Bypass manual routing for Buzz sign-in, derive and validate identity in the controller, and initialize only public owner routing using the current Host relay after the stale/cancel fence. Retained owners still must match; custody remains session-only.
Regression drives the real Node/Bun UI once with no controller owner configured and an explicit synthetic credential fixture. Focused 12-test checks, typecheck, and first-use PTY walkthrough pass. Earlier broad-suite 400-second failure remains unresolved; no production Keychain access or native rebuild.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Selecting Sign in with Buzz key now dispatches the read of the saved Buzz
owner key immediately. The extra Beehive confirmation before it is removed:
selection itself is the explicit user gesture. While the read is in flight
the status line keeps the custody disclosure (Keychain read only, session
only, no local copy) and states that an OS keychain permission dialog is
separate and never bypassed or promised away.
Saved-key and matching-key import sign-in keep their confirmation and
input paths; helper source, owner matching, session-only custody,
cancellation and all backend behavior are unchanged. The test-only fixture
gains an inert env-gated pacing knob so a PTY driver can observe the
pending state and exercise Esc cancellation deterministically.
Verified with the synthetic source-UI PTY driver in a fresh
beehive-pairing-cli- HOME with explicit BEEHIVE_TEST_CREDENTIAL_FILE,
installed loader and service fences; production Keychain never read: one
selection reaches signed-in controls with no further Beehive input, and
Esc still cancels the in-flight read. Focused 12/12 backend and 8/8
renderer suites and package typecheck re-passed.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Move the action list out of the Details scroll into a bordered, bounded
Controls region in the right pane so agent actions stay reachable and
visibly focused beside arbitrarily long detail text, for pointer and
keyboard alike. Map clicks through the pinned SelectRenderable's
deterministic window so every visible action runs exactly itself when
the real 13-action Agents menu overflows the bounded region; wheel and
keyboard movement keep the remaining actions reachable.
Only a genuine item or section change re-routes selection and presents
its details from the top. Unchanged snapshot pushes, background or
explicit refresh, preserve the user's Details scroll position.
Signed-off-by: Logan Johnson <loganj@squareup.com>
The orchestration test polls for the fixture's readiness marker with
existsSync and then reads the PID. The fixture published the marker with
a single writeFileSync, so a child descheduled between the internal open
and write exposed a zero-byte file; Number('') is 0 and process.kill(0, 0)
probes the caller's process group, so the protected ESRCH assertion failed
with "Missing expected exception" while the production SIGKILL plus
awaited-close teardown had demonstrably worked.
Publish through a staging file and renameSync, the same atomic pattern
as the blocker() fixture in credential-helper.test.ts, so a reader that
sees the marker always sees the complete owned PID. Assertions, poll
budget, timeout and production behavior are unchanged; negative controls
in the task triage report show broken kill or broken awaited-close still
fail the protected assertion.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Bounded optional relay display name for the host-settings footer. One
unauthenticated NIP-11 document read per configured relay URL (4 s timeout,
32 KiB cap, no redirects, cancellable) supplies a terminal-sanitized name
shown before the exact configured URL and actual connection state. Missing,
failed, oversized or control-bearing names keep the truthful URL-only
footer; the name never changes reported connection state, blocks startup,
resets configuration, carries credentials or invents a name. A relay switch
aborts the in-flight read and a late completion is never applied to a new
relay. Installed smoke loader stubs the new HTTP path; no live relay is
contacted in tests.
Signed-off-by: Logan Johnson <loganj@squareup.com>
An authority-check exception after the accepted POST /events - while reading
the response or during the final latest-kind0 query - previously became the
host's generic failed receipt even though the relay may already hold the
signed event. publishPublicMetadata now maps authority-guard interruptions to
the dedicated metadataPublicationInterrupted result once a submission may be
live: after the /events response and across the final readback query entry
and post-body checks. Pre-send query checks and the /events entry remain
definitive refusals and the guard itself is unchanged. intents.ts maps the
metadata-only result to unknown, matching interrupted-reconcile-locally.
Signed-off-by: Logan Johnson <loganj@squareup.com>
fetchRelayTransport now acquires response bytes through the stream
reader and cancels it the moment the 256 KB cap is exceeded or the
stream fails, so a chunked body with no usable Content-Length is
rejected while it is still arriving instead of after response.text()
has already buffered it all. The injected host signer is an async
boundary like the transport: its await is raced against the same
per-request timeout and caller cancellation, so a signer that never
settles cannot hold a claim or evidence run open. Redirect refusal,
error redaction and abort semantics are unchanged.
Signed-off-by: Logan Johnson <loganj@squareup.com>
NIP-11 requirement discovery, host-keyed NIP-98 invite claim and
membership-gated /query evidence against the relay-signed kind 13534
roster, per the verified contract at block/buzz 051c3a2. Signer output
is re-verified before any request leaves; redirects, timeouts and
aborts are bounded; invite material never surfaces in errors.
Signed-off-by: Logan Johnson <loganj@squareup.com>
