Files
buzz/desktop
Matt Toohey b991b35f33 fix(desktop): normalize ACP lock tarball URLs to the public npm registry
acp-tools.lock.json pinned Block's internal Artifactory host in all 24
tarball URL fields — internal infrastructure leaked into an OSS repo,
and anyone regenerating the lock against a different registry churned
every URL in the diff even when no pin changed. The URLs are
informational only: ensure-acp-tools.sh installs via the developer's
ambient npm registry and validates the registry-agnostic sha512
integrity from npm's package-lock, so no install path dereferences
them.

Normalize at write time instead: update-acp-tools-lock.mjs rebuilds
every tarball URL on https://registry.npmjs.org from the resolved
package name plus the registry-reported tarball basename (the basename
is not derivable from name@version alone — @openai/codex native
tarballs carry a platform suffix like codex-0.144.1-darwin-arm64.tgz).
A dist.tarball with no /-/ segment fails loudly rather than writing an
unnormalizable URL. The usage text documents the normalization, and the
committed lock is regenerated: the diff is exactly the 24 tarball
fields; every version and integrity hash is byte-identical.

Addresses the internal-Artifactory-URL finding from the bundling-series
code review (review 2ed3d00d on b52a665a).

Verification (ambient registry = Block Artifactory, proving
normalization against an internal mirror):
- Full regeneration: versions/integrity byte-identical to the previous
  lock; only tarball hosts changed.
- Partial --target aarch64-apple-darwin rerun on the normalized lock:
  byte-identical output (preserved + fresh entries agree).
- All normalized URL shapes probe live on registry.npmjs.org (303 CDN
  redirect), including the platform-suffixed codex native tarball.
- ensure-acp-tools.sh with the new lock: validates and no-op stages,
  exit 0 (the freshness stamp does not compare tarball fields, so no
  spurious re-install).
- pnpm exec biome check on the script: clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
2026-07-15 13:52:14 +10:00
..
2026-03-09 13:02:11 -07:00
2026-06-11 15:06:24 +00:00
2026-03-09 13:02:11 -07:00

Buzz

Desktop chat shell with:

  • Tauri + React + TypeScript + Vite
  • Tailwind CSS
  • shadcn/ui-ready shared components
  • Biome (lint/format/check)
  • Feature-driven frontend structure

Scripts

  • pnpm dev - run the web frontend
  • pnpm tauri dev - run the desktop app
  • pnpm build - typecheck and build frontend
  • pnpm typecheck - TypeScript checks
  • pnpm lint - Biome lint
  • pnpm format - Biome format (write)
  • pnpm check - Biome check

Structure

  • src/shared - reusable app-wide code (ui, lib, styles)
  • src/features - feature modules (vertical slices)
  • src/app - top-level app composition