mirror of
https://github.com/block/buzz.git
synced 2026-10-29 13:31:44 +00:00
ad01b708f8
On Windows the token cache was memory-only because std has no way to set an owner-only DACL, and the Win32 calls need `unsafe`, which buzz-agent forbids. Each process therefore ran its own sign-in, and Databricks stayed gated off on Windows in the desktop app. The new buzz-private-file crate holds that FFI behind a safe API, so buzz-agent keeps `forbid(unsafe_code)` on every platform: - `create_new` creates a file with the protected DACL `D:P(A;;FA;;;OW)` set atomically at creation, the Windows counterpart of `mode(0o600)`. - `open_owned` opens without following a final link, refuses anything but a regular file owned by the process's default owner, and then re-applies that DACL on the open handle, like the Unix `O_NOFOLLOW` + `fchmod` repair. auth.rs now persists and reads the cache on Windows through these, with the same temp-file + rename lifecycle as Unix. Tests that were Unix-only only because Windows had no disk cache now run on both, and Windows CI runs the helper crate (including its elevated planted-owner and symlink tests) plus the buzz-agent token-cache unit tests. Signed-off-by: Pinky <5f5ab050ec58ae208332edd544ebf705221e24c1b86d82a6ca07038a7a8f6ac9@buzz.block.builderlab.xyz>
Buzz
Desktop chat shell with:
- Tauri + React + TypeScript + Vite
- Tailwind CSS
- shadcn/ui-ready shared components
- Biome (lint/format/check)
- Feature-driven frontend structure
Scripts
pnpm dev- run the web frontendpnpm tauri dev- run the desktop apppnpm build- typecheck and build frontendpnpm typecheck- TypeScript checkspnpm lint- Biome lintpnpm format- Biome format (write)pnpm check- Biome check
Structure
src/shared- reusable app-wide code (ui,lib,styles)src/features- feature modules (vertical slices)src/app- top-level app composition