mirror of
https://github.com/block/buzz.git
synced 2026-11-06 09:21:45 +00:00
6191763cfc
Round-seven review found a residual check/use gap in the round-six startup fix, plus review nits: 1. start_local_agent_with_preflight asserted the relay scope after the mesh-preflight await, but the check was not bound to the spawn: start_managed_agent_process independently re-read the workspace override at spawn time, so an A->B community switch landing after the check but before the spawn still activated the (agent, relay) pair in tenant B. The scope check now BINDS its validated read: bind_expected_relay_scope returns a ScopedWorkspaceRelay newtype whose only constructor is the check itself, and start_managed_agent_process takes that type instead of re-reading mutable state — a spawn consuming an unchecked relay no longer typechecks. Regressions cover the switch-after-check-before-spawn interleaving at the scope layer and the pair-key derivation. 2. commitMatchesViewerGitIdentity matched on name OR email, so any commit authored under the viewer's display name borrowed their avatar. Now email-only, with a shared-display-name regression. 3. Sidebar projects filter/sort preferences were stored globally while expansion and membership are relay+pubkey scoped; a community or identity switch leaked view preferences across tenants. They now share the same scoped key derivation and re-read on scope change. Co-authored-by: Thomas Petersen <thomasp@squareup.com> Signed-off-by: Thomas Petersen <thomasp@squareup.com>