mirror of
https://github.com/block/buzz.git
synced 2026-11-08 02:11:36 +00:00
3ed98a8048
Canvas frames run with `connect-src 'none'`, so a widget's only avatar source was a `data:` URL inlined into the RPC reply. Every picture was therefore charged against the 64 KiB port-message ceiling, and overrunning it failed the whole lookup — display names included — so the host could inline only a handful and the rest fell back to initials. Add `buzz-canvas://…/__buzz/avatar/<pubkey>`: the host publishes fetched avatar bytes to the backend, and the frame loads them as ordinary images, lazily and cached, outside any message. Widgets pass `pubkey` to `sdk.ui.avatar` instead of `avatarUrl`; the existing `avatarUrl` path still renders, so packages written before the route keep working. The store is keyed by project rather than by load, because publishing and frame creation race in both directions and a 404 is never retried. It is bounded by an LRU over 4 projects, 64 avatars and 512 KiB per project, and 32 KiB per avatar. Bytes are magic-byte-matched against their declared type, the content type served is an allowlisted `&'static str` rather than the caller's string, the route requires `project.people.read`, and the project comes from the bound load, never from the request. Signed-off-by: Matt Toohey <contact@matttoohey.com>
Buzz
Desktop chat shell with:
- Tauri + React + TypeScript + Vite
- Tailwind CSS
- shadcn/ui-ready shared components
- Biome (lint/format/check)
- Feature-driven frontend structure
Scripts
pnpm dev- run the web frontendpnpm tauri dev- run the desktop apppnpm build- typecheck and build frontendpnpm typecheck- TypeScript checkspnpm lint- Biome lintpnpm format- Biome format (write)pnpm check- Biome check
Structure
src/shared- reusable app-wide code (ui,lib,styles)src/features- feature modules (vertical slices)src/app- top-level app composition