); assert_key_eq(&resolved.keys, &from_file); // No marker: the file is the authoritative store, not the keyring. - assert!(!migration_marker_path(dir.path()).exists()); + assert!( + !migration_marker_path(dir.path()).exists() + && resolved.storage == IdentityStorage::LocalFile + ); } // ── New tests for the three defects fixed in this PR ───────────────────── @@ -786,10 +789,7 @@ fn persist_imported_identity_falls_back_to_file_on_keyring_failure() { let result = persist_imported_identity_impl(&store, &imported_keys, &legacy_path, dir.path()); // The policy core handles the keyring failure — Ok, not Err. - assert!( - result.is_ok(), - "must not propagate keyring failure when file fallback succeeds" - ); + assert_eq!(result.unwrap(), IdentityStorage::LocalFile); // Key is recoverable from the file on next boot. let from_file = load_key_file(&legacy_path).unwrap(); diff --git a/desktop/src-tauri/src/commands/identity.rs b/desktop/src-tauri/src/commands/identity.rs index 142e3bac88..33ecf3cfca 100644 --- a/desktop/src-tauri/src/commands/identity.rs +++ b/desktop/src-tauri/src/commands/identity.rs @@ -43,6 +43,7 @@ pub fn get_identity(state: State<'_, AppState>) -> Result Ok(IdentityInfo { pubkey: pubkey_hex, display_name, + storage: state.identity_storage().as_str().to_string(), lost, locked, reset_failed, @@ -334,11 +335,17 @@ pub async fn save_ncryptsec_copy( #[tauri::command] pub async fn import_identity( nsec: String, + password: Option, app_handle: tauri::AppHandle, ) -> Result { tokio::task::spawn_blocking(move || { - let trimmed = nsec.trim(); - let keys = Keys::parse(trimmed).map_err(|e| format!("Invalid private key: {e}"))?; + // NIP-49 backups require a passphrase and decrypt entirely in Rust. + // Raw nsec/hex input follows the existing parser path unchanged. + let password = password.map(zeroize::Zeroizing::new); + let keys = crate::key_backup::recover_keys_from_input( + &nsec, + password.as_ref().map(|value| value.as_str()), + )?; // Serialize against persist_current_identity: hold this guard for the // full function body so a concurrent stale persist can't overwrite @@ -353,30 +360,14 @@ pub async fn import_identity( std::fs::create_dir_all(&data_dir).map_err(|e| format!("create app data dir: {e}"))?; let key_path = data_dir.join("identity.key"); - // Persist into the OS keyring first (store → read-back verify → marker → - // delete file). Falls back to the 0o600 file when the keyring is - // unavailable; returns Err only when both backends fail. - let store = crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); - crate::app_state::persist_imported_identity(store, &keys, &key_path, &data_dir)?; - - // Update in-memory keys BEFORE clearing recovery flags. The Release - // stores below pair with Acquire loads in get_identity: a reader - // observing false is guaranteed to see the updated keys. - let pubkey = keys.public_key(); - *state.keys.lock().map_err(|e| e.to_string())? = keys; - - // Clear both recovery flags — an import is valid in either lost or - // keyring-locked state and resolves both. In the locked case the - // keyring is unreachable, so persist_imported_identity already fell - // back to identity.key; on the next Unreachable boot the file is - // loaded directly and when the keyring returns the adoption path - // picks it up. - state - .identity_lost - .store(false, std::sync::atomic::Ordering::Release); - state - .keyring_locked - .store(false, std::sync::atomic::Ordering::Release); + let (pubkey, storage) = commit_imported_identity(&state, &data_dir, keys, |keys| { + // Persist into the OS keyring first (store → read-back verify → + // marker → delete file). Falls back to the 0o600 file when the + // keyring is unavailable; returns Err only when both backends fail. + let store = + crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); + crate::app_state::persist_imported_identity(store, keys, &key_path, &data_dir) + })?; let pubkey_hex = pubkey.to_hex(); let display_name = truncated_display_name(&pubkey)?; @@ -386,6 +377,7 @@ pub async fn import_identity( Ok(IdentityInfo { pubkey: pubkey_hex, display_name, + storage: storage.as_str().to_string(), lost: false, locked: false, reset_failed: false, @@ -395,6 +387,69 @@ pub async fn import_identity( .map_err(|e| format!("spawn_blocking failed: {e}"))? } +/// Commit an imported identity: durably persist, swap in-memory keys, clear +/// recovery flags, then remove the previous identity's stale app-managed +/// backup. Caller must hold `state.identity_mutation`. +/// +/// Ordering is the contract: +/// +/// 1. `persist` runs FIRST. If it fails (`Err` from both keyring and file +/// fallback), nothing has changed — the previous identity stays live in +/// memory AND its valid canonical `identity.ncryptsec` stays on disk. +/// 2. Only after durable persistence do we swap `state.keys` and clear the +/// recovery flags. +/// 3. Stale-backup cleanup runs LAST and is deliberately best-effort: at that +/// point the import is durably committed, so reporting a cleanup failure +/// as a command `Err` would claim a half-applied import that actually +/// succeeded. The leftover blob is still passphrase-encrypted and is +/// replaced by the next backup creation; we log and move on. +fn commit_imported_identity( + state: &AppState, + data_dir: &std::path::Path, + keys: nostr::Keys, + persist: impl FnOnce(&nostr::Keys) -> Result, +) -> Result<(nostr::PublicKey, crate::app_state::IdentityStorage), String> { + // Capture the previous pubkey up front for post-commit cleanup. + let previous_pubkey = state.keys.lock().map_err(|e| e.to_string())?.public_key(); + + let storage = persist(&keys)?; + + // Update in-memory keys BEFORE clearing recovery flags. The Release + // stores below pair with Acquire loads in get_identity: a reader + // observing false is guaranteed to see the updated keys. + let pubkey = keys.public_key(); + { + let mut active_keys = state.keys.lock().map_err(|e| e.to_string())?; + *active_keys = keys; + state.set_identity_storage(storage); + } + + // Clear both recovery flags — an import is valid in either lost or + // keyring-locked state and resolves both. In the locked case the + // keyring is unreachable, so the persist step already fell back to + // identity.key; on the next Unreachable boot the file is loaded + // directly and when the keyring returns the adoption path picks it up. + state + .identity_lost + .store(false, std::sync::atomic::Ordering::Release); + state + .keyring_locked + .store(false, std::sync::atomic::Ordering::Release); + + // Importing a different identity invalidates the app-managed backup: it + // encrypts the previous key and must not linger mislabeled. Best-effort + // per the ordering contract above. + if let Err(e) = crate::key_backup::cleanup_stale_backup(&previous_pubkey, &pubkey, data_dir) { + eprintln!( + "buzz-desktop: import committed, but stale key backup cleanup failed: {e}; \ + the leftover identity.ncryptsec encrypts the PREVIOUS key and will be \ + replaced by the next backup creation" + ); + } + + Ok((pubkey, storage)) +} + /// Make the current ephemeral identity durable by persisting it to the OS /// keyring (or falling back to identity.key). This is called when the user /// chooses to start a new identity instead of re-importing their previous one @@ -438,11 +493,12 @@ pub async fn persist_current_identity( let key_path = data_dir.join("identity.key"); let store = crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); - crate::app_state::persist_imported_identity(store, &keys, &key_path, &data_dir)?; + let storage = + crate::app_state::persist_imported_identity(store, &keys, &key_path, &data_dir)?; - // Keys are already the live identity — only clear identity_lost. - // Release pairs with Acquire in get_identity so readers see - // consistent state. + // Keys are already the live identity. Record where the durable write + // landed before clearing identity_lost. + state.set_identity_storage(storage); state .identity_lost .store(false, std::sync::atomic::Ordering::Release); @@ -454,6 +510,7 @@ pub async fn persist_current_identity( Ok(IdentityInfo { pubkey: pubkey_hex, display_name, + storage: storage.as_str().to_string(), lost: false, locked: false, reset_failed: false, diff --git a/desktop/src-tauri/src/identity_storage.rs b/desktop/src-tauri/src/identity_storage.rs new file mode 100644 index 0000000000..b39c1a0331 --- /dev/null +++ b/desktop/src-tauri/src/identity_storage.rs @@ -0,0 +1,62 @@ +use nostr::Keys; + +use crate::app_state::AppState; + +/// Durable location of the active human identity. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +#[repr(u8)] +pub(crate) enum IdentityStorage { + Ephemeral = 0, + SystemKeyring = 1, + LocalFile = 2, + Environment = 3, +} + +impl IdentityStorage { + pub(crate) fn as_str(self) -> &'static str { + match self { + Self::Ephemeral => "ephemeral", + Self::SystemKeyring => "system-keyring", + Self::LocalFile => "local-file", + Self::Environment => "environment", + } + } + + fn from_u8(value: u8) -> Self { + match value { + 1 => Self::SystemKeyring, + 2 => Self::LocalFile, + 3 => Self::Environment, + _ => Self::Ephemeral, + } + } +} + +impl AppState { + pub(crate) fn identity_storage(&self) -> IdentityStorage { + IdentityStorage::from_u8( + self.identity_storage + .load(std::sync::atomic::Ordering::Acquire), + ) + } + + pub(crate) fn set_identity_storage(&self, storage: IdentityStorage) { + self.identity_storage + .store(storage as u8, std::sync::atomic::Ordering::Release); + } +} + +/// Recovery state produced by identity resolution. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub(crate) enum RecoveryState { + None, + Lost, + KeyringLocked, +} + +/// Identity and persistence metadata produced by startup resolution. +pub(crate) struct ResolvedIdentity { + pub(crate) keys: Keys, + pub(crate) recovery: RecoveryState, + pub(crate) storage: IdentityStorage, +} diff --git a/desktop/src-tauri/src/key_backup.rs b/desktop/src-tauri/src/key_backup.rs index 6396911aef..f97bf95a67 100644 --- a/desktop/src-tauri/src/key_backup.rs +++ b/desktop/src-tauri/src/key_backup.rs @@ -13,6 +13,10 @@ use nostr::nips::nip49::{EncryptedSecretKey, KeySecurity}; use nostr::{FromBech32, Keys, ToBech32}; +/// Bech32 prefix of NIP-49 encrypted secret keys. Import routing is +/// case-insensitive because bech32 permits all-uppercase encodings. +pub const NCRYPTSEC_HRP: &str = "ncryptsec1"; + /// scrypt cost for new backups (2^18 — Gossip's desktop default, ~256 MiB). /// The blob self-describes its cost, so this can be raised later without /// breaking existing backups. @@ -108,6 +112,27 @@ pub fn decrypt_ncryptsec(input: &str, password: &str) -> Result { Ok(Keys::new(secret_key)) } +/// Recover identity keys from either an encrypted NIP-49 backup or the raw +/// nsec/hex formats accepted before encrypted imports were added. +pub fn recover_keys_from_input(input: &str, password: Option<&str>) -> Result { + let trimmed = input.trim(); + let is_ncryptsec = trimmed + .get(..NCRYPTSEC_HRP.len()) + .is_some_and(|prefix| prefix.eq_ignore_ascii_case(NCRYPTSEC_HRP)); + + if is_ncryptsec { + let password = password.ok_or_else(|| "key backup requires a password".to_string())?; + decrypt_ncryptsec(trimmed, password) + } else { + Keys::parse(trimmed).map_err(|e| format!("Invalid private key: {e}")) + } +} + +/// Path of the canonical app-managed backup file. +pub fn backup_file_path(data_dir: &std::path::Path) -> std::path::PathBuf { + data_dir.join(BACKUP_FILE_NAME) +} + /// Atomically write `ncryptsec` to `path` with owner-only permissions, then /// reread and byte-compare. Same crash-safety pattern as /// `app_state::save_key_file`. @@ -140,6 +165,28 @@ pub fn write_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), Ok(()) } +/// Delete the app-managed backup if present. Missing files are already clean. +pub fn delete_backup_file(data_dir: &std::path::Path) -> Result<(), String> { + let path = backup_file_path(data_dir); + match std::fs::remove_file(path) { + Ok(()) => Ok(()), + Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()), + Err(e) => Err(format!("delete stale backup file: {e}")), + } +} + +/// Remove the app-managed backup only when an import changes identities. +pub fn cleanup_stale_backup( + previous: &nostr::PublicKey, + new: &nostr::PublicKey, + data_dir: &std::path::Path, +) -> Result<(), String> { + if previous != new { + delete_backup_file(data_dir)?; + } + Ok(()) +} + /// Generate a passphrase of `word_count` EFF short-wordlist words joined by /// `separator`, using OS entropy. /// diff --git a/desktop/src-tauri/src/key_backup_tests.rs b/desktop/src-tauri/src/key_backup_tests.rs index e5892ad99e..b9713201e1 100644 --- a/desktop/src-tauri/src/key_backup_tests.rs +++ b/desktop/src-tauri/src/key_backup_tests.rs @@ -79,12 +79,59 @@ fn verify_backup_blob_catches_pubkey_mismatch() { assert!(err.contains("does not match identity"), "{err}"); } +// ── Import key recovery ─────────────────────────────────────────────────────── + +#[test] +fn recover_keys_ncryptsec_happy_path() { + let keys = recover_keys_from_input(&format!(" {SPEC_NCRYPTSEC}\n"), Some("nostr")).unwrap(); + assert_eq!(keys.secret_key().to_secret_hex(), SPEC_SECRET_HEX); +} + +#[test] +fn recover_keys_ncryptsec_requires_password() { + let err = recover_keys_from_input(SPEC_NCRYPTSEC, None).unwrap_err(); + assert_eq!(err, "key backup requires a password"); +} + +#[test] +fn recover_keys_ncryptsec_wrong_password() { + let err = recover_keys_from_input(SPEC_NCRYPTSEC, Some("wrong")).unwrap_err(); + assert_eq!(err, "wrong backup password or damaged key backup"); +} + +#[test] +fn recover_keys_uppercase_ncryptsec_classifies_as_encrypted() { + let upper = SPEC_NCRYPTSEC.to_ascii_uppercase(); + assert_eq!( + recover_keys_from_input(&upper, None).unwrap_err(), + "key backup requires a password" + ); + let keys = recover_keys_from_input(&upper, Some("nostr")).unwrap(); + assert_eq!(keys.secret_key().to_secret_hex(), SPEC_SECRET_HEX); + + let mut mixed = SPEC_NCRYPTSEC.to_string(); + mixed.replace_range(0..1, "N"); + let err = recover_keys_from_input(&mixed, Some("nostr")).unwrap_err(); + assert!(err.contains("invalid ncryptsec"), "{err}"); +} + +#[test] +fn recover_keys_raw_nsec_path_unchanged() { + let keys = Keys::generate(); + let nsec = keys.secret_key().to_bech32().unwrap(); + let recovered = recover_keys_from_input(&nsec, Some("ignored")).unwrap(); + assert_eq!(recovered.public_key(), keys.public_key()); + let recovered = recover_keys_from_input(&nsec, None).unwrap(); + assert_eq!(recovered.public_key(), keys.public_key()); + assert!(recover_keys_from_input("garbage", None).is_err()); +} + // ── File lifecycle ──────────────────────────────────────────────────────────── #[test] fn write_backup_file_persists_0600_and_verifies() { let dir = tempfile::tempdir().unwrap(); - let path = dir.path().join(BACKUP_FILE_NAME); + let path = backup_file_path(dir.path()); write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); let on_disk = std::fs::read_to_string(&path).unwrap(); @@ -101,7 +148,7 @@ fn write_backup_file_persists_0600_and_verifies() { #[test] fn write_backup_file_overwrites_atomically() { let dir = tempfile::tempdir().unwrap(); - let path = dir.path().join(BACKUP_FILE_NAME); + let path = backup_file_path(dir.path()); write_backup_file(&path, "ncryptsec1old").unwrap(); write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); assert_eq!(std::fs::read_to_string(&path).unwrap(), SPEC_NCRYPTSEC); @@ -113,6 +160,34 @@ fn write_backup_file_overwrites_atomically() { assert_eq!(entries, vec![std::ffi::OsString::from(BACKUP_FILE_NAME)]); } +#[test] +fn delete_backup_file_is_idempotent() { + let dir = tempfile::tempdir().unwrap(); + delete_backup_file(dir.path()).unwrap(); + let path = backup_file_path(dir.path()); + write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); + delete_backup_file(dir.path()).unwrap(); + assert!(!path.exists()); +} + +#[test] +fn cleanup_stale_backup_removes_only_on_identity_change() { + let dir = tempfile::tempdir().unwrap(); + let path = backup_file_path(dir.path()); + let a = Keys::generate().public_key(); + let b = Keys::generate().public_key(); + + write_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); + cleanup_stale_backup(&a, &a, dir.path()).unwrap(); + assert!(path.exists(), "same identity must keep the backup"); + + cleanup_stale_backup(&a, &b, dir.path()).unwrap(); + assert!( + !path.exists(), + "identity change must remove the stale backup" + ); +} + #[test] fn generated_passphrase_respects_word_count_and_separator() { let words: std::collections::HashSet<&str> = diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs index 7dcc5994ae..ee2a98f5c1 100644 --- a/desktop/src-tauri/src/lib.rs +++ b/desktop/src-tauri/src/lib.rs @@ -8,6 +8,7 @@ mod egress_guard; mod event_sync; mod events; mod huddle; +mod identity_storage; mod key_backup; mod linux_media; mod managed_agents; diff --git a/desktop/src-tauri/src/models.rs b/desktop/src-tauri/src/models.rs index 1d9747bc20..3f04d3d7a1 100644 --- a/desktop/src-tauri/src/models.rs +++ b/desktop/src-tauri/src/models.rs @@ -6,6 +6,8 @@ use serde::{Deserialize, Deserializer, Serialize}; pub struct IdentityInfo { pub pubkey: String, pub display_name: String, + /// Durable location of the active identity key. + pub storage: String, /// True when the app booted with an ephemeral key because the OS keyring /// was empty despite a prior successful migration (key was externally /// deleted). The frontend routes to the nsec re-import step when true. diff --git a/desktop/src-tauri/src/reset.rs b/desktop/src-tauri/src/reset.rs index d2e35e6839..18ddd80eb8 100644 --- a/desktop/src-tauri/src/reset.rs +++ b/desktop/src-tauri/src/reset.rs @@ -463,6 +463,26 @@ mod tests { assert_eq!(kc.delete_calls.get(), 1, "keychain deleted once"); } + // ── NIP-49: the boot wipe destroys the app-managed key backup ───────────── + + #[test] + fn test_wipe_removes_app_managed_key_backup() { + let tmp = TempDir::new().unwrap(); + let app_data = make_app_data(&tmp); + let backup = crate::key_backup::backup_file_path(&app_data); + std::fs::write(&backup, b"encrypted-backup-bytes").unwrap(); + + write_sentinel(&app_data).unwrap(); + let kc = FakeKeychain::ok(); + let outcome = run_boot_reset_with_keychain(make_ctx(&app_data, &kc, false)); + + assert!(outcome.completed); + assert!( + !backup.exists(), + "sign-out wipe must destroy the app-managed key backup" + ); + } + // ── Test 3: keychain failure keeps sentinel ──────────────────────────────── #[test] diff --git a/desktop/src/features/onboarding/lib/encryptedBackup.test.mjs b/desktop/src/features/onboarding/lib/encryptedBackup.test.mjs new file mode 100644 index 0000000000..b570153185 --- /dev/null +++ b/desktop/src/features/onboarding/lib/encryptedBackup.test.mjs @@ -0,0 +1,118 @@ +import assert from "node:assert/strict"; +import test from "node:test"; +import { + MIN_PASSPHRASE_LEN, + downloadDisabled, + isEncrypting, + passphraseIssue, + pendingEncryptPassphrase, + effectivePassphrase, + encryptedBackupReducer, + initialEncryptedBackupState, +} from "./encryptedBackup.ts"; +const reduce = (events, from = initialEncryptedBackupState) => + events.reduce(encryptedBackupReducer, from); +test("password validation mirrors Rust character counting", () => { + assert.equal(passphraseIssue(""), null); + assert.match(passphraseIssue("short"), new RegExp(`${MIN_PASSPHRASE_LEN}`)); + const emoji = "😀".repeat(MIN_PASSPHRASE_LEN); + assert.equal(passphraseIssue(emoji), null); + assert.equal( + effectivePassphrase(reduce([{ type: "set-passphrase", value: emoji }])), + emoji, + ); +}); +test("valid password requests encryption without copying it into events", () => { + const ready = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + ]); + assert.equal(pendingEncryptPassphrase(ready), "one-two-three-four"); + const started = reduce([{ type: "encrypt-started", requestId: 1 }], ready); + assert.equal(isEncrypting(started), true); + assert.equal(started.requestId, 1); + assert.equal(Object.hasOwn(started, "encryptingPassphrase"), false); +}); +test("background encryption remains silent until download is clicked", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + ]); + assert.equal(state.passphrase, "one-two-three-four"); + assert.equal(state.encrypted, "ncryptsec1abc"); + assert.equal(state.ncryptsec, null); + assert.equal(state.savedPassword, false); + assert.equal(state.requestId, null); +}); +test("stale async completions cannot replace current request", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "set-passphrase", value: "five-six-seven-eight" }, + { type: "encrypt-started", requestId: 2 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1stale" }, + ]); + assert.equal(state.requestId, 2); + assert.equal(state.encrypted, null); + assert.equal(state.passphrase, "five-six-seven-eight"); +}); +test("failure clears submitted password", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "download-clicked" }, + { type: "encrypt-failed", requestId: 1, message: "keychain unavailable" }, + ]); + assert.equal(state.passphrase, ""); + assert.equal(state.createError, "keychain unavailable"); + assert.equal(state.downloadPending, false); + assert.equal(downloadDisabled(state), true); +}); +test("queued download commits and clears password", () => { + const state = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "download-clicked" }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + ]); + assert.equal(state.ncryptsec, "ncryptsec1abc"); + assert.equal(state.passphrase, ""); + assert.equal(state.savedPassword, true); +}); +test("Back preserves blob for immediate re-download without password", () => { + const made = reduce([ + { type: "set-passphrase", value: "one-two-three-four" }, + { type: "encrypt-started", requestId: 1 }, + { type: "encrypt-succeeded", requestId: 1, ncryptsec: "ncryptsec1abc" }, + { type: "download-clicked" }, + { type: "back-to-password" }, + ]); + assert.equal(made.ncryptsec, "ncryptsec1abc"); + assert.equal(made.passphrase, ""); + assert.equal(downloadDisabled(made), false); +}); +test("starting over discards blob and invalidates late requests", () => { + const made = { + ...initialEncryptedBackupState, + ncryptsec: "ncryptsec1abc", + encrypted: "ncryptsec1abc", + savedPassword: true, + nextRequestId: 3, + }; + const fresh = reduce([{ type: "start-new-backup" }], made); + assert.equal(fresh.ncryptsec, null); + assert.equal(fresh.nextRequestId, 4); + assert.equal( + reduce( + [ + { + type: "encrypt-succeeded", + requestId: 2, + ncryptsec: "ncryptsec1stale", + }, + ], + fresh, + ).ncryptsec, + null, + ); +}); diff --git a/desktop/src/features/onboarding/lib/encryptedBackup.ts b/desktop/src/features/onboarding/lib/encryptedBackup.ts new file mode 100644 index 0000000000..2f7d4a0bb0 --- /dev/null +++ b/desktop/src/features/onboarding/lib/encryptedBackup.ts @@ -0,0 +1,135 @@ +/** Pure state model for NIP-49 backup creation. */ +export const MIN_PASSPHRASE_LEN = 12; + +export type EncryptedBackupState = { + passphrase: string; + requestId: number | null; + nextRequestId: number; + encrypted: string | null; + createError: string | null; + downloadPending: boolean; + ncryptsec: string | null; + savedPassword: boolean; +}; + +export const initialEncryptedBackupState: EncryptedBackupState = { + passphrase: "", + requestId: null, + nextRequestId: 1, + encrypted: null, + createError: null, + downloadPending: false, + ncryptsec: null, + savedPassword: false, +}; + +export type EncryptedBackupEvent = + | { type: "set-passphrase"; value: string } + | { type: "encrypt-started"; requestId: number } + | { type: "encrypt-succeeded"; requestId: number; ncryptsec: string } + | { type: "encrypt-failed"; requestId: number; message: string } + | { type: "download-clicked" } + | { type: "back-to-password" } + | { type: "start-new-backup" }; + +export function encryptedBackupReducer( + state: EncryptedBackupState, + event: EncryptedBackupEvent, +): EncryptedBackupState { + switch (event.type) { + case "set-passphrase": + return { + ...state, + passphrase: event.value, + encrypted: null, + createError: null, + }; + case "encrypt-started": + return { + ...state, + requestId: event.requestId, + nextRequestId: Math.max(state.nextRequestId, event.requestId + 1), + createError: null, + }; + case "encrypt-succeeded": + if (event.requestId !== state.requestId) return state; + if (state.downloadPending) { + return { + ...state, + passphrase: "", + requestId: null, + encrypted: event.ncryptsec, + ncryptsec: event.ncryptsec, + downloadPending: false, + savedPassword: true, + }; + } + return { + ...state, + requestId: null, + encrypted: event.ncryptsec, + }; + case "encrypt-failed": + if (event.requestId !== state.requestId) return state; + return { + ...state, + passphrase: "", + requestId: null, + createError: event.message, + downloadPending: false, + }; + case "download-clicked": + if ( + state.ncryptsec || + state.downloadPending || + (!state.encrypted && !effectivePassphrase(state)) + ) + return state; + return state.encrypted + ? { + ...state, + ncryptsec: state.encrypted, + passphrase: "", + savedPassword: true, + } + : { ...state, downloadPending: true }; + case "back-to-password": + return { ...state, createError: null }; + case "start-new-backup": + return { + ...initialEncryptedBackupState, + nextRequestId: state.nextRequestId + 1, + }; + } +} + +export function passphraseIssue(passphrase: string): string | null { + if (passphrase.length === 0) return null; + return [...passphrase].length < MIN_PASSPHRASE_LEN + ? `Use at least ${MIN_PASSPHRASE_LEN} characters.` + : null; +} +export function effectivePassphrase( + state: EncryptedBackupState, +): string | null { + return [...state.passphrase].length < MIN_PASSPHRASE_LEN + ? null + : state.passphrase; +} +export function pendingEncryptPassphrase( + state: EncryptedBackupState, +): string | null { + if (state.savedPassword || state.encrypted || state.requestId !== null) + return null; + return effectivePassphrase(state); +} +export function isEncrypting(state: EncryptedBackupState): boolean { + return state.requestId !== null; +} +export function downloadDisabled(state: EncryptedBackupState): boolean { + if (state.savedPassword && state.ncryptsec) return false; + return ( + state.downloadPending || + (!state.encrypted && effectivePassphrase(state) === null) + ); +} diff --git a/desktop/src/features/onboarding/lib/keyImportInput.test.mjs b/desktop/src/features/onboarding/lib/keyImportInput.test.mjs new file mode 100644 index 0000000000..bc0bb4b4d7 --- /dev/null +++ b/desktop/src/features/onboarding/lib/keyImportInput.test.mjs @@ -0,0 +1,73 @@ +/** + * Pure-logic tests for key-import input classification (nsec vs NIP-49 + * ncryptsec) and submit gating. + */ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { nsecEncode } from "nostr-tools/nip19"; +import { generateSecretKey } from "nostr-tools/pure"; +import { + classifyKeyImportInput, + isPlausibleNcryptsec, + keyImportSubmitEnabled, + NCRYPTSEC_ENCODED_LENGTH, +} from "./keyImportInput.ts"; + +// NIP-49 spec vector — structurally valid encrypted backup. +const NCRYPTSEC = + "ncryptsec1qgg9947rlpvqu76pj5ecreduf9jxhselq2nae2kghhvd5g7dgjtcxfqtd67p9m0w57lspw8gsq6yphnm8623nsl8xn9j4jdzz84zm3frztj3z7s35vpzmqf6ksu8r89qk5z2zxfmu5gv8th8wclt0h4p"; + +const VALID_NSEC = nsecEncode(generateSecretKey()); + +test("classify_by_hrp_with_whitespace_tolerance", () => { + assert.equal(classifyKeyImportInput(` ${NCRYPTSEC}\n`), "ncryptsec"); + assert.equal(classifyKeyImportInput(VALID_NSEC), "nsec"); + assert.equal(classifyKeyImportInput("npub1whatever"), "unknown"); + assert.equal(classifyKeyImportInput(""), "unknown"); + // nsec must not be shadowed by the longer HRP check. + assert.equal(classifyKeyImportInput("nsec1"), "nsec"); +}); + +test("uppercase_bech32_encoding_classifies_and_gates_like_lowercase", () => { + // Bech32 permits an all-uppercase encoding; it must route to the + // encrypted path (matching Rust) and be submit-plausible. + const upper = NCRYPTSEC.toUpperCase(); + assert.equal(classifyKeyImportInput(upper), "ncryptsec"); + assert.equal(isPlausibleNcryptsec(upper), true); + assert.equal(keyImportSubmitEnabled(upper, ""), false); + assert.equal(keyImportSubmitEnabled(upper, "hunter2hunter2"), true); + // Mixed case: routed encrypted (Rust reports the accurate error) but + // never plausible/submittable — mixed-case bech32 cannot decode. + const mixed = `N${NCRYPTSEC.slice(1)}`; + assert.equal(classifyKeyImportInput(mixed), "ncryptsec"); + assert.equal(isPlausibleNcryptsec(mixed), false); + assert.equal(keyImportSubmitEnabled(mixed, "hunter2hunter2"), false); +}); + +test("plausible_ncryptsec_requires_complete_checksummed_nip49_payload", () => { + assert.equal(NCRYPTSEC.length, NCRYPTSEC_ENCODED_LENGTH); + assert.equal(isPlausibleNcryptsec(NCRYPTSEC), true); + assert.equal(isPlausibleNcryptsec(` ${NCRYPTSEC}\n`), true); + assert.equal(isPlausibleNcryptsec(NCRYPTSEC.slice(0, -1)), false); + assert.equal(isPlausibleNcryptsec(`${NCRYPTSEC}q`), false); + // Same length and charset, but a changed checksum must not advance the UI. + assert.equal(isPlausibleNcryptsec(`${NCRYPTSEC.slice(0, -1)}q`), false); + // '1' and 'b' / 'i' / 'o' are not in the Bech32 data charset. + assert.equal(isPlausibleNcryptsec("ncryptsec1bio"), false); + assert.equal(isPlausibleNcryptsec("ncryptsec1"), false); + assert.equal(isPlausibleNcryptsec("ncryptsec1 with spaces"), false); +}); + +test("submit_gating_nsec_path_unchanged", () => { + assert.equal(keyImportSubmitEnabled(VALID_NSEC, ""), true); + assert.equal(keyImportSubmitEnabled("nsec1garbage", ""), false); + assert.equal(keyImportSubmitEnabled("", ""), false); +}); + +test("submit_gating_ncryptsec_requires_passphrase", () => { + assert.equal(keyImportSubmitEnabled(NCRYPTSEC, ""), false); + assert.equal(keyImportSubmitEnabled(NCRYPTSEC, "hunter2hunter2"), true); + // Structurally implausible blob never submits, passphrase or not. + assert.equal(keyImportSubmitEnabled("ncryptsec1bio", "hunter2"), false); +}); diff --git a/desktop/src/features/onboarding/lib/keyImportInput.ts b/desktop/src/features/onboarding/lib/keyImportInput.ts new file mode 100644 index 0000000000..0f6fc609ed --- /dev/null +++ b/desktop/src/features/onboarding/lib/keyImportInput.ts @@ -0,0 +1,127 @@ +/** + * Pure classification + submit gating for the key-import form, unit-testable + * without a DOM. + * + * `ncryptsec1…` is a NIP-49 encrypted backup: no npub preview is possible + * (the pubkey is inside the encrypted payload) and a passphrase is required. + * Password validation happens in Rust at decrypt time; this module performs + * the password-independent Bech32 and NIP-49 structure checks needed to decide + * when the form can safely switch modes. + */ + +import { nsecToNpub } from "@/shared/lib/nostrUtils"; + +export type KeyImportKind = "nsec" | "ncryptsec" | "unknown"; + +const NCRYPTSEC_HRP = "ncryptsec"; +const NIP49_VERSION = 2; +const NIP49_PAYLOAD_BYTES = 91; +/** Current NIP-49 payloads encode to 162 characters including the checksum. */ +export const NCRYPTSEC_ENCODED_LENGTH = 162; +const BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"; +const BECH32_GENERATORS = [ + 0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3, +] as const; + +function bech32Polymod(values: readonly number[]): number { + let checksum = 1; + for (const value of values) { + const high = checksum >>> 25; + checksum = ((checksum & 0x1ffffff) << 5) ^ value; + for (let index = 0; index < BECH32_GENERATORS.length; index += 1) { + if ((high >>> index) & 1) checksum ^= BECH32_GENERATORS[index]; + } + } + return checksum >>> 0; +} + +function expandBech32Hrp(hrp: string): number[] { + return [ + ...Array.from(hrp, (character) => character.charCodeAt(0) >>> 5), + 0, + ...Array.from(hrp, (character) => character.charCodeAt(0) & 31), + ]; +} + +function convertFiveBitWordsToBytes(words: readonly number[]): number[] | null { + let accumulator = 0; + let bitCount = 0; + const bytes: number[] = []; + + for (const word of words) { + accumulator = (accumulator << 5) | word; + bitCount += 5; + while (bitCount >= 8) { + bitCount -= 8; + bytes.push((accumulator >>> bitCount) & 0xff); + } + } + + // Bech32 conversion without padding permits fewer than five zero remainder + // bits. Any larger or non-zero remainder is not a canonical byte encoding. + if (bitCount >= 5 || ((accumulator << (8 - bitCount)) & 0xff) !== 0) { + return null; + } + return bytes; +} + +export function classifyKeyImportInput(input: string): KeyImportKind { + const trimmed = input.trim(); + // Case-insensitive on the HRP to match the Rust classifier: an uppercase + // valid backup routes to the encrypted path (and decodes there); mixed + // case routes there too and fails in Rust with the accurate error. + if (trimmed.slice(0, 10).toLowerCase() === "ncryptsec1") return "ncryptsec"; + if (trimmed.startsWith("nsec1")) return "nsec"; + return "unknown"; +} + +/** + * Password-independent NIP-49 validation used for the automatic UI transition. + * A candidate must have canonical casing and length, a valid Bech32 checksum, + * and the current 91-byte/version-2 NIP-49 payload shape. + */ +export function isPlausibleNcryptsec(input: string): boolean { + const trimmed = input.trim(); + if (trimmed.length !== NCRYPTSEC_ENCODED_LENGTH) return false; + if (trimmed !== trimmed.toLowerCase() && trimmed !== trimmed.toUpperCase()) { + return false; + } + + const normalized = trimmed.toLowerCase(); + const separatorIndex = normalized.lastIndexOf("1"); + if ( + separatorIndex !== NCRYPTSEC_HRP.length || + normalized.slice(0, separatorIndex) !== NCRYPTSEC_HRP + ) { + return false; + } + + const encoded = normalized.slice(separatorIndex + 1); + const words = Array.from(encoded, (character) => + BECH32_CHARSET.indexOf(character), + ); + if (words.some((word) => word < 0) || words.length <= 6) return false; + if (bech32Polymod([...expandBech32Hrp(NCRYPTSEC_HRP), ...words]) !== 1) { + return false; + } + + const payload = convertFiveBitWordsToBytes(words.slice(0, -6)); + return ( + payload?.length === NIP49_PAYLOAD_BYTES && payload[0] === NIP49_VERSION + ); +} + +/** + * Whether the import form's submit should be enabled. + * nsec: must derive an npub. ncryptsec: plausible blob + non-empty passphrase. + */ +export function keyImportSubmitEnabled( + input: string, + passphrase: string, +): boolean { + const kind = classifyKeyImportInput(input); + if (kind === "ncryptsec") { + return isPlausibleNcryptsec(input) && passphrase.length > 0; + } + return nsecToNpub(input) !== null; +} diff --git a/desktop/src/features/onboarding/ui/BackupPasswordTimeline.tsx b/desktop/src/features/onboarding/ui/BackupPasswordTimeline.tsx new file mode 100644 index 0000000000..610c104d95 --- /dev/null +++ b/desktop/src/features/onboarding/ui/BackupPasswordTimeline.tsx @@ -0,0 +1,130 @@ +import { FileKey2, LockKeyhole, LockOpen } from "lucide-react"; +import { motion, useReducedMotion } from "motion/react"; + +import { cn } from "@/shared/lib/cn"; + +const BACKUP_KEY_DOTS = [ + "key-dot-1", + "key-dot-2", + "key-dot-3", + "key-dot-4", + "key-dot-5", + "key-dot-6", + "key-dot-7", + "key-dot-8", + "key-dot-9", +] as const; + +const TIMELINE_CONNECTOR_DOTS = [ + "connector-dot-1", + "connector-dot-2", + "connector-dot-3", + "connector-dot-4", +] as const; + +const TIMELINE_DOT_INITIAL = { opacity: 0.35, scale: 0.85 }; +const TIMELINE_DOT_PULSE = { + opacity: [0.35, 1, 0.35], + scale: [0.85, 1.25, 0.85], +}; +const TIMELINE_DOT_TRANSITION = { + duration: 0.7, + ease: "easeInOut" as const, + repeat: Number.POSITIVE_INFINITY, + repeatDelay: 1.2, +}; +const TIMELINE_TOP_DOT_TRANSITIONS = TIMELINE_CONNECTOR_DOTS.map( + (_, index) => ({ + ...TIMELINE_DOT_TRANSITION, + delay: index * 0.16, + }), +); +const TIMELINE_BOTTOM_DOT_TRANSITIONS = TIMELINE_CONNECTOR_DOTS.map( + (_, index) => ({ + ...TIMELINE_DOT_TRANSITION, + delay: (index + TIMELINE_CONNECTOR_DOTS.length) * 0.16 + 0.24, + }), +); + +/** + * Decorative timeline shared by backup creation and encrypted-backup restore. + * Backup creation reads key → password → lock; restore reads encrypted file → + * password → unlocked account. The password field is layered over the center. + */ +export function BackupPasswordTimeline({ + className, + mode = "backup", +}: { + className?: string; + mode?: "backup" | "restore"; +}) { + const reduceMotion = useReducedMotion() ?? false; + + return ( +
+ {mode === "restore" ? ( +
+ +
+ ) : ( +
+ {BACKUP_KEY_DOTS.map((dot) => ( + + ))} +
+ )} +
+ {TIMELINE_CONNECTOR_DOTS.map((dot, index) => ( + + ))} +
+
+ {TIMELINE_CONNECTOR_DOTS.map((dot, index) => ( + + ))} +
+ {mode === "restore" ? ( + + ) : ( + + )} +
+ ); +} diff --git a/desktop/src/features/onboarding/ui/BackupStep.tsx b/desktop/src/features/onboarding/ui/BackupStep.tsx index ed2184baaa..99d9c6324d 100644 --- a/desktop/src/features/onboarding/ui/BackupStep.tsx +++ b/desktop/src/features/onboarding/ui/BackupStep.tsx @@ -1,183 +1,438 @@ -import { AlertTriangle, Info, RefreshCw } from "lucide-react"; +import { Check, Copy, Eye, EyeOff, Info, ShieldCheck } from "lucide-react"; +import { useReducedMotion } from "motion/react"; import * as React from "react"; import { getNsec } from "@/shared/api/tauriIdentity"; +import type { IdentityStorage } from "@/shared/api/types"; +import { cn } from "@/shared/lib/cn"; +import { writeTextToClipboard } from "@/shared/lib/clipboard"; import { Button } from "@/shared/ui/button"; +import { FuzzyLogo } from "@/shared/ui/buzz-logo/FuzzyLogo"; import { Card } from "@/shared/ui/card"; import { Spinner } from "@/shared/ui/spinner"; -import { ONBOARDING_PRIMARY_CTA_CLASS } from "./OnboardingChrome"; +import { + ONBOARDING_PRIMARY_CTA_CLASS, + ONBOARDING_SECONDARY_CTA_CLASS, +} from "./OnboardingChrome"; import { OnboardingFooter } from "./OnboardingFooter"; import { type OnboardingTransitionDirection, OnboardingSlideTransition, } from "./OnboardingSlideTransition"; -import { NsecMaskedDisplay } from "./NsecMaskedDisplay"; +import { ONBOARDING_KEY_TEXT_CLASS } from "./NsecMaskedDisplay"; /** - * Pure helper so the disabled logic can be unit-tested without a DOM. - * - * Disabled while loading (key not fetched yet) or after a failed load (only - * the explicit "Skip for now" ghost advances past an error). + * How long the "Creating your identity key" loader holds the stage before the + * finished state fades in. Purely perceptual — the key already exists; the + * pause sells the creation moment. */ -export function backupNextDisabled({ - isLoading, - loadError, -}: { - isLoading: boolean; - loadError: string | null; -}): boolean { - return isLoading || loadError !== null; +const INTRO_HOLD_MS = 1400; + +/** + * The creation moment should only be sold once per app session. Module-level + * so remounts (e.g. navigating Back and returning to this step) skip the fake + * hold and show the finished state instantly. + */ +let introPlayed = false; + +const REVEAL_ANIMATION_CLASS = + "animate-in fade-in duration-700 motion-reduce:animate-none"; + +const BACKUP_OPTION_CLASS = + "flex min-h-48 w-full flex-col items-start justify-start px-6 py-5 text-left text-foreground"; + +/** Viewing the key never blocks onboarding — Next is always actionable. */ +export function backupNextDisabled(): boolean { + return false; } type BackupStepProps = { direction: OnboardingTransitionDirection; + identityStorage?: IdentityStorage; onBack: () => void; onNext: () => void; + onOpenPasswordBackup: () => void; + onShowOptions: () => void; + optionsExpanded: boolean; + returningFromSecurity: boolean; }; /** - * Onboarding backup step — shows the user their freshly created key so they - * can save it somewhere safe. Only shown on the fresh-key path. + * Onboarding identity-key step — shows the freshly created key, then opens a + * dark backup-options state. Copy fetches the raw key only after an explicit + * click; password backup opens the separate security flow. Neither method + * blocks Next. */ -export function BackupStep({ direction, onBack, onNext }: BackupStepProps) { +export function BackupStep({ + direction, + identityStorage, + onBack, + onNext, + onOpenPasswordBackup, + onShowOptions, + optionsExpanded, + returningFromSecurity, +}: BackupStepProps) { + const reduceMotion = useReducedMotion() ?? false; + const [created, setCreated] = React.useState(introPlayed || reduceMotion); + const [copyState, setCopyState] = React.useState< + "idle" | "copying" | "copied" + >("idle"); + const [copyError, setCopyError] = React.useState(null); const [nsec, setNsec] = React.useState(null); - const [isLoading, setIsLoading] = React.useState(true); - const [loadError, setLoadError] = React.useState(null); + const [isRevealed, setIsRevealed] = React.useState(false); const cancelledRef = React.useRef(false); + const copiedTimerRef = React.useRef(null); - const loadNsec = React.useCallback(async () => { - setIsLoading(true); - setLoadError(null); - try { - const value = await getNsec(); - if (!cancelledRef.current) setNsec(value); - } catch (err) { - if (!cancelledRef.current) - setLoadError( - err instanceof Error - ? err.message - : "Failed to retrieve private key.", - ); - } finally { - if (!cancelledRef.current) setIsLoading(false); + React.useEffect(() => { + if (introPlayed) return; + if (reduceMotion) { + introPlayed = true; + setCreated(true); + return; } - }, []); + const timer = window.setTimeout(() => { + introPlayed = true; + setCreated(true); + }, INTRO_HOLD_MS); + return () => window.clearTimeout(timer); + }, [reduceMotion]); React.useEffect(() => { cancelledRef.current = false; - void loadNsec(); return () => { // Back-during-fetch: cancel any in-flight setState calls and clear the // nsec from memory on unmount (backup step is only on the fresh-key path). cancelledRef.current = true; setNsec(null); + if (copiedTimerRef.current !== null) + window.clearTimeout(copiedTimerRef.current); }; - }, [loadNsec]); + }, []); + + const copyKeyToClipboard = React.useCallback(async () => { + setCopyState("copying"); + setCopyError(null); + try { + const value = nsec ?? (await getNsec()); + await writeTextToClipboard(value); + if (cancelledRef.current) return; + setCopyState("copied"); + if (copiedTimerRef.current !== null) + window.clearTimeout(copiedTimerRef.current); + copiedTimerRef.current = window.setTimeout(() => { + if (!cancelledRef.current) setCopyState("idle"); + }, 2000); + } catch (err) { + if (cancelledRef.current) return; + setCopyState("idle"); + setCopyError( + err instanceof Error ? err.message : "Failed to retrieve private key.", + ); + } + }, [nsec]); + + const toggleReveal = React.useCallback(async () => { + if (isRevealed) { + setIsRevealed(false); + return; + } + setCopyError(null); + try { + // The raw key enters the DOM only after this explicit reveal action. + const value = nsec ?? (await getNsec()); + if (cancelledRef.current) return; + setNsec(value); + setIsRevealed(true); + } catch (err) { + if (cancelledRef.current) return; + setCopyError( + err instanceof Error ? err.message : "Failed to retrieve private key.", + ); + } + }, [isRevealed, nsec]); + + // Fixed-length decorative mask (nsec keys are 63 chars) so no key material + // is fetched just to render the blurred row. Bullets are joined with a + // zero-width space: WebKit won't line-break a run of U+2022 without an + // explicit break opportunity, so the masked row would overflow otherwise. + const maskedKey = React.useMemo( + () => Array.from({ length: nsec?.length ?? 63 }, () => "•").join("\u200b"), + [nsec], + ); + const storageDescription = + identityStorage === "system-keyring" + ? "Buzz keeps your identity key in your system keychain. Your computer may ask for your password when Buzz needs to read the key." + : identityStorage === "local-file" + ? "Your system keychain wasn’t available, so Buzz keeps your identity key in a private file on this device." + : "Buzz keeps your identity key protected on this device. Make a separate backup in case you lose access."; + const storageTitle = + identityStorage === "system-keyring" + ? "Protected by your system keychain" + : identityStorage === "local-file" + ? "Stored in private device storage" + : "Protected in private device storage"; + const introStorageDescription = + identityStorage === "system-keyring" + ? "Buzz keeps your identity key in your system keychain." + : identityStorage === "local-file" + ? "Buzz keeps your identity key in a private file on this device because the system keychain wasn’t available." + : "Your identity key is protected on this device."; + + if (optionsExpanded) { + return ( + +
+

+ Backup options +

+

+ Your identity key works like a password for your Buzz account. Keep + a copy somewhere safe. You can create a backup file and lock it with + a password you can remember. +

+
+ +
+
+
+ {storageTitle} + + {storageDescription} + +
+ +
+ + Saved in your password manager + + + Copy your identity key, then save it in a password manager like + 1Password. + + +
+ +
+ + Locked in a backup file + + + Create a backup file and choose a password you can remember. + You’ll need both to restore your account. + + +
+
+ + {copyError ? ( +

+ Could not retrieve your private key: {copyError}. You can continue + and find it later in Settings > Profile > Identity. +

+ ) : null} +
+ + ); + } return (
-

- Your unique identity key has been created + {/* Plain string concat: cn()'s tailwind-merge misreads the custom + text-title size token as conflicting with text-foreground. */} +

+ {created + ? "Your unique identity key has been created" + : "Creating your identity key"}

-

- This key is stored in your system keychain, but save it some place - safe in case you ever need to restore your account. -

-
- -
- {isLoading ? ( -
- - Loading your private key… -
- ) : loadError ? ( -
-
- - - Could not retrieve your private key: {loadError}. You can - continue and find it later in Settings > Profile > - Identity. - -
- -
- ) : nsec ? ( - -
- -
- - ) : ( -

- No key available to back up. -

- )} - - {nsec ? ( -

- - - Never share your private key. Anyone with this key can impersonate - you and access everything in your account. - + review backup options + {" "} + for ways to restore your account.

) : null}
- - + + + ) : ( +
+
+ +
+
+

+ {isRevealed && nsec ? nsec : maskedKey} +

+
+ +
+ + + {copyError ? ( +

+ Could not retrieve your private key: {copyError}. You can + continue and find it later in Settings > Profile > + Identity. +

+ ) : null} - {loadError ? ( +

+ + + Never share your private key. Anyone with this key can + impersonate you and access everything in your account. + +

+
+
+ )} + + {created ? ( + - ) : null} - - + + + ) : null} ); } diff --git a/desktop/src/features/onboarding/ui/BackupTestFlow.tsx b/desktop/src/features/onboarding/ui/BackupTestFlow.tsx new file mode 100644 index 0000000000..9370d5c061 --- /dev/null +++ b/desktop/src/features/onboarding/ui/BackupTestFlow.tsx @@ -0,0 +1,745 @@ +import { Check, CircleHelp, Eye, EyeOff, FileKey2, FileUp } from "lucide-react"; +import { motion, useReducedMotion } from "motion/react"; +import * as React from "react"; +import { createPortal } from "react-dom"; + +import { + getNsec, + verifyNcryptsecBackup, + type BackupVerification, +} from "@/shared/api/tauriIdentity"; +import { cn } from "@/shared/lib/cn"; +import { Button } from "@/shared/ui/button"; +import { Card } from "@/shared/ui/card"; +import { Input } from "@/shared/ui/input"; +import { PubKey } from "@/shared/ui/PubKey"; +import { Spinner } from "@/shared/ui/spinner"; +import { + ONBOARDING_SECURITY_PRIMARY_CTA_CLASS, + ONBOARDING_SECONDARY_CTA_CLASS, +} from "./OnboardingChrome"; + +type BackupTestStage = "drop" | "password" | "success"; + +/** + * Durable progress through the test flow. Owned by the host so navigating + * away (e.g. onboarding Back) and returning doesn't force the user to + * re-drop the file. The password attempt is deliberately NOT part of this + * state — it lives only in short-lived component state and is cleared the + * moment it's submitted or the component unmounts. + */ +export type BackupTestProgress = { + stage: BackupTestStage; + /** Name of the accepted file once the drop check passed. */ + fileName: string | null; + /** Contents of the accepted file, pending or past verification. */ + ncryptsec: string | null; + /** The Rust-verified public identity once decryption succeeded. */ + result: BackupVerification | null; +}; + +export const initialBackupTestProgress: BackupTestProgress = { + stage: "drop", + fileName: null, + ncryptsec: null, + result: null, +}; + +type BackupTestFlowProps = { + /** "spotlight" is the onboarding treatment; "boxed" fits settings cards. */ + variant?: "spotlight" | "boxed"; + /** + * When supplied, only this exact just-created file is accepted — the + * onboarding ceremony proves the user saved *that* backup. Without it the + * flow is a general-purpose tester for any key backup file. + */ + expectedNcryptsec?: string; + /** Re-open the native save dialog for another copy of the backup file. */ + onSaveCopy?: () => void; + isSaving?: boolean; + saveError?: string | null; + /** Optional onboarding footer target for the verification CTA. */ + verifyButtonPortal?: HTMLElement | null; + /** Host-owned progress so it survives this component unmounting. */ + progress: BackupTestProgress; + onProgressChange: React.Dispatch>; + /** Fired once when the user completes the test successfully. */ + onVerified?: () => void; +}; + +const BURST_EMOJIS = ["🎉", "✨", "🐝", "🍯", "🔑", "💛"] as const; +const BURST_PARTICLE_COUNT = 18; +const VERIFICATION_CONNECTOR_DOTS = [ + "verification-dot-1", + "verification-dot-2", + "verification-dot-3", + "verification-dot-4", +] as const; +const VERIFICATION_DOT_ANIMATION = { + opacity: [0.35, 1, 0.35], + scale: [0.85, 1.25, 0.85], +}; +const VERIFICATION_DOT_TRANSITION = { + duration: 0.7, + ease: "easeInOut" as const, + repeat: Number.POSITIVE_INFINITY, + repeatDelay: 1.2, +}; +const PRIVATE_KEY_MASK = Array.from({ length: 63 }, () => "•").join("\u200b"); + +type BurstParticle = { + id: number; + x: number; + y: number; + emoji: string; + delay: number; + scale: number; + rotate: number; +}; + +/** + * One-shot radial emoji burst behind the success badge. Purely decorative — + * skipped entirely under reduced motion. + */ +function SuccessBurst() { + const particles = React.useMemo( + () => + Array.from({ length: BURST_PARTICLE_COUNT }, (_, i) => { + const angle = + (i / BURST_PARTICLE_COUNT) * Math.PI * 2 + Math.random() * 0.5; + const distance = 70 + Math.random() * 80; + return { + id: i, + x: Math.cos(angle) * distance, + y: Math.sin(angle) * distance, + emoji: BURST_EMOJIS[i % BURST_EMOJIS.length], + delay: Math.random() * 0.18, + scale: 0.8 + Math.random() * 0.7, + rotate: -120 + Math.random() * 240, + }; + }), + [], + ); + + return ( +
+ {particles.map((particle) => ( + + {particle.emoji} + + ))} +
+ ); +} + +function VerificationConnector({ + delayOffset, + reduceMotion, +}: { + delayOffset: number; + reduceMotion: boolean; +}) { + return ( +
+ {VERIFICATION_CONNECTOR_DOTS.map((dot, index) => ( + + ))} +
+ ); +} + +/** + * "Test your backup" flow: the user drops a backup file onto a large + * dropzone, then enters its password. Verification is a real NIP-49 decrypt + * in Rust — the submitted password is cleared immediately after the result + * and only the derived public identity ever comes back. + */ +export function BackupTestFlow({ + variant = "spotlight", + expectedNcryptsec, + onSaveCopy, + isSaving = false, + saveError, + verifyButtonPortal, + progress, + onProgressChange, + onVerified, +}: BackupTestFlowProps) { + const reduceMotion = useReducedMotion() ?? false; + const { stage, fileName, ncryptsec, result } = progress; + // True while a file drag is anywhere over the window — the drop overlay + // takes over the host surface only for the duration of the drag. + const [isWindowDragging, setIsWindowDragging] = React.useState(false); + const dragDepthRef = React.useRef(0); + + React.useEffect(() => { + // dragenter/dragleave fire per nested element, so track depth to know + // when the drag has actually left the window. + const handleDragEnter = (event: DragEvent) => { + if (!event.dataTransfer?.types.includes("Files")) return; + dragDepthRef.current += 1; + setIsWindowDragging(true); + }; + const handleDragLeave = () => { + dragDepthRef.current = Math.max(0, dragDepthRef.current - 1); + if (dragDepthRef.current === 0) setIsWindowDragging(false); + }; + const handleDragEnd = () => { + dragDepthRef.current = 0; + setIsWindowDragging(false); + }; + window.addEventListener("dragenter", handleDragEnter); + window.addEventListener("dragleave", handleDragLeave); + window.addEventListener("drop", handleDragEnd); + window.addEventListener("dragend", handleDragEnd); + return () => { + window.removeEventListener("dragenter", handleDragEnter); + window.removeEventListener("dragleave", handleDragLeave); + window.removeEventListener("drop", handleDragEnd); + window.removeEventListener("dragend", handleDragEnd); + }; + }, []); + + // The password attempt is component-local, never host state: it is cleared + // when verification is submitted and when this component unmounts. + const [attempt, setAttempt] = React.useState(""); + const [error, setError] = React.useState(null); + const [isVerifying, setIsVerifying] = React.useState(false); + const [isRevealed, setIsRevealed] = React.useState(false); + const [successNsec, setSuccessNsec] = React.useState(null); + const [isSuccessNsecRevealed, setIsSuccessNsecRevealed] = + React.useState(false); + const [isLoadingSuccessNsec, setIsLoadingSuccessNsec] = React.useState(false); + const [successNsecError, setSuccessNsecError] = React.useState( + null, + ); + const fileInputRef = React.useRef(null); + const passwordInputRef = React.useRef(null); + const mountedRef = React.useRef(true); + // Opaque correlation id so a stale in-flight verification can't commit + // after "Use a different file" or unmount. + const requestRef = React.useRef(0); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + requestRef.current += 1; + setAttempt(""); + }; + }, []); + + React.useEffect(() => { + if (stage === "password") passwordInputRef.current?.focus(); + }, [stage]); + + const handleFile = React.useCallback( + async (file: File) => { + let text: string; + try { + text = (await file.text()).trim(); + } catch { + if (mountedRef.current) setError("Could not read that file."); + return; + } + if (!mountedRef.current) return; + if (!text.toLowerCase().startsWith("ncryptsec1")) { + setError( + expectedNcryptsec + ? "That doesn't look like your key backup. Choose the file you just downloaded." + : "That doesn't look like a key backup file.", + ); + return; + } + if (expectedNcryptsec && text !== expectedNcryptsec.trim()) { + setError("That's a key backup, but not the one you just downloaded."); + return; + } + setError(null); + setAttempt(""); + onProgressChange({ + stage: "password", + fileName: file.name, + ncryptsec: text, + result: null, + }); + }, + [expectedNcryptsec, onProgressChange], + ); + + const handleVerify = React.useCallback(async () => { + if (!ncryptsec || !attempt || isVerifying) return; + const password = attempt; + const requestId = ++requestRef.current; + setIsVerifying(true); + setError(null); + setIsRevealed(false); + // Clear the attempt the moment it's handed to Rust — success or failure, + // the typed password never lingers in the field. + setAttempt(""); + try { + const verified = await verifyNcryptsecBackup(ncryptsec, password); + if (!mountedRef.current || requestId !== requestRef.current) return; + onProgressChange((prev) => ({ + ...prev, + stage: "success", + result: verified, + })); + onVerified?.(); + } catch (err) { + if (mountedRef.current && requestId === requestRef.current) + setError( + err instanceof Error ? err.message : "Could not verify this backup.", + ); + } finally { + if (mountedRef.current && requestId === requestRef.current) + setIsVerifying(false); + } + }, [attempt, isVerifying, ncryptsec, onProgressChange, onVerified]); + + const toggleSuccessNsec = React.useCallback(async () => { + if (isSuccessNsecRevealed) { + setIsSuccessNsecRevealed(false); + return; + } + if (successNsec) { + setIsSuccessNsecRevealed(true); + return; + } + setIsLoadingSuccessNsec(true); + setSuccessNsecError(null); + try { + const value = await getNsec(); + if (!mountedRef.current) return; + setSuccessNsec(value); + setIsSuccessNsecRevealed(true); + } catch (err) { + if (!mountedRef.current) return; + setSuccessNsecError( + err instanceof Error ? err.message : "Could not retrieve your key.", + ); + } finally { + if (mountedRef.current) setIsLoadingSuccessNsec(false); + } + }, [isSuccessNsecRevealed, successNsec]); + + const isSpotlight = variant === "spotlight"; + + if (stage === "success" && result) { + // The onboarding ceremony pins the exact file, so a success there is by + // construction the current identity — celebrate and move on. The general + // tester reports which identity the backup unlocks. + const isCeremony = Boolean(expectedNcryptsec); + return ( +
+ {reduceMotion ? null : } + + + + {isCeremony ? ( +
+

+ Your backup works! +

+

+ File and password verified. Keep them both somewhere safe — + that's all you need to restore your identity. +

+
+

+ {isSuccessNsecRevealed && successNsec + ? successNsec + : PRIVATE_KEY_MASK} +

+ +
+ {successNsecError ? ( +

+ {successNsecError} +

+ ) : null} +
+ ) : ( + <> +

+ This backup works +

+

+ {result.matchesCurrentIdentity + ? "It restores your current Buzz identity." + : "It restores a different identity than the one signed in here."} +

+
+ +
+ + )} + + {isCeremony ? null : ( + + )} +
+ ); + } + + return ( +
+ {stage === "drop" ? ( + + { + const file = event.target.files?.[0]; + // Allow re-selecting the same file after an error. + event.target.value = ""; + if (file) void handleFile(file); + }} + ref={fileInputRef} + tabIndex={-1} + type="file" + /> + + {isWindowDragging ? ( + /* + * Composer-style takeover: fills the nearest positioned host + * surface (the onboarding card / the settings backup row) and is + * itself the drop target, so anywhere on that surface accepts + * the file. + */ + // biome-ignore lint/a11y/noStaticElementInteractions: pointer-only drop target; the select button is the keyboard-accessible path +
event.preventDefault()} + onDrop={(event) => { + event.preventDefault(); + const file = event.dataTransfer.files?.[0]; + if (file) void handleFile(file); + }} + > + + +
+ ) : null} + {error ? ( +

+ {error} +

+ ) : null} + {onSaveCopy ? ( +
+ +
+ ) : null} + {saveError ? ( +

{saveError}

+ ) : null} + + ) : ( + + {(() => { + const fileRow = ( +
+ + + + {fileName} + +
+ ); + const passwordField = ( +
+ setAttempt(event.target.value)} + onKeyDown={(event) => { + if (event.key === "Enter") { + event.preventDefault(); + void handleVerify(); + } + }} + placeholder="Your backup password" + ref={passwordInputRef} + type={isRevealed ? "text" : "password"} + value={attempt} + /> + + {error ? ( +

+ {error} +

+ ) : null} +
+ ); + if (!isSpotlight) { + return ( + <> + {fileRow} +

+ Enter the password to prove you can unlock this backup. +

+ {passwordField} + + ); + } + return ( +
+
+ ); + })()} + {(() => { + const verifyButton = ( + + ); + if (verifyButtonPortal === undefined) { + return ( +
{verifyButton}
+ ); + } + return verifyButtonPortal + ? createPortal(verifyButton, verifyButtonPortal) + : null; + })()} + + )} +
+ ); +} diff --git a/desktop/src/features/onboarding/ui/DownloadKeyStep.tsx b/desktop/src/features/onboarding/ui/DownloadKeyStep.tsx new file mode 100644 index 0000000000..3d69150049 --- /dev/null +++ b/desktop/src/features/onboarding/ui/DownloadKeyStep.tsx @@ -0,0 +1,139 @@ +import { motion, useReducedMotion } from "motion/react"; +import * as React from "react"; + +import { Button } from "@/shared/ui/button"; +import { + ONBOARDING_SECURITY_PRIMARY_CTA_CLASS, + ONBOARDING_SECONDARY_CTA_CLASS, +} from "./OnboardingChrome"; +import { OnboardingFooter } from "./OnboardingFooter"; +import { + type OnboardingTransitionDirection, + OnboardingSlideTransition, +} from "./OnboardingSlideTransition"; +import { + type EncryptedBackupSession, + EncryptedBackupCreator, +} from "./EncryptedBackupCreator"; + +type DownloadKeyStepProps = { + direction: OnboardingTransitionDirection; + /** Backup state owned by the parent flow across the creation and test views. */ + session: EncryptedBackupSession; + onBack: () => void; +}; + +/** + * Password-backup security subview within the identity-key onboarding step. + * The raw key never enters this component: Rust builds the NIP-49 payload + * locally and the native save dialog produces the user-owned file. + */ +export function DownloadKeyStep({ + direction, + session, + onBack, +}: DownloadKeyStepProps) { + const reduceMotion = useReducedMotion() ?? false; + // Once the encrypted payload is saved, the creator advances to its guided + // backup test while this surface keeps its own navigation. + const hasCreated = session.created; + const hasVerifiedBackup = session.verified; + const hasSelectedBackup = session.test.stage === "password"; + const [primaryActionSlot, setPrimaryActionSlot] = + React.useState(null); + + return ( + + + {/* Plain string concat: cn()'s tailwind-merge misreads the custom + text-title size token as conflicting with text-foreground. */} +

+ {hasVerifiedBackup + ? "Your backup is verified" + : hasSelectedBackup + ? "That’s your backup file" + : hasCreated + ? "Optionally, test your backup" + : "Backup your key with a password"} +

+

+ {hasVerifiedBackup + ? "Your file and password can restore your identity." + : hasSelectedBackup + ? "Now enter your password to prove you can unlock it." + : hasCreated + ? "Learn how your backup works. Drop the file you just saved and unlock it with your password." + : "Keep the downloaded file private — you need both it and your password to restore your identity. Save the backup password somewhere safe; Buzz cannot reset it if lost."} +

+ + +
+
+ +
+ +
+ +
+
+ + +
+ + + + ); +} diff --git a/desktop/src/features/onboarding/ui/EncryptedBackupCreator.tsx b/desktop/src/features/onboarding/ui/EncryptedBackupCreator.tsx new file mode 100644 index 0000000000..bb76166bd7 --- /dev/null +++ b/desktop/src/features/onboarding/ui/EncryptedBackupCreator.tsx @@ -0,0 +1,885 @@ +import { AlertTriangle, Eye, EyeOff, RefreshCw } from "lucide-react"; +import * as React from "react"; +import { createPortal } from "react-dom"; + +import { + createNcryptsecBackup, + generateBackupPassphrase, + saveNcryptsecCopy, +} from "@/shared/api/tauriIdentity"; +import { cn } from "@/shared/lib/cn"; +import { Button } from "@/shared/ui/button"; +import { Input } from "@/shared/ui/input"; +import { Popover, PopoverAnchor, PopoverContent } from "@/shared/ui/popover"; +import { Spinner } from "@/shared/ui/spinner"; +import { + AlertDialog, + AlertDialogAction, + AlertDialogCancel, + AlertDialogContent, + AlertDialogDescription, + AlertDialogFooter, + AlertDialogHeader, + AlertDialogTitle, +} from "@/shared/ui/alert-dialog"; +import { + downloadDisabled, + passphraseIssue, + pendingEncryptPassphrase, + encryptedBackupReducer, + initialEncryptedBackupState, + MIN_PASSPHRASE_LEN, + type EncryptedBackupEvent, + type EncryptedBackupState, +} from "../lib/encryptedBackup"; +import { + type BackupTestProgress, + BackupTestFlow, + initialBackupTestProgress, +} from "./BackupTestFlow"; +import { BackupPasswordTimeline } from "./BackupPasswordTimeline"; +import { + ONBOARDING_SECURITY_PRIMARY_CTA_CLASS, + ONBOARDING_SECONDARY_CTA_CLASS, +} from "./OnboardingChrome"; + +/** Word-count bounds mirroring `key_backup.rs` (Rust clamps regardless). */ +const MIN_GENERATED_WORDS = 3; +const MAX_GENERATED_WORDS = 10; +const DEFAULT_GENERATED_WORDS = 3; + +const SEPARATOR_OPTIONS = [ + { label: "Spaces", value: " " }, + { label: "Hyphens", value: "-" }, + { label: "Periods", value: "." }, + { label: "Commas", value: "," }, +] as const; + +const DEFAULT_SEPARATOR = SEPARATOR_OPTIONS[0].value; + +/** + * Pause after the last keystroke before the background KDF starts, so typing + * past the minimum length doesn't launch an encryption per character. + */ +const ENCRYPT_DEBOUNCE_MS = 400; + +const PENDING_TICKER_MESSAGES = [ + "Downloading once finished", + "Encrypting your password", + "Just a bit longer...", +] as const; + +/** How long each ticker message holds before sliding to the next. */ +const PENDING_TICKER_INTERVAL_MS = 2500; + +/** Matches the `duration-300` slide transition on the ticker column. */ +const PENDING_TICKER_SLIDE_MS = 300; + +/** + * Vertical ticker for the queued-download button label — cycles through the + * pending messages by sliding a stacked column inside a one-line viewport. + * The column ends with a clone of the first message, so the wrap-around + * slides up from the bottom like every other step; once the clone settles, + * the column snaps (transition disabled) back to the real first row. All + * lines render at all times, so the button keeps the width of the longest + * message instead of resizing on each swap. + */ +function PendingDownloadTicker() { + // Index into the rendered column (messages + trailing clone of the first). + const [position, setPosition] = React.useState(0); + const [snap, setSnap] = React.useState(false); + + React.useEffect(() => { + const timer = window.setInterval( + () => setPosition((current) => current + 1), + PENDING_TICKER_INTERVAL_MS, + ); + return () => window.clearInterval(timer); + }, []); + + // The clone is visually identical to the first message: once its slide-in + // finishes, jump back to the real first row without animating. + React.useEffect(() => { + if (position !== PENDING_TICKER_MESSAGES.length) return; + const timer = window.setTimeout(() => { + setSnap(true); + setPosition(0); + }, PENDING_TICKER_SLIDE_MS); + return () => window.clearTimeout(timer); + }, [position]); + + // Re-enable the transition one frame after the snap has painted. + React.useEffect(() => { + if (!snap) return; + const raf = window.requestAnimationFrame(() => setSnap(false)); + return () => window.cancelAnimationFrame(raf); + }, [snap]); + + // The clone row duplicates the first message's text, so it carries its own + // stable key. + const column = [ + ...PENDING_TICKER_MESSAGES.map((message) => ({ key: message, message })), + { key: "wrap-clone", message: PENDING_TICKER_MESSAGES[0] }, + ]; + + return ( + + + {column.map((row) => ( + + {row.message} + + ))} + + + ); +} + +/** + * Everything about an in-progress backup that must survive this component + * unmounting: the reducer state (short-lived passphrase + encrypted blob), whether the + * backup test passed, where the file was saved, the save-once guard, and the + * test-flow progress. Hosts that need the state to outlive the creator (the + * onboarding flow, where Back unmounts the step) call + * `useEncryptedBackupSession` at a longer-lived level and pass it down; + * otherwise the creator owns a private session internally. + */ +export type EncryptedBackupSession = { + state: EncryptedBackupState; + dispatch: React.Dispatch; + /** + * True once the encrypted payload has been committed AND saved to disk. + * Derived so hosts (e.g. DownloadKeyStep) can branch on it without touching + * the blob itself — keeping them outside the ncryptsec confinement scan. + */ + created: boolean; + /** True once the user has passed the backup test. */ + verified: boolean; + setVerified: React.Dispatch>; + savedPath: string | null; + setSavedPath: React.Dispatch>; + /** The committed blob a save was already kicked off for (save-once guard). */ + savedForRef: React.MutableRefObject; + test: BackupTestProgress; + setTest: React.Dispatch>; +}; + +/** Host-side state for `EncryptedBackupCreator` — see `EncryptedBackupSession`. */ +export function useEncryptedBackupSession(): EncryptedBackupSession { + const [state, dispatch] = React.useReducer( + encryptedBackupReducer, + initialEncryptedBackupState, + ); + const [verified, setVerified] = React.useState(false); + const [savedPath, setSavedPath] = React.useState(null); + const savedForRef = React.useRef(null); + const [test, setTest] = React.useState( + initialBackupTestProgress, + ); + return React.useMemo( + () => ({ + state, + dispatch, + created: state.ncryptsec !== null && savedPath !== null, + verified, + setVerified, + savedPath, + setSavedPath, + savedForRef, + test, + setTest, + }), + [state, verified, savedPath, test], + ); +} + +/** + * Return to a secure saved-password placeholder. The encrypted blob survives + * for instant re-download, while no password or test attempt is retained. + */ +export function backupSessionToPasswordEntry( + session: EncryptedBackupSession, +): void { + session.dispatch({ type: "back-to-password" }); + session.setVerified(false); + session.setSavedPath(null); + session.setTest(initialBackupTestProgress); +} + +/** Discard all backup-creation and verification progress. */ +export function resetEncryptedBackupSession( + session: EncryptedBackupSession, +): void { + session.dispatch({ type: "start-new-backup" }); + session.setVerified(false); + session.setSavedPath(null); + session.savedForRef.current = null; + session.setTest(initialBackupTestProgress); +} + +type EncryptedBackupCreatorProps = { + /** "spotlight" is the onboarding treatment; "boxed" fits settings cards. */ + variant?: "spotlight" | "boxed"; + /** + * When set, the "Download" button is portaled into this element instead of + * rendering inline. + */ + createButtonPortal?: HTMLElement | null; + /** Optional onboarding footer target for the guided-test verification CTA. */ + verifyButtonPortal?: HTMLElement | null; + /** Extra classes for the "Download" button. */ + createButtonClassName?: string; + /** + * Host-owned session so the backup state survives this component + * unmounting (onboarding Back navigation). Omitted = private session. + */ + session?: EncryptedBackupSession; + /** Fired once the encrypted payload has been created (before saving). */ + onCreated?: () => void; + /** Fired only after the encrypted key file has been saved successfully. */ + onSaved?: (path: string) => void; + /** Whether creation continues into onboarding's guided test ceremony. */ + guidedTest?: boolean; + /** Fired once when the user completes the backup test successfully. */ + onVerified?: () => void; +}; + +/** + * 1Password-style memorable-password generator popover with word-count and + * separator fields, anchored to a refresh icon inset in the password field + * (the anchor assumes a `relative` parent). The first click opens the + * popover and generates; further clicks on the icon re-roll while the + * popover stays open — only click-outside or Esc closes it. There is no + * candidate preview: every generation writes the passphrase straight into + * the parent's password field via `onGenerated`. + */ +function PassphraseGeneratorPopover({ + disabled = false, + onRequestGenerate, + onGenerated, + securityTheme = false, +}: { + disabled?: boolean; + onRequestGenerate?: () => void; + onGenerated: (value: string) => void; + securityTheme?: boolean; +}) { + const [open, setOpen] = React.useState(false); + const [words, setWords] = React.useState(DEFAULT_GENERATED_WORDS); + const [separator, setSeparator] = React.useState(DEFAULT_SEPARATOR); + const [error, setError] = React.useState(null); + const anchorRef = React.useRef(null); + const mountedRef = React.useRef(true); + // Read via a ref so `generate` stays reference-stable even though parents + // pass an inline `onGenerated`. Otherwise each generated password would + // re-render the parent, rebuild `generate`, and re-fire the open/controls + // effect below — an infinite generate loop while the popover is open. + const onGeneratedRef = React.useRef(onGenerated); + + React.useEffect(() => { + onGeneratedRef.current = onGenerated; + }, [onGenerated]); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + }; + }, []); + + const generate = React.useCallback(async (wordCount: number, sep: string) => { + setError(null); + try { + const passphrase = await generateBackupPassphrase({ + words: wordCount, + separator: sep, + }); + if (mountedRef.current) onGeneratedRef.current(passphrase); + } catch (err) { + if (!mountedRef.current) return; + setError( + err instanceof Error ? err.message : "Failed to generate a password.", + ); + } + }, []); + + // Fill the password field on every open and whenever a control changes. + React.useEffect(() => { + if (open) void generate(words, separator); + }, [open, words, separator, generate]); + + return ( + + {/* Anchor (not Trigger): Radix triggers toggle on click, but repeat + clicks here must generate a fresh password while the popover stays + open. Only click-outside or Esc closes it. */} + + + + { + // Clicking the anchor icon is "outside" the content — keep the + // popover open so that click re-rolls instead of closing. + if ( + event.target instanceof Node && + anchorRef.current?.contains(event.target) + ) { + event.preventDefault(); + } + }} + onOpenAutoFocus={(event) => event.preventDefault()} + > +
+ +
+ setWords(Number(event.target.value))} + type="range" + value={words} + /> + + {words} + +
+
+ +
+ + +
+ + {error ? ( +

+ + {error} +

+ ) : null} + + + ); +} + +/** + * Password-first encrypted key download flow shared by onboarding and + * Settings. The raw private key never enters this component. Rust creates the + * NIP-49 payload locally, then the native save dialog produces the user-owned + * file. + * + * The flow is a single password input; a refresh icon inset in the field + * opens a 1Password-style generator popover (word count + separator). + * Encryption starts eagerly once the password is valid, so Download usually + * opens the save dialog instantly. Background encryption is silent; clicking + * mid-encryption reveals the queued-download ticker until the KDF finishes. + */ +export function EncryptedBackupCreator({ + variant = "spotlight", + createButtonPortal, + verifyButtonPortal, + createButtonClassName, + session: sessionProp, + onCreated, + onSaved, + guidedTest = true, + onVerified, +}: EncryptedBackupCreatorProps) { + // Hosts without a longer-lived session get a private one (settings card). + const fallbackSession = useEncryptedBackupSession(); + const session = sessionProp ?? fallbackSession; + const { state, dispatch, savedPath, setSavedPath, savedForRef } = session; + const [isRevealed, setIsRevealed] = React.useState(false); + const [saveError, setSaveError] = React.useState(null); + const [isSaving, setIsSaving] = React.useState(false); + const [confirmNewPassword, setConfirmNewPassword] = React.useState(false); + const mountedRef = React.useRef(true); + + React.useEffect(() => { + mountedRef.current = true; + return () => { + mountedRef.current = false; + }; + }, []); + + // A queued download locks the form — mask the password too so it isn't + // left readable on screen while the user waits for the save dialog. + React.useEffect(() => { + if (state.downloadPending) setIsRevealed(false); + }, [state.downloadPending]); + + // Correlate KDF completion by an opaque request id. The password exists only + // in this short-lived effect closure and is cleared from reducer state once + // Rust returns; stale completions cannot commit. + const pendingPassphrase = pendingEncryptPassphrase(state); + const skipDebounce = state.downloadPending; + React.useEffect(() => { + if (!pendingPassphrase) return; + let cancelled = false; + const requestId = state.nextRequestId; + const start = () => { + if (cancelled) return; + dispatch({ type: "encrypt-started", requestId }); + void createNcryptsecBackup(pendingPassphrase) + .then((ncryptsec) => + dispatch({ type: "encrypt-succeeded", requestId, ncryptsec }), + ) + .catch((err: unknown) => + dispatch({ + type: "encrypt-failed", + requestId, + message: + err instanceof Error + ? err.message + : "Failed to encrypt your key.", + }), + ); + }; + const timer = window.setTimeout( + start, + skipDebounce ? 0 : ENCRYPT_DEBOUNCE_MS, + ); + return () => { + cancelled = true; + window.clearTimeout(timer); + }; + }, [dispatch, pendingPassphrase, skipDebounce, state.nextRequestId]); + + // Download commit: fires once per committed blob, whether the commit was + // instant (encryption already done) or resolved a queued download. The flow + // only advances to the test view once the file is actually on disk — a + // canceled save dialog or a save failure rolls the commit back to the + // password form so "Download backup" can be clicked again. + React.useEffect(() => { + const ncryptsec = state.ncryptsec; + if (!ncryptsec || savedForRef.current === ncryptsec) return; + savedForRef.current = ncryptsec; + onCreated?.(); + setIsSaving(true); + setSaveError(null); + const rollBack = () => { + savedForRef.current = null; + dispatch({ type: "back-to-password" }); + }; + void saveNcryptsecCopy(ncryptsec) + .then((path) => { + if (path) { + setSavedPath(path); + onSaved?.(path); + } else { + // User canceled the native save dialog — nothing was downloaded. + rollBack(); + } + }) + .catch((err: unknown) => { + rollBack(); + if (mountedRef.current) + setSaveError( + err instanceof Error ? err.message : "Failed to save your key.", + ); + }) + .finally(() => { + if (mountedRef.current) setIsSaving(false); + }); + }, [ + dispatch, + onCreated, + onSaved, + savedForRef, + setSavedPath, + state.ncryptsec, + ]); + + const handleSaveCopy = React.useCallback(async () => { + if (!state.ncryptsec || isSaving) return; + setIsSaving(true); + setSaveError(null); + try { + const path = await saveNcryptsecCopy(state.ncryptsec); + if (mountedRef.current && path) { + setSavedPath(path); + onSaved?.(path); + } + } catch (err) { + if (mountedRef.current) + setSaveError( + err instanceof Error ? err.message : "Failed to save your key.", + ); + } finally { + if (mountedRef.current) setIsSaving(false); + } + }, [isSaving, onSaved, setSavedPath, state.ncryptsec]); + + const { setVerified, test, setTest } = session; + const handleVerified = React.useCallback(() => { + setVerified(true); + onVerified?.(); + }, [onVerified, setVerified]); + + const issue = passphraseIssue(state.passphrase); + const showBackupTimeline = + variant === "spotlight" && + !state.savedPassword && + !state.createError && + !saveError; + + // The test view requires a successful save, not just a committed blob — + // while the native save dialog is open the password form stays put. + if (state.ncryptsec && savedPath && guidedTest) { + return ( +
+ void handleSaveCopy()} + onVerified={handleVerified} + progress={test} + saveError={saveError} + variant={variant} + verifyButtonPortal={verifyButtonPortal} + /> +
+ ); + } + // Without the guided test (settings), a completed save keeps the form + // visible in its saved-password state: masked input, instant re-download, + // and the change-password confirmation guarding any edit. + + return ( +
+
+ {showBackupTimeline ? : null} +
+ { + if (state.savedPassword) { + event.preventDefault(); + setConfirmNewPassword(true); + } + }} + onPaste={(event) => { + if (state.savedPassword) { + event.preventDefault(); + setConfirmNewPassword(true); + } + }} + onChange={(event) => + dispatch({ type: "set-passphrase", value: event.target.value }) + } + onKeyDown={(event) => { + if (event.key !== "Enter" || event.nativeEvent.isComposing) + return; + event.preventDefault(); + if (downloadDisabled(state) || isSaving) return; + if (state.savedPassword && state.ncryptsec) { + void handleSaveCopy(); + return; + } + dispatch({ type: "download-clicked" }); + }} + placeholder={ + state.savedPassword + ? "" + : `Password (min ${MIN_PASSPHRASE_LEN} characters)` + } + type={isRevealed ? "text" : "password"} + value={state.passphrase} + /> + {state.savedPassword ? ( +
+ •••••••••••••••••••••••••••••••• +
+ ) : null} + {state.savedPassword ? ( + + Backup password saved; hidden for security. + + ) : null} + + setConfirmNewPassword(true) + : undefined + } + onGenerated={(value) => { + dispatch({ type: "set-passphrase", value }); + // A generated password must be visible so the user can save it. + setIsRevealed(true); + }} + securityTheme={variant === "spotlight"} + /> + {issue ? ( +

+ {issue} +

+ ) : null} +
+
+ + {state.savedPassword && state.ncryptsec && savedPath ? ( +
+

+ Backup saved to {savedPath} +

+

+ Your password isn't kept — download another copy anytime, or start + over to choose a new password. +

+
+ ) : null} + + {state.createError ? ( +

+ {state.createError} +

+ ) : null} + + {saveError ? ( +

+ {saveError} +

+ ) : null} + + {(() => { + // A queued download gets an explicit progress treatment. Background + // encryption stays silent until the user asks to download. + const createButton = ( +
+ {state.downloadPending || isSaving ? ( + + ) : null} + +
+ ); + // `undefined` = inline (settings); `null` = slot not mounted yet + // (skip a frame rather than flashing the button inline). + if (createButtonPortal === undefined) + return
{createButton}
; + return createButtonPortal + ? createPortal(createButton, createButtonPortal) + : null; + })()} + + + + Create a new backup password? + + Starting over lets you pick a new password and download a fresh + backup file. Backups you saved earlier will still work — just use + the password you created them with. + + + + + Keep current backup + + { + dispatch({ type: "start-new-backup" }); + setSavedPath(null); + savedForRef.current = null; + setTest(initialBackupTestProgress); + setIsRevealed(false); + }} + > + Start with a new password + + + + +
+ ); +} diff --git a/desktop/src/features/onboarding/ui/KeyringLockedScreen.tsx b/desktop/src/features/onboarding/ui/KeyringLockedScreen.tsx index 0376fc9709..a6a02f38c0 100644 --- a/desktop/src/features/onboarding/ui/KeyringLockedScreen.tsx +++ b/desktop/src/features/onboarding/ui/KeyringLockedScreen.tsx @@ -22,8 +22,8 @@ export function KeyringLockedScreen() { }, []); const handleImport = React.useCallback( - async (nsec: string) => { - const identity = await importIdentity(nsec); + async (nsec: string, password?: string) => { + const identity = await importIdentity(nsec, password); // Update the identity query cache so useIdentityQuery observers see // locked: false. The bootedLocked latch in hooks.ts will then route // to RelaunchRequiredScreen via bootedLocked && !identityLocked. diff --git a/desktop/src/features/onboarding/ui/MachineOnboardingFlow.tsx b/desktop/src/features/onboarding/ui/MachineOnboardingFlow.tsx index ca87c76636..cee17c68f8 100644 --- a/desktop/src/features/onboarding/ui/MachineOnboardingFlow.tsx +++ b/desktop/src/features/onboarding/ui/MachineOnboardingFlow.tsx @@ -1,20 +1,33 @@ import * as React from "react"; import type { QueryClient } from "@tanstack/react-query"; +import { ArrowUp } from "lucide-react"; +import { motion, useReducedMotion } from "motion/react"; import { getIdentity, importIdentity, persistCurrentIdentity, } from "@/shared/api/tauriIdentity"; +import type { IdentityStorage } from "@/shared/api/types"; import { Button } from "@/shared/ui/button"; import { StartupWindowDragRegion } from "@/shared/ui/StartupWindowDragRegion"; import { BackupStep } from "./BackupStep"; import { DefaultConfigStep } from "./DefaultConfigStep"; +import { DownloadKeyStep } from "./DownloadKeyStep"; +import { + backupSessionToPasswordEntry, + resetEncryptedBackupSession, + useEncryptedBackupSession, +} from "./EncryptedBackupCreator"; import { IdentityKeyHelpDialog } from "./IdentityKeyHelpDialog"; import { LandingBees } from "./LandingBees"; -import { NostrKeyImportForm } from "./NostrKeyImportForm"; +import { + NostrKeyImportForm, + type NostrKeyImportStage, +} from "./NostrKeyImportForm"; import { ONBOARDING_LANDING_CTA_CLASS, + ONBOARDING_SECONDARY_CTA_CLASS, OnboardingChrome, } from "./OnboardingChrome"; import { OnboardingFooterProvider } from "./OnboardingFooter"; @@ -28,6 +41,8 @@ export type MachineOnboardingPage = | "setup" | "config"; +type BackupSubview = "created" | "options" | "password"; + /** A pending navigation the parent should execute after RouterProvider mounts. */ export type PostOnboardingNavigation = { to: string; @@ -61,10 +76,27 @@ export function MachineOnboardingFlow({ const [error, setError] = React.useState(null); const [isPending, setIsPending] = React.useState(false); const [identityWasImported, setIdentityWasImported] = React.useState(false); + const [keyImportStage, setKeyImportStage] = + React.useState("key-entry"); const [selectedPubkey, setSelectedPubkey] = React.useState( null, ); + const [identityStorage, setIdentityStorage] = React.useState< + IdentityStorage | undefined + >(); const [readyRuntimeIds, setReadyRuntimeIds] = React.useState([]); + const [backupSubview, setBackupSubview] = + React.useState("created"); + const [backupDirection, setBackupDirection] = React.useState< + "forward" | "backward" + >("forward"); + const [returningFromSecurity, setReturningFromSecurity] = + React.useState(false); + // Owned here so switching between the yellow onboarding view and the dark + // security subview keeps the created backup, password, and test progress. + const backupSession = useEncryptedBackupSession(); + const reduceMotion = useReducedMotion() ?? false; + const isSecuritySubview = page === "backup" && backupSubview !== "created"; const handleReadyRuntimeIdsChange = React.useCallback( (runtimeIds: readonly string[]) => { setReadyRuntimeIds(Array.from(new Set(runtimeIds))); @@ -79,6 +111,10 @@ export function MachineOnboardingFlow({ const identity = await getIdentity(); queryClient.setQueryData(["identity"], identity); setSelectedPubkey(identity.pubkey); + setIdentityStorage(identity.storage); + setBackupDirection("forward"); + setReturningFromSecurity(false); + setBackupSubview("created"); setPage("backup"); } catch (cause) { setError( @@ -101,6 +137,10 @@ export function MachineOnboardingFlow({ const identity = await persistCurrentIdentity(); queryClient.setQueryData(["identity"], identity); setSelectedPubkey(identity.pubkey); + setIdentityStorage(identity.storage); + setBackupDirection("forward"); + setReturningFromSecurity(false); + setBackupSubview("created"); setPage("backup"); } catch (cause) { setError( @@ -112,8 +152,8 @@ export function MachineOnboardingFlow({ }, [queryClient]); const importExistingIdentity = React.useCallback( - async (nsec: string) => { - const identity = await importIdentity(nsec); + async (nsec: string, password?: string) => { + const identity = await importIdentity(nsec, password); continueWithIdentity(identity.pubkey); queryClient.setQueryData(["identity"], identity); setIdentityWasImported(true); @@ -126,6 +166,8 @@ export function MachineOnboardingFlow({ return (
{page === "identity" ? : null} - {page !== "identity" ? ( + {isSecuritySubview ? ( +
+ +
+ ) : page !== "identity" ? ( @@ -178,9 +237,12 @@ export function MachineOnboardingFlow({ : "Create a new identity key"} -
- - ) : ( - { - setNsecInput(event.target.value); - setImportError(null); - }} - placeholder="nsec1..." - ref={inputRef} - spellCheck={false} - type="password" - value={nsecInput} - /> - )} -
+ + + + ) : ( + { + setNsecInput(event.target.value); + setImportError(null); + }} + placeholder="nsec1..." + ref={inputRef} + spellCheck={false} + type="password" + value={nsecInput} + /> + )} + + ) : null} - {variant === "spotlight" ? null : ( - <> - { - void handleFiles(event.currentTarget.files); - event.currentTarget.value = ""; - }} - ref={fileInputRef} - tabIndex={-1} - type="file" - /> + {/* Hidden file input shared by both variants: the default drop zone and + the spotlight "Choose a backup file" button both open it. Accepts the + .ncryptsec backups our own save flow emits alongside raw .key files. */} + { + void handleFiles(event.currentTarget.files); + event.currentTarget.value = ""; + }} + ref={fileInputRef} + tabIndex={-1} + type="file" + /> - + ) : null} + + {isPasswordStage ? ( +
+ + +
+ { + setPassphrase(event.target.value); + setImportError(null); + }} + placeholder="Backup password" + ref={passphraseInputRef} + spellCheck={false} + type={isRevealed ? "text" : "password"} + value={passphrase} /> - setIsRevealed((current) => !current)} + size="icon" + type="button" + variant="ghost" > - Drop a key here - - - - )} + {isRevealed ? ( +
+
+ ) : null} -
- {previewNpub ? ( - variant === "spotlight" ? ( - // Spotlight uses the backup step's quiet caption language: - // centered, unboxed, with the npub in the shared olive key ink. -
-

-

-

- {previewNpub} -

-
- ) : ( -
- -
-

- This will use this Nostr identity: + {!isPasswordStage || errorMessage ? ( +

+ {!isPasswordStage && previewNpub ? ( + variant === "spotlight" ? ( + // Spotlight uses the backup step's quiet caption language: + // centered, unboxed, with the npub in the shared olive key ink. +
+

+

-

+

{previewNpub}

-
- ) - ) : null} + ) : ( +
+ +
+

+ This will use this Nostr identity: +

+

+ {previewNpub} +

+
+
+ ) + ) : null} - {showInvalidHint && !errorMessage ? ( -

- Waiting for a valid nsec1 key -

- ) : null} + {showInvalidHint && !errorMessage ? ( +

+ {isEncryptedInput + ? "Waiting for a complete ncryptsec backup" + : "Waiting for a valid nsec1 key"} +

+ ) : null} - {errorMessage ? ( -

{errorMessage}

- ) : null} -
+ {errorMessage ? ( +

+ {errorMessage} +

+ ) : null} +
+ ) : null} diff --git a/desktop/src/features/onboarding/ui/OnboardingChrome.tsx b/desktop/src/features/onboarding/ui/OnboardingChrome.tsx index 936313bce0..7a52ae4999 100644 --- a/desktop/src/features/onboarding/ui/OnboardingChrome.tsx +++ b/desktop/src/features/onboarding/ui/OnboardingChrome.tsx @@ -2,8 +2,8 @@ import { BuzzMark } from "@/shared/ui/buzz-logo/BuzzMark"; /** * Positions in the first-launch flow: landing, identity/key, harness setup, - * default config, community choice, community profile, meet the team. Used as - * the default pagination length when a flow doesn't pass an explicit total. + * default config, community choice, community profile, meet the team. Password + * backup is an optional subview of identity/key, not another position. */ export const TOTAL_ONBOARDING_PAGES = 7; @@ -17,6 +17,9 @@ const ONBOARDING_CTA_SHAPE = "h-[2.375rem] rounded-full px-6"; */ export const ONBOARDING_PRIMARY_CTA_CLASS = `${ONBOARDING_CTA_SHAPE} text-[var(--buzz-onboarding-cta-label)]`; +/** Inverted primary action used only on dark backup-security surfaces. */ +export const ONBOARDING_SECURITY_PRIMARY_CTA_CLASS = `${ONBOARDING_CTA_SHAPE} bg-white text-black/80 hover:bg-white/90 hover:text-black`; + /** * Primary-CTA styling for the landing screen only: the shared pill with the * chartreuse label (`--buzz-welcome-chartreuse`). The blue label is reserved @@ -24,6 +27,10 @@ export const ONBOARDING_PRIMARY_CTA_CLASS = `${ONBOARDING_CTA_SHAPE} text-[var(- */ export const ONBOARDING_LANDING_CTA_CLASS = `${ONBOARDING_CTA_SHAPE} text-[var(--buzz-welcome-chartreuse)]`; +/** Shared quiet pill for secondary actions throughout onboarding. */ +export const ONBOARDING_SECONDARY_CTA_CLASS = + "h-9 rounded-full bg-foreground/10 px-6 text-foreground hover:bg-foreground/15 hover:text-foreground"; + /** * Icon-control styling for onboarding surfaces that sit on the textured card: * olive backup ink (`--buzz-onboarding-backup-ink`) with a plain @@ -34,6 +41,10 @@ export const ONBOARDING_LANDING_CTA_CLASS = `${ONBOARDING_CTA_SHAPE} text-[var(- export const ONBOARDING_INK_ICON_CLASS = "text-[color:var(--buzz-onboarding-backup-ink)] hover:bg-transparent hover:text-foreground"; +/** Icon controls on the dark noisy backup surfaces stay visually unboxed. */ +export const ONBOARDING_SECURITY_ICON_CLASS = + "text-muted-foreground hover:bg-transparent hover:text-foreground"; + /** * Shared onboarding chrome shown on every page after the landing screen: a * static Buzz mark pinned to the top-left, and a centered pagination track that diff --git a/desktop/src/features/onboarding/ui/OnboardingFlow.tsx b/desktop/src/features/onboarding/ui/OnboardingFlow.tsx index 01a226e3de..a3653f750f 100644 --- a/desktop/src/features/onboarding/ui/OnboardingFlow.tsx +++ b/desktop/src/features/onboarding/ui/OnboardingFlow.tsx @@ -388,8 +388,8 @@ export function OnboardingFlow({ // key's relay profile reseeds the steps, and a key that already finished // onboarding on this machine skips straight into the app. const importExistingKey = React.useCallback( - async (nsec: string) => { - const identity = await importIdentity(nsec); + async (nsec: string, password?: string) => { + const identity = await importIdentity(nsec, password); relayClient.disconnect(); queryClient.setQueryData(["identity"], identity); queryClient.removeQueries({ queryKey: profileQueryKey }); diff --git a/desktop/src/features/onboarding/ui/OnboardingSlideTransition.tsx b/desktop/src/features/onboarding/ui/OnboardingSlideTransition.tsx index 82d9a0213c..ba5d8b2c87 100644 --- a/desktop/src/features/onboarding/ui/OnboardingSlideTransition.tsx +++ b/desktop/src/features/onboarding/ui/OnboardingSlideTransition.tsx @@ -14,6 +14,7 @@ export type OnboardingTransitionDirection = "forward" | "backward"; export type OnboardingTransitionEffect = | "fade" | "line-slide" + | "mask-reveal-down" | "mask-reveal-up" | "none"; diff --git a/desktop/src/features/onboarding/ui/SetupStep.tsx b/desktop/src/features/onboarding/ui/SetupStep.tsx index 431c9b2f51..911ddaf362 100644 --- a/desktop/src/features/onboarding/ui/SetupStep.tsx +++ b/desktop/src/features/onboarding/ui/SetupStep.tsx @@ -698,25 +698,28 @@ function SetupStepContent({ /> - - - + {/* Relative row keeps the primary CTA truly centered while Skip + hangs off its right edge without shifting the center. */} +
+ + +
+ + + + + + + + ); +} diff --git a/desktop/src/features/messages/ui/MessageActionBar.tsx b/desktop/src/features/messages/ui/MessageActionBar.tsx index ba45bc62fb..967e50f5d2 100644 --- a/desktop/src/features/messages/ui/MessageActionBar.tsx +++ b/desktop/src/features/messages/ui/MessageActionBar.tsx @@ -35,17 +35,8 @@ import { copyTextToClipboard } from "@/shared/lib/clipboard"; import { emojiDisplayName } from "@/shared/lib/emojiName"; import { rewriteRelayUrl } from "@/shared/lib/mediaUrl"; import { KIND_HUDDLE_STARTED } from "@/shared/constants/kinds"; -import { - AlertDialog, - AlertDialogAction, - AlertDialogCancel, - AlertDialogContent, - AlertDialogDescription, - AlertDialogFooter, - AlertDialogHeader, - AlertDialogTitle, -} from "@/shared/ui/alert-dialog"; import { Button } from "@/shared/ui/button"; +import { DeleteMessageConfirmDialog } from "./DeleteMessageConfirmDialog"; import { DropdownMenu, DropdownMenuContent, @@ -277,35 +268,11 @@ function MoreActionsMenu({ {onDelete ? ( - onDelete(message)} onOpenChange={setIsDeleteDialogOpen} open={isDeleteDialogOpen} - > - - - Delete message? - - This will permanently delete this message and cannot be undone. - - - - - - - - - - - - + /> ) : null} {canReport ? ( diff --git a/desktop/src/features/messages/ui/MessageComposer.tsx b/desktop/src/features/messages/ui/MessageComposer.tsx index df3a734cee..69e4ec67b5 100644 --- a/desktop/src/features/messages/ui/MessageComposer.tsx +++ b/desktop/src/features/messages/ui/MessageComposer.tsx @@ -513,10 +513,9 @@ function MessageComposerImpl({ if (editTargetRef.current && onEditSaveRef.current) { if (isSendingRef.current || isUploadingRef.current) return; const currentPendingImeta = media.pendingImetaRef.current; - const hasMedia = currentPendingImeta.length > 0; - // Empty text + zero attachments is a no-op (don't let edit become an - // effective deletion). - if (!trimmed && !hasMedia) return; + // No empty-edit guard here: clearing an edit to empty (no text, no + // attachments) flows through to onEditSave as empty content, which + // deletes the message instead of publishing it (see handleEditSave). // Build the edit's body + imeta tag set. Coerce `mediaTags ?? []` // because edit semantics use `[]` as the explicit "wipe all diff --git a/desktop/tests/e2e/empty-edit-delete.spec.ts b/desktop/tests/e2e/empty-edit-delete.spec.ts new file mode 100644 index 0000000000..772506571b --- /dev/null +++ b/desktop/tests/e2e/empty-edit-delete.spec.ts @@ -0,0 +1,120 @@ +import { expect, test } from "@playwright/test"; + +import { installMockBridge } from "../helpers/bridge"; + +// The mock identity's own pre-seeded message in #general (authored by +// DEFAULT_MOCK_IDENTITY.pubkey in e2eBridge.ts). Editing/deleting one's own +// message is exactly Sam's workflow: "delete a message by clearing its edit." +const OWN_MESSAGE_ID = "mock-general-welcome"; +const ORIGINAL_CONTENT = "Welcome to #general"; + +// Open the more-actions menu for a message row and wait for the menu to mount. +async function openMoreActionsMenu( + page: import("@playwright/test").Page, + messageId: string, +) { + const row = page.locator(`[data-message-id="${messageId}"]`); + await row.hover(); + await page.getByTestId(`more-actions-${messageId}`).click(); + await expect(page.locator('[role="menuitem"]').first()).toBeVisible({ + timeout: 5_000, + }); +} + +// Enter edit mode for a message, clear it to empty, and submit — the gesture +// that triggers the empty-edit delete confirmation. +async function submitEmptyEdit( + page: import("@playwright/test").Page, + messageId: string, +) { + await openMoreActionsMenu(page, messageId); + await page.getByTestId(`edit-message-${messageId}`).click(); + await expect(page.getByTestId("edit-target")).toBeVisible({ timeout: 5_000 }); + // Edit mode sets the editor content via Tiptap's async transaction pipeline; + // wait for it to populate before we clear it. + const input = page.getByTestId("message-input"); + await expect(input).not.toBeEmpty({ timeout: 5_000 }); + await input.click(); + await page.keyboard.press("ControlOrMeta+A"); + await page.keyboard.press("Backspace"); + await expect(input).toBeEmpty(); + await page.keyboard.press("Enter"); +} + +test.beforeEach(async ({ page }) => { + await installMockBridge(page); + await page.goto("/"); + await page.getByTestId("channel-general").click(); + await expect(page.getByTestId("chat-title")).toHaveText("general"); +}); + +test("clearing an edit to empty prompts to delete, then deletes on confirm", async ({ + page, +}) => { + const row = page.locator(`[data-message-id="${OWN_MESSAGE_ID}"]`); + await expect(row).toBeVisible({ timeout: 10_000 }); + + await submitEmptyEdit(page, OWN_MESSAGE_ID); + + // The same "Delete message?" confirmation the Delete menu action shows — an + // empty edit is routed through it, not silently deleted. + const dialog = page.getByRole("alertdialog"); + await expect(dialog).toBeVisible({ timeout: 5_000 }); + await expect(dialog).toContainText("Delete message?"); + // Edit mode stays active while the dialog is open — it exits only on confirm. + await expect(page.getByTestId("edit-target")).toBeVisible(); + + // Confirm → the message row is removed and edit mode has exited. + await dialog.getByRole("button", { name: "Delete" }).click(); + await expect(dialog).toBeHidden({ timeout: 5_000 }); + await expect(page.getByTestId("edit-target")).toBeHidden(); + await expect(row).toBeHidden({ timeout: 5_000 }); +}); + +test("cancelling the empty-edit delete keeps the message", async ({ page }) => { + const row = page.locator(`[data-message-id="${OWN_MESSAGE_ID}"]`); + await expect(row).toBeVisible({ timeout: 10_000 }); + + await submitEmptyEdit(page, OWN_MESSAGE_ID); + + const dialog = page.getByRole("alertdialog"); + await expect(dialog).toBeVisible({ timeout: 5_000 }); + + // Cancel → nothing is deleted, the original message survives, and the user is + // left in edit mode (the editing session is preserved, not discarded). + await dialog.getByRole("button", { name: "Cancel" }).click(); + await expect(dialog).toBeHidden({ timeout: 5_000 }); + await expect(page.getByTestId("edit-target")).toBeVisible(); + await expect(row).toBeVisible(); + await expect(page.getByTestId("message-timeline")).toContainText( + ORIGINAL_CONTENT, + ); +}); + +test("a non-empty edit still edits and never deletes", async ({ page }) => { + const row = page.locator(`[data-message-id="${OWN_MESSAGE_ID}"]`); + await expect(row).toBeVisible({ timeout: 10_000 }); + + await openMoreActionsMenu(page, OWN_MESSAGE_ID); + await page.getByTestId(`edit-message-${OWN_MESSAGE_ID}`).click(); + await expect(page.getByTestId("edit-target")).toBeVisible({ timeout: 5_000 }); + const input = page.getByTestId("message-input"); + await expect(input).not.toBeEmpty({ timeout: 5_000 }); + const editedContent = `Edited, not deleted ${Date.now()}`; + + await input.click(); + await page.keyboard.press("ControlOrMeta+A"); + await page.keyboard.type(editedContent); + await page.keyboard.press("Enter"); + + // No delete confirmation, edit mode exits, the row survives with new text. + await expect(page.getByRole("alertdialog")).toHaveCount(0); + await expect(page.getByTestId("edit-target")).toBeHidden({ timeout: 5_000 }); + await expect(row).toBeVisible(); + await expect(page.getByTestId("message-timeline")).toContainText( + editedContent, + ); + await expect(page.getByTestId("message-timeline")).not.toContainText( + ORIGINAL_CONTENT, + ); +}); From d48b0e0eec4d2958f90a3cafa9d974450abe8501 Mon Sep 17 00:00:00 2001 From: John Matthew Tennant Date: Fri, 31 Jul 2026 07:00:15 -0400 Subject: [PATCH 102/112] feat(desktop): upgrade Pocket TTS model (#3266) ## Context Buzz Desktop currently installs an older Pocket TTS model bundle. The current bundle changes the tokenizer, learned BOS input, recurrent-state contract, and prompt behavior, so updating download URLs alone is not compatible. ## Summary This PR upgrades Buzz Desktop to the current pinned Pocket TTS model. It preserves existing product behavior and the hard 50-token model-input limit while adding the required runtime support, verified acquisition, and crash-safe cache migration. ## Changes - Pins an immutable Pocket TTS revision, artifact names, exact byte sizes, SHA-256 checksums, Mary reference voice, and license. - Loads the bundle-matched SentencePiece tokenizer, learned BOS embedding, and bundle-declared recurrent states. - Uses one pinned Pocket TTS configuration; no precision or model-version selector is added. - Preserves the resident engine's exact `<= 50` token contract without changing Desktop segmentation policy. - Bumps the Pocket cache manifest to v4, verifies size and checksum before adoption, atomically swaps the cache, and recovers the last verified cache after interrupted installs, including an incomplete final directory. - Keeps acquisition, cache migration, worker adoption, and tests within the existing Desktop implementation. - Removes the obsolete model-quality harness, which was coupled to the superseded production prompt and model layout. ## Related issue None. ## Testing Manual listening completed on the exact Desktop build. The updated model improved speech quality and resolved the phrase-start and sample-onset artifacts. Reproducible integrity and model checks are below. ## Screenshots N/A. This changes model installation and speech synthesis, not a visual surface. ## Reviewer-reproducible examples ### Before and after model identity ```sh git show 35305bfc8fd456ca9a17caa1ddbfaabd87d46981:desktop/src-tauri/src/huddle/models.rs \ | grep -E 'sherpa-onnx-pocket-tts|TTS_MODEL_VERSION' git show 211d17c58567448fe7ac95c4fa0ad2b88378849a:desktop/src-tauri/src/huddle/pocket_models.rs \ | grep -E 'MODEL_REPOSITORY|MODEL_REVISION|MODEL_PRECISION|MAX_TOKENS' ``` The target branch identifies the January bundle. The PR branch identifies the immutable April revision, INT8 precision, and 50-token maximum. ### Deterministic runtime validation Use the pinned artifacts listed in `pocket_models.rs` and run the model-dependent Pocket tests with the model directory supplied by the test environment. The checked-in long-sentence fixture must preserve its expected 48 and 44 token split and produce non-silent PCM. ### Manual listening validation John listened to an untrimmed Pocket TTS onset-stress clip generated from the exact user-provided passage, with every sentence synthesized separately and identical 100 ms digital-silence boundaries. The clip used no leading period, onset trimming, gain adjustment, or loudness normalization. The updated model produced better-quality speech and resolved the start-of-sample artifacts. --------- Signed-off-by: John Tennant Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta Co-authored-by: John Tennant Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta --- desktop/src-tauri/Cargo.lock | 461 ++++++++- desktop/src-tauri/Cargo.toml | 5 + desktop/src-tauri/examples/pocket_bench.rs | 116 --- .../src-tauri/examples/pocket_clip_probe.rs | 122 --- .../src-tauri/examples/pocket_onset_probe.rs | 149 --- .../src-tauri/examples/pocket_quality_ab.rs | 519 ---------- desktop/src-tauri/src/huddle/models.rs | 241 +++-- desktop/src-tauri/src/huddle/models_tests.rs | 148 +++ desktop/src-tauri/src/huddle/pocket.rs | 672 ++----------- desktop/src-tauri/src/huddle/pocket_april.rs | 940 ++++++++++++++++++ desktop/src-tauri/src/huddle/pocket_models.rs | 130 +++ desktop/src-tauri/src/huddle/tts.rs | 200 ++-- desktop/src-tauri/src/huddle/tts_tests.rs | 34 +- .../src/huddle/tts_tests/token_split.rs | 24 + 14 files changed, 2047 insertions(+), 1714 deletions(-) delete mode 100644 desktop/src-tauri/examples/pocket_bench.rs delete mode 100644 desktop/src-tauri/examples/pocket_clip_probe.rs delete mode 100644 desktop/src-tauri/examples/pocket_onset_probe.rs delete mode 100644 desktop/src-tauri/examples/pocket_quality_ab.rs create mode 100644 desktop/src-tauri/src/huddle/models_tests.rs create mode 100644 desktop/src-tauri/src/huddle/pocket_april.rs create mode 100644 desktop/src-tauri/src/huddle/pocket_models.rs create mode 100644 desktop/src-tauri/src/huddle/tts_tests/token_split.rs diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 325eb9aa67..aca89d7ed7 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -84,6 +84,7 @@ dependencies = [ "cfg-if 1.0.4", "getrandom 0.3.4", "once_cell", + "serde", "version_check", "zerocopy", ] @@ -707,6 +708,12 @@ version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6" +[[package]] +name = "base64" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" + [[package]] name = "base64" version = "0.21.7" @@ -731,6 +738,12 @@ version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32637268377fc7b10a8c6d51de3e7fba1ce5dd371a96e342b34e6078db558e7f" +[[package]] +name = "beef" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3a8241f3ebb85c056b509d4327ad0358fbbba6ffb340bf388f26350aeda225b1" + [[package]] name = "bip39" version = "2.2.2" @@ -1065,8 +1078,11 @@ dependencies = [ "objc2-app-kit", "objc2-foundation", "opus", + "ort", + "ort-sys", "plist", "png 0.18.1", + "rand 0.10.2", "regex", "reqwest 0.13.4", "rodio", @@ -1074,6 +1090,7 @@ dependencies = [ "rusqlite", "rustls", "security-framework 3.7.0", + "sentencepiece-model", "serde", "serde_json", "serde_yaml", @@ -1093,6 +1110,7 @@ dependencies = [ "tauri-plugin-updater", "tauri-plugin-window-state", "tempfile", + "tokenizers", "tokio", "tokio-tungstenite 0.29.0", "tokio-util", @@ -1562,6 +1580,7 @@ dependencies = [ "itoa", "rustversion", "ryu", + "serde", "static_assertions", ] @@ -1813,6 +1832,16 @@ dependencies = [ "crossbeam-utils", ] +[[package]] +name = "crossbeam-deque" +version = "0.8.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb" +dependencies = [ + "crossbeam-epoch", + "crossbeam-utils", +] + [[package]] name = "crossbeam-epoch" version = "0.9.20" @@ -2137,6 +2166,15 @@ dependencies = [ "syn 2.0.118", ] +[[package]] +name = "dary_heap" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b1e3a325bc115f096c8b77bbf027a7c2592230e70be2d985be950d3d5e60ebe" +dependencies = [ + "serde", +] + [[package]] name = "dasp_sample" version = "0.11.0" @@ -2634,6 +2672,12 @@ version = "3.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59" +[[package]] +name = "esaxx-rs" +version = "0.1.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d817e038c30374a4bcb22f94d0a8a0e216958d4c3dcde369b1439fec4bdda6e6" + [[package]] name = "euclid" version = "0.22.14" @@ -2692,6 +2736,17 @@ dependencies = [ "regex", ] +[[package]] +name = "fancy-regex" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298" +dependencies = [ + "bit-set 0.8.0", + "regex-automata", + "regex-syntax", +] + [[package]] name = "fast-srgb8" version = "1.0.0" @@ -4763,6 +4818,39 @@ version = "0.4.33" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" +[[package]] +name = "logos" +version = "0.14.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7251356ef8cb7aec833ddf598c6cb24d17b689d20b993f9d11a3d764e34e6458" +dependencies = [ + "logos-derive", +] + +[[package]] +name = "logos-codegen" +version = "0.14.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "59f80069600c0d66734f5ff52cc42f2dabd6b29d205f333d61fd7832e9e9963f" +dependencies = [ + "beef", + "fnv", + "lazy_static", + "proc-macro2", + "quote", + "regex-syntax", + "syn 2.0.118", +] + +[[package]] +name = "logos-derive" +version = "0.14.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24fb722b06a9dc12adb0963ed585f19fc61dc5413e6a9be9422ef92c091e731d" +dependencies = [ + "logos-codegen", +] + [[package]] name = "loom" version = "0.7.2" @@ -4872,6 +4960,22 @@ dependencies = [ "libc", ] +[[package]] +name = "macro_rules_attribute" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b3ae8f6d608c795738406608304d30a2dfbdc8e58e44f7ba43236da5208ded3c" +dependencies = [ + "macro_rules_attribute-proc_macro", + "pastey", +] + +[[package]] +name = "macro_rules_attribute-proc_macro" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc04a4c58212d57930a24bf47d3fa87485264a3a054e9c10e042eb373573ad3c" + [[package]] name = "markup5ever" version = "0.38.0" @@ -4898,6 +5002,16 @@ version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3" +[[package]] +name = "matrixmultiply" +version = "0.3.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f607c237553f086e7043417a51df26b2eb899d3caff94e6a67592ff992fedc7" +dependencies = [ + "autocfg", + "rawpointer", +] + [[package]] name = "maybe-async" version = "0.2.11" @@ -4997,7 +5111,7 @@ dependencies = [ "mesh-llm-types", "model-artifact", "nostr-sdk", - "prost", + "prost 0.14.4", "rand 0.10.2", "rustls", "serde", @@ -5135,7 +5249,7 @@ dependencies = [ "opentelemetry", "opentelemetry-otlp", "opentelemetry_sdk", - "prost", + "prost 0.14.4", "rand 0.10.2", "regex-lite", "reqwest 0.12.28", @@ -5224,8 +5338,8 @@ source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05 dependencies = [ "anyhow", "async-trait", - "prost", - "prost-build", + "prost 0.14.4", + "prost-build 0.14.4", "protoc-bin-vendored", "rmcp", "schemars 1.2.1", @@ -5261,7 +5375,7 @@ dependencies = [ "anyhow", "hex", "iroh", - "prost", + "prost 0.14.4", "serde_json", "sha2 0.10.9", ] @@ -5376,6 +5490,28 @@ dependencies = [ "tracing", ] +[[package]] +name = "miette" +version = "7.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7" +dependencies = [ + "cfg-if 1.0.4", + "miette-derive", + "unicode-width 0.1.14", +] + +[[package]] +name = "miette-derive" +version = "7.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.118", +] + [[package]] name = "mime" version = "0.3.17" @@ -5521,6 +5657,28 @@ dependencies = [ "uuid", ] +[[package]] +name = "monostate" +version = "0.1.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3341a273f6c9d5bef1908f17b7267bbab0e95c9bf69a0d4dcf8e9e1b2c76ef67" +dependencies = [ + "monostate-impl", + "serde", + "serde_core", +] + +[[package]] +name = "monostate-impl" +version = "0.1.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e4db6d5580af57bf992f59068d4ea26fd518574ff48d7639b255a36f9de6e7e9" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.118", +] + [[package]] name = "more-asserts" version = "0.3.1" @@ -5648,6 +5806,21 @@ dependencies = [ "tempfile", ] +[[package]] +name = "ndarray" +version = "0.17.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "520080814a7a6b4a6e9070823bb24b4531daac8c4627e08ba5de8c5ef2f2752d" +dependencies = [ + "matrixmultiply", + "num-complex", + "num-integer", + "num-traits", + "portable-atomic", + "portable-atomic-util", + "rawpointer", +] + [[package]] name = "ndk" version = "0.9.0" @@ -6149,7 +6322,7 @@ version = "0.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8" dependencies = [ - "proc-macro-crate 2.0.2", + "proc-macro-crate 3.5.0", "proc-macro2", "quote", "syn 2.0.118", @@ -6629,7 +6802,7 @@ dependencies = [ "opentelemetry-http", "opentelemetry-proto", "opentelemetry_sdk", - "prost", + "prost 0.14.4", "reqwest 0.12.28", "thiserror 2.0.18", ] @@ -6644,7 +6817,7 @@ dependencies = [ "const-hex", "opentelemetry", "opentelemetry_sdk", - "prost", + "prost 0.14.4", "serde", "serde_json", "tonic", @@ -6710,6 +6883,24 @@ dependencies = [ "pin-project-lite", ] +[[package]] +name = "ort" +version = "2.0.0-rc.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d7de3af33d24a745ffb8fab904b13478438d1cd52868e6f17735ef6e1f8bf133" +dependencies = [ + "ndarray", + "ort-sys", + "smallvec", + "tracing", +] + +[[package]] +name = "ort-sys" +version = "2.0.0-rc.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d7b497d21a8b6fbb4b5a544f8fadb77e801a09ae0add9e411d31c6f89e3c1e90" + [[package]] name = "os_pipe" version = "1.2.3" @@ -6937,6 +7128,16 @@ dependencies = [ "pest", ] +[[package]] +name = "petgraph" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772" +dependencies = [ + "fixedbitset 0.5.7", + "indexmap 2.14.0", +] + [[package]] name = "petgraph" version = "0.8.3" @@ -7201,6 +7402,15 @@ dependencies = [ "serde", ] +[[package]] +name = "portable-atomic-util" +version = "0.2.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618" +dependencies = [ + "portable-atomic", +] + [[package]] name = "portmapper" version = "0.19.1" @@ -7411,6 +7621,16 @@ dependencies = [ "unarray", ] +[[package]] +name = "prost" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5" +dependencies = [ + "bytes", + "prost-derive 0.13.5", +] + [[package]] name = "prost" version = "0.14.4" @@ -7418,7 +7638,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1" dependencies = [ "bytes", - "prost-derive", + "prost-derive 0.14.4", +] + +[[package]] +name = "prost-build" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf" +dependencies = [ + "heck 0.5.0", + "itertools", + "log", + "multimap", + "once_cell", + "petgraph 0.7.1", + "prettyplease", + "prost 0.13.5", + "prost-types 0.13.5", + "regex", + "syn 2.0.118", + "tempfile", ] [[package]] @@ -7431,15 +7671,28 @@ dependencies = [ "itertools", "log", "multimap", - "petgraph", + "petgraph 0.8.3", "prettyplease", - "prost", - "prost-types", + "prost 0.14.4", + "prost-types 0.14.4", "regex", "syn 2.0.118", "tempfile", ] +[[package]] +name = "prost-derive" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d" +dependencies = [ + "anyhow", + "itertools", + "proc-macro2", + "quote", + "syn 2.0.118", +] + [[package]] name = "prost-derive" version = "0.14.4" @@ -7453,13 +7706,35 @@ dependencies = [ "syn 2.0.118", ] +[[package]] +name = "prost-reflect" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7b5edd582b62f5cde844716e66d92565d7faf7ab1445c8cebce6e00fba83ddb2" +dependencies = [ + "logos", + "miette", + "once_cell", + "prost 0.13.5", + "prost-types 0.13.5", +] + +[[package]] +name = "prost-types" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16" +dependencies = [ + "prost 0.13.5", +] + [[package]] name = "prost-types" version = "0.14.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a" dependencies = [ - "prost", + "prost 0.14.4", ] [[package]] @@ -7526,6 +7801,33 @@ version = "3.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3" +[[package]] +name = "protox" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f352af331bf637b8ecc720f7c87bf903d2571fa2e14a66e9b2558846864b54a" +dependencies = [ + "bytes", + "miette", + "prost 0.13.5", + "prost-reflect", + "prost-types 0.13.5", + "protox-parse", + "thiserror 1.0.69", +] + +[[package]] +name = "protox-parse" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a3a462d115462c080ae000c29a47f0b3985737e5d3a995fcdbcaa5c782068dde" +dependencies = [ + "logos", + "miette", + "prost-types 0.13.5", + "thiserror 1.0.69", +] + [[package]] name = "pxfm" version = "0.1.30" @@ -7774,7 +8076,7 @@ dependencies = [ "thiserror 2.0.18", "unicode-segmentation", "unicode-truncate", - "unicode-width", + "unicode-width 0.2.2", ] [[package]] @@ -7837,7 +8139,7 @@ dependencies = [ "strum", "time", "unicode-segmentation", - "unicode-width", + "unicode-width 0.2.2", ] [[package]] @@ -7846,6 +8148,43 @@ version = "0.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539" +[[package]] +name = "rawpointer" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3" + +[[package]] +name = "rayon" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d" +dependencies = [ + "either", + "rayon-core", +] + +[[package]] +name = "rayon-cond" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2964d0cf57a3e7a06e8183d14a8b527195c706b7983549cd5462d5aa3747438f" +dependencies = [ + "either", + "itertools", + "rayon", +] + +[[package]] +name = "rayon-core" +version = "1.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91" +dependencies = [ + "crossbeam-deque", + "crossbeam-utils", +] + [[package]] name = "realfft" version = "3.5.0" @@ -8658,6 +8997,18 @@ version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73" +[[package]] +name = "sentencepiece-model" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "40b87bf750a8322c3236d7aa63c1f4a6862187d00d2d8b038e1dfe263bfe43ec" +dependencies = [ + "miette", + "prost 0.13.5", + "prost-build 0.13.5", + "protox", +] + [[package]] name = "serde" version = "1.0.228" @@ -9090,8 +9441,8 @@ name = "skippy-protocol" version = "0.74.0" source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.74.0#e60b2fe43aa05271569fbeff2a457133aef456a1" dependencies = [ - "prost", - "prost-build", + "prost 0.14.4", + "prost-build 0.14.4", "protoc-bin-vendored", "serde", ] @@ -9271,6 +9622,18 @@ dependencies = [ "der", ] +[[package]] +name = "spm_precompiled" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5851699c4033c63636f7ea4cf7b7c1f1bf06d0cc03cfb42e711de5a5c46cf326" +dependencies = [ + "base64 0.13.1", + "nom 7.1.3", + "serde", + "unicode-segmentation", +] + [[package]] name = "sse-stream" version = "0.2.4" @@ -9652,7 +10015,7 @@ version = "1.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fce91f2f0ec87dff7e6bcbbeb267439aa1188703003c6055193c821487400432" dependencies = [ - "unicode-width", + "unicode-width 0.2.2", ] [[package]] @@ -10227,7 +10590,7 @@ dependencies = [ "anyhow", "base64 0.22.1", "bitflags 2.13.0", - "fancy-regex", + "fancy-regex 0.11.0", "filedescriptor", "finl_unicode", "fixedbitset 0.4.2", @@ -10390,6 +10753,39 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" +[[package]] +name = "tokenizers" +version = "0.22.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b238e22d44a15349529690fb07bd645cf58149a1b1e44d6cb5bd1641ff1a6223" +dependencies = [ + "ahash", + "aho-corasick", + "compact_str 0.9.1", + "dary_heap", + "derive_builder", + "esaxx-rs", + "fancy-regex 0.14.0", + "getrandom 0.3.4", + "itertools", + "log", + "macro_rules_attribute", + "monostate", + "paste", + "rand 0.9.4", + "rayon", + "rayon-cond", + "regex", + "regex-syntax", + "serde", + "serde_json", + "spm_precompiled", + "thiserror 2.0.18", + "unicode-normalization-alignments", + "unicode-segmentation", + "unicode_categories", +] + [[package]] name = "tokio" version = "1.52.3" @@ -10723,7 +11119,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0" dependencies = [ "bytes", - "prost", + "prost 0.14.4", "tonic", ] @@ -10904,7 +11300,7 @@ checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6" dependencies = [ "memchr", "nom 8.0.0", - "petgraph", + "petgraph 0.8.3", ] [[package]] @@ -11075,6 +11471,15 @@ dependencies = [ "tinyvec", ] +[[package]] +name = "unicode-normalization-alignments" +version = "0.1.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43f613e4fa046e69818dd287fdc4bc78175ff20331479dab6e1b0f98d57062de" +dependencies = [ + "smallvec", +] + [[package]] name = "unicode-segmentation" version = "1.13.3" @@ -11089,9 +11494,15 @@ checksum = "16b380a1238663e5f8a691f9039c73e1cdae598a30e9855f541d29b08b53e9a5" dependencies = [ "itertools", "unicode-segmentation", - "unicode-width", + "unicode-width 0.2.2", ] +[[package]] +name = "unicode-width" +version = "0.1.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af" + [[package]] name = "unicode-width" version = "0.2.2" @@ -11104,6 +11515,12 @@ version = "0.2.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" +[[package]] +name = "unicode_categories" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e" + [[package]] name = "universal-hash" version = "0.5.1" diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 6f3c03c5a5..248eac107e 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -82,6 +82,9 @@ bytes = "1" futures-util = "0.3" opus = "0.3" neteq = { version = "0.8", default-features = false } +ort = { version = "=2.0.0-rc.12", default-features = false, features = ["api-24", "ndarray", "std"] } +ort-sys = { version = "=2.0.0-rc.12", features = ["disable-linking"] } +rand = "0.10" serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yaml = "0.9" @@ -125,6 +128,7 @@ image = { version = "0.25", default-features = false, features = ["jpeg", "png", zip = "8" flate2 = "1" sherpa-onnx = "1.12" +sentencepiece-model = "0.1" regex = "1" rusqlite = { version = "0.37", features = ["bundled"] } axum = "0.8" @@ -135,6 +139,7 @@ audioadapter-buffers = "3.0" tempfile = "3" strip-ansi-escapes = "0.2" tracing = "0.1" +tokenizers = { version = "0.22", default-features = false, features = ["fancy-regex"] } [dev-dependencies] # `test-util` enables tokio's paused-clock (`start_paused`) so the relay diff --git a/desktop/src-tauri/examples/pocket_bench.rs b/desktop/src-tauri/examples/pocket_bench.rs deleted file mode 100644 index b4f5635a95..0000000000 --- a/desktop/src-tauri/examples/pocket_bench.rs +++ /dev/null @@ -1,116 +0,0 @@ -//! Cold-vs-warm latency bench for Pocket TTS. -//! -//! This duplicates the small config-building snippet from `huddle::pocket` so it -//! doesn't depend on changing module visibility for a one-off dev tool. -//! Keep in sync with `huddle::pocket::load_text_to_speech`. -//! -//! Run with the model files in a directory (defaults to /tmp/pocket-tts-bench): -//! cargo run --release --example pocket_bench -//! cargo run --release --example pocket_bench /path/to/pocket-tts - -use std::path::PathBuf; -use std::time::Instant; - -use sherpa_onnx::{ - self, GenerationConfig, OfflineTts, OfflineTtsConfig, OfflineTtsModelConfig, - OfflineTtsPocketModelConfig, Wave, -}; - -const SAMPLE_RATE: u32 = 24_000; -const TEST_TEXT: &str = - "Hello, this is a test of the new Pocket TTS engine running on sherpa-onnx."; - -fn main() { - let model_dir = std::env::args() - .nth(1) - .unwrap_or_else(|| "/tmp/pocket-tts-bench".to_string()); - println!("Model dir: {model_dir}"); - - let dir = PathBuf::from(&model_dir); - let p = |name: &str| dir.join(name).to_string_lossy().into_owned(); - - let t0 = Instant::now(); - let cfg = OfflineTtsConfig { - model: OfflineTtsModelConfig { - pocket: OfflineTtsPocketModelConfig { - lm_main: Some(p("lm_main.int8.onnx")), - lm_flow: Some(p("lm_flow.int8.onnx")), - encoder: Some(p("encoder.onnx")), - decoder: Some(p("decoder.int8.onnx")), - text_conditioner: Some(p("text_conditioner.onnx")), - vocab_json: Some(p("vocab.json")), - token_scores_json: Some(p("token_scores.json")), - voice_embedding_cache_capacity: 16, - }, - num_threads: 1, - debug: false, - ..Default::default() - }, - ..Default::default() - }; - let engine = OfflineTts::create(&cfg).expect("engine create"); - let load_ms = t0.elapsed().as_secs_f32() * 1000.0; - println!("Engine load: {load_ms:.1} ms"); - - let t0 = Instant::now(); - let voice_path = dir.join("reference_sample.wav"); - let wave = Wave::read(voice_path.to_str().unwrap()).expect("voice WAV"); - let samples = wave.samples().to_vec(); - let sr = wave.sample_rate(); - let voice_ms = t0.elapsed().as_secs_f32() * 1000.0; - println!("Voice load: {voice_ms:.1} ms"); - - let gen = || GenerationConfig { - speed: 1.05, - num_steps: 1, - silence_scale: 1.0, // production setting (huddle::pocket::SYNTH_SILENCE_SCALE) - reference_audio: Some(samples.clone()), - reference_sample_rate: sr, - ..Default::default() - }; - - let t0 = Instant::now(); - let cold = engine - .generate_with_config(TEST_TEXT, &gen(), None:: bool>) - .expect("cold synth"); - let cold_ms = t0.elapsed().as_secs_f32() * 1000.0; - let cold_audio_ms = (cold.samples().len() as f32 / SAMPLE_RATE as f32) * 1000.0; - let cold_rtf_x = cold_audio_ms / cold_ms; - println!( - "Cold synth: {cold_ms:.1} ms → {cold_audio_ms:.1} ms audio → {cold_rtf_x:.2}× realtime" - ); - - let t0 = Instant::now(); - let warm = engine - .generate_with_config(TEST_TEXT, &gen(), None:: bool>) - .expect("warm synth"); - let warm_ms = t0.elapsed().as_secs_f32() * 1000.0; - let warm_audio_ms = (warm.samples().len() as f32 / SAMPLE_RATE as f32) * 1000.0; - let warm_rtf_x = warm_audio_ms / warm_ms; - println!( - "Warm synth: {warm_ms:.1} ms → {warm_audio_ms:.1} ms audio → {warm_rtf_x:.2}× realtime" - ); - - let out_path = "/tmp/pocket_bench_out.wav"; - let ok = sherpa_onnx::write(out_path, warm.samples(), SAMPLE_RATE as i32); - println!( - "Wrote {} ({} samples, ok={ok})", - out_path, - warm.samples().len() - ); - - let delta_ms = cold_ms - warm_ms; - let delta_pct = (delta_ms / warm_ms) * 100.0; - println!(); - println!("Cold/warm delta: {delta_ms:+.1} ms ({delta_pct:+.1}%)"); - println!( - "Decision: warmup {}.", - if delta_ms > 200.0 { - "RECOMMENDED — significant cold-call penalty" - } else if delta_ms > 50.0 { - "OPTIONAL — small cold-call penalty" - } else { - "UNNECESSARY — cold and warm essentially equal" - } - ); -} diff --git a/desktop/src-tauri/examples/pocket_clip_probe.rs b/desktop/src-tauri/examples/pocket_clip_probe.rs deleted file mode 100644 index ad8657599f..0000000000 --- a/desktop/src-tauri/examples/pocket_clip_probe.rs +++ /dev/null @@ -1,122 +0,0 @@ -//! Clipping probe for any fixed playback gain applied after Pocket TTS synth. -//! -//! Synthesises a spread of sentences (short/long, calm/energetic) and reports -//! the raw peak of each, the post-gain peak, and the fraction of samples that -//! would hit a ±1.0 clamp — i.e. how much a fixed gain would flat-top the -//! waveform ("blown out" distortion). -//! -//! History: the production pipeline briefly shipped a fixed 9.3× gain -//! calibrated on a single bench utterance that peaked at 0.076. This probe -//! showed real output peaks at 0.4–0.97, so that gain clipped 13–34% of all -//! samples (the 2026-06-12 "blown out" report). Production now applies no -//! gain — run this probe before reintroducing one. -//! -//! Run with model files in ~/.buzz/models/pocket-tts (override with arg 1): -//! cargo run --release --example pocket_clip_probe - -use std::path::PathBuf; - -use sherpa_onnx::{ - self, GenerationConfig, OfflineTts, OfflineTtsConfig, OfflineTtsModelConfig, - OfflineTtsPocketModelConfig, Wave, -}; - -/// Candidate gain under test (the regressed production value). -const GAIN: f32 = 9.3; - -const PROMPTS: &[&str] = &[ - "Hello, this is a test of the new Pocket TTS engine running on sherpa-onnx.", - "Yep, I can hear you.", - "Absolutely! That sounds fantastic, let's do it right now!", - "The quick brown fox jumps over the lazy dog near the riverbank.", - "I found three problems in the code: a race condition, a memory leak, and an off-by-one error in the loop bounds.", - "No.", - "Warning! The build failed because seventeen tests crashed unexpectedly!", - "Sure, I can walk you through the whole pipeline step by step whenever you're ready.", -]; - -fn main() { - let model_dir = std::env::args().nth(1).unwrap_or_else(|| { - dirs::home_dir() - .expect("home dir") - .join(".buzz/models/pocket-tts") - .to_string_lossy() - .into_owned() - }); - eprintln!("Model dir: {model_dir}"); - - let dir = PathBuf::from(&model_dir); - let p = |name: &str| dir.join(name).to_string_lossy().into_owned(); - - let cfg = OfflineTtsConfig { - model: OfflineTtsModelConfig { - pocket: OfflineTtsPocketModelConfig { - lm_main: Some(p("lm_main.int8.onnx")), - lm_flow: Some(p("lm_flow.int8.onnx")), - encoder: Some(p("encoder.onnx")), - decoder: Some(p("decoder.int8.onnx")), - text_conditioner: Some(p("text_conditioner.onnx")), - vocab_json: Some(p("vocab.json")), - token_scores_json: Some(p("token_scores.json")), - voice_embedding_cache_capacity: 16, - }, - num_threads: 1, - debug: false, - ..Default::default() - }, - ..Default::default() - }; - let engine = OfflineTts::create(&cfg).expect("engine create"); - - let voice_path = dir.join("reference_sample.wav"); - let wave = Wave::read(voice_path.to_str().unwrap()).expect("voice WAV"); - let voice_samples = wave.samples().to_vec(); - let voice_sr = wave.sample_rate(); - - let gen = || GenerationConfig { - speed: 1.05, - num_steps: 1, - silence_scale: 1.0, - reference_audio: Some(voice_samples.clone()), - reference_sample_rate: voice_sr, - ..Default::default() - }; - - let _ = engine.generate_with_config("warmup.", &gen(), None:: bool>); - - println!( - "{:<46} | {:>8} | {:>9} | {:>9} | {:>10}", - "prompt", "raw peak", "raw RMS", "post-gain", "% clipped" - ); - println!("{}", "-".repeat(95)); - - let mut worst_clip = 0.0f32; - for prompt in PROMPTS { - let out = engine - .generate_with_config(prompt, &gen(), None:: bool>) - .expect("synth"); - let samples = out.samples(); - - let peak = samples.iter().fold(0.0f32, |m, s| m.max(s.abs())); - let rms = (samples.iter().map(|s| s * s).sum::() / samples.len() as f32).sqrt(); - let post = peak * GAIN; - let clipped = samples.iter().filter(|s| s.abs() * GAIN > 1.0).count(); - let clip_pct = 100.0 * clipped as f32 / samples.len() as f32; - worst_clip = worst_clip.max(clip_pct); - - let label: String = prompt.chars().take(44).collect(); - println!("{label:<46} | {peak:>8.4} | {rms:>9.4} | {post:>9.3} | {clip_pct:>9.3}%"); - } - - println!(); - println!( - "Verdict: worst-case clipped fraction {worst_clip:.3}% — {}", - if worst_clip > 0.1 { - "AUDIBLE DISTORTION LIKELY (gain too hot)" - } else if worst_clip > 0.0 { - "marginal — occasional transient clipping" - } else { - "no clipping at this gain" - } - ); -} diff --git a/desktop/src-tauri/examples/pocket_onset_probe.rs b/desktop/src-tauri/examples/pocket_onset_probe.rs deleted file mode 100644 index 05b4d0193c..0000000000 --- a/desktop/src-tauri/examples/pocket_onset_probe.rs +++ /dev/null @@ -1,149 +0,0 @@ -//! Onset-attenuation probe for Pocket TTS. -//! -//! Synthesises a handful of short sentences and dumps per-sentence onset -//! statistics (samples[0], 1ms/5ms/20ms peak + RMS) so we can decide whether -//! the production `apply_fades` 8 ms fade-in is masking real audio. -//! -//! Also writes the raw (un-faded, un-normalised) audio of each sentence to -//! /tmp so they can be inspected in Audacity / aplay without rodio in the -//! loop. -//! -//! Run with model files in /tmp/pocket-tts-bench (override with arg 1): -//! cargo run --release --example pocket_onset_probe -//! cargo run --release --example pocket_onset_probe /path/to/pocket-tts - -use std::path::PathBuf; - -use sherpa_onnx::{ - self, GenerationConfig, OfflineTts, OfflineTtsConfig, OfflineTtsModelConfig, - OfflineTtsPocketModelConfig, Wave, -}; - -const SAMPLE_RATE: u32 = 24_000; - -/// Test prompts chosen to span different onsets: -/// - palatal glide 'Y' (soft onset) -/// - voiceless fricative 'H' (very soft onset) -/// - labio-velar glide 'W' (medium onset) -/// - voiceless stop 'T' (hard onset) -const PROMPTS: &[&str] = &[ - "Yep, I can hear you.", - "Hello there friend.", - "What can I help with?", - "Try this experiment now.", -]; - -fn main() { - let model_dir = std::env::args() - .nth(1) - .unwrap_or_else(|| "/tmp/pocket-tts-bench".to_string()); - eprintln!("Model dir: {model_dir}"); - - let dir = PathBuf::from(&model_dir); - let p = |name: &str| dir.join(name).to_string_lossy().into_owned(); - - let cfg = OfflineTtsConfig { - model: OfflineTtsModelConfig { - pocket: OfflineTtsPocketModelConfig { - lm_main: Some(p("lm_main.int8.onnx")), - lm_flow: Some(p("lm_flow.int8.onnx")), - encoder: Some(p("encoder.onnx")), - decoder: Some(p("decoder.int8.onnx")), - text_conditioner: Some(p("text_conditioner.onnx")), - vocab_json: Some(p("vocab.json")), - token_scores_json: Some(p("token_scores.json")), - voice_embedding_cache_capacity: 16, - }, - num_threads: 1, - debug: false, - ..Default::default() - }, - ..Default::default() - }; - let engine = OfflineTts::create(&cfg).expect("engine create"); - - let voice_path = dir.join("reference_sample.wav"); - let wave = Wave::read(voice_path.to_str().unwrap()).expect("voice WAV"); - let voice_samples = wave.samples().to_vec(); - let voice_sr = wave.sample_rate(); - - // Warmup so we're not measuring cold-call jitter. - { - let cfg = GenerationConfig { - speed: 1.05, - num_steps: 1, - silence_scale: 1.0, // production setting (huddle::pocket::SYNTH_SILENCE_SCALE) - reference_audio: Some(voice_samples.clone()), - reference_sample_rate: voice_sr, - ..Default::default() - }; - let _ = engine.generate_with_config("warmup.", &cfg, None:: bool>); - } - - println!( - "{:<28} | {:>10} | {:>10} {:>10} | {:>10} {:>10} | {:>10} {:>10}", - "prompt", - "samples[0]", - "peak@1ms", - "rms@1ms", - "peak@5ms", - "rms@5ms", - "peak@20ms", - "rms@20ms" - ); - println!("{}", "-".repeat(120)); - - for prompt in PROMPTS { - // Mirror the production prompt-prep (capitalise + terminal punctuation). - // These prompts already have it, so this is just to match what - // sherpa-onnx sees in production. - let cfg = GenerationConfig { - speed: 1.05, - num_steps: 1, - silence_scale: 1.0, // production setting (huddle::pocket::SYNTH_SILENCE_SCALE) - reference_audio: Some(voice_samples.clone()), - reference_sample_rate: voice_sr, - ..Default::default() - }; - let out = engine - .generate_with_config(prompt, &cfg, None:: bool>) - .expect("synth"); - let samples = out.samples(); - - let n_1ms = (SAMPLE_RATE as f32 * 0.001) as usize; - let n_5ms = (SAMPLE_RATE as f32 * 0.005) as usize; - let n_20ms = (SAMPLE_RATE as f32 * 0.020) as usize; - - let stats = |range: &[f32]| -> (f32, f32) { - if range.is_empty() { - return (0.0, 0.0); - } - let peak = range.iter().fold(0.0_f32, |a, &x| a.max(x.abs())); - let sumsq: f32 = range.iter().map(|x| x * x).sum(); - let rms = (sumsq / range.len() as f32).sqrt(); - (peak, rms) - }; - - let first = samples.first().copied().unwrap_or(0.0); - let (p1, r1) = stats(&samples[..n_1ms.min(samples.len())]); - let (p5, r5) = stats(&samples[..n_5ms.min(samples.len())]); - let (p20, r20) = stats(&samples[..n_20ms.min(samples.len())]); - - println!( - "{:<28} | {:>10.6} | {:>10.6} {:>10.6} | {:>10.6} {:>10.6} | {:>10.6} {:>10.6}", - prompt, first, p1, r1, p5, r5, p20, r20 - ); - - let safe: String = prompt - .chars() - .map(|c| if c.is_ascii_alphanumeric() { c } else { '_' }) - .collect(); - let out_path = format!("/tmp/pocket_onset_{}.wav", &safe[..safe.len().min(24)]); - let _ = sherpa_onnx::write(&out_path, samples, SAMPLE_RATE as i32); - eprintln!( - " → wrote {out_path} ({} samples = {:.3} s)", - samples.len(), - samples.len() as f32 / SAMPLE_RATE as f32 - ); - } -} diff --git a/desktop/src-tauri/examples/pocket_quality_ab.rs b/desktop/src-tauri/examples/pocket_quality_ab.rs deleted file mode 100644 index 0c31f1c910..0000000000 --- a/desktop/src-tauri/examples/pocket_quality_ab.rs +++ /dev/null @@ -1,519 +0,0 @@ -//! Reproducible blind Pocket TTS quality corpus generator. -//! -//! Renders Buzz's production prompt preparation and post-processing across: -//! INT8/FP32 × per-sentence/grouped generation. The generated filenames are -//! deterministically blinded; keep `key.json` away from listeners until their -//! scoring sheet is complete. -//! -//! Usage: -//! cargo run --release --example pocket_quality_ab -- \ -//! [--idle-minutes N --only ITEM] -//! -//! The optional idle run intentionally creates one engine per condition, warms -//! all four, sleeps once, and then makes each clip the first generation after -//! dormancy. It requires `--only` because only the first synthesis after an -//! uninterrupted idle is a valid post-idle observation. Run each 5/15-minute -//! item as a separate process. - -// Importing the production module also brings in runtime-only helpers that this -// standalone corpus generator deliberately does not call. -#![allow(dead_code)] - -#[path = "../src/huddle/pocket.rs"] -mod production_pocket; -#[path = "../src/huddle/preprocessing.rs"] -mod production_preprocessing; - -use std::collections::HashMap; -use std::fs; -use std::path::{Path, PathBuf}; -use std::time::{Duration, Instant}; - -use serde::Serialize; -use sha2::{Digest, Sha256}; -use sherpa_onnx::{GenerationConfig, OfflineTts, OfflineTtsConfig, Wave}; - -use production_pocket::{prepare_pocket_prompt, SAMPLE_RATE}; -use production_preprocessing::{preprocess_for_tts, split_sentences}; - -const NUM_STEPS: i32 = 1; -const SILENCE_SCALE: f32 = 1.0; -const INTER_SENTENCE_SILENCE_SAMPLES: usize = SAMPLE_RATE as usize / 10; -const LEAD_IN_SAMPLES: usize = SAMPLE_RATE as usize / 50; -const FADE_OUT_SAMPLES: usize = SAMPLE_RATE as usize * 8 / 1000; -const TARGET_RMS_DBFS: f32 = -23.0; -const BLINDING_SEED: &str = "pocket-quality-2026-07-21-v1"; - -const CORPUS: &[CorpusItem] = &[ - CorpusItem { id: "short_one_word", kind: "short", text: "Yep." }, - CorpusItem { id: "short_four_words", kind: "short", text: "Sounds good to me." }, - CorpusItem { - id: "multi_relay_review", - kind: "multi-sentence", - text: "I looked at the relay code this morning. The lease logic is solid. There's one race in the worker claim path, though. I'll write it up and send you a patch.", - }, - CorpusItem { - id: "multi_community_size", - kind: "multi-sentence", - text: "Great question. The answer is it depends on the community size. For small ones, keep it simple.", - }, - CorpusItem { - id: "mixed_agent_message", - kind: "mixed", - text: "That's 42 open PRs right now — mostly small. I'll triage them after lunch.", - }, -]; - -#[derive(Clone, Copy)] -struct CorpusItem { - id: &'static str, - kind: &'static str, - text: &'static str, -} - -#[derive(Clone, Copy, Debug, Serialize)] -#[serde(rename_all = "snake_case")] -enum Precision { - Int8, - Fp32, -} - -#[derive(Clone, Copy, Debug, Serialize)] -#[serde(rename_all = "snake_case")] -enum Chunking { - PerSentence, - Grouped, -} - -#[derive(Clone, Copy, Debug)] -struct Condition { - precision: Precision, - chunking: Chunking, -} - -const CONDITIONS: [Condition; 4] = [ - Condition { - precision: Precision::Int8, - chunking: Chunking::PerSentence, - }, - Condition { - precision: Precision::Int8, - chunking: Chunking::Grouped, - }, - Condition { - precision: Precision::Fp32, - chunking: Chunking::PerSentence, - }, - Condition { - precision: Precision::Fp32, - chunking: Chunking::Grouped, - }, -]; - -#[derive(Serialize)] -struct KeyFile { - warning: &'static str, - blinding_seed: &'static str, - target_rms_dbfs: f32, - items: Vec, -} - -#[derive(Serialize)] -struct KeyItem { - id: String, - kind: String, - text: String, - clips: Vec, -} - -#[derive(Serialize)] -struct KeyClip { - file: String, - precision: Precision, - chunking: Chunking, - cold_start: bool, - idle_minutes: Option, - synthesis_ms: u128, - audio_seconds: f32, -} - -struct Voice { - samples: Vec, - sample_rate: i32, -} - -struct Engine { - inner: OfflineTts, - voice: Voice, -} - -fn main() -> Result<(), String> { - let mut args = std::env::args().skip(1); - let int8_dir = required_path(args.next(), "INT8 model directory")?; - let fp32_dir = required_path(args.next(), "FP32 model directory")?; - let output_dir = required_path(args.next(), "output directory")?; - let mut idle_minutes = None; - let mut only_item = None; - while let Some(arg) = args.next() { - match arg.as_str() { - "--idle-minutes" => { - idle_minutes = Some( - args.next() - .ok_or("--idle-minutes requires a value")? - .parse::() - .map_err(|e| format!("invalid idle minutes: {e}"))?, - ); - } - "--only" => only_item = Some(args.next().ok_or("--only requires an item ID")?), - _ => return Err(format!("unknown argument: {arg}")), - } - } - - if idle_minutes.is_some() && only_item.is_none() { - return Err("--idle-minutes requires --only so every clip is first-after-idle".into()); - } - if let Some(ref requested) = only_item { - if !CORPUS.iter().any(|item| item.id == requested) { - return Err(format!("unknown corpus item for --only: {requested}")); - } - } - - validate_model_dir(&int8_dir, Precision::Int8)?; - validate_model_dir(&fp32_dir, Precision::Fp32)?; - fs::create_dir_all(&output_dir).map_err(|e| e.to_string())?; - - let mut engines = Vec::with_capacity(CONDITIONS.len()); - for condition in CONDITIONS { - let dir = match condition.precision { - Precision::Int8 => &int8_dir, - Precision::Fp32 => &fp32_dir, - }; - let engine = load_engine(dir, condition.precision)?; - // Production warms once before serving a real utterance. Cold cases use - // separate fresh engines below and deliberately skip this call. - synth_chunks(&engine, &["warmup".to_string()])?; - engines.push(engine); - } - - if let Some(minutes) = idle_minutes { - eprintln!("All four warmed engines idle for {minutes} minute(s)…"); - std::thread::sleep(Duration::from_secs(minutes * 60)); - } - - let mut key_items = Vec::new(); - for item in CORPUS { - if only_item - .as_deref() - .is_some_and(|requested| requested != item.id) - { - continue; - } - let preprocessed = preprocess_for_tts(item.text); - let per_sentence: Vec = split_sentences(&preprocessed) - .into_iter() - .filter(|s| !s.trim().is_empty()) - .collect(); - // These corpus texts are deliberately below the upstream ~50-token - // grouping target, so grouped mode is one exact generate() call. - let grouped = vec![per_sentence.join(" ")]; - let item_dir = output_dir.join(item.id); - fs::create_dir_all(&item_dir).map_err(|e| e.to_string())?; - let clip_order = blinded_order(item.id); - let mut clips = Vec::new(); - - let mut rendered = Vec::new(); - for (condition_index, engine) in engines.iter().enumerate() { - let condition = CONDITIONS[condition_index]; - let chunks = match condition.chunking { - Chunking::PerSentence => &per_sentence, - Chunking::Grouped => &grouped, - }; - let started = Instant::now(); - let audio = synth_chunks(engine, chunks)?; - rendered.push(( - condition_index, - condition, - audio, - started.elapsed().as_millis(), - )); - } - loudness_match_item(&mut rendered); - for (condition_index, condition, audio, synth_ms) in rendered { - let clip_number = clip_order[condition_index] + 1; - let file_name = format!("clip{clip_number}.wav"); - write_wav(&item_dir.join(&file_name), &audio)?; - clips.push(KeyClip { - file: format!("{}/{file_name}", item.id), - precision: condition.precision, - chunking: condition.chunking, - cold_start: false, - idle_minutes, - synthesis_ms: synth_ms, - audio_seconds: audio.len() as f32 / SAMPLE_RATE as f32, - }); - } - clips.sort_by(|a, b| a.file.cmp(&b.file)); - key_items.push(KeyItem { - id: item.id.to_string(), - kind: item.kind.to_string(), - text: item.text.to_string(), - clips, - }); - } - - // Explicit fresh-engine cold-start clips for the two highest-signal texts. - // Idle runs intentionally omit them: they happen after the post-idle clips - // and add no valid idle observation. - for item in if idle_minutes.is_none() { CORPUS } else { &[] } { - if !matches!(item.id, "short_one_word" | "multi_relay_review") { - continue; - } - if only_item - .as_deref() - .is_some_and(|requested| requested != item.id) - { - continue; - } - let cold_id = format!("cold_{}", item.id); - let preprocessed = preprocess_for_tts(item.text); - let sentences: Vec = split_sentences(&preprocessed) - .into_iter() - .filter(|s| !s.trim().is_empty()) - .collect(); - let grouped = vec![sentences.join(" ")]; - let item_dir = output_dir.join(&cold_id); - fs::create_dir_all(&item_dir).map_err(|e| e.to_string())?; - let clip_order = blinded_order(&cold_id); - let mut clips = Vec::new(); - let mut rendered = Vec::new(); - for (condition_index, condition) in CONDITIONS.iter().copied().enumerate() { - let dir = match condition.precision { - Precision::Int8 => &int8_dir, - Precision::Fp32 => &fp32_dir, - }; - let engine = load_engine(dir, condition.precision)?; - let chunks = match condition.chunking { - Chunking::PerSentence => &sentences, - Chunking::Grouped => &grouped, - }; - let started = Instant::now(); - let audio = synth_chunks(&engine, chunks)?; - rendered.push(( - condition_index, - condition, - audio, - started.elapsed().as_millis(), - )); - } - loudness_match_item(&mut rendered); - for (condition_index, condition, audio, synth_ms) in rendered { - let clip_number = clip_order[condition_index] + 1; - let file_name = format!("clip{clip_number}.wav"); - write_wav(&item_dir.join(&file_name), &audio)?; - clips.push(KeyClip { - file: format!("{cold_id}/{file_name}"), - precision: condition.precision, - chunking: condition.chunking, - cold_start: true, - idle_minutes: None, - synthesis_ms: synth_ms, - audio_seconds: audio.len() as f32 / SAMPLE_RATE as f32, - }); - } - clips.sort_by(|a, b| a.file.cmp(&b.file)); - key_items.push(KeyItem { - id: cold_id, - kind: "cold-start".to_string(), - text: item.text.to_string(), - clips, - }); - } - - let key = KeyFile { - warning: "DO NOT OPEN UNTIL LISTENING SCORES ARE FINAL", - blinding_seed: BLINDING_SEED, - target_rms_dbfs: TARGET_RMS_DBFS, - items: key_items, - }; - fs::write( - output_dir.join("key.json"), - serde_json::to_vec_pretty(&key).map_err(|e| e.to_string())?, - ) - .map_err(|e| e.to_string())?; - write_scoring_sheet(&output_dir, &key)?; - println!("Wrote blind corpus to {}", output_dir.display()); - println!("Give listeners the WAV folders and SCORING.md; withhold key.json."); - Ok(()) -} - -fn required_path(value: Option, label: &str) -> Result { - value - .map(PathBuf::from) - .ok_or_else(|| format!("missing {label}")) -} - -fn model_file(precision: Precision, base: &str) -> String { - match precision { - Precision::Int8 => format!("{base}.int8.onnx"), - Precision::Fp32 => format!("{base}.onnx"), - } -} - -fn validate_model_dir(dir: &Path, precision: Precision) -> Result<(), String> { - for file in [ - model_file(precision, "lm_main"), - model_file(precision, "lm_flow"), - "encoder.onnx".into(), - model_file(precision, "decoder"), - "text_conditioner.onnx".into(), - "vocab.json".into(), - "token_scores.json".into(), - "reference_sample.wav".into(), - ] { - if !dir.join(&file).is_file() { - return Err(format!("missing {}", dir.join(file).display())); - } - } - Ok(()) -} - -fn load_engine(dir: &Path, precision: Precision) -> Result { - let p = |name: &str| dir.join(name).to_string_lossy().into_owned(); - let mut cfg = OfflineTtsConfig::default(); - cfg.model.pocket.lm_main = Some(p(&model_file(precision, "lm_main"))); - cfg.model.pocket.lm_flow = Some(p(&model_file(precision, "lm_flow"))); - cfg.model.pocket.encoder = Some(p("encoder.onnx")); - cfg.model.pocket.decoder = Some(p(&model_file(precision, "decoder"))); - cfg.model.pocket.text_conditioner = Some(p("text_conditioner.onnx")); - cfg.model.pocket.vocab_json = Some(p("vocab.json")); - cfg.model.pocket.token_scores_json = Some(p("token_scores.json")); - cfg.model.pocket.voice_embedding_cache_capacity = 16; - cfg.model.num_threads = 1; - cfg.model.debug = false; - let inner = - OfflineTts::create(&cfg).ok_or_else(|| format!("failed to create {precision:?} engine"))?; - let wave = - Wave::read(&p("reference_sample.wav")).ok_or("failed to read reference_sample.wav")?; - Ok(Engine { - inner, - voice: Voice { - samples: wave.samples().to_vec(), - sample_rate: wave.sample_rate(), - }, - }) -} - -fn synth_chunks(engine: &Engine, chunks: &[String]) -> Result, String> { - let mut out = Vec::new(); - for chunk in chunks { - let prepared = prepare_pocket_prompt(chunk).ok_or("empty prepared prompt")?; - let extra = prepared.max_frames.map(|max_frames| { - HashMap::from([( - "max_frames".to_string(), - serde_json::Value::from(max_frames), - )]) - }); - let cfg = GenerationConfig { - num_steps: NUM_STEPS, - silence_scale: SILENCE_SCALE, - reference_audio: Some(engine.voice.samples.clone()), - reference_sample_rate: engine.voice.sample_rate, - extra, - ..Default::default() - }; - let audio = engine - .inner - .generate_with_config(&prepared.text, &cfg, None:: bool>) - .ok_or_else(|| format!("synthesis failed for {chunk:?}"))?; - let mut samples: Vec = audio.samples().iter().map(|s| s.clamp(-1.0, 1.0)).collect(); - apply_fade_out(&mut samples); - out.extend(std::iter::repeat_n(0.0, LEAD_IN_SAMPLES)); - out.extend(samples); - out.extend(std::iter::repeat_n( - 0.0, - INTER_SENTENCE_SILENCE_SAMPLES - LEAD_IN_SAMPLES, - )); - } - Ok(out) -} - -fn apply_fade_out(samples: &mut [f32]) { - let fade = FADE_OUT_SAMPLES.min(samples.len() / 2); - for i in 0..fade { - samples[samples.len() - 1 - i] *= i as f32 / fade as f32; - } -} - -fn active_rms(samples: &[f32]) -> Option { - let (sum_squares, count) = samples - .iter() - .filter(|sample| sample.abs() > 1.0e-4) - .fold((0.0_f32, 0_usize), |(sum, count), sample| { - (sum + sample * sample, count + 1) - }); - (count > 0).then(|| (sum_squares / count as f32).sqrt()) -} - -/// Attenuate every clip in one comparison set to the quietest active-speech RMS. -/// This removes the louder-is-better confound without normalizing dynamics or -/// claiming standards-compliant integrated LUFS. The dBFS value is a ceiling. -fn loudness_match_item(rendered: &mut [(usize, Condition, Vec, u128)]) { - let ceiling = 10.0_f32.powf(TARGET_RMS_DBFS / 20.0); - let target = rendered - .iter() - .filter_map(|(_, _, samples, _)| active_rms(samples)) - .fold(ceiling, f32::min); - for (_, _, samples, _) in rendered { - let Some(rms) = active_rms(samples) else { - continue; - }; - let gain = (target / rms).min(1.0); - for sample in samples { - *sample *= gain; - } - } -} - -fn blinded_order(item_id: &str) -> [usize; 4] { - let mut keyed: Vec<(usize, Vec)> = (0..4) - .map(|index| { - let digest = Sha256::digest(format!("{BLINDING_SEED}:{item_id}:{index}")); - (index, digest.to_vec()) - }) - .collect(); - keyed.sort_by(|a, b| a.1.cmp(&b.1)); - let mut condition_to_clip = [0; 4]; - for (clip, (condition, _)) in keyed.into_iter().enumerate() { - condition_to_clip[condition] = clip; - } - condition_to_clip -} - -fn write_wav(path: &Path, samples: &[f32]) -> Result<(), String> { - let path = path - .to_str() - .ok_or_else(|| format!("non-UTF8 path: {}", path.display()))?; - if sherpa_onnx::write(path, samples, SAMPLE_RATE as i32) { - Ok(()) - } else { - Err(format!("failed to write {path}")) - } -} - -fn write_scoring_sheet(output_dir: &Path, key: &KeyFile) -> Result<(), String> { - let mut sheet = String::from("# Pocket TTS blind listening sheet\n\nDo not open `key.json` until this sheet is complete. Rank best to worst; ties are allowed.\n\n"); - for item in &key.items { - sheet.push_str(&format!( - "## {} ({})\n\n> {}\n\n", - item.id, item.kind, item.text - )); - sheet.push_str("Rank: `____ > ____ > ____ > ____`\n\n| Clip | seam | onset | garble | robotic | timbre | truncate | note |\n|---|---|---|---|---|---|---|---|\n"); - for clip in 1..=4 { - sheet.push_str(&format!( - "| clip{clip} | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | |\n" - )); - } - sheet.push('\n'); - } - fs::write(output_dir.join("SCORING.md"), sheet).map_err(|e| e.to_string()) -} diff --git a/desktop/src-tauri/src/huddle/models.rs b/desktop/src-tauri/src/huddle/models.rs index 169ddf66c0..11c9ee4c7d 100644 --- a/desktop/src-tauri/src/huddle/models.rs +++ b/desktop/src-tauri/src/huddle/models.rs @@ -24,6 +24,10 @@ use std::sync::{Arc, Mutex, OnceLock}; use serde::{Deserialize, Serialize}; use sha2::{Digest, Sha256}; +use super::pocket::{ + april_model_info, PocketModelArtifact, APRIL_BUNDLE_ID, APRIL_MODEL_ID, APRIL_MODEL_REVISION, +}; + // ── Integrity verification ──────────────────────────────────────────────────── // // All model artifacts are verified against pinned SHA-256 hashes before @@ -38,19 +42,15 @@ use sha2::{Digest, Sha256}; /// Computed from a known-good download. Update when upgrading model versions. const STT_ARCHIVE_SHA256: &str = "17f945007b52ccd8b7200ffc7c5652e9e8e961dfdf479cefcabd06cf5703630b"; -/// HuggingFace base URL for the sherpa-onnx Pocket TTS fp32 repackage. -/// -/// Pinned to commit 96d1e53ce3311ca6c2c6a35e2062d36b4cec6fa3 -/// (2026-02-10) for reproducible downloads. -/// -/// fp32 (not int8): a direct same-runtime A/B (k2-fsa/sherpa-onnx#3172) -/// found the ONNX int8 quantization audibly degraded Pocket TTS output and -/// that fp32 "significantly improved quality even at 1 step". The runtime -/// bundle grows from ~189 MB to ~473 MB; encoder, text conditioner, both -/// JSON tables, and LICENSE are byte-identical between the two repos — only -/// the three quantized sessions (lm_main, lm_flow, decoder) change. -const POCKET_HF_BASE: &str = - "https://huggingface.co/csukuangfj2/sherpa-onnx-pocket-tts-2026-01-26/resolve/96d1e53ce3311ca6c2c6a35e2062d36b4cec6fa3"; +fn pocket_artifact_url(filename: &str) -> String { + format!( + "https://huggingface.co/{APRIL_MODEL_ID}/resolve/{APRIL_MODEL_REVISION}/onnx/{APRIL_BUNDLE_ID}/{filename}" + ) +} + +fn pocket_license_url() -> String { + format!("https://huggingface.co/{APRIL_MODEL_ID}/resolve/{APRIL_MODEL_REVISION}/onnx/LICENSE") +} /// Reference voice WAV: "Mary (f, conversation)" from the Kyutai TTS demo /// voice set — VCTK speaker p333, ai-coustics-enhanced. Pinned to @@ -64,20 +64,19 @@ const POCKET_HF_BASE: &str = const POCKET_REFERENCE_WAV_URL: &str = "https://huggingface.co/kyutai/tts-voices/resolve/323332d33f997de8394f24a193e1a76df720e01a/vctk/p333_023_enhanced.wav"; -/// SHA-256 hashes for individual Pocket TTS model files. -/// Computed from known-good pinned downloads. Update when upgrading model versions. -#[rustfmt::skip] -const TTS_FILE_HASHES: &[(&str, &str)] = &[ - ("decoder.onnx", "f267880fde6c58b17b0a8f3647eaf8dcfad321f833f32d583ebc2fb2d1a15f10"), - ("encoder.onnx", "e8f2f6d301ffb96e398b138a7dc6d3038622d236044636b73d920bab85890260"), - ("lm_flow.onnx", "79c013a554a54e63319c33c0cc8830cbbedc9b7e448ae7e26f7923ae11f9873e"), - ("lm_main.onnx", "255d1a9263c5abdf36034abfc19c11d21cc5f40f0f87d8361288e972cbd5c578"), - ("text_conditioner.onnx", "0b84e837d7bfaf2c896627b03e3f080320309f37f4fc7df7698c644f7ba5e6b1"), - ("vocab.json", "6fb646346cf931016f70c4921aab0900ce7a304b893cb02135c74e294abfea01"), - ("token_scores.json", "5be2f278caf9b9800741f0fd82bff677f4943ec764c356f907213434b622d958"), - ("LICENSE", "fe7b4ce83b8381cc5b216bbb4af73c570688d1b819c73bbaed8ca401f4677cd6"), - ("reference_sample.wav", "a35b0468382218e9f37a9a7494d1e4b74deaf18d7ced22265b4e325bb55c183f"), -]; +const TTS_LICENSE_ARTIFACT: PocketModelArtifact = PocketModelArtifact { + filename: "LICENSE", + sha256: "fe7b4ce83b8381cc5b216bbb4af73c570688d1b819c73bbaed8ca401f4677cd6", + size_bytes: 18_655, + quantized: false, +}; + +const TTS_REFERENCE_ARTIFACT: PocketModelArtifact = PocketModelArtifact { + filename: "reference_sample.wav", + sha256: "a35b0468382218e9f37a9a7494d1e4b74deaf18d7ced22265b4e325bb55c183f", + size_bytes: 639_084, + quantized: false, +}; // ── Model versioning ────────────────────────────────────────────────────────── // @@ -92,15 +91,8 @@ const TTS_FILE_HASHES: &[(&str, &str)] = &[ /// honest (each version tag identifies one specific set of model bytes). const STT_MODEL_VERSION: &str = "2"; -/// Model manifest version for Pocket TTS. Increment when upgrading model files. -/// Bumped "1" → "2" when the bundled reference voice changed from KevinAHM's -/// anonymous 16 kHz sample to Mary (VCTK p333, 32 kHz, ai-coustics-enhanced) -/// from kyutai/tts-voices. The hash mismatch on `reference_sample.wav` would -/// fail readiness on its own, but the manifest bump makes the re-download -/// reason explicit and skips the failing-then-re-fetching transient state. -/// Bumped "2" → "3" for the int8 → fp32 model swap (see `POCKET_HF_BASE`): -/// existing int8 installs must re-download the suffixless fp32 sessions. -const TTS_MODEL_VERSION: &str = "3"; +/// Identifies the exact April INT8 asset set expected by readiness checks. +const TTS_MODEL_VERSION: &str = "4"; /// Filename for the version manifest written alongside model files. const MANIFEST_FILENAME: &str = ".buzz-model-manifest"; @@ -110,9 +102,9 @@ const MANIFEST_FILENAME: &str = ".buzz-model-manifest"; /// Maximum expected STT archive size (200 MB — actual is ~100 MB). const MAX_STT_DOWNLOAD_BYTES: u64 = 200 * 1024 * 1024; -/// Maximum expected Pocket TTS file size (400 MB per file — largest is -/// `lm_main.onnx` at ~303 MB fp32). -const MAX_TTS_FILE_BYTES: u64 = 400 * 1024 * 1024; +/// Maximum expected Pocket TTS file size. The largest pinned INT8 artifact is +/// `flow_lm_main_int8.onnx` at 76,341,079 bytes. +const MAX_TTS_FILE_BYTES: u64 = 100 * 1024 * 1024; /// NVIDIA Parakeet TDT-CTC 110M (English, int8) — packaged for sherpa-onnx by /// k2-fsa. Single ONNX file (CTC head) + tokens.txt. Avg WER ~7.5% across @@ -181,9 +173,9 @@ Original model by Kyutai: https://huggingface.co/kyutai/pocket-tts Paper: Charles, Roebel, et al., Pocket TTS (arXiv:2509.06926). Mimi neural codec by Kyutai is bundled as part of the model. -ONNX export by KevinAHM: https://huggingface.co/KevinAHM/pocket-tts-onnx -Sherpa-onnx repackage by csukuangfj / k2-fsa: -https://huggingface.co/csukuangfj2/sherpa-onnx-pocket-tts-2026-01-26 +April 2026 ONNX export by KevinAHM: +https://huggingface.co/KevinAHM/pocket-tts-onnx +Pinned revision: 58a6d00cf13d239b6748cb0769f35c580a8f606c Bundled reference voice (reference_sample.wav): \"Mary (f, conversation)\" preset from the Kyutai TTS demo voice catalogue @@ -203,13 +195,14 @@ license text for full warranty disclaimer. /// All files that must be present for Pocket TTS to be considered ready. const TTS_EXPECTED_FILES: &[&str] = &[ - "decoder.onnx", - "encoder.onnx", - "lm_flow.onnx", - "lm_main.onnx", + "bundle.json", + "bos_before_voice.npy", + "flow_lm_main_int8.onnx", + "flow_lm_flow_int8.onnx", + "mimi_decoder_int8.onnx", + "mimi_encoder.onnx", "text_conditioner.onnx", - "vocab.json", - "token_scores.json", + "tokenizer.model", "LICENSE", "reference_sample.wav", TTS_LICENSE_FILE_NAME, @@ -404,6 +397,7 @@ struct ModelSlot { dir_name: &'static str, // subdir under ~/.buzz/models/ expected_files: &'static [&'static str], // files required for "ready" version: &'static str, // manifest version; increment to force re-download + expected_size: fn(&str) -> Option, status: Arc>, just_ready: Arc, // fires once when download completes } @@ -418,11 +412,17 @@ impl ModelSlot { dir_name, expected_files, version, + expected_size: |_| None, status: Arc::new(Mutex::new(ModelStatus::NotDownloaded)), just_ready: Arc::new(AtomicBool::new(false)), } } + fn with_expected_sizes(mut self, expected_size: fn(&str) -> Option) -> Self { + self.expected_size = expected_size; + self + } + fn model_dir(&self, models_dir: &Path) -> PathBuf { models_dir.join(self.dir_name) } @@ -432,7 +432,17 @@ impl ModelSlot { std::fs::read_to_string(dir.join(MANIFEST_FILENAME)) .map(|v| v.trim() == self.version) .unwrap_or(false) - && self.expected_files.iter().all(|f| dir.join(f).is_file()) + && self.expected_files.iter().all(|filename| { + let path = dir.join(filename); + path.is_file() + && (self.expected_size)(filename) + .map(|expected| { + path.metadata() + .map(|metadata| metadata.len() == expected) + .unwrap_or(false) + }) + .unwrap_or(true) + }) } fn dir_if_ready(&self, models_dir: &Path) -> Option { @@ -453,6 +463,39 @@ impl ModelSlot { self.just_ready.swap(false, Ordering::AcqRel) } + /// Recover or clean up the backup left by an interrupted atomic install. + fn recover_interrupted_install(&self, models_dir: &Path) { + let final_dir = self.model_dir(models_dir); + let backup_dir = final_dir.with_extension("old"); + if !backup_dir.exists() { + return; + } + if self.is_ready(models_dir) { + if let Err(error) = std::fs::remove_dir_all(&backup_dir) { + eprintln!( + "buzz-desktop: could not remove stale {} backup: {error}", + self.dir_name + ); + } + return; + } + if final_dir.exists() { + if let Err(error) = std::fs::remove_dir_all(&final_dir) { + eprintln!( + "buzz-desktop: could not remove incomplete {} install: {error}", + self.dir_name + ); + return; + } + } + if let Err(error) = std::fs::rename(&backup_dir, &final_dir) { + eprintln!( + "buzz-desktop: could not restore interrupted {} install: {error}", + self.dir_name + ); + } + } + /// Spawn a background download task if not already ready or downloading. fn start_download( &self, @@ -511,6 +554,9 @@ impl ModelSlot { )); } + std::fs::write(source_dir.join(MANIFEST_FILENAME), self.version) + .map_err(|e| format!("write model manifest: {e}"))?; + let final_dir = self.model_dir(models_dir); let backup_dir = final_dir.with_extension("old"); @@ -529,8 +575,6 @@ impl ModelSlot { return Err(format!("install new model: {e}")); } - std::fs::write(final_dir.join(MANIFEST_FILENAME), self.version) - .map_err(|e| format!("write model manifest: {e}"))?; let _ = tokio::fs::remove_dir_all(&backup_dir).await; if let Some(extra) = temp_cleanup { let _ = tokio::fs::remove_dir_all(extra).await; @@ -542,6 +586,25 @@ impl ModelSlot { } } +fn tts_expected_size(filename: &str) -> Option { + april_model_info() + .artifacts + .iter() + .find(|artifact| artifact.filename == filename) + .map(|artifact| artifact.size_bytes) + .or_else(|| { + [TTS_LICENSE_ARTIFACT, TTS_REFERENCE_ARTIFACT] + .iter() + .find(|artifact| artifact.filename == filename) + .map(|artifact| artifact.size_bytes) + }) +} + +fn tts_model_slot() -> ModelSlot { + ModelSlot::new(TTS_MODEL_DIR_NAME, TTS_EXPECTED_FILES, TTS_MODEL_VERSION) + .with_expected_sizes(tts_expected_size) +} + // ── ModelManager ────────────────────────────────────────────────────────────── /// Manages download and location of STT/TTS model files. @@ -561,11 +624,13 @@ impl ModelManager { /// Returns `None` if the home directory cannot be resolved. pub fn new() -> Option { let models_dir = dirs::home_dir()?.join(".buzz").join("models"); - Some(Self { + let manager = Self { models_dir, stt: ModelSlot::new(STT_MODEL_DIR_NAME, STT_EXPECTED_FILES, STT_MODEL_VERSION), - tts: ModelSlot::new(TTS_MODEL_DIR_NAME, TTS_EXPECTED_FILES, TTS_MODEL_VERSION), - }) + tts: tts_model_slot(), + }; + manager.tts.recover_interrupted_install(&manager.models_dir); + Some(manager) } // ── STT accessors ──────────────────────────────────────────────────────── @@ -638,7 +703,7 @@ impl ModelManager { } } - /// Start a background Pocket TTS download (~189 MB). No-op if already ready or downloading. + /// Start a background Pocket TTS download. No-op if already ready or downloading. pub fn start_tts_download(&self, http_client: reqwest::Client) { let manager = self.clone(); self.tts.start_download( @@ -754,8 +819,8 @@ impl ModelManager { /// Download and verify the Pocket TTS model files from HuggingFace. /// /// Downloads files into `~/.buzz/models/pocket-tts/`: - /// - five ONNX sessions (Pocket TTS + Mimi codec) - /// - `vocab.json` / `token_scores.json` for sherpa-onnx text conditioning + /// - five ONNX sessions selected by the April INT8 bundle + /// - bundle metadata, SentencePiece tokenizer, and learned voice BOS /// - upstream `LICENSE` plus Buzz's `MODEL_LICENSE.txt` attribution sidecar /// - `reference_sample.wav` as the bundled default voice /// @@ -768,24 +833,18 @@ impl ModelManager { let temp_dir = self.models_dir.join("pocket-tts.tmp"); fresh_temp_dir(&temp_dir).await?; - let model_files = [ - "decoder.onnx", - "encoder.onnx", - "lm_flow.onnx", - "lm_main.onnx", - "text_conditioner.onnx", - "vocab.json", - "token_scores.json", - "LICENSE", - ]; - let mut downloads: Vec<(String, &'static str)> = model_files + let mut downloads: Vec<(String, PocketModelArtifact)> = april_model_info() + .artifacts .iter() - .map(|filename| (format!("{POCKET_HF_BASE}/{filename}"), *filename)) + .copied() + .map(|artifact| (pocket_artifact_url(artifact.filename), artifact)) .collect(); - downloads.push((POCKET_REFERENCE_WAV_URL.to_string(), "reference_sample.wav")); + downloads.push((pocket_license_url(), TTS_LICENSE_ARTIFACT)); + downloads.push((POCKET_REFERENCE_WAV_URL.to_string(), TTS_REFERENCE_ARTIFACT)); let total_files = downloads.len() as u32; - for (i, (url, filename)) in downloads.iter().enumerate() { + for (i, (url, artifact)) in downloads.iter().enumerate() { + let filename = artifact.filename; eprintln!("buzz-desktop: downloading Pocket TTS {filename} from {url}"); let response = fetch_url(&http_client, url, filename) @@ -822,16 +881,19 @@ impl ModelManager { })?; eprintln!("buzz-desktop: downloaded {bytes} bytes ({filename}), wrote to disk"); - let expected = TTS_FILE_HASHES - .iter() - .find(|(n, _)| *n == *filename) - .map(|(_, hash)| *hash) - .ok_or_else(|| format!("missing expected hash for Pocket TTS file: {filename}"))?; + if bytes != artifact.size_bytes { + let _ = tokio::fs::remove_dir_all(&temp_dir).await; + return Err(format!( + "Pocket TTS {filename} size check failed: expected {} bytes, got {bytes}", + artifact.size_bytes + )); + } let actual = sha256_file(&dest).await?; - if actual != expected { + if actual != artifact.sha256 { let _ = tokio::fs::remove_dir_all(&temp_dir).await; return Err(format!( - "Pocket TTS {filename} integrity check failed: expected {expected}, got {actual}" + "Pocket TTS {filename} integrity check failed: expected {}, got {actual}", + artifact.sha256 )); } @@ -931,24 +993,5 @@ pub fn is_tts_ready() -> bool { } #[cfg(test)] -mod tests { - use super::*; - - #[test] - fn tts_readiness_requires_license_sidecar() { - let temp = tempfile::tempdir().expect("tempdir"); - let slot = ModelSlot::new(TTS_MODEL_DIR_NAME, TTS_EXPECTED_FILES, TTS_MODEL_VERSION); - let model_dir = temp.path().join(TTS_MODEL_DIR_NAME); - std::fs::create_dir_all(&model_dir).expect("create model dir"); - - for file in TTS_EXPECTED_FILES { - std::fs::write(model_dir.join(file), b"test").expect("write expected file"); - } - std::fs::write(model_dir.join(MANIFEST_FILENAME), TTS_MODEL_VERSION).expect("manifest"); - - assert!(slot.is_ready(temp.path())); - - std::fs::remove_file(model_dir.join(TTS_LICENSE_FILE_NAME)).expect("remove sidecar"); - assert!(!slot.is_ready(temp.path())); - } -} +#[path = "models_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/huddle/models_tests.rs b/desktop/src-tauri/src/huddle/models_tests.rs new file mode 100644 index 0000000000..4bcb4081e0 --- /dev/null +++ b/desktop/src-tauri/src/huddle/models_tests.rs @@ -0,0 +1,148 @@ +use super::*; + +fn create_ready_model_dir(root: &Path) -> PathBuf { + let model_dir = root.join(TTS_MODEL_DIR_NAME); + std::fs::create_dir_all(&model_dir).expect("create model dir"); + for file in TTS_EXPECTED_FILES { + let path = model_dir.join(file); + let handle = std::fs::File::create(path).expect("create expected file"); + if let Some(size) = tts_expected_size(file) { + handle.set_len(size).expect("size expected file"); + } else { + std::fs::write(model_dir.join(file), b"test").expect("write expected file"); + } + } + std::fs::write(model_dir.join(MANIFEST_FILENAME), TTS_MODEL_VERSION).expect("manifest"); + model_dir +} + +#[test] +fn expected_files_match_april_int8_metadata() { + let mut expected = april_model_info() + .artifacts + .iter() + .map(|artifact| artifact.filename) + .chain([ + TTS_LICENSE_ARTIFACT.filename, + TTS_REFERENCE_ARTIFACT.filename, + TTS_LICENSE_FILE_NAME, + ]) + .collect::>(); + expected.sort_unstable(); + let mut actual = TTS_EXPECTED_FILES.to_vec(); + actual.sort_unstable(); + + assert_eq!(actual, expected); + assert!(!actual.contains(&"flow_lm_main.onnx")); + assert!(!actual.contains(&"flow_lm_flow.onnx")); + assert!(!actual.contains(&"mimi_decoder.onnx")); +} + +#[test] +fn tts_readiness_requires_license_sidecar() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let model_dir = create_ready_model_dir(temp.path()); + + assert!(slot.is_ready(temp.path())); + + std::fs::remove_file(model_dir.join(TTS_LICENSE_FILE_NAME)).expect("remove sidecar"); + assert!(!slot.is_ready(temp.path())); +} + +#[test] +fn tts_readiness_rejects_truncated_pinned_artifact() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let model_dir = create_ready_model_dir(temp.path()); + let artifact = april_model_info().artifacts[0]; + + std::fs::OpenOptions::new() + .write(true) + .open(model_dir.join(artifact.filename)) + .expect("open artifact") + .set_len(artifact.size_bytes - 1) + .expect("truncate artifact"); + + assert!(!slot.is_ready(temp.path())); +} + +#[test] +fn january_cache_is_not_ready_for_april_int8() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let model_dir = temp.path().join(TTS_MODEL_DIR_NAME); + std::fs::create_dir_all(&model_dir).expect("create model dir"); + for file in [ + "decoder.onnx", + "encoder.onnx", + "lm_flow.onnx", + "lm_main.onnx", + "text_conditioner.onnx", + "vocab.json", + "token_scores.json", + "LICENSE", + "reference_sample.wav", + TTS_LICENSE_FILE_NAME, + ] { + std::fs::write(model_dir.join(file), b"january").expect("write January file"); + } + std::fs::write(model_dir.join(MANIFEST_FILENAME), "3").expect("manifest"); + + assert!(!slot.is_ready(temp.path())); +} + +#[test] +fn interrupted_install_restores_backup_when_destination_is_missing() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let backup_dir = temp.path().join("pocket-tts.old"); + std::fs::create_dir_all(&backup_dir).expect("create backup"); + std::fs::write(backup_dir.join("sentinel"), b"previous").expect("write sentinel"); + + slot.recover_interrupted_install(temp.path()); + + assert_eq!( + std::fs::read(temp.path().join(TTS_MODEL_DIR_NAME).join("sentinel")) + .expect("restored sentinel"), + b"previous" + ); + assert!(!backup_dir.exists()); +} + +#[test] +fn interrupted_install_replaces_incomplete_destination_with_backup() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let model_dir = temp.path().join(TTS_MODEL_DIR_NAME); + let backup_dir = temp.path().join("pocket-tts.old"); + std::fs::create_dir_all(&model_dir).expect("create incomplete destination"); + std::fs::write(model_dir.join("incomplete"), b"april").expect("write incomplete file"); + std::fs::create_dir_all(&backup_dir).expect("create backup"); + std::fs::write(backup_dir.join("sentinel"), b"previous").expect("write sentinel"); + + slot.recover_interrupted_install(temp.path()); + + assert_eq!( + std::fs::read(model_dir.join("sentinel")).expect("restored sentinel"), + b"previous" + ); + assert!(!model_dir.join("incomplete").exists()); + assert!(!backup_dir.exists()); +} + +#[test] +fn ready_destination_removes_stale_backup() { + let temp = tempfile::tempdir().expect("tempdir"); + let slot = tts_model_slot(); + let model_dir = create_ready_model_dir(temp.path()); + let backup_dir = temp.path().join("pocket-tts.old"); + std::fs::create_dir_all(&backup_dir).expect("create backup"); + std::fs::write(backup_dir.join("sentinel"), b"previous").expect("write sentinel"); + + slot.recover_interrupted_install(temp.path()); + + assert!(slot.is_ready(temp.path())); + assert!(model_dir.exists()); + assert!(!backup_dir.exists()); +} diff --git a/desktop/src-tauri/src/huddle/pocket.rs b/desktop/src-tauri/src/huddle/pocket.rs index ee1faf928a..2154a25c22 100644 --- a/desktop/src-tauri/src/huddle/pocket.rs +++ b/desktop/src-tauri/src/huddle/pocket.rs @@ -1,184 +1,52 @@ -//! Pocket TTS engine wrapper around sherpa-onnx's `OfflineTts`. +//! April 2026 Pocket TTS engine for Buzz Desktop. //! -//! Pocket TTS is a small (~473 MB fp32 ONNX) zero-shot voice-cloning TTS -//! model from Kyutai. It runs quickly on CPU via sherpa-onnx, replacing the -//! previous Kokoro-82M engine that also required an espeak-free but -//! lexicon-heavy G2P pipeline (Misaki + CMUdict). -//! -//! Full-precision fp32 sessions, not the ~189 MB int8 quantization we -//! originally shipped: a direct same-runtime A/B (k2-fsa/sherpa-onnx#3172) -//! found the int8 ONNX export audibly degraded output quality, and fp32 -//! "significantly improved quality even at 1 step". +//! The `english_2026-04` bundle uses SentencePiece tokenization, a learned +//! voice BOS embedding, recurrent FlowLM state, and stateful Mimi decoding. +//! Buzz selects the upstream three-graph INT8 variant while retaining the +//! full-precision Mimi encoder and text conditioner specified by that variant. //! //! ## Attribution //! -//! - **Model**: Kyutai *Pocket TTS* — Charles, Roebel, et al., 2026. -//! arXiv:2509.06926. Original repository: . -//! Licensed CC-BY-4.0. -//! - **Mimi neural codec**: Kyutai, bundled in the same release. CC-BY-4.0. -//! - **ONNX export**: KevinAHM — -//! . CC-BY-4.0. -//! - **sherpa-onnx repackage**: csukuangfj / k2-fsa — -//! . -//! Repackages KevinAHM's export with the file layout sherpa-onnx's -//! `OfflineTtsPocketModelConfig` expects. CC-BY-4.0. -//! - **Reference voice WAV** (`reference_sample.wav`): the "Mary -//! (f, conversation)" preset from the Kyutai TTS demo -//! (), which maps to `vctk/p333_023_enhanced.wav` -//! in . CC-BY-4.0, base recording -//! from the VCTK corpus, enhanced by ai-coustics. -//! -//! Buzz ships these files unmodified; see the on-disk `MODEL_LICENSE.txt` -//! sidecar written by `huddle::models` during install for the canonical -//! CC-BY-4.0 §3(a)(1) attribution block. -//! -//! ## Engine-module contract (see `huddle::tts`) +//! - Pocket TTS and Mimi: Kyutai, CC-BY-4.0. +//! - ONNX export: KevinAHM/pocket-tts-onnx, CC-BY-4.0. +//! - Reference voice: Kyutai's Mary preset (VCTK p333), CC-BY-4.0. //! -//! `pocket.rs` exposes a fixed surface used by `tts.rs`. Mirroring this -//! contract is what lets the TTS pipeline stay engine-agnostic: -//! -//! - `SAMPLE_RATE: u32` — engine output sample rate in Hz. -//! - `DEFAULT_VOICE: &str` — default voice name (without extension). -//! - `VOICE_FILE_EXT: &str` — extension for per-voice files on disk. -//! - `load_text_to_speech(model_dir)` → `Result` -//! - `load_voice_style(path)` → `Result` -//! - `Engine::synth_chunk(&self, text, lang, &VoiceStyle, steps)` -//! → `Result, String>` -//! -//! `lang` and `steps` are accepted for API compatibility with the previous -//! Kokoro engine but are unused — Pocket TTS does its own language ID from -//! the input text and is not a diffusion model (consistency LM, one step). -//! There is no speed knob: sherpa-onnx's `GenerationConfig.speed` is only -//! read by some model families (vits), never by the Pocket impl -//! (`offline-tts-pocket-impl.h` — zero references), and upstream pocket-tts -//! has no speed parameter either. +//! `huddle::models` writes the complete attribution beside the cached bytes. -use std::collections::HashMap; use std::path::{Path, PathBuf}; +use std::sync::Mutex; + +use sherpa_onnx::Wave; -use sherpa_onnx::{GenerationConfig, OfflineTts, OfflineTtsConfig, Wave}; +#[path = "pocket_april.rs"] +mod pocket_april; +#[path = "pocket_models.rs"] +mod pocket_models; -// ── Engine-module contract: public consts ───────────────────────────────────── +use pocket_april::{prepare_april_prompt, AprilPocketTts}; +pub(crate) use pocket_models::{ + april_model_info, PocketModelArtifact, APRIL_BUNDLE_ID, APRIL_MODEL_ID, APRIL_MODEL_REVISION, +}; -/// Pocket TTS emits 24 kHz mono PCM. Matches the previous Kokoro output rate, -/// so the rodio sink and inter-sentence silence buffer in `tts.rs` remain valid. +/// Pocket TTS emits 24 kHz mono PCM. pub const SAMPLE_RATE: u32 = 24_000; -/// Name (without extension) of the bundled reference voice. The model directory -/// is expected to contain `.` after install. +/// Bundled reference voice name without its extension. pub const DEFAULT_VOICE: &str = "reference_sample"; -/// Voice files for Pocket TTS are reference audio (WAV). Distinct from the -/// Kokoro `.bin` style vectors — the model conditions on raw waveform samples, -/// not a precomputed embedding, so the extension change is honest. +/// Pocket voice files are reference WAVs. pub const VOICE_FILE_EXT: &str = "wav"; -// ── Tuning ──────────────────────────────────────────────────────────────────── - -/// Single-threaded ONNX execution for predictable CPU contention with the STT -/// pipeline. Matches `STT_NUM_THREADS` in `stt.rs`; raise only if a benchmark -/// argues for it. -const TTS_NUM_THREADS: i32 = 1; - -/// LRU cache size for cloned voice embeddings inside the sherpa-onnx engine. -/// We bind to one voice per pipeline today, but the upstream example uses 16 -/// and the cost is negligible — keep room for future multi-voice support. -const VOICE_EMBEDDING_CACHE_CAPACITY: i32 = 16; - -/// Pocket TTS is a consistency-based LM. Generation quality saturates at one -/// denoising step — the upstream `GenerationConfig` default of 5 multiplies -/// synthesis time by ~5× with no audible benefit on this model. -const SYNTH_NUM_STEPS: i32 = 1; - -/// Leave the generated audio's silences untouched (1.0 is the identity). -/// -/// sherpa-onnx's `ScaleSilence` (`offline-tts.cc`) is *not* pre/post padding -/// control: it finds every interior silence run ≥ 0.2 s (|s| ≤ 0.01) and -/// multiplies its length by this factor. The previous value of 0.0 — set -/// under the mistaken belief it disabled lead-in/lead-out padding — deleted -/// every natural pause inside an utterance: clause breaks, breaths, the gap -/// after a comma. Words slammed together and endings cut abruptly. The -/// reference Pocket TTS pipeline does not post-process silence at all; -/// 1.0 restores parity. -const SYNTH_SILENCE_SCALE: f32 = 1.0; - -/// sherpa-onnx upstream default for `max_frames` (LM steps), in -/// `offline-tts-pocket-impl.h:Generate`. 500 steps ≈ 40 s of audio at the -/// Mimi 12.5 Hz frame rate. Referenced only by the regression test below; -/// production code path never raises (or even reads) this value — we just -/// leave sherpa-onnx's own default in place by not setting the override. -#[cfg(test)] -const SHERPA_ONNX_MAX_FRAMES_DEFAULT: i32 = 500; - -/// Tight `max_frames` we ask for on short, padded prompts to bound the -/// original "monster breathing" runaway. 100 LM steps ≈ 8 s of audio — -/// roomy for any one-to-four-word utterance the user is likely to elicit -/// while still well short of the 40 s upstream default. Chosen with slack so -/// we never *truncate* a legitimate short reply. -const SHORT_PROMPT_MAX_FRAMES: i32 = 100; - -/// Word-count threshold (inclusive) below which we pad the prompt with -/// leading spaces and cap `max_frames` tighter than the upstream default. -/// Matches upstream `pocket_tts.models.tts_model.prepare_text_prompt`. Above -/// this threshold we leave sherpa-onnx's own defaults in place — overriding -/// them caused the "first 'yep' is just static" regression seen on -/// 2026-05-18, where dropping `frames_after_eos` below the upstream default -/// of 3 clipped the leading audio of multi-clause sentences. -const SHORT_PROMPT_WORD_THRESHOLD: usize = 4; - -/// Number of leading spaces prepended to short prompts. The upstream Python -/// uses exactly 8 — keep parity rather than tuning blindly. -/// -/// This is upstream's *only* mitigation for the FlowLM cold-start smear on -/// short utterances (kyutai-labs/pocket-tts #91, #70): the autoregressive -/// generation has a 2–3 step "settle" period where the first phoneme can be -/// smeared. A previous revision added a sacrificial `". . "` prefix plus an -/// amplitude-threshold trim to strip the rendered prefix from the output — -/// but the trim's absolute threshold (0.02 against raw peaks of ~0.076) sat -/// in soft-onset territory and could eat real word starts, and its tuning -/// was calibrated against `silence_scale = 0.0` audio. Deleted in favour of -/// upstream parity: accept the occasional smeared first syllable rather -/// than risk trimming real speech. -const SHORT_PROMPT_PAD_SPACES: usize = 8; - -/// sherpa-onnx's documented `frames_after_eos` default. We deliberately do -/// *not* override this knob — the previous attempt to bump it for short -/// inputs and lower it for long inputs lowered it below the upstream default -/// of 3, which clipped the leading audio of multi-clause sentences (the -/// "first 'yep' is static" regression). The constant exists only for the -/// regression test below. Source: `offline-tts-pocket-impl.h:Generate`. -#[cfg(test)] -const SHERPA_ONNX_FRAMES_AFTER_EOS_DEFAULT: i32 = 3; - -// ── ONNX file names (five Pocket TTS sessions plus two JSON tables) ─────────── +const TTS_NUM_THREADS: usize = 1; -const FILE_LM_MAIN: &str = "lm_main.onnx"; -const FILE_LM_FLOW: &str = "lm_flow.onnx"; -const FILE_ENCODER: &str = "encoder.onnx"; -const FILE_DECODER: &str = "decoder.onnx"; -const FILE_TEXT_COND: &str = "text_conditioner.onnx"; -const FILE_VOCAB: &str = "vocab.json"; -const FILE_TOKEN_SCORES: &str = "token_scores.json"; - -// ── Voice style ─────────────────────────────────────────────────────────────── - -/// Loaded reference voice — normalised f32 PCM samples plus their sample rate. -/// -/// Pocket TTS takes a reference waveform per generation call (not a -/// precomputed style embedding), so we keep the samples in memory and clone -/// the small `Vec` into each `GenerationConfig` rather than re-reading the -/// WAV from disk on every sentence. +/// Loaded reference voice samples and their original sample rate. #[derive(Debug, Clone)] pub struct VoiceStyle { samples: Vec, sample_rate: i32, } -/// Load a reference voice WAV from disk. -/// -/// Accepts any sample rate sherpa-onnx's `Wave::read` can decode — Pocket TTS -/// resamples internally using `reference_sample_rate`. The bundled -/// `reference_sample.wav` ("Mary" — VCTK p333, enhanced) is 32 kHz mono. +/// Load a Pocket reference voice WAV from disk. pub fn load_voice_style(path: &Path) -> Result { let path_str = path .to_str() @@ -195,199 +63,46 @@ pub fn load_voice_style(path: &Path) -> Result { }) } -// ── Engine ──────────────────────────────────────────────────────────────────── - -/// Pocket TTS engine handle. Cheap to construct (one `OfflineTts::create` -/// call). Owned by the TTS worker thread for the lifetime of a huddle session. -/// -/// `OfflineTts` does not implement `Debug`, so we don't derive it here — the -/// pipeline only needs to move the engine into the worker thread and call -/// `synth_chunk` on it, never to print it. +/// Resident April INT8 Pocket TTS engine. pub struct PocketTts { - inner: OfflineTts, + inner: Mutex, } -/// Build the Pocket TTS engine from the model directory installed by -/// `huddle::models`. Returns `Err` if any expected ONNX or JSON file is -/// missing — readiness is normally enforced by `is_tts_ready` upstream, but -/// the check is repeated here so a manually-modified model dir produces a -/// clear error string instead of an opaque sherpa-onnx `None`. +/// Load Buzz Desktop's pinned April INT8 model. pub fn load_text_to_speech(model_dir: &str) -> Result { let dir = PathBuf::from(model_dir); - for name in [ - FILE_LM_MAIN, - FILE_LM_FLOW, - FILE_ENCODER, - FILE_DECODER, - FILE_TEXT_COND, - FILE_VOCAB, - FILE_TOKEN_SCORES, - ] { - let p = dir.join(name); - if !p.is_file() { - return Err(format!("missing Pocket TTS file: {}", p.display())); - } - } - - let to_str = |name: &str| -> String { dir.join(name).to_string_lossy().into_owned() }; - - // Build the config by mutating defaults — mirrors `stt.rs` and stays - // resilient if sherpa-onnx adds unrelated model-family fields. - let mut cfg = OfflineTtsConfig::default(); - cfg.model.pocket.lm_main = Some(to_str(FILE_LM_MAIN)); - cfg.model.pocket.lm_flow = Some(to_str(FILE_LM_FLOW)); - cfg.model.pocket.encoder = Some(to_str(FILE_ENCODER)); - cfg.model.pocket.decoder = Some(to_str(FILE_DECODER)); - cfg.model.pocket.text_conditioner = Some(to_str(FILE_TEXT_COND)); - cfg.model.pocket.vocab_json = Some(to_str(FILE_VOCAB)); - cfg.model.pocket.token_scores_json = Some(to_str(FILE_TOKEN_SCORES)); - cfg.model.pocket.voice_embedding_cache_capacity = VOICE_EMBEDDING_CACHE_CAPACITY; - cfg.model.num_threads = TTS_NUM_THREADS; - // Explicit — defaults are not part of the API contract, and noisy debug - // logging in release builds would be expensive on every synthesized chunk. - cfg.model.debug = false; - - let inner = OfflineTts::create(&cfg) - .ok_or_else(|| "OfflineTts::create returned None for Pocket TTS".to_string())?; - Ok(PocketTts { inner }) -} - -// ── Prompt preparation ──────────────────────────────────────────────────────── - -/// Result of [`prepare_pocket_prompt`]: a synthesizer-ready prompt plus the -/// per-call generation overrides derived from the original text. -/// -/// `None` for either override means "leave sherpa-onnx's documented default -/// in place". The pipeline only sets `max_frames` (and only for short -/// padded inputs) so it can bound the original "monster breathing" runaway -/// without disturbing the rest of the LM sampling envelope. -#[derive(Debug, Clone, PartialEq)] -pub(crate) struct PreparedPrompt { - /// Text to hand to `OfflineTts::generate_with_config`. Capitalized, - /// punctuation-terminated, and (for short inputs) left-padded with - /// spaces — upstream's mitigation for the FlowLM cold-start smear. - pub text: String, - /// Value to pass via `GenerationConfig.extra["max_frames"]`, or `None` to - /// keep the upstream default of 500 LM steps. We only override on short - /// padded prompts where we have a tight expectation on output length. - pub max_frames: Option, -} - -/// Mirror of the *text-preparation* half of upstream -/// `pocket_tts.models.tts_model.prepare_text_prompt`. Sherpa-onnx's C++ -/// Pocket TTS impl does not run these preparation steps, so short / -/// unpunctuated / lowercase inputs can trigger up to 40 s of runaway -/// generation when the EOS logit never crosses its threshold. We replicate -/// the upstream Python recipe here: -/// -/// 1. Collapse interior whitespace (already done by `preprocess_for_tts`, but -/// cheap to re-check after sentence splitting). -/// 2. Capitalize the first letter. -/// 3. Append `.` if the text doesn't end in punctuation. -/// 4. If fewer than five words, prepend `SHORT_PROMPT_PAD_SPACES` spaces -/// (upstream's cold-start mitigation — see the constant's docstring) and -/// return a tight [`SHORT_PROMPT_MAX_FRAMES`] cap so the LM can't run -/// away if EOS still doesn't fire. -/// -/// We do **not** override `frames_after_eos` — sherpa-onnx's default of 3 -/// is what we want. An earlier version set it to 1 on long inputs, which -/// clipped the leading audio of multi-clause sentences ("first 'yep' is -/// just static" regression). Tests `prepare_prompt_never_lowers_frames_…` -/// lock this in. -/// -/// Returns `None` only if the input is empty after trimming — caller should -/// skip synthesis in that case. -pub(crate) fn prepare_pocket_prompt(input: &str) -> Option { - let trimmed = input.trim(); - if trimmed.is_empty() { - return None; - } - - // Collapse stray double-spaces / embedded newlines that may slip past - // `preprocess_for_tts` when sentences are spliced back together. - let mut cleaned = String::with_capacity(trimmed.len()); - let mut last_was_space = false; - for ch in trimmed.chars() { - let is_ws = ch.is_whitespace(); - if is_ws { - if !last_was_space { - cleaned.push(' '); - } - last_was_space = true; - } else { - cleaned.push(ch); - last_was_space = false; + for artifact in april_model_info().artifacts { + let path = dir.join(artifact.filename); + if !path.is_file() { + return Err(format!( + "incomplete Pocket TTS {} INT8 bundle: missing {}", + APRIL_BUNDLE_ID, + path.display() + )); } } - - // Capitalize first character. Uses `to_uppercase` (multi-codepoint safe). - let first = cleaned.chars().next().expect("cleaned non-empty above"); - if first.is_lowercase() { - let upper: String = first.to_uppercase().collect(); - let mut iter = cleaned.chars(); - iter.next(); - cleaned = upper + iter.as_str(); - } - - // Ensure terminal punctuation. Anything not in `.!?;:,` gets a period. - // The upstream Python only checks `isalnum` → period, but for our agent - // text we already may end in `!` `?` `.` etc. — treat any of those as OK. - let last = cleaned - .chars() - .next_back() - .expect("cleaned non-empty above"); - if !matches!(last, '.' | '!' | '?' | ';' | ':' | ',') { - cleaned.push('.'); - } - - // Word count of the *cleaned but not padded* text — padding is whitespace - // only and would just lie to the threshold check below. - let word_count = cleaned.split_whitespace().count(); - - let (final_text, max_frames) = if word_count <= SHORT_PROMPT_WORD_THRESHOLD { - let mut padded = String::with_capacity(cleaned.len() + SHORT_PROMPT_PAD_SPACES); - for _ in 0..SHORT_PROMPT_PAD_SPACES { - padded.push(' '); - } - padded.push_str(&cleaned); - (padded, Some(SHORT_PROMPT_MAX_FRAMES)) - } else { - // For everything ≥5 words, fall back to upstream defaults. Overriding - // these is what caused the "first 'yep' is static" regression — the - // upstream LM has been tuned for `frames_after_eos = 3` and - // `max_frames = 500`, and there's no clear win in second-guessing. - (cleaned, None) - }; - - Some(PreparedPrompt { - text: final_text, - max_frames, - }) -} - -/// Build the `GenerationConfig.extra` HashMap from a [`PreparedPrompt`]. -/// -/// Centralised so the regression test below can assert that we **never** -/// emit a `frames_after_eos` override — the previous attempt to override -/// that knob (setting it to 1 for ≥5-word inputs) clipped the leading -/// audio of multi-clause sentences (the "first 'yep' is static" bug on -/// 2026-05-18). The upstream sherpa-onnx default of 3 is what we want, and -/// the right way to keep it is to not set it at all. -fn build_generation_extra(prepared: &PreparedPrompt) -> Option> { - prepared.max_frames.map(|mf| { - let mut h: HashMap = HashMap::with_capacity(1); - h.insert("max_frames".to_string(), serde_json::Value::from(mf)); - h + Ok(PocketTts { + inner: Mutex::new(AprilPocketTts::load(&dir, TTS_NUM_THREADS)?), }) } impl PocketTts { - /// Synthesise `text` with the given reference voice. + /// Split text into synthesis units that satisfy the bundle's exact + /// 50-token input limit. + pub fn split_text_into_chunks(&self, text: &str) -> Result, String> { + let Some(prepared) = prepare_april_prompt(text) else { + return Ok(Vec::new()); + }; + self.inner + .lock() + .map_err(|_| "Pocket TTS engine lock poisoned".to_string())? + .split_prompt(&prepared) + } + + /// Synthesize text with the supplied reference voice. /// - /// `_lang` and `_steps` are accepted for API compatibility with the - /// previous Kokoro engine. Pocket TTS infers language from the input text - /// directly and is a one-step consistency model. Returns an empty buffer - /// for whitespace-only input. + /// Pocket detects language from text and this model uses one synthesis + /// step, so `_lang` and `_steps` intentionally do not affect output. pub fn synth_chunk( &self, text: &str, @@ -395,57 +110,21 @@ impl PocketTts { style: &VoiceStyle, _steps: usize, ) -> Result, String> { - // Mirror upstream pocket-tts prompt prep — without this short or - // unpunctuated inputs can cause the LM's EOS logit to never trip, - // producing up to 40 s of "monster breathing" garbage on the first - // utterance. See `prepare_pocket_prompt` for the full recipe. - let prepared = match prepare_pocket_prompt(text) { - Some(p) => p, - None => return Ok(Vec::new()), + let Some(prepared) = prepare_april_prompt(text) else { + return Ok(Vec::new()); }; - - // Per-call generation hints sherpa-onnx forwards to - // `offline-tts-pocket-impl.h`. We only override `max_frames`, and - // only for short padded prompts where we have a tight expectation - // on output length — that bounds the original runaway without - // disturbing the rest of the LM sampling envelope. See - // `prepare_pocket_prompt` docs for the regression history. - let extra = build_generation_extra(&prepared); - - let cfg = GenerationConfig { - num_steps: SYNTH_NUM_STEPS, - silence_scale: SYNTH_SILENCE_SCALE, - reference_audio: Some(style.samples.clone()), - reference_sample_rate: style.sample_rate, - extra, - // `speed` stays at its default: the Pocket impl never reads it - // (see the engine-contract note in the module docs). - ..Default::default() - }; - - // No progress callback — synthesis is fast enough that returning the - // whole buffer at once keeps the lookahead pipelining in `tts.rs` - // simple. `None:: bool>` pins the callback type for the - // `generate_with_config` generic parameter. - let audio = self + let mut engine = self .inner - .generate_with_config(&prepared.text, &cfg, None:: bool>) - .ok_or_else(|| { - format!( - "Pocket TTS synthesis failed for text ({} chars)", - prepared.text.len() - ) - })?; - - let sample_rate = audio.sample_rate(); - if sample_rate != SAMPLE_RATE as i32 { - eprintln!( - "buzz-desktop: Pocket TTS returned unexpected sample rate {sample_rate}Hz \ - (expected {SAMPLE_RATE}Hz); playback speed may be wrong" - ); + .lock() + .map_err(|_| "Pocket TTS engine lock poisoned".to_string())?; + let chunks = engine.split_prompt(&prepared)?; + let mut samples = Vec::new(); + for chunk in chunks { + let prepared = prepare_april_prompt(&chunk) + .ok_or_else(|| "Pocket TTS prompt chunk became empty".to_string())?; + samples.extend(engine.synth_chunk(&prepared, style)?); } - - Ok(audio.samples().to_vec()) + Ok(samples) } } @@ -453,202 +132,35 @@ impl PocketTts { mod tests { use super::*; - // ── prepare_pocket_prompt ──────────────────────────────────────────────── - - #[test] - fn prepare_prompt_returns_none_for_empty_input() { - assert!(prepare_pocket_prompt("").is_none()); - assert!(prepare_pocket_prompt(" ").is_none()); - assert!(prepare_pocket_prompt("\n\t ").is_none()); - } - - /// Helper: the exact leading sequence prepended to every short prompt — - /// 8 spaces of padding (upstream's cold-start mitigation). - /// Centralising this keeps the assertions readable. - fn short_prefix() -> String { - " ".repeat(SHORT_PROMPT_PAD_SPACES) - } - - #[test] - fn prepare_prompt_pads_and_capitalizes_one_word() { - // The "yep" case Tyler hit in production — bare lowercase one-word - // utterance with no punctuation. Must be padded with the short-prompt - // space pad, capitalized, terminated, with a tight `max_frames` cap - // to bound runaway gen. - let out = prepare_pocket_prompt("yep").expect("non-empty"); - assert_eq!(out.text, format!("{}Yep.", short_prefix())); - assert_eq!(out.max_frames, Some(SHORT_PROMPT_MAX_FRAMES)); - const { - assert!( - SHORT_PROMPT_MAX_FRAMES < SHERPA_ONNX_MAX_FRAMES_DEFAULT, - "short cap must be tighter than the upstream default" - ); - } - } - - #[test] - fn prepare_prompt_preserves_existing_punctuation() { - let out = prepare_pocket_prompt("yes!").expect("non-empty"); - assert_eq!(out.text, format!("{}Yes!", short_prefix())); // exclamation kept - let out = prepare_pocket_prompt("really?").expect("non-empty"); - assert_eq!(out.text, format!("{}Really?", short_prefix())); - } - #[test] - fn prepare_prompt_threshold_is_inclusive_at_four_words() { - // 4 words = short (padded + tight max_frames); 5 words = long - // (no padding, no overrides — upstream defaults stand). - let four = prepare_pocket_prompt("one two three four").expect("non-empty"); - assert_eq!( - four.text, - format!("{}One two three four.", short_prefix()), - "four-word input should get exactly the space pad" - ); - assert_eq!(four.max_frames, Some(SHORT_PROMPT_MAX_FRAMES)); - - let five = prepare_pocket_prompt("one two three four five").expect("non-empty"); - assert!( - !five.text.starts_with(' '), - "five-word input should NOT be padded" - ); - assert_eq!( - five.max_frames, None, - "long inputs must leave sherpa-onnx's max_frames default in place" - ); - } - - #[test] - fn prepare_prompt_does_not_pad_long_text() { - let long = "This is a longer sentence that the model should handle just fine."; - let out = prepare_pocket_prompt(long).expect("non-empty"); - assert!(!out.text.starts_with(' ')); - assert_eq!(out.max_frames, None); - assert!(out.text.ends_with('.')); + fn desktop_model_is_april_int8_only() { + let info = april_model_info(); + assert_eq!(info.max_token_per_chunk, 50); + assert_eq!(info.sample_rate, SAMPLE_RATE); + assert!(info + .artifacts + .iter() + .any(|artifact| artifact.filename == "flow_lm_main_int8.onnx")); + assert!(!info + .artifacts + .iter() + .any(|artifact| artifact.filename == "flow_lm_main.onnx")); } #[test] - fn prepare_prompt_collapses_whitespace() { - let out = prepare_pocket_prompt("Hello world\n\nfriend").expect("non-empty"); - // 3 words → short → padded. Interior whitespace collapsed. - assert_eq!(out.text, format!("{}Hello world friend.", short_prefix())); - } - - #[test] - fn prepare_prompt_does_not_double_capitalize_already_uppercase() { - let out = prepare_pocket_prompt("HELLO there").expect("non-empty"); - assert_eq!(out.text, format!("{}HELLO there.", short_prefix())); - } - - #[test] - fn prepare_prompt_handles_non_ascii_first_letter() { - // Cyrillic lowercase 'д' → uppercase 'Д'. Must not panic / produce - // mojibake. - let out = prepare_pocket_prompt("дa").expect("non-empty"); - assert!(out.text.contains("Дa.")); - } - - /// REGRESSION GUARD: short prompts must receive *only* whitespace - /// padding — no sacrificial text. A previous revision prepended a - /// `". . "` cold-start absorber and trimmed the rendered audio back out - /// with an amplitude threshold that could eat soft word onsets. If - /// non-whitespace ever reappears in the pad, the synth output will - /// contain audio for text the user never wrote. - #[test] - fn prepare_prompt_pad_is_whitespace_only() { - let out = prepare_pocket_prompt("I'm happy.").expect("non-empty"); - let pad_len = out.text.len() - "I'm happy.".len(); - assert!( - out.text[..pad_len].chars().all(|c| c == ' '), - "short-prompt pad must be spaces only, got {:?}", - &out.text[..pad_len] - ); - assert_eq!(out.text, format!("{}I'm happy.", short_prefix())); - } - - // ── build_generation_extra ─────────────────────────────────────────────── - // - // These tests pin down a behaviour we've now regressed twice on: - // 1) Not padding/punctuating short inputs → 40 s of "monster breathing" - // (pre-773a2a1). - // 2) Setting `frames_after_eos = 1` on long inputs → clipped leading - // audio of multi-clause sentences, e.g. "Yep, I can hear you. …" - // came out as a static burst (the 773a2a1 regression Tyler hit on - // 2026-05-18 ~14:30 UTC). - // - // The contract we enforce going forward: we **only** override - // `max_frames`, and only for ≤4-word inputs. Every other knob is left - // at sherpa-onnx's documented default (notably `frames_after_eos = 3`). - - #[test] - fn build_extra_short_prompt_sets_only_max_frames() { - let prepared = prepare_pocket_prompt("yep").expect("non-empty"); - let extra = build_generation_extra(&prepared).expect("short prompts get extra"); - // Exactly one key — `max_frames` — and nothing else. - assert_eq!(extra.len(), 1, "extra has unexpected keys: {extra:?}"); - assert_eq!( - extra.get("max_frames"), - Some(&serde_json::Value::from(SHORT_PROMPT_MAX_FRAMES)) - ); - assert!( - !extra.contains_key("frames_after_eos"), - "frames_after_eos must never be set — upstream default of {SHERPA_ONNX_FRAMES_AFTER_EOS_DEFAULT} is what we want" - ); - } - - #[test] - fn build_extra_long_prompt_is_none() { - // ≥5 words: no extras at all. This is the key fix for the "first - // 'yep' in 'Yep, I can hear you. …' is static" regression — we - // were previously forcing `frames_after_eos = 1` on this path. - let prepared = prepare_pocket_prompt("Yep, I can hear you.").expect("non-empty"); - assert_eq!( - build_generation_extra(&prepared), - None, - "long prompts must not override any LM knob" - ); - } - - #[test] - fn build_extra_never_lowers_frames_after_eos_for_any_word_count() { - // Sweep a range of prompt lengths and assert the `extra` map (when - // present) never carries a `frames_after_eos` override that's lower - // than the upstream sherpa-onnx default. Implemented as a structural - // check — we just never set the key — but worth a property test in - // case someone reintroduces the override in the future. - let prompts: &[&str] = &[ - "hi", - "hi there", - "yes please", - "one two three four", - "one two three four five", - "a slightly longer reply, hopefully fine", - "This is a multi-clause sentence. It has two parts.", - "really really really really really long prompt with lots of words just to be sure", - ]; - for &p in prompts { - let prepared = prepare_pocket_prompt(p).expect("non-empty"); - if let Some(extra) = build_generation_extra(&prepared) { - if let Some(v) = extra.get("frames_after_eos") { - let n = v.as_i64().expect("frames_after_eos should be int"); - assert!( - n >= SHERPA_ONNX_FRAMES_AFTER_EOS_DEFAULT as i64, - "prompt {p:?} set frames_after_eos={n}, below upstream default of {SHERPA_ONNX_FRAMES_AFTER_EOS_DEFAULT}" - ); - } - } - } - } - - #[test] - fn short_prompt_max_frames_is_below_upstream_default() { - // Sanity: the override only ever *lowers* the cap, never raises it. - const { - assert!(SHORT_PROMPT_MAX_FRAMES < SHERPA_ONNX_MAX_FRAMES_DEFAULT); - } - // …and is still large enough for a one-to-four-word reply. At Mimi's - // 12.5 Hz frame rate, 100 frames = 8 s, which is roomy. - const { - assert!(SHORT_PROMPT_MAX_FRAMES >= 50, "would risk truncation"); - } + #[ignore = "requires BUZZ_POCKET_TEST_MODEL_DIR"] + fn production_api_emits_non_silent_april_int8_pcm() { + let dir = std::env::var("BUZZ_POCKET_TEST_MODEL_DIR") + .expect("set BUZZ_POCKET_TEST_MODEL_DIR to an April INT8 model directory"); + let engine = load_text_to_speech(&dir).expect("load April INT8 engine"); + let style = load_voice_style(&Path::new(&dir).join("reference_sample.wav")) + .expect("load reference voice"); + let samples = engine + .synth_chunk("Bright birds begin beside the bay.", "en", &style, 1) + .expect("synthesize through the production API"); + + assert!(!samples.is_empty()); + assert!(samples.iter().all(|sample| sample.is_finite())); + assert!(samples.iter().any(|sample| sample.abs() > 1.0e-6)); } } diff --git a/desktop/src-tauri/src/huddle/pocket_april.rs b/desktop/src-tauri/src/huddle/pocket_april.rs new file mode 100644 index 0000000000..43826df5c9 --- /dev/null +++ b/desktop/src-tauri/src/huddle/pocket_april.rs @@ -0,0 +1,940 @@ +//! Native ONNX loader for Pocket TTS `english_2026-04`. +//! +//! The bundle uses SentencePiece, prepends a learned BOS voice embedding, and +//! describes recurrent state tensors in `bundle.json`. This module supplies +//! that frontend and state loop while reusing the ONNX Runtime linked by the +//! Desktop speech stack. + +use std::borrow::Cow; +use std::f32::consts::TAU; +use std::fs; +use std::path::{Path, PathBuf}; + +use ort::session::{Session, SessionInputValue}; +use ort::value::{DynValue, Tensor}; +use rand::{Rng, RngExt}; +use sentencepiece_model::SentencePieceModel; +use serde::Deserialize; +use sherpa_onnx::LinearResampler; +use tokenizers::models::unigram::Unigram; +use tokenizers::pre_tokenizers::metaspace::{Metaspace, PrependScheme}; +use tokenizers::Tokenizer; + +use super::VoiceStyle; + +const FILE_BUNDLE: &str = "bundle.json"; +const FILE_MIMI_ENCODER: &str = "mimi_encoder.onnx"; +const FILE_TEXT_CONDITIONER: &str = "text_conditioner.onnx"; +const FILE_FLOW_MAIN_INT8: &str = "flow_lm_main_int8.onnx"; +const FILE_FLOW_INT8: &str = "flow_lm_flow_int8.onnx"; +const FILE_MIMI_DECODER_INT8: &str = "mimi_decoder_int8.onnx"; + +const MODEL_LANGUAGE: &str = "english_2026-04"; +const DEFAULT_TEMPERATURE: f32 = 0.7; +const EOS_LOGIT_THRESHOLD: f32 = -4.0; +const DECODER_CHUNK_FRAMES: usize = 12; +const TOKENS_PER_SECOND_ESTIMATE: f32 = 3.0; +const GENERATION_SECONDS_PADDING: f32 = 2.0; + +#[derive(Debug, Deserialize)] +struct Bundle { + schema_version: u32, + language: String, + sample_rate: usize, + frame_rate: f32, + samples_per_frame: usize, + latent_dim: usize, + conditioning_dim: usize, + insert_bos_before_voice: bool, + pad_with_spaces_for_short_inputs: bool, + remove_semicolons: bool, + model_recommended_frames_after_eos: Option, + max_token_per_chunk: usize, + tokenizer_file: String, + bos_before_voice_file: String, + flow_lm_state_manifest: Vec, + mimi_state_manifest: Vec, +} + +#[derive(Debug, Clone, Deserialize)] +struct StateSpec { + input_name: String, + output_name: String, + dtype: StateDtype, + shape: Vec, + fill: StateFill, +} + +#[derive(Debug, Clone, Copy, Deserialize)] +#[serde(rename_all = "lowercase")] +enum StateDtype { + #[serde(rename = "float32")] + Float32, + #[serde(rename = "int64")] + Int64, + Bool, +} + +#[derive(Debug, Clone, Copy, Deserialize)] +#[serde(rename_all = "lowercase")] +enum StateFill { + Empty, + Nan, + Ones, + Zeros, +} + +struct StateValue { + spec: StateSpec, + value: DynValue, +} + +struct CachedVoice { + samples_ptr: usize, + samples_len: usize, + sample_rate: i32, + embeddings: Vec, +} + +pub(crate) struct AprilPocketTts { + bundle: Bundle, + tokenizer: Tokenizer, + bos_embedding: Vec, + mimi_encoder: Session, + text_conditioner: Session, + flow_main: Session, + flow: Session, + mimi_decoder: Session, + cached_voice: Option, +} + +#[derive(Debug, Clone, PartialEq)] +pub(crate) struct AprilPreparedPrompt { + pub(crate) text: String, + pub(crate) frames_after_eos: usize, +} + +pub(crate) fn prepare_april_prompt(input: &str) -> Option { + let trimmed = input.trim(); + if trimmed.is_empty() { + return None; + } + + let mut cleaned = String::with_capacity(trimmed.len()); + let mut last_was_space = false; + for ch in trimmed.chars() { + if ch.is_whitespace() { + if !last_was_space { + cleaned.push(' '); + } + last_was_space = true; + } else { + cleaned.push(ch); + last_was_space = false; + } + } + + let first = cleaned.chars().next().expect("cleaned non-empty above"); + if first.is_lowercase() { + let upper: String = first.to_uppercase().collect(); + let mut iter = cleaned.chars(); + iter.next(); + cleaned = upper + iter.as_str(); + } + + let last = cleaned + .chars() + .next_back() + .expect("cleaned non-empty above"); + if last.is_alphanumeric() { + cleaned.push('.'); + } + + let word_count = cleaned.split_whitespace().count(); + Some(AprilPreparedPrompt { + text: cleaned, + // Mirror the bundle's upstream heuristic: three generated frames plus + // two trailing frames for short prompts, one plus two otherwise. + frames_after_eos: if word_count <= 4 { 5 } else { 3 }, + }) +} + +impl AprilPocketTts { + pub(crate) fn load(dir: &Path, num_threads: usize) -> Result { + if num_threads == 0 { + return Err("Pocket TTS num_threads must be at least 1".to_string()); + } + let bundle_path = dir.join(FILE_BUNDLE); + let bundle: Bundle = serde_json::from_slice( + &fs::read(&bundle_path) + .map_err(|err| format!("read {}: {err}", bundle_path.display()))?, + ) + .map_err(|err| format!("parse {}: {err}", bundle_path.display()))?; + + if bundle.schema_version != 2 { + return Err(format!( + "unsupported Pocket TTS bundle schema {} in {}", + bundle.schema_version, + bundle_path.display() + )); + } + if bundle.language != MODEL_LANGUAGE { + return Err(format!( + "expected Pocket TTS language {MODEL_LANGUAGE}, got {}", + bundle.language + )); + } + if bundle.sample_rate != 24_000 + || bundle.frame_rate != 12.5 + || bundle.samples_per_frame != 1_920 + || bundle.latent_dim != 32 + || bundle.conditioning_dim != 1024 + { + return Err(format!( + "unexpected Pocket TTS dimensions: sample_rate={}, frame_rate={}, samples_per_frame={}, latent_dim={}, conditioning_dim={}", + bundle.sample_rate, + bundle.frame_rate, + bundle.samples_per_frame, + bundle.latent_dim, + bundle.conditioning_dim + )); + } + if !bundle.insert_bos_before_voice { + return Err("April Pocket TTS bundle must insert BOS before voice".to_string()); + } + if bundle.pad_with_spaces_for_short_inputs + || bundle.remove_semicolons + || bundle.model_recommended_frames_after_eos.is_some() + || bundle.max_token_per_chunk != 50 + { + return Err("unsupported April Pocket TTS prompt-policy metadata".to_string()); + } + + let tokenizer_path = dir.join(&bundle.tokenizer_file); + let tokenizer = load_tokenizer(&tokenizer_path)?; + let bos_path = dir.join(&bundle.bos_before_voice_file); + let bos_embedding = read_npy_f32(&bos_path)?; + if bos_embedding.len() != bundle.conditioning_dim { + return Err(format!( + "{} has {} values; expected {}", + bos_path.display(), + bos_embedding.len(), + bundle.conditioning_dim + )); + } + + let flow_main = FILE_FLOW_MAIN_INT8; + let flow = FILE_FLOW_INT8; + let mimi_decoder = FILE_MIMI_DECODER_INT8; + + Ok(Self { + // The INT8 layout quantizes only the three generation graphs; + // voice encoding and text conditioning remain full precision. + mimi_encoder: load_session(dir.join(FILE_MIMI_ENCODER), num_threads)?, + text_conditioner: load_session(dir.join(FILE_TEXT_CONDITIONER), num_threads)?, + flow_main: load_session(dir.join(flow_main), num_threads)?, + flow: load_session(dir.join(flow), num_threads)?, + mimi_decoder: load_session(dir.join(mimi_decoder), num_threads)?, + bundle, + tokenizer, + bos_embedding, + cached_voice: None, + }) + } + + pub(crate) fn split_prompt( + &self, + prepared: &AprilPreparedPrompt, + ) -> Result, String> { + if self.token_count(&prepared.text)? <= self.bundle.max_token_per_chunk { + return Ok(vec![prepared.text.clone()]); + } + + let mut chunks = Vec::new(); + let mut current = String::new(); + for word in prepared.text.split_whitespace() { + let candidate = if current.is_empty() { + word.to_string() + } else { + format!("{current} {word}") + }; + if self.prepared_token_count(&candidate)? <= self.bundle.max_token_per_chunk { + current = candidate; + continue; + } + if !current.is_empty() { + chunks.push(std::mem::take(&mut current)); + } + + if self.prepared_token_count(word)? <= self.bundle.max_token_per_chunk { + current = word.to_string(); + continue; + } + + let mut fragment = String::new(); + for ch in word.chars() { + let candidate = format!("{fragment}{ch}"); + if !fragment.is_empty() + && self.prepared_token_count(&candidate)? > self.bundle.max_token_per_chunk + { + chunks.push(std::mem::take(&mut fragment)); + } + fragment.push(ch); + } + current = fragment; + } + if !current.is_empty() { + chunks.push(current); + } + + chunks + .into_iter() + .map(|text| { + let chunk = prepare_april_prompt(&text) + .ok_or_else(|| "Pocket TTS prompt chunk became empty".to_string())?; + let token_count = self.token_count(&chunk.text)?; + if token_count > self.bundle.max_token_per_chunk { + return Err(format!( + "Pocket TTS prompt chunk has {token_count} tokens; maximum is {}", + self.bundle.max_token_per_chunk + )); + } + Ok(chunk.text) + }) + .collect() + } + + pub(crate) fn synth_chunk( + &mut self, + prepared: &AprilPreparedPrompt, + style: &VoiceStyle, + ) -> Result, String> { + let voice_embeddings = self.voice_embeddings(style)?; + let mut flow_state = self.condition_voice(&voice_embeddings)?; + let token_ids = self + .tokenizer + .encode(prepared.text.as_str(), false) + .map_err(|err| format!("tokenize Pocket TTS prompt: {err}"))? + .get_ids() + .iter() + .copied() + .map(i64::from) + .collect::>(); + if token_ids.is_empty() { + return Ok(Vec::new()); + } + if token_ids.len() > self.bundle.max_token_per_chunk { + return Err(format!( + "Pocket TTS prompt has {} tokens; split_text_into_chunks maximum is {}", + token_ids.len(), + self.bundle.max_token_per_chunk + )); + } + + let token_count = token_ids.len(); + let text_embeddings = self.text_embeddings(token_ids)?; + self.run_flow_main_prefix(&text_embeddings, &mut flow_state)?; + let max_frames = estimate_max_frames(token_count, self.bundle.frame_rate); + let latents = + self.generate_latents(max_frames, prepared.frames_after_eos, &mut flow_state)?; + self.decode_latents(&latents) + } + + fn prepared_token_count(&self, text: &str) -> Result { + let prepared = prepare_april_prompt(text) + .ok_or_else(|| "Pocket TTS prompt chunk became empty".to_string())?; + self.token_count(&prepared.text) + } + + fn token_count(&self, text: &str) -> Result { + Ok(self + .tokenizer + .encode(text, false) + .map_err(|err| format!("tokenize Pocket TTS prompt: {err}"))? + .get_ids() + .len()) + } + + fn voice_embeddings(&mut self, style: &VoiceStyle) -> Result, String> { + let key = ( + style.samples.as_ptr() as usize, + style.samples.len(), + style.sample_rate, + ); + if let Some(cached) = &self.cached_voice { + if (cached.samples_ptr, cached.samples_len, cached.sample_rate) == key { + return Ok(cached.embeddings.clone()); + } + } + + let samples = if style.sample_rate == self.bundle.sample_rate as i32 { + style.samples.clone() + } else { + LinearResampler::create(style.sample_rate, self.bundle.sample_rate as i32) + .ok_or_else(|| { + format!( + "create Pocket TTS resampler {}Hz -> {}Hz", + style.sample_rate, self.bundle.sample_rate + ) + })? + .resample(&style.samples, true) + }; + let audio = Tensor::from_array(( + vec![1_i64, 1, samples.len() as i64], + samples.into_boxed_slice(), + )) + .map_err(ort_error("create voice audio tensor"))?; + let outputs = self + .mimi_encoder + .run(ort::inputs!["audio" => audio]) + .map_err(ort_error("run Mimi encoder"))?; + let (_, encoded) = outputs[0] + .try_extract_tensor::() + .map_err(ort_error("extract Mimi encoder output"))?; + if !encoded.len().is_multiple_of(self.bundle.conditioning_dim) { + return Err(format!( + "Mimi encoder returned {} values, not divisible by {}", + encoded.len(), + self.bundle.conditioning_dim + )); + } + let mut embeddings = + Vec::with_capacity(self.bos_embedding.len().saturating_add(encoded.len())); + embeddings.extend_from_slice(&self.bos_embedding); + embeddings.extend_from_slice(encoded); + self.cached_voice = Some(CachedVoice { + samples_ptr: key.0, + samples_len: key.1, + sample_rate: key.2, + embeddings: embeddings.clone(), + }); + Ok(embeddings) + } + + fn condition_voice(&mut self, embeddings: &[f32]) -> Result, String> { + let frames = embeddings.len() / self.bundle.conditioning_dim; + let sequence = Tensor::::new( + &ort::memory::Allocator::default(), + [1_i64, 0, self.bundle.latent_dim as i64], + ) + .map_err(ort_error("create empty voice sequence"))?; + let text_embeddings = Tensor::from_array(( + vec![1_i64, frames as i64, self.bundle.conditioning_dim as i64], + embeddings.to_vec().into_boxed_slice(), + )) + .map_err(ort_error("create voice embedding tensor"))?; + let mut state = initialize_state(&self.bundle.flow_lm_state_manifest)?; + let mut inputs = vec![ + (Cow::Borrowed("sequence"), SessionInputValue::from(sequence)), + ( + Cow::Borrowed("text_embeddings"), + SessionInputValue::from(text_embeddings), + ), + ]; + append_state_inputs(&mut inputs, &state); + let mut outputs = self + .flow_main + .run(inputs) + .map_err(ort_error("condition Pocket TTS voice"))?; + replace_state_from_outputs(&mut state, &mut outputs)?; + Ok(state) + } + + fn text_embeddings(&mut self, token_ids: Vec) -> Result, String> { + let tokens = Tensor::from_array(( + vec![1_i64, token_ids.len() as i64], + token_ids.into_boxed_slice(), + )) + .map_err(ort_error("create token tensor"))?; + let outputs = self + .text_conditioner + .run(ort::inputs!["token_ids" => tokens]) + .map_err(ort_error("run text conditioner"))?; + let (_, embeddings) = outputs[0] + .try_extract_tensor::() + .map_err(ort_error("extract text embeddings"))?; + Ok(embeddings.to_vec()) + } + + fn run_flow_main_prefix( + &mut self, + text_embeddings: &[f32], + state: &mut [StateValue], + ) -> Result<(), String> { + if !text_embeddings + .len() + .is_multiple_of(self.bundle.conditioning_dim) + { + return Err(format!( + "text conditioner returned {} values, not divisible by {}", + text_embeddings.len(), + self.bundle.conditioning_dim + )); + } + let frames = text_embeddings.len() / self.bundle.conditioning_dim; + let sequence = Tensor::::new( + &ort::memory::Allocator::default(), + [1_i64, 0, self.bundle.latent_dim as i64], + ) + .map_err(ort_error("create empty text sequence"))?; + let text_embeddings = Tensor::from_array(( + vec![1_i64, frames as i64, self.bundle.conditioning_dim as i64], + text_embeddings.to_vec().into_boxed_slice(), + )) + .map_err(ort_error("create text embedding tensor"))?; + let mut inputs = vec![ + (Cow::Borrowed("sequence"), SessionInputValue::from(sequence)), + ( + Cow::Borrowed("text_embeddings"), + SessionInputValue::from(text_embeddings), + ), + ]; + append_state_inputs(&mut inputs, state); + let mut outputs = self + .flow_main + .run(inputs) + .map_err(ort_error("prime Pocket TTS text state"))?; + replace_state_from_outputs(state, &mut outputs) + } + + fn generate_latents( + &mut self, + max_frames: usize, + frames_after_eos: usize, + state: &mut [StateValue], + ) -> Result, String> { + let mut current = vec![f32::NAN; self.bundle.latent_dim]; + let mut latents = Vec::with_capacity(max_frames * self.bundle.latent_dim); + let mut eos_step = None; + let mut rng = rand::rng(); + + for step in 0..max_frames { + let sequence = Tensor::from_array(( + vec![1_i64, 1, self.bundle.latent_dim as i64], + current.clone().into_boxed_slice(), + )) + .map_err(ort_error("create latent input"))?; + let text_embeddings = Tensor::::new( + &ort::memory::Allocator::default(), + [1_i64, 0, self.bundle.conditioning_dim as i64], + ) + .map_err(ort_error("create empty text input"))?; + let mut inputs = vec![ + (Cow::Borrowed("sequence"), SessionInputValue::from(sequence)), + ( + Cow::Borrowed("text_embeddings"), + SessionInputValue::from(text_embeddings), + ), + ]; + append_state_inputs(&mut inputs, state); + let mut outputs = self + .flow_main + .run(inputs) + .map_err(ort_error("run Pocket TTS Flow LM"))?; + let conditioning = outputs[0] + .try_extract_tensor::() + .map_err(ort_error("extract Flow LM conditioning"))? + .1 + .to_vec(); + let eos_logit = outputs[1] + .try_extract_tensor::() + .map_err(ort_error("extract Flow LM EOS logit"))? + .1 + .first() + .copied() + .ok_or_else(|| "Flow LM returned empty EOS logit".to_string())?; + replace_state_from_outputs(state, &mut outputs)?; + + if eos_logit > EOS_LOGIT_THRESHOLD && eos_step.is_none() { + eos_step = Some(step); + } + if eos_step.is_some_and(|eos| step >= eos + frames_after_eos) { + break; + } + + let mut noise = + normal_noise(&mut rng, self.bundle.latent_dim, DEFAULT_TEMPERATURE.sqrt()); + let conditioning = Tensor::from_array(( + vec![1_i64, self.bundle.conditioning_dim as i64], + conditioning.into_boxed_slice(), + )) + .map_err(ort_error("create flow conditioning"))?; + let s = Tensor::from_array((vec![1_i64, 1], vec![0.0_f32].into_boxed_slice())) + .map_err(ort_error("create flow start tensor"))?; + let t = Tensor::from_array((vec![1_i64, 1], vec![1.0_f32].into_boxed_slice())) + .map_err(ort_error("create flow end tensor"))?; + let x = Tensor::from_array(( + vec![1_i64, self.bundle.latent_dim as i64], + noise.clone().into_boxed_slice(), + )) + .map_err(ort_error("create flow noise tensor"))?; + let outputs = self + .flow + .run(ort::inputs![ + "c" => conditioning, + "s" => s, + "t" => t, + "x" => x, + ]) + .map_err(ort_error("run Pocket TTS flow"))?; + let flow = outputs[0] + .try_extract_tensor::() + .map_err(ort_error("extract Pocket TTS flow"))? + .1; + if flow.len() != noise.len() { + return Err(format!( + "flow returned {} values; expected {}", + flow.len(), + noise.len() + )); + } + for (sample, delta) in noise.iter_mut().zip(flow) { + *sample += *delta; + } + current.clone_from(&noise); + latents.extend_from_slice(&noise); + } + Ok(latents) + } + + fn decode_latents(&mut self, latents: &[f32]) -> Result, String> { + if latents.is_empty() { + return Ok(Vec::new()); + } + if !latents.len().is_multiple_of(self.bundle.latent_dim) { + return Err(format!( + "latent buffer has {} values, not divisible by {}", + latents.len(), + self.bundle.latent_dim + )); + } + let frame_count = latents.len() / self.bundle.latent_dim; + let mut state = initialize_state(&self.bundle.mimi_state_manifest)?; + let mut audio = Vec::new(); + + for start in (0..frame_count).step_by(DECODER_CHUNK_FRAMES) { + let end = (start + DECODER_CHUNK_FRAMES).min(frame_count); + let values = + latents[start * self.bundle.latent_dim..end * self.bundle.latent_dim].to_vec(); + let latent = Tensor::from_array(( + vec![1_i64, (end - start) as i64, self.bundle.latent_dim as i64], + values.into_boxed_slice(), + )) + .map_err(ort_error("create Mimi latent tensor"))?; + let mut inputs = vec![(Cow::Borrowed("latent"), SessionInputValue::from(latent))]; + append_state_inputs(&mut inputs, &state); + let mut outputs = self + .mimi_decoder + .run(inputs) + .map_err(ort_error("run Mimi decoder"))?; + let samples = outputs[0] + .try_extract_tensor::() + .map_err(ort_error("extract Mimi audio"))? + .1; + audio.extend_from_slice(samples); + replace_state_from_outputs(&mut state, &mut outputs)?; + } + Ok(audio) + } +} + +fn load_session(path: PathBuf, num_threads: usize) -> Result { + if !path.is_file() { + return Err(format!("missing Pocket TTS file: {}", path.display())); + } + Session::builder() + .map_err(ort_error("create ONNX session builder"))? + .with_intra_threads(num_threads) + .map_err(|err| format!("configure ONNX intra-op threads: {err}"))? + .with_inter_threads(1) + .map_err(|err| format!("configure ONNX inter-op threads: {err}"))? + .commit_from_file(&path) + .map_err(|err| format!("load {}: {err}", path.display())) +} + +fn load_tokenizer(path: &Path) -> Result { + let sentencepiece = SentencePieceModel::from_file(path) + .map_err(|err| format!("load {}: {err}", path.display()))?; + let trainer = sentencepiece + .trainer() + .ok_or_else(|| format!("{} has no SentencePiece trainer metadata", path.display()))?; + let normalizer = sentencepiece.normalizer().ok_or_else(|| { + format!( + "{} has no SentencePiece normalizer metadata", + path.display() + ) + })?; + if normalizer.name() != "identity" { + return Err(format!( + "{} uses unsupported SentencePiece normalizer {:?}", + path.display(), + normalizer.name() + )); + } + + let vocab = sentencepiece + .pieces() + .iter() + .map(|piece| (piece.piece().to_owned(), f64::from(piece.score()))) + .collect(); + let mut tokenizer = Tokenizer::new( + Unigram::from( + vocab, + Some(trainer.unk_id() as usize), + trainer.byte_fallback(), + ) + .map_err(|err| format!("construct tokenizer from {}: {err}", path.display()))?, + ); + // SentencePiece's identity normalizer still escapes spaces as U+2581 and + // prepends one marker to the input before unigram segmentation. + tokenizer.with_pre_tokenizer(Some(Metaspace::new('▁', PrependScheme::Always, false))); + Ok(tokenizer) +} + +fn initialize_state(specs: &[StateSpec]) -> Result, String> { + specs + .iter() + .cloned() + .map(|spec| { + let len = shape_len(&spec.shape)?; + let value = match spec.dtype { + StateDtype::Float32 => { + let fill = match spec.fill { + StateFill::Nan => f32::NAN, + StateFill::Empty | StateFill::Zeros => 0.0, + StateFill::Ones => 1.0, + }; + if len == 0 { + Tensor::::new(&ort::memory::Allocator::default(), spec.shape.clone()) + .map_err(ort_error("create empty float state tensor"))? + .into_dyn() + } else { + Tensor::from_array((spec.shape.clone(), vec![fill; len].into_boxed_slice())) + .map_err(ort_error("create float state tensor"))? + .into_dyn() + } + } + StateDtype::Int64 => { + let fill = i64::from(matches!(spec.fill, StateFill::Ones)); + if len == 0 { + Tensor::::new(&ort::memory::Allocator::default(), spec.shape.clone()) + .map_err(ort_error("create empty integer state tensor"))? + .into_dyn() + } else { + Tensor::from_array((spec.shape.clone(), vec![fill; len].into_boxed_slice())) + .map_err(ort_error("create integer state tensor"))? + .into_dyn() + } + } + StateDtype::Bool => { + let fill = matches!(spec.fill, StateFill::Ones); + if len == 0 { + Tensor::::new(&ort::memory::Allocator::default(), spec.shape.clone()) + .map_err(ort_error("create empty bool state tensor"))? + .into_dyn() + } else { + Tensor::from_array((spec.shape.clone(), vec![fill; len].into_boxed_slice())) + .map_err(ort_error("create bool state tensor"))? + .into_dyn() + } + } + }; + Ok(StateValue { spec, value }) + }) + .collect() +} + +fn append_state_inputs<'a>( + inputs: &mut Vec<(Cow<'a, str>, SessionInputValue<'a>)>, + state: &'a [StateValue], +) { + for value in state { + inputs.push(( + Cow::Borrowed(value.spec.input_name.as_str()), + SessionInputValue::from(&value.value), + )); + } +} + +fn replace_state_from_outputs( + state: &mut [StateValue], + outputs: &mut ort::session::SessionOutputs<'_>, +) -> Result<(), String> { + for value in state { + value.value = outputs + .remove(&value.spec.output_name) + .ok_or_else(|| format!("missing state output {}", value.spec.output_name))?; + } + Ok(()) +} + +fn shape_len(shape: &[i64]) -> Result { + shape.iter().try_fold(1_usize, |len, &dim| { + let dim = usize::try_from(dim).map_err(|_| format!("negative state dimension {dim}"))?; + len.checked_mul(dim) + .ok_or_else(|| format!("state shape overflows usize: {shape:?}")) + }) +} + +fn estimate_max_frames(token_count: usize, frame_rate: f32) -> usize { + ((token_count as f32 / TOKENS_PER_SECOND_ESTIMATE + GENERATION_SECONDS_PADDING) * frame_rate) + .ceil() as usize +} + +fn normal_noise(rng: &mut impl Rng, len: usize, std_dev: f32) -> Vec { + let mut out = Vec::with_capacity(len); + while out.len() < len { + let u1 = rng.random::().max(f32::MIN_POSITIVE); + let u2 = rng.random::(); + let radius = (-2.0_f32 * u1.ln()).sqrt() * std_dev; + out.push(radius * (TAU * u2).cos()); + if out.len() < len { + out.push(radius * (TAU * u2).sin()); + } + } + out +} + +fn read_npy_f32(path: &Path) -> Result, String> { + let bytes = fs::read(path).map_err(|err| format!("read {}: {err}", path.display()))?; + if bytes.len() < 10 || &bytes[..6] != b"\x93NUMPY" { + return Err(format!("{} is not a NumPy array", path.display())); + } + let major = bytes[6]; + let header_len_bytes = match major { + 1 => 2, + 2 | 3 => 4, + _ => { + return Err(format!( + "unsupported NumPy version {major} in {}", + path.display() + )) + } + }; + let header_start = 8 + header_len_bytes; + if bytes.len() < header_start { + return Err(format!("truncated NumPy header in {}", path.display())); + } + let header_len = if header_len_bytes == 2 { + u16::from_le_bytes([bytes[8], bytes[9]]) as usize + } else { + u32::from_le_bytes([bytes[8], bytes[9], bytes[10], bytes[11]]) as usize + }; + let data_start = header_start + .checked_add(header_len) + .ok_or_else(|| format!("NumPy header overflow in {}", path.display()))?; + if data_start > bytes.len() { + return Err(format!("truncated NumPy data in {}", path.display())); + } + let header = std::str::from_utf8(&bytes[header_start..data_start]) + .map_err(|err| format!("invalid NumPy header in {}: {err}", path.display()))?; + if !(header.contains("'descr': ' impl FnOnce(ort::Error) -> String { + move |err| format!("{context}: {err}") +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn shape_len_supports_empty_state_dimensions() { + assert_eq!(shape_len(&[1, 128, 0]).expect("shape"), 0); + assert_eq!(shape_len(&[2, 1, 8, 1000, 64]).expect("shape"), 1_024_000); + } + + #[test] + fn normal_noise_has_requested_length() { + let mut rng = rand::rng(); + assert_eq!(normal_noise(&mut rng, 1, 1.0).len(), 1); + assert_eq!(normal_noise(&mut rng, 32, 1.0).len(), 32); + } + + #[test] + fn generation_frame_estimate_scales_with_token_count() { + assert_eq!(estimate_max_frames(3, 12.5), 38); + assert_eq!(estimate_max_frames(300, 12.5), 1_275); + } + + #[test] + #[ignore = "requires BUZZ_POCKET_TEST_MODEL_DIR"] + fn tokenizer_matches_sentencepiece_reference_including_unknown_words() { + let dir = std::env::var("BUZZ_POCKET_TEST_MODEL_DIR") + .expect("set BUZZ_POCKET_TEST_MODEL_DIR to the verified April bundle"); + let tokenizer = + load_tokenizer(&Path::new(&dir).join("tokenizer.model")).expect("load April tokenizer"); + let cases: &[(&str, &[u32])] = &[ + ("Yep.", &[2462, 263]), + ("Hello there.", &[2994, 310, 263]), + ( + "quizzaciously xyzzy.", + &[ + 260, 1157, 1818, 362, 1814, 323, 260, 568, 327, 1818, 327, 263, + ], + ), + ("I'm listening.", &[268, 264, 283, 260, 604, 273, 263]), + ]; + for (text, expected) in cases { + let encoding = tokenizer.encode(*text, false).expect("tokenize"); + assert_eq!(encoding.get_ids(), *expected, "{text}"); + } + } + + #[test] + #[ignore = "requires BUZZ_POCKET_TEST_MODEL_DIR"] + fn loader_splits_oversized_prompts_at_bundle_token_limit() { + let dir = std::env::var("BUZZ_POCKET_TEST_MODEL_DIR") + .expect("set BUZZ_POCKET_TEST_MODEL_DIR to the verified April bundle"); + let engine = AprilPocketTts::load(Path::new(&dir), 1).expect("load April bundle"); + let text = "This deliberately long sentence repeats ordinary English words so the exact SentencePiece token limit is exercised without relying on punctuation, and it keeps adding more material until the prompt must be divided into multiple independently safe generation chunks before the recurrent state cache can be exhausted."; + let prepared = prepare_april_prompt(text).expect("prepare prompt"); + let chunks = engine.split_prompt(&prepared).expect("split prompt"); + + assert!(chunks.len() > 1); + assert!(chunks.iter().all(|chunk| { + engine.token_count(chunk).expect("tokenize chunk") <= engine.bundle.max_token_per_chunk + })); + } + + #[test] + #[ignore = "requires BUZZ_POCKET_TEST_MODEL_DIR"] + fn gary_provost_long_sentence_respects_bundle_token_limit() { + let dir = std::env::var("BUZZ_POCKET_TEST_MODEL_DIR") + .expect("set BUZZ_POCKET_TEST_MODEL_DIR to the verified April bundle"); + let engine = AprilPocketTts::load(Path::new(&dir), 1).expect("load April bundle"); + let text = "And sometimes, when I am certain the reader is rested, I will engage him with a sentence of considerable length, a sentence that burns with energy and builds with all the impetus of a crescendo, the roll of the drums, the crash of the cymbals–sounds that say listen to this, it is important."; + let prepared = prepare_april_prompt(text).expect("prepare prompt"); + let chunks = engine.split_prompt(&prepared).expect("split long sentence"); + let token_counts: Vec<_> = chunks + .iter() + .map(|chunk| engine.token_count(chunk).expect("count tokens")) + .collect(); + + assert_eq!( + chunks, + [ + "And sometimes, when I am certain the reader is rested, I will engage him with a sentence of considerable length, a sentence that burns with energy and builds with all the.", + "Impetus of a crescendo, the roll of the drums, the crash of the cymbals–sounds that say listen to this, it is important.", + ] + ); + assert_eq!(token_counts, [48, 44]); + } +} diff --git a/desktop/src-tauri/src/huddle/pocket_models.rs b/desktop/src-tauri/src/huddle/pocket_models.rs new file mode 100644 index 0000000000..de34c77a70 --- /dev/null +++ b/desktop/src-tauri/src/huddle/pocket_models.rs @@ -0,0 +1,130 @@ +//! Immutable capabilities for Buzz Desktop's April Pocket TTS bundle. + +/// Pinned upstream export repository. +pub const APRIL_MODEL_ID: &str = "KevinAHM/pocket-tts-onnx"; + +/// Pinned revision containing the `english_2026-04` bundle. +pub const APRIL_MODEL_REVISION: &str = "58a6d00cf13d239b6748cb0769f35c580a8f606c"; + +/// Language bundle selected from the pinned export. +pub const APRIL_BUNDLE_ID: &str = "english_2026-04"; + +/// Maximum input size declared by the April bundle. +pub const APRIL_MAX_TOKEN_PER_CHUNK: usize = 50; + +/// One immutable artifact required by the April INT8 runtime. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub struct PocketModelArtifact { + pub filename: &'static str, + pub sha256: &'static str, + pub size_bytes: u64, + pub quantized: bool, +} + +/// Capabilities of Buzz Desktop's sole Pocket model. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub struct PocketModelInfo { + pub bundle_id: &'static str, + pub source_model_id: &'static str, + pub revision: &'static str, + pub sample_rate: u32, + pub max_token_per_chunk: usize, + pub artifacts: &'static [PocketModelArtifact], + pub quantized_components: &'static [&'static str], +} + +const INT8_ARTIFACTS: [PocketModelArtifact; 8] = [ + PocketModelArtifact { + filename: "bundle.json", + sha256: "bab643150f437f37df080a710520ff39ed9ebd9a339f8ebdc739f7eddfc28b3f", + size_bytes: 24_381, + quantized: false, + }, + PocketModelArtifact { + filename: "bos_before_voice.npy", + sha256: "f46edf4f7007b7ba4ea58831f49d003e59e167b4641c44bb3addfe9231a780b1", + size_bytes: 4_224, + quantized: false, + }, + PocketModelArtifact { + filename: "tokenizer.model", + sha256: "d461765ae179566678c93091c5fa6f2984c31bbe990bf1aa62d92c64d91bc3f6", + size_bytes: 59_339, + quantized: false, + }, + PocketModelArtifact { + filename: "flow_lm_main_int8.onnx", + sha256: "f9bd8106b79a0192c1c43399ab938fb24900a95c1c599870d75a884e99000116", + size_bytes: 76_341_079, + quantized: true, + }, + PocketModelArtifact { + filename: "flow_lm_flow_int8.onnx", + sha256: "3dd781ee5abee9e195320bf0106bebd6372a852b3b36352524ee78b40554635d", + size_bytes: 9_962_530, + quantized: true, + }, + PocketModelArtifact { + filename: "mimi_decoder_int8.onnx", + sha256: "3630450a3297a101792a6ac66619ebc70ab916b265e6220c2afaef8b1673f925", + size_bytes: 22_684_077, + quantized: true, + }, + PocketModelArtifact { + filename: "mimi_encoder.onnx", + sha256: "853e2ca623b8782d94c3745ec6133bfdff7ce33d9b11128bd29ea03f28d76e3d", + size_bytes: 39_768_446, + quantized: false, + }, + PocketModelArtifact { + filename: "text_conditioner.onnx", + sha256: "4ecee995fb69f85c7a7493d11f7b5ee15d9950facc7ab3f5c9c49ef1e03847bb", + size_bytes: 16_388_344, + quantized: false, + }, +]; + +const INT8_COMPONENTS: [&str; 3] = ["flow_lm_main", "flow_lm_flow", "mimi_decoder"]; + +/// Return immutable metadata for Buzz Desktop's April INT8 model. +pub const fn april_model_info() -> PocketModelInfo { + PocketModelInfo { + bundle_id: APRIL_BUNDLE_ID, + source_model_id: APRIL_MODEL_ID, + revision: APRIL_MODEL_REVISION, + sample_rate: 24_000, + max_token_per_chunk: APRIL_MAX_TOKEN_PER_CHUNK, + artifacts: &INT8_ARTIFACTS, + quantized_components: &INT8_COMPONENTS, + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn metadata_matches_pinned_int8_layout() { + let info = april_model_info(); + assert_eq!(info.artifacts.len(), 8); + assert_eq!( + info.quantized_components, + ["flow_lm_main", "flow_lm_flow", "mimi_decoder"] + ); + assert_eq!( + info.artifacts + .iter() + .map(|artifact| artifact.size_bytes) + .sum::(), + 165_232_420 + ); + assert!(info + .artifacts + .iter() + .any(|artifact| { artifact.filename == "mimi_encoder.onnx" && !artifact.quantized })); + assert!(!info + .artifacts + .iter() + .any(|artifact| artifact.filename == "mimi_encoder_int8.onnx")); + } +} diff --git a/desktop/src-tauri/src/huddle/tts.rs b/desktop/src-tauri/src/huddle/tts.rs index 63a435cd8e..f084cca6d5 100644 --- a/desktop/src-tauri/src/huddle/tts.rs +++ b/desktop/src-tauri/src/huddle/tts.rs @@ -73,9 +73,8 @@ const SYNTH_STEPS: usize = 1; /// /// Applied only at the *end* of each synthesised sentence to eliminate the /// click that would otherwise occur when a non-zero waveform terminates -/// abruptly. **No fade-in is applied** — see `apply_fade_out` for the -/// rationale and `examples/pocket_onset_probe.rs` for the measurement that -/// motivated removing the leading fade. +/// abruptly. **No fade-in is applied** — see `apply_fade_out` for why preserving +/// the leading waveform is important. const FADE_OUT_SAMPLES: usize = (SAMPLE_RATE as f64 * 0.008) as usize; /// Length of the zero-sample cushion prepended before each synthesized @@ -101,13 +100,9 @@ const SENTENCE_LEAD_IN_SAMPLES: usize = (SAMPLE_RATE as f64 * 0.020) as usize; /// names chunk stitching as the reliability lever). Our previous /// sentence-per-call path created ~2–4× more seams than upstream. /// -/// We don't ship the SentencePiece tokenizer, so 50 tokens is approximated -/// with a character budget. The bundled 4k-entry vocab averages ~4 chars per -/// token, but usage-weighted English text leans on short common tokens, so -/// the effective ratio is ~2–4 chars/token and 200 chars ≈ 60–100 tokens — -/// modestly above upstream's 50, deliberately: erring large means fewer -/// seams, and even ~100 tokens is far below the model's 500-LM-step (~40 s) -/// ceiling. Do not shrink this budget to chase an exact 50-token match. +/// This character budget performs only coarse sentence packing. The April +/// engine applies its SentencePiece tokenizer afterward and refines every +/// result at the bundle's exact 50-token boundary. const MAX_CHUNK_CHARS: usize = 200; /// Silence inserted between sentences by the TTS pipeline (seconds). @@ -493,18 +488,17 @@ fn tts_worker( // Split into sentences, then group into synthesis chunks: the first // sentence stays alone (fast time-to-first-audio), the rest pack - // greedily up to MAX_CHUNK_CHARS. Each chunk is one `generate()` - // call; playback of chunk N overlaps synthesis of chunk N+1 - // (lookahead pipelining). Grouping matches upstream's ~50-token - // chunking and halves the exposed prosody seams on multi-sentence - // replies — see MAX_CHUNK_CHARS. + // greedily up to MAX_CHUNK_CHARS. Playback of each model unit overlaps + // synthesis of the next one. The Pocket engine applies its exact + // 50-token split; keeping those units within one playback chunk avoids + // adding fades and pauses at token-only boundaries. let sentences: Vec = split_sentences(&text) .into_iter() .filter(|s| !s.trim().is_empty()) .collect(); let chunks = group_sentences_into_chunks(&sentences, MAX_CHUNK_CHARS); - for chunk in &chunks { + 'playback_chunks: for chunk in &chunks { if handle_cancel_or_shutdown( &cancel, &shutdown, @@ -521,51 +515,76 @@ fn tts_worker( continue; } - match engine.synth_chunk(text, "en", &style, SYNTH_STEPS) { - Ok(samples) if !samples.is_empty() => { - let mut audio = clamp_to_full_scale(samples); - // Fade-out only — fading-in would attenuate the consonant - // onset (see `apply_fade_out` docstring + the - // 2026-05-18 "first little sound is missing" regression). - apply_fade_out(&mut audio); - - // Build one contiguous buffer per synthesized sentence: - // lead-in cushion + audio + trailing gap. Keeping this as - // a single rodio source preserves the original queue/drain - // semantics (one append per sentence) while still giving - // every chunk a quiet device warm-up window. - let buf = - build_sentence_append_buffer(&mut first_append, audio, silence_buf_len); - - // Check-and-append under `player_ops`, serialized with - // the monitor: a barge-in may have arrived during - // synthesis (the blocking window the monitor thread - // exists for). Don't append the now-stale sentence — the - // human interrupted; speaking it anyway would talk over - // them. Holding the lock for the check + append means the - // monitor can never clear between our check passing and - // the buffer landing. The flag is deliberately NOT - // consumed here: the loop-top handle_cancel_or_shutdown - // does the full consume (drain queue, reset lead-in) on - // the next iteration. - let _ops = lock_player_ops(&player_ops); - if cancel.load(Ordering::Acquire) { - // Nothing appended; the loop-top consume re-arms - // `first_append` (the flag is still set — the worker - // is its only consumer). + let model_chunks = match engine.split_text_into_chunks(text) { + Ok(model_chunks) => model_chunks, + Err(error) => { + eprintln!("buzz-desktop: TTS chunking failed: {error}"); + break; + } + }; + let model_chunk_count = model_chunks.len(); + for (model_chunk_index, model_chunk) in model_chunks.iter().enumerate() { + if handle_cancel_or_shutdown( + &cancel, + &shutdown, + &tts_active, + &text_rx, + Some((&player, &player_ops)), + ) { + first_append = true; + break 'playback_chunks; + } + + let ends_playback_chunk = model_chunk_index + 1 == model_chunk_count; + match engine.synth_chunk(model_chunk, "en", &style, SYNTH_STEPS) { + Ok(samples) if !samples.is_empty() => { + let mut audio = clamp_to_full_scale(samples); + if ends_playback_chunk { + // Fade only at the playback-chunk boundary. Applying + // it at the model's internal token boundary would + // create an audible dip between contiguous units. + apply_fade_out(&mut audio); + } + + let buf = build_sentence_append_buffer( + &mut first_append, + audio, + silence_buf_len, + model_chunk_index == 0 || player.empty(), + ends_playback_chunk, + ); + + // Check-and-append under `player_ops`, serialized with + // the monitor: a barge-in may have arrived during + // synthesis (the blocking window the monitor thread + // exists for). Don't append the now-stale sentence — the + // human interrupted; speaking it anyway would talk over + // them. Holding the lock for the check + append means the + // monitor can never clear between our check passing and + // the buffer landing. The flag is deliberately NOT + // consumed here: the loop-top handle_cancel_or_shutdown + // does the full consume (drain queue, reset lead-in) on + // the next iteration. + let _ops = lock_player_ops(&player_ops); + if cancel.load(Ordering::Acquire) { + // Nothing appended; the loop-top consume re-arms + // `first_append` (the flag is still set — the worker + // is its only consumer). + break; + } + player.append(SamplesBuffer::new(channels, rate, buf)); + // NOTE: tts_active is set AFTER player.append(), not + // before. Setting it before synthesis would cause STT to + // discard user speech during the synthesis window as + // "echo" even though no audio is actually playing yet. + // See crossfire review C3. + tts_active.store(true, Ordering::Release); + } + Ok(_) => {} + Err(e) => { + eprintln!("buzz-desktop: TTS synth failed: {e}"); break; } - player.append(SamplesBuffer::new(channels, rate, buf)); - // NOTE: tts_active is set AFTER player.append(), not - // before. Setting it before synthesis would cause STT to - // discard user speech during the synthesis window as - // "echo" even though no audio is actually playing yet. - // See crossfire review C3. - tts_active.store(true, Ordering::Release); - } - Ok(_) => {} - Err(e) => { - eprintln!("buzz-desktop: TTS synth failed: {e}"); } } } @@ -646,15 +665,10 @@ fn lock_player_ops(ops: &Mutex<()>) -> MutexGuard<'_, ()> { /// Hard-clamp samples to ±1.0 full scale. /// -/// No gain is applied: Pocket TTS already emits speech-level audio -/// (peaks 0.4–0.97, RMS ≈ −20 dBFS across varied sentences — measured by -/// `examples/pocket_clip_probe`), matching the kyutai reference pipeline, -/// which applies no output scaling. Two earlier gain stages were both -/// regressions against that baseline: per-sentence peak normalization caused -/// level pumping between sentences, and the fixed 9.3× gain that replaced it -/// was calibrated on a single anomalously-quiet bench utterance (peak 0.076) -/// and clipped 13–34% of samples on real speech ("blown out", 2026-06-12). -/// The clamp alone remains as the safety net against outlier transients. +/// No gain is applied because Pocket TTS already emits speech-level audio and +/// the reference pipeline applies no output scaling. Normalizing each sentence +/// would cause level pumping between chunks. The clamp remains only as a safety +/// net against outlier transients. fn clamp_to_full_scale(samples: Vec) -> Vec { samples.into_iter().map(|s| s.clamp(-1.0, 1.0)).collect() } @@ -667,14 +681,10 @@ fn clamp_to_full_scale(samples: Vec) -> Vec { /// /// # Why no fade-in /// -/// An earlier revision (pre 2026-05) symmetrically faded *in* over the same -/// 8 ms window. That swallowed the leading consonant attack on every -/// sentence — Pocket TTS produces real audio energy inside the first -/// millisecond (RMS ≈ 0.02, peak ≈ 0.03 measured across four prompts in -/// `examples/pocket_onset_probe.rs`), and a linear 0→1 ramp over 192 samples -/// scales those onset samples by ≤50 % for the first ~4 ms. The result was -/// the "first little sound or two is missing" regression heard on -/// 2026-05-18. +/// A symmetric fade-in would attenuate the leading consonant attack because +/// Pocket TTS produces real audio energy inside the first millisecond. A +/// linear 0→1 ramp over 192 samples scales those onset samples by ≤50% for the +/// first ~4 ms, which can make the first phoneme sound clipped. /// /// The first sample of Pocket output measures ≈ 0.0018 (≈ −54 dBFS) — well /// below the threshold at which a DC-jump would be audible as a click — so @@ -689,13 +699,12 @@ fn apply_fade_out(samples: &mut [f32]) { } } -/// Build the single buffer appended to the rodio `Player` for one synthesised -/// sentence. +/// Build one buffer appended to the rodio `Player` for a synthesis unit. /// -/// Every sentence chunk gets a short lead-in pad immediately before its audio. -/// This matters for chunks that start with soft first phonemes (`I'm`, `I've`): -/// the synthesized buffer can begin with speech within the first millisecond, -/// so the playback layer must provide the device/mixer cushion. +/// Every playback boundary gets a short lead-in pad immediately before its +/// audio. This matters for chunks that start with soft first phonemes (`I'm`, +/// `I've`): the synthesized buffer can begin with speech within the first +/// millisecond, so the playback layer must provide the device/mixer cushion. /// To keep the audible gap unchanged, the trailing silence after this chunk is /// shortened by the same amount (`silence_buf_len - SENTENCE_LEAD_IN_SAMPLES`): /// sentence N contributes 80 ms of post-speech silence and sentence N+1 @@ -706,6 +715,11 @@ fn apply_fade_out(samples: &mut [f32]) { /// tracked source per synthesized sentence, avoiding source-boundary/drain /// regressions from enqueueing the lead-in, audio, and tail as separate sounds. /// +/// A playback chunk may contain several model-sized synthesis units. Only the +/// first unit receives the onset cushion and only the last receives the +/// remaining gap. If playback underruns while the next unit is synthesized, +/// that unit becomes a new playback boundary and receives a fresh cushion. +/// /// `first_append` is flipped on the first call after the player goes idle. /// The worker uses it in the idle branch of the main loop to distinguish /// "never queued anything since last drain" from "drained after speaking", @@ -714,14 +728,25 @@ fn build_sentence_append_buffer( first_append: &mut bool, audio: Vec, silence_buf_len: usize, + starts_playback_chunk: bool, + ends_playback_chunk: bool, ) -> Vec { if *first_append { *first_append = false; } - let trailing_silence_len = silence_buf_len.saturating_sub(SENTENCE_LEAD_IN_SAMPLES); - let mut buf = Vec::with_capacity(SENTENCE_LEAD_IN_SAMPLES + audio.len() + trailing_silence_len); - buf.extend(std::iter::repeat_n(0.0_f32, SENTENCE_LEAD_IN_SAMPLES)); + let lead_in_len = if starts_playback_chunk { + SENTENCE_LEAD_IN_SAMPLES + } else { + 0 + }; + let trailing_silence_len = if ends_playback_chunk { + silence_buf_len.saturating_sub(SENTENCE_LEAD_IN_SAMPLES) + } else { + 0 + }; + let mut buf = Vec::with_capacity(lead_in_len + audio.len() + trailing_silence_len); + buf.extend(std::iter::repeat_n(0.0_f32, lead_in_len)); buf.extend(audio); buf.extend(std::iter::repeat_n(0.0_f32, trailing_silence_len)); buf @@ -734,9 +759,8 @@ fn build_sentence_append_buffer( /// single-sentence cost. Subsequent sentences pack greedily: a sentence /// joins the current chunk while the combined length stays within /// `max_chars`; otherwise it starts a new chunk. A single sentence longer -/// than `max_chars` becomes its own chunk unsplit — Pocket TTS handles long -/// single sentences fine (the ceiling is the 500-LM-step default), it's the -/// *seams* we're minimizing. +/// than `max_chars` becomes its own chunk here, then the Pocket engine splits +/// it at the April bundle's exact token limit before synthesis. /// /// Sentences within a chunk are joined with a single space; sentence-ending /// punctuation is preserved by `split_sentences`, so the model sees natural diff --git a/desktop/src-tauri/src/huddle/tts_tests.rs b/desktop/src-tauri/src/huddle/tts_tests.rs index 7887f8bbdb..1908b096b1 100644 --- a/desktop/src-tauri/src/huddle/tts_tests.rs +++ b/desktop/src-tauri/src/huddle/tts_tests.rs @@ -9,6 +9,9 @@ use std::sync::atomic::{AtomicBool, Ordering}; use std::sync::mpsc; use std::sync::{Arc, Mutex}; +#[path = "tts_tests/token_split.rs"] +mod token_split; + // ── Remote interrupt tracker ────────────────────────────────────────────── // // Models the per-peer frame counting logic in the recv task of @@ -785,16 +788,6 @@ fn apply_fade_out_single_sample() { assert_eq!(samples[0], 1.0); } -/// Sanity-check the per-sentence cushion length: 20 ms at 24 kHz must -/// land at exactly 480 samples. This is a const computation, so the -/// real value of this test is documenting *why* 20 ms was chosen — it -/// covers a typical CoreAudio buffer turnover (256–1024 samples) -/// without being audible as user-facing latency. -#[test] -fn sentence_lead_in_is_sane() { - assert_eq!(SENTENCE_LEAD_IN_SAMPLES, 480, "20 ms × 24 kHz"); -} - // ── build_sentence_append_buffer tests ─────────────────────────────────── /// REGRESSION: every chunk needs an onset cushion; synthesized chunks @@ -812,6 +805,8 @@ fn lead_in_pad_is_present_for_every_sentence_chunk() { &mut first, vec![0.5_f32; SENTENCE_AUDIO_LEN], SILENCE_BUF_LEN, + true, + true, ); assert_eq!(buf.len(), SENTENCE_AUDIO_LEN + SILENCE_BUF_LEN); @@ -840,11 +835,11 @@ fn lead_in_pad_is_present_for_every_sentence_chunk() { #[test] fn build_sentence_append_buffer_flips_first_append() { let mut first = true; - let _ = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400); + let _ = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); assert!(!first, "first call must flip the flag"); // Subsequent call: still has a per-sentence lead-in, flag stays false. - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400); + let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); assert!(!first); } @@ -853,7 +848,7 @@ fn build_sentence_append_buffer_flips_first_append() { #[test] fn first_sentence_leading_silence_is_exactly_lead_in() { let mut first = true; - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400); + let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); assert_eq!(buf[SENTENCE_LEAD_IN_SAMPLES], 0.5); } @@ -863,8 +858,10 @@ fn first_sentence_leading_silence_is_exactly_lead_in() { fn sentence_gap_budget_is_preserved() { let mut first = true; let silence_buf_len = 2400; - let first_buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len); - let second_buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len); + let first_buf = + build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, true); + let second_buf = + build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, true); let first_tail = &first_buf[SENTENCE_LEAD_IN_SAMPLES + 100..]; let second_lead = &second_buf[..SENTENCE_LEAD_IN_SAMPLES]; @@ -877,7 +874,7 @@ fn sentence_gap_budget_is_preserved() { #[test] fn sentence_append_buffer_is_one_contiguous_source() { let mut first = true; - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400); + let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); assert_eq!(buf.len(), 2400 + 100); assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); @@ -949,9 +946,8 @@ fn chunk_grouping_packs_up_to_budget_then_spills() { assert_eq!(chunks[2], d); } -/// A single sentence longer than the budget is passed through unsplit — -/// long single sentences are fine (the LM cap bounds runaway); only seams -/// are being minimized. +/// A single sentence longer than the coarse budget is passed through here; +/// the loaded April engine subsequently enforces its exact 50-token limit. #[test] fn chunk_grouping_oversized_sentence_passes_through() { let long = "word ".repeat(60).trim_end().to_string() + "."; diff --git a/desktop/src-tauri/src/huddle/tts_tests/token_split.rs b/desktop/src-tauri/src/huddle/tts_tests/token_split.rs new file mode 100644 index 0000000000..b9249c9afc --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_tests/token_split.rs @@ -0,0 +1,24 @@ +use super::*; + +/// The onset cushion covers 20 ms at the production sample rate. +#[test] +fn sentence_lead_in_is_sane() { + assert_eq!(SENTENCE_LEAD_IN_SAMPLES, 480, "20 ms × 24 kHz"); +} + +/// Model-token splits remain contiguous: only the playback chunk as a whole +/// receives its onset cushion and trailing sentence gap. +#[test] +fn token_split_units_do_not_add_sentence_boundary_padding() { + let mut first = true; + let silence_buf_len = 2400; + let first_unit = + build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, false); + let last_unit = + build_sentence_append_buffer(&mut first, vec![0.25; 100], silence_buf_len, false, true); + + assert_eq!(first_unit.len(), SENTENCE_LEAD_IN_SAMPLES + 100); + assert_eq!(first_unit.last(), Some(&0.5)); + assert_eq!(last_unit.first(), Some(&0.25)); + assert_eq!(first_unit.len() + last_unit.len(), 200 + silence_buf_len); +} From 081f805d5ea25841ab885c7b67a568618a34aa59 Mon Sep 17 00:00:00 2001 From: Tyler <109685178+tlongwell-block@users.noreply.github.com> Date: Fri, 31 Jul 2026 07:02:48 -0400 Subject: [PATCH 103/112] feat(agent): optional reply guard reminds a silent turn to publish (#3763) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why A Buzz agent's assistant text and reasoning are never shown to anyone — only what it posts through the CLI. A turn that runs fifteen tool calls and never publishes is a silent failure: the requester waits on a result that was produced and thrown away. This adds an optional reminder at the end-of-turn gate, off by default. Tyler asked for it in buzz-mesh; plan iterated to **9.5/10 with @Wren** (Minimalness 9.7, Elegance 9.5, Correctness 9.3). ## What `BUZZ_AGENT_REQUIRE_REPLY=1` (default off, per-agent opt-in). A turn about to end with no recognized attempt to post gets a reminder and is rerolled. **At most two, then the turn ends regardless** — the guard catches accidental omission, it does not compel speech. The reminder text explicitly licenses silence so it cannot fight the base prompt's "silence is usually correct." **This is not a new MCP hook.** `RunCtx::run` *is* the turn, so the two per-turn locals need no plumbing, and every tool call already passes through it with arguments visible. The objection is appended at the existing `_Stop` gate and rides `push_hook_outputs_as_tool_results`, so the model receives it as a lower-trust tool result with `{hook, server, text}` attribution. No new trust path, no new lifecycle event, no dev-mcp or CLI protocol change. Earlier revisions of this plan needed four crates (a `_UserPromptSubmit` hook, a marker file, a `buzz-cli` change, dev-mcp state). Tyler pointed out the agent already knows both facts; that deleted all of it. Net runtime change is ~35 lines in `agent.rs` + ~4 in `config.rs`. ### Recognition contract A registered non-hook tool whose qualified name ends in `__shell`, whose `command` argument contains `messages send` or `reactions add`. - **The `__` separator is exact, not approximate.** Given `has()` + `!is_hook()`, `ends_with("__shell")` is *provably equivalent* to a bare name of `shell`: registration forbids `__` in server and bare names (`mcp.rs:227,268`) and qnames are `{server}__{bare}`, so a trailing `__shell` could only straddle the separator if the bare name began with `_` — which `is_hook` excludes. Without the separator, `powershell` and `noshell` would match. - **Reads the structured `command` field**, not serialized arguments, so a `description` that quotes a send cannot disarm the guard, and a non-string `command` is rejected rather than coerced. - **Detects an attempt, not a successful publish.** A failed send already returns non-zero exit and error JSON — louder than this reminder. The variable is named `buzz_reply_call_seen` so the code can't pretend otherwise. - **Checked after the per-turn tool-call cap**, since a discarded call never ran. - `messages send` also covers `messages send-diff`. Reactions count because the base prompt directs agents to react rather than post a bare acknowledgement. **Known limits, both deliberate and documented:** a command assembled at runtime (`$CMD`) or hidden in a wrapper script is missed; text that merely quotes a send (`echo "buzz messages send"`) matches. Missing a real post is the expensive direction and substring matching is the forgiving one there. Neither edge is pinned by a test, so the matcher stays free to improve. ### Budget Reminders share `BUZZ_AGENT_STOP_MAX_REJECTIONS`, the existing outer cap on every end-turn objection. Default 3 fits both; at 1 only one fits; at 0 the guard is off with the hooks. A round carrying both a hook objection and a reminder costs one rejection and delivers both texts. An independent budget would either violate that bound or need a second arbitration rule. ## Prior art - **#3467** (closed) built the same detector one layer up in `buzz-acp` for a different remedy. None of its symbols are on main — this borrows its permission to be coarse, but reads structured data that ACP didn't have. - **#3648** (open) detects turns with *no output at all*; a turn with fifteen tool calls and no post counts as output there, so it does not cover this case. - **#3741** (merged) is mesh-only. ## Testing **14 new tests.** 4 unit tests on the matcher; 10 integration tests through the ACP wire harness: off by default, `=0` still off, opted-in silent → exactly 2 reminders then `end_turn`, registered `fake__shell` send → 0 reminders, hallucinated `fake__shell` → still reminded, publish call truncated past the 64-call cap → still reminded, budget 1 → 1 reminder, budget 0 → off, combined `_Stop` hook objection + reminder → one round both texts and after 2 reminders the hook objection continues alone, unparseable `=true` → startup error naming the key. **10 mutation checks, each breaking a specific named test** — neutralize the nag cap, stop sharing the budget, neutralize `buzz_reply_call_seen`, drop `has`/`is_hook`, ignore the flag, drop the `__`, drop `reactions add`, read serialized args, move detection before truncation. `tests/bin/fake_mcp.rs` gains `FAKE_MCP_SHELL_TOOL=1`: it previously exposed no tool with a bare name of `shell`, so the satisfied-guard path was untestable. Full `cargo test -p buzz-agent` green at 9e0ae1f04; clippy `-D warnings` and `cargo fmt --check` clean. **Unrelated flake found:** `cancelled_turn_with_usage_emits_notification_before_response` (`tests/fake_llm.rs`) is timing-sensitive. Under 10 loaded cores it fails **2/20 on this branch and 1/20 at unmodified `origin/main@02be413b8`** — pre-existing, not caused by this change (which is inert without the env var). Flagging so it isn't misattributed to the next PR that's open when CI hits it. ## Docs `crates/buzz-agent/README.md` is the primary home (env var, recognition contract, limits, budget interaction). `docs/MCP_DRIVEN_HOOKS.md` gets a short cross-reference explaining this is *not* a hook — otherwise readers hunt for a `_ReplyGuard` tool that doesn't exist. --------- Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta Co-authored-by: Dawn (sprout agent) Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta --- crates/buzz-agent/README.md | 61 +++ crates/buzz-agent/src/agent.rs | 182 ++++++- crates/buzz-agent/src/config.rs | 12 + crates/buzz-agent/src/llm.rs | 1 + crates/buzz-agent/tests/bin/fake_mcp.rs | 26 +- crates/buzz-agent/tests/regressions.rs | 462 ++++++++++++++++++ .../src/managed_agents/relay_mesh.rs | 89 +++- docs/MCP_DRIVEN_HOOKS.md | 17 + 8 files changed, 847 insertions(+), 3 deletions(-) diff --git a/crates/buzz-agent/README.md b/crates/buzz-agent/README.md index f138e4a4f1..5d942777d5 100644 --- a/crates/buzz-agent/README.md +++ b/crates/buzz-agent/README.md @@ -163,6 +163,67 @@ Everything is environment variables. No flags, no config files. (We are a subpro | `BUZZ_AGENT_MAX_LINE_BYTES` | `4194304` | 4 MiB. Hard cap on inbound JSON-RPC frames. | | `BUZZ_AGENT_MAX_HISTORY_BYTES` | `1048576` | 1 MiB. Old turns are evicted past this. | | `BUZZ_AGENT_MAX_TOOL_RESULT_TEXT_BYTES` | `51200` | 50 KiB. Per-result cap on tool-output text; oversize is middle-elided (head + tail kept) with an inline marker. Images are exempt. | +| `BUZZ_AGENT_REQUIRE_REPLY` | `0` (`1` on mesh) | `1` enables the [reply guard](#reply-guard) — remind the model to publish when a turn is about to end with nothing posted to Buzz. Desktop defaults it to `1` for Buzz shared-compute agents. | + + +## Reply Guard + +Off by default, except on Buzz shared-compute (mesh) agents, where Buzz Desktop +sets `BUZZ_AGENT_REQUIRE_REPLY=1` automatically. With it enabled, a turn that is +about to end without any recognized attempt to post to Buzz gets a reminder that +its assistant text is invisible to humans, and is rerolled. + +This exists because a Buzz agent's reasoning and tool output are not shown to +anyone. A turn that does real work and never posts is a silent failure — the +requester waits on a result that was produced and thrown away. + +Mesh agents get it by default because they run on small local models, which are +the ones most likely to do the work and then end the turn without publishing it. +Setting `BUZZ_AGENT_REQUIRE_REPLY=0` on the agent, persona, or global env opts a +mesh agent back out; the default never overrides an explicit value. + +**Advisory, never a trap.** At most two reminders, then the turn ends whether or +not anything was published. The guard catches accidental omission; it does not +compel speech. The reminder text explicitly licenses silence, because the +built-in system prompt says publishing is optional and silence is often the +correct outcome. + +**Recognition contract.** A turn counts as having replied when it issues a call +that: + +- resolves to a registered, non-hook tool (a hallucinated tool name is rejected + at preflight and never runs, so it must not disarm the guard), +- whose qualified name ends in `__shell` — i.e. the bare tool name is exactly + `shell`, which is `buzz-dev-mcp`'s shell tool and any other server's, and +- whose `command` argument contains `messages send` or `reactions add`. + +`messages send` also covers `messages send-diff`. Reactions count because the +built-in prompt directs agents to react rather than post a bare +acknowledgement, so nagging an agent that reacted would punish documented +behavior. + +Detection is checked **after** the per-turn tool-call cap +(`MAX_TOOL_CALLS_PER_TURN`) is applied: a publish-shaped call that was discarded +never ran. + +**It recognizes an attempt, not a successful publish.** Only the command text is +inspected, never the exit status. A send that fails still satisfies the guard — +which is fine, since a failed send already returns a non-zero exit and error +JSON to the model, louder feedback than a reminder. + +**Known limits**, both deliberate. A command assembled at runtime (`$CMD`) or +buried in a wrapper script is missed, so that turn is reminded despite having +posted. Text that merely quotes a send (`echo "buzz messages send"`) matches, so +that turn is not reminded. Missing a real post is the expensive direction, and +substring matching is the forgiving one there. Neither edge is pinned by a test; +the matcher is free to improve. + +**Budget.** Reminders ride the existing `_Stop` gate and share +`BUZZ_AGENT_STOP_MAX_REJECTIONS` — the outer cap on every end-turn objection. +At the default 3 both reminders fit; at 1 only one does; at 0 the guard is off +along with the hooks. A round carrying both a `_Stop` hook objection and a +reminder costs one rejection and delivers both texts. This is not a new +lifecycle hook — see [MCP_DRIVEN_HOOKS.md](../../docs/MCP_DRIVEN_HOOKS.md). ## Providers diff --git a/crates/buzz-agent/src/agent.rs b/crates/buzz-agent/src/agent.rs index 48d4ea3b02..8e14fee195 100644 --- a/crates/buzz-agent/src/agent.rs +++ b/crates/buzz-agent/src/agent.rs @@ -21,6 +21,80 @@ use crate::wire::{self, WireSender}; const ERROR_REFLECTION_SUFFIX: &str = "\n\n[Reflect] Before retrying, identify the cause and change your approach."; +/// Maximum reply reminders emitted per prompt when `require_reply` is on. +/// +/// After this many, the turn is allowed to end whether or not anything was +/// published: the guard exists to catch accidental omission, not to compel +/// speech. The shared `stop_max_rejections` budget can cut this lower — see +/// [`Config::require_reply`](crate::config::Config::require_reply). +const MAX_REPLY_NAGS: u32 = 2; + +/// Server label on the synthetic reply-guard objection. +/// +/// Not a real MCP server. It rides the same tool-result path as `_Stop` hook +/// output, so the model sees `{hook, server, text}` attribution naming the +/// in-process guard rather than an MCP server that could be impersonated. +const REPLY_GUARD_SERVER: &str = "buzz-agent"; + +/// Reminder text emitted when a turn is about to end with nothing published. +/// +/// Explicitly licenses silence. The base prompt tells agents that publishing is +/// optional and "silence is usually correct"; a reminder that argued otherwise +/// would fight that instruction and make agents chattier. +const REPLY_GUARD_NAG: &str = "You are about to end this turn without calling `buzz messages send`. \ +Your assistant text and reasoning are never shown to anyone — if you did work, found an answer, \ +or hit a blocker that someone is waiting on, it exists only if you publish it. \ +If you already posted, or if silence is genuinely correct for this turn, ignore this and end your turn."; + +/// Whether `call` is a recognized attempt to publish a reply to Buzz. +/// +/// Recognizes an *attempt*, not a successful publish: the command text is +/// inspected, never the exit status. That is deliberate — a send that fails +/// already returns a non-zero exit and error JSON to the model, which is louder +/// feedback than the reminder this gates. +/// +/// `has` + `!is_hook` are the same checks the dispatcher uses to accept a call +/// (see `execute_calls`), so a hallucinated `fake__shell` — rejected at preflight +/// and never executed — cannot disarm the guard. They must stay *before* +/// [`is_reply_shaped`]: together with them, and only with them, the `__shell` +/// suffix is exactly equivalent to "the bare tool name is `shell`". +fn is_buzz_reply_call(call: &ToolCall, mcp: &McpRegistry) -> bool { + mcp.has(&call.name) && !mcp.is_hook(&call.name) && is_reply_shaped(&call.name, &call.arguments) +} + +/// Whether a tool name and arguments have the shape of a Buzz publish command. +/// +/// Split from [`is_buzz_reply_call`] only so the matcher is testable without a +/// live [`McpRegistry`]; callers must apply the registry checks first. +/// +/// On the name: `ends_with("__shell")` is exact rather than approximate *given* +/// those checks. Registration rejects `__` in both server names and bare tool +/// names, and qualified names are `{server}__{bare}`, so a trailing `__shell` can +/// only straddle the separator if the bare name starts with `_` — which `is_hook` +/// already excludes. Dropping the separator would not be exact: `powershell` and +/// `noshell` both end in `shell`. +/// +/// On the command: a deliberately coarse substring test, scoped to the structured +/// `command` field so unrelated metadata — a `description` that quotes a send — +/// cannot suppress the guard, and a non-string `command` is rejected rather than +/// coerced. Known limits, both accepted: a command assembled at runtime (`$CMD`) +/// or hidden in a wrapper script is missed, and text that merely quotes a send +/// (`echo "buzz messages send"`) matches. Missing a real post is the expensive +/// direction, and substring matching is the more forgiving one there. +fn is_reply_shaped(name: &str, arguments: &serde_json::Value) -> bool { + name.ends_with("__shell") + && arguments + .get("command") + .and_then(|v| v.as_str()) + .is_some_and(|cmd| { + // `messages send` also covers `messages send-diff`. `reactions + // add` counts because the base prompt directs agents to react + // rather than post a bare acknowledgement, so nagging an agent + // that reacted would punish documented-correct behavior. + cmd.contains("messages send") || cmd.contains("reactions add") + }) +} + pub struct RunCtx<'a> { pub cfg: &'a Config, /// Effective model for this session. Usually equals `cfg.model`; overridden @@ -102,6 +176,14 @@ impl RunCtx<'_> { // session) so a stubborn exchange can't permanently disable the stop // guard for a long-lived session; `max_rounds` still caps the loop. let mut stop_rejections = 0u32; + // Reply-guard state for this prompt. `prompt()` *is* the turn, so + // locals here are per-turn by construction — same shape as + // `stop_rejections` above. + // + // Named for what it proves: a *recognized attempt* to publish, not a + // successful publish. See `is_buzz_reply_call`. + let mut buzz_reply_call_seen = false; + let mut reply_nags = 0u32; loop { if self.cfg.max_rounds > 0 && round >= self.cfg.max_rounds { return Ok(StopReason::MaxTurnRequests); @@ -264,7 +346,7 @@ impl RunCtx<'_> { if stop_rejections >= self.cfg.stop_max_rejections { return Ok(stop); } - let objections = self + let mut objections = self .mcp .call_hooks( "_Stop", @@ -273,6 +355,17 @@ impl RunCtx<'_> { &self.cfg.hook_servers, ) .await; + // Reply guard shares this gate and this budget, so a round + // carrying both a hook objection and a reply reminder costs + // one rejection and delivers both texts. + if self.cfg.require_reply + && !buzz_reply_call_seen + && reply_nags < MAX_REPLY_NAGS + { + reply_nags += 1; + objections + .push((REPLY_GUARD_SERVER.to_string(), REPLY_GUARD_NAG.to_string())); + } if !objections.is_empty() { stop_rejections = stop_rejections.saturating_add(1); push_hook_outputs_as_tool_results(self.history, "_Stop", &objections); @@ -290,6 +383,11 @@ impl RunCtx<'_> { ); calls.truncate(MAX_TOOL_CALLS_PER_TURN); } + // Deliberately after truncation: a publish-shaped call that was + // discarded never runs, so it must not suppress the reminder. + if self.cfg.require_reply && !buzz_reply_call_seen { + buzz_reply_call_seen = calls.iter().any(|c| is_buzz_reply_call(c, self.mcp)); + } self.history.push(HistoryItem::Assistant { text: response.text, tool_calls: calls.clone(), @@ -799,6 +897,88 @@ mod tests { use super::*; use serde_json::json; + /// The shapes the guard must recognize as a publish attempt. Callers apply + /// the registry checks first; these cover the name suffix and command text. + #[test] + fn reply_shape_matches_documented_send_forms() { + for cmd in [ + "buzz messages send --channel X --content Y", + "buzz --relay wss://r messages send --channel X --content Y", + "/abs/path/buzz messages send", + "printf 'hi' | buzz messages send --content -", + "buzz messages send-diff --diff -", + "buzz reactions add --event E --emoji +", + // Assembled through another shell: rev 3's tokenizer missed this. + r#"sh -c "buzz messages send --channel X""#, + ] { + assert!( + is_reply_shaped("dev__shell", &json!({ "command": cmd })), + "expected {cmd:?} to count as a publish attempt" + ); + } + } + + /// Commands that do real work but do not reply in the originating + /// conversation must still be nagged. + #[test] + fn reply_shape_rejects_non_reply_commands() { + for cmd in [ + "buzz messages get --channel X", + "buzz channels list", + "buzz reactions remove --event E", + "buzz pr open --title T", + "buzz social publish --content hi", + "buzz notes set --name n", + "cargo test -p buzz-agent", + ] { + assert!( + !is_reply_shaped("dev__shell", &json!({ "command": cmd })), + "expected {cmd:?} not to count as a publish attempt" + ); + } + } + + /// The `__` separator is load-bearing: `ends_with("shell")` alone would + /// accept any registered tool whose name merely ends in those letters, and + /// `has()` proves registration, not the bare name. + #[test] + fn reply_shape_requires_the_qname_separator() { + let args = json!({ "command": "buzz messages send --channel X" }); + for name in [ + "dev__powershell", + "dev__noshell", + "shell", + "dev__send_message", + ] { + assert!( + !is_reply_shaped(name, &args), + "{name} must not satisfy the shell-tool check" + ); + } + assert!(is_reply_shaped("dev__shell", &args)); + assert!(is_reply_shaped("buzz-dev-mcp__shell", &args)); + } + + /// Only the field that carries the executable command counts. Searching + /// serialized arguments instead would let arbitrary metadata disarm the + /// guard, turning a description into an attempted send. + #[test] + fn reply_shape_reads_only_the_command_field() { + assert!(!is_reply_shaped( + "dev__shell", + &json!({ "description": "buzz messages send --channel X" }) + )); + assert!(!is_reply_shaped( + "dev__shell", + &json!({ "workdir": "buzz messages send" }) + )); + // Malformed `command` is rejected, not coerced — and must not panic. + assert!(!is_reply_shaped("dev__shell", &json!({ "command": 42 }))); + assert!(!is_reply_shaped("dev__shell", &json!({ "command": null }))); + assert!(!is_reply_shaped("dev__shell", &json!({}))); + assert!(!is_reply_shaped("dev__shell", &json!("not an object"))); + } + /// A9 regression: `reasoning_details` contributes real bytes to /// `estimated_bytes` (see `types.rs::HistoryItem::size_with`), so a /// history item carrying a large opaque reasoning array must actually diff --git a/crates/buzz-agent/src/config.rs b/crates/buzz-agent/src/config.rs index a0e64f1a9d..afbda5379d 100644 --- a/crates/buzz-agent/src/config.rs +++ b/crates/buzz-agent/src/config.rs @@ -720,6 +720,16 @@ pub struct Config { /// Maximum `_Stop` rejections per prompt. Default 3. Set to 0 to /// disable `_Stop` hooks entirely (agent always honors end_turn). pub stop_max_rejections: u32, + /// Remind the model to publish when a turn is about to end without any + /// recognized attempt to post to Buzz. Default off; opt in per agent with + /// `BUZZ_AGENT_REQUIRE_REPLY=1`. + /// + /// Advisory only: at most `MAX_REPLY_NAGS` reminders (see `agent.rs`), + /// then the turn ends regardless. Bounded by the same + /// `stop_max_rejections` budget as `_Stop` hooks, which is the outer cap on + /// all end-turn objections — at the default 3 both reminders fit; at 1 only + /// one does; at 0 the guard is off with the hooks. + pub require_reply: bool, /// Hook server allowlist. See [`HookServers`] for variant semantics. /// Default (env unset/empty) is `None` — hooks are off unless the /// operator explicitly opts in. @@ -851,6 +861,7 @@ impl Config { max_parallel_tools: parse_env("BUZZ_AGENT_MAX_PARALLEL_TOOLS", 8usize)?, hook_timeout: Duration::from_millis(parse_env("BUZZ_AGENT_HOOK_TIMEOUT_MS", 2500u64)?), stop_max_rejections: parse_env("BUZZ_AGENT_STOP_MAX_REJECTIONS", 3u32)?, + require_reply: parse_env("BUZZ_AGENT_REQUIRE_REPLY", 0u8)? != 0, hook_servers: parse_hook_servers_env("MCP_HOOK_SERVERS"), hints_enabled: parse_env("BUZZ_AGENT_NO_HINTS", 0u8)? == 0, thinking_effort: parse_thinking_effort(env("BUZZ_AGENT_THINKING_EFFORT").as_deref())?, @@ -893,6 +904,7 @@ impl Config { max_parallel_tools: 1, hook_timeout: Duration::from_secs(1), stop_max_rejections: 0, + require_reply: false, hook_servers: HookServers::None, hints_enabled: false, thinking_effort: None, diff --git a/crates/buzz-agent/src/llm.rs b/crates/buzz-agent/src/llm.rs index f595a165e5..73c7e1faf2 100644 --- a/crates/buzz-agent/src/llm.rs +++ b/crates/buzz-agent/src/llm.rs @@ -2355,6 +2355,7 @@ mod tests { max_parallel_tools: 1, hook_timeout: Duration::from_secs(1), stop_max_rejections: 0, + require_reply: false, hook_servers: HookServers::None, api_key: "key".into(), model: "model".into(), diff --git a/crates/buzz-agent/tests/bin/fake_mcp.rs b/crates/buzz-agent/tests/bin/fake_mcp.rs index 0bbd1d3478..5b660da48c 100644 --- a/crates/buzz-agent/tests/bin/fake_mcp.rs +++ b/crates/buzz-agent/tests/bin/fake_mcp.rs @@ -33,6 +33,11 @@ //! — expose a `_PostCompact` hook tool //! FAKE_MCP_POSTCOMPACT_TEXT=text //! — `_PostCompact` returns this (default: "") +//! FAKE_MCP_SHELL_TOOL=1 — expose a tool whose bare name is `shell` +//! (registered as `__shell`), taking a +//! `command` string. Lets a test drive the +//! reply guard's recognition of a real, +//! registered shell tool. use std::io::{BufRead, Write}; @@ -76,6 +81,7 @@ fn make_tools( desc: &str, include_stop_hook: bool, include_post_compact_hook: bool, + include_shell_tool: bool, ) -> Vec { let mut tools: Vec = (0..count) .map(|i| { @@ -100,6 +106,17 @@ fn make_tools( "inputSchema": { "type": "object", "properties": {} }, })); } + if include_shell_tool { + tools.push(json!({ + "name": "shell", + "description": "run a shell command", + "inputSchema": { + "type": "object", + "properties": { "command": { "type": "string" } }, + "required": ["command"], + }, + })); + } tools } @@ -136,6 +153,7 @@ fn main() { let stop_count_limit: usize = env_usize("FAKE_MCP_STOP_COUNT", usize::MAX); let mut stop_calls_seen: usize = 0; let post_compact_hook = env_flag("FAKE_MCP_POSTCOMPACT_HOOK"); + let shell_tool = env_flag("FAKE_MCP_SHELL_TOOL"); let post_compact_text = std::env::var("FAKE_MCP_POSTCOMPACT_TEXT").unwrap_or_default(); // Use a channel-based stdin reader so notifications (which carry no id) @@ -206,7 +224,13 @@ fn main() { write_response( id, json!({ - "tools": make_tools(tool_count, &desc, stop_hook, post_compact_hook) + "tools": make_tools( + tool_count, + &desc, + stop_hook, + post_compact_hook, + shell_tool, + ) }), ); } diff --git a/crates/buzz-agent/tests/regressions.rs b/crates/buzz-agent/tests/regressions.rs index 2e0b579c84..abb4f7b311 100644 --- a/crates/buzz-agent/tests/regressions.rs +++ b/crates/buzz-agent/tests/regressions.rs @@ -1819,3 +1819,465 @@ async fn cancel_sends_notifications_cancelled_to_any_mcp_server() { let _ = std::fs::remove_file(&call_received_marker); h.shutdown().await; } + +// --------------------------------------------------------------------------- +// Reply guard (`BUZZ_AGENT_REQUIRE_REPLY`) +// +// The guard reminds the model to publish when a turn is about to end without +// any recognized attempt to post to Buzz. It rides the existing `_Stop` gate +// and shares its rejection budget, so most of these tests count LLM calls: +// each reminder costs exactly one extra round. +// --------------------------------------------------------------------------- + +/// Number of reply-guard reminders present in one captured LLM request. +/// +/// A reminder is a tool-role message whose JSON body is attributed to the +/// in-process guard (`server: "buzz-agent"`) at the `_Stop` hook point — the +/// same lower-trust shape as real hook output. +fn reply_nag_count(request: &Value) -> usize { + request["messages"] + .as_array() + .map(|msgs| { + msgs.iter() + .filter(|m| { + m["role"] == "tool" + && serde_json::from_str::(m["content"].as_str().unwrap_or("")) + .map(|p| p["hook"] == "_Stop" && p["server"] == "buzz-agent") + .unwrap_or(false) + }) + .count() + }) + .unwrap_or(0) +} + +/// A publish-shaped call to a real registered shell tool. +fn openai_shell_send(id: &str) -> Value { + openai_tool_call( + id, + "fake__shell", + json!({ "command": "buzz messages send --channel c --content hi" }), + ) +} + +/// Run one prompt to completion, answering any permission requests, and +/// return the final response. +async fn prompt_to_completion(h: &mut Harness, sid: &str) -> Value { + let p = h + .send( + "session/prompt", + json!({"sessionId": sid, "prompt": [{"type":"text","text":"go"}]}), + ) + .await; + loop { + let v = h.recv().await; + if v.get("method") == Some(&json!("session/request_permission")) { + let id = v["id"].clone(); + h.write(json!({ + "jsonrpc": "2.0", + "id": id, + "result": { "outcome": { "outcome": "selected", "optionId": "allow" } }, + })) + .await; + continue; + } + if v["id"] == json!(p) { + return v; + } + } +} + +/// Default off: a silent turn ends on the first end_turn with no extra round. +/// This is the invariant that keeps the feature free for everyone who hasn't +/// opted in. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_off_by_default() { + let llm = spawn_capturing_llm(vec![openai_text("done"), openai_text("unexpected")]).await; + let mut h = Harness::spawn(&llm.url).await; + let sid = init_session(&mut h, json!([])).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 1, + "guard must be inert when unset, got {} LLM calls", + captured.len() + ); + h.shutdown().await; +} + +/// `BUZZ_AGENT_REQUIRE_REPLY=0` is off too — the toggle is numeric, so a +/// literal `0` must not read as "set, therefore on". +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_explicit_zero_is_off() { + let llm = spawn_capturing_llm(vec![openai_text("done"), openai_text("unexpected")]).await; + let mut h = Harness::spawn_with_env(&llm.url, &[("BUZZ_AGENT_REQUIRE_REPLY", "0")]).await; + let sid = init_session(&mut h, json!([])).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 1, + "REQUIRE_REPLY=0 must behave as off, got {} LLM calls", + captured.len() + ); + h.shutdown().await; +} + +/// Opted in and silent: exactly two reminders, then the turn is allowed to +/// end. The guard is advisory — it must never trap a turn. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_nags_twice_then_lets_the_turn_end() { + // Budget defaults to 3, so the cap that stops the loop here is + // MAX_REPLY_NAGS = 2, not the rejection budget. + let llm = spawn_capturing_llm(vec![ + openai_text("silent-1"), + openai_text("silent-2"), + openai_text("silent-3"), + openai_text("must-not-be-requested"), + ]) + .await; + let mut h = Harness::spawn_with_env(&llm.url, &[("BUZZ_AGENT_REQUIRE_REPLY", "1")]).await; + let sid = init_session(&mut h, json!([])).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 3, + "expected 2 reminders then end_turn (3 LLM calls), got {}", + captured.len() + ); + assert_eq!( + reply_nag_count(&captured[0]), + 0, + "reminder before any end_turn" + ); + assert_eq!(reply_nag_count(&captured[1]), 1); + assert_eq!(reply_nag_count(&captured[2]), 2); + + // The reminder must name the command it wants and license silence, so it + // cannot fight the base prompt's "silence is usually correct". + let msgs = captured[2]["messages"].as_array().unwrap(); + let nag = msgs + .iter() + .filter_map(|m| serde_json::from_str::(m["content"].as_str().unwrap_or("")).ok()) + .find(|p| p["server"] == "buzz-agent") + .expect("reminder body"); + let text = nag["text"].as_str().unwrap_or(""); + assert!( + text.contains("buzz messages send"), + "reminder should name the command: {text}" + ); + assert!( + text.contains("silence is genuinely correct"), + "reminder must license silence: {text}" + ); + h.shutdown().await; +} + +/// A real publish attempt through a registered shell tool satisfies the guard: +/// no reminder, no extra round. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_satisfied_by_registered_shell_send() { + let llm = spawn_capturing_llm(vec![ + openai_shell_send("tc1"), + openai_text("posted"), + openai_text("must-not-be-requested"), + ]) + .await; + let mut h = Harness::spawn_with_env(&llm.url, &[("BUZZ_AGENT_REQUIRE_REPLY", "1")]).await; + let sid = init_session_with_fake_mcp( + &mut h, + &[("FAKE_MCP_TOOL_COUNT", "1"), ("FAKE_MCP_SHELL_TOOL", "1")], + ) + .await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 2, + "a recognized send must not be nagged, got {} LLM calls", + captured.len() + ); + assert_eq!(reply_nag_count(&captured[1]), 0); + h.shutdown().await; +} + +/// A publish-shaped call to a shell tool that is *not registered* never runs — +/// preflight rejects it — so it must not disarm the guard. This is what the +/// `has`/`is_hook` checks in the predicate buy. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_ignores_unregistered_shell_tool() { + // FAKE_MCP_SHELL_TOOL is absent, so `fake__shell` is a hallucination. + let llm = spawn_capturing_llm(vec![ + openai_shell_send("tc1"), + openai_text("silent-1"), + openai_text("silent-2"), + ]) + .await; + let mut h = Harness::spawn_with_env( + &llm.url, + &[ + ("BUZZ_AGENT_REQUIRE_REPLY", "1"), + ("BUZZ_AGENT_STOP_MAX_REJECTIONS", "1"), + ], + ) + .await; + let sid = init_session_with_fake_mcp(&mut h, &[("FAKE_MCP_TOOL_COUNT", "1")]).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 3, + "expected the hallucinated call to still be nagged, got {} LLM calls", + captured.len() + ); + let msgs = captured[1]["messages"].as_array().unwrap(); + assert!( + msgs.iter() + .any(|m| m["role"] == "tool" + && m["content"].as_str().unwrap_or("").contains("unknown tool")), + "expected preflight to reject the call: {msgs:?}" + ); + assert_eq!(reply_nag_count(&captured[2]), 1); + h.shutdown().await; +} + +/// A publish-shaped call discarded by the per-turn tool-call cap never runs, +/// so it must not suppress the reminder either. Pins the check's placement +/// after `calls.truncate(MAX_TOOL_CALLS_PER_TURN)`. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_ignores_calls_lost_to_the_turn_cap() { + // 64 filler calls (the cap) followed by the publish attempt, which is + // therefore truncated away. The shell tool *is* registered here, so only + // the placement — not tool identity — can explain the reminder. + let mut calls: Vec = (0..64) + .map(|i| { + json!({ + "id": format!("c{i}"), + "type": "function", + "function": { "name": "fake__tool_0", "arguments": "{}" }, + }) + }) + .collect(); + calls.push(json!({ + "id": "c-send", + "type": "function", + "function": { + "name": "fake__shell", + "arguments": json!({ "command": "buzz messages send --channel c --content hi" }) + .to_string(), + }, + })); + let truncated_send = json!({ + "id": "cc-trunc", "object": "chat.completion", "model": "fake-model", + "choices": [{ + "index": 0, + "message": { "role": "assistant", "content": null, "tool_calls": calls }, + "finish_reason": "tool_calls", + }], + }); + let llm = spawn_capturing_llm(vec![ + truncated_send, + openai_text("silent-1"), + openai_text("silent-2"), + ]) + .await; + let mut h = Harness::spawn_with_env( + &llm.url, + &[ + ("BUZZ_AGENT_REQUIRE_REPLY", "1"), + ("BUZZ_AGENT_STOP_MAX_REJECTIONS", "1"), + ], + ) + .await; + let sid = init_session_with_fake_mcp( + &mut h, + &[("FAKE_MCP_TOOL_COUNT", "1"), ("FAKE_MCP_SHELL_TOOL", "1")], + ) + .await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 3, + "a truncated send must still be nagged, got {} LLM calls", + captured.len() + ); + assert_eq!(reply_nag_count(&captured[2]), 1); + h.shutdown().await; +} + +/// The shared `_Stop` rejection budget is the outer cap: at 1 the guard gets +/// one reminder instead of two. Documented degradation, not a bug. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_bounded_by_stop_rejection_budget() { + let llm = spawn_capturing_llm(vec![ + openai_text("silent-1"), + openai_text("silent-2"), + openai_text("must-not-be-requested"), + ]) + .await; + let mut h = Harness::spawn_with_env( + &llm.url, + &[ + ("BUZZ_AGENT_REQUIRE_REPLY", "1"), + ("BUZZ_AGENT_STOP_MAX_REJECTIONS", "1"), + ], + ) + .await; + let sid = init_session(&mut h, json!([])).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 2, + "budget 1 must allow exactly one reminder, got {} LLM calls", + captured.len() + ); + assert_eq!(reply_nag_count(&captured[1]), 1); + h.shutdown().await; +} + +/// Budget 0 disables every objection at the gate, including this one. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_off_when_stop_budget_is_zero() { + let llm = spawn_capturing_llm(vec![openai_text("done"), openai_text("unexpected")]).await; + let mut h = Harness::spawn_with_env( + &llm.url, + &[ + ("BUZZ_AGENT_REQUIRE_REPLY", "1"), + ("BUZZ_AGENT_STOP_MAX_REJECTIONS", "0"), + ], + ) + .await; + let sid = init_session(&mut h, json!([])).await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 1, + "budget 0 must disable the guard, got {} LLM calls", + captured.len() + ); + h.shutdown().await; +} + +/// The two axes are independent inside one shared budget: a round carrying +/// both a `_Stop` hook objection and a reminder costs one rejection and +/// delivers both texts, and once the reminders are spent the hook objection +/// continues alone. +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn reply_guard_combines_with_stop_hook_objection() { + // The hook objects on its first 3 calls, then clears. Reminders stop + // after 2, so round 3 must carry the hook text and no new reminder. + let llm = spawn_capturing_llm(vec![ + openai_text("silent-1"), + openai_text("silent-2"), + openai_text("silent-3"), + openai_text("silent-4"), + ]) + .await; + let mut h = Harness::spawn_with_env( + &llm.url, + &[ + ("BUZZ_AGENT_REQUIRE_REPLY", "1"), + ("MCP_HOOK_SERVERS", "fake"), + ("BUZZ_AGENT_STOP_MAX_REJECTIONS", "10"), + ], + ) + .await; + let sid = init_session_with_fake_mcp( + &mut h, + &[ + ("FAKE_MCP_TOOL_COUNT", "1"), + ("FAKE_MCP_STOP_HOOK", "1"), + ("FAKE_MCP_STOP_TEXT", "you have open todos"), + ("FAKE_MCP_STOP_COUNT", "3"), + ], + ) + .await; + + let r = prompt_to_completion(&mut h, &sid).await; + assert_eq!(r["result"]["stopReason"], "end_turn"); + + let captured = llm.captured.lock().await; + assert_eq!( + captured.len(), + 4, + "expected 3 objecting rounds then a clear end, got {}", + captured.len() + ); + + let hook_objections = |req: &Value| -> usize { + req["messages"] + .as_array() + .map(|msgs| { + msgs.iter() + .filter(|m| { + m["content"] + .as_str() + .unwrap_or("") + .contains("you have open todos") + }) + .count() + }) + .unwrap_or(0) + }; + + // Round 2 carries one of each — a single rejection bought both texts. + assert_eq!(reply_nag_count(&captured[1]), 1); + assert_eq!(hook_objections(&captured[1]), 1); + // Round 4: the hook objected three times, the guard only twice. + assert_eq!(reply_nag_count(&captured[3]), 2); + assert_eq!(hook_objections(&captured[3]), 3); + h.shutdown().await; +} + +/// An unparseable toggle is a startup error, not a silent default. `parse_env` +/// is generic over `FromStr`, so this also pins the numeric type: a `bool` +/// field would have rejected the documented `1`. +#[test] +fn reply_guard_rejects_unparseable_toggle() { + let out = std::process::Command::new(env!("CARGO_BIN_EXE_buzz-agent")) + .env("BUZZ_AGENT_PROVIDER", "openai") + .env("OPENAI_COMPAT_API_KEY", "test") + .env("OPENAI_COMPAT_MODEL", "fake-model") + .env("BUZZ_AGENT_REQUIRE_REPLY", "true") + .stdin(Stdio::null()) + .output() + .expect("run buzz-agent"); + assert!( + !out.status.success(), + "expected a config error exit, got {:?}", + out.status + ); + let stderr = String::from_utf8_lossy(&out.stderr); + assert!( + stderr.contains("BUZZ_AGENT_REQUIRE_REPLY"), + "expected the offending key in the error, got: {stderr}" + ); +} diff --git a/desktop/src-tauri/src/managed_agents/relay_mesh.rs b/desktop/src-tauri/src/managed_agents/relay_mesh.rs index 327c106bc8..5c246feedc 100644 --- a/desktop/src-tauri/src/managed_agents/relay_mesh.rs +++ b/desktop/src-tauri/src/managed_agents/relay_mesh.rs @@ -47,6 +47,13 @@ pub fn apply_relay_mesh_env( // may deliberately choose a smaller cap or a different effort. This function // runs after those layers during readiness, so never clobber their values. insert_default_if_unset(env, "BUZZ_AGENT_MAX_OUTPUT_TOKENS", "4096"); + // Mesh agents run on small local models, which are the ones most likely to + // do the work and then end the turn without publishing it — the failure the + // reply guard exists to catch. Everywhere else it stays opt-in and unset. + // A default, not policy: an explicit `0` from the agent/persona/global env + // survives (see `insert_default_if_unset`, and the copy-forward list in + // `relay_mesh_process_env` that preserves it through the spawn path). + insert_default_if_unset(env, "BUZZ_AGENT_REQUIRE_REPLY", "1"); // Deliberately no BUZZ_AGENT_THINKING_EFFORT default: mesh translates // `reasoning_effort` into the chat template's `enable_thinking` flag, so any // value we pick overrides each model's own template default — and the right @@ -80,7 +87,15 @@ pub fn relay_mesh_process_env( model: &str, ) -> std::collections::BTreeMap { let mut env = std::collections::BTreeMap::new(); - for key in ["BUZZ_AGENT_MAX_OUTPUT_TOKENS", "BUZZ_AGENT_THINKING_EFFORT"] { + for key in [ + "BUZZ_AGENT_MAX_OUTPUT_TOKENS", + "BUZZ_AGENT_THINKING_EFFORT", + // Must be copied forward for the user's value to survive: this map is + // written onto the command *after* the layered user env, so a key absent + // here is re-defaulted by `apply_relay_mesh_env` below and an explicit + // `BUZZ_AGENT_REQUIRE_REPLY=0` would be silently overridden back to `1`. + "BUZZ_AGENT_REQUIRE_REPLY", + ] { if let Some(value) = effective_env.get(key) { env.insert(key.to_string(), value.clone()); } @@ -145,6 +160,78 @@ mod tests { ); } + #[test] + fn native_provider_enables_reply_guard_by_default() { + let mut env = BTreeMap::new(); + apply_relay_mesh_env( + &mut env, + Some(RELAY_MESH_PROVIDER_ID), + Some(RELAY_MESH_AUTO_MODEL_ID), + ); + + assert_eq!( + env.get("BUZZ_AGENT_REQUIRE_REPLY").map(String::as_str), + Some("1"), + "mesh agents opt into the reply guard automatically" + ); + } + + #[test] + fn native_provider_preserves_explicit_reply_guard_opt_out() { + let mut env = BTreeMap::from([("BUZZ_AGENT_REQUIRE_REPLY".to_string(), "0".to_string())]); + apply_relay_mesh_env( + &mut env, + Some(RELAY_MESH_PROVIDER_ID), + Some(RELAY_MESH_AUTO_MODEL_ID), + ); + + assert_eq!( + env.get("BUZZ_AGENT_REQUIRE_REPLY").map(String::as_str), + Some("0"), + "an explicit opt-out is a user decision, not a value to re-default" + ); + } + + #[test] + fn non_mesh_provider_leaves_reply_guard_unset() { + let mut env = BTreeMap::new(); + apply_relay_mesh_env(&mut env, Some("anthropic"), Some("claude-haiku-4.5")); + + assert_eq!( + env.get("BUZZ_AGENT_REQUIRE_REPLY"), + None, + "the guard stays opt-in everywhere except mesh" + ); + assert!(env.is_empty(), "non-mesh providers get no mesh env at all"); + } + + /// The spawn path writes this map onto the command *after* the layered user + /// env, so an explicit opt-out only survives if it is copied forward. Without + /// the copy-forward, `apply_relay_mesh_env` re-defaults it to `1` here and + /// silently overrides the user at spawn while readiness still shows `0`. + #[test] + fn process_env_preserves_explicit_reply_guard_opt_out() { + let effective_env = + BTreeMap::from([("BUZZ_AGENT_REQUIRE_REPLY".to_string(), "0".to_string())]); + + let env = relay_mesh_process_env(&effective_env, "Gemma-4"); + + assert_eq!( + env.get("BUZZ_AGENT_REQUIRE_REPLY").map(String::as_str), + Some("0") + ); + } + + #[test] + fn process_env_enables_reply_guard_when_user_is_silent() { + let env = relay_mesh_process_env(&BTreeMap::new(), "Gemma-4"); + + assert_eq!( + env.get("BUZZ_AGENT_REQUIRE_REPLY").map(String::as_str), + Some("1") + ); + } + #[test] fn process_env_seeds_controls_without_restoring_unrelated_credentials() { let effective_env = BTreeMap::from([ diff --git a/docs/MCP_DRIVEN_HOOKS.md b/docs/MCP_DRIVEN_HOOKS.md index e510c378e7..6812a5b9a6 100644 --- a/docs/MCP_DRIVEN_HOOKS.md +++ b/docs/MCP_DRIVEN_HOOKS.md @@ -65,6 +65,23 @@ These constraints ensure a buggy or malicious hook cannot trap the agent. Hooks are **off by default**. The operator must explicitly opt in via `MCP_HOOK_SERVERS`. +### Not a hook: the reply guard + +`buzz-agent` has one in-process objection at the `_Stop` gate that is **not** an +MCP hook and exposes no hook tool: the reply guard +(`BUZZ_AGENT_REQUIRE_REPLY=1`), which reminds the model to publish when a turn is +about to end with nothing posted to Buzz. There is no `_ReplyGuard` tool to +implement and no server to allowlist — the env var and the recognition contract +are documented in +[crates/buzz-agent/README.md](../crates/buzz-agent/README.md#reply-guard). + +It is mentioned here only because it shares this lifecycle point and this +budget: its reminders count against `BUZZ_AGENT_STOP_MAX_REJECTIONS` like any +hook objection, and a round carrying both a hook objection and a reminder costs +one rejection and delivers both texts. Setting the budget to 0 disables both. +That the gate can carry in-process objections alongside hook output is +deliberate; hooks see no difference. + ## Implementing a Hook Any MCP server can expose hooks. Example: a test-runner server that blocks From 4632c55041c5d423d572a6f6411bb7b279c26f67 Mon Sep 17 00:00:00 2001 From: John Matthew Tennant Date: Fri, 31 Jul 2026 07:06:41 -0400 Subject: [PATCH 104/112] feat(desktop): auto-enable huddle transcription for agents (#3180) ## Context Before this change, every huddle initialized with transcription off. Joining or adding an agent did not enable it, so the agent could not receive spoken conversation until a person clicked the transcript control. Starting a huddle from an agent DM could also omit that agent, and adding an agent who already belonged to the parent channel could attempt an unnecessary role change and show a warning. Agent detection uses authoritative huddle membership. A participant counts as an agent when the ephemeral membership identifies it with the `bot` role, or when the existing agent identity model identifies the participant in an agent DM. ## Summary Buzz now enables transcription once when the first authoritative agent is present. After that initial automatic action, explicit user control is authoritative: manual ON or OFF survives membership refreshes, reconnects, and UI remounts. Removing the last agent does not change the current transcription state. Agent-DM huddles enroll the agent automatically. Adding an agent who already belongs to the parent channel preserves the existing parent role and completes without a role-mutation warning. | Scenario | Before | With this change | | --- | --- | --- | | First authoritative agent joins or is hydrated | Transcription stays off | Transcription turns on once | | User explicitly turns transcription on or off | Manual control exists without an agent policy | The explicit choice suppresses later automatic changes | | Last agent leaves | No defined agent-presence behavior | The current transcription state remains unchanged | | Huddle starts from an agent DM | The agent can be omitted | The known agent is enrolled automatically | | Added agent already belongs to the parent channel | Buzz can attempt a role rewrite and warn | Existing parent membership and role are preserved | | Transcription is active | The control is not visually distinct | The control is highlighted and exposes `aria-pressed=true` | ## Changes - Derive agent presence from authoritative bot-role huddle membership and known agent-DM identity. - Apply the one-time auto-enable rule during create, join, membership hydration, reconnect, pipeline startup, and local agent addition. - Preserve explicit user state and use huddle-generation guards so stale asynchronous work cannot alter a replacement huddle. - Keep backend and React transcription state synchronized, with a visible and accessible active control. - Enroll known agent-DM participants and make parent-channel membership updates idempotent. - Cover hydration ordering, reconnects, remounts, explicit OFF, last-agent removal, DM enrollment, existing membership, and active styling. ## Related issue None found. ## Testing Manual validation in `pending-seed` confirmed the product contract: 1. Started a huddle from the owned, running Fizz agent DM. 2. Confirmed the authoritative roster contained the human and Fizz as an agent. 3. Confirmed transcription enabled without clicking the control: `Stop transcript`, `aria-pressed=true`, with the highlighted active background. 4. Turned transcription off and confirmed `Start transcript`, `aria-pressed=false` remained stable. 5. Removed Fizz while transcription was off and confirmed the state stayed off. 6. Left the huddle cleanly. ## Screenshots The same control has distinct active and inactive states. ![Active transcript control](https://raw.githubusercontent.com/block/buzz/2dcb266244e93d358f85e5371d190de77b03c86d/pr-3180--active-transcription.png) ![Inactive transcript control](https://raw.githubusercontent.com/block/buzz/2dcb266244e93d358f85e5371d190de77b03c86d/pr-3180--inactive-transcription.png) ## Reviewer-reproducible examples From a fresh checkout: ```bash pnpm --dir desktop build:e2e pnpm --dir desktop exec playwright test tests/e2e/huddle-transcription.spec.ts --project=smoke pnpm --dir desktop exec playwright test tests/e2e/mentions.spec.ts --project=smoke --grep "system agent profile exposes owned agent actions|system agent avatar exposes owned agent actions|owned bot profile exposes message and huddle actions|owned agent mention profile exposes message and huddle actions" ``` The huddle scenario exercises initial authoritative hydration, exactly one automatic enable, explicit OFF persistence, unchanged state after last-agent removal, newer events winning over delayed hydration, agent-DM enrollment, and idempotent parent membership. It also asserts `aria-pressed` and distinct computed active styling. --------- Signed-off-by: John Tennant Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> --- desktop/playwright.config.ts | 1 + desktop/src-tauri/src/huddle/agents.rs | 66 +++- desktop/src-tauri/src/huddle/mod.rs | 303 +++++++----------- desktop/src-tauri/src/huddle/pipeline.rs | 269 +++++++++++++--- desktop/src-tauri/src/huddle/state.rs | 239 +++++++++++++- desktop/src-tauri/src/huddle/transcription.rs | 27 +- .../channels/ui/ChannelMembersBar.tsx | 47 ++- desktop/src/features/huddle/HuddleContext.tsx | 30 +- .../features/huddle/components/HuddleBar.tsx | 12 +- .../profile/ui/UserProfilePopover.tsx | 18 +- .../src/shared/styles/globals/utilities.css | 9 + desktop/src/testing/e2eBridge.ts | 205 ++++++++++-- .../tests/e2e/huddle-transcription.spec.ts | 254 +++++++++++++++ desktop/tests/e2e/mentions.spec.ts | 38 ++- desktop/tests/helpers/bridge.ts | 21 ++ 15 files changed, 1232 insertions(+), 307 deletions(-) create mode 100644 desktop/tests/e2e/huddle-transcription.spec.ts diff --git a/desktop/playwright.config.ts b/desktop/playwright.config.ts index bba9218a1a..2b885e3e53 100644 --- a/desktop/playwright.config.ts +++ b/desktop/playwright.config.ts @@ -131,6 +131,7 @@ export default defineConfig({ "**/harness-management.spec.ts", "**/harness-catalog-screenshots.spec.ts", "**/inline-custom-harness.spec.ts", + "**/huddle-transcription.spec.ts", ], use: { ...devices["Desktop Chrome"], diff --git a/desktop/src-tauri/src/huddle/agents.rs b/desktop/src-tauri/src/huddle/agents.rs index 02c4045410..2de22f99d8 100644 --- a/desktop/src-tauri/src/huddle/agents.rs +++ b/desktop/src-tauri/src/huddle/agents.rs @@ -2,7 +2,8 @@ //! //! Mental model: //! add_agent_to_huddle → kind:9000 to ephemeral channel -//! → kind:9000 to parent channel (best-effort) +//! → preserve existing parent membership, or +//! kind:9000 to parent channel (best-effort) //! //! ACP spawning is NOT needed here: the running agent process auto-subscribes //! when it receives the kind:9000 membership notification. Huddle-specific @@ -11,7 +12,10 @@ use serde::Serialize; use uuid::Uuid; -use crate::{app_state::AppState, events, relay::submit_event}; +use crate::{ + app_state::AppState, events, huddle::relay_api::fetch_channel_members_with_roles, + relay::submit_event, +}; // ── Constants ───────────────────────────────────────────────────────────────── @@ -61,8 +65,9 @@ with the next one. /// The field exists for forward compatibility with future batch-add operations /// where partial success may be meaningful. /// -/// `parent_added` reflects whether the parent-channel add succeeded; -/// `parent_error` carries the error string when it didn't. +/// `parent_added` reflects whether the parent already contained the agent or +/// the parent-channel add succeeded; `parent_error` carries the error string +/// when neither condition could be confirmed. #[derive(Debug, Serialize)] pub struct AgentAddResult { /// Always `true` — invariant guaranteed by [`add_agent_to_huddle`]. @@ -91,17 +96,33 @@ pub async fn add_agent_to_huddle( let add_eph = events::build_add_member(ephemeral_channel_id, agent_pubkey, Some("bot"))?; submit_event(add_eph, state).await?; - // 2. Add agent to parent channel — so agent has full context. - // Best-effort: capture the error but don't propagate it. - let (parent_added, parent_error) = { + // 2. Preserve any active parent membership, regardless of role. Rewriting + // an existing DM member as `bot` is both unnecessary and forbidden for + // non-admins. Otherwise add the agent so it has full context. + // Best-effort: capture a real error but don't propagate it. + let parent_channel_id_string = parent_channel_id.to_string(); + let parent_already_contains_agent = + fetch_channel_members_with_roles(&parent_channel_id_string, state) + .await + .is_ok_and(|members| contains_member(&members, agent_pubkey)); + + let (parent_added, parent_error) = if parent_already_contains_agent { + (true, None) + } else { let add_parent = events::build_add_member(parent_channel_id, agent_pubkey, Some("bot"))?; match submit_event(add_parent, state).await { Ok(_) => (true, None), Err(e) => { - eprintln!( - "buzz-desktop: add agent to parent channel failed (may already be member): {e}" - ); - (false, Some(e)) + let active_after_error = + fetch_channel_members_with_roles(&parent_channel_id_string, state) + .await + .is_ok_and(|members| contains_member(&members, agent_pubkey)); + if active_after_error { + (true, None) + } else { + eprintln!("buzz-desktop: add agent to parent channel failed: {e}"); + (false, Some(e)) + } } } }; @@ -112,3 +133,26 @@ pub async fn add_agent_to_huddle( parent_error, }) } + +fn contains_member(members: &[(String, Option)], pubkey: &str) -> bool { + members + .iter() + .any(|(member_pubkey, _)| member_pubkey.eq_ignore_ascii_case(pubkey)) +} + +#[cfg(test)] +mod tests { + use super::contains_member; + + #[test] + fn existing_parent_membership_is_preserved_regardless_of_role() { + let members = vec![ + ("agent-member".to_owned(), Some("member".to_owned())), + ("agent-bot".to_owned(), Some("bot".to_owned())), + ]; + + assert!(contains_member(&members, "AGENT-MEMBER")); + assert!(contains_member(&members, "agent-bot")); + assert!(!contains_member(&members, "missing")); + } +} diff --git a/desktop/src-tauri/src/huddle/mod.rs b/desktop/src-tauri/src/huddle/mod.rs index a815bf2d06..0a84cffe00 100644 --- a/desktop/src-tauri/src/huddle/mod.rs +++ b/desktop/src-tauri/src/huddle/mod.rs @@ -66,13 +66,16 @@ pub use transcription::{set_huddle_transcription_enabled, start_stt_pipeline}; // ── Imports ─────────────────────────────────────────────────────────────────── -use std::sync::{atomic::Ordering, Arc}; +use std::sync::atomic::Ordering; use tauri::State; use uuid::Uuid; use crate::{app_state::AppState, events, relay::submit_event}; - -use pipeline::{maybe_start_stt_pipeline, maybe_start_tts_pipeline, post_connect_setup}; +pub use pipeline::check_pipeline_hotstart; +use pipeline::{ + maybe_start_stt_pipeline, maybe_start_tts_pipeline, post_connect_setup, + start_auto_enabled_transcription, PostConnectOutcome, +}; use relay_api::{ count_human_members, fetch_channel_members, parse_channel_uuid, validate_pubkey_hex, MAX_HUDDLE_AGENTS, @@ -186,7 +189,7 @@ pub async fn start_huddle( }; // Transition to Creating. - { + let huddle_generation = { let mut hs = state.huddle()?; if hs.phase != HuddlePhase::Idle { return Err(format!( @@ -194,9 +197,11 @@ pub async fn start_huddle( hs.phase )); } + let generation = hs.begin_huddle_lifetime(); hs.phase = HuddlePhase::Creating; hs.parent_channel_id = Some(parent_channel_id.clone()); - } + generation + }; let ephemeral_uuid = Uuid::new_v4(); let ephemeral_channel_id = ephemeral_uuid.to_string(); @@ -259,27 +264,33 @@ pub async fn start_huddle( match result { Ok(successful_agents) => { // 5. Store active state. - { + let committed = { let mut hs = state.huddle()?; - hs.phase = HuddlePhase::Connected; - hs.is_creator = true; - hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); - // Only store agents that were successfully enrolled. - *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = - successful_agents.clone(); - // Include the current user + successfully enrolled agents as participants. - // Use successful_agents (not member_pubkeys) so failed enrollments - // are not reflected in the participant list. - let own_pubkey = state - .keys - .lock() - .map(|k| k.public_key().to_hex()) - .unwrap_or_default(); - let mut participants = successful_agents.clone(); - if !own_pubkey.is_empty() && !participants.contains(&own_pubkey) { - participants.insert(0, own_pubkey); + if !hs.owns_huddle_lifetime(huddle_generation, HuddlePhase::Creating) { + false + } else { + hs.phase = HuddlePhase::Connected; + hs.is_creator = true; + hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); + *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = + successful_agents.clone(); + hs.maybe_auto_enable_transcription_for_agents(); + let own_pubkey = state + .keys + .lock() + .map(|k| k.public_key().to_hex()) + .unwrap_or_default(); + let mut participants = successful_agents.clone(); + if !own_pubkey.is_empty() && !participants.contains(&own_pubkey) { + participants.insert(0, own_pubkey); + } + hs.participants = participants; + true } - hs.participants = participants; + }; + if !committed { + emit_end_and_archive(&parent_channel_id, &ephemeral_channel_id, &state).await; + return Err("huddle start was superseded".to_owned()); } // 6. Notify frontend of state change. @@ -287,16 +298,30 @@ pub async fn start_huddle( // 7. Hydrate members, download models, start pipelines (incl. audio relay). // Audio relay failure is fatal — no point in a huddle without audio. - if let Err(e) = post_connect_setup(&state, &ephemeral_channel_id).await { - // Rollback: audio relay failed after state was committed. - // Publish the terminal lifecycle event before archiving so - // other clients do not reconstruct a phantom active huddle. - emit_end_and_archive(&parent_channel_id, &ephemeral_channel_id, &state).await; - if let Ok(mut hs) = state.huddle_state.lock() { - hs.reset_preserving_generation(); + match post_connect_setup(&state, &ephemeral_channel_id, huddle_generation).await { + Ok(PostConnectOutcome::Ready) => {} + Ok(PostConnectOutcome::Stale) => { + return Err("huddle start was superseded".to_owned()); + } + Err(e) => { + // Roll back only if this failed setup still owns the active + // huddle. A stale failure must not tear down its replacement. + let still_current = state + .huddle() + .map(|hs| hs.is_current_huddle(&ephemeral_channel_id, huddle_generation)) + .unwrap_or(false); + if still_current { + emit_end_and_archive(&parent_channel_id, &ephemeral_channel_id, &state) + .await; + if let Ok(mut hs) = state.huddle_state.lock() { + if hs.is_current_huddle(&ephemeral_channel_id, huddle_generation) { + hs.reset_preserving_generation(); + } + } + state.emit_huddle_state_changed(); + } + return Err(e); } - state.emit_huddle_state_changed(); - return Err(e); } Ok(HuddleJoinInfo { @@ -314,11 +339,11 @@ pub async fn start_huddle( } } } - // Reset state to Idle so the user can retry. - // Preserve session_generation so in-flight transcription tasks - // from a prior session still see a stale generation and exit. + // Reset only if this failed attempt still owns the Creating state. if let Ok(mut hs) = state.huddle_state.lock() { - hs.reset_preserving_generation(); + if hs.owns_huddle_lifetime(huddle_generation, HuddlePhase::Creating) { + hs.reset_preserving_generation(); + } } Err(e) } @@ -340,7 +365,7 @@ pub async fn join_huddle( state: State<'_, AppState>, ) -> Result { // Transition to Connecting. - { + let huddle_generation = { let mut hs = state.huddle()?; if hs.phase != HuddlePhase::Idle { return Err(format!( @@ -348,10 +373,12 @@ pub async fn join_huddle( hs.phase )); } + let generation = hs.begin_huddle_lifetime(); hs.phase = HuddlePhase::Connecting; hs.parent_channel_id = Some(parent_channel_id.clone()); hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); - } + generation + }; // Seed participant list with own pubkey as a fallback until relay responds. let own_pubkey = state @@ -360,12 +387,20 @@ pub async fn join_huddle( .map(|k| k.public_key().to_hex()) .unwrap_or_default(); - { + let committed = { let mut hs = state.huddle()?; - hs.phase = HuddlePhase::Connected; - if !own_pubkey.is_empty() { - hs.participants = vec![own_pubkey]; + if !hs.owns_huddle_lifetime(huddle_generation, HuddlePhase::Connecting) { + false + } else { + hs.phase = HuddlePhase::Connected; + if !own_pubkey.is_empty() { + hs.participants = vec![own_pubkey]; + } + true } + }; + if !committed { + return Err("huddle join was superseded".to_owned()); } // Notify frontend of state change. @@ -373,15 +408,25 @@ pub async fn join_huddle( // Hydrate members, download models, start pipelines (incl. audio relay). // Audio relay failure is fatal — no point in a huddle without audio. - if let Err(e) = post_connect_setup(&state, &ephemeral_channel_id).await { - // Rollback: audio relay failed after state was committed. - // Reset state to Idle so the user can retry. The ephemeral channel - // has a TTL and will expire — no manual archive needed for joiners. - if let Ok(mut hs) = state.huddle_state.lock() { - hs.reset_preserving_generation(); + match post_connect_setup(&state, &ephemeral_channel_id, huddle_generation).await { + Ok(PostConnectOutcome::Ready) => {} + Ok(PostConnectOutcome::Stale) => { + return Err("huddle join was superseded".to_owned()); + } + Err(e) => { + // Reset only the huddle lifetime that failed. + let mut did_reset = false; + if let Ok(mut hs) = state.huddle_state.lock() { + if hs.is_current_huddle(&ephemeral_channel_id, huddle_generation) { + hs.reset_preserving_generation(); + did_reset = true; + } + } + if did_reset { + state.emit_huddle_state_changed(); + } + return Err(e); } - state.emit_huddle_state_changed(); - return Err(e); } Ok(HuddleJoinInfo { @@ -675,123 +720,6 @@ pub fn push_audio_pcm( } } -/// Hot-start: check if voice models just finished downloading during an active -/// huddle and start the corresponding pipelines. -/// -/// Called by the frontend on a timer or after model status changes. No-op if -/// the huddle is not active or pipelines are already running. -#[tauri::command] -pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), String> { - let (is_active, ephemeral_channel_id) = { - let hs = state.huddle()?; - ( - matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active), - hs.ephemeral_channel_id.clone(), - ) - }; - - if !is_active { - return Ok(()); - } - - // Detect dead pipelines: if the worker thread has exited (init failure or crash), - // clear the pipeline handle so hot-start can retry on the next cycle. - { - let mut hs = state.huddle()?; - if let Some(ref p) = hs.stt_pipeline { - if p.is_finished() { - hs.stt_pipeline = None; - } - } - if let Some(ref p) = hs.tts_pipeline { - if p.is_finished() { - hs.tts_pipeline = None; - } - } - } - // Re-read after potential cleanup. - let (has_stt, has_tts, transcription_enabled) = { - let hs = state.huddle()?; - ( - hs.stt_pipeline.is_some(), - hs.tts_pipeline.is_some(), - hs.transcription_enabled, - ) - }; - - // Check if models just became ready (one-shot flags). - let stt_ready = models::global_model_manager() - .map(|m| m.take_stt_ready()) - .unwrap_or(false); - let tts_ready = models::global_model_manager() - .map(|m| m.take_tts_ready()) - .unwrap_or(false); - - // Start TTS first (so STT can capture tts_cancel). - if !has_tts && (tts_ready || models::is_tts_ready()) { - if let Err(e) = maybe_start_tts_pipeline(&state).await { - eprintln!("buzz-desktop: TTS hotstart failed: {e}"); - } - } - - if transcription_enabled && !has_stt && (stt_ready || models::is_stt_ready()) { - if let Some(eph_id) = &ephemeral_channel_id { - if let Err(e) = maybe_start_stt_pipeline(&state, eph_id).await { - eprintln!("buzz-desktop: STT hotstart failed: {e}"); - } - } - } - - // Periodically refresh agent_pubkeys from relay membership. - // This catches mid-huddle agent additions/removals by other participants, - // keeping STT p-tags authoritative throughout the session. - // Throttled to every 15 s (not on every 5 s hotstart poll). - // - // NOTE: The frontend ALSO polls agent membership independently (every 10 s - // via get_huddle_agent_pubkeys). This is intentional — the two polls have - // different failure semantics: - // - Rust (here): preserves stale list on failure (STT p-tags should not - // disappear on a transient network blip). - // - React (HuddleContext.tsx): clears list on failure (TTS authorization - // must fail-closed — never speak from a stale agent list). - // - // On Ok: always replace (even with empty — agents may have been removed). - // On Err: preserve the existing list (transient failure shouldn't zero it). - if let Some(eph_id) = &ephemeral_channel_id { - let should_refresh = { - let hs = state.huddle()?; - match hs.last_agent_refresh { - None => true, - Some(t) => t.elapsed() >= std::time::Duration::from_secs(15), - } - }; - if should_refresh { - // Fetch agents (for STT p-tags) and all members (for participant list). - // Sequential — tokio::join! requires the `macros` feature. - // Only update the throttle timestamp when at least one fetch succeeds, - // so transient failures retry immediately on the next poll cycle. - // Fetch both lists before acquiring the lock — no lock held across await. - let fresh_agents = fetch_channel_members(eph_id, Some("bot"), &state) - .await - .ok(); - let fresh_members = fetch_channel_members(eph_id, None, &state).await.ok(); - - if fresh_agents.is_some() || fresh_members.is_some() { - let mut hs = state.huddle()?; - if let Some(agents) = fresh_agents { - *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; - } - if let Some(members) = fresh_members { - hs.participants = members; - } - hs.last_agent_refresh = Some(std::time::Instant::now()); - } - } - } - - Ok(()) -} - /// Trigger a background download of voice models (Parakeet STT + Pocket TTS). /// /// Returns immediately — downloads run in tokio background tasks. @@ -924,7 +852,7 @@ pub async fn add_agent_to_huddle( ) -> Result { validate_pubkey_hex(&agent_pubkey)?; - let (eph_id, parent_id) = { + let (eph_id, parent_id, huddle_generation) = { let hs = state.huddle()?; if !matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active) { return Err("no active huddle".to_string()); @@ -948,7 +876,7 @@ pub async fn add_agent_to_huddle( .clone() .ok_or("no ephemeral channel")?; let parent = hs.parent_channel_id.clone().ok_or("no parent channel")?; - (eph, parent) + (eph, parent, hs.huddle_generation) }; let eph_uuid = Uuid::parse_str(&eph_id).map_err(|e| e.to_string())?; @@ -957,29 +885,30 @@ pub async fn add_agent_to_huddle( // Returns Err only if the ephemeral add fails — parent failure is in the result. let result = agents::add_agent_to_huddle(eph_uuid, parent_uuid, &agent_pubkey, &state).await?; - // Ephemeral add succeeded — safe to register for p-tagging. - // Clone the Arc first so we can drop the outer HuddleState lock before - // acquiring the inner pubkeys lock (avoids the E0597 borrow-checker error). - { - let agent_pubkeys_arc = { - let hs = state.huddle()?; - Arc::clone(&hs.agent_pubkeys) - }; - let mut pubkeys = agent_pubkeys_arc.lock().unwrap_or_else(|e| e.into_inner()); + // Ephemeral add succeeded — register it only if this is still the huddle + // that initiated the relay operation. + let transcription_auto_enabled = { + let mut hs = state.huddle()?; + if !hs.is_current_huddle(&eph_id, huddle_generation) { + return Ok(result); + } + let mut pubkeys = hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()); if !pubkeys.contains(&agent_pubkey) { pubkeys.push(agent_pubkey.clone()); } - } + drop(pubkeys); + if !hs.participants.contains(&agent_pubkey) { + hs.participants.push(agent_pubkey.clone()); + } + hs.maybe_auto_enable_transcription_for_agents() + }; // No guidelines re-post needed — the agent sees the original kind:48106 // guidelines via EOSE replay when it subscribes to the ephemeral channel. - - // Also add the agent to the visible participants list. - { - let mut hs = state.huddle()?; - if !hs.participants.contains(&agent_pubkey) { - hs.participants.push(agent_pubkey); - } + if transcription_auto_enabled { + start_auto_enabled_transcription(&state, &eph_id).await; + } else { + state.emit_huddle_state_changed(); } Ok(result) diff --git a/desktop/src-tauri/src/huddle/pipeline.rs b/desktop/src-tauri/src/huddle/pipeline.rs index 6a4cf26201..18b688a971 100644 --- a/desktop/src-tauri/src/huddle/pipeline.rs +++ b/desktop/src-tauri/src/huddle/pipeline.rs @@ -9,6 +9,7 @@ use std::sync::{ }; use nostr::JsonUtil; +use tauri::State; use uuid::Uuid; use crate::app_state::AppState; @@ -20,55 +21,224 @@ use super::state::{HuddlePhase, VoiceInputMode}; use super::stt; use super::tts; +pub(crate) enum PostConnectOutcome { + Ready, + Stale, +} + +/// Hot-start: check if voice models just finished downloading during an active +/// huddle and start the corresponding pipelines. +/// +/// Called by the frontend on a timer or after model status changes. No-op if +/// the huddle is not active or pipelines are already running. +#[tauri::command] +pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), String> { + let (is_active, ephemeral_channel_id, huddle_generation) = { + let hs = state.huddle()?; + ( + matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active), + hs.ephemeral_channel_id.clone(), + hs.huddle_generation, + ) + }; + + if !is_active { + return Ok(()); + } + + // Detect dead pipelines: if the worker thread has exited (init failure or crash), + // clear the pipeline handle so hot-start can retry on the next cycle. + { + let mut hs = state.huddle()?; + if let Some(ref p) = hs.stt_pipeline { + if p.is_finished() { + hs.stt_pipeline = None; + } + } + if let Some(ref p) = hs.tts_pipeline { + if p.is_finished() { + hs.tts_pipeline = None; + } + } + } + // Re-read after potential cleanup. + let (has_stt, has_tts, transcription_enabled) = { + let hs = state.huddle()?; + ( + hs.stt_pipeline.is_some(), + hs.tts_pipeline.is_some(), + hs.transcription_enabled, + ) + }; + + // Check if models just became ready (one-shot flags). + let stt_ready = models::global_model_manager() + .map(|m| m.take_stt_ready()) + .unwrap_or(false); + let tts_ready = models::global_model_manager() + .map(|m| m.take_tts_ready()) + .unwrap_or(false); + + // Start TTS first (so STT can capture tts_cancel). + if !has_tts && (tts_ready || models::is_tts_ready()) { + if let Err(e) = maybe_start_tts_pipeline(&state).await { + eprintln!("buzz-desktop: TTS hotstart failed: {e}"); + } + } + if transcription_enabled && !has_stt && (stt_ready || models::is_stt_ready()) { + if let Some(eph_id) = &ephemeral_channel_id { + if let Err(e) = maybe_start_stt_pipeline(&state, eph_id).await { + eprintln!("buzz-desktop: STT hotstart failed: {e}"); + } + } + } + + // Periodically refresh agent membership from the relay. + // This catches mid-huddle additions/removals by other participants, keeps + // STT p-tags authoritative, and auto-enables transcription when the first + // agent appears unless the user has already chosen a transcription state. + // Throttled independently from the more frequent hotstart poll. + // + // NOTE: The frontend ALSO polls agent membership independently via + // get_huddle_agent_pubkeys. This is intentional — the two polls have + // different failure semantics: + // - Rust (here): preserves stale list on failure (STT p-tags should not + // disappear on a transient network blip). + // - React (HuddleContext.tsx): clears list on failure (TTS authorization + // must fail-closed — never speak from a stale agent list). + // + // On Ok: always replace (even with empty — agents may have been removed). + // On Err: preserve the existing list (transient failure shouldn't zero it). + if let Some(eph_id) = &ephemeral_channel_id { + let should_refresh = { + let hs = state.huddle()?; + match hs.last_agent_refresh { + None => true, + Some(t) => t.elapsed() >= std::time::Duration::from_secs(15), + } + }; + if should_refresh { + // Fetch agents (for STT p-tags) before all members (for participant + // list) so relay membership queries remain ordered. + // Only update the throttle timestamp when at least one fetch succeeds, + // so transient failures retry immediately on the next poll cycle. + // Fetch both lists before acquiring the lock — no lock held across await. + let fresh_agents = fetch_channel_members(eph_id, Some("bot"), &state) + .await + .ok(); + let fresh_members = fetch_channel_members(eph_id, None, &state).await.ok(); + let transcription_auto_enabled = if fresh_agents.is_some() || fresh_members.is_some() { + let mut hs = state.huddle()?; + if !hs.is_current_huddle(eph_id, huddle_generation) { + return Ok(()); + } + if let Some(agents) = fresh_agents { + *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; + } + if let Some(members) = fresh_members { + hs.participants = members; + } + hs.last_agent_refresh = Some(std::time::Instant::now()); + hs.maybe_auto_enable_transcription_for_agents() + } else { + false + }; + if transcription_auto_enabled { + start_auto_enabled_transcription(&state, eph_id).await; + } + } + } + + Ok(()) +} + pub(crate) async fn post_connect_setup( state: &AppState, ephemeral_channel_id: &str, -) -> Result<(), String> { + huddle_generation: u64, +) -> Result { + { + let hs = state.huddle()?; + if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { + return Ok(PostConnectOutcome::Stale); + } + } + // Hydrate agent pubkeys and participants from relay in parallel // (authoritative — overrides local guesses). let (agents_result, all_members_result) = tokio::join!( fetch_channel_members(ephemeral_channel_id, Some("bot"), state), fetch_channel_members(ephemeral_channel_id, None, state), ); - if let Ok(agents) = agents_result { - let hs = state.huddle()?; - *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; - } - - if let Ok(all_members) = all_members_result { - if !all_members.is_empty() { - let mut hs = state.huddle()?; - hs.participants = all_members; + let transcription_auto_enabled = { + let mut hs = state.huddle()?; + if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { + return Ok(PostConnectOutcome::Stale); } + if let Ok(agents) = agents_result { + *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; + } + if let Ok(all_members) = all_members_result { + if !all_members.is_empty() { + hs.participants = all_members; + } + } + hs.maybe_auto_enable_transcription_for_agents() + }; + + if transcription_auto_enabled { + state.emit_huddle_state_changed(); } - // Prepare TTS for agent voice. STT is transcript-specific and starts only - // when transcription is explicitly enabled. + // Prepare voice models. Agent presence may have auto-enabled transcription; + // explicit user choices remain authoritative. if let Some(mgr) = models::global_model_manager() { mgr.start_tts_download(state.http_client.clone()); + if state.huddle()?.transcription_enabled { + mgr.start_stt_download(state.http_client.clone()); + } } // Connect audio relay WebSocket (Opus encode/decode pipeline). // This is the core audio path — failure is fatal for the huddle. let parent_id = { let hs = state.huddle()?; + if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { + return Ok(PostConnectOutcome::Stale); + } hs.parent_channel_id.clone() }; - let (cancel, pcm_tx) = - relay_api::connect_audio_relay(ephemeral_channel_id, parent_id.as_deref(), state).await?; + let audio_result = + relay_api::connect_audio_relay(ephemeral_channel_id, parent_id.as_deref(), state).await; { let mut hs = state.huddle()?; + if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { + if let Ok((cancel, _)) = audio_result { + cancel.cancel(); + } + return Ok(PostConnectOutcome::Stale); + } + let (cancel, pcm_tx) = audio_result?; hs.audio_ws_cancel = Some(cancel); hs.audio_relay_pcm_tx = Some(pcm_tx); } - // Start TTS immediately. STT/transcript posting is opt-in and starts only - // after the user explicitly enables transcription. + // Start TTS immediately, then STT when transcription is enabled either by + // the user or by authoritative agent membership. + if !state + .huddle()? + .is_current_huddle(ephemeral_channel_id, huddle_generation) + { + return Ok(PostConnectOutcome::Stale); + } if let Err(e) = maybe_start_tts_pipeline(state).await { eprintln!("buzz-desktop: TTS pipeline failed to start: {e}"); } + if let Err(e) = maybe_start_stt_pipeline(state, ephemeral_channel_id).await { + eprintln!("buzz-desktop: STT pipeline failed to start: {e}"); + } - Ok(()) + Ok(PostConnectOutcome::Ready) } /// Attempt to start the STT pipeline if models are present. @@ -83,12 +253,16 @@ pub(crate) async fn maybe_start_stt_pipeline( state: &AppState, ephemeral_channel_id: &str, ) -> Result { - { + let huddle_generation = { let hs = state.huddle()?; - if !hs.transcription_enabled { + if !hs.transcription_enabled + || !matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active) + || hs.ephemeral_channel_id.as_deref() != Some(ephemeral_channel_id) + { return Ok(false); } - } + hs.huddle_generation + }; if !models::is_stt_ready() { return Ok(false); // Models not downloaded yet — voice-only mode. @@ -97,21 +271,29 @@ pub(crate) async fn maybe_start_stt_pipeline( let channel_uuid = parse_channel_uuid(ephemeral_channel_id)?; - // Atomically claim the construction slot (mirrors tts_starting pattern). - { - let hs = state.huddle()?; - if hs.stt_starting.swap(true, Ordering::AcqRel) { - return Ok(false); // Another caller is already constructing. - } - } - - // Grab shared flags, agent pubkeys, and session generation from HuddleState. + // Atomically claim construction and grab shared state under one lock. // If replacing an existing pipeline, bump generation first so the old // transcription task's next POST sees a stale generation and exits. // Take the old pipeline OUT of the lock before dropping — Drop joins // the worker thread (~200ms) and must not block under the mutex. - let (tts_active, tts_cancel, agent_pubkeys_arc, session_gen, ptt_active_for_stt, old_stt) = { + let ( + tts_active, + tts_cancel, + agent_pubkeys_arc, + session_gen, + expected_generation, + stt_starting, + ptt_active_for_stt, + old_stt, + ) = { let mut hs = state.huddle()?; + if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { + return Ok(false); + } + if hs.stt_starting.swap(true, Ordering::AcqRel) { + return Ok(false); + } + let stt_starting = Arc::clone(&hs.stt_starting); // Invalidate any existing transcription task before replacing the pipeline. if hs.stt_pipeline.is_some() { hs.session_generation.fetch_add(1, Ordering::Release); @@ -130,6 +312,8 @@ pub(crate) async fn maybe_start_stt_pipeline( Some(Arc::clone(&hs.tts_cancel)), Arc::clone(&hs.agent_pubkeys), Arc::clone(&hs.session_generation), + hs.session_generation.load(Ordering::Acquire), + stt_starting, ptt, old, ) @@ -144,13 +328,11 @@ pub(crate) async fn maybe_start_stt_pipeline( let (pipeline, text_rx) = match constructed { Ok(Ok(p)) => p, Ok(Err(e)) => { - let hs = state.huddle()?; - hs.stt_starting.store(false, Ordering::Release); + stt_starting.store(false, Ordering::Release); return Err(e); } Err(e) => { - let hs = state.huddle()?; - hs.stt_starting.store(false, Ordering::Release); + stt_starting.store(false, Ordering::Release); return Err(format!("spawn_blocking failed: {e}")); } }; @@ -158,10 +340,14 @@ pub(crate) async fn maybe_start_stt_pipeline( { let mut hs = state.huddle()?; - hs.stt_starting.store(false, Ordering::Release); + stt_starting.store(false, Ordering::Release); // Phase check: huddle may have been torn down during construction. if !hs.transcription_enabled - || !matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active) + || !hs.is_current_transcription_generation( + ephemeral_channel_id, + huddle_generation, + expected_generation, + ) { return Ok(false); } @@ -172,6 +358,17 @@ pub(crate) async fn maybe_start_stt_pipeline( Ok(true) } +/// Start STT after agent presence automatically enables transcription. +pub(crate) async fn start_auto_enabled_transcription(state: &AppState, ephemeral_channel_id: &str) { + if let Some(manager) = models::global_model_manager() { + manager.start_stt_download(state.http_client.clone()); + } + if let Err(error) = maybe_start_stt_pipeline(state, ephemeral_channel_id).await { + eprintln!("buzz-desktop: auto-enabled STT failed to start: {error}"); + } + state.emit_huddle_state_changed(); +} + /// Attempt to start the TTS pipeline if TTS models are present and TTS is enabled. /// /// Returns `Ok(true)` if the pipeline was started, `Ok(false)` if preconditions diff --git a/desktop/src-tauri/src/huddle/state.rs b/desktop/src-tauri/src/huddle/state.rs index 876c2d688b..f0a2227ca8 100644 --- a/desktop/src-tauri/src/huddle/state.rs +++ b/desktop/src-tauri/src/huddle/state.rs @@ -5,7 +5,7 @@ use serde::{Deserialize, Serialize}; use std::sync::{ - atomic::{AtomicBool, AtomicU64}, + atomic::{AtomicBool, AtomicU64, Ordering}, Arc, Mutex, }; @@ -80,6 +80,15 @@ pub struct HuddleState { pub tts_enabled: bool, /// Whether STT transcript posting is enabled for this huddle. pub transcription_enabled: bool, + /// Whether the user has explicitly used the transcription control in this + /// huddle. Agent presence may auto-enable transcription only while this is + /// false, so membership refreshes never undo an explicit user choice. + /// + /// This is backend-only session state: keeping it in `HuddleState` makes it + /// survive frontend remounts and audio reconnects, while huddle teardown + /// resets it for the next session. + #[serde(skip)] + pub transcription_user_controlled: bool, /// Shared flag: true while TTS is playing audio. /// Shared with the STT pipeline for barge-in / echo gating. #[serde(skip)] @@ -103,6 +112,10 @@ pub struct HuddleState { /// Used to throttle the refresh in check_pipeline_hotstart to every 15 s. #[serde(skip)] pub last_agent_refresh: Option, + /// Monotonic identity for a local huddle lifetime. Unlike transcript + /// generation, this changes only when a new start/join attempt begins. + #[serde(skip)] + pub huddle_generation: u64, /// Session generation — incremented on every teardown. The transcription /// task captures this at spawn time and checks before each POST. If the /// generation has changed, the task silently drops the transcript. @@ -157,11 +170,13 @@ impl Clone for HuddleState { is_creator: self.is_creator, tts_enabled: self.tts_enabled, transcription_enabled: self.transcription_enabled, + transcription_user_controlled: self.transcription_user_controlled, tts_active: Arc::clone(&self.tts_active), tts_cancel: Arc::clone(&self.tts_cancel), tts_starting: Arc::clone(&self.tts_starting), stt_starting: Arc::clone(&self.stt_starting), last_agent_refresh: self.last_agent_refresh, + huddle_generation: self.huddle_generation, session_generation: Arc::clone(&self.session_generation), voice_input_mode: self.voice_input_mode.clone(), ptt_active: Arc::clone(&self.ptt_active), @@ -184,11 +199,13 @@ impl Default for HuddleState { is_creator: false, tts_enabled: true, transcription_enabled: false, + transcription_user_controlled: false, tts_active: Arc::new(AtomicBool::new(false)), tts_cancel: Arc::new(AtomicBool::new(false)), tts_starting: Arc::new(AtomicBool::new(false)), stt_starting: Arc::new(AtomicBool::new(false)), last_agent_refresh: None, + huddle_generation: 0, session_generation: Arc::new(AtomicU64::new(0)), voice_input_mode: VoiceInputMode::default(), ptt_active: Arc::new(AtomicBool::new(false)), @@ -197,13 +214,233 @@ impl Default for HuddleState { } impl HuddleState { + /// Begin a new local huddle lifetime and return its identity. + pub(crate) fn begin_huddle_lifetime(&mut self) -> u64 { + self.huddle_generation = self.huddle_generation.wrapping_add(1); + self.huddle_generation + } + + pub(crate) fn owns_huddle_lifetime(&self, huddle_generation: u64, phase: HuddlePhase) -> bool { + self.huddle_generation == huddle_generation && self.phase == phase + } + + /// Whether an async result still belongs to the active huddle that + /// initiated it. The channel id is the huddle-session identity; transcript + /// generation changes within the same huddle must not invalidate it. + pub(crate) fn is_current_huddle( + &self, + ephemeral_channel_id: &str, + huddle_generation: u64, + ) -> bool { + matches!(self.phase, HuddlePhase::Connected | HuddlePhase::Active) + && self.ephemeral_channel_id.as_deref() == Some(ephemeral_channel_id) + && self.huddle_generation == huddle_generation + } + + /// Whether an STT construction still belongs to the current transcript + /// generation within the active huddle. + pub(crate) fn is_current_transcription_generation( + &self, + ephemeral_channel_id: &str, + huddle_generation: u64, + session_generation: u64, + ) -> bool { + self.is_current_huddle(ephemeral_channel_id, huddle_generation) + && self.session_generation.load(Ordering::Acquire) == session_generation + } + + /// Invalidate in-flight transcription work and give the next constructor a + /// fresh sentinel that stale constructors cannot clear. + pub(crate) fn invalidate_transcription_pipeline(&mut self) { + self.session_generation.fetch_add(1, Ordering::Release); + self.stt_starting = Arc::new(AtomicBool::new(false)); + } + + /// Record an explicit transcription choice made through the existing user + /// control. Later agent membership refreshes must preserve this choice. + pub(crate) fn set_transcription_enabled_by_user(&mut self, enabled: bool) { + self.transcription_enabled = enabled; + self.transcription_user_controlled = true; + } + + /// Enable transcription when an agent is present and the user has not + /// explicitly chosen a transcription state for this huddle. + /// + /// Returns true only for the transition from disabled to enabled, allowing + /// callers to start models/pipelines and emit state exactly once. Removing + /// the last agent deliberately leaves the current state unchanged. + pub(crate) fn maybe_auto_enable_transcription_for_agents(&mut self) -> bool { + let has_agent = !self + .agent_pubkeys + .lock() + .unwrap_or_else(|e| e.into_inner()) + .is_empty(); + if has_agent && !self.transcription_user_controlled && !self.transcription_enabled { + self.transcription_enabled = true; + return true; + } + false + } + /// Reset to default state while preserving the session generation counter. /// Used by start_huddle rollback, join_huddle rollback, and teardown_huddle /// to invalidate in-flight transcription tasks without losing the generation. pub(crate) fn reset_preserving_generation(&mut self) { let gen = Arc::clone(&self.session_generation); + let huddle_generation = self.huddle_generation; *self = Self::default(); self.session_generation = gen; + self.huddle_generation = huddle_generation; + } +} + +#[cfg(test)] +mod tests { + use std::sync::atomic::Ordering; + + use super::HuddleState; + + fn set_agents(state: &HuddleState, agents: &[&str]) { + *state + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()) = + agents.iter().map(|agent| (*agent).to_owned()).collect(); + } + + #[test] + fn first_agent_auto_enables_transcription_once() { + let mut state = HuddleState::default(); + set_agents(&state, &["agent"]); + + assert!(state.maybe_auto_enable_transcription_for_agents()); + assert!(state.transcription_enabled); + assert!(!state.maybe_auto_enable_transcription_for_agents()); + } + + #[test] + fn explicit_user_disable_is_not_undone_by_agent_presence() { + let mut state = HuddleState::default(); + set_agents(&state, &["agent"]); + assert!(state.maybe_auto_enable_transcription_for_agents()); + + state.set_transcription_enabled_by_user(false); + + assert!(!state.maybe_auto_enable_transcription_for_agents()); + assert!(!state.transcription_enabled); + } + + #[test] + fn last_agent_leaving_preserves_current_transcription_state() { + let mut state = HuddleState::default(); + set_agents(&state, &["agent"]); + assert!(state.maybe_auto_enable_transcription_for_agents()); + + set_agents(&state, &[]); + + assert!(!state.maybe_auto_enable_transcription_for_agents()); + assert!(state.transcription_enabled); + } + + #[test] + fn clone_preserves_user_control_across_frontend_state_reads() { + let mut state = HuddleState::default(); + state.set_transcription_enabled_by_user(false); + + let mut clone = state.clone(); + set_agents(&clone, &["agent"]); + + assert!(clone.transcription_user_controlled); + assert!(!clone.maybe_auto_enable_transcription_for_agents()); + } + + #[test] + fn stale_huddle_identity_is_rejected_after_replacement() { + let mut state = HuddleState { + phase: super::HuddlePhase::Active, + ephemeral_channel_id: Some("huddle-a".to_owned()), + ..HuddleState::default() + }; + let huddle_generation = state.begin_huddle_lifetime(); + let generation = state.session_generation.load(Ordering::Acquire); + assert!(state.is_current_huddle("huddle-a", huddle_generation)); + assert!(state.is_current_transcription_generation( + "huddle-a", + huddle_generation, + generation + )); + + state.session_generation.fetch_add(1, Ordering::Release); + assert!(state.is_current_huddle("huddle-a", huddle_generation)); + assert!(!state.is_current_transcription_generation( + "huddle-a", + huddle_generation, + generation + )); + + state.ephemeral_channel_id = Some("huddle-b".to_owned()); + + assert!(!state.is_current_huddle("huddle-a", huddle_generation)); + } + + #[test] + fn same_channel_rejoin_gets_a_new_huddle_lifetime() { + let mut state = HuddleState { + phase: super::HuddlePhase::Active, + ephemeral_channel_id: Some("huddle".to_owned()), + ..HuddleState::default() + }; + let first_generation = state.begin_huddle_lifetime(); + state.reset_preserving_generation(); + state.phase = super::HuddlePhase::Active; + state.ephemeral_channel_id = Some("huddle".to_owned()); + let second_generation = state.begin_huddle_lifetime(); + + assert_ne!(first_generation, second_generation); + assert!(!state.is_current_huddle("huddle", first_generation)); + assert!(state.is_current_huddle("huddle", second_generation)); + } + + #[test] + fn superseded_create_cannot_commit_or_reset_replacement_lifetime() { + let mut state = HuddleState::default(); + let first_generation = state.begin_huddle_lifetime(); + state.phase = super::HuddlePhase::Creating; + assert!(state.owns_huddle_lifetime(first_generation, super::HuddlePhase::Creating)); + + state.reset_preserving_generation(); + let replacement_generation = state.begin_huddle_lifetime(); + state.phase = super::HuddlePhase::Creating; + + assert!(!state.owns_huddle_lifetime(first_generation, super::HuddlePhase::Creating)); + assert!(state.owns_huddle_lifetime(replacement_generation, super::HuddlePhase::Creating)); + } + + #[test] + fn superseded_join_cannot_commit_replacement_lifetime() { + let mut state = HuddleState::default(); + let first_generation = state.begin_huddle_lifetime(); + state.phase = super::HuddlePhase::Connecting; + + state.reset_preserving_generation(); + let replacement_generation = state.begin_huddle_lifetime(); + state.phase = super::HuddlePhase::Connecting; + + assert!(!state.owns_huddle_lifetime(first_generation, super::HuddlePhase::Connecting)); + assert!(state.owns_huddle_lifetime(replacement_generation, super::HuddlePhase::Connecting)); + } + + #[test] + fn stale_constructor_cannot_clear_replacement_sentinel() { + let mut state = HuddleState::default(); + let stale_sentinel = std::sync::Arc::clone(&state.stt_starting); + stale_sentinel.store(true, Ordering::Release); + + state.invalidate_transcription_pipeline(); + state.stt_starting.store(true, Ordering::Release); + stale_sentinel.store(false, Ordering::Release); + + assert!(state.stt_starting.load(Ordering::Acquire)); } } diff --git a/desktop/src-tauri/src/huddle/transcription.rs b/desktop/src-tauri/src/huddle/transcription.rs index 0d752c1de7..5962f57cf4 100644 --- a/desktop/src-tauri/src/huddle/transcription.rs +++ b/desktop/src-tauri/src/huddle/transcription.rs @@ -1,5 +1,3 @@ -use std::sync::atomic::Ordering; - use tauri::State; use crate::app_state::AppState; @@ -15,10 +13,12 @@ use super::{models, pipeline::maybe_start_stt_pipeline}; pub async fn start_stt_pipeline(state: State<'_, AppState>) -> Result<(), String> { let ephemeral_channel_id = { let mut hs = state.huddle()?; - hs.transcription_enabled = true; - hs.ephemeral_channel_id + let ephemeral_channel_id = hs + .ephemeral_channel_id .clone() - .ok_or("no active huddle — start or join a huddle first")? + .ok_or("no active huddle — start or join a huddle first")?; + hs.set_transcription_enabled_by_user(true); + ephemeral_channel_id }; match maybe_start_stt_pipeline(&state, &ephemeral_channel_id).await { @@ -41,14 +41,17 @@ pub async fn set_huddle_transcription_enabled( ) -> Result<(), String> { let (ephemeral_channel_id, old_stt) = { let mut hs = state.huddle()?; - hs.transcription_enabled = enabled; + let ephemeral_channel_id = hs + .ephemeral_channel_id + .clone() + .ok_or("no active huddle — start or join a huddle first")?; + hs.set_transcription_enabled_by_user(enabled); if enabled { - (hs.ephemeral_channel_id.clone(), None) + (ephemeral_channel_id, None) } else { - hs.session_generation.fetch_add(1, Ordering::Release); - hs.stt_starting.store(false, Ordering::Release); - (hs.ephemeral_channel_id.clone(), hs.stt_pipeline.take()) + hs.invalidate_transcription_pipeline(); + (ephemeral_channel_id, hs.stt_pipeline.take()) } }; @@ -58,12 +61,10 @@ pub async fn set_huddle_transcription_enabled( drop(old_stt); if enabled { - let eph_id = - ephemeral_channel_id.ok_or("no active huddle — start or join a huddle first")?; if let Some(manager) = models::global_model_manager() { manager.start_stt_download(state.http_client.clone()); } - if let Err(e) = maybe_start_stt_pipeline(&state, &eph_id).await { + if let Err(e) = maybe_start_stt_pipeline(&state, &ephemeral_channel_id).await { eprintln!("buzz-desktop: STT transcript start failed: {e}"); } } diff --git a/desktop/src/features/channels/ui/ChannelMembersBar.tsx b/desktop/src/features/channels/ui/ChannelMembersBar.tsx index c87617ce9b..7b9bf2b79f 100644 --- a/desktop/src/features/channels/ui/ChannelMembersBar.tsx +++ b/desktop/src/features/channels/ui/ChannelMembersBar.tsx @@ -11,9 +11,15 @@ import { useManagedAgentsQuery, useRelayAgentsQuery, } from "@/features/agents/hooks"; +import { mergeChannelKnownAgentPubkeys } from "@/features/agents/knownAgentPubkeys"; import { requestOpenCreateAgent } from "@/features/agents/openCreateAgentEvent"; import { useChannelMembersQuery } from "@/features/channels/hooks"; +import { + getDmHuddleMemberPubkeys, + hasOtherDmParticipant, +} from "@/features/channels/lib/dmHuddleMembers"; import { canStartHuddleInChannel } from "@/features/channels/lib/huddleAvailability"; +import { useUsersBatchQuery } from "@/features/profile/hooks"; import type { Channel } from "@/shared/api/types"; import { normalizePubkey } from "@/shared/lib/pubkey"; import { Button } from "@/shared/ui/button"; @@ -64,6 +70,41 @@ export function ChannelMembersBar({ const managedAgentsQuery = useManagedAgentsQuery(); const relayAgentsQuery = useRelayAgentsQuery(); const members = membersQuery.data ?? []; + const dmProfilesQuery = useUsersBatchQuery( + channel.channelType === "dm" ? channel.participantPubkeys : [], + { enabled: channel.channelType === "dm" }, + ); + const huddleAgentPubkeys = React.useMemo(() => { + const pubkeys = new Set( + mergeChannelKnownAgentPubkeys( + membersQuery.data, + managedAgentsQuery.data, + relayAgentsQuery.data, + ), + ); + for (const [pubkey, profile] of Object.entries( + dmProfilesQuery.data?.profiles ?? {}, + )) { + if (profile.isAgent) pubkeys.add(normalizePubkey(pubkey)); + } + return pubkeys; + }, [ + dmProfilesQuery.data?.profiles, + managedAgentsQuery.data, + membersQuery.data, + relayAgentsQuery.data, + ]); + const huddleMemberPubkeys = React.useMemo( + () => getDmHuddleMemberPubkeys(channel, huddleAgentPubkeys, currentPubkey), + [channel, currentPubkey, huddleAgentPubkeys], + ); + const huddleMemberPubkeysPending = + hasOtherDmParticipant(channel, currentPubkey) && + (membersQuery.isPending || + managedAgentsQuery.isPending || + relayAgentsQuery.isPending || + dmProfilesQuery.isPending || + dmProfilesQuery.isPlaceholderData); const memberCount = membersQuery.data?.length ?? channel.memberCount; const providers = React.useMemo( () => @@ -117,7 +158,7 @@ export function ChannelMembersBar({ try { await startHuddle( channel.id, - [], + [...huddleMemberPubkeys], buildHuddleChannelName({ channel, currentPubkey, @@ -133,7 +174,9 @@ export function ChannelMembersBar({ } }} renderMode={variant === "compact" ? "menu-item" : "button"} - startDisabled={!canStartHuddle || isStartingHuddle} + startDisabled={ + !canStartHuddle || isStartingHuddle || huddleMemberPubkeysPending + } /> ); diff --git a/desktop/src/features/huddle/HuddleContext.tsx b/desktop/src/features/huddle/HuddleContext.tsx index 804eb4bc0e..03620838a3 100644 --- a/desktop/src/features/huddle/HuddleContext.tsx +++ b/desktop/src/features/huddle/HuddleContext.tsx @@ -339,6 +339,28 @@ export function HuddleProvider({ children }: { children: React.ReactNode }) { [], ); + /** + * Clean up only this provider's media after its start token is superseded. + * The action that changed the token owns backend teardown; issuing a global + * leave here could terminate a replacement huddle started by a new provider. + */ + const cleanupSupersededStart = React.useCallback( + (worklet: AudioWorkletHandle | null) => { + try { + worklet?.stop(); + } catch { + /* best-effort */ + } + workletRef.current = null; + rustActiveRef.current = false; + setLocalAudioTrack(null); + setMicConnected(false); + setEphemeralChannelId(null); + setActiveSpeakers([]); + }, + [], + ); + /** Shared media setup: get mic, setup AudioWorklet, confirm active. * Used by both startHuddle and joinHuddle after the Rust backend call succeeds. */ const connectAndSetupMedia = React.useCallback( @@ -443,7 +465,7 @@ export function HuddleProvider({ children }: { children: React.ReactNode }) { await connectAndSetupMedia(joinInfo, myToken); } catch (e) { if (e instanceof Error && e.message === "superseded") { - await cleanupFailedStart(workletRef.current, true); + cleanupSupersededStart(workletRef.current); return; } throw e; @@ -466,7 +488,7 @@ export function HuddleProvider({ children }: { children: React.ReactNode }) { busyRef.current = false; } }, - [cleanupFailedStart, connectAndSetupMedia], + [cleanupFailedStart, cleanupSupersededStart, connectAndSetupMedia], ); const joinHuddle = React.useCallback( @@ -489,7 +511,7 @@ export function HuddleProvider({ children }: { children: React.ReactNode }) { await connectAndSetupMedia(joinInfo, myToken); } catch (e) { if (e instanceof Error && e.message === "superseded") { - await cleanupFailedStart(workletRef.current, false); + cleanupSupersededStart(workletRef.current); return; } throw e; @@ -512,7 +534,7 @@ export function HuddleProvider({ children }: { children: React.ReactNode }) { busyRef.current = false; } }, - [cleanupFailedStart, connectAndSetupMedia], + [cleanupFailedStart, cleanupSupersededStart, connectAndSetupMedia], ); useTtsSubscription(ephemeralChannelId, selfPubkeyRef); diff --git a/desktop/src/features/huddle/components/HuddleBar.tsx b/desktop/src/features/huddle/components/HuddleBar.tsx index 35d660e475..758726cf58 100644 --- a/desktop/src/features/huddle/components/HuddleBar.tsx +++ b/desktop/src/features/huddle/components/HuddleBar.tsx @@ -242,7 +242,10 @@ export function HuddleBar({ // Primary: listen for Rust-emitted state change events listen("huddle-state-changed", (event) => { - if (!cancelled) applyIncomingState(event.payload); + if (!cancelled) { + stateGenerationRef.current += 1; + applyIncomingState(event.payload); + } }).then((fn) => { if (cancelled) fn(); else unlisten = fn; @@ -757,14 +760,11 @@ export function HuddleBar({ transcriptionEnabled ? "Stop transcript" : "Start transcript" } aria-pressed={transcriptionEnabled} - className={cn( - "buzz-huddle-control-button h-12 w-12 shrink-0 rounded-md", - transcriptionEnabled && "text-foreground", - )} + className="buzz-huddle-control-button h-12 w-12 shrink-0 rounded-md" onClick={() => void handleToggleTranscript()} size="icon" type="button" - variant={transcriptionEnabled ? "secondary" : "ghost"} + variant="ghost" > diff --git a/desktop/src/features/profile/ui/UserProfilePopover.tsx b/desktop/src/features/profile/ui/UserProfilePopover.tsx index f2739088a6..da51ab1b88 100644 --- a/desktop/src/features/profile/ui/UserProfilePopover.tsx +++ b/desktop/src/features/profile/ui/UserProfilePopover.tsx @@ -260,11 +260,18 @@ export function UserProfilePopover({ const selfProfileQuery = useProfileQuery(open && showProfileActions); const isCurrentUserOwner = ownsAuthorAgent(profile, currentPubkey); const viewerIsOwner = isCurrentUserOwner || isOwner === true; + const showHuddleAction = + showHumanProfileActions || + (showProfileActions && + isBotProfile && + viewerIsOwner && + !isAgentClassificationPending); const showMessageAction = showProfileActions && !isAgentClassificationPending && (!isBotProfile || viewerIsOwner); - const showAnyProfileActions = showHumanProfileActions || showMessageAction; + const showAnyProfileActions = + showHumanProfileActions || showMessageAction || showHuddleAction; const canViewActivity = isBotProfile && viewerIsOwner && canOpenAgentActivity(pubkey); const presenceStatus = presenceQuery.data?.[pubkey.toLowerCase()]; @@ -356,7 +363,7 @@ export function UserProfilePopover({ const handleHuddle = React.useCallback(async () => { if ( !showProfileActions || - !showHumanProfileActions || + !showHuddleAction || pendingAction !== null || isStartingHuddle ) { @@ -369,7 +376,7 @@ export function UserProfilePopover({ try { const dm = await openDmMutation.mutateAsync({ pubkeys: [pubkey] }); await goChannel(dm.id); - await startHuddle(dm.id, []); + await startHuddle(dm.id, isBotProfile ? [pubkey] : []); await queryClient.invalidateQueries({ queryKey: channelsQueryKey }); if (isMountedRef.current) { setOpen(false); @@ -389,7 +396,8 @@ export function UserProfilePopover({ pendingAction, pubkey, queryClient, - showHumanProfileActions, + isBotProfile, + showHuddleAction, showProfileActions, startHuddle, ]); @@ -722,7 +730,7 @@ export function UserProfilePopover({ Message ) : null} - {showHumanProfileActions ? ( + {showHuddleAction ? ( + + + { + if (settings) void savePocketVoice(voiceKey); + }} + value={selectedVoice?.key} + > + {voices.map((voice) => ( + + {voiceOptionLabel(voice, voices)} + + ))} + + + + + + + + + + {error && ( +

+ {error} +

+ )} + + + ); +} diff --git a/desktop/src/features/settings/ui/voiceSettingsLogic.test.mjs b/desktop/src/features/settings/ui/voiceSettingsLogic.test.mjs new file mode 100644 index 0000000000..8ffc918471 --- /dev/null +++ b/desktop/src/features/settings/ui/voiceSettingsLogic.test.mjs @@ -0,0 +1,60 @@ +import assert from "node:assert/strict"; +import test from "node:test"; + +import { + selectedVoiceForBackend, + voiceOptionLabel, + voicesForBackend, +} from "./voiceSettingsLogic.ts"; + +const voice = (key, displayName, fallbackKey = "pocket:mary") => ({ + key, + displayName, + backend: "pocket", + backendName: "Pocket TTS", + availability: "bundled", + fallbackKey, + referenceFile: `${key}.wav`, + provenance: { + source: "bundled", + contentHash: null, + license: null, + sourceUrl: null, + }, +}); + +test("Pocket-only V1 filters the shared registry by backend", () => { + const registry = [ + voice("pocket:mary", "Mary", null), + { ...voice("siri:aaron", "Aaron"), backend: "siri" }, + ]; + assert.deepEqual( + voicesForBackend(registry, "pocket").map((entry) => entry.key), + ["pocket:mary"], + ); +}); + +test("local selection uses the first compatible qualified preference", () => { + const voices = [ + voice("pocket:mary", "Mary", null), + voice("pocket:eve", "Eve"), + ]; + assert.equal( + selectedVoiceForBackend(["siri:aaron", "pocket:eve", "pocket:mary"], voices) + ?.key, + "pocket:eve", + ); +}); + +test("duplicate display labels remain distinct by content-derived key", () => { + const voices = [ + voice("pocket:imported:aaa", "Jim"), + voice("pocket:imported:bbb", "Jim"), + ]; + assert.equal( + selectedVoiceForBackend(["pocket:imported:bbb"], voices)?.key, + "pocket:imported:bbb", + ); + assert.equal(voiceOptionLabel(voices[0], voices), "Jim · aaa"); + assert.equal(voiceOptionLabel(voices[1], voices), "Jim · bbb"); +}); diff --git a/desktop/src/features/settings/ui/voiceSettingsLogic.ts b/desktop/src/features/settings/ui/voiceSettingsLogic.ts new file mode 100644 index 0000000000..30352f2d0f --- /dev/null +++ b/desktop/src/features/settings/ui/voiceSettingsLogic.ts @@ -0,0 +1,57 @@ +export type VoiceAvailability = + | "bundled" + | "installed" + | "downloadable" + | "unavailable"; + +export type VoiceRegistryEntry = { + key: string; + displayName: string; + backend: string; + backendName: string; + availability: VoiceAvailability; + fallbackKey: string | null; + referenceFile: string | null; + provenance: { + source: string; + contentHash: string | null; + license: string | null; + sourceUrl: string | null; + }; +}; + +export function voicesForBackend( + registry: readonly VoiceRegistryEntry[], + backend: string, +): VoiceRegistryEntry[] { + return registry.filter( + (voice) => + voice.backend === backend && + (voice.availability === "bundled" || voice.availability === "installed"), + ); +} + +export function selectedVoiceForBackend( + preferences: readonly string[], + voices: readonly VoiceRegistryEntry[], +): VoiceRegistryEntry | undefined { + for (const key of preferences) { + const voice = voices.find((candidate) => candidate.key === key); + if (voice) return voice; + } + return voices.find((voice) => voice.fallbackKey === null) ?? voices[0]; +} + +export function voiceOptionLabel( + voice: VoiceRegistryEntry, + voices: readonly VoiceRegistryEntry[], +): string { + const duplicateLabel = voices.some( + (candidate) => + candidate.key !== voice.key && + candidate.displayName === voice.displayName, + ); + if (!duplicateLabel) return voice.displayName; + const identitySuffix = voice.key.split(":").at(-1)?.slice(-8) ?? voice.key; + return `${voice.displayName} · ${identitySuffix}`; +} diff --git a/desktop/src/shared/api/readOnlyRelayClient.ts b/desktop/src/shared/api/readOnlyRelayClient.ts index c7446f4e70..121b00c800 100644 --- a/desktop/src/shared/api/readOnlyRelayClient.ts +++ b/desktop/src/shared/api/readOnlyRelayClient.ts @@ -12,7 +12,7 @@ import { AUTH_TIMEOUT_MS, HISTORY_TIMEOUT_MS, PUBLISH_TIMEOUT_MS, -} from "@/shared/api/relayClientSession"; +} from "@/shared/api/relayClientTimings"; type PendingHistory = { events: RelayEvent[]; diff --git a/desktop/src/shared/api/relayChannelFilters.test.mjs b/desktop/src/shared/api/relayChannelFilters.test.mjs index 3519c82146..503f1a5d58 100644 --- a/desktop/src/shared/api/relayChannelFilters.test.mjs +++ b/desktop/src/shared/api/relayChannelFilters.test.mjs @@ -6,6 +6,7 @@ import { buildChannelAuxFilter, buildChannelReactionAuxFilter, buildChannelStructuralAuxFilter, + buildHuddleTtsLiveFilter, } from "./relayChannelFilters.ts"; const CHANNEL = "36411e44-0e2d-4cfe-bd6e-567eb169db9f"; @@ -14,6 +15,14 @@ const IDS = [ "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", ]; +test("huddle TTS filter is future-only for both message kinds", () => { + assert.deepEqual(buildHuddleTtsLiveFilter(CHANNEL), { + kinds: [9, 40002], + "#h": [CHANNEL], + limit: 0, + }); +}); + // Regression: reaction (kind:7) and reaction-removal (kind:5) events carry only // an `e` tag, no channel `h` tag. An `#h`-scoped aux query never matches them, // so removed historical reactions reappear. The aux filters must key on `#e` diff --git a/desktop/src/shared/api/relayChannelFilters.ts b/desktop/src/shared/api/relayChannelFilters.ts index d0c7e7938e..0d432d422e 100644 --- a/desktop/src/shared/api/relayChannelFilters.ts +++ b/desktop/src/shared/api/relayChannelFilters.ts @@ -6,6 +6,8 @@ import { KIND_DELETION, KIND_NIP29_DELETE_EVENT, KIND_REACTION, + KIND_STREAM_MESSAGE, + KIND_STREAM_MESSAGE_V2, KIND_STREAM_MESSAGE_EDIT, } from "@/shared/constants/kinds"; import type { RelaySubscriptionFilter } from "@/shared/api/relayClientShared"; @@ -40,6 +42,17 @@ export function buildChannelFilter( return filter; } +/** Strictly live huddle message filter: zero stored rows, future messages only. */ +export function buildHuddleTtsLiveFilter( + channelId: string, +): RelaySubscriptionFilter { + return { + kinds: [KIND_STREAM_MESSAGE, KIND_STREAM_MESSAGE_V2], + "#h": [channelId], + limit: 0, + }; +} + /** * History filter for cold-load and scrollback: message kinds *only*, so the * `limit` budget buys visible message depth. Auxiliary events (reactions, diff --git a/desktop/src/shared/api/relayClientSession.ts b/desktop/src/shared/api/relayClientSession.ts index 94438386eb..53d541ff0f 100644 --- a/desktop/src/shared/api/relayClientSession.ts +++ b/desktop/src/shared/api/relayClientSession.ts @@ -53,20 +53,19 @@ import { } from "@/shared/api/relayReconnectPolicy"; import { RelayReconnectWaiters } from "@/shared/api/relayReconnectWaiters"; import { RelayStallWatchdog } from "@/shared/api/relayStallWatchdog"; +import { + AUTH_TIMEOUT_MS, + BACKOFF_RESET_STABLE_MS, + EVENT_BATCH_MS, + HISTORY_TIMEOUT_MS, + PUBLISH_TIMEOUT_MS, + RECONNECT_BASE_DELAY_MS, + RECONNECT_MAX_DELAY_MS, + STALL_CHECK_INTERVAL_MS, + STALL_IDLE_TIMEOUT_MS, +} from "@/shared/api/relayClientTimings"; import { closeWebSocket } from "@/shared/api/relayWebSocketClose"; import { buildThreadReferenceTags } from "@/features/messages/lib/threading"; -const RECONNECT_BASE_DELAY_MS = 1_000, - RECONNECT_MAX_DELAY_MS = 30_000, - EVENT_BATCH_MS = 16; - -export const AUTH_TIMEOUT_MS = 25_000; -export const HISTORY_TIMEOUT_MS = 25_000; -export const PUBLISH_TIMEOUT_MS = 25_000; - -export const BACKOFF_RESET_STABLE_MS = 60_000; - -const STALL_CHECK_INTERVAL_MS = 10_000; -const STALL_IDLE_TIMEOUT_MS = 60_000; export class RelayClient { private wsId: number | null = null; diff --git a/desktop/src/shared/api/relayClientTimings.ts b/desktop/src/shared/api/relayClientTimings.ts new file mode 100644 index 0000000000..dbe85a835c --- /dev/null +++ b/desktop/src/shared/api/relayClientTimings.ts @@ -0,0 +1,20 @@ +export const RECONNECT_BASE_DELAY_MS = 1_000; +export const RECONNECT_MAX_DELAY_MS = 30_000; +export const EVENT_BATCH_MS = 16; + +/** + * Op-level timeouts tolerate degraded networks where TLS handshakes and DNS + * resolution can take several seconds. + */ +export const AUTH_TIMEOUT_MS = 25_000; +export const HISTORY_TIMEOUT_MS = 25_000; +export const PUBLISH_TIMEOUT_MS = 25_000; + +/** + * A stability-gated reset prevents reconnect flapping from erasing backoff. + */ +export const BACKOFF_RESET_STABLE_MS = 60_000; + +/** Passive liveness thresholds for the relay heartbeat stream. */ +export const STALL_CHECK_INTERVAL_MS = 10_000; +export const STALL_IDLE_TIMEOUT_MS = 60_000; diff --git a/desktop/src/shared/api/relayReconnectReplay.test.mjs b/desktop/src/shared/api/relayReconnectReplay.test.mjs index 54254e89de..59253a459f 100644 --- a/desktop/src/shared/api/relayReconnectReplay.test.mjs +++ b/desktop/src/shared/api/relayReconnectReplay.test.mjs @@ -5,6 +5,7 @@ import { buildReconnectReplayFilter, replayLiveSubscriptions, REPLAY_BATCH_SIZE, + shouldPageReconnectReplay, } from "./relayReconnectReplay.ts"; import { buildChannelFilter } from "./relayChannelFilters.ts"; @@ -113,6 +114,31 @@ test("reconnect replay caps large steady-state limits", () => { }); }); +test("reconnect replay preserves the live-only zero-history contract", () => { + const filter = { + kinds: [9], + "#h": ["channel-1"], + limit: 0, + }; + + assert.deepEqual(replayFilter(filter, 123), { + kinds: [9], + "#h": ["channel-1"], + limit: 0, + since: 123, + }); +}); + +test("live-only subscriptions do not page reconnect history", () => { + const filter = { + kinds: [9], + "#h": ["channel-1"], + limit: 0, + }; + + assert.equal(shouldPageReconnectReplay(filter), false); +}); + test("reconnect replay keeps the stricter existing since window", () => { const filter = { kinds: [9], diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index dcad430bbf..97051b68ec 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -161,6 +161,11 @@ type MockHuddleSeed = { type E2eConfig = { mode?: "mock" | "relay"; mock?: { + ttsSettings?: { + version: number; + agentTextToSpeech: boolean; + voicePreferences: string[]; + }; /** Advertised HEAD for the first mock project without adding that branch. */ projectHeadBranch?: string; /** Builderlab account returned by hosted-community onboarding. Null/omitted = signed out. */ @@ -9954,6 +9959,161 @@ export function maybeInstallE2eTauriMocks() { } case "get_model_status": return { stt: "ready", tts: "ready" }; + case "get_tts_settings": + return ( + activeConfig?.mock?.ttsSettings ?? { + version: 1, + agentTextToSpeech: true, + voicePreferences: ["pocket:mary"], + } + ); + case "list_voice_registry": + return [ + [ + "anna", + "Anna", + "anna.wav", + "p228_023_enhanced.wav", + "0a6de25cf12bf1540beb85979f306a92be81fecc051c547c5395e7e5237a3856", + ], + [ + "vera", + "Vera", + "vera.wav", + "p229_023_enhanced.wav", + "309cf91a895830f15842b398f69a4962cb1f7e0bfab10e25dd27838e826c204b", + ], + [ + "fantine", + "Fantine", + "fantine.wav", + "p244_023_enhanced.wav", + "5f07d4e2a3f20a15572aae885156b43ef3fc12ef3812996fd135680d9956448b", + ], + [ + "charles", + "Charles", + "charles.wav", + "p254_023_enhanced.wav", + "6b681a429198f16e378d53bccb08d06939da7b00144a7696111d4f8f76be7756", + ], + [ + "paul", + "Paul", + "paul.wav", + "p259_023_enhanced.wav", + "7aba504fe0b3b16478b69ed27ce6007e3cb42b0c1915b5f1c6a6024ae37d679b", + ], + [ + "eponine", + "Eponine", + "eponine.wav", + "p262_023_enhanced.wav", + "a13c27fb47627b05223691a0ef2974358a18c886e6c2f9d2762ff1d02c20926b", + ], + [ + "azelma", + "Azelma", + "azelma.wav", + "p303_023_enhanced.wav", + "60e3d26cdf2efdec5df712152c839928f4d5522821e6554ae11fd96c57ab1026", + ], + [ + "george", + "George", + "george.wav", + "p315_023_enhanced.wav", + "29a41f93bf5236e5b21501091d7774c255d5f3d4e62fa4f9fdf0a92a793c84ae", + ], + [ + "mary", + "Mary", + "reference_sample.wav", + "p333_023_enhanced.wav", + "a35b0468382218e9f37a9a7494d1e4b74deaf18d7ced22265b4e325bb55c183f", + ], + [ + "jane", + "Jane", + "jane.wav", + "p339_023_enhanced.wav", + "2f12e7f155eb3118f55425394f1b049e5b1b67bdc9b3932c8ba4521420aeb84a", + ], + [ + "michael", + "Michael", + "michael.wav", + "p360_023_enhanced.wav", + "b6743e9195e5e3fd34fe9d1633ae93f7ffab787b249e45f6467d7d6f7a6ee6ad", + ], + [ + "eve", + "Eve", + "eve.wav", + "p361_023_enhanced.wav", + "396e7cbd066b0f3fb6d67fa26e7904076958239d736d4390f15b5fe88feb14cd", + ], + ].map( + ([id, displayName, referenceFile, upstreamFile, contentHash]) => ({ + key: `pocket:${id}`, + displayName, + backend: "pocket", + backendName: "Pocket TTS", + availability: "bundled", + fallbackKey: id === "mary" ? null : "pocket:mary", + referenceFile, + provenance: { + source: "bundled", + contentHash, + license: "CC-BY-4.0", + sourceUrl: `https://huggingface.co/kyutai/tts-voices/blob/323332d33f997de8394f24a193e1a76df720e01a/vctk/${upstreamFile}`, + }, + }), + ); + case "set_tts_enabled": { + const enabled = (payload as { enabled?: boolean })?.enabled; + if (typeof enabled !== "boolean") + throw new Error("Missing text-to-speech enabled state"); + const settings = { + version: 1, + agentTextToSpeech: enabled, + voicePreferences: activeConfig?.mock?.ttsSettings + ?.voicePreferences ?? ["pocket:mary"], + }; + if (activeConfig) { + activeConfig.mock ??= {}; + activeConfig.mock.ttsSettings = settings; + } + return settings; + } + case "set_pocket_voice": { + const voiceKey = (payload as { voiceKey?: string })?.voiceKey; + if (!voiceKey) throw new Error("Missing Pocket voice key"); + const current = activeConfig?.mock?.ttsSettings ?? { + version: 1, + agentTextToSpeech: true, + voicePreferences: ["pocket:mary"], + }; + const firstPocketIndex = current.voicePreferences.findIndex((key) => + key.startsWith("pocket:"), + ); + const preferences = current.voicePreferences.filter( + (key) => !key.startsWith("pocket:"), + ); + preferences.splice( + firstPocketIndex < 0 ? preferences.length : firstPocketIndex, + 0, + voiceKey, + ); + const settings = { ...current, voicePreferences: preferences }; + if (activeConfig) { + activeConfig.mock ??= {}; + activeConfig.mock.ttsSettings = settings; + } + return settings; + } + case "preview_pocket_voice": + return null; case "get_builderlab_auth": return activeConfig?.mock?.builderlabAuth ?? null; case "start_builderlab_login": { diff --git a/desktop/tests/e2e/voice-settings.spec.ts b/desktop/tests/e2e/voice-settings.spec.ts new file mode 100644 index 0000000000..490bee3424 --- /dev/null +++ b/desktop/tests/e2e/voice-settings.spec.ts @@ -0,0 +1,119 @@ +import { expect, test } from "@playwright/test"; + +import { waitForAnimations } from "../helpers/animations"; +import { installMockBridge } from "../helpers/bridge"; +import { openSettings } from "../helpers/settings"; + +const SCREENSHOT_PATH = "test-results/voice-settings/pocket-voices.png"; + +test.describe("Pocket voice settings", () => { + test.use({ viewport: { width: 1100, height: 760 } }); + + test("selects and retains a bundled voice while text to speech is off", async ({ + page, + }) => { + await installMockBridge(page); + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "voice"); + + const card = page.getByTestId("settings-voice"); + await expect(card).toBeVisible(); + await expect( + page.getByText("Agent text to speech", { exact: true }), + ).toBeVisible(); + await expect( + page.getByText("Pocket TTS voice", { exact: true }), + ).toBeVisible(); + await expect(card).not.toContainText("April INT8"); + + await page.getByTestId("pocket-voice-selector").click(); + await expect(page.getByRole("menuitemradio")).toHaveCount(12); + await page.getByRole("menuitemradio", { name: "Eve" }).click(); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Eve", + ); + await expect( + page.getByRole("button", { name: "Pocket TTS voice: Eve" }), + ).toBeVisible(); + + await page.getByTestId("agent-text-to-speech-toggle").click(); + await expect( + page.getByTestId("agent-text-to-speech-toggle"), + ).toHaveAttribute("aria-checked", "false"); + await expect(page.getByTestId("pocket-voice-controls")).toHaveAttribute( + "aria-disabled", + "true", + ); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Eve", + ); + + const savedCommands = await page.evaluate(() => + (window.__BUZZ_E2E_COMMAND_LOG__ ?? []) + .filter((entry) => + ["set_pocket_voice", "set_tts_enabled"].includes(entry.command), + ) + .map((entry) => ({ command: entry.command, payload: entry.payload })), + ); + expect(savedCommands).toEqual([ + { + command: "set_pocket_voice", + payload: { voiceKey: "pocket:eve" }, + }, + { + command: "set_tts_enabled", + payload: { enabled: false }, + }, + ]); + }); + + test("captures the complete VCTK preset settings surface", async ({ + page, + }) => { + await installMockBridge(page, { + ttsSettings: { + version: 1, + agentTextToSpeech: true, + voicePreferences: ["pocket:eve"], + }, + }); + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "voice"); + + const card = page.getByTestId("settings-voice"); + await expect(card).toBeVisible(); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Eve", + ); + await page.getByTestId("pocket-voice-selector").click(); + await expect(page.getByRole("menuitemradio")).toHaveCount(12); + const menu = page.getByRole("menu"); + await expect(menu).toBeVisible(); + await waitForAnimations(page); + const cardBox = await card.boundingBox(); + const menuBox = await menu.boundingBox(); + const viewport = page.viewportSize(); + if (!cardBox || !menuBox || !viewport) { + throw new Error("Voice settings screenshot bounds are unavailable"); + } + const x = Math.max(0, Math.min(cardBox.x, menuBox.x) - 16); + const y = Math.max(0, Math.min(cardBox.y, menuBox.y) - 16); + const right = Math.min( + viewport.width, + Math.max(cardBox.x + cardBox.width, menuBox.x + menuBox.width) + 16, + ); + const bottom = Math.min( + viewport.height, + Math.max(cardBox.y + cardBox.height, menuBox.y + menuBox.height) + 16, + ); + await page.screenshot({ + path: SCREENSHOT_PATH, + clip: { + x: Math.floor(x), + y: Math.floor(y), + width: Math.ceil(right - x), + height: Math.ceil(bottom - y), + }, + }); + }); +}); diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index 49d12ec17a..2d41d27a5e 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -159,6 +159,11 @@ type MockInstallRuntimeResult = { }; type MockBridgeOptions = { + ttsSettings?: { + version: number; + agentTextToSpeech: boolean; + voicePreferences: string[]; + }; /** Advertised HEAD for the first mock project without adding that branch. */ projectHeadBranch?: string; /** Relay NIP-11 identity used to sign authoritative repository state. */ diff --git a/desktop/tests/helpers/settings.ts b/desktop/tests/helpers/settings.ts index a63b52453e..c26c0e9195 100644 --- a/desktop/tests/helpers/settings.ts +++ b/desktop/tests/helpers/settings.ts @@ -3,6 +3,7 @@ import { expect, type Page } from "@playwright/test"; type SettingsSection = | "profile" | "notifications" + | "voice" | "agents" | "channel-templates" | "compute" diff --git a/scripts/run-tests.sh b/scripts/run-tests.sh index 0a3b2ed5a2..2e7e944482 100755 --- a/scripts/run-tests.sh +++ b/scripts/run-tests.sh @@ -84,6 +84,9 @@ run_unit_tests() { run_test_step "buzz-auth unit tests" \ cargo test -p buzz-auth --lib -- --nocapture + run_test_step "buzz-voice tests" \ + cargo test -p buzz-voice --lib -- --nocapture + run_test_step "buzz-cli tests" \ cargo test -p buzz-cli -- --nocapture From 39ce3dfc3cf2d12f0d6c64b4cd4293df86567663 Mon Sep 17 00:00:00 2001 From: klopez4212 Date: Fri, 31 Jul 2026 15:24:51 +0100 Subject: [PATCH 107/112] fix(desktop): open profiles from avatars (#3751) ## Summary - show profile descriptions in hover cards as a single truncated line - open the profile panel when avatars are clicked across desktop surfaces - make the direct-message intro avatar clickable ## Validation - Desktop static checks - 3,807 desktop tests via pre-push --------- Signed-off-by: kenny lopez Signed-off-by: Wes Co-authored-by: Wes Co-authored-by: Carl --- desktop/scripts/check-pubkey-truncation.mjs | 6 +- desktop/src/app/AppHuddleBar.tsx | 25 ++ desktop/src/app/AppProfilePanelProvider.tsx | 22 + desktop/src/app/AppShell.tsx | 412 +++++++++--------- .../src/app/navigation/useAppNavigation.ts | 13 + .../channels/ui/ChannelScreenHeader.tsx | 64 ++- .../ui/CommunityMembersSettingsCard.tsx | 17 +- .../huddle/components/ParticipantList.tsx | 33 +- .../ui/DirectMessageIntroAvatarStack.tsx | 44 +- .../e2e/invites-settings-screenshots.spec.ts | 11 +- 10 files changed, 380 insertions(+), 267 deletions(-) create mode 100644 desktop/src/app/AppHuddleBar.tsx create mode 100644 desktop/src/app/AppProfilePanelProvider.tsx diff --git a/desktop/scripts/check-pubkey-truncation.mjs b/desktop/scripts/check-pubkey-truncation.mjs index 95e56fb282..d65db13545 100644 --- a/desktop/scripts/check-pubkey-truncation.mjs +++ b/desktop/scripts/check-pubkey-truncation.mjs @@ -18,12 +18,10 @@ const rules = [ // Non-display uses: array windows over pubkey lists, color/initials // derivation where the value is never presented as an identity. const overrides = new Set([ - // ProfileAvatar fallback label — decorative glyphs inside an avatar disc. - "src/features/huddle/components/ParticipantList.tsx:92", // HexAvatar: 6-char badge + hue derivation inside a color-coded disc, // clearly decorative (paired with a full truncatePubkey aria-label). - "src/features/huddle/components/ParticipantList.tsx:143", - "src/features/huddle/components/ParticipantList.tsx:144", + "src/features/huddle/components/ParticipantList.tsx:150", + "src/features/huddle/components/ParticipantList.tsx:151", // clientId (not a pubkey) sliced in a debug log next to the real thing. "src/features/channels/readState/readStateManager.ts:338", // Array windows (first N pubkeys), not string truncation. diff --git a/desktop/src/app/AppHuddleBar.tsx b/desktop/src/app/AppHuddleBar.tsx new file mode 100644 index 0000000000..9fa12d513f --- /dev/null +++ b/desktop/src/app/AppHuddleBar.tsx @@ -0,0 +1,25 @@ +import type * as React from "react"; + +import { HuddleBar } from "@/features/huddle"; + +import { AppProfilePanelProvider } from "@/app/AppProfilePanelProvider"; + +type AppHuddleBarProps = Pick< + React.ComponentProps, + "onOpenThread" | "onVisibilityChange" +>; + +export function AppHuddleBar({ + onOpenThread, + onVisibilityChange, +}: AppHuddleBarProps) { + return ( + + + + ); +} diff --git a/desktop/src/app/AppProfilePanelProvider.tsx b/desktop/src/app/AppProfilePanelProvider.tsx new file mode 100644 index 0000000000..213acec498 --- /dev/null +++ b/desktop/src/app/AppProfilePanelProvider.tsx @@ -0,0 +1,22 @@ +import * as React from "react"; + +import { useAppNavigation } from "@/app/navigation/useAppNavigation"; +import { ProfilePanelProvider } from "@/shared/context/ProfilePanelContext"; + +export function AppProfilePanelProvider({ + children, +}: Readonly<{ children: React.ReactNode }>) { + const { goProfile } = useAppNavigation(); + const handleOpenProfilePanel = React.useCallback( + (pubkey: string) => { + void goProfile(pubkey); + }, + [goProfile], + ); + + return ( + + {children} + + ); +} diff --git a/desktop/src/app/AppShell.tsx b/desktop/src/app/AppShell.tsx index b856434e61..4eb0a42bbe 100644 --- a/desktop/src/app/AppShell.tsx +++ b/desktop/src/app/AppShell.tsx @@ -63,7 +63,8 @@ import { type SettingsSection, isSettingsSection, } from "@/features/settings/ui/SettingsPanels"; -import { HuddleBar, HuddleProvider } from "@/features/huddle"; +import { HuddleProvider } from "@/features/huddle"; +import { AppHuddleBar } from "@/app/AppHuddleBar"; import { useDueReminderBadgeCount } from "@/features/reminders/hooks"; import { RemindMeLaterProvider } from "@/features/reminders/ui/RemindMeLaterProvider"; import { useReminderNotifications } from "@/features/reminders/useReminderNotifications"; @@ -97,7 +98,7 @@ import { SidebarInset, SidebarProvider } from "@/shared/ui/sidebar"; import { RelayConnectionOverlay } from "@/app/RelayConnectionOverlay"; import { useSidebarRelayConnectionCard } from "@/features/sidebar/ui/useSidebarRelayConnectionCard"; import { AppShellTrayMenu } from "@/app/useAppShellTrayMenu"; - +import { AppProfilePanelProvider } from "@/app/AppProfilePanelProvider"; const LazySettingsScreen = React.lazy(async () => { const module = await import("@/features/settings/ui/SettingsScreen"); return { default: module.SettingsScreen }; @@ -160,7 +161,6 @@ export function AppShell() { ? locationSearchSection : DEFAULT_SETTINGS_SECTION; const startupReady = useDeferredStartup(); - const identityQuery = useIdentityQuery(); const { mutedChannelIds, muteChannel, unmuteChannel } = useChannelMutes( identityQuery.data?.pubkey, @@ -303,7 +303,6 @@ export function AppShell() { ? (channels.find((channel) => channel.id === targetChannelId) ?? null) : null; }, [channels, managedChannelId, selectedChannelId]); - const { handleChannelNotification, handleDmNotification, @@ -518,7 +517,6 @@ export function AppShell() { }, [applyAgents, applyCanvas, createChannelMutation, goChannel], ); - const handleCreateForum = React.useCallback( async ({ description, @@ -586,7 +584,6 @@ export function AppShell() { }, [goHome, hideDmMutation, selectedChannelId], ); - const handleOpenSettings = React.useCallback( (section: SettingsSection = DEFAULT_SETTINGS_SECTION) => { setIsChannelManagementOpen(false); @@ -594,12 +591,10 @@ export function AppShell() { }, [goSettings], ); - const handleCloseSettings = React.useCallback( () => closeSettings(), [closeSettings], ); - // Section switches rewrite the settings entry rather than stacking one // history entry per section, so back always exits settings in one step. const handleSettingsSectionChange = React.useCallback( @@ -620,11 +615,8 @@ export function AppShell() { unreadChannelIds, unreadChannelNotificationCount, }); + // Dispatch `buzz://message` deep links into the router. useMessageDeepLinks(); - const handleOpenNewDm = React.useCallback( - () => void goNewMessage(), - [goNewMessage], - ); const handleOpenCreateChannel = React.useCallback( () => setIsCreateChannelOpen(true), [], @@ -657,7 +649,7 @@ export function AppShell() { if (key === "k" && event.shiftKey) { event.preventDefault(); - handleOpenNewDm(); + void goNewMessage(); return; } @@ -686,9 +678,9 @@ export function AppShell() { }; }, [ handleOpenBrowseChannels, - handleOpenNewDm, handleOpenCreateChannel, handleOpenSearch, + goNewMessage, goHome, settingsOpen, ]); @@ -770,216 +762,224 @@ export function AppShell() { /> ) : null} - {!settingsOpen ? ( - - ) : null} - {settingsOpen ? ( -
- - + {!settingsOpen ? ( + + ) : null} + {settingsOpen ? ( +
+ + + +
+ ) : ( +
+ { + const id = communitiesHook.addCommunity({ + ...community, + pubkey: + community.pubkey ?? + identityQuery.data?.pubkey, + }); + handleSwitchCommunity(id); + }} + onAddCommunityOpenChange={ + addCommunityDialog.onOpenChange } - notificationSettings={notificationSettings.settings} - onClose={handleCloseSettings} - onSectionChange={handleSettingsSectionChange} - onSetDesktopNotificationsEnabled={ - notificationSettings.setDesktopEnabled + onNewMessage={goNewMessage} + onBackgroundClick={requestFocusedThreadClose} + onCreateChannelOpenChange={setIsCreateChannelOpen} + onOpenAddCommunity={addCommunityDialog.openDialog} + onSendFeedback={() => setIsSendFeedbackOpen(true)} + onUpdateCommunity={communitiesHook.updateCommunity} + onRemoveCommunity={(id) => + void handleRemoveCommunity(id) } - onSetHomeBadgeEnabled={ - notificationSettings.setHomeBadgeEnabled + onSwitchCommunity={handleSwitchCommunity} + onCreateAgent={() => requestOpenCreateAgent()} + selfPresenceStatus={presenceSession.currentStatus} + communities={communitiesHook.communities} + onCreateChannel={handleCreateChannel} + onCreateForum={handleCreateForum} + onHideDm={handleHideDm} + onMarkAllChannelsRead={markAllChannelsRead} + onMarkChannelRead={markChannelRead} + onMarkChannelUnread={markChannelUnread} + onBrowseChannels={handleOpenBrowseChannels} + onOpenDm={async ({ pubkeys }) => { + const directMessage = + await openDmMutation.mutateAsync({ + pubkeys, + }); + await goChannel(directMessage.id); + }} + onSelectAgents={() => void goAgents()} + onSelectChannel={(channelId) => + void goChannel(channelId) } - onSetSlotAlertsEnabled={ - notificationSettings.setSlotAlertsEnabled + onOpenSearchResult={handleOpenSearchResult} + searchChannels={channels} + searchFocusRequest={searchFocusRequest} + onSelectHome={() => void goHome()} + onSelectProjects={() => void goProjects()} + onSelectPulse={() => void goPulse()} + onSelectSettings={handleOpenSettings} + onSelectWorkflows={() => void goWorkflows()} + onSetPresenceStatus={(status) => + presenceSession.setStatus(status) } - onSetNotifyWhileViewing={ - notificationSettings.setNotifyWhileViewing + onSetUserStatus={(text, emoji) => + setUserStatusMutation.mutate({ text, emoji }) } - onSetAllSlotAlertsEnabled={ - notificationSettings.setAllSlotAlertsEnabled + onClearUserStatus={() => + setUserStatusMutation.mutate({ + text: "", + emoji: "", + }) } - onSetSoundForSlot={ - notificationSettings.setSoundForSlot + profile={profileQuery.data} + selfUserStatus={ + deferredPubkey + ? (selfStatusQuery.data?.[ + deferredPubkey.toLowerCase() + ] ?? undefined) + : undefined } - section={settingsSection} + selectedChannelId={selectedChannelId} + selectedView={selectedView} + unreadChannelIds={unreadChannelIds} + unreadChannelCounts={unreadChannelCounts} + mutedChannelIds={mutedChannelIds} + onMuteChannel={muteChannel} + onUnmuteChannel={unmuteChannel} + starredChannelIds={starredChannelIds} + onStarChannel={starChannel} + onUnstarChannel={unstarChannel} /> - -
- ) : ( -
- { - const id = communitiesHook.addCommunity({ - ...community, - pubkey: - community.pubkey ?? identityQuery.data?.pubkey, - }); - handleSwitchCommunity(id); - }} - onAddCommunityOpenChange={ - addCommunityDialog.onOpenChange - } - onNewMessage={handleOpenNewDm} - onBackgroundClick={requestFocusedThreadClose} - onCreateChannelOpenChange={setIsCreateChannelOpen} - onOpenAddCommunity={addCommunityDialog.openDialog} - onSendFeedback={() => setIsSendFeedbackOpen(true)} - onUpdateCommunity={communitiesHook.updateCommunity} - onRemoveCommunity={(id) => - void handleRemoveCommunity(id) - } - onSwitchCommunity={handleSwitchCommunity} - onCreateAgent={() => requestOpenCreateAgent()} - selfPresenceStatus={presenceSession.currentStatus} - communities={communitiesHook.communities} - onCreateChannel={handleCreateChannel} - onCreateForum={handleCreateForum} - onHideDm={handleHideDm} - onMarkAllChannelsRead={markAllChannelsRead} - onMarkChannelRead={markChannelRead} - onMarkChannelUnread={markChannelUnread} - onBrowseChannels={handleOpenBrowseChannels} - onOpenDm={async ({ pubkeys }) => { - const directMessage = - await openDmMutation.mutateAsync({ - pubkeys, - }); - await goChannel(directMessage.id); - }} - onSelectAgents={() => void goAgents()} - onSelectChannel={(channelId) => - void goChannel(channelId) - } - onOpenSearchResult={handleOpenSearchResult} - searchChannels={channels} - searchFocusRequest={searchFocusRequest} - onSelectHome={() => void goHome()} - onSelectProjects={() => void goProjects()} - onSelectPulse={() => void goPulse()} - onSelectSettings={handleOpenSettings} - onSelectWorkflows={() => void goWorkflows()} - onSetPresenceStatus={(status) => - presenceSession.setStatus(status) - } - onSetUserStatus={(text, emoji) => - setUserStatusMutation.mutate({ text, emoji }) - } - onClearUserStatus={() => - setUserStatusMutation.mutate({ - text: "", - emoji: "", - }) - } - profile={profileQuery.data} - selfUserStatus={ - deferredPubkey - ? (selfStatusQuery.data?.[ - deferredPubkey.toLowerCase() - ] ?? undefined) - : undefined + + + + + + + + +
+ )} + + + { + setIsChannelManagementOpen(open); + if (!open) { + setManagedChannelId(null); } - selectedChannelId={selectedChannelId} - selectedView={selectedView} - unreadChannelIds={unreadChannelIds} - unreadChannelCounts={unreadChannelCounts} - mutedChannelIds={mutedChannelIds} - onMuteChannel={muteChannel} - onUnmuteChannel={unmuteChannel} - starredChannelIds={starredChannelIds} - onStarChannel={starChannel} - onUnstarChannel={unstarChannel} - /> - - - - - - - - -
- )} - - - { - setIsChannelManagementOpen(open); - if (!open) { + }} + onDeleteActiveChannel={() => { + setIsChannelManagementOpen(false); setManagedChannelId(null); - } - }} - onDeleteActiveChannel={() => { - setIsChannelManagementOpen(false); - setManagedChannelId(null); - void goHome({ replace: true }); - }} - onSelectChannel={(channelId) => { - void goChannel(channelId); - }} - /> - + void goHome({ replace: true }); + }} + onSelectChannel={(channelId) => { + void goChannel(channelId); + }} + /> + +
- { void goChannel(channelId, { messageId, diff --git a/desktop/src/app/navigation/useAppNavigation.ts b/desktop/src/app/navigation/useAppNavigation.ts index f928970610..d19ac03120 100644 --- a/desktop/src/app/navigation/useAppNavigation.ts +++ b/desktop/src/app/navigation/useAppNavigation.ts @@ -79,6 +79,18 @@ export function useAppNavigation() { [commitNavigation], ); + const goProfile = React.useCallback( + (pubkey: string, behavior?: NavigationBehavior) => + commitNavigation( + { + to: "/pulse", + search: { profile: pubkey }, + }, + behavior, + ), + [commitNavigation], + ); + const goProjects = React.useCallback( (behavior?: NavigationBehavior) => commitNavigation( @@ -303,6 +315,7 @@ export function useAppNavigation() { goProject, goProjects, goPulse, + goProfile, goSettings, goWorkflow, goWorkflows, diff --git a/desktop/src/features/channels/ui/ChannelScreenHeader.tsx b/desktop/src/features/channels/ui/ChannelScreenHeader.tsx index a3a8a20231..4c545baf68 100644 --- a/desktop/src/features/channels/ui/ChannelScreenHeader.tsx +++ b/desktop/src/features/channels/ui/ChannelScreenHeader.tsx @@ -13,6 +13,7 @@ import { ProfileAvatarWithStatus, scaleProfileAvatarStatusGeometry, } from "@/features/profile/ui/ProfileAvatarWithStatus"; +import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover"; import { Button } from "@/shared/ui/button"; import type { Channel, PresenceStatus } from "@/shared/api/types"; import { UserAvatar } from "@/shared/ui/UserAvatar"; @@ -65,6 +66,7 @@ export function ChannelScreenHeader({ const isGroupDm = activeChannel?.channelType === "dm" && activeDmHeaderParticipants.length > 1; + const activeDmParticipant = activeDmHeaderParticipants[0] ?? null; const showJoinButton = activeChannel !== null && !activeChannel.isMember && @@ -113,6 +115,25 @@ export function ChannelScreenHeader({ + ) : activeDmParticipant ? ( + + + ) : (
- + + +
- {profile?.displayName || profile?.avatarUrl ? ( - - ) : ( - - )} + + {profile?.displayName || profile?.avatarUrl ? ( + + ) : ( + + )} +
diff --git a/desktop/src/features/messages/ui/DirectMessageIntroAvatarStack.tsx b/desktop/src/features/messages/ui/DirectMessageIntroAvatarStack.tsx index 1a1018fbe7..e2922d80b7 100644 --- a/desktop/src/features/messages/ui/DirectMessageIntroAvatarStack.tsx +++ b/desktop/src/features/messages/ui/DirectMessageIntroAvatarStack.tsx @@ -1,4 +1,5 @@ import { getDmParticipantPreview } from "@/features/channels/lib/dmParticipantDisplay"; +import { UserProfilePopover } from "@/features/profile/ui/UserProfilePopover"; import { UserAvatar } from "@/shared/ui/UserAvatar"; export type DirectMessageIntroParticipant = { @@ -18,31 +19,36 @@ export function DirectMessageIntroAvatarStack({ return ( + { + if (!open) setDeleteCandidate(null); + }} + open={deleteCandidate !== null} + > + + + Delete imported voice? + + {deleteCandidate + ? `${deleteCandidate.displayName} and its local audio file will be removed.` + : "This imported voice and its local audio file will be removed."} + {selectedVoice?.key === deleteCandidate?.key && + " Mary will be selected instead."} + + + + Cancel + { + event.preventDefault(); + if (deleteCandidate) { + void deletePocketVoice(deleteCandidate.key); + } + }} + > + Delete voice + + + + ); } diff --git a/desktop/src/testing/e2eBridge.ts b/desktop/src/testing/e2eBridge.ts index 97051b68ec..818144415a 100644 --- a/desktop/src/testing/e2eBridge.ts +++ b/desktop/src/testing/e2eBridge.ts @@ -166,6 +166,8 @@ type E2eConfig = { agentTextToSpeech: boolean; voicePreferences: string[]; }; + /** Native picker boundary result for Pocket voice import tests. */ + pocketVoiceImportResult?: "success" | "cancel" | "invalid"; /** Advertised HEAD for the first mock project without adding that branch. */ projectHeadBranch?: string; /** Builderlab account returned by hosted-community onboarding. Null/omitted = signed out. */ @@ -9911,7 +9913,25 @@ export function maybeInstallE2eTauriMocks() { deviceId: state === "running" ? "mock-endpoint-id" : null, deviceName: state === "running" ? "Mock desktop" : null, }); - const handleMockCommand = async (command: string, payload: unknown) => { + let mockImportedVoices: Array<{ + key: string; + displayName: string; + backend: string; + backendName: string; + availability: "installed"; + fallbackKey: string; + referenceFile: string; + provenance: { + source: string; + contentHash: string; + license: null; + sourceUrl: null; + }; + }> = []; + const handleMockCommand = async ( + command: string, + payload: unknown, + ): Promise => { const activeConfig = getConfig(); const identity = getActiveIdentity(activeConfig); window.__BUZZ_E2E_COMMANDS__?.push(command); @@ -9969,107 +9989,110 @@ export function maybeInstallE2eTauriMocks() { ); case "list_voice_registry": return [ - [ - "anna", - "Anna", - "anna.wav", - "p228_023_enhanced.wav", - "0a6de25cf12bf1540beb85979f306a92be81fecc051c547c5395e7e5237a3856", - ], - [ - "vera", - "Vera", - "vera.wav", - "p229_023_enhanced.wav", - "309cf91a895830f15842b398f69a4962cb1f7e0bfab10e25dd27838e826c204b", - ], - [ - "fantine", - "Fantine", - "fantine.wav", - "p244_023_enhanced.wav", - "5f07d4e2a3f20a15572aae885156b43ef3fc12ef3812996fd135680d9956448b", - ], - [ - "charles", - "Charles", - "charles.wav", - "p254_023_enhanced.wav", - "6b681a429198f16e378d53bccb08d06939da7b00144a7696111d4f8f76be7756", - ], - [ - "paul", - "Paul", - "paul.wav", - "p259_023_enhanced.wav", - "7aba504fe0b3b16478b69ed27ce6007e3cb42b0c1915b5f1c6a6024ae37d679b", - ], - [ - "eponine", - "Eponine", - "eponine.wav", - "p262_023_enhanced.wav", - "a13c27fb47627b05223691a0ef2974358a18c886e6c2f9d2762ff1d02c20926b", - ], - [ - "azelma", - "Azelma", - "azelma.wav", - "p303_023_enhanced.wav", - "60e3d26cdf2efdec5df712152c839928f4d5522821e6554ae11fd96c57ab1026", - ], - [ - "george", - "George", - "george.wav", - "p315_023_enhanced.wav", - "29a41f93bf5236e5b21501091d7774c255d5f3d4e62fa4f9fdf0a92a793c84ae", - ], - [ - "mary", - "Mary", - "reference_sample.wav", - "p333_023_enhanced.wav", - "a35b0468382218e9f37a9a7494d1e4b74deaf18d7ced22265b4e325bb55c183f", - ], - [ - "jane", - "Jane", - "jane.wav", - "p339_023_enhanced.wav", - "2f12e7f155eb3118f55425394f1b049e5b1b67bdc9b3932c8ba4521420aeb84a", - ], - [ - "michael", - "Michael", - "michael.wav", - "p360_023_enhanced.wav", - "b6743e9195e5e3fd34fe9d1633ae93f7ffab787b249e45f6467d7d6f7a6ee6ad", - ], - [ - "eve", - "Eve", - "eve.wav", - "p361_023_enhanced.wav", - "396e7cbd066b0f3fb6d67fa26e7904076958239d736d4390f15b5fe88feb14cd", - ], - ].map( - ([id, displayName, referenceFile, upstreamFile, contentHash]) => ({ - key: `pocket:${id}`, - displayName, - backend: "pocket", - backendName: "Pocket TTS", - availability: "bundled", - fallbackKey: id === "mary" ? null : "pocket:mary", - referenceFile, - provenance: { - source: "bundled", - contentHash, - license: "CC-BY-4.0", - sourceUrl: `https://huggingface.co/kyutai/tts-voices/blob/323332d33f997de8394f24a193e1a76df720e01a/vctk/${upstreamFile}`, - }, - }), - ); + ...[ + [ + "anna", + "Anna", + "anna.wav", + "p228_023_enhanced.wav", + "0a6de25cf12bf1540beb85979f306a92be81fecc051c547c5395e7e5237a3856", + ], + [ + "vera", + "Vera", + "vera.wav", + "p229_023_enhanced.wav", + "309cf91a895830f15842b398f69a4962cb1f7e0bfab10e25dd27838e826c204b", + ], + [ + "fantine", + "Fantine", + "fantine.wav", + "p244_023_enhanced.wav", + "5f07d4e2a3f20a15572aae885156b43ef3fc12ef3812996fd135680d9956448b", + ], + [ + "charles", + "Charles", + "charles.wav", + "p254_023_enhanced.wav", + "6b681a429198f16e378d53bccb08d06939da7b00144a7696111d4f8f76be7756", + ], + [ + "paul", + "Paul", + "paul.wav", + "p259_023_enhanced.wav", + "7aba504fe0b3b16478b69ed27ce6007e3cb42b0c1915b5f1c6a6024ae37d679b", + ], + [ + "eponine", + "Eponine", + "eponine.wav", + "p262_023_enhanced.wav", + "a13c27fb47627b05223691a0ef2974358a18c886e6c2f9d2762ff1d02c20926b", + ], + [ + "azelma", + "Azelma", + "azelma.wav", + "p303_023_enhanced.wav", + "60e3d26cdf2efdec5df712152c839928f4d5522821e6554ae11fd96c57ab1026", + ], + [ + "george", + "George", + "george.wav", + "p315_023_enhanced.wav", + "29a41f93bf5236e5b21501091d7774c255d5f3d4e62fa4f9fdf0a92a793c84ae", + ], + [ + "mary", + "Mary", + "reference_sample.wav", + "p333_023_enhanced.wav", + "a35b0468382218e9f37a9a7494d1e4b74deaf18d7ced22265b4e325bb55c183f", + ], + [ + "jane", + "Jane", + "jane.wav", + "p339_023_enhanced.wav", + "2f12e7f155eb3118f55425394f1b049e5b1b67bdc9b3932c8ba4521420aeb84a", + ], + [ + "michael", + "Michael", + "michael.wav", + "p360_023_enhanced.wav", + "b6743e9195e5e3fd34fe9d1633ae93f7ffab787b249e45f6467d7d6f7a6ee6ad", + ], + [ + "eve", + "Eve", + "eve.wav", + "p361_023_enhanced.wav", + "396e7cbd066b0f3fb6d67fa26e7904076958239d736d4390f15b5fe88feb14cd", + ], + ].map( + ([id, displayName, referenceFile, upstreamFile, contentHash]) => ({ + key: `pocket:${id}`, + displayName, + backend: "pocket", + backendName: "Pocket TTS", + availability: "bundled", + fallbackKey: id === "mary" ? null : "pocket:mary", + referenceFile, + provenance: { + source: "bundled", + contentHash, + license: "CC-BY-4.0", + sourceUrl: `https://huggingface.co/kyutai/tts-voices/blob/323332d33f997de8394f24a193e1a76df720e01a/vctk/${upstreamFile}`, + }, + }), + ), + ...mockImportedVoices, + ]; case "set_tts_enabled": { const enabled = (payload as { enabled?: boolean })?.enabled; if (typeof enabled !== "boolean") @@ -10114,6 +10137,75 @@ export function maybeInstallE2eTauriMocks() { } case "preview_pocket_voice": return null; + case "import_pocket_voice": { + const importResult = + activeConfig?.mock?.pocketVoiceImportResult ?? "success"; + if (importResult === "cancel") return null; + if (importResult === "invalid") { + throw new Error("Voice WAV must contain PCM or 32-bit float audio"); + } + const contentHash = "1".repeat(64); + const imported = { + key: `pocket:imported:${contentHash}`, + displayName: "My voice", + backend: "pocket", + backendName: "Pocket TTS", + availability: "installed" as const, + fallbackKey: "pocket:mary", + referenceFile: `${contentHash}.wav`, + provenance: { + source: "local import", + contentHash, + license: null, + sourceUrl: null, + }, + }; + mockImportedVoices = [imported]; + const current = activeConfig?.mock?.ttsSettings ?? { + version: 1, + agentTextToSpeech: true, + voicePreferences: ["pocket:mary"], + }; + const settings = { + ...current, + voicePreferences: [imported.key], + }; + if (activeConfig) { + activeConfig.mock ??= {}; + activeConfig.mock.ttsSettings = settings; + } + return { + settings, + registry: await handleMockCommand("list_voice_registry", null), + }; + } + case "delete_pocket_voice": { + const voiceKey = (payload as { voiceKey?: string })?.voiceKey; + if (!voiceKey?.startsWith("pocket:imported:")) + throw new Error("Missing imported Pocket voice key"); + mockImportedVoices = mockImportedVoices.filter( + (voice) => voice.key !== voiceKey, + ); + const current = activeConfig?.mock?.ttsSettings ?? { + version: 1, + agentTextToSpeech: true, + voicePreferences: ["pocket:mary"], + }; + const settings = { + ...current, + voicePreferences: current.voicePreferences.includes(voiceKey) + ? ["pocket:mary"] + : current.voicePreferences, + }; + if (activeConfig) { + activeConfig.mock ??= {}; + activeConfig.mock.ttsSettings = settings; + } + return { + settings, + registry: await handleMockCommand("list_voice_registry", null), + }; + } case "get_builderlab_auth": return activeConfig?.mock?.builderlabAuth ?? null; case "start_builderlab_login": { diff --git a/desktop/tests/e2e/voice-settings.spec.ts b/desktop/tests/e2e/voice-settings.spec.ts index 490bee3424..9bd8742ed7 100644 --- a/desktop/tests/e2e/voice-settings.spec.ts +++ b/desktop/tests/e2e/voice-settings.spec.ts @@ -116,4 +116,97 @@ test.describe("Pocket voice settings", () => { }, }); }); + + test("imports, selects, and safely deletes a local voice", async ({ + page, + }) => { + await installMockBridge(page); + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "voice"); + + await page.getByTestId("pocket-voice-import").click(); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "My voice", + ); + await expect(page.getByTestId("pocket-voice-delete")).toBeVisible(); + await page.getByRole("button", { name: "Preview" }).click(); + + await page.getByTestId("pocket-voice-delete").click(); + await expect(page.getByText("Delete imported voice?")).toBeVisible(); + await page.getByTestId("confirm-pocket-voice-delete").click(); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Mary", + ); + await expect(page.getByTestId("pocket-voice-delete")).toBeHidden(); + await page.getByRole("button", { name: "Preview" }).click(); + + const mutations = await page.evaluate(() => + (window.__BUZZ_E2E_COMMAND_LOG__ ?? []) + .filter((entry) => + [ + "import_pocket_voice", + "preview_pocket_voice", + "delete_pocket_voice", + ].includes(entry.command), + ) + .map((entry) => ({ command: entry.command, payload: entry.payload })), + ); + expect(mutations).toEqual([ + { command: "import_pocket_voice", payload: {} }, + { + command: "preview_pocket_voice", + payload: { voiceKey: `pocket:imported:${"1".repeat(64)}` }, + }, + { + command: "delete_pocket_voice", + payload: { voiceKey: `pocket:imported:${"1".repeat(64)}` }, + }, + { + command: "preview_pocket_voice", + payload: { voiceKey: "pocket:mary" }, + }, + ]); + }); + + test("keeps the selected voice unchanged when the native picker is cancelled", async ({ + page, + }) => { + await installMockBridge(page, { pocketVoiceImportResult: "cancel" }); + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "voice"); + + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Mary", + ); + await page.getByTestId("pocket-voice-import").click(); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Mary", + ); + await expect(page.getByTestId("pocket-voice-delete")).toBeHidden(); + await expect(page.getByTestId("voice-settings-error")).toBeHidden(); + + const audioCommands = await page.evaluate(() => + (window.__BUZZ_E2E_COMMAND_LOG__ ?? []).filter((entry) => + ["preview_pocket_voice", "delete_pocket_voice"].includes(entry.command), + ), + ); + expect(audioCommands).toEqual([]); + }); + + test("surfaces invalid or unsupported WAV errors without changing selection", async ({ + page, + }) => { + await installMockBridge(page, { pocketVoiceImportResult: "invalid" }); + await page.goto("/", { waitUntil: "domcontentloaded" }); + await openSettings(page, "voice"); + + await page.getByTestId("pocket-voice-import").click(); + await expect(page.getByTestId("voice-settings-error")).toContainText( + "Voice WAV must contain PCM or 32-bit float audio", + ); + await expect(page.getByTestId("pocket-voice-selector")).toContainText( + "Mary", + ); + await expect(page.getByTestId("pocket-voice-delete")).toBeHidden(); + }); }); diff --git a/desktop/tests/helpers/bridge.ts b/desktop/tests/helpers/bridge.ts index 2d41d27a5e..8a9ab2be11 100644 --- a/desktop/tests/helpers/bridge.ts +++ b/desktop/tests/helpers/bridge.ts @@ -164,6 +164,8 @@ type MockBridgeOptions = { agentTextToSpeech: boolean; voicePreferences: string[]; }; + /** Native picker boundary result for Pocket voice import tests. */ + pocketVoiceImportResult?: "success" | "cancel" | "invalid"; /** Advertised HEAD for the first mock project without adding that branch. */ projectHeadBranch?: string; /** Relay NIP-11 identity used to sign authoritative repository state. */ From 052174a148f9f6bcbb2b5a1d20ce0317645e49f8 Mon Sep 17 00:00:00 2001 From: Wes Date: Fri, 31 Jul 2026 10:39:14 -0600 Subject: [PATCH 109/112] fix(release): make immutable desktop release operable (#3943) ## Summary - document `Prepare Desktop Release` as the canonical desktop release entry point - describe the frozen candidate, exact-head approval, and true merge-commit contract - document all platform outputs and complete release App/signing configuration - link the release runbook from the README - allow stable reruns to repair the rolling updater manifest after the versioned release has already published ## Release blocker The live repository cannot currently complete this flow: repository settings disable merge commits and the `main` ruleset allows only squash, while `scripts/verify-desktop-release-merge.sh` requires a two-parent merge whose second parent is the approved candidate. Those settings must allow merge commits before a desktop release PR is merged. ## Validation - `bash scripts/test-desktop-release-candidate.sh` - `bash scripts/test-release-ref-contract.sh` - `git diff --check` - verified live repository merge settings, `main` ruleset, release tag ruleset, Actions variable names, and secret names with GitHub API - independent review by Princess Donut; incorporated all findings, including the rolling-manifest retry gap and unsigned Windows labeling Signed-off-by: Wes Co-authored-by: Carl --- .github/workflows/release.yml | 2 +- README.md | 1 + RELEASING.md | 113 ++++++++++++++++++++------- scripts/test-release-ref-contract.sh | 5 +- 4 files changed, 89 insertions(+), 32 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 07951ef81d..7d5f3fbf40 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -948,5 +948,5 @@ jobs: run: gh release edit "desktop-v${VERSION}" --draft=false - name: Upload latest.json to rolling release last - if: ${{ env.already_published != 'true' && !contains(needs.setup.outputs.version, '-') }} + if: ${{ !contains(needs.setup.outputs.version, '-') }} run: gh release upload buzz-desktop-latest latest.json --clobber diff --git a/README.md b/README.md index 72af92ce13..2c58ceecad 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ Forge · Agents · Architecture · + Releasing · Apache 2.0

diff --git a/RELEASING.md b/RELEASING.md index 45f0f8638f..11f669fc9b 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -5,7 +5,7 @@ Mobile uses immutable release-candidate tags cut directly from remote `main`: | Lane | Entry point | Artifact | |------|-------------|----------| -| Desktop | `Prepare Desktop Release` / `just release-desktop` | Signed desktop app (macOS/Linux) | +| Desktop | `Prepare Desktop Release` | Packaged desktop app (signed/notarized macOS, unsigned Windows, and Linux) | | Relay | `just release-relay` | `ghcr.io/block/buzz` container image | | Mobile | `scripts/mobile-release.sh candidate X.Y.Z` | Exact `mobile-vX.Y.Z-rc.N` source identity | @@ -16,13 +16,22 @@ remains manual because OSS CI cannot trigger private CI. ## Quick Start +Desktop releases are prepared from the current remote `main` by GitHub Actions: + ```sh -# Desktop release (next patch version) -just release-desktop +gh workflow run prepare-desktop-release.yml \ + --repo block/buzz \ + --ref main \ + -f version=0.5.3 +``` -# Desktop explicit version -just release-desktop 0.4.0 +The equivalent GitHub UI path is **Actions → Prepare Desktop Release → Run +workflow**, select `main`, enter the version without a `v` prefix, and run it. +The local `just release-desktop ` recipe uses the same candidate script, +but the Actions workflow is the canonical operator path because it runs with the +release App identity and does not depend on an operator checkout. +```sh # Relay release just release-relay just release-relay 0.4.0 @@ -31,8 +40,9 @@ just release-relay 0.4.0 scripts/mobile-release.sh candidate 0.5.0 ``` -Desktop uses an immutable generated candidate PR; relay continues using its metadata PR. Mobile does not. Each -`mobile-vX.Y.Z-rc.N` tag is an immutable candidate and the artifact of record. +Desktop uses an immutable generated candidate PR; relay continues using its +metadata PR. Mobile does not. Each `mobile-vX.Y.Z-rc.N` tag is an immutable +candidate and the artifact of record. There is no mobile release branch, stable mobile tag alias, finalization step, or mobile GitHub Release. @@ -42,11 +52,26 @@ or mobile GitHub Release. ### Desktop -1. Run **Prepare Desktop Release** with a version (or `just release-desktop `). Automation records current `origin/main`, regenerates `version-bump/` as one deterministic candidate commit, and opens or updates the PR. -2. Review the full-SHA changelog, CI, recorded base, and candidate SHA. Any regeneration creates a new head and requires fresh approval. -3. Merge with **Create a merge commit**. Squash and rebase are invalid for desktop release PRs. -4. `auto-tag-on-release-pr-merge` proves that merge parent 2 is the exact approved candidate, then tags that candidate `desktop-v`. -5. The tag triggers `release.yml`. It creates a draft, builds and stages every platform, publishes the complete versioned release, and updates the rolling updater manifest last for stable versions. +1. Run **Prepare Desktop Release** with an explicit version. Automation fetches + the current `origin/main`, regenerates `version-bump/` as one + deterministic candidate commit, records the frozen base and proposed + `desktop-v` tag in `.release/desktop-candidate.json`, updates every + desktop manifest and lockfile, writes a full-SHA changelog, and opens or + updates the PR. +2. Review the recorded base and candidate SHA, the complete changelog, and CI. + The candidate must receive an approval on its exact current head. Any + regeneration changes that head and therefore requires a fresh approval. +3. Merge with **Create a merge commit**. Squash and rebase are invalid for + desktop release PRs. Repository settings and the `main` ruleset must allow + merge commits for this option to exist. +4. `auto-tag-on-release-pr-merge` verifies the two-parent merge, exact candidate + approval, and every required check, then tags the reviewed candidate—not the + merge commit—as `desktop-v`. +5. The tag triggers `release.yml`. It builds and stages Apple Silicon and Intel + macOS, Windows, and Linux artifacts; publishes the versioned release only + after the complete set succeeds; then updates the rolling updater manifest + last for stable versions. A failed platform leaves no partially published + versioned release. ### Relay @@ -143,12 +168,15 @@ for distributable builds or builds from an immutable release tag. --- -## Manual Release Retry +## Release Retry -The **Release** workflow's manual dispatch is only a retry mechanism for an -existing immutable `desktop-v` tag. Select that tag in the ref picker and -provide the matching semver version without the `desktop-v` prefix. It cannot build -from `main` or another caller-selected source ref. +`release.yml` has no manual dispatch and cannot build from `main` or another +caller-selected ref. If a run for an existing immutable +`desktop-v` tag fails, rerun that failed workflow from GitHub Actions +(or use `gh run rerun --failed --repo block/buzz`). A stable rerun also +repairs `buzz-desktop-latest/latest.json` if the original run published the +versioned release but failed during that final rolling-manifest upload. Do not +recreate, move, or push the immutable tag again. Mobile intentionally has no branch or arbitrary-ref fallback. The private Buildkite pipeline accepts only an exact candidate tag. @@ -183,9 +211,11 @@ GitHub Release or a stable `mobile-vX.Y.Z` alias. The release workflow builds **two separate macOS DMGs**: Apple Silicon (`darwin-aarch64`, the `release` job) and Intel -(`darwin-x86_64`, the `release-macos-x64` job), plus Linux `.deb` and -`.AppImage`. Both macOS DMGs are codesigned, notarized, and attached to -the same `desktop-v` release. Intel users download the `_x64.dmg`. +(`darwin-x86_64`, the `release-macos-x64` job), an unsigned Windows x64 +NSIS installer (its filename includes `_alpha-unsigned`), and Linux `.deb` and +`.AppImage` packages. Both macOS DMGs are codesigned, notarized, and attached +to the same `desktop-v` release. Intel users +download the `_x64.dmg`. The Linux AppImage is post-processed by `desktop/scripts/fix-appimage.sh`, which strips infra libraries over-bundled by linuxdeploy (they crash on @@ -205,18 +235,25 @@ host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 repository - `gh` CLI version 2.87.0 or newer, authenticated with permission to dispatch the candidate workflow +- Repository settings and the `main` ruleset configured to allow **merge + commits**; desktop release PRs cannot be squash- or rebase-merged - Release tag ruleset [`14378754`](https://github.com/block/buzz/rules/14378754) - active for `mobile-v*`, with creation, update, deletion, and non-fast-forward - protections and `buzz-release-bot` as its sole always-bypass actor + active for `desktop-v*` and `mobile-v*`, with creation, update, deletion, and + non-fast-forward protections and `buzz-release-bot` as its sole always-bypass + actor - The `buzz-release-bot` App credentials configured for GitHub Actions -- The following **GitHub Actions secrets** must also be configured for the +- The following **GitHub Actions variables and secrets** configured for the desktop release lane: - | Secret | Purpose | - |--------|---------| - | `BUZZ_UPDATER_PUBLIC_KEY` | Tauri updater public key (minisign) | - | `TAURI_SIGNING_PRIVATE_KEY` | Tauri updater private key | - | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for the private key | + | Name | Kind | Purpose | + |------|------|---------| + | `BUZZ_RELEASE_TAGGER_CLIENT_ID` | Variable | GitHub App client ID used to prepare candidates and create tags | + | `BUZZ_RELEASE_TAGGER_PRIVATE_KEY` | Secret | GitHub App private key | + | `OSX_CODESIGN_ROLE` | Secret | macOS signing role used by `block/apple-codesign-action` | + | `CODESIGN_S3_BUCKET` | Secret | macOS signing exchange bucket | + | `BUZZ_UPDATER_PUBLIC_KEY` or `SPROUT_UPDATER_PUBLIC_KEY` | Secret | Tauri updater public key | + | `TAURI_SIGNING_PRIVATE_KEY` | Secret | Tauri updater private key | + | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Secret | Password for the private key | Mobile candidate publication requires workflow-dispatch access and the existing release App because strict tag protection denies direct human creation. The App @@ -231,10 +268,26 @@ actor list. ## Troubleshooting -### `just release-desktop` fails with "must be on main branch" +### The release PR does not offer **Create a merge commit** + +The immutable desktop flow cannot release until both the repository merge +settings and the `main` ruleset allow merge commits. Do not squash the PR: the +auto-tagger deliberately rejects a one-parent squash commit. Enable merge +commits, then merge the already-approved exact candidate head with **Create a +merge commit**. + +### `Prepare Desktop Release` fails before opening a PR + +Check the workflow run first. Confirm `BUZZ_RELEASE_TAGGER_CLIENT_ID` and +`BUZZ_RELEASE_TAGGER_PRIVATE_KEY` are configured and that the release App can +write contents and pull requests. Rerunning the preparer regenerates the +candidate from the then-current `origin/main`; if its head changes, obtain a new +approval before merging. + +### Local `just release-desktop` fails with "must be on main branch" Switch to `main` and pull latest before running the release recipe. -### `just release-desktop` fails with "working tree is dirty" +### Local `just release-desktop` fails with "working tree is dirty" Commit or stash your changes before running the release recipe. ### New commits land after publishing a mobile candidate diff --git a/scripts/test-release-ref-contract.sh b/scripts/test-release-ref-contract.sh index bd4eb75275..25ef5ca230 100755 --- a/scripts/test-release-ref-contract.sh +++ b/scripts/test-release-ref-contract.sh @@ -120,7 +120,10 @@ grep -Fq "needs.release-macos-x64.result == 'success'" "$release_workflow" grep -Fq "needs.release-linux.result == 'success'" "$release_workflow" grep -Fq "needs.release-windows.result == 'success'" "$release_workflow" grep -Fq "refs/tags/desktop-v{0}" "$release_workflow" -grep -Fq "if: \${{ env.already_published != 'true' && !contains(needs.setup.outputs.version, '-') }}" "$release_workflow" +grep -Fq "if: \${{ !contains(needs.setup.outputs.version, '-') }}" "$release_workflow" +if grep -Fq "env.already_published != 'true' && !contains(needs.setup.outputs.version, '-')" "$release_workflow"; then + echo "rolling updater retry is incorrectly gated by versioned publication state" >&2; exit 1 +fi grep -Fq 'group: desktop-release-${{ github.ref }}' "$release_workflow" grep -Fq 'cancel-in-progress: false' "$release_workflow" grep -Fq 'release artifact basename collision' "$release_workflow" From d12b3d6a79d56a95fc99ce4fadd2d2235d5a3131 Mon Sep 17 00:00:00 2001 From: Wes Date: Fri, 31 Jul 2026 10:43:30 -0600 Subject: [PATCH 110/112] chore(release): release Buzz Desktop version 0.5.3 Co-authored-by: Release Automation Signed-off-by: Wes --- .release/desktop-candidate.json | 8 ++++ CHANGELOG.md | 63 +++++++++++++++++++++++++++++++ desktop/package.json | 2 +- desktop/src-tauri/Cargo.lock | 2 +- desktop/src-tauri/Cargo.toml | 2 +- desktop/src-tauri/tauri.conf.json | 2 +- 6 files changed, 75 insertions(+), 4 deletions(-) create mode 100644 .release/desktop-candidate.json diff --git a/.release/desktop-candidate.json b/.release/desktop-candidate.json new file mode 100644 index 0000000000..150f8023e7 --- /dev/null +++ b/.release/desktop-candidate.json @@ -0,0 +1,8 @@ +{ + "schema": 1, + "version": "0.5.3", + "base_sha": "052174a148f9f6bcbb2b5a1d20ce0317645e49f8", + "previous_tag": "v0.5.2", + "tag": "desktop-v0.5.3", + "commit_count": 53 +} diff --git a/CHANGELOG.md b/CHANGELOG.md index d83087fc26..974f68c683 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,68 @@ # Changelog +## v0.5.3 + +### Desktop and shared changes + +- feat(desktop): import local Pocket voices ([#3259](https://github.com/block/buzz/pull/3259)) ([`c104eecfb38620de2c35c7e20a716f8658b5a6b1`](https://github.com/block/buzz/commit/c104eecfb38620de2c35c7e20a716f8658b5a6b1)) +- fix(desktop): open profiles from avatars ([#3751](https://github.com/block/buzz/pull/3751)) ([`39ce3dfc3cf2d12f0d6c64b4cd4293df86567663`](https://github.com/block/buzz/commit/39ce3dfc3cf2d12f0d6c64b4cd4293df86567663)) +- refactor(voice): extract reusable Pocket primitives + Pocket voice settings (relands #2467 + #3208) ([#3910](https://github.com/block/buzz/pull/3910)) ([`61ba9dfaa00852925058d1a024322fa53663a5bc`](https://github.com/block/buzz/commit/61ba9dfaa00852925058d1a024322fa53663a5bc)) +- feat(desktop): auto-enable huddle transcription for agents ([#3180](https://github.com/block/buzz/pull/3180)) ([`4632c55041c5d423d572a6f6411bb7b279c26f67`](https://github.com/block/buzz/commit/4632c55041c5d423d572a6f6411bb7b279c26f67)) +- feat(agent): optional reply guard reminds a silent turn to publish ([#3763](https://github.com/block/buzz/pull/3763)) ([`081f805d5ea25841ab885c7b67a568618a34aa59`](https://github.com/block/buzz/commit/081f805d5ea25841ab885c7b67a568618a34aa59)) +- feat(desktop): upgrade Pocket TTS model ([#3266](https://github.com/block/buzz/pull/3266)) ([`d48b0e0eec4d2958f90a3cafa9d974450abe8501`](https://github.com/block/buzz/commit/d48b0e0eec4d2958f90a3cafa9d974450abe8501)) +- feat(desktop): delete a message by clearing its edit to empty ([#3813](https://github.com/block/buzz/pull/3813)) ([`d88313f369acfa17973029787ee4c0bbea07fa51`](https://github.com/block/buzz/commit/d88313f369acfa17973029787ee4c0bbea07fa51)) +- feat(relay): raise hosted community limit to five ([#3829](https://github.com/block/buzz/pull/3829)) ([`10d5a26414dc90dc89fd27de74b21e105d4fa622`](https://github.com/block/buzz/commit/10d5a26414dc90dc89fd27de74b21e105d4fa622)) +- feat(desktop): locally stored NIP-49 encrypted key backup ([#2937](https://github.com/block/buzz/pull/2937)) ([`468647a51f858b29d27eaf9fd07bf90294f99d39`](https://github.com/block/buzz/commit/468647a51f858b29d27eaf9fd07bf90294f99d39)) +- fix(catalog): update Amp tagline ([#3806](https://github.com/block/buzz/pull/3806)) ([`f3e5e812677f6f14bffe16a7aa02642d56faca4b`](https://github.com/block/buzz/commit/f3e5e812677f6f14bffe16a7aa02642d56faca4b)) +- fix(desktop): channel topic and membership metadata cleanup ([#3642](https://github.com/block/buzz/pull/3642)) ([`9e8fcfda099652926b921bca7fcc9bfecab0e140`](https://github.com/block/buzz/commit/9e8fcfda099652926b921bca7fcc9bfecab0e140)) +- fix(desktop): align data deletion labels ([#2230](https://github.com/block/buzz/pull/2230)) ([`ede26863345a518ec46edd6d7692e0281883491b`](https://github.com/block/buzz/commit/ede26863345a518ec46edd6d7692e0281883491b)) +- fix(desktop): allow linux-only media items as dead code off-linux ([#3811](https://github.com/block/buzz/pull/3811)) ([`36571f4adcfdcf3714a17bd968c58c78bcbdd9ef`](https://github.com/block/buzz/commit/36571f4adcfdcf3714a17bd968c58c78bcbdd9ef)) +- fix(desktop): report authenticated relay recovery ([#3812](https://github.com/block/buzz/pull/3812)) ([`74cd5712191bffd84ae688d59bb8b451c6eec1b0`](https://github.com/block/buzz/commit/74cd5712191bffd84ae688d59bb8b451c6eec1b0)) +- fix(desktop): don't gate hover affordances on the hover media query ([#3657](https://github.com/block/buzz/pull/3657)) ([`29dfe4821ed577489a1879fd2a9bfe2a621a52b3`](https://github.com/block/buzz/commit/29dfe4821ed577489a1879fd2a9bfe2a621a52b3)) +- feat(relay): gate kind 30178 team-catalog reads behind the shared tag ([#3358](https://github.com/block/buzz/pull/3358)) ([`114d40d9d37f05eff83ee90347ed93fb3da512c5`](https://github.com/block/buzz/commit/114d40d9d37f05eff83ee90347ed93fb3da512c5)) +- test(desktop): click visible thread collapse guide ([#3800](https://github.com/block/buzz/pull/3800)) ([`b9e4ed616f39b812bc964e79c7a40223c4e93832`](https://github.com/block/buzz/commit/b9e4ed616f39b812bc964e79c7a40223c4e93832)) +- feat(desktop): raise the install ceiling and make installs observable ([#3368](https://github.com/block/buzz/pull/3368)) ([`d40a33290e75791aa7ecf3ce7a252b66c2e35966`](https://github.com/block/buzz/commit/d40a33290e75791aa7ecf3ce7a252b66c2e35966)) +- Add Devin as a preset ACP harness ([#3225](https://github.com/block/buzz/pull/3225)) ([`1b3ff96a5764303998fa629ff852e81f1a88d7ad`](https://github.com/block/buzz/commit/1b3ff96a5764303998fa629ff852e81f1a88d7ad)) +- feat(desktop): improve agent activity header ui ([#3321](https://github.com/block/buzz/pull/3321)) ([`4d47aa83455a9fd024121a596154cd311dca1d76`](https://github.com/block/buzz/commit/4d47aa83455a9fd024121a596154cd311dca1d76)) +- perf(presence): reduce heartbeat frequency ([#3783](https://github.com/block/buzz/pull/3783)) ([`bf139e8d0bdba10df9a5adbf16843140e0a78a59`](https://github.com/block/buzz/commit/bf139e8d0bdba10df9a5adbf16843140e0a78a59)) +- Tighten continuation message rows ([#3724](https://github.com/block/buzz/pull/3724)) ([`6e419b9f1c873549a7b40996970e0da7352adafb`](https://github.com/block/buzz/commit/6e419b9f1c873549a7b40996970e0da7352adafb)) +- Fix video reviews in thread replies ([#3719](https://github.com/block/buzz/pull/3719)) ([`f48f3f055fdd6030d3832f615f8c0d8e5a81261a`](https://github.com/block/buzz/commit/f48f3f055fdd6030d3832f615f8c0d8e5a81261a)) +- Make relay reconnect backoff authoritative ([#3774](https://github.com/block/buzz/pull/3774)) ([`cca8839034eb571a7ce943c3ace7f85a82330898`](https://github.com/block/buzz/commit/cca8839034eb571a7ce943c3ace7f85a82330898)) +- feat(desktop): add password-protected backups in settings ([#3701](https://github.com/block/buzz/pull/3701)) ([`bd0bff24bfd2cffa2b3b3a995f7628af5e460a5c`](https://github.com/block/buzz/commit/bd0bff24bfd2cffa2b3b3a995f7628af5e460a5c)) +- fix(desktop): reuse profiles when joining communities ([#2155](https://github.com/block/buzz/pull/2155)) ([`f44b5a2477f3979ae66e49153b11be36538cf859`](https://github.com/block/buzz/commit/f44b5a2477f3979ae66e49153b11be36538cf859)) +- fix(catalog): update Amp description ([#3758](https://github.com/block/buzz/pull/3758)) ([`61b96c9828d1dd54106b570d87a54edbc92bb9c4`](https://github.com/block/buzz/commit/61b96c9828d1dd54106b570d87a54edbc92bb9c4)) +- feat(catalog): resolve publisher display name in catalog detail pane ([#3640](https://github.com/block/buzz/pull/3640)) ([`02be413b823c356587e6e9f4d07f6cb06bb41c3c`](https://github.com/block/buzz/commit/02be413b823c356587e6e9f4d07f6cb06bb41c3c)) +- feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute (split 1/2 of #3467) ([#3741](https://github.com/block/buzz/pull/3741)) ([`4933672eb4589e7208b312829ebddcd10dfa9dd3`](https://github.com/block/buzz/commit/4933672eb4589e7208b312829ebddcd10dfa9dd3)) +- Refine agent sharing dialog ([#3699](https://github.com/block/buzz/pull/3699)) ([`9a386a0defbf2b355ee17646c7c11817a535b85f`](https://github.com/block/buzz/commit/9a386a0defbf2b355ee17646c7c11817a535b85f)) +- desktop: enable getUserMedia in the Linux WebKitGTK webview ([#3607](https://github.com/block/buzz/pull/3607)) ([`c9aa55505c544c608ff71648bbfd21b235637f19`](https://github.com/block/buzz/commit/c9aa55505c544c608ff71648bbfd21b235637f19)) +- fix: align responsive agent views ([#3688](https://github.com/block/buzz/pull/3688)) ([`73589408db6fd96b87ac570935d414ecc4120f53`](https://github.com/block/buzz/commit/73589408db6fd96b87ac570935d414ecc4120f53)) +- Add macOS agent menu-bar menu ([#3565](https://github.com/block/buzz/pull/3565)) ([`d0a24bcb5210326da4c0b1e749ee3935621b329c`](https://github.com/block/buzz/commit/d0a24bcb5210326da4c0b1e749ee3935621b329c)) +- Fix pending message feedback ([#3543](https://github.com/block/buzz/pull/3543)) ([`4672ee55c4e4a7916c31bfeae5df2fb4384bed10`](https://github.com/block/buzz/commit/4672ee55c4e4a7916c31bfeae5df2fb4384bed10)) +- fix(desktop): remove remaining Projects panel fills ([#3742](https://github.com/block/buzz/pull/3742)) ([`c55e421a0629c74b9ffd96ee3ccde36f006196ed`](https://github.com/block/buzz/commit/c55e421a0629c74b9ffd96ee3ccde36f006196ed)) +- desktop: restore direct community member adds ([#3634](https://github.com/block/buzz/pull/3634)) ([`310df2ec33fbb075edf226ba18bf9a96d90ba81b`](https://github.com/block/buzz/commit/310df2ec33fbb075edf226ba18bf9a96d90ba81b)) +- fix(desktop): explain open agent access ([#2561](https://github.com/block/buzz/pull/2561)) ([`7fb008f9347b933b9a1da20a7afb070912b430e8`](https://github.com/block/buzz/commit/7fb008f9347b933b9a1da20a7afb070912b430e8)) +- fix(desktop): remove Projects overview card fills ([#3416](https://github.com/block/buzz/pull/3416)) ([`3b8567a05d4c40e667d061666feb7aa7bc38212d`](https://github.com/block/buzz/commit/3b8567a05d4c40e667d061666feb7aa7bc38212d)) +- fix(git): channel binding tooling + author remediation for unbound repos ([#3626](https://github.com/block/buzz/pull/3626)) ([`788b3c002bd2509455444f57f8a03a054b4b496a`](https://github.com/block/buzz/commit/788b3c002bd2509455444f57f8a03a054b4b496a)) +- feat: configure S3 URL addressing style ([#3400](https://github.com/block/buzz/pull/3400)) ([`7012d86d52fd188b27c7beedeaa132d9c1f61fa8`](https://github.com/block/buzz/commit/7012d86d52fd188b27c7beedeaa132d9c1f61fa8)) +- feat: add first-class OpenRouter provider support ([#1975](https://github.com/block/buzz/pull/1975)) ([`ab55fee81896d2b03edf5d2ca5012b715be2b93d`](https://github.com/block/buzz/commit/ab55fee81896d2b03edf5d2ca5012b715be2b93d)) +- feat(agent,acp): wire provider total_tokens through NIP-AM publish chain ([#3593](https://github.com/block/buzz/pull/3593)) ([`f95fdc1a102e17c6718a44323d9a2feaed702db7`](https://github.com/block/buzz/commit/f95fdc1a102e17c6718a44323d9a2feaed702db7)) + +### Other repository changes + +- fix(release): make immutable desktop release operable ([#3943](https://github.com/block/buzz/pull/3943)) ([`052174a148f9f6bcbb2b5a1d20ce0317645e49f8`](https://github.com/block/buzz/commit/052174a148f9f6bcbb2b5a1d20ce0317645e49f8)) +- docs: add VISION_REMOTE_AGENTS.md ([#3924](https://github.com/block/buzz/pull/3924)) ([`689617af7ad420c3266d5d2eb437757371327089`](https://github.com/block/buzz/commit/689617af7ad420c3266d5d2eb437757371327089)) +- fix(relay): align NIP-11 max_limit with REQ ceiling ([#3635](https://github.com/block/buzz/pull/3635)) ([`23f0c26b1ceba8e07bf3c160a1e08c7bda82ccd9`](https://github.com/block/buzz/commit/23f0c26b1ceba8e07bf3c160a1e08c7bda82ccd9)) +- fix(db): isolate usage metrics advisory-lock test on scratch DB ([#3670](https://github.com/block/buzz/pull/3670)) ([`dba97eecd9d8659c9c816cd6666fa6d687b6bca1`](https://github.com/block/buzz/commit/dba97eecd9d8659c9c816cd6666fa6d687b6bca1)) +- feat(release): make desktop releases immutable ([#3568](https://github.com/block/buzz/pull/3568)) ([`1dfd89ea67b4ebce0c4d10390f280ed4e7ddde8a`](https://github.com/block/buzz/commit/1dfd89ea67b4ebce0c4d10390f280ed4e7ddde8a)) +- Render mobile agent mention chips ([#3702](https://github.com/block/buzz/pull/3702)) ([`06582ee6f09e5f7454e4d8895d80a45c3cdb5e8a`](https://github.com/block/buzz/commit/06582ee6f09e5f7454e4d8895d80a45c3cdb5e8a)) +- fix(acp): preserve truncated thread context ([#3340](https://github.com/block/buzz/pull/3340)) ([`53771c8f5439f9c5c26876f0229bfcfe5da9b170`](https://github.com/block/buzz/commit/53771c8f5439f9c5c26876f0229bfcfe5da9b170)) +- docs(nips): specify kind:30621 multi-repo projects (NIP-MP) ([#3163](https://github.com/block/buzz/pull/3163)) ([`33bf7caa6ea474ccde2932c1ed05a90d7345c6e0`](https://github.com/block/buzz/commit/33bf7caa6ea474ccde2932c1ed05a90d7345c6e0)) +- feat(mobile): desktop-parity emoji and thread experience ([#3485](https://github.com/block/buzz/pull/3485)) ([`85edc0572a8540dedfa6562d40f0f875af0b5f61`](https://github.com/block/buzz/commit/85edc0572a8540dedfa6562d40f0f875af0b5f61)) +- fix(cli): resolve agents from owner records ([#3178](https://github.com/block/buzz/pull/3178)) ([`262f2392e3b7e09c78d582fb384672034d8551d5`](https://github.com/block/buzz/commit/262f2392e3b7e09c78d582fb384672034d8551d5)) +- feat(replica): portable heartbeat-token fence with snapshot-local reader routing ([#3268](https://github.com/block/buzz/pull/3268)) ([`63496cc1d4c6f1b7c613801bdcc694169dcf391a`](https://github.com/block/buzz/commit/63496cc1d4c6f1b7c613801bdcc694169dcf391a)) + +[Compare v0.5.2...desktop-v0.5.3](https://github.com/block/buzz/compare/v0.5.2...desktop-v0.5.3) + ## v0.5.2 - feat(cli): mirror Desktop mention delivery ([#3330](https://github.com/block/buzz/pull/3330)) ([`7adc46268`](https://github.com/block/buzz/commit/7adc46268d5e93f0b1d4dc8e700af22815dcac1b)) diff --git a/desktop/package.json b/desktop/package.json index 2226a0cb12..e8145f5468 100644 --- a/desktop/package.json +++ b/desktop/package.json @@ -1,7 +1,7 @@ { "name": "buzz", "private": true, - "version": "0.5.2", + "version": "0.5.3", "type": "module", "scripts": { "dev": "vite", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 254b7070ac..00d3fba3b5 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1036,7 +1036,7 @@ dependencies = [ [[package]] name = "buzz-desktop" -version = "0.5.2" +version = "0.5.3" dependencies = [ "anyhow", "arboard", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 39aaf0dead..b80684f955 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -2,7 +2,7 @@ [package] name = "buzz-desktop" -version = "0.5.2" +version = "0.5.3" description = "Buzz desktop app" authors = ["you"] edition = "2021" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index 2eba7815b2..1ff8bd20ef 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Buzz", - "version": "0.5.2", + "version": "0.5.3", "identifier": "xyz.block.buzz.app", "build": { "beforeDevCommand": { From 209536ade6c5ebf7fa82671d7ca0b74f599a40cc Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Fri, 31 Jul 2026 13:06:21 -0400 Subject: [PATCH 111/112] docs(nips): add single-coordinate manual-unread override layer and verification model to NIP-RS (#2864) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Amends `docs/nips/NIP-RS.md` with the manual mark-as-unread override layer and includes `docs/formal/nip-rs-unread/`, the bounded exhaustive verification model that preceded and informed the spec. All `ov_*` override state lives in exactly one coordinate per installation. That single constraint is what makes the rest of the amendment small: override state never moves between coordinates, so there is no slot lifecycle to make crash-safe, and the only durability obligation is carry-forward on `client_id` rotation. ## Spec changes (`docs/nips/NIP-RS.md`) - **Non-Goals:** drop the stale line stating mark-as-unread is out of scope; state the `ov_*` durability exception to the best-effort/time-horizon model. - **Reserved Namespace:** `ov_` stem and `esc:` escape marker reserved. Escape on publish (prepend `esc:` to raw IDs beginning with `ov_` or `esc:`), unescape on receive (strip exactly one `esc:`). Bijection, with the pre-amendment backward-compat residual documented as a stated limitation. - **Content Validation:** override entries are collected and validated as a complete logical group *before* any decoding, zero-filling, merging, or canonicalizing. Only two wire shapes are accepted — a complete live three-key group, or an `ov_c:`-only tombstone floor. Any other shape rejects the whole group while retaining the frontier entry; applying the generic per-entry discard rule first is prohibited. - **`d` Tag:** `` is exactly 32 lowercase hexadecimal characters, replacing "a random opaque string" of 1–64 ASCII characters. The fixed shape lets a relay recognize a read-state coordinate structurally from the `d` tag alone, without decrypting anything, and apply per-coordinate protections to it — under the old wording a conforming client could pick a shape that silently forfeits them. Recognizable coordinates are also what let a relay replace superseded versions outright rather than accumulating one retained row per publish, which keeps the coordinate count a full-state load must enumerate near one per installation. Every client designates one **primary** coordinate with a stable `` for the installation's lifetime. All `ov_*` entries, and the frontier entries of the contexts they belong to, MUST live in the primary. Additional coordinates remain legal for frontier volume but MUST NOT carry `ov_*`, which keeps them freely rewritable and freely deletable. - **`t` Tag:** described as a discoverability marker rather than a guarantee of relay-side selectivity. A relay MAY apply tag constraints after its result cap, and `kind:30078` is shared with unrelated application data, so clients MUST apply the tag as a correctness filter locally, MUST NOT infer completeness from a short result, and MUST omit the tag entirely when performing a full-state load. - **Fetching / Full-State Load:** clients implementing the override layer MUST NOT apply a finite `since` filter — an encrypted payload means a relay filter cannot select for override-bearing events, so any event-level window can exclude the only coordinate holding a tombstone floor. Removing `since` is not sufficient: relays MAY cap historical results, MAY cap below the requested `limit`, and emit end-of-stored-events after the capped query, so neither EOSE nor a short page proves completeness. No test against the client's requested `limit` can detect truncation either: the effective cap belongs to the relay, a relay MAY cap below what was requested, and an advertised maximum limit is not necessarily the limit enforced. A full-state load is therefore enumerated on `{"kinds": [30078], "authors": [], "limit": }` with **no tag constraint**. A relay MAY apply tag constraints only after its result cap and withhold the events that fail them, so under a tag-constrained filter the delivered count is not the count the cap selected — a delivered page can be empty while older coordinates still exist below it, and `kind:30078` is arbitrary application data whose `d` tag namespace is open to every application that has written under the user's key. Omitting the tag makes delivery observable; read-state selection moves client-side, where the validation rules already place it. Completeness is then established by enumeration on a strictly decreasing cursor: collect a page, descend on the lowest `created_at` across all delivered events, exhaust that second with a window pinned to it, continue below it, and treat only an empty delivery as complete. Every query carries the same explicit `limit` `n` with `n >= L`. Per-second exhaustion is discharged by comparing the pinned window's delivery against the largest delivery the relay has already demonstrated in the same load, floored at `L = 2` so that the ordinary single-coordinate installation can reach *complete* at all. The comparison fails safe: an inconclusive window reports *cannot prove complete* rather than *complete*, and that verdict is terminal for the load. Because these are addressable events, a coordinate republished mid-load moves *above* the descending cursor while its previous version stops existing, so neither is reachable by any later query. A full-state load is therefore fenced by a live subscription on the same tag-free filter, established — defined as receipt of end-of-stored-events — before the first enumeration query and held unbroken on the same connection for the load's duration. Fence deliveries are collected like enumerated events but do not contribute to the cursor or to the demonstrated-delivery bound. Collection deduplicates coordinates on the full NIP-01 addressable ordering — greatest `created_at`, lowest event id on ties — because an equal-timestamp replacement is legal and is the version the relay retains. A lapsed or reconnected fence makes the load potentially incomplete, and a client MUST NOT publish to its own coordinates during its own load. Five relay behaviours the *complete* verdict rests on are stated as normative conformance preconditions rather than assumptions, because none is verifiable from the responses a client receives: newest-first prefix delivery with lowest-id tie-breaking (what NIP-01 already specifies for `limit`), a non-decreasing effective cap within a load, the floor `L`, push delivery on an open subscription, and a delivery barrier ordering accepted matching events ahead of a query's end-of-stored-events on the same connection. Conditioning *complete* on positive proof of these instead would withdraw the override layer from every client rather than from the non-conforming relays. A client MUST NOT load against a relay it has evidence violates them, and MUST treat any such load as potentially incomplete. A load that is potentially incomplete, or that failed on any relay the client publishes to, MUST NOT authorize canonical compaction, publishing a canonicalized override blob, deleting or abandoning a coordinate, or reporting a mark-read as successful; the client falls back to local state. - **Client-ID Rotation / Orphaned Blob Deletion:** rotation is the only event that changes an override-bearing coordinate. Before deleting or abandoning its previous primary, a client MUST republish the componentwise `max()` of every register that primary holds — every tombstone ceiling included — under its new primary, and MUST confirm acceptance on **every relay** from which the old primary will be deleted or allowed to lapse. Acceptance on one relay does not authorize deletion on another. Frontier-only orphans are deletable unconditionally; an unknown same-`client_id` coordinate is treated as a live carrier until merged. - **Live Subscription and Convergence:** the re-publish trigger and its suppression are evaluated on canonicalized state, so a retained live peer blob the client has already tombstoned cannot trigger an identical write on every replay. - **Manual-Unread Override Layer** (new section): - **Wire encoding:** `ov_s:`, `ov_c:`, `ov_b:` as uint32 siblings in the existing `contexts` map. - **Merge rule:** componentwise `max()` per counter — no new wire merge logic. - **Liveness predicate:** `S > 0 AND F <= B AND S > C`, transcribed from `model.py::override_set_b`. - **Actions:** mark-unread bumps S and captures the effective frontier as B; mark-read bumps C; a natural frontier advance past B deactivates a stale set with no counter update. Every action requires a complete full-state load. At the uint32 ceiling, wrapping and resetting are prohibited: mark-unread is refused, and mark-read completes only if the resulting state has `override_active == false` — otherwise it fails visibly rather than reporting success over a still-live override. - **Tombstone floor:** a dead ever-active register compacts to `RegB(0, max(S,C), 0)` — a single `ov_c:` key. A virgin register is omitted entirely. This blocks counter reuse and the resulting resurrection. - **Mandatory canonical publication:** a protocol requirement, not an optimization. Publishing raw dead registers lets two independently-dead registers from different devices produce a live join. - **Override group co-location rule:** a context's frontier entry and all its `ov_*` siblings MUST travel in the same event, and that event MUST be the primary coordinate. An override-bearing context therefore has exactly one legal destination for its whole group; only frontier-only groups may be distributed across additional coordinates. Grouping is per logical context, never per key. - **Unescape-before-group rule:** the frontier wire key MUST be unescaped to its raw logical context ID before use as group identity. Equal normative weight to atomic grouping. - **Tie policy:** clear-wins is MUST. The tie verdict is not encoded on the wire, so a selectable policy makes two conforming clients diverge permanently on both the unread verdict and the canonical wire form. - **Override State Durability:** `ov_*` entries are exempt from age pruning and budget eviction permanently, and durability is defined over retrievable logical state — the containing event must stay reachable and the load must establish completeness, not merely retain keys. There is no safe finite GC horizon. - **Bounds and budget:** byte/key analysis at both small-counter and uint32-maximum values. Confining `ov_*` to one blob makes its plaintext budget a hard lifetime ceiling on ever-overridden contexts — roughly 600 tombstones at the worst-case ~54 bytes against 32 KiB, ~730 at the common ~45 bytes, ~199 simultaneously live overrides at ~164 bytes. At the ceiling a client MUST refuse mark-unread and MUST NOT split override state, drop floors, or publish a truncated override set. Same policy shape as counter exhaustion: visible failure, never silent degradation. - **Verification artifact:** `docs/formal/nip-rs-unread/`. The model is a broader predecessor of this NIP: its `split_blob_into_slots` permits override groups in any slot, so verified atomicity covers every arrangement this NIP allows, but the converse does not follow. The model does not verify the single-primary rule, the completeness procedure, the relay conformance requirements or the mutation fence, or carry-forward; malformed-group wire validation is likewise normative but outside verified scope. - **Abstract / Non-Goals / Backwards Compatibility:** the absolute "no relay-side logic" and "no relay behavior changes" claims are narrowed to what remains true — no new event kind, no new wire message, no relay-stored read-state logic — with the override layer's relay conformance contract named as the exception. Frontier sync and clients that skip the override layer are unaffected on any relay. ## Verification model (`docs/formal/nip-rs-unread/`) Four Python files constituting a bounded exhaustive verification model for the override layer's register algebra. **What it does:** constructs a toy universe — 2–3 devices, 2 channels, every action that can happen (mark-unread, mark-read, late/duplicate syncs, app reinstall, storage compaction) — and brute-forces every reachable ordering (14,258 BFS states; 672-point deep-history parameter cube; 9-mutant harness over ~45,000 merge pairs). After each world-state it asks: did all devices converge? Did any unread flag get resurrected after being cleared, or vanish while live? **What it found and fixed:** 1. **Killed candidate A.** The model produced a concrete kill sequence: an old client that doesn't know about the new field rewrites its read-state blob and silently erases unread flags. That witness is why the spec uses candidate B (two counters that only count up, plus a snapshot) instead. 2. **Candidate B passes everything.** All delivery orders converge; the frontier high-water mark never regresses; duplicated/replayed syncs are harmless; old clients can't destroy it; compaction never resurrects a dead unread or drops a live one, including cleanup-followed-by-weeks-late-stale-sync and tombstone-landing-on-unrelated-live-state corner cases. 3. **Caught a second real bug late.** Two devices each publishing "this unread is cleared" could, on merge, reactivate it. The fix (canonicalize before publishing) is a mandatory rule in the spec; the model re-checks it across ~45,000 merge pairs. **Scope and caveats:** bounded to 2–3 devices and 2 channels. Can't prove the infinite case. `NOTE.md` documents the exact verification scope and the gap between the model's `split_blob_into_slots` generality and the single-primary rule the spec adds on top. **Why it's in the repo:** the spec asserts "verified by bounded exhaustive model checking." Keeping the artifact in-repo means anyone who later amends the merge/compaction rules can `python3 exhaustive.py && python3 mutation.py` (deterministic, exit 0) and confirm the guarantees hold. Without it the spec claims a proof nobody can check. ## Diff scope `docs/nips/NIP-RS.md` — spec amendment, zero product code. `docs/formal/nip-rs-unread/{NOTE.md,model.py,exhaustive.py,mutation.py}` — bounded exhaustive verification model, zero product code. `.gitignore` — `__pycache__/` and `*.pyc` entries for the model directory. --------- Signed-off-by: Will Pfleger Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 --- .gitignore | 4 + docs/formal/nip-rs-unread/NOTE.md | 698 +++++++++++ docs/formal/nip-rs-unread/exhaustive.py | 1486 +++++++++++++++++++++++ docs/formal/nip-rs-unread/model.py | 492 ++++++++ docs/formal/nip-rs-unread/mutation.py | 519 ++++++++ docs/nips/NIP-RS.md | 289 ++++- 6 files changed, 3458 insertions(+), 30 deletions(-) create mode 100644 docs/formal/nip-rs-unread/NOTE.md create mode 100644 docs/formal/nip-rs-unread/exhaustive.py create mode 100644 docs/formal/nip-rs-unread/model.py create mode 100644 docs/formal/nip-rs-unread/mutation.py diff --git a/.gitignore b/.gitignore index 65ddcaf1c4..f26e74136c 100644 --- a/.gitignore +++ b/.gitignore @@ -3,6 +3,10 @@ /dist/ /admin-web/dist/ +# Python cache +__pycache__/ +*.pyc + # lefthook-generated hook scripts (machine-specific) .hooks/ diff --git a/docs/formal/nip-rs-unread/NOTE.md b/docs/formal/nip-rs-unread/NOTE.md new file mode 100644 index 0000000000..7472c3dca3 --- /dev/null +++ b/docs/formal/nip-rs-unread/NOTE.md @@ -0,0 +1,698 @@ +--- +title: "NIP-RS manual-unread: bounded exhaustive model — candidates A vs B" +tags: [nostr, nip-rs, read-state, formal-model, buzz] +status: active +created: 2026-07-16 +--- + +# NIP-RS manual-unread encoding model + +Bounded exhaustive model comparing two candidate CRDT encodings for a +manual mark-as-unread override layer within NIP-RS read state. + +## Run + +```bash +python3 exhaustive.py +python3 mutation.py +``` + +Both scripts are deterministic and exit 0 on success. + +## Context + +NIP-RS v1 encodes read state as grow-only `max(timestamp)` frontiers per +context. Manual mark-as-unread requires a second source of truth (an +override layer) because the frontier cannot be lowered — a lower value is +indistinguishable from a stale replica under `max()` merge. + +The override layer must converge across devices, survive legacy client +rewrite cycles, and remain bounded within the existing 32 KiB plaintext +budget. Two candidate encodings are modeled: + +- **A — lexicographic operation register:** per context, one register + `{counter, client_tiebreak, op, baseline}` in a NEW top-level field. +- **B — two grow-only counters + baseline:** per context, `S` (set + counter), `C` (clear counter), `B` (frontier-at-set-time) encoded as + sibling keys under `contexts`. + +## Model universe + +- 2 upgraded devices + 1 legacy device +- 2 contexts (`c0`, `c1`) +- Actions: mark-unread, mark-read (with frontier advance), + advance-frontier, compact, reinstall (client_id loss), + deliver (including duplicate/replay) +- BFS over canonical global states with interleaved actions and deliveries + (not phased), depth-bounded +- All delivery permutations of published blobs at terminal states +- Multi-slot union (split blob across 2 slots, deliver separately) +- Directed deep-history check: compact → new local actions (counter + reuse) → delayed stale delivery, over a 672-point parameter cube + (stale `(S,C,B)` × post-compaction frontier × 7 action sequences × + 2 tie policies × 1 delivery shape). The prior 2,016-point count + included two duplicate split-delivery shapes (`split_fwd`/`split_rev`) + that became semantically identical to `single` once the atomic-grouping + rule made a single-context compliant split always whole-register+empty; + collapsed to one meaningful shape without loss of register-level + coverage. +- Cross-device compaction transparency check: same tombstone, delivered + to an unrelated device with its own live concurrent state, over a + 312-point parameter cube (stale `(S,C,B)` × post-compaction frontier × + 4 fresh-frontier values × 2 tie policies), plus a monotonicity lemma + over 1,728 points (2 tie policies × 4×4×3×3 receiving-register/frontier + combinations × 6 ceiling values) proving the ceiling can never + *strengthen* a receiving register's set-counter standing +- States explored: 7,129 per tie policy (14,258 total) +- Published-state merge closure: every override is canonicalized against + the device's own effective frontier at serialization time before + hitting the wire (mandatory, not optional) — live unchanged, dead + folded to the tombstone floor, virgin omitted. Checked over a directed + witness (Thufir's exact dead+dead pair) plus a general search: every + pairwise join of a bounded cube of 300 independently-dead published + states (156 clear-wins + 144 set-wins = 300 total across both tie + policies), including a one-hop relay republication to cover + delayed/multi-hop delivery — 45,074 pairs checked total (156² + 144² + + 2 directed witnesses) + +## Invariants checked + +| # | Invariant | A | B (clear-wins) | B (set-wins) | +|---|-----------|---|-----------------|--------------| +| I1 | Join associative/commutative/idempotent | PASS | PASS | PASS | +| I2 | Convergence (all delivery orders) | not exercised | PASS | PASS | +| I3 | No frontier regression | not exercised | PASS | PASS | +| I4 | Concurrent set/clear winner stable | not exercised | PASS | PASS | +| I5 | Compaction: no loss, no resurrection (immediate merge-back) | n/a | PASS | PASS | +| I5c | Deep-history: compact → reuse → delayed stale delivery (same-device replay) | n/a | PASS | PASS | +| I5d | Cross-device compaction transparency (suppress-only, not zero-divergence) | n/a | PASS | PASS | +| I5e | Published-state merge closure: dead+dead join stays inactive | n/a | PASS | PASS | +| I6 | Replay harmless | not exercised | PASS | PASS | +| I7 | Legacy rewrite safety | **FAIL** (witness) | PASS | PASS | +| I8 | Bounded key growth (3 keys/ctx live, 1 key/ctx tombstone) | n/a | PASS | PASS | +| I9 | DeviceA counter absorption | PASS | n/a | n/a | + +Note: Candidate A is exercised only for I1, I7, and I9. BFS/convergence, +frontier-regression, concurrent-winner, and replay tests (I2–I4, I6) are +Candidate B-only; adding A variants would fail minimalism since A is already +dead on I7 (legacy-rewrite erasure). + +I5 covers the immediate compacted-vs-pre-compaction merge shape (both +merge orders). I5c is the same-device deep-history property this round +was originally opened to close: it directly targets the ~9-transition +history a depth-4 BFS cannot structurally reach (compact → new local +set/clear → delayed stale delivery, including from a second slot), +asserting that compaction never resurrects a dead override or drops a +live one **when the delayed delivery is the compacting device's own +pre-compaction ancestor** (or an exact copy of it, e.g. a peer that +never advanced past the original snapshot). + +**I5c does not cover, and NOTE.md previously overstated, the +cross-device case.** Compaction is a storage optimization from the +compacting device's own point of view — its dead register's baseline +`B` was frontier-relative to *that device's* history, and dropping `S` +in favor of the `C` ceiling is safe against replays of *its own* past. +But once published, the tombstone's `C` ceiling is globally comparable +via componentwise `max()`, while the baseline-relative death that +produced it is not. I5d proves the resulting property precisely: +merging in a tombstone can **suppress** — never resurrect, per the +`test_tombstone_merge_monotonic` structural lemma — a different +device's concurrent fresh set whose own counters happen to be at or +below the tombstone's ceiling, and the suppression always recovers with +one more local mark-unread (verified replay-stable against the same +tombstone). This is a one-shot false-negative risk, not a correctness +violation of the CRDT join (idempotent/commutative/associative still +hold per I1) and not new: an *uncompacted* stale explicit clear already +suppresses a fresh concurrent set under clear-wins with no compaction +anywhere (verified directly — see "Tie policy evidence" below); the +tombstone extends the same false-negative-preferring shape to +baseline-dominated dead sets that were never explicitly cleared. + +**I5e — published-state merge closure — is a protocol requirement, not +an optimization.** I5d's suppress-only guarantee assumes the tombstone +was actually on the wire before the merge. Nothing forces that: +`compact_b()`/`do_compact` are a local storage-GC transition a device +may or may not have called before it serializes. Without a mandatory +canonicalization step, `publish_blob()` can emit a register's *raw* +`(S, C, B)` — dead by construction (baseline-dominated, clear-dominated, +or a clear-wins tie) but not yet folded into the tombstone's +globally-comparable `C` ceiling. Two such raw-dead registers, published +by two different devices for unrelated reasons, can componentwise-max +into a **live** join: each register's `S` and `B` came from a different +device history, and the merge recombines them independent of either +history's own death cause. This is a distinct hazard from I5d's +suppression (I5d is a live register losing to a stale dead one; I5e's +witness is two dead registers producing a live one) but the same root +cause — components taken from independent histories can be +recombined in ways neither history's own frontier ever permitted. + +**Fix: canonical publication is mandatory, not advisory.** +`DeviceB.publish_blob()` now canonicalizes every override against the +device's own effective frontier at serialization time, unconditionally +— live unchanged (3 keys), dead folded to the tombstone floor `RegB(0, +max(S,C), 0)` (1 key), virgin omitted (0 keys) — regardless of whether +`do_compact` was ever called locally first. This is a **spec-amendment +requirement for any production client implementing this override +layer**: publication MUST canonicalize before serialization, the same +way it MUST advance the frontier monotonically. It is load-bearing +correctness, not a storage optimization a client can opt out of. +`do_compact` remains available separately to mutate a device's own +`self.overrides` for local storage-GC purposes; it is no longer a +prerequisite for correct publication, because publication no longer +depends on prior local state having been compacted. + +**Proof obligation closed:** `exhaustive.py::test_published_merge_closure` +checks two ways — Thufir's exact witness pair +(`RegB(3,2,0)`@baseline-dead-50 join `RegB(1,2,100)`@clear-dead-100, +raw join is live `RegB(3,2,100)`) as a directed case under both tie +policies, and a general search over every pairwise join of a bounded +cube of 300 independently-dead published states (156 clear-wins + 144 +set-wins = 300 total across both tie policies), including a one-hop +relay republication step to cover delayed/multi-hop delivery (a relay +that receives one operand alone and republishes — re-canonicalizing — +before forwarding). The 45,074 ordered pairs checked comes from +156² + 144² + 2 directed witnesses. `mutation.py::mutant_m7` reverts +`publish_blob` to the pre-fix raw-serialization behavior and reproduces +Thufir's exact resurrection witness directly, confirming the new +invariant has teeth. + +## Candidate comparison + +### Convergence + +Both candidates converge under all tested delivery permutations (algebraic +property). +Candidate B achieves this with componentwise `max()` merge (a standard +state-based CRDT join). Candidate A uses a register with lexicographic +tuple comparison — also convergent, but the register requires a +client-identity tiebreak field. (Convergence for Candidate B is verified +by exhaustive BFS over all reachable states; I2–I4 and I6 are exercised +for Candidate B only — see invariant table.) + +### Legacy compatibility matrix + +| Scenario | A | B | +|----------|---|---| +| Upgraded publishes, legacy reads blob | Legacy drops `overrides` field | Legacy preserves `ov_*` sibling keys | +| Legacy rewrites same slot | **Overrides erased** (expected-witness confirmed) | Sibling keys survive sanitization | +| Upgraded reads legacy-rewritten blob | Override state lost | Override state intact | +| Legacy reads its own frontier | Inert (correct) | Inert (correct) | +| Legacy frontier advance past baseline | Cannot clear override (erased) | Stale set dominated (correct) | + +**Candidate A's legacy erasure is the decisive defect.** The desktop and +mobile parsers (`readStateFormat.ts:82-108`, `read_state_format.dart:100-141`) +reconstruct only `{v, client_id, contexts}`. A same-slot legacy rewrite +drops the top-level `overrides` field entirely and republishes without it. +There is no safe migration path: any user with a single legacy device +loses all manual-unread state on the next rewrite cycle. + +Candidate B's sibling keys (`ov_s:`, `ov_c:`, `ov_b:`) pass all legacy +validation gates — keys are <= 256 UTF-8 bytes, values are uint32 — +and round-trip through legacy rewrite unmodified. + +**Legacy carry-through simplification (documented divergence).** Row +"Legacy preserves `ov_*` sibling keys" is proven two different ways in +this model, and they are not the same claim: + +- `legacy_sanitize_blob` — the byte-sanitization function alone (drop + keys >256 UTF-8 bytes or non-uint32 values) — genuinely preserves + unknown keys as opaque pass-through, matching production + `sanitizeContexts`. `test_legacy_rewrite_b` (I7) exercises exactly + this: an upgraded device's blob is sanitized and received by a + *second upgraded* device; the sibling keys survive because + sanitization never touches keys it doesn't recognize. +- `DeviceB(is_legacy=True)` — the explorer's legacy *device* object used + in the multi-device BFS (`exhaustive.py`) — does **not** carry + through `ov_*` keys it receives. `receive_merge` parses them into a + local dict but the store step is gated on `not self.is_legacy` + (`model.py:268`), so a legacy device's own `publish_blob` only ever + republishes its own frontier keys, never sibling keys it received + from an upgraded peer. This is a deliberate model simplification, not + a claim about production: production's legacy client is a single + `sanitizeContexts` pass with no in-memory override model to gate on, + so it forwards unknown keys unchanged; the model's `DeviceB` needed an + explicit legacy/upgraded split to represent "does not understand or + act on overrides" for the BFS explorer's mark-unread/mark-read action + space, and that split was implemented as drop-on-receive rather than + store-opaque-and-forward. +- **Why this doesn't hide a defect:** every invariant that asserts + sibling-key survival through a legacy hop (I7) is checked via the + sanitize function directly, never via a `DeviceB(is_legacy=True)` + relay round-trip — the two paths are never conflated in a single + assertion. The BFS explorer's own legacy-device transitions are also + gated: `enabled_transitions` only enqueues `mark_unread`/`mark_read`/ + `compact` for a device `if not d.is_legacy` (`exhaustive.py:118-124`), + so a legacy device in the BFS never even attempts to act on overrides; + `do_mark_unread`/`do_mark_read` (`model.py:210-222`) additionally + carry an explicit `if self.is_legacy: return` no-op guard as + defense-in-depth for the same property. `do_compact` + (`model.py:227-236`) carries no such explicit guard — it is a no-op + for a legacy device only *transitively*, because `self.overrides` + is never populated for one (every write path into `self.overrides` + is already gated on `not self.is_legacy`), so `do_compact` finds + `self.overrides.get(ctx)` is always `None` and returns immediately. + Either way, the drop-on-receive simplification never + changes the BFS's own convergence or compaction verdicts (I2, I3, I5, + I5c, I5d) — those are computed only over upgraded devices' + `override_is_set`. The one place a real production legacy client + *does* matter for override survival — sanitizing an upgraded device's + own re-published blob — is I7's scope, and I7 uses the accurate + function. +- **Implication for implementation:** production's `sanitizeContexts` + pass-through behavior is correct and required; this note exists so a + future reader of `DeviceB.receive_merge` doesn't mistake the model's + drop-on-receive simplification for a claim that legacy relaying loses + override state in production — it doesn't, per the function-level + proof above. + +### Identity dependence + +- **A requires client_id** for the tiebreak field. After reinstall + (new `client_id`), the tiebreak changes. Convergence is preserved only + because the counter is strictly higher; a same-counter reinstall would + create an ambiguous merge. +- **B needs no client identity** — componentwise `max()` is + identity-free. Confirmed: reinstall with new `client_id` preserves + convergence. + +### Bytes per manually-unread context + +Sizes computed with realistic context IDs. Envelope cost +(`{"v":1,"client_id":"...","contexts":{}}`) is ~60 bytes and shared +across all contexts — amortized to near zero per context. + +| Context type | Context ID example | ID length | Live override keys (3) | Tombstone key (1) | +|--------------|-------------------|-----------|------------------------|--------------------| +| Channel | `b68cd7cb-6f8d-4641-b743-a7349eb4114b` | 36 | 138 bytes | 45 bytes | +| Message | `msg:` + 64-hex event ID | 68 | 234 bytes | 77 bytes | +| Thread | `thread:` + 64-hex event ID | 71 | 243 bytes | 80 bytes | + +Live-override bytes are unchanged by the reserved-namespace escaping +(below): every context ID Buzz actually generates (channel UUID, +`msg:hex64`, `thread:hex64`) is a no-op under `escape_context_key` — none +begin with `ov_` or `esc:` — so the escape marker costs 0 bytes in the +common case. Tombstone bytes are new in this revision: canonical +publication no longer serializes a dead register at 3 keys (see +"Compaction behavior" below and "Published-state merge closure" above) +but a single `ov_c:` key with the counter ceiling — this is now the +literal output of `publish_blob()` for any dead override, not merely +the output of the optional `do_compact` storage-GC step. + +Breakdown for channel context (worst real-world common case, live): +``` +"ov_s:b68cd7cb-6f8d-4641-b743-a7349eb4114b":1 → 44 chars +"ov_c:b68cd7cb-6f8d-4641-b743-a7349eb4114b":0 → 44 chars +"ov_b:b68cd7cb-6f8d-4641-b743-a7349eb4114b":10 → 45 chars + total ≈ 138 bytes (+ 2 commas) +``` + +Tombstone floor for channel context (dead override after compaction): +``` +"ov_c:b68cd7cb-6f8d-4641-b743-a7349eb4114b":3 → 45 chars ≈ 45 bytes +``` + +Candidate A for comparison: `{"counter":1,"tiebreak":"dev0","op":"SET","baseline":10}` +≈ 56 bytes per context as a JSON object, plus the top-level `overrides` +field overhead. However, this is moot since A's top-level field is erased +by legacy clients. + +### Reserved key namespace + +NIP-RS v1 context IDs are arbitrary UTF-8 (spec `:89`, `:113-114`), so a +pre-existing opaque context could legitimately begin with `ov_s:`, +`ov_c:`, or `ov_b:` and, once flattened into the same `contexts` map, +be misparsed as a control key for a *different* context. + +**Reservation:** the 3-byte stem `ov_` and the escape marker `esc:` are +reserved at the spec-amendment level. A raw context ID that begins with +either is escaped on publish by prepending `esc:`, and unescaped on +receive by stripping exactly one leading `esc:` (`model.py: +escape_context_key`, `unescape_context_key`). This is a bijection, not +an idempotent no-op: a context literally named `esc:foo` escapes to +`esc:esc:foo` on the wire and unescapes back to exactly `esc:foo` on +receipt — the two operations are inverses, so no collision or data +loss occurs even for context IDs that already contain the marker. + +**Cost:** zero bytes for every context ID Buzz generates today (channel +UUID, `msg:hex64`, `thread:hex64` — none start with `ov_` or `esc:`). +Only a context ID that happens to start with the reserved stem pays the +4-byte `esc:` prefix. + +**Backward-compatibility limitation (Thufir's qualification — not a +collision-safe migration of existing data):** a context published +*unescaped* by a client that predates this amendment, and that happens +to start with `ov_` (e.g. an already-published, pre-existing +`ov_s:evil`-style context), is **not safely migrated** by this scheme. +Retroactive escaping cannot rewrite a blob the original publisher never +knew needed escaping — the codec protects contexts generated by +amendment-aware clients going forward, not history that predates the +amendment. This is a theoretical concern for the reasons in the +">256-byte key drop hazard" section: Buzz's own key shapes cannot +trigger it, and no legacy client is known to generate `ov_`-prefixed +context IDs. Documented as a residual, unsolved, backward-compatibility +gap — not modeled further — per the same practical-risk reasoning +already applied to the 256-byte hazard below. + +**Verified:** `exhaustive.py::test_reserved_namespace_collision` — a +context literally named `ov_s:evil` round-trips through publish/receive +as frontier state (not misparsed as an override), and a real override on +a *different* context in the same blob is unaffected. + +### Counter headroom (uint32) + +Each counter (S, C) is a uint32: 2^32 - 1 = 4,294,967,295. At one +toggle per second, ~136 years. No practical concern for manual +right-click actions. + +### >256-byte key drop hazard + +Legacy `sanitizeContexts` drops any key with `len(key.encode('utf-8')) > 256`. +Adding the `ov_s:` prefix (5 bytes) to a context key creates a key of +`len(context_id) + 5` bytes. If the original context key is at or near +the 256-byte limit, the prefixed override key exceeds it and is silently +dropped by legacy sanitization. + +In practice, context keys are UUIDs (36 bytes), hex event IDs (64-68 bytes), +or thread IDs (71 bytes) — all well under 256 bytes. The longest common +override key (`ov_b:thread:` + 64-hex = 76 bytes) has 180 bytes of +headroom. This hazard is theoretical but should be documented in the spec. + +### 10,000-key validation limit + +Legacy `isValidBlob` rejects blobs with >10,000 context keys. Live +override keys consume 3 entries per overridden context; a compacted +(tombstoned) override consumes 1: + +| Overridden contexts | Live override keys | Typical frontier keys | Total | Headroom | +|--------------------|---------------------|-----------------------|-------|----------| +| 50 | 150 | ~500 | 650 | 93.5% | +| 100 | 300 | ~1,000 | 1,300 | 87% | +| 500 | 1,500 | ~2,000 | 3,500 | 65% | +| 3,000 | 9,000 | ~1,000 | 10,000 | 0% (limit) | + +The 32 KiB byte budget is the binding constraint long before key count. + +### Compaction behavior (tombstone-floor, policy-dependent) + +**Revision note:** the prior "compacts to zero" design (delete-on- +dominance: a dead register was dropped entirely, 0 keys) is retracted. +Thufir's pass-3 review found a stale-replay resurrection: dropping all +`(S,C)` state made counters reusable, so a new local set/clear pair +restarting from `S=0,C=0` could be dominated by a delayed stale peer +snapshot on replay (`RegB(3,0,10)` → compact → `None` → local +set+clear → `RegB(1,2,20)` → stale replay merges in → `RegB(3,2,20)`, +`S>C`, resurrected). Fixed by a tombstone floor: any register with +recorded activity (S>0 or C>0) is *never* fully deleted — dead state +compacts to `RegB(0, max(S,C), 0)` instead of `None`. Only a virgin +register (never set, S==0 and C==0) has no ceiling to protect and +compacts to `None`. + +**The compaction rule is now uniform across the dead cases — the +per-branch table collapses to a single test:** + +| Condition | Clear-wins | Set-wins | +|-----------|-----------|----------| +| `override_set_b(reg)` is True (live) | Do not compact | Do not compact | +| `override_set_b(reg)` is False and `S>0 or C>0` (dead, ever-active) | Compact to tombstone floor `RegB(0, max(S,C), 0)` | Compact to tombstone floor (same) | +| `S == 0, C == 0` (virgin, never set) | Drop entirely (`None`) | Drop entirely (same) | + +Because `override_set_b` is already policy-aware, "live" vs. "dead" +differs by policy exactly where it did before (`S == C, S > 0` is dead +under clear-wins, live under set-wins) — the tombstone floor rule itself +does not need to branch on policy; `compact_b` calls `override_set_b` +once and only tombstones the false branch. + +Under clear-wins, a dead override compacts to the ~45-byte tombstone +(one `ov_c:` key, channel context) — **not** to zero, because `C` must +persist as the reuse-blocking ceiling. Under set-wins, `S == C` overrides +remain live and are never compacted (3 keys, ~138 bytes for channel +contexts) — unchanged from the prior revision. + +**Proof obligation closed (same-device replay):** +`exhaustive.py::test_deep_history_compaction` (672-point parameter +cube) and `test_tombstone_stale_merge_direct` verify no resurrection +and no loss of a genuinely-live override across the compact → +new-action → delayed-stale-delivery shape, for both tie policies. +`mutation.py::mutant_m4` +reverts to the old delete-on-dominance rule and reproduces the exact +resurrection witness (`final_reg=RegB(s=3, c=2, b=20)`, +`override_is_set=True`) — confirming the suite would have caught the +defect this round was opened to fix. + +**Proof obligation closed (cross-device transparency, requalified — +suppress-only, not zero-divergence):** +`exhaustive.py::test_cross_device_compaction_suppression` (312-point +cube: stale ancestor `(S,C,B)` × post-compaction frontier × 4 +fresh-frontier values on the receiving device × 2 tie policies) proves +every divergence between "receive the tombstone" and "receive the +uncompacted ancestor" is a suppression of an unrelated device's live +set — never a resurrection — and that every suppression recovers with +one more local mark-unread and stays recovered after re-receiving the +same tombstone. `test_tombstone_merge_monotonic` proves the direction +structurally (not just over the bounded cube): merging in a tombstone +`RegB(0, k, 0)` for any ceiling `k` can only raise the receiving +register's `C`, never its `S` or `B`, so it can only weaken — never +strengthen — the receiving register's live/dead standing under +`override_set_b`. Together these close the compaction-safety proof +obligation to exactly what it can honestly claim: no resurrection ever, +one-shot suppression is a known and recoverable false-negative risk +inherent to the clear-wins/tombstone design, not an unbounded +correctness gap. + +### GC/tombstone behavior + +**Override keys with `ov_` prefix (legacy prune):** Legacy +`pruneStaleContexts` only drops `msg:`/`thread:`-prefixed keys past the +7-day horizon. Unknown-prefix keys (including `ov_*`) are kept forever: + +- **Permanent tombstones:** every override that is ever compacted while + dead leaves a permanent `ov_c:` key (~45 bytes, channel context) — this + is no longer a "harmless, can shrink to zero" cost; it is a durable + floor kept forever to block stale-replay resurrection. This is the + direct storage consequence of fixing the CRITICAL above and must be + budgeted, not treated as free. +- **Live overrides:** an override still live (per `override_set_b`) + keeps all 3 keys (~138 bytes, channel context) until it becomes dead + and is compacted down to the tombstone. + +**Alternative: nesting under `msg:`/`thread:` prefixes** — confirmed +**state-loss hazard**. Legacy prune would delete overrides at the 7-day +horizon, silently losing active unread markers. Rejected. + +### Legacy trim interaction + +Legacy `trimContextsToBudget` evicts only `msg:`/`thread:` keys. +Override `ov_*` keys (including tombstones) are never evicted. Budget +analysis by context type, worst case (all overrides still live, 3 keys +each — the tombstone floor only ever *reduces* this cost): + +| Overridden contexts | Context type | Live override bytes | With ~10 KiB frontiers | Fits 32 KiB? | +|--------------------|-------------|----------------|----------------------|-------------| +| 50 | Channel (UUID) | ~6.9 KiB | ~16.9 KiB | Yes | +| 100 | Channel (UUID) | ~13.8 KiB | ~23.8 KiB | Yes | +| 150 | Channel (UUID) | ~20.7 KiB | ~30.7 KiB | Marginal | +| 50 | Message (hex64) | ~11.9 KiB | ~21.9 KiB | Yes | +| 100 | Message (hex64) | ~23.7 KiB | ~33.7 KiB | **No** | + +At the 100-override cap with every override compacted to its tombstone +floor instead: ~4.5 KiB (channel contexts, 100 × 45 bytes) — well +within budget alongside a full frontier set. The permanent-tombstone +floor from the CRITICAL fix costs storage but is bounded and small; it +does not change the 32 KiB conclusion below. + +**Mitigation:** Upgraded clients should compact aggressively (any dead +override, not just baseline-dominated ones) and enforce a cap on active +override count. A cap of 100 channel-context overrides keeps *live* +override budget under ~14 KiB and *tombstoned* budget under ~4.5 KiB, +both within the 32 KiB limit alongside a full frontier set. + +### Tie policy evidence: clear-wins vs set-wins + +Both tie policies pass all invariants. The choice is a product-semantics +decision: + +- **Clear-wins (S == C → read):** If two devices concurrently set and + clear the same context, the result is "read." Conservative — no + spurious unread badges. Matches the "I already read this" signal being + more definitive than the "remind me" signal. Compaction advantage: + `S == C` states are compactable. +- **Set-wins (S == C → unread):** Concurrent set and clear results in + "unread." Preserves the reminder intent. Risk: a user who reads on one + device while another has a stale mark-unread gets a persistent badge + they can't clear without an explicit action. Compaction disadvantage: + `S == C` states are live and cannot be compacted. + +**Recommendation:** Clear-wins. A false negative (missing badge) is +recovered by re-marking unread. A false positive (badge that won't clear) +is more frustrating. This matches Slack's behavior: reading anywhere +clears everywhere. The compaction advantage further favors clear-wins. + +**Pre-existing false-negative risk (independent of compaction).** Under +clear-wins, a stale explicit clear (`RegB(0,1,0)`, no compaction +involved) merging into a device with a fresh concurrent set +(`RegB(1,0,30)`) already produces `RegB(1,1,30)`, tied, suppressed — +verified directly by evaluating `merge_reg_b`/`override_set_b` on those +two registers with no `compact_b` call anywhere in the path. The +cross-device tombstone-suppression finding (I5d, "Compaction behavior" +above) is the same tie shape reached via a different route: a +baseline-dominated *dead set* (never explicitly cleared) that gets +compacted to a `C`-ceiling tombstone, which is then globally comparable +in a way its pre-compaction, frontier-relative death was not. Compaction +widens the set of histories that can reach the tie, but clear-wins +already accepted this one-shot, re-mark-recoverable false-negative shape +as its stated tradeoff. + +### Multi-slot union + +Production splits blobs across up to 8 slots (`READ_STATE_MAX_SLOTS`). +`mergeReadStateEvents` merges all slots with per-context `max()`. Override +sibling keys are individual context entries and follow the same merge path. + +**Atomic slot-grouping rule (spec-amendment requirement):** a context's +frontier entry and ALL of its `ov_*` sibling entries MUST travel in the +same slot, including during slot growth/rebalancing. This is the transport +half of the same closure property as mandatory canonical publication: + +- Without it, an observer holding only a slot containing `ov_s:ctx` (but + not `ov_b:ctx`) reconstructs `RegB(s=1, c=0, b=0)` — baseline-dead at + any nonzero frontier — and canonically publishes tombstone `RegB(0,1,0)`. + After full eventual delivery of all original slots plus that transient + tombstone, the merged result is `RegB(s=1, c=1, b=10)` — dead under + clear-wins — permanently suppressing a live override. +- With the rule, a receiver always sees either the complete register group + or none of it; partial reconstruction is structurally impossible from a + compliant publisher's output. + +Implementation: amend `splitContextsIntoBudgetedSlots` to round-robin +per-context groups (frontier key + all `ov_*` sibling keys for that context) +rather than per-entry. `DeviceB.split_blob_into_slots` in `model.py` models +this correctly. + +**Unescape-before-group rule (corollary — spec-amendment requirement):** +When grouping context entries, a frontier wire key MUST be unescaped to its +raw logical context ID before being used as the group key. A raw context ID +starting with a reserved prefix (e.g. `ov_s:evil`) escapes to +`esc:ov_s:evil` as its frontier wire key, while its `ov_*` siblings are +keyed by the raw suffix (`ov_s:evil`). Without unescaping the frontier key +before grouping, these resolve to different groups and the register splits +across slots — reproducing the same partial-reconstruction poison across +publication cycles via old/new slot-coordinate mixtures. Fix: derive group +identity via `unescape_context_key(wire_key)` for frontier keys. +`mutation.py::mutant_m9` reverts to escaped-key grouping and confirms +`test_escaped_context_slot_grouping` catches the witness. + +`mutation.py::mutant_m8` reverts to per-entry splitting (M8's split puts +frontier+`ov_s:` in slot 0 and `ov_b:`+`ov_c:` in slot 1) and confirms +`test_interleaved_delivery_grouping` catches Thufir's exact witness. + +This rule carries the same normative weight as mandatory canonical publication: +both are protocol requirements for any client implementing this override layer, +not optional optimizations. + +Confirmed: splitting a published blob across 2 grouped slots and delivering +each separately produces the same final override and frontier state as +delivering the full blob, regardless of delivery order. Interleaved-delivery +test (`test_interleaved_delivery_grouping`) additionally verifies that +receive-one-slot → re-publish → receive-rest permutations, including delayed +transient delivery to a third observer, preserve the live override verdict. + +## Mutation harness + +9 mutants, all caught with recorded counterexamples: + +| Mutant | Rule dropped | Counterexample | +|--------|-------------|----------------| +| M1 | Baseline dominance check | `RegB(1,0,10)` at frontier=100: correct=inactive, mutant=active (stale set persists) | +| M2 | `max(S,C)+1` counter bump | After set→set→clear: correct `RegB(2,3,10)` (clear wins), mutant `RegB(2,1,10)` (set persists) | +| M3 | Tie policy | `RegB(1,1,10)` at frontier=10: clear-wins=False, set-wins=True | +| M4 | Tombstone-floor compaction (delete-on-dominance revert) | `RegB(3,0,10)` at frontier=20 compacts to `None` (vs. tombstone `RegB(0,3,0)`); local set+clear reuses counters from zero; delayed stale replay resurrects — `final_reg=RegB(s=3,c=2,b=20)`, `override_is_set=True` (reproduces Thufir's pass-3 CRITICAL) | +| M5 | uint32 value range | Value 4,294,967,296 rejected by legacy sanitization | +| M6 | Componentwise-max merge | LWW delivery-order-dependent: convergence breaks under permutation | +| M7 | Canonical publication (raw register serialization) | `RegB(3,2,0)`@frontier-50 join `RegB(1,2,100)`@frontier-100 = live `RegB(3,2,100)` (reproduces Thufir's pass-1/2 CRITICAL dead+dead resurrection) | +| M8 | Atomic slot-grouping rule (per-entry split) | Live `RegB(1,0,10)` at frontier=10 split as `{frontier+ov_s:}` / `{ov_b:+ov_c:}`; partial observer reconstructs `RegB(1,0,0)`, publishes tombstone `RegB(0,1,0)`; final merge = `RegB(1,1,10)` → inactive (reproduces Thufir's pass-2/2 CRITICAL transport witness) | +| M9 | Unescape-before-group rule (escaped-key grouping) | Live override on raw ctx `ov_s:evil` (frontier wire key `esc:ov_s:evil`); escaped-key grouping splits frontier from `ov_*` siblings; old/new slot-coordinate mixture → `RegB(1,0,0)` → tombstone `RegB(0,1,0)` → final merge = `RegB(1,1,10)` → inactive (reproduces Thufir's round-2 CRITICAL) | + +Each mutant is injected into the model via DeviceB subclass (M1, M2, M4, +M6, M7, M8, M9) or direct function evaluation (M3, M5), then the applicable +invariant suite is rerun. M4 reverts to the pre-fix delete-on-dominance +compaction rule and directly reproduces Thufir's pass-3 CRITICAL resurrection +witness — the exact `RegB(3,0,10)` → `None` → counter-reuse → stale +replay → `RegB(3,2,20)`,`override_is_set=True` sequence — with a +fallback to the directed deep-history cube (`test_deep_history_compaction`) +if the hand-built scenario doesn't trigger under a given tie policy. M7 +reverts `publish_blob` to raw serialization and reproduces Thufir's pass-1/2 +CRITICAL dead+dead resurrection. M8 reverts `split_blob_into_slots` to +per-entry assignment (frontier+`ov_s:` / `ov_b:`+`ov_c:`) and reproduces +Thufir's pass-2/2 CRITICAL transport witness via `test_interleaved_delivery_grouping`. +M9 reverts `split_blob_into_slots` to escaped-key grouping (groups frontier by +its wire key instead of its unescaped logical ID) and reproduces Thufir's +round-2 CRITICAL for escaped contexts via `test_escaped_context_slot_grouping`. + +## Recommendation + +**Candidate B (two grow-only counters + baseline) with clear-wins tie +policy.** + +Evidence: + +1. **Legacy safety:** B's sibling keys survive legacy rewrite; A's + top-level field is erased. Hard blocker for A — no migration path + tolerates a single legacy device. +2. **Identity-free:** B needs no client_id for correctness; A's + tiebreak creates a reinstall fragility. +3. **CRDT properties:** Candidate B passes all merge invariants (I2–I8) in + the exhaustive model. Candidate A's join is also correct algebraically + (I1, I9), but I2–I4 and I6 are not exercised for A — A is dead on I7 + regardless. B's componentwise max is simpler and more standard. +4. **Bytes:** B at 3 live keys costs 138 bytes/context (channel UUID) to + 243 bytes/context (thread hex64); a dead override compacts to a single + ~45-80 byte tombstone key instead. Cap of 100 overrides stays within + 32 KiB budget for both live and tombstoned cases. +5. **Compaction:** B supports safe policy-aware compaction — no + resurrection, ever (proved structurally, not just over a bounded + cube). Clear-wins allows compacting `S == C` states (set-wins does + not). Cross-device delivery of a tombstone can one-shot suppress an + unrelated device's concurrent fresh set whose counters are at or + below the tombstone's ceiling; this is recoverable by re-marking and + is the same false-negative shape clear-wins already accepts for a + stale explicit clear with no compaction involved (see "Tie policy + evidence"). +6. **Tie policy:** Clear-wins avoids persistent false-positive badges + and enables more aggressive compaction. + +## Honest limits + +- The model enumerates bounded abstract operations, not real encrypted + NIP-59 payloads or relay replacement semantics. +- Counter values in the general BFS explorer are bounded by its exploration + depth (max ~4 via BFS depth 4); the directed deep-history cube + (`test_deep_history_compaction`) reaches counter values up to the stale + parameter range (0-3) plus post-compaction action sequences, covering the + ~9-transition witness the BFS explorer cannot structurally reach. Real + uint32 overflow/wrap is tested only via the legacy sanitization mutant (M5). +- The BFS explorer (I5/I5c) checks compaction safety over reachable + multi-device histories up to depth 4, but its own terminal-state + compaction check (`check_compaction_safety`) only merges a device's + compacted register with its *own* pre-compaction snapshot — it does + not, by construction, exercise an unrelated device's independently- + live concurrent register. `test_cross_device_compaction_suppression` + (I5d) covers that shape directly but over a hand-parameterized cube, + not the full BFS state space; the accompanying + `test_tombstone_merge_monotonic` lemma is what extends the + no-resurrection guarantee beyond the cube's specific points. +- Two contexts are modeled. Production users may have hundreds of contexts, + but the CRDT properties are per-context — cross-context interactions are + limited to the shared byte budget (tested via trim/prune interaction). +- Multi-slot behavior is confirmed via split+merge convergence test, and + the atomic slot-grouping rule is modeled by `DeviceB.split_blob_into_slots` + (including the escaped-context identity fix — `split_blob_into_slots` + unescapes frontier keys before grouping). The production TypeScript + implementation (`splitContextsIntoBudgetedSlots`) is NOT modeled — only + the abstract grouping property is verified here. Implementation-level + testing is still needed for slot placement, slot rebalancing, and the + production d-tag coordinate assignment. +- The model assumes eventual delivery (all blobs eventually reach all + devices). Permanent message loss is not modeled. +- Byte sizes are computed from JSON serialization of realistic key names. + Actual encrypted blob overhead (NIP-59 envelope, relay metadata) adds + to the total but does not affect the 32 KiB plaintext budget. diff --git a/docs/formal/nip-rs-unread/exhaustive.py b/docs/formal/nip-rs-unread/exhaustive.py new file mode 100644 index 0000000000..82d54c6b43 --- /dev/null +++ b/docs/formal/nip-rs-unread/exhaustive.py @@ -0,0 +1,1486 @@ +"""Bounded transition-system explorer for NIP-RS manual-unread candidates. + +BFS over canonical global states. At each depth, enabled transitions are +local actions and message deliveries, interleaved — not phased. + +Universe: 2 upgraded devices + 1 legacy device, 2 contexts. +Transitions: mark_unread, mark_read (with frontier advance), + advance_frontier, compact, reinstall, deliver (including + duplicate/replay). Legacy rewrite semantics are exercised through the + deliver path (legacy_sanitize_and_publish), not as a separate + transition — a legacy device never mutates its own state outside + delivery, so a dedicated no-op transition added nothing (see NOTE.md). + +Invariants: + I1 merge_reg_b associative/commutative/idempotent + I2 convergence: all delivery orders -> identical override verdict + I3 no frontier regression + I4 concurrent set/clear winner stable (order-independent, ancestor-independent) + I5 compaction: no loss of live set, no resurrection of dead clear, + survives merge with stale pre-compaction state + I5c directed deep-history: compact -> new local actions (counter reuse) + -> delayed stale delivery does not resurrect a dead override or + lose a genuinely-live one. Scope: the compacting device's own + pre-compaction ancestor (or an exact copy of it) replayed back to + that same device. + I5d cross-device compaction transparency (requalified, NOT + zero-divergence): a tombstone's counter ceiling can one-shot + suppress an unrelated device's concurrent fresh set with no + resurrection, and the suppression is always recoverable by one + more local action. Proven suppress-only direction via a bounded + witness cube plus a structural monotonicity argument. + I6 replay harmless + I7 legacy rewrite: B sibling keys survive / A overrides erased (witness) + I8 bounded key growth per context + I9 DeviceA post-receive counter absorption +""" +from itertools import permutations +from copy import deepcopy +from model import ( + RegB, merge_reg_b, override_set_b, compact_b, + RegA, merge_reg_a, + DeviceB, DeviceA, + SET, CLEAR, + legacy_prune, legacy_trim, legacy_sanitize_blob, + escape_context_key, unescape_context_key, ESCAPE_PREFIX, +) + +CONTEXTS = ("c0", "c1") +FRONTIER_VALS = (10, 20) + + +# --------------------------------------------------------------------------- +# I1: algebraic properties +# --------------------------------------------------------------------------- + +def test_merge_algebra_b(): + vals = [0, 1, 2, 3] + regs = [RegB(s, c, b) for s in vals for c in vals for b in vals] + violations = [] + for a in regs: + if merge_reg_b(a, a) != a: + violations.append(("idempotent", a)) + for a in regs: + for b in regs: + if merge_reg_b(a, b) != merge_reg_b(b, a): + violations.append(("commutative", a, b)) + for a in regs: + for b in regs: + for c in regs: + if merge_reg_b(merge_reg_b(a, b), c) != merge_reg_b(a, merge_reg_b(b, c)): + violations.append(("associative", a, b, c)) + return violations + + +def test_merge_algebra_a(): + vals = [0, 1, 2] + tiebreaks = ["a", "b"] + ops = [SET, CLEAR] + baselines = [0, 10] + regs = [RegA(ct, t, o, bl) + for ct in vals for t in tiebreaks for o in ops for bl in baselines] + violations = [] + for tie_op in [CLEAR, SET]: + for a in regs: + if merge_reg_a(a, a, tie_op) != a: + violations.append(("idempotent", tie_op, a)) + for a in regs: + for b in regs: + if merge_reg_a(a, b, tie_op) != merge_reg_a(b, a, tie_op): + violations.append(("commutative", tie_op, a, b)) + for a in regs: + for b in regs: + for c in regs: + ab_c = merge_reg_a(merge_reg_a(a, b, tie_op), c, tie_op) + a_bc = merge_reg_a(a, merge_reg_a(b, c, tie_op), tie_op) + if ab_c != a_bc: + violations.append(("associative", tie_op, a, b, c)) + return violations + + +# --------------------------------------------------------------------------- +# BFS state explorer — Candidate B +# --------------------------------------------------------------------------- + +def next_frontier(device, ctx): + cur = device.effective_frontier(ctx) + for fv in FRONTIER_VALS: + if fv > cur: + return fv + return None + + +def enabled_transitions(devices, tie_policy): + """Generate (kind, args) tuples for all enabled transitions.""" + trans = [] + for di, d in enumerate(devices): + for ctx in CONTEXTS: + if not d.is_legacy: + trans.append(("mark_unread", di, ctx)) + fv = next_frontier(d, ctx) + if fv is not None: + trans.append(("mark_read", di, ctx, fv)) + if ctx in d.overrides: + trans.append(("compact", di, ctx)) + fv = next_frontier(d, ctx) + if fv is not None: + trans.append(("advance", di, ctx, fv)) + if not d.is_legacy: + trans.append(("reinstall", di)) + for si in range(len(devices)): + for di in range(len(devices)): + if si != di: + trans.append(("deliver", si, di)) + return trans + + +def apply_transition(devices, t, tie_policy): + kind = t[0] + if kind == "mark_unread": + devices[t[1]].do_mark_unread(t[2]) + elif kind == "mark_read": + devices[t[1]].do_mark_read(t[2], t[3]) + elif kind == "advance": + devices[t[1]].do_advance_frontier(t[2], t[3]) + elif kind == "compact": + devices[t[1]].do_compact(t[2], tie_policy) + elif kind == "reinstall": + devices[t[1]].do_reinstall() + elif kind == "deliver": + src = devices[t[1]] + dst = devices[t[2]] + if src.is_legacy: + blob = src.legacy_sanitize_and_publish(tie_policy) + else: + blob = src.publish_blob(tie_policy) + dst.receive_merge(blob) + + +def state_sig(devices, tie_policy): + return tuple(d.state_key(CONTEXTS, tie_policy) for d in devices) + + +def check_convergence(devices, tie_policy, trace, violations): + """Publish all blobs, deliver in every order, check upgraded devices + converge on override_is_set for each context. + + Tests with latest_ts=5 (below all frontiers) so the override is the + sole unread source — no masking by natural unread. + """ + blobs = [] + for d in devices: + if d.is_legacy: + blobs.append(d.legacy_sanitize_and_publish(tie_policy)) + else: + blobs.append(d.publish_blob(tie_policy)) + + verdicts_per_order = [] + for perm in permutations(range(len(blobs))): + receivers = deepcopy(devices) + for idx in perm: + for r in receivers: + r.receive_merge(blobs[idx]) + per_device = [] + for r in receivers: + if not r.is_legacy: + per_device.append( + tuple(r.override_is_set(ctx, tie_policy) for ctx in CONTEXTS) + ) + verdicts_per_order.append(tuple(per_device)) + + if len(set(verdicts_per_order)) > 1: + violations.append(("I2-convergence", trace, set(verdicts_per_order))) + + +def check_compaction_safety(devices, tie_policy, trace, violations): + """For each upgraded device with overrides: + 1. Check override_is_set directly (not via verdict/latest_ts). + 2. Compact and verify override_is_set unchanged. + 3. Merge compacted state with stale pre-compaction state in both orders. + Verify no resurrection and no loss. + """ + for di, d in enumerate(devices): + if d.is_legacy: + continue + for ctx in CONTEXTS: + reg = d.overrides.get(ctx) + if reg is None: + continue + front = d.effective_frontier(ctx) + ov_before = d._override_set(reg, front, tie_policy) + compacted = d._compact(reg, front, tie_policy) + ov_after = d._override_set(compacted, front, tie_policy) if compacted else False + + if ov_before and not ov_after: + violations.append(( + "I5-compaction-lost-set", trace, di, ctx, + reg, compacted, front, tie_policy + )) + if not ov_before and ov_after: + violations.append(( + "I5-compaction-resurrection", trace, di, ctx, + reg, compacted, front, tie_policy + )) + + if compacted is not None: + for merged in [merge_reg_b(compacted, reg), merge_reg_b(reg, compacted)]: + ov_merged = d._override_set(merged, front, tie_policy) + if not ov_before and ov_merged: + violations.append(( + "I5-compaction-merge-resurrection", trace, di, ctx, + reg, compacted, merged + )) + + +def explore_b(max_depth=4, tie_policy=CLEAR, device_cls=DeviceB): + """BFS over all reachable global states up to max_depth. + + Returns (states_explored, violations). + Accepts device_cls for mutation testing via subclassing. + """ + def make_devices(): + return [ + device_cls("d0", is_legacy=False), + device_cls("d1", is_legacy=False), + device_cls("d2", is_legacy=True), + ] + + violations = [] + seen = set() + states_explored = 0 + queue = [(make_devices(), [])] + + while queue: + devices, trace = queue.pop(0) + sig = state_sig(devices, tie_policy) + if sig in seen: + continue + seen.add(sig) + states_explored += 1 + + for di, d in enumerate(devices): + for ctx in CONTEXTS: + prev_front = d.effective_frontier(ctx) + if prev_front < 0: + violations.append(("I3-frontier-negative", trace, di, ctx)) + + if len(trace) >= max_depth: + check_convergence(devices, tie_policy, trace, violations) + check_compaction_safety(devices, tie_policy, trace, violations) + continue + + for t in enabled_transitions(devices, tie_policy): + new_devs = deepcopy(devices) + fronts_before = { + (di, ctx): d.effective_frontier(ctx) + for di, d in enumerate(new_devs) for ctx in CONTEXTS + } + apply_transition(new_devs, t, tie_policy) + + # Reinstall intentionally wipes local state; frontier regression + # is only invalid during merge/delivery/compaction/advance. + if t[0] != "reinstall": + for (di, ctx), fb in fronts_before.items(): + fa = new_devs[di].effective_frontier(ctx) + if fa < fb: + violations.append(("I3-frontier-regression", trace + [t], di, ctx, fb, fa)) + + queue.append((new_devs, trace + [t])) + + return states_explored, violations + + +# --------------------------------------------------------------------------- +# I4: concurrent set/clear winner stable +# --------------------------------------------------------------------------- + +def test_concurrent_stability(device_cls=DeviceB): + """Two devices concurrently set and clear from every possible ancestor state. + The winner must be the same regardless of delivery order AND ancestor state.""" + violations = [] + for tie_policy in [CLEAR, SET]: + for pre_s, pre_c in [(0, 0), (1, 0), (0, 1), (2, 1), (1, 2), (1, 1)]: + for front in [0, 10]: + for ctx in CONTEXTS: + ancestor = RegB(s=pre_s, c=pre_c, b=front) + + d0 = device_cls("d0") + d0.frontier[ctx] = front + d0.overrides[ctx] = deepcopy(ancestor) + d1 = device_cls("d1") + d1.frontier[ctx] = front + d1.overrides[ctx] = deepcopy(ancestor) + + d0.do_mark_unread(ctx) + d1.do_mark_read(ctx, front + 10) + + blob0 = d0.publish_blob(tie_policy) + blob1 = d1.publish_blob(tie_policy) + + verdicts = set() + for first, second in [(blob0, blob1), (blob1, blob0)]: + r = device_cls("recv") + r.frontier[ctx] = front + r.overrides[ctx] = deepcopy(ancestor) + r.receive_merge(first) + r.receive_merge(second) + verdicts.add(r.override_is_set(ctx, tie_policy)) + + if len(verdicts) > 1: + violations.append(( + "I4-unstable", tie_policy, ctx, + pre_s, pre_c, front + )) + return violations + + +# --------------------------------------------------------------------------- +# I5: direct compaction register-level check (all register values x policies) +# --------------------------------------------------------------------------- + +def test_compaction_register_exhaustive(): + """Exhaustive check over bounded register cube and frontier values. + Tests override_is_set directly — no latest_ts masking.""" + violations = [] + vals = [0, 1, 2, 3] + frontiers = [0, 10, 20] + for tie_policy in [CLEAR, SET]: + for s in vals: + for c in vals: + for b in frontiers: + for fv in frontiers: + reg = RegB(s=s, c=c, b=b) + ov_before = override_set_b(reg, fv, tie_policy) + compacted = compact_b(reg, fv, tie_policy) + ov_after = (override_set_b(compacted, fv, tie_policy) + if compacted else False) + + if ov_before and not ov_after: + violations.append(( + "loss", tie_policy, reg, fv, compacted + )) + if not ov_before and ov_after: + violations.append(( + "resurrection", tie_policy, reg, fv, compacted + )) + + if compacted is not None: + merged_fwd = merge_reg_b(compacted, reg) + merged_rev = merge_reg_b(reg, compacted) + for label, merged in [("fwd", merged_fwd), ("rev", merged_rev)]: + ov_merged = override_set_b(merged, fv, tie_policy) + if not ov_before and ov_merged: + violations.append(( + f"merge-resurrection-{label}", + tie_policy, reg, fv, compacted, merged + )) + return violations + + +# --------------------------------------------------------------------------- +# I5c: directed deep-history — compact -> new actions (counter reuse) -> +# delayed stale delivery (including split across two slots) +# --------------------------------------------------------------------------- + +def _apply_action_seq(dev, ctx, seq, ts): + for a in seq: + if a == "set": + dev.do_mark_unread(ctx) + else: + dev.do_mark_read(ctx, ts) + + +def _ancestor_ctx_dict(ctx, reg): + return {f"ov_s:{ctx}": reg.s, f"ov_c:{ctx}": reg.c, f"ov_b:{ctx}": reg.b} + + +_DEEP_HISTORY_ACTION_SEQS = [ + (), ("set",), ("clear",), ("set", "clear"), ("clear", "set"), + ("set", "set"), ("clear", "clear"), +] +# One delivery shape: single unsplit blob. The prior "split_fwd"/"split_rev" +# shapes are no longer distinct — with the atomic-grouping rule a single- +# context blob's compliant split puts the whole group in one slot and the +# other empty, making split_fwd and split_rev semantically identical to +# single. Keeping only one shape avoids 2/3 duplicate executions (2,016 → +# 672 meaningful points) while losing zero register-level coverage. +_DEEP_HISTORY_DELIVERY_SHAPES = ("single",) + + +def test_deep_history_compaction(device_cls=DeviceB): + """Directed check over the exact shape a depth-4 BFS structurally + cannot reach (~9 transitions): compact -> new local set/clear actions + (counter reuse against the tombstone floor) -> delayed delivery of + the pre-compaction stale ancestor, including split across 2 slots. + + Oracle: compaction is a storage optimization and must never change + the semantic outcome. A reference device that never compacts, given + the identical ancestor / frontier advance / action sequence / late + ancestor delivery, must reach the same override_is_set verdict as + the compacting device. This directly targets Thufir's counterexample + (RegB(3,0,10) -> None under delete-on-dominance -> counter reuse -> + RegB(3,2,20) resurrection) and requires the tombstone floor from + compact_b to hold under it. + + Returns (cube_size, violations). + """ + violations = [] + cube_size = 0 + ctx = "c0" + stale_vals = (0, 1, 2, 3) + baselines = (0, 10) + post_frontiers = (10, 20) + + for s0 in stale_vals: + for c0 in stale_vals: + for b0 in baselines: + for f1 in post_frontiers: + if f1 <= b0: + continue # not a dominance/compaction scenario + ancestor = RegB(s=s0, c=c0, b=b0) + ancestor_blob = _ancestor_ctx_dict(ctx, ancestor) + for seq in _DEEP_HISTORY_ACTION_SEQS: + for tie_policy in (CLEAR, SET): + for shape in _DEEP_HISTORY_DELIVERY_SHAPES: + cube_size += 1 + + dev = device_cls("d0") + dev.frontier[ctx] = b0 + dev.overrides[ctx] = ancestor + dev.do_advance_frontier(ctx, f1) + dev.do_compact(ctx, tie_policy) + _apply_action_seq(dev, ctx, seq, f1) + + if shape == "single": + dev.receive_merge({"contexts": dict(ancestor_blob)}) + ov_after = dev.override_is_set(ctx, tie_policy) + + ref = device_cls("ref") + ref.frontier[ctx] = b0 + ref.overrides[ctx] = ancestor + ref.do_advance_frontier(ctx, f1) + _apply_action_seq(ref, ctx, seq, f1) + ref.receive_merge({"contexts": dict(ancestor_blob)}) + ov_ref = ref.override_is_set(ctx, tie_policy) + + if ov_after != ov_ref: + violations.append(( + "I5c-deep-history-divergence", tie_policy, shape, + ancestor, f1, seq, + f"compacted_path={ov_after}", f"reference={ov_ref}", + )) + return cube_size, violations + + +def test_tombstone_stale_merge_direct(): + """Tombstone floor merged directly with its own pre-compaction stale + ancestor (no intervening local actions) must not resurrect and must + not exceed the ancestor's own verdict.""" + violations = [] + vals = (0, 1, 2, 3) + frontiers = (0, 10, 20) + for tie_policy in (CLEAR, SET): + for s in vals: + for c in vals: + for b in frontiers: + for fv in frontiers: + if fv <= b: + continue + reg = RegB(s=s, c=c, b=b) + compacted = compact_b(reg, fv, tie_policy) + if compacted is None: + continue # virgin register: nothing to tombstone + ov_before = override_set_b(reg, fv, tie_policy) + for merged in (merge_reg_b(compacted, reg), merge_reg_b(reg, compacted)): + ov_merged = override_set_b(merged, fv, tie_policy) + if not ov_before and ov_merged: + violations.append(( + "tombstone-stale-merge-resurrection", + tie_policy, reg, fv, compacted, merged, + )) + return violations + + +# --------------------------------------------------------------------------- +# I5d: cross-device compaction transparency (requalified — suppress-only, +# NOT zero-divergence) + re-mark recovery +# --------------------------------------------------------------------------- + +def test_tombstone_merge_monotonic(): + """Structural lemma: merging in ANY tombstone RegB(0, k, 0) is a + monotonically non-increasing function of the ceiling k in + override_set_b's boolean output, for a fixed receiving register and + frontier. A tombstone only ever adds to C (its S and B are both 0, + so max() with any receiving register leaves that register's own S + and B untouched) — raising C can only weaken S's relative standing, + never strengthen it. This is what makes resurrection structurally + impossible and suppression the only possible direction, independent + of any bounded cube. + """ + violations = [] + vals = (0, 1, 2, 3) + baselines = (0, 10, 20) + ceilings = (0, 1, 2, 3, 4, 5) + for tie_policy in (CLEAR, SET): + for s in vals: + for c in vals: + for b in baselines: + for fv in baselines: + x_reg = RegB(s=s, c=c, b=b) + prev = None + for k in ceilings: + merged = merge_reg_b(x_reg, RegB(s=0, c=k, b=0)) + cur = override_set_b(merged, fv, tie_policy) + if prev is not None and cur and not prev: + violations.append(( + "I5d-non-monotonic-ceiling", tie_policy, + x_reg, fv, k, merged, + )) + prev = cur + return violations + + +def test_cross_device_compaction_suppression(device_cls=DeviceB): + """Compaction is NOT semantically transparent cross-device (I5c only + covers the same-device replay shape). A tombstone re-encodes + baseline-dominated death — frontier-relative, doesn't transfer + across devices — as a clear-counter ceiling — globally comparable — + so it can one-shot suppress an unrelated device's concurrent fresh + set whose own counters don't exceed that ceiling. + + Witness (Paul's report, illustrative — the cube below tests nearby + parameter values `f_x` in `(5, 15, 25, 35)`, not the literal + `f_x=30` used in the original report; the shape is the same): + Y: mark_unread -> RegB(1,0,0); frontier->10 (dead) -> compact -> + tombstone RegB(0,1,0) + X: offline, fresh mark_unread at frontier 30 -> RegB(1,0,30), LIVE + X merges Y's tombstone -> RegB(1,1,30) -> suppressed (clear-wins) + Control (Y publishes the uncompacted RegB(1,0,0) instead): X stays + RegB(1,0,30), LIVE — the divergence is caused by compaction, not + by the merge itself. + + Proves over a bounded cube, both tie policies: every divergence + between "X merges Y's tombstone" and "X merges Y's uncompacted + ancestor" is a suppression (never a resurrection — that would + contradict test_tombstone_merge_monotonic), and every suppression + recovers with one more local mark-unread, stable under tombstone + replay. + + Returns (cube_size, suppress_count, violations). + """ + violations = [] + cube_size = 0 + suppress_count = 0 + dead_vals = (0, 1, 2, 3) + dead_baselines = (0, 10) + dead_post_frontiers = (10, 20) + fresh_frontiers = (5, 15, 25, 35) + + for tie_policy in (CLEAR, SET): + for s_y in dead_vals: + for c_y in dead_vals: + for b_y in dead_baselines: + for f_y in dead_post_frontiers: + if f_y <= b_y: + continue + ancestor = RegB(s=s_y, c=c_y, b=b_y) + tomb = compact_b(ancestor, f_y, tie_policy) + if tomb is None or tomb == ancestor: + continue # virgin, or was live (not compacted) + + for f_x in fresh_frontiers: + cube_size += 1 + x_reg = RegB(s=1, c=0, b=f_x) + x_before = override_set_b(x_reg, f_x, tie_policy) + if not x_before: + violations.append(( + "I5d-setup-not-live", tie_policy, x_reg, f_x, + )) + continue + + ov_tomb = override_set_b( + merge_reg_b(x_reg, tomb), f_x, tie_policy + ) + ov_ancestor = override_set_b( + merge_reg_b(x_reg, ancestor), f_x, tie_policy + ) + + if ov_tomb == ov_ancestor: + continue + if ov_tomb and not ov_ancestor: + violations.append(( + "I5d-resurrection-vs-ancestor", tie_policy, + ancestor, tomb, x_reg, f_x, + )) + continue + + suppress_count += 1 + dev = device_cls("x") + dev.frontier["c0"] = f_x + dev.overrides["c0"] = merge_reg_b(x_reg, tomb) + dev.do_mark_unread("c0") + if not dev.override_is_set("c0", tie_policy): + violations.append(( + "I5d-recovery-failed", tie_policy, + ancestor, tomb, x_reg, f_x, dev.overrides["c0"], + )) + continue + dev.receive_merge({"contexts": { + "ov_s:c0": tomb.s, "ov_c:c0": tomb.c, "ov_b:c0": tomb.b, + }}) + if not dev.override_is_set("c0", tie_policy): + violations.append(( + "I5d-recovery-not-replay-stable", tie_policy, + ancestor, tomb, x_reg, f_x, dev.overrides["c0"], + )) + + return cube_size, suppress_count, violations + + +# --------------------------------------------------------------------------- +# New invariant: published-state merge closure (Paul's fix-scope item 2, +# generalizing Thufir's pass-1/2 CRITICAL — dead+dead merge resurrection) +# --------------------------------------------------------------------------- + +def _dead_register_points(tie_policy): + """Bounded cube of (label, reg, frontier) points independently + verified DEAD (inactive) under `tie_policy` by the real + `override_set_b` predicate — the death cause (baseline dominance, + clear-count dominance, or clear-wins tie) is whatever the predicate + actually computes for that point, not asserted by construction. + """ + vals = (0, 1, 2, 3) + baselines = (0, 10, 50) + frontiers = (0, 20, 60, 100) + points = [] + for s in vals: + for c in vals: + if s == 0 and c == 0: + continue # virgin: not a "dead override" case + for b in baselines: + for fv in frontiers: + reg = RegB(s=s, c=c, b=b) + if override_set_b(reg, fv, tie_policy): + continue # live: out of scope for this invariant + points.append((f"s={s}c={c}b={b}fv={fv}", reg, fv)) + return points + + +def test_published_merge_closure(device_cls=DeviceB): + """Over reachable *published* states: joining any two individually- + inactive published states must remain inactive. + + This targets Thufir's pass-1/2 CRITICAL directly: a dead register's + death cause is frontier-relative (baseline dominance) or + device-local-history-relative (clear-count dominance), but the + componentwise-max join recombines each register's `S`/`C`/`B` + independent of the history that produced them, so two individually- + dead registers could — before canonical publication — recombine + into a live join. Canonicalizing every override to `RegB(0, + max(S,C), 0)` before serialization (this round's CRITICAL fix) + folds every dead cause into a single globally-comparable `C` + ceiling with `S=0`, which per `test_tombstone_merge_monotonic` can + only ever raise a receiver's `C` — never resurrect. + + Checked two ways: + - Directed case: Thufir's exact witness pair — `RegB(3,2,0)` + inactive via baseline dominance at frontier 50, `RegB(1,2,100)` + inactive via clear dominance at frontier 100 — whose raw + componentwise join is `RegB(3,2,100)`, live (`S=3>C=2`, + `frontier(100) not> B(100)`). Both tie policies. + - General search: every pairwise join of a bounded cube of + independently-dead `(reg, frontier)` points (see + `_dead_register_points`), delivered to a fresh receiver in both + direct orders and via a one-hop relay that itself republishes + (re-canonicalizes) what it received before forwarding — covering + delayed/multi-hop delivery, not just direct pairwise merge. + + Returns (cube_size, violations). + """ + violations = [] + cube_size = 0 + + def _check_pair(tie_policy, label_a, blob_a, label_b, blob_b, tag): + nonlocal cube_size + cube_size += 1 + for first, second in [(blob_a, blob_b), (blob_b, blob_a)]: + recv = device_cls("recv") + recv.receive_merge(first) + recv.receive_merge(second) + if recv.override_is_set("c0", tie_policy): + violations.append(( + tag, tie_policy, label_a, label_b, recv.overrides.get("c0"), + )) + # Multi-hop: a relay receives blob_a alone, republishes + # (re-canonicalizes) before forwarding, then the receiver gets + # the relayed form plus blob_b directly, in both orders. + relay = device_cls("relay") + relay.receive_merge(blob_a) + relayed = relay.publish_blob(tie_policy) + for first, second in [(relayed, blob_b), (blob_b, relayed)]: + recv = device_cls("recv_hop") + recv.receive_merge(first) + recv.receive_merge(second) + if recv.override_is_set("c0", tie_policy): + violations.append(( + tag + "-multihop", tie_policy, label_a, label_b, + recv.overrides.get("c0"), + )) + + # --- Directed case: Thufir's exact witness pair. --- + for tie_policy in (CLEAR, SET): + reg_a, front_a = RegB(s=3, c=2, b=0), 50 + reg_b, front_b = RegB(s=1, c=2, b=100), 100 + assert not override_set_b(reg_a, front_a, tie_policy) + assert not override_set_b(reg_b, front_b, tie_policy) + + dev_a = device_cls("a") + dev_a.frontier["c0"] = front_a + dev_a.overrides["c0"] = reg_a + dev_b = device_cls("b") + dev_b.frontier["c0"] = front_b + dev_b.overrides["c0"] = reg_b + + _check_pair( + tie_policy, f"thufir-witness-A={reg_a}@{front_a}", + dev_a.publish_blob(tie_policy), + f"thufir-witness-B={reg_b}@{front_b}", + dev_b.publish_blob(tie_policy), + "merge-closure-thufir-witness", + ) + + # --- General search over a bounded cube of dead published states. --- + for tie_policy in (CLEAR, SET): + points = _dead_register_points(tie_policy) + for label_a, reg_a, front_a in points: + dev_a = device_cls("a") + dev_a.frontier["c0"] = front_a + dev_a.overrides["c0"] = reg_a + blob_a = dev_a.publish_blob(tie_policy) + for label_b, reg_b, front_b in points: + dev_b = device_cls("b") + dev_b.frontier["c0"] = front_b + dev_b.overrides["c0"] = reg_b + blob_b = dev_b.publish_blob(tie_policy) + _check_pair( + tie_policy, label_a, blob_a, label_b, blob_b, + "merge-closure-cube", + ) + + return cube_size, violations + + +# --------------------------------------------------------------------------- +# I6: replay harmless +# --------------------------------------------------------------------------- + +def test_replay_harmless(device_cls=DeviceB): + violations = [] + for tie_policy in [CLEAR, SET]: + for ctx in CONTEXTS: + d = device_cls("d0") + d.frontier[ctx] = 10 + d.do_mark_unread(ctx) + blob = d.publish_blob(tie_policy) + state_before = ( + dict(d.frontier), + {k: v for k, v in d.overrides.items()}, + ) + d.receive_merge(blob) + d.receive_merge(blob) + d.receive_merge(blob) + state_after = ( + dict(d.frontier), + {k: v for k, v in d.overrides.items()}, + ) + if state_before != state_after: + violations.append(("I6-replay", tie_policy, ctx)) + return violations + + +# --------------------------------------------------------------------------- +# I7: legacy rewrite +# --------------------------------------------------------------------------- + +def test_legacy_rewrite_b(): + """B's sibling keys survive legacy sanitization (round-trip).""" + violations = [] + for ctx in CONTEXTS: + d = DeviceB("d0") + d.frontier[ctx] = 10 + d.do_mark_unread(ctx) + blob = d.publish_blob() + sanitized = legacy_sanitize_blob(blob) + + recv_orig = DeviceB("recv1") + recv_orig.receive_merge(blob) + recv_san = DeviceB("recv2") + recv_san.receive_merge(sanitized) + + for c in CONTEXTS: + if recv_orig.overrides.get(c) != recv_san.overrides.get(c): + violations.append(("I7-B-sanitize-mutated", c, + recv_orig.overrides.get(c), + recv_san.overrides.get(c))) + return violations + + +def test_legacy_erasure_a(): + """A's top-level overrides field is erased by legacy rewrite. Expected witness.""" + d = DeviceA("d0") + d.frontier["c0"] = 10 + d.do_mark_unread("c0") + blob = d.publish_blob() + assert "overrides" in blob + legacy_blob = {"v": 1, "client_id": "legacy", "contexts": dict(blob["contexts"])} + return "overrides" not in legacy_blob + + +# --------------------------------------------------------------------------- +# I8: bounded key growth +# --------------------------------------------------------------------------- + +def test_bounded_growth(): + """I8: bounded key growth, canonical wire shape. A live override + (last action = mark_unread, still within baseline) publishes + exactly 3 keys/ctx; a dead override (mark_read past baseline, or + C > S under clear-wins) canonicalizes to exactly 1 key/ctx + (`ov_c:` tombstone) at publish time — never 0 (virgin-only) or 3 + (dead-but-uncompacted, which the pre-fix serializer allowed). + """ + violations = [] + for ctx in CONTEXTS: + # Live: 100 set/clear round-trips, ending on a fresh mark_unread + # so S > C (live under both tie policies) at publish time. + d = DeviceB("d0") + d.frontier[ctx] = 10 + for _ in range(100): + d.do_mark_unread(ctx) + d.do_mark_read(ctx, d.effective_frontier(ctx) + 1) + d.do_mark_unread(ctx) + blob = d.publish_blob(CLEAR) + ov_keys = [k for k in blob["contexts"] if k.startswith("ov_")] + if ov_keys != [f"ov_s:{ctx}", f"ov_c:{ctx}", f"ov_b:{ctx}"]: + violations.append(("I8-growth-live", ctx, ov_keys)) + + # Dead: advance the frontier past baseline B — override_set_b's + # baseline-dominance clause forces S dead regardless of S vs C. + d.do_advance_frontier(ctx, d.effective_frontier(ctx) + 100) + tomb_blob = d.publish_blob(CLEAR) + tomb_keys = [k for k in tomb_blob["contexts"] if k.startswith("ov_")] + if tomb_keys != [f"ov_c:{ctx}"]: + violations.append(("I8-growth-tombstone", ctx, tomb_keys)) + return violations + + +def test_wire_shape_exact(): + """Exact wire-shape regression (Paul's fix-scope item 4): a live + override serializes to exactly 3 `ov_*` keys, a dead override to + exactly 1 (`ov_c:` only, zero-valued `ov_s`/`ov_b` omitted), and a + virgin override to exactly 0. Checked directly against + `publish_blob`'s output, independent of `do_compact`. + """ + violations = [] + for tie_policy in (CLEAR, SET): + # Live. + d_live = DeviceB("d0") + d_live.frontier["c0"] = 10 + d_live.do_mark_unread("c0") + live_blob = d_live.publish_blob(tie_policy) + live_keys = sorted(k for k in live_blob["contexts"] if k.startswith("ov_")) + if live_keys != ["ov_b:c0", "ov_c:c0", "ov_s:c0"]: + violations.append(("wire-shape-live", tie_policy, live_keys)) + + # Dead (clear-wins only: S==C>0 is dead under CLEAR, live under + # SET — use baseline dominance instead so it's dead under both). + d_dead = DeviceB("d0") + d_dead.frontier["c0"] = 10 + d_dead.do_mark_unread("c0") + d_dead.do_advance_frontier("c0", 100) + dead_blob = d_dead.publish_blob(tie_policy) + dead_keys = sorted(k for k in dead_blob["contexts"] if k.startswith("ov_")) + if dead_keys != ["ov_c:c0"]: + violations.append(("wire-shape-tombstone", tie_policy, dead_keys)) + if dead_blob["contexts"]["ov_c:c0"] != 1: + violations.append(( + "wire-shape-tombstone-ceiling", tie_policy, + dead_blob["contexts"]["ov_c:c0"], + )) + + # Virgin: no override ever set for this context. + d_virgin = DeviceB("d0") + d_virgin.frontier["c0"] = 10 + d_virgin.overrides["c0"] = RegB(s=0, c=0, b=0) + virgin_blob = d_virgin.publish_blob(tie_policy) + virgin_keys = [k for k in virgin_blob["contexts"] if k.startswith("ov_")] + if virgin_keys: + violations.append(("wire-shape-virgin", tie_policy, virgin_keys)) + + return violations + + +# --------------------------------------------------------------------------- +# I9: DeviceA counter absorption +# --------------------------------------------------------------------------- + +def test_a_counter_absorption(): + """After receiving a blob with counter=10, a local action must use counter>10.""" + d0 = DeviceA("d0") + d0.frontier["c0"] = 10 + d0.counter = 10 + d0.do_mark_unread("c0") + blob0 = d0.publish_blob() + + d1 = DeviceA("d1") + d1.frontier["c0"] = 10 + d1.receive_merge(blob0) + assert d1.counter >= 10, f"counter not absorbed: {d1.counter}" + + d1.do_mark_read("c0", 20) + reg = d1.overrides.get("c0") + assert reg is not None and reg.counter > 10, \ + f"post-receive clear at counter {reg.counter} would lose to set at 10" + return True + + +# --------------------------------------------------------------------------- +# Identity-free (B): reinstall convergence +# --------------------------------------------------------------------------- + +def test_b_identity_free(device_cls=DeviceB): + violations = [] + for tie_policy in [CLEAR, SET]: + for ctx in CONTEXTS: + d = device_cls("d0") + d.frontier[ctx] = 10 + d.do_mark_unread(ctx) + blob1 = d.publish_blob(tie_policy) + + d_re = device_cls("d0_reinstalled") + d_re.receive_merge(blob1) + d_re.do_mark_read(ctx, 20) + blob2 = d_re.publish_blob(tie_policy) + + verdicts = set() + for first, second in [(blob1, blob2), (blob2, blob1)]: + recv = device_cls("recv") + recv.receive_merge(first) + recv.receive_merge(second) + verdicts.add(recv.override_is_set(ctx, tie_policy)) + if len(verdicts) > 1: + violations.append(("identity-free", tie_policy, ctx)) + return violations + + +# --------------------------------------------------------------------------- +# Legacy prune/trim interaction +# --------------------------------------------------------------------------- + +def test_legacy_prune_interaction(): + """ov_ keys survive prune; msg:ov_ nested keys would be pruned (state loss).""" + base = {"c0": 50, "msg:m1": 30, "thread:t1": 40} + ov = {"ov_s:c0": 1, "ov_c:c0": 0, "ov_b:c0": 10} + all_keys = {**base, **ov} + pruned = legacy_prune(all_keys, horizon=35) + ov_survived = all(k in pruned for k in ov) + msg_pruned = "msg:m1" not in pruned + + nested = {"msg:ov_s:c0": 1, "msg:ov_c:c0": 0, "msg:ov_b:c0": 10} + pruned_nested = legacy_prune({**base, **nested}, horizon=35) + nested_lost = any(k not in pruned_nested for k in nested) + return ov_survived, msg_pruned, nested_lost + + +def test_legacy_trim_interaction(): + """Excess override keys block legacy publish when budget exceeded.""" + contexts = {"c0": 50} + for i in range(1000): + contexts[f"ov_s:c{i}"] = 1 + contexts[f"ov_c:c{i}"] = 0 + contexts[f"ov_b:c{i}"] = 10 + _, fits = legacy_trim(contexts, "client1", max_bytes=32768) + return not fits + + +# --------------------------------------------------------------------------- +# Multi-slot union +# --------------------------------------------------------------------------- + +def test_multi_slot_union(device_cls=DeviceB): + """Split a published blob across 2 slots using the atomic-grouping rule, + deliver each slot separately, verify convergence with delivering the full blob. + + Production: mergeReadStateEvents merges per-slot blobs with per-context + max(). Override sibling keys are individual context entries, so they + follow the same merge path. The atomic-grouping rule requires that all + `ov_*` sibling keys for a context travel with that context's frontier + key in the same slot — `split_blob_into_slots` enforces this. + """ + violations = [] + for tie_policy in [CLEAR, SET]: + dev = device_cls("d0") + dev.frontier["c0"] = 10 + dev.frontier["c1"] = 20 + dev.do_mark_unread("c0") + dev.do_mark_read("c1", 30) + + full_blob = dev.publish_blob(tie_policy) + slots = dev.split_blob_into_slots(tie_policy, n_slots=2) + slot0, slot1 = slots[0], slots[1] + + recv_full = device_cls("recv_full") + recv_full.receive_merge(full_blob) + + for first, second in [(slot0, slot1), (slot1, slot0)]: + recv_split = device_cls("recv_split") + recv_split.receive_merge(first) + recv_split.receive_merge(second) + + for ctx in CONTEXTS: + ov_full = recv_full.override_is_set(ctx, tie_policy) + ov_split = recv_split.override_is_set(ctx, tie_policy) + f_full = recv_full.effective_frontier(ctx) + f_split = recv_split.effective_frontier(ctx) + if ov_full != ov_split: + violations.append(("multi-slot-override", tie_policy, ctx)) + if f_full != f_split: + violations.append(("multi-slot-frontier", tie_policy, ctx)) + return violations + + +# --------------------------------------------------------------------------- +# Interleaved-delivery grouping: Thufir's CRITICAL transport counterexample +# +# Without the atomic-grouping rule a compliant publisher would still split +# ov_s:/ov_c:/ov_b: across slots as independent entries. M8's per-entry +# split places frontier+ov_s: in slot 0 and ov_b:+ov_c: in slot 1. An +# observer holding only slot 0 reconstructs RegB(1,0,0), judges it +# baseline-dead (B=0 ≤ frontier=10), and canonically publishes tombstone +# RegB(0,1,0). After all slots and that transient tombstone are eventually +# merged the result is RegB(1,1,10) — dead under clear-wins — +# permanently suppressing a live override. +# +# The atomic-grouping rule closes this: every ov_* entry for a context +# travels with the context's frontier entry, so a receiver always sees +# either the complete register or nothing. This test exercises both: +# - The PASS path: grouped slots → no false tombstone possible. +# - The FAIL path (M8): per-entry split → Thufir's exact witness reproduced. +# --------------------------------------------------------------------------- + +def test_interleaved_delivery_grouping(device_cls=DeviceB): + """Exercise receive-one-slot → canonical re-publish → receive-rest → + re-publish permutations, both slot orders, including delayed delivery + of both transient re-publications to a third observer. + + Protocol sequence (exact, per Paul's brief): + 1. partial_obs receives first_slot → publishes transient_1. + 2. partial_obs receives second_slot → publishes transient_2. + 3. Third-party finals receive BOTH source slots AND both transient + publications in relevant interleaving orders. + Oracle: after eventual delivery of ALL blobs (both source slots + + both transients), every observer's override matches source liveness. + + With the atomic-grouping rule (default DeviceB): + - The compliant split puts the full register in one slot, the other + is empty. partial_obs after step 1 holds either the complete + register (live → transient_1 is live) or nothing (transient_1 is + empty/virgin). Either way, step 2 delivers the remaining (possibly + empty) slot. Final merge of all blobs = source liveness. PASS. + With per-entry splitting (M8): + - slot 0 carries frontier + ov_s: (partial → RegB(1,0,0), dead). + transient_1 is tombstone RegB(0,1,0). After step 2 partial_obs + holds full register but transient_1 tombstone is already in + circulation. Finals that receive transient_1 get + RegB(1,1,10) — dead under clear-wins. FAIL (Thufir's witness). + """ + violations = [] + + # Source: live override RegB(1,0,10) at frontier=10 — Thufir's witness. + src_s, src_c, src_b, src_front = 1, 0, 10, 10 + + for tie_policy in (CLEAR, SET): + src = device_cls("src") + src.frontier["c0"] = src_front + src.overrides["c0"] = RegB(s=src_s, c=src_c, b=src_b) + + # Confirm source is actually live. + assert src.override_is_set("c0", tie_policy), ( + f"test precondition: source must be live under {tie_policy}" + ) + + # Produce the source's two slots via the (possibly mutated) split. + slots = src.split_blob_into_slots(tie_policy, n_slots=2) + slot0, slot1 = slots[0], slots[1] + src_live = src.override_is_set("c0", tie_policy) + + for first_slot, second_slot in [(slot0, slot1), (slot1, slot0)]: + # Step 1: partial_obs receives first slot, canonically re-publishes. + partial_obs = device_cls("partial_obs") + partial_obs.receive_merge(first_slot) + transient_1 = partial_obs.publish_blob(tie_policy) + + # Step 2: partial_obs receives second slot, publishes again. + partial_obs.receive_merge(second_slot) + transient_2 = partial_obs.publish_blob(tie_policy) + + # Step 3: third-party finals receive BOTH source slots AND both + # transient publications, in several representative interleaving + # orders. All must agree with source liveness. + # Representative orders: transient_1 before both slots (most + # dangerous under M8), transient_1 after both slots, and + # interleaved. We check 3 explicit orders rather than all 4! + # permutations (24) for speed; M8's canonical false-clear path + # (transient_1 first, then second_slot only) is order 1. + check_orders = [ + # Most dangerous: transient_1 arrives first, before any source + [transient_1, slot0, slot1, transient_2], + # Normal: both source slots first, then both transients + [slot0, slot1, transient_1, transient_2], + # Interleaved: first source, transient_1, second source, transient_2 + [first_slot, transient_1, second_slot, transient_2], + ] + + for order in check_orders: + final = device_cls("final") + for blob in order: + final.receive_merge(blob) + final_live = final.override_is_set("c0", tie_policy) + if final_live != src_live: + t1_reg = partial_obs.overrides.get("c0") + violations.append(( + "interleaved-delivery-false-clear", + tie_policy, + f"slot_order=(first={list(first_slot['contexts'].keys())[:2]}...)", + f"delivery_order={[list(b['contexts'].keys())[:2] for b in order]}", + f"transient_1_reg={t1_reg}", + f"final_reg={final.overrides.get('c0')}", + f"expected_live={src_live} got_live={final_live}", + )) + + return violations + + +# --------------------------------------------------------------------------- +# Escaped-context slot-grouping regression +# +# Thufir's CRITICAL (round 2): a raw context ID that starts with a +# reserved prefix (e.g. "ov_s:evil") escapes to "esc:ov_s:evil" as its +# frontier wire key. Before the fix, split_blob_into_slots grouped the +# frontier by its wire key ("esc:ov_s:evil") but the ov_* siblings by +# the raw suffix ("ov_s:evil") — two identities for one logical context. +# The frontier and its siblings landed in different slots. +# +# Across publication cycles the replaceable slot d-tag coordinates +# update slot-by-slot. A relay can therefore serve: new frontier slot +# (just published, carries esc:ov_s:evil=10) + stale override slot +# (old coordinate, carries ov_s/ov_c/ov_b at b=0 from the old pub). +# The reconstructed register is RegB(s=1, c=0, b=0) at frontier=10 — +# baseline-dead. Canonical re-publication emits tombstone RegB(0,1,0). +# Eventually both current slots + the transient merge to RegB(1,1,10) — +# dead under clear-wins — permanently suppressing a live override. +# +# The fix: derive the frontier's group identity via unescape_context_key +# so it joins the same group as its ov_* siblings. This test exercises +# both directions: M9 (reverts to escaped-key grouping) must reproduce +# the witness, and the correct model must pass. +# --------------------------------------------------------------------------- + +def test_escaped_context_slot_grouping(device_cls=DeviceB): + """Regression for escaped-context identity mismatch in split_blob_into_slots. + + Scenario: + 1. Source has a live override on raw context "ov_s:evil" (escapes to + "esc:ov_s:evil" as frontier wire key) — Thufir's exact escaped witness. + 2. Source publishes twice: first at frontier=0/b=0, then after advancing + frontier to 10 and re-marking unread (b=10). Each publication produces + 2 slots. Simulates a relay retaining a stale old-cycle slot under its + old replaceable coordinate while only the new-cycle slot for the OTHER + half has been updated — the old/new slot-coordinate mixture. + 3. An observer receives: new-cycle frontier-bearing slot (frontier=10, + esc:ov_s:evil=10) + stale old-cycle override slot (ov_s/ov_c/ov_b from + first pub where b=0). + 4. Observer canonically re-publishes (mandatory, per NIP-RS spec). + 5. A third-party final observer receives both current-cycle source slots + plus the transient re-publication. + 6. Oracle: final observer must see the override as live. + + With the unescape-before-group fix: frontier + ov_* siblings always land + in the same slot → no partial register → no false tombstone. PASS. + With M9 (escaped-key grouping): frontier in one slot, siblings in another + → partial reconstruction → false tombstone → final merge dead. FAIL. + """ + violations = [] + raw_ctx = "ov_s:evil" + + for tie_policy in (CLEAR, SET): + # --- Publication cycle 1: initial state, frontier=0 --- + src_old = device_cls("src") + src_old.frontier[raw_ctx] = 0 + src_old.do_mark_unread(raw_ctx) # RegB(s=1, c=0, b=0) + old_slots = src_old.split_blob_into_slots(tie_policy, n_slots=2) + # old_slots[0] is the "stale old-coordinate slot" a relay may retain. + + # --- Publication cycle 2: frontier advances, re-mark-unread --- + src_new = device_cls("src") + src_new.frontier[raw_ctx] = 10 + src_new.do_mark_unread(raw_ctx) # RegB(s=1, c=0, b=10) — live at frontier=10 + + assert src_new.override_is_set(raw_ctx, tie_policy), ( + f"test precondition: source must be live under {tie_policy}" + ) + + new_slots = src_new.split_blob_into_slots(tie_policy, n_slots=2) + + # --- Full delivery: both new slots → both current-cycle slot arrive --- + recv_full = device_cls("recv_full") + recv_full.receive_merge(new_slots[0]) + recv_full.receive_merge(new_slots[1]) + if not recv_full.override_is_set(raw_ctx, tie_policy): + violations.append(( + "escaped-ctx-full-delivery-dead", tie_policy, + f"full={recv_full.overrides.get(raw_ctx)}", + )) + + # --- Mixture: new frontier-bearing slot + stale old override slot --- + # Identify which new slot carries the frontier and which carries ov_*, + # then pair the frontier slot with the old-cycle override slot. + wire_frontier = escape_context_key(raw_ctx) + + new_frontier_slot_idx = 0 if wire_frontier in new_slots[0]["contexts"] else 1 + new_frontier_slot = new_slots[new_frontier_slot_idx] + old_override_slot = old_slots[1 - new_frontier_slot_idx] # opposite slot + + # Check whether the frontier and ov_* siblings are co-located in new_slots. + ov_s_key = f"ov_s:{raw_ctx}" + frontier_and_ov_same_slot = ( + wire_frontier in new_slots[new_frontier_slot_idx]["contexts"] and + ov_s_key in new_slots[new_frontier_slot_idx]["contexts"] + ) + + if frontier_and_ov_same_slot: + # Correct grouping: old override slot has nothing relevant, mixture + # is safe by construction — the stale slot is just an empty dict. + # Verify anyway for defense-in-depth. + obs = device_cls("obs") + obs.receive_merge(new_frontier_slot) + obs.receive_merge(old_override_slot) + transient = obs.publish_blob(tie_policy) + + final = device_cls("final") + final.receive_merge(new_slots[0]) + final.receive_merge(new_slots[1]) + final.receive_merge(transient) + if not final.override_is_set(raw_ctx, tie_policy): + violations.append(( + "escaped-ctx-grouped-mixture-dead", tie_policy, + f"transient={obs.overrides.get(raw_ctx)}", + f"final={final.overrides.get(raw_ctx)}", + )) + else: + # Mismatched grouping (M9 path): frontier and siblings split. + # The mixture produces a partial register → false tombstone. + obs = device_cls("obs") + obs.receive_merge(new_frontier_slot) # gets frontier=10, no ov_* + obs.receive_merge(old_override_slot) # gets ov_s/ov_c/ov_b at b=0 + transient = obs.publish_blob(tie_policy) + + # Final observer gets everything: both new slots + transient. + for order in [(new_slots[0], new_slots[1]), (new_slots[1], new_slots[0])]: + final = device_cls("final") + final.receive_merge(order[0]) + final.receive_merge(order[1]) + final.receive_merge(transient) + if not final.override_is_set(raw_ctx, tie_policy): + violations.append(( + "escaped-ctx-mixture-false-clear", tie_policy, + f"obs_reg={obs.overrides.get(raw_ctx)}", + f"transient_reg={transient['contexts']}", + f"final_reg={final.overrides.get(raw_ctx)}", + )) + + return violations + + +# --------------------------------------------------------------------------- +# Reserved key namespace: adversarial prefix collision +# --------------------------------------------------------------------------- + +def test_reserved_namespace_collision(): + """A genuine user context whose raw ID begins with the reserved `ov_` + stem (e.g. a pre-existing legacy context literally named `ov_s:evil`) + must round-trip as frontier state, not be misparsed as a control key + for a different context, and must not collide with a real override's + sibling keys in the same flattened contexts map. + + Exercises: escape on publish, unescape on receive, and a live + override on a DIFFERENT context in the same blob to prove no + control-key collision occurs. + """ + violations = [] + adversarial_raw = "ov_s:evil" # would misparse as ov_s: control for ctx "evil" + real_ctx = "c0" + + # Escaping must be a no-op for every context ID Buzz actually + # generates, and must trigger for the adversarial one. + for benign in ("b68cd7cb-6f8d-4641-b743-a7349eb4114b", + "msg:" + "a" * 64, "thread:" + "b" * 64): + if escape_context_key(benign) != benign: + violations.append(("namespace-benign-escaped", benign)) + if escape_context_key(adversarial_raw) == adversarial_raw: + violations.append(("namespace-adversarial-not-escaped", adversarial_raw)) + if not escape_context_key(adversarial_raw).startswith(ESCAPE_PREFIX): + violations.append(("namespace-adversarial-missing-marker", adversarial_raw)) + + dev = DeviceB("d0") + dev.frontier[adversarial_raw] = 42 + dev.frontier[real_ctx] = 5 + dev.do_mark_unread(real_ctx) + blob = dev.publish_blob() + + wire_key = escape_context_key(adversarial_raw) + if wire_key not in blob["contexts"]: + violations.append(("namespace-wire-key-missing", wire_key, blob["contexts"])) + if blob["contexts"].get(wire_key) != 42: + violations.append(("namespace-value-corrupted", wire_key, blob["contexts"].get(wire_key))) + + recv = DeviceB("recv") + recv.receive_merge(blob) + if recv.effective_frontier(adversarial_raw) != 42: + violations.append(( + "namespace-roundtrip-failed", adversarial_raw, + recv.effective_frontier(adversarial_raw), + )) + if adversarial_raw in recv.overrides: + violations.append(("namespace-misparsed-as-override", adversarial_raw)) + if recv.overrides.get(real_ctx) is None or recv.overrides[real_ctx].s == 0: + violations.append(("namespace-real-override-corrupted", real_ctx, recv.overrides.get(real_ctx))) + + return violations + + +# --------------------------------------------------------------------------- +# Run all +# --------------------------------------------------------------------------- + +def run_all(): + print("=" * 60) + print("NIP-RS manual-unread exhaustive model") + print("=" * 60) + total_violations = 0 + + def report(name, violations): + nonlocal total_violations + n = len(violations) if isinstance(violations, list) else 0 + total_violations += n + status = "PASS" if n == 0 else f"FAIL ({n})" + print(f" {name}: {status}") + if n > 0: + for v in violations[:3]: + print(f" {v}") + + print("\n--- I1: merge algebra (B) ---") + report("assoc/commut/idempot", test_merge_algebra_b()) + + print("\n--- I1: merge algebra (A) ---") + report("assoc/commut/idempot", test_merge_algebra_a()) + + print("\n--- I2+I3+I5: BFS explorer (B, clear-wins) ---") + n, v = explore_b(max_depth=4, tie_policy=CLEAR) + print(f" states explored: {n}") + report("convergence+frontier+compaction", v) + + print("\n--- I2+I3+I5: BFS explorer (B, set-wins) ---") + n, v = explore_b(max_depth=4, tie_policy=SET) + print(f" states explored: {n}") + report("convergence+frontier+compaction", v) + + print("\n--- I4: concurrent set/clear stability ---") + report("stable winner", test_concurrent_stability()) + + print("\n--- I5: compaction register-level exhaustive ---") + report("all register values x policies", test_compaction_register_exhaustive()) + + print("\n--- I5c: directed deep-history (compact -> reuse -> stale delivery) ---") + cube_size, deep_v = test_deep_history_compaction() + print(f" parameter cube size: {cube_size}") + report("no divergence from never-compact reference", deep_v) + + print("\n--- I5c: tombstone + stale-ancestor merge (direct) ---") + report("no resurrection", test_tombstone_stale_merge_direct()) + + print("\n--- I5d: tombstone-merge monotonicity (structural lemma) ---") + report("ceiling never strengthens S", test_tombstone_merge_monotonic()) + + print("\n--- I5d: cross-device compaction transparency (suppress-only) ---") + cd_cube, cd_suppress, cd_v = test_cross_device_compaction_suppression() + print(f" parameter cube size: {cd_cube} suppressions observed: {cd_suppress}") + report("suppress-only + recoverable", cd_v) + + print("\n--- Published-state merge closure (canonical publication guarantee) ---") + mc_cube, mc_v = test_published_merge_closure() + print(f" pairs checked: {mc_cube}") + report("no dead+dead resurrection", mc_v) + + print("\n--- I6: replay harmless ---") + report("replay", test_replay_harmless()) + + print("\n--- I7: legacy rewrite (B) ---") + report("sibling keys survive", test_legacy_rewrite_b()) + + print("\n--- I7: legacy erasure (A) — expected witness ---") + erased = test_legacy_erasure_a() + print(f" overrides erased by legacy: {'CONFIRMED' if erased else 'NOT FOUND'}") + if not erased: + total_violations += 1 + + print("\n--- I8: bounded growth ---") + report("canonical wire shape (3 live / 1 tombstone)", test_bounded_growth()) + + print("\n--- I8: exact wire-shape regression ---") + report("live=3 keys, tombstone=1 key, virgin=0 keys", test_wire_shape_exact()) + + print("\n--- I9: DeviceA counter absorption ---") + absorbed = test_a_counter_absorption() + print(f" post-receive counter > received: {'CONFIRMED' if absorbed else 'FAIL'}") + if not absorbed: + total_violations += 1 + + print("\n--- Identity-free (B) ---") + report("reinstall convergence", test_b_identity_free()) + + print("\n--- Legacy prune interaction ---") + ov_ok, msg_ok, nested_lost = test_legacy_prune_interaction() + print(f" ov_ keys survive: {'PASS' if ov_ok else 'FAIL'}") + print(f" msg: pruned at horizon: {'PASS' if msg_ok else 'FAIL'}") + print(f" nested msg:ov_ lost: {'CONFIRMED (hazard)' if nested_lost else 'NOT FOUND'}") + if not ov_ok: + total_violations += 1 + + print("\n--- Legacy trim interaction ---") + blocked = test_legacy_trim_interaction() + print(f" excess overrides block publish: {'CONFIRMED (hazard)' if blocked else 'NOT FOUND'}") + + print("\n--- Multi-slot union ---") + report("split+merge convergence", test_multi_slot_union()) + + print("\n--- Interleaved delivery + atomic grouping rule ---") + report("no false clear under slot interleaving", test_interleaved_delivery_grouping()) + + print("\n--- Escaped-context slot-grouping regression ---") + report("escaped ctx: frontier + ov_* siblings same slot", test_escaped_context_slot_grouping()) + + print("\n--- Reserved key namespace: adversarial prefix collision ---") + report("escape/unescape + no misparse", test_reserved_namespace_collision()) + + print("\n" + "=" * 60) + if total_violations == 0: + print("ALL INVARIANTS HOLD — 0 violations") + else: + print(f"VIOLATIONS: {total_violations}") + print("=" * 60) + return total_violations + + +if __name__ == "__main__": + import sys + sys.exit(0 if run_all() == 0 else 1) diff --git a/docs/formal/nip-rs-unread/model.py b/docs/formal/nip-rs-unread/model.py new file mode 100644 index 0000000000..4400280571 --- /dev/null +++ b/docs/formal/nip-rs-unread/model.py @@ -0,0 +1,492 @@ +"""Bounded exhaustive model comparing two NIP-RS manual-unread encodings. + +Candidate A: lexicographic operation register + Per context: {counter, client_tiebreak, op in {SET,CLEAR}, baseline} + in a NEW top-level field beside `contexts`. + Merge = max tuple (counter, tiebreak, op-rule on full tie). + +Candidate B: two grow-only counters + baseline + Per context: S (set counter), C (clear counter), B (frontier-at-set-time) + as sibling keys under `contexts` (ov_s:, ov_c:, ov_b: prefixes). + Action: own counter := max(S,C)+1; set also writes B := effective frontier. + Merge = componentwise max. Tie policy on S == C is a parameter. + +Both share: + - Frontier: grow-only max() per NIP-RS v1 (unchanged). + - Verdict: unread(ctx) = latest > effective_frontier(ctx) OR override_set(ctx). + - Mark-read = advance frontier + clear override. + - Mark-unread = set override with baseline B = current effective frontier. + - Natural frontier advance strictly past B dominates a stale set. + +Device simulators use overridable methods (_override_set, _compact, _merge_reg, +_bump, _sanitize_value) so the mutation harness can inject weakened rules via +subclassing without monkeypatching. +""" +from dataclasses import dataclass +from typing import Optional + + +SET = "SET" +CLEAR = "CLEAR" + + +# --------------------------------------------------------------------------- +# Reserved key namespace + escaping +# +# NIP-RS v1 context IDs are arbitrary UTF-8 (spec :89, :113-114), so a +# pre-existing opaque context could legitimately begin with `ov_s:`, +# `ov_c:`, or `ov_b:` and collide with a control key for a DIFFERENT +# context in the same flattened `contexts` map. `ov_` (the shared +# 3-byte stem) and the escape marker itself are reserved; any raw +# context ID that would collide is escaped before being used as a +# plain frontier key. Escaping is a no-op for every context ID Buzz +# actually generates (channel UUID, `msg:`, `thread:` +# — none start with `ov_` or `esc:`), so the common case pays zero +# bytes. Only a pathological ID pays the 4-byte `esc:` cost. +# +# This protects context IDs generated by amendment-aware clients. +# It does NOT retroactively protect a context that a PRE-EXISTING +# legacy client already published unescaped before the amendment +# shipped — that residual hazard is documented, not solved (see +# NOTE.md "Reserved key namespace"). +# --------------------------------------------------------------------------- + +ESCAPE_PREFIX = "esc:" +_RESERVED_STEM = "ov_" + + +def _needs_escape(raw_key: str) -> bool: + return raw_key.startswith(_RESERVED_STEM) or raw_key.startswith(ESCAPE_PREFIX) + + +def escape_context_key(raw_key: str) -> str: + return ESCAPE_PREFIX + raw_key if _needs_escape(raw_key) else raw_key + + +def unescape_context_key(wire_key: str) -> str: + if wire_key.startswith(ESCAPE_PREFIX): + return wire_key[len(ESCAPE_PREFIX):] + return wire_key + + +# --------------------------------------------------------------------------- +# Candidate B — two grow-only counters + baseline +# --------------------------------------------------------------------------- + +@dataclass(frozen=True) +class RegB: + s: int = 0 + c: int = 0 + b: int = 0 + + +def merge_reg_b(a: Optional[RegB], b: Optional[RegB]) -> Optional[RegB]: + if a is None: + return b + if b is None: + return a + return RegB(s=max(a.s, b.s), c=max(a.c, b.c), b=max(a.b, b.b)) + + +def override_set_b(reg: Optional[RegB], frontier_val: int, tie_policy=CLEAR) -> bool: + if reg is None: + return False + if frontier_val > reg.b and reg.s > 0: + return False + if reg.s > reg.c: + return True + if reg.s == reg.c and reg.s > 0: + return tie_policy == SET + return False + + +def compact_b(reg: RegB, frontier_val: int, tie_policy=CLEAR) -> Optional[RegB]: + """Compact override state. + + Tombstone-floor design: a register with any recorded counter + activity (S>0 or C>0) is never fully deleted. Its counter + high-water-mark is exactly what prevents a stale replica — + any (S,C) pair below that ceiling — from dominating a freshly + created register after compaction (delete-on-dominance made + counters reusable: a dead register dropped entirely, then a new + local set/clear pair restarted from S=0/C=0, so a delayed stale + peer snapshot with S>0 could out-rank the new state on replay). + Only a virgin register (S==0, C==0, no activity ever recorded) + has no ceiling to protect and compacts to None. + + A live override (per `override_set_b`, which is already + policy-aware) is returned unchanged — compaction only touches dead + state. Dead overrides — whether dominated by C>S, tied under + clear-wins, or baseline-dominated by frontier advance — compact to + the clear-tombstone floor `RegB(s=0, c=max(S,C), b=0)`: S is + zeroed (no longer overriding), but C retains the ceiling so both a + future local bump (`max(S,C)+1`) and a componentwise-max merge with + any pre-compaction stale snapshot start strictly above the + historical maximum, never below it. + """ + if reg.s == 0 and reg.c == 0: + return None + if override_set_b(reg, frontier_val, tie_policy): + return reg + return RegB(s=0, c=max(reg.s, reg.c), b=0) + + +# --------------------------------------------------------------------------- +# Candidate A — lexicographic operation register +# --------------------------------------------------------------------------- + +@dataclass(frozen=True) +class RegA: + counter: int = 0 + tiebreak: str = "" + op: str = CLEAR + baseline: int = 0 + + def as_tuple(self, op_wins): + op_val = 1 if self.op == op_wins else 0 + return (self.counter, self.tiebreak, op_val) + + +def merge_reg_a(a: Optional[RegA], b: Optional[RegA], tie_op=CLEAR) -> Optional[RegA]: + if a is None: + return b + if b is None: + return a + at = a.as_tuple(tie_op) + bt = b.as_tuple(tie_op) + if at == bt: + return RegA( + counter=a.counter, tiebreak=a.tiebreak, op=a.op, + baseline=max(a.baseline, b.baseline), + ) + return a if at > bt else b + + +# --------------------------------------------------------------------------- +# Device simulation — Candidate B +# --------------------------------------------------------------------------- + +class DeviceB: + """Simulates one device's NIP-RS read-state blob with manual-unread + override layer (candidate B encoding). + + All model operations go through overridable _methods so the mutation + harness can inject weakened rules via subclassing. + """ + + def __init__(self, client_id, is_legacy=False): + self.client_id = client_id + self.is_legacy = is_legacy + self.frontier = {} + self.overrides = {} + + def effective_frontier(self, ctx): + return self.frontier.get(ctx, 0) + + def _override_set(self, reg, frontier_val, tie_policy): + return override_set_b(reg, frontier_val, tie_policy) + + def _compact(self, reg, frontier_val, tie_policy): + return compact_b(reg, frontier_val, tie_policy) + + def _merge_reg(self, a, b): + return merge_reg_b(a, b) + + def _bump(self, s, c): + return max(s, c) + 1 + + def _sanitize_value(self, v): + return isinstance(v, int) and 0 <= v <= 4294967295 + + def override_is_set(self, ctx, tie_policy=CLEAR): + return self._override_set( + self.overrides.get(ctx), self.effective_frontier(ctx), tie_policy + ) + + def verdict(self, ctx, latest_ts, tie_policy=CLEAR): + return (latest_ts > self.effective_frontier(ctx) + or self.override_is_set(ctx, tie_policy)) + + def do_mark_unread(self, ctx): + if self.is_legacy: + return + cur = self.overrides.get(ctx, RegB()) + new_s = self._bump(cur.s, cur.c) + self.overrides[ctx] = RegB(s=new_s, c=cur.c, b=self.effective_frontier(ctx)) + + def do_mark_read(self, ctx, frontier_ts): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), frontier_ts) + if not self.is_legacy: + cur = self.overrides.get(ctx, RegB()) + new_c = self._bump(cur.s, cur.c) + self.overrides[ctx] = RegB(s=cur.s, c=new_c, b=cur.b) + + def do_advance_frontier(self, ctx, ts): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), ts) + + def do_compact(self, ctx, tie_policy=CLEAR): + reg = self.overrides.get(ctx) + if reg is None: + return + result = self._compact(reg, self.effective_frontier(ctx), tie_policy) + if result is None: + if ctx in self.overrides: + del self.overrides[ctx] + else: + self.overrides[ctx] = result + + def do_reinstall(self): + self.client_id = self.client_id + "_r" + self.frontier = {} + self.overrides = {} + + def _canonicalize_for_publish(self, ctx, tie_policy): + """Canonical published form of `ctx`'s override register, + computed fresh against the current effective frontier — + independent of whether `do_compact` was ever called locally. + Returns `(is_live, canonical_reg)`; `canonical_reg is None` + means virgin (omit from the wire entirely). Reuses the same + overridable `_compact`/`_override_set` hooks `do_compact` uses, + so a mutation-harness subclass that weakens one weakens both + the storage-GC path and the publish path identically. + """ + reg = self.overrides.get(ctx) + if reg is None: + return False, None + front = self.effective_frontier(ctx) + canonical = self._compact(reg, front, tie_policy) + if canonical is None: + return False, None + return self._override_set(canonical, front, tie_policy), canonical + + def publish_blob(self, tie_policy=CLEAR): + """Serialize this device's read-state blob. + + Every override is canonicalized at serialization time: live -> + unchanged (3 keys), dead -> tombstone floor (1 key, `ov_c:` + only), virgin -> omitted (0 keys). Canonical publication is a + protocol requirement, not an optimization — noncanonical wire + output is structurally impossible here, not merely avoided by + convention. `do_compact` remains a separate storage-GC + transition that mutates `self.overrides`; publication no + longer depends on it having been called first. + + **Atomic slot-grouping rule (spec-amendment requirement):** + A context's frontier entry and ALL of its `ov_*` sibling entries + MUST travel in the same slot. `split_blob_into_slots` below + enforces this by round-robining per-context groups, never + per-entry. A receiving client that only holds part of a context + group and attempts to reconstruct a `RegB` from it would see + partial zeroes and might canonically re-publish a false + tombstone. Group atomicity makes partial reconstruction + structurally impossible from a compliant publisher's output. + """ + blob_ctx = {escape_context_key(k): v for k, v in self.frontier.items()} + if not self.is_legacy: + for k in self.overrides: + is_live, canonical = self._canonicalize_for_publish(k, tie_policy) + if canonical is None: + continue # virgin: omitted from the wire entirely + if is_live: + blob_ctx[f"ov_s:{k}"] = canonical.s + blob_ctx[f"ov_c:{k}"] = canonical.c + blob_ctx[f"ov_b:{k}"] = canonical.b + else: + blob_ctx[f"ov_c:{k}"] = canonical.c # tombstone: ceiling only + return {"v": 1, "client_id": self.client_id, "contexts": blob_ctx} + + def split_blob_into_slots(self, tie_policy=CLEAR, n_slots=2): + """Split this device's blob into `n_slots` compliant slots. + + **Atomic grouping rule:** a context's frontier entry and ALL of + its `ov_*` sibling entries travel together in the same slot. + Round-robin assignment is per-context group, never per-entry. + This matches production `splitContextsIntoBudgetedSlots` when + it is amended to group by context instead of by individual entry. + + Returns a list of `n_slots` blobs, each with the same `v` and + `client_id` but a disjoint subset of context groups. + """ + blob = self.publish_blob(tie_policy) + contexts = blob["contexts"] + + # Gather per-context groups: each group is a list of (key, value) pairs. + # A "group" is: the frontier key (escaped ctx) + any ov_* siblings. + # Contexts that appear only as ov_* keys (no frontier entry) are + # also grouped together. + groups = {} # logical_ctx -> list of (wire_key, value) + for wire_key, value in contexts.items(): + if wire_key.startswith("ov_s:"): + ctx = wire_key[5:] + elif wire_key.startswith("ov_c:"): + ctx = wire_key[5:] + elif wire_key.startswith("ov_b:"): + ctx = wire_key[5:] + else: + # Frontier key: may be escaped (e.g. "esc:ov_s:evil"). + # Derive the logical context ID by unescaping so this + # entry joins the same group as its ov_* siblings, which + # are keyed by the RAW context ID (e.g. "ov_s:evil" -> + # ctx = "evil", but "esc:ov_s:evil" frontier -> ctx = + # "ov_s:evil" after unescape). Without this step an + # escaped frontier key and its ov_* siblings would be + # treated as two different groups, splitting the register + # across slots — reproducing the round-1 partial- + # reconstruction poison for escaped context IDs. + ctx = unescape_context_key(wire_key) + groups.setdefault(ctx, []).append((wire_key, value)) + + slots = [{"v": blob["v"], "client_id": blob["client_id"], "contexts": {}} + for _ in range(n_slots)] + for i, (_ctx, pairs) in enumerate(sorted(groups.items())): + slot = slots[i % n_slots] + for wire_key, value in pairs: + slot["contexts"][wire_key] = value + return slots + + def receive_merge(self, blob): + incoming_overrides = {} + for k, v in blob.get("contexts", {}).items(): + if k.startswith("ov_s:"): + ctx = k[5:] + incoming_overrides.setdefault(ctx, [0, 0, 0])[0] = v + elif k.startswith("ov_c:"): + ctx = k[5:] + incoming_overrides.setdefault(ctx, [0, 0, 0])[1] = v + elif k.startswith("ov_b:"): + ctx = k[5:] + incoming_overrides.setdefault(ctx, [0, 0, 0])[2] = v + else: + ctx = unescape_context_key(k) + self.frontier[ctx] = max(self.frontier.get(ctx, 0), v) + + if not self.is_legacy: + for ctx, (s, c, b) in incoming_overrides.items(): + incoming_reg = RegB(s=s, c=c, b=b) + self.overrides[ctx] = self._merge_reg( + self.overrides.get(ctx), incoming_reg + ) + + def legacy_sanitize_and_publish(self, tie_policy=CLEAR): + blob = self.publish_blob(tie_policy) + sanitized = {} + for k, v in blob["contexts"].items(): + if len(k.encode("utf-8")) <= 256 and self._sanitize_value(v): + sanitized[k] = v + return {"v": 1, "client_id": self.client_id, "contexts": sanitized} + + def state_key(self, contexts, tie_policy=CLEAR): + parts = [] + for ctx in sorted(contexts): + f = self.effective_frontier(ctx) + reg = self.overrides.get(ctx, RegB()) + ov = self.override_is_set(ctx, tie_policy) + parts.append((ctx, f, reg.s, reg.c, reg.b, ov)) + return (self.client_id, self.is_legacy, tuple(parts)) + + +# --------------------------------------------------------------------------- +# Device simulation — Candidate A +# --------------------------------------------------------------------------- + +class DeviceA: + def __init__(self, client_id, is_legacy=False): + self.client_id = client_id + self.is_legacy = is_legacy + self.frontier = {} + self.overrides = {} + self.counter = 0 + + def effective_frontier(self, ctx): + return self.frontier.get(ctx, 0) + + def override_is_set(self, ctx): + reg = self.overrides.get(ctx) + if reg is None or reg.op == CLEAR: + return False + if self.effective_frontier(ctx) > reg.baseline: + return False + return True + + def verdict(self, ctx, latest_ts): + return latest_ts > self.effective_frontier(ctx) or self.override_is_set(ctx) + + def do_mark_unread(self, ctx): + if self.is_legacy: + return + self.counter += 1 + self.overrides[ctx] = RegA( + counter=self.counter, tiebreak=self.client_id, + op=SET, baseline=self.effective_frontier(ctx), + ) + + def do_mark_read(self, ctx, frontier_ts): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), frontier_ts) + if not self.is_legacy: + self.counter += 1 + self.overrides[ctx] = RegA( + counter=self.counter, tiebreak=self.client_id, + op=CLEAR, baseline=0, + ) + + def do_advance_frontier(self, ctx, ts): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), ts) + + def receive_merge(self, blob, tie_op=CLEAR): + for ctx, ts in blob.get("contexts", {}).items(): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), ts) + if not self.is_legacy: + for ctx, reg in blob.get("overrides", {}).items(): + self.overrides[ctx] = merge_reg_a( + self.overrides.get(ctx), reg, tie_op + ) + if reg.counter > self.counter: + self.counter = reg.counter + + def publish_blob(self): + blob = {"v": 1, "client_id": self.client_id, "contexts": dict(self.frontier)} + if not self.is_legacy: + blob["overrides"] = dict(self.overrides) + return blob + + def legacy_rewrite_and_publish(self): + return {"v": 1, "client_id": self.client_id, "contexts": dict(self.frontier)} + + +# --------------------------------------------------------------------------- +# Legacy pruning/trim model +# --------------------------------------------------------------------------- + +def legacy_prune(contexts, horizon): + return {k: v for k, v in contexts.items() + if not (k.startswith("msg:") or k.startswith("thread:")) or v >= horizon} + + +def legacy_trim(contexts, client_id, max_bytes=32768): + import json + + def size(ctx): + return len(json.dumps({"v": 1, "client_id": client_id, "contexts": ctx}).encode()) + + if size(contexts) <= max_bytes: + return contexts, True + evictable = sorted( + ((k, v) for k, v in contexts.items() + if k.startswith("msg:") or k.startswith("thread:")), + key=lambda kv: kv[1], + ) + out = dict(contexts) + for k, _ in evictable: + del out[k] + if size(out) <= max_bytes: + return out, True + return out, size(out) <= max_bytes + + +def legacy_sanitize_blob(blob): + sanitized = {} + for k, v in blob.get("contexts", {}).items(): + if (len(k.encode("utf-8")) <= 256 + and isinstance(v, int) and 0 <= v <= 4294967295): + sanitized[k] = v + return {"v": 1, "client_id": blob.get("client_id", ""), "contexts": sanitized} diff --git a/docs/formal/nip-rs-unread/mutation.py b/docs/formal/nip-rs-unread/mutation.py new file mode 100644 index 0000000000..4450a99c8f --- /dev/null +++ b/docs/formal/nip-rs-unread/mutation.py @@ -0,0 +1,519 @@ +"""Mutation harness for candidate B (two-counter) model. + +Each mutant: subclass DeviceB with a weakened rule, run the BFS explorer, +require a recorded counterexample. A model that stays green under a real +weakening is worthless. + +Mutants: + M1: drop baseline dominance (frontier > B no longer clears stale set) + M2: drop max(S,C)+1 bump (use S+1 or C+1 — counter can regress) + M3: flip tie policy (verify the model distinguishes them) + M4: revert to delete-on-dominance compaction (drops the tombstone floor + entirely instead of zeroing S and keeping max(S,C) as C) — reproduces + Thufir's pass-3 CRITICAL: stale-replay resurrection after counter reuse + M5: uint32 overflow bypass (legacy sanitization disabled) + M6: componentwise-max -> last-write-wins merge (convergence breaks) + M7: publish without canonicalization (serialize raw registers instead + of the compact-at-publish canonical form) — reproduces Thufir's + pass-1/2 CRITICAL: dead+dead merge resurrection + M8: revert split_blob_into_slots to per-entry splitting (violates the + atomic-grouping rule) — reproduces Thufir's pass-2/2 CRITICAL: + partial-slot reconstruction of a live RegB creates a false tombstone + that permanently suppresses the override after eventual full delivery + M9: revert split_blob_into_slots to escaped-key grouping (groups frontier + by wire key instead of unescaped logical ID) — reproduces Thufir's + round-2 CRITICAL: for a context whose raw ID starts with a reserved + prefix (e.g. "ov_s:evil"), the frontier's escaped wire key + ("esc:ov_s:evil") and the ov_* siblings (keyed by raw suffix "ov_s:evil") + resolve to different groups → register split across slots → + old/new slot-coordinate mixture produces partial reconstruction → + false tombstone → permanent false clear across publication cycles + +Each mutant is injected into the model via DeviceB subclass, then the +explorer or invariant suite is rerun. The counterexample (first violation) +is recorded and printed. +""" +from copy import deepcopy +from model import ( + RegB, merge_reg_b, override_set_b, compact_b, + DeviceB, legacy_sanitize_blob, + escape_context_key, + SET, CLEAR, +) +from exhaustive import ( + explore_b, test_concurrent_stability, + test_compaction_register_exhaustive, test_deep_history_compaction, + test_published_merge_closure, test_interleaved_delivery_grouping, + test_escaped_context_slot_grouping, + CONTEXTS, +) + + +# --------------------------------------------------------------------------- +# M1: drop baseline dominance +# --------------------------------------------------------------------------- + +class M1_NoBaselineDominance(DeviceB): + def _override_set(self, reg, frontier_val, tie_policy): + if reg is None: + return False + if reg.s > reg.c: + return True + if reg.s == reg.c and reg.s > 0: + return tie_policy == SET + return False + + def _compact(self, reg, frontier_val, tie_policy): + if reg.s == 0 and reg.c == 0: + return None + if self._override_set(reg, frontier_val, tie_policy): + return reg + if reg.c > reg.s: + return RegB(s=0, c=reg.c, b=0) + if reg.c == reg.s and tie_policy == CLEAR: + return RegB(s=0, c=reg.c, b=0) + return reg + + +def mutant_m1(): + """M1: without baseline dominance, a stale set persists after frontier + advance past baseline. Verify by constructing the scenario directly: + mark-unread at frontier=10, then advance frontier to 100. The correct + model clears the override; the mutant keeps it live.""" + violations = [] + for ctx in CONTEXTS: + dev = M1_NoBaselineDominance("d0") + dev.frontier[ctx] = 10 + dev.do_mark_unread(ctx) + dev.do_advance_frontier(ctx, 100) + + correct = override_set_b(dev.overrides[ctx], 100, CLEAR) + mutant_result = dev.override_is_set(ctx, CLEAR) + + if correct != mutant_result: + violations.append(( + "baseline-dominance-missing", ctx, + dev.overrides[ctx], 100, + f"correct={correct}", f"mutant={mutant_result}", + )) + + if not violations: + _, violations = explore_b(max_depth=3, tie_policy=CLEAR, + device_cls=M1_NoBaselineDominance) + return violations + + +# --------------------------------------------------------------------------- +# M2: drop max(S,C)+1 bump +# --------------------------------------------------------------------------- + +class M2_NoBump(DeviceB): + """Each counter bumps only itself: mark_unread does S := S+1, + mark_read does C := C+1. When S > C from a prior set, a clear + at C+1 can produce C < S even though the clear is causally later.""" + def do_mark_unread(self, ctx): + if self.is_legacy: + return + cur = self.overrides.get(ctx, RegB()) + self.overrides[ctx] = RegB(s=cur.s + 1, c=cur.c, + b=self.effective_frontier(ctx)) + + def do_mark_read(self, ctx, frontier_ts): + self.frontier[ctx] = max(self.frontier.get(ctx, 0), frontier_ts) + if not self.is_legacy: + cur = self.overrides.get(ctx, RegB()) + self.overrides[ctx] = RegB(s=cur.s, c=cur.c + 1, b=cur.b) + + +def mutant_m2(): + """M2: each counter bumps independently. After set→set→clear at + the SAME frontier (no advance past baseline): correct clear has + C=3 > S=2, mutant clear has C=1 < S=2 — a causally later clear + fails to dominate. + + Use mark_read at the current frontier (not advancing past baseline) + so baseline dominance doesn't mask the counter discrepancy. + """ + violations = [] + for ctx in CONTEXTS: + front = 10 + dev_correct = DeviceB("d0") + dev_correct.frontier[ctx] = front + dev_correct.do_mark_unread(ctx) + dev_correct.do_mark_unread(ctx) + dev_correct.do_mark_read(ctx, front) + + dev_mutant = M2_NoBump("d0") + dev_mutant.frontier[ctx] = front + dev_mutant.do_mark_unread(ctx) + dev_mutant.do_mark_unread(ctx) + dev_mutant.do_mark_read(ctx, front) + + correct_set = dev_correct.override_is_set(ctx, CLEAR) + mutant_set = dev_mutant.override_is_set(ctx, CLEAR) + + if correct_set != mutant_set: + violations.append(( + "bump-independent", ctx, + f"correct={dev_correct.overrides[ctx]}", + f"mutant={dev_mutant.overrides[ctx]}", + f"correct_set={correct_set}", f"mutant_set={mutant_set}", + )) + + if not violations: + _, violations = explore_b(max_depth=4, tie_policy=CLEAR, + device_cls=M2_NoBump) + return violations + + +# --------------------------------------------------------------------------- +# M3: tie policy distinguishable +# --------------------------------------------------------------------------- + +def mutant_m3(): + """M3: tie policy is load-bearing — S==C must produce different verdicts. + Not a DeviceB mutation; tests the model function directly.""" + reg = RegB(s=1, c=1, b=10) + frontier = 10 + v_clear = override_set_b(reg, frontier, CLEAR) + v_set = override_set_b(reg, frontier, SET) + if v_clear == v_set: + return [] + return [("tie-distinguishable", v_clear, v_set, reg, frontier)] + + +# --------------------------------------------------------------------------- +# M4: revert to delete-on-dominance compaction (drops the tombstone floor) +# --------------------------------------------------------------------------- + +class M4_DeleteOnDominance(DeviceB): + """The pre-fix compaction rule: any dead/dominated register is deleted + entirely rather than reduced to the tombstone floor RegB(0, max(S,C), 0). + This makes counters reusable — a later local set/clear pair restarts + from S=0/C=0, so a delayed stale peer snapshot can dominate it on + replay. This is exactly the rule Thufir's pass-3 CRITICAL found live + at e453b3945.""" + def _compact(self, reg, frontier_val, tie_policy): + if reg.s == 0 and reg.c == 0: + return None + if self._override_set(reg, frontier_val, tie_policy): + return reg + if frontier_val > reg.b: + return None + if reg.c > reg.s: + return RegB(s=0, c=reg.c, b=0) + if reg.c == reg.s and tie_policy == CLEAR: + return RegB(s=0, c=reg.c, b=0) + return reg + + +def mutant_m4(): + """M4: without the tombstone floor, compaction deletes the counter + ceiling instead of preserving it. Reproduce Thufir's exact witness + directly: RegB(3,0,10) at frontier=20 compacts to None under the old + rule (vs. RegB(0,3,0) under the fix); a subsequent local set+clear + reuses counters from zero; the stale ancestor then replays and + resurrects (S>C) under both tie policies. + + Then confirm the explorer/deep-history suite also catches it (defense + in depth — a mutant that only fails a hand-built scenario would still + be a real bug, but the directed check is what's supposed to catch this + class per T2/T3).""" + violations = [] + stale = RegB(s=3, c=0, b=10) + frontier_after = 20 + + for tie_policy in (CLEAR, SET): + dev = M4_DeleteOnDominance("d0") + dev.frontier["c0"] = 10 + dev.overrides["c0"] = stale + dev.do_advance_frontier("c0", frontier_after) + dev.do_compact("c0", tie_policy) + if "c0" in dev.overrides: + continue # old rule didn't drop it here; not the witness shape + + dev.do_mark_unread("c0") # S := 1, B := 20 + dev.do_mark_read("c0", frontier_after) # C := 2 + + stale_blob = {"contexts": {"ov_s:c0": stale.s, "ov_c:c0": stale.c, "ov_b:c0": stale.b}} + dev.receive_merge(stale_blob) + resurrected = dev.override_is_set("c0", tie_policy) + + if resurrected: + violations.append(( + "M4-delete-on-dominance-resurrection", tie_policy, + f"stale_ancestor={stale}", f"post_compact_reuse=(set,clear)", + f"final_reg={dev.overrides['c0']}", f"override_is_set={resurrected}", + )) + + if not violations: + _, violations = test_deep_history_compaction(device_cls=M4_DeleteOnDominance) + return violations + + +# --------------------------------------------------------------------------- +# M5: uint32 overflow bypass +# --------------------------------------------------------------------------- + +def mutant_m5(): + """M5: values outside uint32 range must fail legacy sanitization.""" + blob = {"v": 1, "client_id": "x", "contexts": { + "ov_s:c0": 4294967296, + "ov_c:c0": 0, + "ov_b:c0": 10, + }} + sanitized = legacy_sanitize_blob(blob) + if "ov_s:c0" in sanitized["contexts"]: + return [] + return [("overflow-rejected", blob["contexts"]["ov_s:c0"], + sanitized["contexts"])] + + +# --------------------------------------------------------------------------- +# M6: last-write-wins merge (breaks convergence) +# --------------------------------------------------------------------------- + +class M6_LastWriteWins(DeviceB): + def _merge_reg(self, a, b): + if a is None: + return b + if b is None: + return a + return b + + +def mutant_m6(): + """M6: replace componentwise max with last-write-wins. Convergence must + break — different delivery orders produce different final states.""" + _, violations = explore_b(max_depth=3, tie_policy=CLEAR, + device_cls=M6_LastWriteWins) + return violations + + +# --------------------------------------------------------------------------- +# M7: publish without canonicalization (reproduces Thufir's pass-1/2 +# CRITICAL — dead+dead merge resurrection) +# --------------------------------------------------------------------------- + +class M7_PublishWithoutCanonicalization(DeviceB): + """Reverts `publish_blob` to serialize raw, uncompacted registers — + the exact pre-fix behavior Thufir's pass-1/2 CRITICAL exploited: + a dead register's baseline-relative death (or clear-count-relative + death) never gets folded into a globally-comparable ceiling before + hitting the wire, so two individually-dead registers can + componentwise-max-merge into a live join.""" + def publish_blob(self, tie_policy=CLEAR): + blob_ctx = {escape_context_key(k): v for k, v in self.frontier.items()} + if not self.is_legacy: + for k, reg in self.overrides.items(): + blob_ctx[f"ov_s:{k}"] = reg.s + blob_ctx[f"ov_c:{k}"] = reg.c + blob_ctx[f"ov_b:{k}"] = reg.b + return {"v": 1, "client_id": self.client_id, "contexts": blob_ctx} + + +def mutant_m7(): + """M7: publish-without-canonicalization must be caught by the + published-state merge-closure invariant — proving that invariant + has teeth. Reproduce Thufir's exact witness directly first (fast, + deterministic); fall back to the full search if the hand-built + scenario doesn't trigger under a given tie policy.""" + violations = [] + for tie_policy in (CLEAR, SET): + dev_a = M7_PublishWithoutCanonicalization("a") + dev_a.frontier["c0"] = 50 + dev_a.overrides["c0"] = RegB(s=3, c=2, b=0) + dev_b = M7_PublishWithoutCanonicalization("b") + dev_b.frontier["c0"] = 100 + dev_b.overrides["c0"] = RegB(s=1, c=2, b=100) + + blob_a = dev_a.publish_blob(tie_policy) + blob_b = dev_b.publish_blob(tie_policy) + + for first, second in [(blob_a, blob_b), (blob_b, blob_a)]: + recv = M7_PublishWithoutCanonicalization("recv") + recv.receive_merge(first) + recv.receive_merge(second) + if recv.override_is_set("c0", tie_policy): + violations.append(( + "M7-publish-without-canonicalization-resurrection", + tie_policy, blob_a, blob_b, recv.overrides["c0"], + )) + + if not violations: + _, violations = test_published_merge_closure( + device_cls=M7_PublishWithoutCanonicalization + ) + return violations + + +# --------------------------------------------------------------------------- +# M8: revert split_blob_into_slots to per-entry splitting +# (violates the atomic-grouping rule — reproduces Thufir's pass-2/2 CRITICAL) +# --------------------------------------------------------------------------- + +class M8_PerEntrySplit(DeviceB): + """Reverts `split_blob_into_slots` to a per-entry split that violates the + atomic-grouping rule by separating `ov_s:` + frontier from `ov_b:` + `ov_c:`. + + This reproduces Thufir's exact transport witness: + - Slot 0: frontier key + `ov_s:` entry (the "partial set" slot) + - Slot 1: `ov_c:` + `ov_b:` entries + + An observer receiving only slot 0 reconstructs `RegB(s=1, c=0, b=0)` at + `frontier=10`. Because `frontier(10) > b(0)`, the override is baseline-dead. + Canonical re-publication emits tombstone `RegB(0, 1, 0)`. After full + eventual delivery (both original slots + transient tombstone), the merged + result is `RegB(s=1, c=1, b=10)` — dead under clear-wins — permanently + suppressing a live override. + """ + + def split_blob_into_slots(self, tie_policy=CLEAR, n_slots=2): + """Split by key type: frontier + ov_s: in slot 0, ov_b: + ov_c: in slot 1. + Violates the atomic-grouping rule by separating ov_s: from ov_b:.""" + blob = self.publish_blob(tie_policy) + slots = [{"v": blob["v"], "client_id": blob["client_id"], "contexts": {}} + for _ in range(n_slots)] + for wire_key, value in blob["contexts"].items(): + if wire_key.startswith("ov_b:") or wire_key.startswith("ov_c:"): + # ov_b and ov_c go to slot 1 — separated from their ov_s: sibling + slots[1]["contexts"][wire_key] = value + else: + # frontier keys and ov_s: go to slot 0 + slots[0]["contexts"][wire_key] = value + return slots + + +def mutant_m8(): + """M8: per-entry splitting must be caught by test_interleaved_delivery_grouping — + proving that the new interleaved-delivery test has teeth. + + Reproduce Thufir's exact transport witness directly: source live + `RegB(1,0,10)` at frontier=10. Per-entry split puts frontier+`ov_s:c0` + in slot 0 and `ov_c:c0`+`ov_b:c0` in slot 1. An observer receiving only + slot 0 reconstructs `RegB(1,0,0)`, re-publishes tombstone `RegB(0,1,0)`. + Full merge including the transient: `RegB(1,1,10)` → inactive. + + Confirmed by running test_interleaved_delivery_grouping with M8_PerEntrySplit; + the witness must be caught before resorting to the full suite.""" + return test_interleaved_delivery_grouping(device_cls=M8_PerEntrySplit) + + +# --------------------------------------------------------------------------- +# M9: revert split_blob_into_slots to escaped-key grouping +# (groups frontier by wire key instead of unescaped logical ID — +# reproduces Thufir's round-2 CRITICAL) +# --------------------------------------------------------------------------- + +class M9_EscapedKeyGrouping(DeviceB): + """Reverts `split_blob_into_slots` to group the frontier key by its + ESCAPED wire key rather than the unescaped logical context ID. + + For a normal context like "c0", this is a no-op (escape_context_key("c0") + == "c0"), so M9 is identical to the correct model on normal contexts. + The defect only manifests when the raw context ID starts with a reserved + prefix — e.g. raw "ov_s:evil" escapes to frontier wire key "esc:ov_s:evil". + The ov_* sibling keys are keyed by the RAW suffix ("ov_s:evil"), while + the frontier is keyed by the escaped wire key ("esc:ov_s:evil") — two + identities for one logical context, so they land in different slots. + + This reproduces Thufir's round-2 CRITICAL: across publication cycles an + observer can receive the new frontier slot (esc:ov_s:evil=10) plus the + stale old-cycle override slot (ov_s/ov_c/ov_b at b=0), reconstructing + RegB(s=1,c=0,b=0) at frontier=10 — baseline-dead — and emitting tombstone + RegB(0,1,0). Full eventual delivery merges to RegB(1,1,10) — dead under + clear-wins — permanently suppressing a live override. + """ + + def split_blob_into_slots(self, tie_policy=CLEAR, n_slots=2): + """Split by original (escaped) wire key identity — does not unescape + frontier keys before grouping, so escaped contexts split incorrectly.""" + blob = self.publish_blob(tie_policy) + contexts = blob["contexts"] + + groups = {} # wire_key -> list of (wire_key, value) + for wire_key, value in contexts.items(): + if wire_key.startswith("ov_s:"): + ctx = wire_key[5:] + elif wire_key.startswith("ov_c:"): + ctx = wire_key[5:] + elif wire_key.startswith("ov_b:"): + ctx = wire_key[5:] + else: + ctx = wire_key # frontier: use escaped wire key as group ID (BUG) + groups.setdefault(ctx, []).append((wire_key, value)) + + slots = [{"v": blob["v"], "client_id": blob["client_id"], "contexts": {}} + for _ in range(n_slots)] + for i, (_ctx, pairs) in enumerate(sorted(groups.items())): + slot = slots[i % n_slots] + for wire_key, value in pairs: + slot["contexts"][wire_key] = value + return slots + + +def mutant_m9(): + """M9: escaped-key grouping must be caught by test_escaped_context_slot_grouping — + proving that the escaped-context regression test has teeth. + + For a context whose raw ID starts with a reserved prefix ("ov_s:evil"), + the frontier wire key is "esc:ov_s:evil" and the ov_* sibling keys are + "ov_s:ov_s:evil", "ov_c:ov_s:evil", "ov_b:ov_s:evil". The escaped-key + grouping treats "esc:ov_s:evil" (frontier) and "ov_s:evil" (ov_* suffix) + as different groups, splitting the register across slots. + + Old/new slot-coordinate mixture across publication cycles then reproduces + the round-1 transport poison: partial reconstruction → false tombstone → + permanent false clear of a live override. + + The test is parameterized to route through the "mismatched grouping" path + (else branch) when the M9 split puts frontier and siblings in different slots, + and the witness must be caught.""" + return test_escaped_context_slot_grouping(device_cls=M9_EscapedKeyGrouping) + + +# --------------------------------------------------------------------------- +# Runner +# --------------------------------------------------------------------------- + +def run_mutations(): + mutants = [ + ("M1: drop baseline dominance", mutant_m1), + ("M2: drop max(S,C)+1 bump", mutant_m2), + ("M3: tie policy distinguishable", mutant_m3), + ("M4: revert to delete-on-dominance compaction (reproduces pass-3 CRITICAL)", mutant_m4), + ("M5: uint32 overflow bypass", mutant_m5), + ("M6: last-write-wins merge", mutant_m6), + ("M7: publish without canonicalization (reproduces pass-1/2 CRITICAL)", mutant_m7), + ("M8: per-entry split violates atomic-grouping rule (reproduces pass-2/2 CRITICAL)", mutant_m8), + ("M9: escaped-key grouping splits escaped-ctx register across slots (reproduces round-2 CRITICAL)", mutant_m9), + ] + + print("=" * 60) + print("Mutation harness — candidate B") + print("=" * 60) + + caught = [] + missed = [] + for name, fn in mutants: + violations = fn() + if violations: + caught.append(name) + v = violations[0] + detail = str(v)[:200] + print(f" CAUGHT: {name}") + print(f" counterexample: {detail}") + else: + missed.append(name) + print(f" MISSED: {name}") + + print(f"\nCaught {len(caught)}/{len(mutants)} mutants") + if missed: + print(f"MISSED: {missed}") + print("=" * 60) + return len(missed) == 0 + + +if __name__ == "__main__": + import sys + sys.exit(0 if run_mutations() else 1) diff --git a/docs/nips/NIP-RS.md b/docs/nips/NIP-RS.md index 1ca30ea08f..6a095df60a 100644 --- a/docs/nips/NIP-RS.md +++ b/docs/nips/NIP-RS.md @@ -20,15 +20,14 @@ read. A user running Nostr clients on multiple devices (phone, desktop, web) has no way to share read position across those clients. Each instance independently tracks what has been read, causing already-read content to appear unread on other devices. -This NIP defines a minimal, privacy-preserving protocol for propagating read state across client instances without requiring relay-side logic or coordination between different client implementations. +This NIP defines a minimal, privacy-preserving protocol for propagating read state across client instances without requiring a new event kind, a new wire message, relay-stored read-state logic, or coordination between different client implementations. It is not free of relay obligations: a relay serving the manual-unread override layer's full-state load must satisfy the ordering, capacity, floor, push, and barrier contract that section enumerates. ## Non-Goals -This NIP does not define a durable log of all read messages — blobs are best-effort recent activity hints bounded by a time horizon. +This NIP does not define a durable log of all read messages — frontier blobs are best-effort recent activity hints bounded by a time horizon. Exception: `ov_*` override entries, including tombstone floors, are durable state — they are exempt from age pruning, budget eviction, and horizon-bounded fetching, they live in a single coordinate per installation, and they MUST be carried forward before that coordinate is deleted or abandoned (see Manual-Unread Override Layer — Override State Durability). This NIP does not define cross-client interoperability on context ID format — context identifiers are opaque by default and meaningful only within a single client family, except for OPTIONAL well-known schemes defined in this NIP (`thread:` and `msg:`, defined under Read Context Schemes), which are provided for cross-client thread/message-read interoperability. -This NIP does not define mark-as-unread — the merge rule is monotonic by design. This NIP does not guarantee ordering of read events across devices. -This NIP does not require relay-side logic. +This NIP does not require relay-stored read-state logic: no new event kind, no new wire message, and nothing a relay must interpret about read state. Clients implementing the manual-unread override layer do depend on relay behaviour their full-state load cannot verify (see Full-State Load). This NIP does not define read receipts, seen-by lists, or any mechanism for tracking what other users have read. @@ -53,18 +52,26 @@ Clients publish a `kind:30078` addressable event (per [NIP-78](78.md)) with the #### `d` Tag -The `d` tag MUST be `read-state:`, where `` is a random opaque string (e.g., 32 random hex characters) generated by the client on first launch and persisted locally. The `` has no relationship to the `client_id` — it is solely a unique key for NIP-33 addressable event semantics. Each client instance MUST use a stable, unique `` for the lifetime of that installation. +The `d` tag MUST be `read-state:`, where `` is exactly 32 lowercase hexadecimal characters (`[0-9a-f]{32}`), generated randomly by the client on first launch and persisted locally. The `` has no relationship to the `client_id` — it is solely a unique key for NIP-33 addressable event semantics. The shape is fixed rather than opaque so that a relay can recognize a read-state coordinate structurally, from the `d` tag alone and without decrypting anything, and apply per-coordinate protections to it; a client that picks some other shape is not merely stylistically different, it forfeits those protections silently. + +**Primary coordinate:** a client MUST designate one coordinate as its **primary** and MUST use a single stable, unique `` for it for the lifetime of that installation. The primary `` changes only on a `client_id` conflict (below) or rotation (see Client-ID Rotation). + +**Additional frontier-only coordinates:** a client MAY publish additional coordinates under distinct `` values when its primary blob would otherwise exceed the size budget. Additional coordinates MUST NOT contain `ov_*` entries — they carry frontier entries only, and are therefore freely rewritable and freely deletable (see Orphaned Blob Deletion). A client MUST persist the `` values of its additional coordinates locally so that it can rewrite and delete them. + +**All `ov_*` entries, and the frontier entries of the contexts they belong to, MUST live in the primary coordinate.** A client implementing the manual-unread override layer MUST NOT distribute `ov_*` entries across coordinates and MUST NOT move them between coordinates: there is exactly one override-bearing coordinate per installation. If a client fetches its own `d` tag coordinate and the decrypted `client_id` does not match its local `client_id`, the coordinate is conflicted. The client MUST NOT publish to that coordinate and MUST generate a new random `` before the next publish. Events with zero `d` tags MUST be ignored. Events whose `d` tag value does not begin with `read-state:` MUST be ignored. Events with more than one `d` tag MUST be ignored. -The `` MUST be a non-empty ASCII string of 1–64 characters. +Events whose `` is not exactly 32 lowercase hexadecimal characters MUST be ignored. + +Recognizable coordinates also serve the accumulation discipline this NIP depends on: a relay that can identify a read-state coordinate structurally can replace superseded versions outright instead of retaining a tombstone row per publish, which keeps the coordinate count a full-state load must enumerate near one per live installation (see Full-State Load). #### `t` Tag -Events MUST include exactly one `["t", "read-state"]` tag. This enables relay-side filtering without fetching all `kind:30078` events for the user. +Events MUST include exactly one `["t", "read-state"]` tag. The tag is a discoverability marker: it lets a client express "read-state events only" in a single filter. It is not a guarantee of relay-side selectivity — a relay MAY apply tag constraints after its result cap, and `kind:30078` is shared with unrelated application data — so clients MUST apply the tag as a correctness filter locally on everything they receive, and MUST NOT infer from a short result that no further coordinates exist. A client performing a full-state load MUST omit the tag from its filter entirely (see Full-State Load). Events with zero `t` tags with value `read-state`, or more than one `t` tag with value `read-state`, MUST be ignored. @@ -104,6 +111,7 @@ After decryption, clients MUST apply the following validation rules: - Events whose `contexts` field is not a JSON object MUST be discarded. - Individual context entries whose timestamp is not an integer in the range 0–4294967295 MUST be discarded (the entry is dropped; the rest of the blob is still processed). - Individual context entries whose context ID exceeds 256 bytes MUST be discarded. +- Override counter entries (keys beginning with `ov_s:`, `ov_c:`, or `ov_b:`) MUST be validated as a complete logical group BEFORE any decoding, zero-filling, merging, or canonicalizing. Clients MUST collect all `ov_s:`, `ov_c:`, and `ov_b:` entries for the same `` suffix together before processing them. The only accepted wire shapes for an override group are: (a) a complete live group containing exactly the three keys `ov_s:`, `ov_c:`, and `ov_b:` with valid uint32 values, or (b) a tombstone floor containing only `ov_c:` with a valid uint32 value. Any other shape (partial group, extra keys, or invalid value in any sibling) MUST cause the entire override group to be rejected; the corresponding frontier entry for `` MUST be retained. Applying the generic per-entry discard rule before group collection is prohibited for override entries. - Blobs containing more than 10,000 context entries MUST be rejected. - If a blob contains duplicate context keys, clients SHOULD use the last value encountered (consistent with RFC 8259 §4). - Clients SHOULD ensure the total serialized event does not exceed the relay's maximum event size (commonly 64 KB per NIP-01). Clients receiving events that exceed their configured size limit SHOULD discard them. @@ -112,6 +120,15 @@ After decryption, clients MUST apply the following validation rules: Context identifier format is not prescribed by this NIP. Clients choose identifiers appropriate to their context type (e.g., a NIP-28 channel event ID, a NIP-29 group address, a pubkey for DMs). Interoperability between different client implementations on context ID conventions is outside the scope of this NIP. +#### Reserved Namespace + +The key prefix stem `ov_` (3 bytes) and the escape marker `esc:` (4 bytes) are reserved for the manual-unread override layer defined below. Clients MUST escape any raw context ID that begins with `ov_` or `esc:` when using it as a frontier key in the `contexts` map: + +- **On publish:** prepend `esc:` to any raw context ID beginning with `ov_` or `esc:` before writing it as a frontier key (e.g., raw `ov_s:evil` → wire key `esc:ov_s:evil`; raw `esc:foo` → wire key `esc:esc:foo`). +- **On receive:** strip exactly one leading `esc:` from any frontier wire key beginning with `esc:` to recover the raw context ID (e.g., wire key `esc:ov_s:evil` → raw `ov_s:evil`; wire key `esc:esc:foo` → raw `esc:foo`). This is a bijection — applying escape then unescape is the identity function. Clients MUST NOT strip more than one `esc:` prefix per receive. + +**Backward-compatibility limitation:** a context published *unescaped* by a client predating this amendment, whose raw ID happens to start with `ov_` or `esc:`, is not safely migrated. The scheme protects contexts generated by amendment-aware clients going forward; it does not retroactively rewrite history. This residual hazard is documented as a known limitation. Buzz's own context ID shapes (channel UUID, `msg:hex64`, `thread:hex64`) cannot trigger it. + #### Read Context Schemes (Optional) This subsection defines OPTIONAL well-known context schemes for tracking read @@ -281,13 +298,13 @@ Because context timestamps are derived from message `created_at` values — whic ### Fetching -To load read state, a client MUST fetch all `kind:30078` events for the user within the time horizon using the `#t` filter: +To load read state, a client MUST fetch all `kind:30078` events for the user. Unless it is performing a full-state load (below), it SHOULD narrow the fetch with the `#t` filter: ```json -{"kinds": [30078], "authors": [""], "#t": ["read-state"], "since": } +{"kinds": [30078], "authors": [""], "#t": ["read-state"]} ``` -Clients SHOULD limit the fetch to events with `created_at` within a configurable time horizon (default: 7 days). +Clients that neither read nor write `ov_*` override state SHOULD limit the fetch to events with `created_at` within a configurable time horizon (default: 7 days) by adding `"since": `, accepting that frontiers older than the horizon become unknown. Clients that implement the manual-unread override layer MUST NOT filter the fetch by age or by tag, and MUST establish completeness (see Full-State Load below). After fetching, clients MUST: @@ -295,11 +312,71 @@ After fetching, clients MUST: 2. Discard blobs that fail validation (see Content Validation). 3. Identify the blob whose decrypted `client_id` matches the client's own `client_id` — this is the client's own blob. -If multiple blobs decrypt to the same `client_id` (e.g., due to a prior rotation that left an orphaned blob, or a backup/restore that duplicated identifiers), the client MUST treat the blob with the highest `created_at` as its own and merge all others into the read state as if they were from other instances. The client SHOULD delete the stale duplicate(s) via NIP-09 deletion. +If multiple blobs decrypt to the same `client_id` (e.g., due to a prior rotation that left an orphaned blob, or a backup/restore that duplicated identifiers), the client MUST treat the blob at its own primary coordinate as its own and merge all others into the read state as if they were from other instances. If none of them is at the client's own primary coordinate, the blob with the highest `created_at` is its current reference. Deletion of such a stale duplicate is governed by Orphaned Blob Deletion — a duplicate carrying `ov_*` entries MUST NOT be deleted until its override state has been carried forward. 4. Merge all valid blobs (including the client's own) using the merge rule. -Absence of a context in all fetched blobs means the read state for that context is **unknown** — clients SHOULD treat unknown contexts as unread (conservative default). The horizon is a storage and fetch optimization, not a semantic claim about read status. Contexts that were read but have aged out of the time horizon are indistinguishable from never-read contexts. Clients MAY extend the horizon or maintain a local cache to mitigate this. +Absence of a context in all fetched blobs means the read state for that context is **unknown** — clients SHOULD treat unknown contexts as unread (conservative default). For clients using a finite horizon, the horizon is a storage and fetch optimization, not a semantic claim about read status: contexts that were read but have aged out of the time horizon are indistinguishable from never-read contexts. Clients MAY extend the horizon or maintain a local cache to mitigate this. Clients implementing the override layer do not filter the fetch by age at all (see above), so for them this ambiguity arises only from write-time frontier pruning. + +#### Full-State Load + +Clients that implement the manual-unread override layer MUST perform a **full-state load**: they MUST NOT apply a finite `since` filter, and they MUST establish that every one of the user's `read-state` coordinates has been retrieved. Because the payload is encrypted, a relay filter cannot select for override-bearing events: any event-level window can exclude the only coordinate carrying a tombstone floor, which reopens the resurrection witness in Override State Durability regardless of any per-entry exemption. For these clients the time horizon is a *write-time* frontier pruning policy only (see Debounce and Pruning), never a fetch filter. + +Removing `since` does not by itself make the result complete. Relays MAY cap the number of events returned for a historical query, MAY cap below the client's requested `limit`, and emit end-of-stored-events after the capped query — so **a single query proves nothing.** End-of-stored-events marks the end of the capped result, not the end of the matching set, and a short result does not establish that no further coordinates exist. Caps typically retain the newest events and drop the oldest, which are precisely the rotation-predecessor and orphaned coordinates whose tombstone floors this layer depends on. A silently truncated load that omits the sole carrier of a floor merges a stale live register unopposed and reports a manually-unread context as read, permanently. + +A full-state load MUST therefore be enumerated with no tag constraint in the filter: + +```json +{"kinds": [30078], "authors": [""], "limit": } +``` + +A relay MAY deliver fewer events than its result cap selected — for example, by applying tag constraints only after the cap and withholding the events that fail them. Under a tag-constrained filter the number of events the client receives is therefore not the number the cap selected: a delivered page can be short, or empty, while older matching coordinates still exist below it, and no observation the client can make distinguishes the two. `kind:30078` is arbitrary application data whose `d` tag namespace is open to every application that has ever written under the user's key, so this is not a hypothetical — a page can be filled entirely by coordinates unrelated to read state. With the tag constraint omitted, the client asks for exactly what it will accept, and the events the cap selects are the events it receives. Selection moves client-side, which is where the validation rules already place it: collect coordinates only from `d` tags of the form `read-state:` and ignore every other event. The cost is that the client fetches its own application data at that kind rather than a relay-selected subset of it. + +A client MUST NOT test completeness by comparing the number of events returned against the `limit` it requested: the effective cap is the relay's, a relay MAY cap below the requested value, and a relay's advertised maximum limit is not necessarily the limit it enforces — so no comparison against the requested `limit` is a valid truncation test. What the client MAY compare is one delivery against another. Let `C` be the largest number of events the relay delivered for any single **preceding** query in this load. The relay demonstrably delivered `C` events at once, so its cap is at least `C`, and a query that delivers fewer than `C` events was not cut short by that cap. Completeness is established by continuation on a strictly decreasing cursor, with each band discharged by that comparison. + +`C` yields nothing at the start of a load, and yields nothing for the whole of a load whose entire history at this kind is a single event: one delivery of one event bounds the cap below by one, and no delivery can be smaller than that. The procedure therefore also fixes a floor, `L = 2`, required of relays below. A delivery is bounded by the requested `limit` as well as by the relay's cap, so the floor licenses a conclusion about a delivery only together with step 1's requirement that the requested `limit` be at least `L`: what the client may conclude is that a query it issued for at least `L` events, whose matching set holds at least `L`, delivers at least `L`. A threshold above the requested `limit` would be unreachable by construction, and a test that can never be met declares a truncated page exhausted. It is stated at the smallest value that admits a second event, because a larger floor is a stronger claim about relays that buys nothing further: a relay that will deliver only one event per query cannot express `limit` semantics and cannot serve a user who has two coordinates at all, whereas any floor above two would begin excluding relays this procedure does not need to exclude. + +Enumeration descends, so it cannot see a coordinate that moves *up* while it runs. Because these are addressable events, a republish replaces the previous version rather than appending: a coordinate the client already collected at a low `created_at` can be replaced, during the load, by a version above the cursor the client has already passed — and the old version stops existing, so no continuation and no pinned window will ever return either one. If that new version carries a tombstone floor the old one lacked, a load that reported *complete* merged without it. + +A full-state load therefore MUST be fenced by a live subscription on the same tag-free filter, established **before** the first enumeration query and held unbroken for the duration of the load. The fence is *established* when the client has received end-of-stored-events for that subscription, not when it sent the request: sending a request is not an observation, and the relay's answer to it is the first point at which the client knows the subscription is registered and that what the relay accepts from then on will be pushed to it. The fence and every enumeration query MUST be issued on the same connection. + +Every event the fence delivers is collected exactly as an enumerated event is (step 2), which is what repairs the moved coordinate: the replacing event is itself what the relay pushes. Delivery is necessary but not sufficient — it must be delivery *before the verdict*, and those are different properties. Under push delivery alone, a relay that accepts a replacement, removes the version sitting below the cursor, and pushes the replacement some time later has violated nothing: the enumeration in between finds neither version, the pinned window and the continuation both come back empty, and the load reports *complete* moments before the fence delivers the floor it was missing. Ordering that push ahead of the verdict is what the delivery barrier below requires of the relay. On the client side, the verdict MUST NOT be rendered until end-of-stored-events for the final continuation has been received and every fence delivery received before it has been collected. + +If the client did not hold such a subscription for the whole load, or it lapsed or reconnected at any point during it, the load is potentially incomplete regardless of what the enumeration returned. A client MUST NOT publish to its own coordinates while its own load is in progress; a self-inflicted replacement is the same defect with the client on both ends of it. + +1. Every query MUST carry the same explicit `limit` `n`, `n` MUST be at least `L`, and no query MUST constrain tags. `C` and the floor are only meaningful across queries that differ solely in their time bounds. `n` SHOULD be substantially larger than `L`: `n` bounds how many events a single band can retrieve, so a small `n` costs round trips without making any verdict safer. +2. From each delivered event, collect the read-state coordinates — those whose `d` tag has the form `read-state:` — deduplicating by `d` tag value and retaining, of the entries sharing a `d` tag value, the one with the greatest `created_at`, and on equal `created_at` the one with the lexicographically lowest event id. That is the addressable ordering NIP-01 defines, and both halves of it are load-bearing here: a replacement published in the same second as the version it replaces is legal and is the one the relay retains, so a retention rule that only compares `created_at` may keep the superseded version even when the fence delivered its successor perfectly. Ignore the other events, but count them: they are part of what the cap returned. Events the fence delivers are collected the same way, but MUST NOT contribute to `T` or to `C`: they are not a query result, and an event arriving below the cursor would otherwise move it down and skip the band between. Collection is what recovers a moved coordinate; the cursor descends on query results alone. +3. Let `T` be the lowest `created_at` across **all** events delivered by the queries in this load, not only the read-state ones. The cursor therefore advances on every non-empty page, including one that yielded no coordinate. +4. Before advancing past `T`, the client MUST query the pinned window `{"since": T, "until": T}` and merge the result. A cap can cut mid-second, leaving events at `T` that a continuation at `"until": T - 1` would skip forever; pinning both bounds to one second removes every event outside that second from contention for the cap. +5. Second `T` is exhausted only if that pinned query delivered fewer than `max(C, L)` events. If it delivered `max(C, L)` or more, the cap may have bound inside the second, no finer cursor exists on the standard filter surface, and the load is **potentially incomplete** and MUST be reported as such. This verdict is terminal for the load: the client MUST NOT continue to step 6, and no later observation upgrades it. A continuation past an undischarged second can deliver nothing simply because that second was the oldest, so an empty continuation is not evidence that the second above it was exhausted. +6. Otherwise continue with `"until": T - 1`. Because a bare `until` is inclusive, decrementing guarantees each continuation covers a strictly older band, so the loop makes progress regardless of how the relay caps. +7. The load is **complete** when a continuation delivers no events at all, every preceding second having been discharged by step 5, the fence having been established before the first query and held unbroken since, and every fence delivery received up to that continuation's end-of-stored-events having been collected. Because the filter constrains nothing the relay applies after its cap, an empty delivery is an empty result — a cap that returns nothing is not a cap. +8. A load that failed, or whose fence lapsed, on any relay the client publishes to is potentially incomplete (see Read-Before-Write). + +This layer places five requirements on every relay a client performs a full-state load against. They are stated normatively, not as background assumptions, because a *complete* verdict rests on them and none of them is verifiable from the responses a client receives: + +- **Newest-first prefix delivery.** A capped result MUST consist of the newest events by `created_at` for the filter, ties broken by lowest id — the delivery NIP-01 already specifies for `limit`. A relay that caps by returning some other subset can omit an event lying *above* the cursor the client derives from that same delivery, so the omitted event is never queried at all. Repeating a query cannot recover it, because the same filter with the same bounds is the same request. +- **Non-decreasing effective cap within a load.** A relay MUST NOT reduce, within a single load, the number of events it will deliver for queries that differ solely in their time bounds. A cap that shrinks between the query establishing `C` and a later pinned window makes that window's short delivery indistinguishable from exhaustion, which converts a truncated second into a discharged one. +- **The floor `L`.** A relay MUST deliver at least `L` events for a query whose matching set holds at least `L` and whose requested `limit` is at least `L`. `L = 2`, fixed by this NIP; a client MUST NOT derive it from relay-advertised discovery, because an advertised maximum is not necessarily the limit a relay enforces. +- **Push delivery on an open subscription.** A relay MUST deliver every event it accepts that matches an open subscription's filter to that subscription. The mutation fence in step 2 is exactly this delivery; a relay that accepts a replacement without pushing it gives the client no way to observe a coordinate that moved above the cursor. +- **The delivery barrier.** Before a relay sends end-of-stored-events for a query, every event it accepted before that query read its stored events, and which matches an open subscription on the same connection, MUST already have been delivered to that subscription. Push delivery alone promises only that the replacement arrives eventually; the barrier is what places it before the verdict that depends on it. Without it, a relay whose accept path and query path proceed independently can answer a query from storage the replacement has already changed while the corresponding push is still pending, and the client discharges the load in the interval between the two. + +A client cannot distinguish a relay that violates any of these from one that simply had fewer events to return, so these are conformance preconditions of this layer rather than properties a load establishes. A client MUST NOT perform a full-state load against a relay it knows, or has evidence, to violate them, and MUST treat any load against such a relay as potentially incomplete. Conditioning *complete* on positive proof of these properties instead would be equivalent to never issuing it — no such proof exists on the standard filter surface — which would withdraw the override layer from every client rather than from the non-conforming relays. + +The comparison in step 5 fails safe: a pinned window is reported potentially incomplete unless the relay has already shown it will deliver at least that many at once, so an inconclusive result is never mistaken for an exhaustive one. A plateau of more events at a single `created_at` than the relay will deliver for a window pinned to that second is therefore unenumerable, because this NIP defines no finer cursor, and it resolves to *cannot prove complete* rather than to a false *complete*. The comparison is a lower bound on the cap rather than the cap itself, so it is also conservative in the other direction: a load whose oldest second holds as many events as the largest delivery observed so far resolves to *cannot prove complete* even where the relay would have delivered more. Where more than one coordinate exists this is transient, because any later publish moves that coordinate to a different second and separates the two. + +The floor is the narrowest of the five requirements and the one that makes the ordinary case reachable at all. A coordinate at a replaceable kind contributes exactly one event no matter how many times it is republished, because a republish replaces the previous version rather than appending to it; a client's event count at this kind therefore does not grow over time, and a single-installation client publishing under one coordinate has one event at one second permanently. Without a floor, `C` for such a client is one, its pinned window delivers one, and step 5 can never be discharged — mark-unread would be permanently unavailable to the most common conforming deployment, and no amount of waiting or republishing would change the observation. `L = 2` discharges it: the pinned window delivers one event, `max(C, L)` is two, `1 < 2`, the second is exhausted, and the continuation below it is empty. That same replacement behaviour is what the fence exists for: the one event a coordinate contributes can move, and it moves by being replaced. + +A **potentially incomplete** load MUST NOT be the basis for any of the following, each of which either destroys override state or asserts authority over it: + +- canonical compaction of an override register (see Mandatory Canonical Publication), +- publishing a canonicalized override blob, +- deleting or abandoning any coordinate (see Orphaned Blob Deletion), +- reporting an explicit mark-read as successful (see Actions). + +Until a complete load succeeds, the client MUST evaluate unread state from its own locally persisted state and MUST report override actions as failed rather than acting on a partial view. The honest terminal states are *complete* and *cannot prove complete*; a client MUST NOT treat the second as the first. + +The number of coordinates a full-state load must retrieve is bounded by the number of installations that have ever used the override layer, plus their not-yet-deleted rotation predecessors. It grows with the user's device history, not with elapsed time, and — because a coordinate carrying `ov_*` entries may not be deleted until it has been carried forward (see Client-ID Rotation) — it does not shrink on its own. Clients SHOULD carry forward and delete rotation predecessors promptly so the count stays near one coordinate per live installation. ### Merge Rule @@ -311,6 +388,8 @@ effective[context] = max(timestamp) across all blobs This is a grow-only max-register state-based CvRDT with an associative, commutative, idempotent join. Clients MUST NOT lower a read timestamp — only advance it. +The manual-unread override layer (see Manual-Unread Override Layer below) adds per-context set/clear counters merged by the same componentwise `max()` rule. The frontier merge rule is unchanged. + ### Writing Clients MAY publish read state automatically when read-position sync is part of @@ -320,28 +399,32 @@ to other users MUST require explicit user consent. Clients SHOULD publish read state blobs to the same relays they use for general event storage. Clients that implement NIP-65 (relay list metadata) SHOULD publish to their write relays and fetch from their read relays. -Each client instance maintains its own blob (one `kind:30078` event per ``). Writing replaces the previous blob via parameterized replaceable event semantics ([NIP-33](33.md)). +Each client instance maintains its own primary blob (one `kind:30078` event at its primary coordinate), plus one event per additional frontier-only coordinate if it uses any. Writing replaces the previous blob at each coordinate via parameterized replaceable event semantics ([NIP-33](33.md)). -Clients MUST only update the blob whose decrypted `client_id` matches their own `client_id`. Clients MUST NOT overwrite another instance's blob. +Clients MUST only update blobs whose decrypted `client_id` matches their own `client_id`. Clients MUST NOT overwrite another instance's blob. -If the client discovers multiple blobs with its own `client_id` during a fetch, it MUST select the one with the highest `created_at` as its active blob and SHOULD delete the others. +If the client discovers same-`client_id` blobs at coordinates that are neither its primary nor one of its known additional coordinates (e.g., rotation orphans or backup/restore duplicates), it MUST merge them into its own state and MUST NOT delete them until their override state has been carried forward (see Orphaned Blob Deletion). It MUST NOT publish to them: its own writes go to its primary and its known additional coordinates only. #### Read-Before-Write Before publishing, a client MUST: -1. Fetch its own current blob from each relay it intends to publish to, and merge all fetched versions. +1. Fetch its own current blob(s) from each relay it intends to publish to, and merge all fetched versions. -The client fetches its own blob using its known `d` tag value: +A client fetches its own coordinates using their known `d` tag values — its primary, plus its additional frontier-only coordinates if any — and unions them componentwise: ```json -{"kinds": [30078], "authors": [""], "#d": ["read-state:"]} +{"kinds": [30078], "authors": [""], "#d": ["read-state:", "read-state:", ...]} ``` -2. Decrypt and merge the fetched blob with local state using `max()` per context. +A read-before-write fetch of the client's own coordinates is not a full-state load: it cannot discover rotation orphans or duplicates. Before canonicalizing override state or publishing a canonicalized override blob, the client MUST have a complete full-state load (see Full-State Load). + +2. Decrypt and merge the fetched blob(s) with local state using `max()` per context. 3. Publish the merged result. -If a relay is unreachable during the fetch step, the client SHOULD proceed with the data available from reachable relays. The merge rule ensures that data from the unreachable relay will be incorporated on the next successful fetch, provided the relay retains the event. Permanent relay loss or event expiry may result in state loss — this is an accepted property of the best-effort model (see Non-Goals). +If a relay is unreachable during the fetch step, the client SHOULD proceed with the data available from reachable relays. The merge rule ensures that data from the unreachable relay will be incorporated on the next successful fetch, provided the relay retains the event. Permanent relay loss or event expiry may result in loss of frontier state — this is an accepted property of the best-effort model (see Non-Goals). + +That accepted loss does not extend to override state. A client MUST NOT treat a fetch that failed on any relay it publishes to as a complete view of its own override state, and MUST NOT canonicalize, publish canonicalized override state, or delete or abandon any of its own coordinates on the basis of such a partial fetch (see Full-State Load). Clients implementing the override layer SHOULD publish override state to more than one relay so that the loss of a single relay does not erase a tombstone floor. This read-before-write requirement also applies to re-publishes triggered by incoming blobs from other instances (see Live Subscription and Convergence). @@ -358,12 +441,14 @@ Clients SHOULD subscribe to `kind:30078` events for their own pubkey with `#t: [ When a blob from another client instance arrives (i.e., its decrypted `client_id` does not match the client's own `client_id`): 1. Merge it into local state using `max()` per context. -2. If any context timestamp in the incoming blob is greater than the corresponding timestamp in the client's last-published blob (or the context is absent from the last-published blob), perform a read-before-write and re-publish the client's own blob after a debounce delay. -3. Clients MUST suppress the re-publish if the merged result is identical to the client's last-published blob. A client that has never published treats its last-published blob as empty. +2. Canonicalize the merged override state against the client's own effective frontier (applying the tombstone floor and live/dead/virgin rules from Mandatory Canonical Publication). If any context entry in the canonical merged result differs from the corresponding entry in the client's last-published canonical blob (or the context is absent from the last-published blob), perform a read-before-write and re-publish the client's own blob after a debounce delay. +3. Clients MUST suppress the re-publish if the canonical merged result is identical to the canonical form of the client's last-published blob. Comparing canonical-to-canonical prevents a retained live peer blob (which the client has already tombstoned) from triggering an identical write on every replay. A client that has never published treats its last-published blob as empty. 4. Clients SHOULD limit re-publishes triggered by incoming blobs to at most one per debounce window, regardless of how many blobs arrive during that window. This drives convergence without a coordination round-trip, assuming eventual relay reachability and event retention. +A live subscription is not a full-state load. A relay MAY return a capped set of stored events before end-of-stored-events on this filter, so a client implementing the override layer MUST NOT treat what the subscription delivers as a complete view of its coordinates (see Full-State Load). Merging an incoming blob into local state (step 1) is always safe, because merge is componentwise `max()`; the canonicalize-and-re-publish in steps 2–3 is a canonical publication and therefore requires a complete full-state load. A client that does not have one MUST defer the re-publish rather than publish a canonical blob derived from a partial view. A subscription is nonetheless a required *component* of a full-state load, serving as its mutation fence, and the fence MUST use the tag-free filter rather than the `#t`-narrowed one above — a replacement it fails to deliver is a replacement the descending enumeration cannot recover. + #### Clock Skew When publishing, if the client's local clock produces a `created_at` value less than or equal to the maximum `created_at` seen across all fetched blobs for the same `d` tag, the client MUST use `max_fetched_created_at + 1` instead. @@ -372,17 +457,158 @@ When publishing, if the client's local clock produces a `created_at` value less Clients SHOULD debounce writes to avoid excessive relay traffic (e.g., flush 5–10 seconds after the last local read-state change, or on app close/background transition). Clients MUST NOT write on every individual read action. -The blob SHOULD contain only contexts the client has explicitly interacted with. Clients SHOULD prune aggressively, prioritizing recently-active contexts, and MAY drop entries older than the time horizon before writing. Clients MUST ensure the published event does not exceed relay event size limits (typically 64 KB content). +The blob SHOULD contain only contexts the client has explicitly interacted with. Clients SHOULD prune aggressively, prioritizing recently-active contexts, and MAY drop frontier entries older than the time horizon before writing. Clients MUST NOT drop `ov_*` override entries (including tombstone floors) based on age or budget pressure; see Override State Durability in the Manual-Unread Override Layer section. Clients MUST ensure the published event does not exceed relay event size limits (typically 64 KB content). #### Client-ID Rotation -Clients MAY rotate their `client_id` by generating a new one, generating a new random ``, and publishing a new blob. The old blob becomes orphaned and ages out of the time horizon naturally. Rotation adds one extra blob temporarily. Clients SHOULD keep their `client_id` stable for as long as possible to minimize blob proliferation. +Clients MAY rotate their `client_id` by generating a new one, generating a new random `` for the primary coordinate, and publishing a new blob. Rotation adds one extra blob temporarily. Clients SHOULD keep their `client_id` stable for as long as possible to minimize blob proliferation. + +Rotation is the only event that changes a client's override-bearing coordinate, and it carries the layer's single durability obligation: + +**Carry-forward rule.** Before deleting or abandoning its previous primary, a rotating client MUST publish the componentwise `max()` of every override register the old primary holds — every tombstone ceiling included — under its new primary, and MUST confirm acceptance **on every relay from which the old primary will be deleted or allowed to lapse**. If any such relay rejects the publish or is unreachable, the client MUST retain the old primary on that relay and MUST NOT delete it there. Acceptance on one relay does not authorize deletion on another: a relay that never received the replacement would otherwise be left with no local carrier of the floor. The old primary MUST NOT be left to age out while it is the only carrier of an override floor on any relay. -If a device backup or clone results in two installations sharing the same `client_id` and `slot-id`, both will write to the same blob. This is operationally equivalent to a single client and does not corrupt state, but the two installations will overwrite each other's context entries. Clients that detect this condition (e.g., by observing unexpected context changes in their own blob) SHOULD generate a new `client_id` and `slot-id`. +Additional frontier-only coordinates carry no override state, so rotation may abandon or delete them freely. + +If a device backup or clone results in two installations sharing the same `client_id` and primary ``, both will write to the same coordinate. This is operationally equivalent to a single client and does not corrupt state, but the two installations will overwrite each other's context entries. Clients that detect this condition (e.g., by observing unexpected context changes in their own blob) SHOULD generate a new `client_id` and a fresh primary ``, again carrying override state forward per the carry-forward rule. #### Orphaned Blob Deletion -Clients MAY delete blobs from decommissioned client instances by publishing a `kind:5` deletion event per [NIP-09](09.md) targeting the orphaned event's `a` tag coordinate (`30078::`). This is optional — orphaned blobs are harmless and age out naturally. +Clients MAY delete blobs from decommissioned client instances by publishing a `kind:5` deletion event per [NIP-09](09.md) targeting the orphaned event's `a` tag coordinate (`30078::`). For blobs carrying no `ov_*` entries — including a client's own additional frontier-only coordinates — this is optional and unconditional: such blobs are harmless and age out naturally. + +A blob carrying `ov_*` entries MUST NOT be deleted or abandoned until its override state has been carried forward per the carry-forward rule in Client-ID Rotation. This applies to the client's own previous primary and to same-`client_id` orphans discovered from a prior rotation or a backup/restore. A client's record of its own coordinates MAY be stale — for example restored from a backup taken before a rotation — so an unknown same-`client_id` coordinate MUST be treated as a live carrier of override state, not as a deletable duplicate, until it has been merged and carried forward. + +### Manual-Unread Override Layer + +This section defines a manual mark-as-unread mechanism as a CRDT override layer within the existing `contexts` map. It does not change the frontier merge rule, event structure, or encryption scheme. Fetching follows the override-specific full-state procedure (see Full-State Load) rather than the horizon-bounded fetch used by clients that do not implement this section. Clients that do not implement this section remain fully interoperable (see Backwards Compatibility). + +#### Wire Encoding + +For each manually-unread context ``, a client publishes up to three sibling keys alongside the existing frontier entry in the `contexts` map: + +| Key | Type | Description | +|-----|------|-------------| +| `ov_s:` | uint32 | Set counter S — incremented on each mark-unread | +| `ov_c:` | uint32 | Clear counter C — incremented on each mark-read | +| `ov_b:` | uint32 | Baseline B — the effective frontier value at the time of the most recent mark-unread | + +Values MUST be integers in the range 0–4294967295 (same validation range as context timestamps). The `` suffix is the raw context ID without any escaping (escaping applies only to the frontier wire key; see Reserved Namespace). + +#### Merge Rule (Override Registers) + +Override counters are merged by componentwise `max()`, identical to the frontier merge rule: + +``` +merged_S[ctx] = max(S) across all blobs +merged_C[ctx] = max(C) across all blobs +merged_B[ctx] = max(B) across all blobs +``` + +No new wire-level merge logic is required. The same `mergeReadStateEvents` path that joins frontier timestamps joins the counter entries as integer max. + +#### Liveness Predicate + +A context `ctx` has an active manual-unread override if and only if ALL of the following hold, evaluated against the merged register `(S, C, B)` and the merged effective frontier `F`: + +1. `S > 0` — at least one mark-unread action has been recorded. +2. `F <= B` — the effective frontier has not advanced past the baseline captured at mark-unread time. (A natural frontier advance strictly past `B` dominates a stale set, clearing the override without any explicit clear action.) +3. `S > C` — set counter exceeds clear counter. (`S == C` is treated as inactive: clear wins on ties — see Tie Policy.) + +Formally (clear-wins is the only conforming tie policy — see Tie Policy): + +``` +override_active(S, C, B, F) = + S > 0 + AND F <= B + AND S > C +``` + +The **unread verdict** for a context is: + +``` +unread(ctx) = (latest_message_ts > F) OR override_active(S, C, B, F) +``` + +where `latest_message_ts` is the `created_at` of the newest message in the context. + +#### Actions + +Every action below requires a complete full-state load (see Full-State Load); on a potentially incomplete load the client MUST report the action as failed rather than act on a partial view of its own override state. + +**Mark-unread:** increment S to `max(S, C) + 1`; set B to the current effective frontier value for the context. C is unchanged. If `max(S, C) == 4294967295` (uint32 maximum), the client MUST refuse the mark-unread action and leave the register unchanged; wrapping or resetting to zero is prohibited. + +**Mark-read (explicit):** advance the frontier to cover the context as normal; increment C to `max(S, C) + 1`. S and B are unchanged. If `max(S, C) == 4294967295`, no representable counter increment exists; wrapping or resetting to zero is prohibited. The client MUST then complete the action only if the resulting state satisfies `override_active == false` — i.e. the frontier advance alone deactivates the override, or the override was already inactive. Otherwise the counters MUST be left unchanged and the client MUST report the mark-read as failed; the monotone frontier advance itself is still permitted, but a client MUST NOT report an explicit mark-read as successful while `override_active` remains true. + +**Natural read (frontier advance):** advance the frontier past B. No counter update is needed — the liveness predicate's `F <= B` condition automatically deactivates the override when the frontier dominates the baseline. + +#### Tombstone Floor + +A register where `S > 0` or `C > 0` (ever-active) that evaluates as inactive MUST be compacted to the tombstone floor before publication: + +``` +tombstone = RegB(S=0, C=max(S, C), B=0) +``` + +This preserves the counter ceiling as a reuse-blocking floor. A register where `S == 0` and `C == 0` (virgin, never activated) MUST be omitted from the wire entirely (0 keys). + +#### Mandatory Canonical Publication + +Publishers MUST canonicalize every override against their own effective frontier at serialization time before writing to the wire: + +- **Live override** (`override_active` is true): publish all three keys (`ov_s:`, `ov_c:`, `ov_b:`) with their current values unchanged. +- **Dead override** (`override_active` is false, `S > 0` or `C > 0`): publish only the tombstone floor — a single `ov_c:` key with value `max(S, C)`. +- **Virgin register** (`S == 0` and `C == 0`): omit all three keys from the wire. + +This is a protocol requirement, not an optimization. A client that publishes raw (non-canonical) dead registers can cause two independently-dead registers from different devices to produce a live join on merge. See `docs/formal/nip-rs-unread/` for the exhaustive proof and mutation harness. + +#### Override Group Co-Location Rule + +A context's frontier entry and ALL of its `ov_*` sibling entries MUST travel in the same event, and that event MUST be the primary coordinate. Because all `ov_*` entries live in the primary (see `d` Tag), an override-bearing context has exactly one legal destination for its whole group: a client that splits frontier entries into additional coordinates MUST NOT move the frontier entry of an override-bearing context out of the primary, and MUST NOT place `ov_*` entries anywhere else. Only frontier-only groups — contexts with no `ov_*` entries — may be distributed across additional coordinates. + +Implementations that split blobs across coordinates MUST group context entries per logical context — not per individual key — and assign the entire group atomically to one coordinate. Round-robin or other assignment strategies MUST operate on groups, not on individual entries. + +**Unescape-before-group rule (corollary):** when grouping, a frontier wire key MUST be unescaped to its raw logical context ID (stripping one leading `esc:` if present) before being used as the group identity. Without this step, a frontier key `esc:ov_s:evil` and its `ov_*` siblings (keyed by the raw suffix `ov_s:evil`) resolve to different groups and the register splits across coordinates, reproducing the partial-reconstruction poison across publication cycles. + +**Rationale:** a receiver holding only a partial group (e.g., `ov_s:ctx` without `ov_b:ctx`) reconstructs a register with incorrect baseline and may canonically publish a false tombstone. With atomic grouping, a compliant publisher's output never permits partial reconstruction. + +#### Tie Policy + +**Clients MUST use clear-wins.** When `S == C` and `S > 0`, the override MUST be treated as inactive, and the register MUST be compacted to the tombstone floor on publication (see Tombstone Floor). + +Clear-wins is normative rather than a local implementation choice because the tie verdict is not encoded on the wire. Two conforming clients holding the same merged register `(S, C, B, F) = (1, 1, 10, 10)` would otherwise disagree permanently: a clear-wins client reports read and publishes the single-key tombstone floor, a set-wins client reports unread and publishes all three keys. Further deliveries converge the counters but can never converge either the verdict or the canonical wire form, which defeats cross-device synchronization. Supporting a selectable tie policy would require encoding the policy in the blob plus a separate interoperability design; neither is in scope here. + +Clear-wins also matches the product semantics this layer is designed for: a false negative (a missed badge) is recoverable by re-marking unread, while a false positive (a badge that will not clear) is more disruptive. See `docs/formal/nip-rs-unread/NOTE.md` for the policy comparison — both policies satisfy the merge-correctness invariants in isolation, so this is an interoperability requirement, not a merge-safety one. + +#### Override State Durability + +`ov_*` override entries — especially tombstone floors (`ov_c:` keys) — carry a reuse-blocking counter ceiling that prevents stale override components from resurrecting a dead register. Specifically, if a tombstone floor `(S=0, C=k, B=0)` is dropped and a stale snapshot `(S=k, C=0, B=b)` is later replayed, the merged result `(S=k, C=0, B=b)` would evaluate as live — a resurrection. + +Because legacy clients can carry and republish old `ov_*` keys indefinitely (they pass through `sanitizeContexts` as unknown opaque entries), there is no finite time after which all stale override components are guaranteed absent. Therefore: + +**Clients MUST NOT drop `ov_*` override entries (including tombstone floors) based on age pruning or budget eviction.** This exemption applies permanently. Age-based pruning applies to frontier entries only. Eviction strategies that respect byte/key budgets MUST apply to frontier and `msg:`/`thread:` entries first and MUST NOT touch `ov_*` entries. + +**Durability is a property of retrievable logical state, not of keys within one blob.** An override register survives only if a client that loads its full state can still reach every component. Therefore, in addition to the per-entry rule above: + +- Full-state loads by clients implementing this layer MUST NOT be restricted by a finite event-level `since` window, and MUST establish completeness rather than assume it; the containing event must remain reachable, not merely retain its keys (see Full-State Load). +- No coordinate carrying `ov_*` entries may be deleted or abandoned until the componentwise `max()` of every override register it holds — especially every tombstone ceiling — has been republished under the client's current primary coordinate and accepted on every relay from which the old coordinate will be deleted or allowed to lapse (see Client-ID Rotation, Orphaned Blob Deletion). + +**There is no safe finite GC horizon for override state.** Any protocol that proposes to delete tombstone floors after a bounded period requires a separately proved guarantee that no stale override component can re-enter the merge — this amendment does not provide such a guarantee. + +#### Bounds and Budget + +- **Key growth:** a live override adds 3 entries per context; a tombstoned override adds 1 entry per context. At 100 overridden channel contexts: ~300 live entries or ~100 tombstone entries. +- **Byte cost (small-counter example, common case):** channel UUID context (36 chars), counters S=1/C=0/B=10 — live override ~138 bytes; tombstone ~45 bytes. **Byte cost at uint32 maximum** (S=4294967295, worst case): live override ~164 bytes; tombstone ~54 bytes. +- **Hard ceiling on ever-overridden contexts.** Because all `ov_*` entries live in one coordinate (see `d` Tag) and tombstones can never be pruned (see Override State Durability — there is no safe finite GC horizon), the primary blob's plaintext budget is a hard ceiling on the number of contexts a single installation can ever have manually marked unread. Against a 32 KiB plaintext budget: roughly **600** tombstoned contexts at the worst-case ~54 bytes, ~730 at the common ~45 bytes, or ~199 simultaneously live overrides at ~164 bytes — and that is before frontier entries get any room at all. +- **Terminal behaviour at the ceiling.** When the primary blob cannot accommodate a new override group after all prunable frontier entries have been evicted, the client MUST refuse the mark-unread action and report it as failed. It MUST NOT split override state across coordinates and MUST NOT drop tombstone floors to make room. Likewise, a client whose merged override state — including tombstones merged in from peer installations — no longer fits in its primary blob MUST leave its last-published primary in place, MUST NOT publish a primary that omits merged `ov_*` entries, and MUST report override actions as failed; publishing a truncated override set is budget-driven override loss under another name. No floor is lost in this state, because the installations that originated those floors still carry them; the constrained installation simply stops acting as a replica until it has room. This is the same policy shape as counter exhaustion (see Actions): visible failure, never silent degradation. +- **10,000-key limit:** override entries count toward the existing per-blob validation limit. Tombstones accumulate permanently with every distinct ever-overridden context; they cannot be pruned. Clients SHOULD compact dead overrides aggressively and MAY enforce an active-live-override cap. Note that a cap on live overrides does not bound the total `ov_*` entry count over an unbounded context lifetime — tombstones from all historical overrides remain. The 32 KiB and 10,000-entry limits are expressed per blob at write time; a client that has overridden many distinct contexts over its lifetime must account for all accumulated tombstones when evaluating budget headroom. +- **256-byte key limit:** override keys (`ov_s:`, `ov_c:`, `ov_b:` + context ID) count toward the per-entry 256-byte validation limit. Context IDs up to 251 bytes are safe. Buzz's own context ID shapes (UUID 36 bytes, `msg:hex64` 68 bytes, `thread:hex64` 71 bytes) are well within this limit. + +#### Verification Artifact + +The design was verified by bounded exhaustive model checking prior to this amendment. See `docs/formal/nip-rs-unread/` for the full model (`model.py`, `exhaustive.py`), 9-mutant harness (`mutation.py`), and design notes (`NOTE.md`). + +The harness verifies the three load-bearing safety requirements — tombstone floor, mandatory canonical publication, and atomic per-context grouping with unescape-before-group — are necessary: each mutant that drops one of these rules produces a detectable witness of permanent false-clear or resurrection. M3 validates that the clear-wins tie policy produces the intended product-semantics behavior; M5 and M6 witness value-range and convergence failures respectively. Clear-wins is normative for interoperability (see Tie Policy), not because set-wins violates merge safety — the model confirms both tie policies satisfy the merge-correctness invariants when applied uniformly. + +**Scope of formal verification:** the bounded model covers the CRDT register algebra, merge/compaction rules, per-context grouping atomicity, and escape/unescape bijection. The model is a broader predecessor of this NIP: its `split_blob_into_slots` permits override groups in any slot, whereas this NIP confines them to one primary coordinate, so the verified atomicity property holds for every arrangement this NIP permits but the converse does not follow. The model does **not** verify the single-primary rule, the full-state-load completeness procedure, the relay conformance requirements or the mutation fence it depends on, or the carry-forward rule; those are normative here and argued, not proved. The model also does NOT cover malformed-group wire validation (the accepted-shape rules in Content Validation). That rule is sound by the partial-group argument (rejecting a partial group leaves a virgin register — a merge no-op — which is strictly safer than zero-filling missing components), but its correctness under parser-level implementation is outside the model's verified scope. Implementation-level tests MUST cover the accepted wire shapes and rejection behavior. ## Example @@ -504,9 +730,9 @@ The conversation key is `nip44_conversation_key(private_key, public_key)` — EC ### Conflict Detection Vector -Device A has `slot-id` = `aaa111` and `client_id` = `client-A`. It fetches its own `d` tag coordinate `read-state:aaa111` and decrypts the blob. The decrypted `client_id` is `client-B` (not `client-A`). This is a slot-id conflict — another device has claimed this coordinate. +Device A has `slot-id` = `aaa111aaa111aaa111aaa111aaa111aa` and `client_id` = `client-A`. It fetches its own `d` tag coordinate `read-state:aaa111aaa111aaa111aaa111aaa111aa` and decrypts the blob. The decrypted `client_id` is `client-B` (not `client-A`). This is a slot-id conflict — another device has claimed this coordinate. -Device A MUST NOT publish to `read-state:aaa111`. Device A MUST generate a new random `slot-id` (e.g., `ccc333`) and publish its blob under `read-state:ccc333`. +Device A MUST NOT publish to `read-state:aaa111aaa111aaa111aaa111aaa111aa`. Device A MUST generate a new random `slot-id` (e.g., `ccc333ccc333ccc333ccc333ccc333cc`) and publish its blob under `read-state:ccc333ccc333ccc333ccc333ccc333cc`. ### Clock Skew Vector @@ -541,7 +767,7 @@ Ciphertext length reveals the approximate number of tracked contexts and may cor Because slot IDs are random and independent of `client_id` values, relay operators cannot directly link blobs to specific devices or client implementations. Timing correlation and write patterns may still allow probabilistic linkage. -Because the merge rule is monotonic, replaying an old event to a relay is harmless — it cannot lower a read timestamp. However, replaying many old events simultaneously could trigger convergence re-publishes from active clients. The debounce window (see Debounce and Pruning) limits this to at most one re-publish per window. +Because the frontier merge rule is monotonic, replaying an old frontier event to a relay is harmless — it cannot lower a read timestamp. The override layer's counter merge is also monotonic (componentwise max), so replaying an old override event cannot lower a counter; however, a stale override component replayed after a tombstone floor was published could suppress a fresh set for one reconciliation cycle (see Override State Durability). The debounce window (see Debounce and Pruning) limits convergence re-publishes to at most one per window. Clients supporting multiple Nostr identities SHOULD use distinct `client_id` values and distinct slot IDs per identity. Reusing identifiers across pubkeys allows relay operators to link those identities. @@ -557,10 +783,13 @@ that expose read activity to other users MUST require explicit user consent. ## Backwards Compatibility -This NIP introduces no changes to existing event kinds or relay behavior. It uses only standard NIP-01 event storage, NIP-33 addressable event semantics, NIP-44 encryption, and NIP-78 application data conventions. Clients that do not implement this NIP are unaffected. +This NIP introduces no changes to existing event kinds and adds no new kind, wire message, or relay-stored read-state logic. It uses only standard NIP-01 event storage, NIP-33 addressable event semantics, NIP-44 encryption, and NIP-78 application data conventions. Clients that do not implement this NIP are unaffected, as are clients that implement everything but the manual-unread override layer. + +The override layer is the exception, and it is a relay-compatibility one rather than a client one. Its full-state load carries the completeness guarantee only against a relay that satisfies the ordering, capacity, floor, push, and barrier requirements enumerated in Full-State Load. Against a relay known or evidenced not to conform, every load resolves to *cannot prove complete* and the actions that depend on a complete load report as failed; against an undetectably nonconforming relay, a load may still return *complete*, and the completeness guarantee does not apply to that verdict. In either case the layer still runs and still merges, and frontier sync is unaffected. ## References +- [NIP-01](01.md) — Basic Protocol Flow Description (defines filter `limit`, `since`, and `until`) - [NIP-09](09.md) — Event Deletion Request - [NIP-33](33.md) — Parameterized Replaceable Events - [NIP-44](44.md) — Versioned Encryption From bb34bc4d98fe4dabe847046103ac5e2859917ac5 Mon Sep 17 00:00:00 2001 From: Wes Date: Fri, 31 Jul 2026 11:38:42 -0600 Subject: [PATCH 112/112] Revert "chore(release): release Buzz Desktop version 0.5.3" (#3960) Reverts block/buzz#3944 --- .release/desktop-candidate.json | 8 ---- CHANGELOG.md | 63 ------------------------------- desktop/package.json | 2 +- desktop/src-tauri/Cargo.lock | 2 +- desktop/src-tauri/Cargo.toml | 2 +- desktop/src-tauri/tauri.conf.json | 2 +- 6 files changed, 4 insertions(+), 75 deletions(-) delete mode 100644 .release/desktop-candidate.json diff --git a/.release/desktop-candidate.json b/.release/desktop-candidate.json deleted file mode 100644 index 150f8023e7..0000000000 --- a/.release/desktop-candidate.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "schema": 1, - "version": "0.5.3", - "base_sha": "052174a148f9f6bcbb2b5a1d20ce0317645e49f8", - "previous_tag": "v0.5.2", - "tag": "desktop-v0.5.3", - "commit_count": 53 -} diff --git a/CHANGELOG.md b/CHANGELOG.md index 974f68c683..d83087fc26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,68 +1,5 @@ # Changelog -## v0.5.3 - -### Desktop and shared changes - -- feat(desktop): import local Pocket voices ([#3259](https://github.com/block/buzz/pull/3259)) ([`c104eecfb38620de2c35c7e20a716f8658b5a6b1`](https://github.com/block/buzz/commit/c104eecfb38620de2c35c7e20a716f8658b5a6b1)) -- fix(desktop): open profiles from avatars ([#3751](https://github.com/block/buzz/pull/3751)) ([`39ce3dfc3cf2d12f0d6c64b4cd4293df86567663`](https://github.com/block/buzz/commit/39ce3dfc3cf2d12f0d6c64b4cd4293df86567663)) -- refactor(voice): extract reusable Pocket primitives + Pocket voice settings (relands #2467 + #3208) ([#3910](https://github.com/block/buzz/pull/3910)) ([`61ba9dfaa00852925058d1a024322fa53663a5bc`](https://github.com/block/buzz/commit/61ba9dfaa00852925058d1a024322fa53663a5bc)) -- feat(desktop): auto-enable huddle transcription for agents ([#3180](https://github.com/block/buzz/pull/3180)) ([`4632c55041c5d423d572a6f6411bb7b279c26f67`](https://github.com/block/buzz/commit/4632c55041c5d423d572a6f6411bb7b279c26f67)) -- feat(agent): optional reply guard reminds a silent turn to publish ([#3763](https://github.com/block/buzz/pull/3763)) ([`081f805d5ea25841ab885c7b67a568618a34aa59`](https://github.com/block/buzz/commit/081f805d5ea25841ab885c7b67a568618a34aa59)) -- feat(desktop): upgrade Pocket TTS model ([#3266](https://github.com/block/buzz/pull/3266)) ([`d48b0e0eec4d2958f90a3cafa9d974450abe8501`](https://github.com/block/buzz/commit/d48b0e0eec4d2958f90a3cafa9d974450abe8501)) -- feat(desktop): delete a message by clearing its edit to empty ([#3813](https://github.com/block/buzz/pull/3813)) ([`d88313f369acfa17973029787ee4c0bbea07fa51`](https://github.com/block/buzz/commit/d88313f369acfa17973029787ee4c0bbea07fa51)) -- feat(relay): raise hosted community limit to five ([#3829](https://github.com/block/buzz/pull/3829)) ([`10d5a26414dc90dc89fd27de74b21e105d4fa622`](https://github.com/block/buzz/commit/10d5a26414dc90dc89fd27de74b21e105d4fa622)) -- feat(desktop): locally stored NIP-49 encrypted key backup ([#2937](https://github.com/block/buzz/pull/2937)) ([`468647a51f858b29d27eaf9fd07bf90294f99d39`](https://github.com/block/buzz/commit/468647a51f858b29d27eaf9fd07bf90294f99d39)) -- fix(catalog): update Amp tagline ([#3806](https://github.com/block/buzz/pull/3806)) ([`f3e5e812677f6f14bffe16a7aa02642d56faca4b`](https://github.com/block/buzz/commit/f3e5e812677f6f14bffe16a7aa02642d56faca4b)) -- fix(desktop): channel topic and membership metadata cleanup ([#3642](https://github.com/block/buzz/pull/3642)) ([`9e8fcfda099652926b921bca7fcc9bfecab0e140`](https://github.com/block/buzz/commit/9e8fcfda099652926b921bca7fcc9bfecab0e140)) -- fix(desktop): align data deletion labels ([#2230](https://github.com/block/buzz/pull/2230)) ([`ede26863345a518ec46edd6d7692e0281883491b`](https://github.com/block/buzz/commit/ede26863345a518ec46edd6d7692e0281883491b)) -- fix(desktop): allow linux-only media items as dead code off-linux ([#3811](https://github.com/block/buzz/pull/3811)) ([`36571f4adcfdcf3714a17bd968c58c78bcbdd9ef`](https://github.com/block/buzz/commit/36571f4adcfdcf3714a17bd968c58c78bcbdd9ef)) -- fix(desktop): report authenticated relay recovery ([#3812](https://github.com/block/buzz/pull/3812)) ([`74cd5712191bffd84ae688d59bb8b451c6eec1b0`](https://github.com/block/buzz/commit/74cd5712191bffd84ae688d59bb8b451c6eec1b0)) -- fix(desktop): don't gate hover affordances on the hover media query ([#3657](https://github.com/block/buzz/pull/3657)) ([`29dfe4821ed577489a1879fd2a9bfe2a621a52b3`](https://github.com/block/buzz/commit/29dfe4821ed577489a1879fd2a9bfe2a621a52b3)) -- feat(relay): gate kind 30178 team-catalog reads behind the shared tag ([#3358](https://github.com/block/buzz/pull/3358)) ([`114d40d9d37f05eff83ee90347ed93fb3da512c5`](https://github.com/block/buzz/commit/114d40d9d37f05eff83ee90347ed93fb3da512c5)) -- test(desktop): click visible thread collapse guide ([#3800](https://github.com/block/buzz/pull/3800)) ([`b9e4ed616f39b812bc964e79c7a40223c4e93832`](https://github.com/block/buzz/commit/b9e4ed616f39b812bc964e79c7a40223c4e93832)) -- feat(desktop): raise the install ceiling and make installs observable ([#3368](https://github.com/block/buzz/pull/3368)) ([`d40a33290e75791aa7ecf3ce7a252b66c2e35966`](https://github.com/block/buzz/commit/d40a33290e75791aa7ecf3ce7a252b66c2e35966)) -- Add Devin as a preset ACP harness ([#3225](https://github.com/block/buzz/pull/3225)) ([`1b3ff96a5764303998fa629ff852e81f1a88d7ad`](https://github.com/block/buzz/commit/1b3ff96a5764303998fa629ff852e81f1a88d7ad)) -- feat(desktop): improve agent activity header ui ([#3321](https://github.com/block/buzz/pull/3321)) ([`4d47aa83455a9fd024121a596154cd311dca1d76`](https://github.com/block/buzz/commit/4d47aa83455a9fd024121a596154cd311dca1d76)) -- perf(presence): reduce heartbeat frequency ([#3783](https://github.com/block/buzz/pull/3783)) ([`bf139e8d0bdba10df9a5adbf16843140e0a78a59`](https://github.com/block/buzz/commit/bf139e8d0bdba10df9a5adbf16843140e0a78a59)) -- Tighten continuation message rows ([#3724](https://github.com/block/buzz/pull/3724)) ([`6e419b9f1c873549a7b40996970e0da7352adafb`](https://github.com/block/buzz/commit/6e419b9f1c873549a7b40996970e0da7352adafb)) -- Fix video reviews in thread replies ([#3719](https://github.com/block/buzz/pull/3719)) ([`f48f3f055fdd6030d3832f615f8c0d8e5a81261a`](https://github.com/block/buzz/commit/f48f3f055fdd6030d3832f615f8c0d8e5a81261a)) -- Make relay reconnect backoff authoritative ([#3774](https://github.com/block/buzz/pull/3774)) ([`cca8839034eb571a7ce943c3ace7f85a82330898`](https://github.com/block/buzz/commit/cca8839034eb571a7ce943c3ace7f85a82330898)) -- feat(desktop): add password-protected backups in settings ([#3701](https://github.com/block/buzz/pull/3701)) ([`bd0bff24bfd2cffa2b3b3a995f7628af5e460a5c`](https://github.com/block/buzz/commit/bd0bff24bfd2cffa2b3b3a995f7628af5e460a5c)) -- fix(desktop): reuse profiles when joining communities ([#2155](https://github.com/block/buzz/pull/2155)) ([`f44b5a2477f3979ae66e49153b11be36538cf859`](https://github.com/block/buzz/commit/f44b5a2477f3979ae66e49153b11be36538cf859)) -- fix(catalog): update Amp description ([#3758](https://github.com/block/buzz/pull/3758)) ([`61b96c9828d1dd54106b570d87a54edbc92bb9c4`](https://github.com/block/buzz/commit/61b96c9828d1dd54106b570d87a54edbc92bb9c4)) -- feat(catalog): resolve publisher display name in catalog detail pane ([#3640](https://github.com/block/buzz/pull/3640)) ([`02be413b823c356587e6e9f4d07f6cb06bb41c3c`](https://github.com/block/buzz/commit/02be413b823c356587e6e9f4d07f6cb06bb41c3c)) -- feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute (split 1/2 of #3467) ([#3741](https://github.com/block/buzz/pull/3741)) ([`4933672eb4589e7208b312829ebddcd10dfa9dd3`](https://github.com/block/buzz/commit/4933672eb4589e7208b312829ebddcd10dfa9dd3)) -- Refine agent sharing dialog ([#3699](https://github.com/block/buzz/pull/3699)) ([`9a386a0defbf2b355ee17646c7c11817a535b85f`](https://github.com/block/buzz/commit/9a386a0defbf2b355ee17646c7c11817a535b85f)) -- desktop: enable getUserMedia in the Linux WebKitGTK webview ([#3607](https://github.com/block/buzz/pull/3607)) ([`c9aa55505c544c608ff71648bbfd21b235637f19`](https://github.com/block/buzz/commit/c9aa55505c544c608ff71648bbfd21b235637f19)) -- fix: align responsive agent views ([#3688](https://github.com/block/buzz/pull/3688)) ([`73589408db6fd96b87ac570935d414ecc4120f53`](https://github.com/block/buzz/commit/73589408db6fd96b87ac570935d414ecc4120f53)) -- Add macOS agent menu-bar menu ([#3565](https://github.com/block/buzz/pull/3565)) ([`d0a24bcb5210326da4c0b1e749ee3935621b329c`](https://github.com/block/buzz/commit/d0a24bcb5210326da4c0b1e749ee3935621b329c)) -- Fix pending message feedback ([#3543](https://github.com/block/buzz/pull/3543)) ([`4672ee55c4e4a7916c31bfeae5df2fb4384bed10`](https://github.com/block/buzz/commit/4672ee55c4e4a7916c31bfeae5df2fb4384bed10)) -- fix(desktop): remove remaining Projects panel fills ([#3742](https://github.com/block/buzz/pull/3742)) ([`c55e421a0629c74b9ffd96ee3ccde36f006196ed`](https://github.com/block/buzz/commit/c55e421a0629c74b9ffd96ee3ccde36f006196ed)) -- desktop: restore direct community member adds ([#3634](https://github.com/block/buzz/pull/3634)) ([`310df2ec33fbb075edf226ba18bf9a96d90ba81b`](https://github.com/block/buzz/commit/310df2ec33fbb075edf226ba18bf9a96d90ba81b)) -- fix(desktop): explain open agent access ([#2561](https://github.com/block/buzz/pull/2561)) ([`7fb008f9347b933b9a1da20a7afb070912b430e8`](https://github.com/block/buzz/commit/7fb008f9347b933b9a1da20a7afb070912b430e8)) -- fix(desktop): remove Projects overview card fills ([#3416](https://github.com/block/buzz/pull/3416)) ([`3b8567a05d4c40e667d061666feb7aa7bc38212d`](https://github.com/block/buzz/commit/3b8567a05d4c40e667d061666feb7aa7bc38212d)) -- fix(git): channel binding tooling + author remediation for unbound repos ([#3626](https://github.com/block/buzz/pull/3626)) ([`788b3c002bd2509455444f57f8a03a054b4b496a`](https://github.com/block/buzz/commit/788b3c002bd2509455444f57f8a03a054b4b496a)) -- feat: configure S3 URL addressing style ([#3400](https://github.com/block/buzz/pull/3400)) ([`7012d86d52fd188b27c7beedeaa132d9c1f61fa8`](https://github.com/block/buzz/commit/7012d86d52fd188b27c7beedeaa132d9c1f61fa8)) -- feat: add first-class OpenRouter provider support ([#1975](https://github.com/block/buzz/pull/1975)) ([`ab55fee81896d2b03edf5d2ca5012b715be2b93d`](https://github.com/block/buzz/commit/ab55fee81896d2b03edf5d2ca5012b715be2b93d)) -- feat(agent,acp): wire provider total_tokens through NIP-AM publish chain ([#3593](https://github.com/block/buzz/pull/3593)) ([`f95fdc1a102e17c6718a44323d9a2feaed702db7`](https://github.com/block/buzz/commit/f95fdc1a102e17c6718a44323d9a2feaed702db7)) - -### Other repository changes - -- fix(release): make immutable desktop release operable ([#3943](https://github.com/block/buzz/pull/3943)) ([`052174a148f9f6bcbb2b5a1d20ce0317645e49f8`](https://github.com/block/buzz/commit/052174a148f9f6bcbb2b5a1d20ce0317645e49f8)) -- docs: add VISION_REMOTE_AGENTS.md ([#3924](https://github.com/block/buzz/pull/3924)) ([`689617af7ad420c3266d5d2eb437757371327089`](https://github.com/block/buzz/commit/689617af7ad420c3266d5d2eb437757371327089)) -- fix(relay): align NIP-11 max_limit with REQ ceiling ([#3635](https://github.com/block/buzz/pull/3635)) ([`23f0c26b1ceba8e07bf3c160a1e08c7bda82ccd9`](https://github.com/block/buzz/commit/23f0c26b1ceba8e07bf3c160a1e08c7bda82ccd9)) -- fix(db): isolate usage metrics advisory-lock test on scratch DB ([#3670](https://github.com/block/buzz/pull/3670)) ([`dba97eecd9d8659c9c816cd6666fa6d687b6bca1`](https://github.com/block/buzz/commit/dba97eecd9d8659c9c816cd6666fa6d687b6bca1)) -- feat(release): make desktop releases immutable ([#3568](https://github.com/block/buzz/pull/3568)) ([`1dfd89ea67b4ebce0c4d10390f280ed4e7ddde8a`](https://github.com/block/buzz/commit/1dfd89ea67b4ebce0c4d10390f280ed4e7ddde8a)) -- Render mobile agent mention chips ([#3702](https://github.com/block/buzz/pull/3702)) ([`06582ee6f09e5f7454e4d8895d80a45c3cdb5e8a`](https://github.com/block/buzz/commit/06582ee6f09e5f7454e4d8895d80a45c3cdb5e8a)) -- fix(acp): preserve truncated thread context ([#3340](https://github.com/block/buzz/pull/3340)) ([`53771c8f5439f9c5c26876f0229bfcfe5da9b170`](https://github.com/block/buzz/commit/53771c8f5439f9c5c26876f0229bfcfe5da9b170)) -- docs(nips): specify kind:30621 multi-repo projects (NIP-MP) ([#3163](https://github.com/block/buzz/pull/3163)) ([`33bf7caa6ea474ccde2932c1ed05a90d7345c6e0`](https://github.com/block/buzz/commit/33bf7caa6ea474ccde2932c1ed05a90d7345c6e0)) -- feat(mobile): desktop-parity emoji and thread experience ([#3485](https://github.com/block/buzz/pull/3485)) ([`85edc0572a8540dedfa6562d40f0f875af0b5f61`](https://github.com/block/buzz/commit/85edc0572a8540dedfa6562d40f0f875af0b5f61)) -- fix(cli): resolve agents from owner records ([#3178](https://github.com/block/buzz/pull/3178)) ([`262f2392e3b7e09c78d582fb384672034d8551d5`](https://github.com/block/buzz/commit/262f2392e3b7e09c78d582fb384672034d8551d5)) -- feat(replica): portable heartbeat-token fence with snapshot-local reader routing ([#3268](https://github.com/block/buzz/pull/3268)) ([`63496cc1d4c6f1b7c613801bdcc694169dcf391a`](https://github.com/block/buzz/commit/63496cc1d4c6f1b7c613801bdcc694169dcf391a)) - -[Compare v0.5.2...desktop-v0.5.3](https://github.com/block/buzz/compare/v0.5.2...desktop-v0.5.3) - ## v0.5.2 - feat(cli): mirror Desktop mention delivery ([#3330](https://github.com/block/buzz/pull/3330)) ([`7adc46268`](https://github.com/block/buzz/commit/7adc46268d5e93f0b1d4dc8e700af22815dcac1b)) diff --git a/desktop/package.json b/desktop/package.json index e8145f5468..2226a0cb12 100644 --- a/desktop/package.json +++ b/desktop/package.json @@ -1,7 +1,7 @@ { "name": "buzz", "private": true, - "version": "0.5.3", + "version": "0.5.2", "type": "module", "scripts": { "dev": "vite", diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 00d3fba3b5..254b7070ac 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -1036,7 +1036,7 @@ dependencies = [ [[package]] name = "buzz-desktop" -version = "0.5.3" +version = "0.5.2" dependencies = [ "anyhow", "arboard", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index b80684f955..39aaf0dead 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -2,7 +2,7 @@ [package] name = "buzz-desktop" -version = "0.5.3" +version = "0.5.2" description = "Buzz desktop app" authors = ["you"] edition = "2021" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index 1ff8bd20ef..2eba7815b2 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Buzz", - "version": "0.5.3", + "version": "0.5.2", "identifier": "xyz.block.buzz.app", "build": { "beforeDevCommand": {