mirror of
https://github.com/block/buzz.git
synced 2026-10-28 21:11:48 +00:00
App-hosted agents sign events but hold no WebSocket, so they could not send typing indicators: POST /events rejected kind 20002 as an unknown kind. The bridge now hands 20002 to the same channel broadcast the WebSocket path uses, without storing it. Before broadcasting it checks the signature, that the signer is the authenticated pubkey, bans and timeouts, the community write fence, an h tag naming the channel, and channel membership. Other ephemeral kinds are still rejected over HTTP. Signed-off-by: Bradley Axen <baxen@squareup.com> Co-authored-by: Honey <8e307ae0076a4dab6b94b036ea3edc7e08f823a625269c1e6919e881a048b4d2@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>