Sync block/buzz upstream through Desktop v0.5.23

.config/nextest.toml

@@ -0,0 +1,41 @@
+nextest-version = "0.9.136"
+# The PostgreSQL lane uses a run-scoped desired-state template database and a
+# per-test wrapper, both of which require nextest's script support.
+experimental = ["setup-scripts", "wrapper-scripts"]
+
+[scripts.setup.postgres-template]
+# Bootstrap the desired-state source database once per nextest invocation.
+command = { command-line = "scripts/postgres-test-setup.sh", relative-to = "workspace-root" }
+slow-timeout = "60s"
+
+[scripts.wrapper.postgres-isolation]
+# Clone or create a unique database for each test process, then drop it on exit.
+command = { command-line = "scripts/postgres-test-wrapper.sh", relative-to = "workspace-root" }
+
+[profile.postgres-ci]
+# This structural convention keeps new PostgreSQL-backed tests discoverable
+# without maintaining an exact list of test names.
+default-filter = """
+(test(/postgres_tests::/) or binary(/^postgres_/))
+and not test(/(^|::)external_infra[^:]*::/)
+"""
+fail-fast = false
+# Eight workers was the fastest stable setting in the Blox benchmark while the
+# wrapper retained one database per concurrently running test process.
+test-threads = 8
+
+[test-groups.postgres-cluster-global]
+# These tests inspect cluster-wide activity or create least-privilege sessions,
+# so database-per-test isolation alone cannot make them independent.
+max-threads = 1
+
+[[profile.postgres-ci.overrides]]
+filter = "test(/cluster_global_/)"
+test-group = "postgres-cluster-global"
+
+[[profile.postgres-ci.scripts]]
+# Script filters are separate from default-filter: they attach the setup and
+# isolation wrapper to the same automatically discovered test set.
+filter = "(test(/postgres_tests::/) or binary(/^postgres_/)) and not test(/(^|::)external_infra[^:]*::/)"
+setup = "postgres-template"
+run-wrapper = "postgres-isolation"

.env.example

@@ -38,6 +38,21 @@ REDIS_URL=redis://localhost:6379
 # READ_DATABASE_URL is set, reader (default 50).
 # BUZZ_DB_POOL_SIZE=50
 
+# Writer-session Postgres timeouts for buzz-db-backed pools and the relay audit
+# pool, all in milliseconds; 0 disables. The separately deployed push gateway
+# owns its own database and session policy and does not consume these knobs.
+# lock_timeout: fail a statement that waits this long on any lock instead of
+# parking behind a wedged holder (default 5000).
+# BUZZ_DB_LOCK_TIMEOUT_MS=5000
+# idle_in_transaction_session_timeout: reap sessions idle inside an open
+# transaction — bounds how long a wedged client can hold locks (default 60000).
+# BUZZ_DB_IDLE_TXN_TIMEOUT_MS=60000
+# statement_timeout: cap any single statement's runtime. Off by default —
+# startup migrations/backfills legitimately run long statements. Warning: a
+# pathologically low value (e.g. 1) also times out connection setup and can
+# prevent any DB connection from establishing.
+# BUZZ_DB_STATEMENT_TIMEOUT_MS=0
+
 # -----------------------------------------------------------------------------
 # Typesense (search)
 # -----------------------------------------------------------------------------
@@ -51,17 +66,70 @@ TYPESENSE_URL=http://localhost:8108
 BUZZ_BIND_ADDR=0.0.0.0:3000
 # Public WebSocket URL — used in NIP-42 auth challenges
 RELAY_URL=ws://localhost:3000
-# Stable relay signing key. Set this in dev if you want REST-created forum posts
-# to keep resolving to the original author across relay restarts.
+# Stable relay signing key (required). `just bootstrap` generates a random key in
+# the gitignored .env file. Preserve that value across restarts and backups.
 # BUZZ_RELAY_PRIVATE_KEY=<32-byte hex private key>
 # Optional: path to the web UI dist directory. When set, the relay serves
 # the web frontend at / for browser requests. Leave unset for local dev
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
+# never enables it. When enabled and the URL is absent, the canonical
+# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+BUZZ_PUSH_ENABLED=false
+# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+
+# -----------------------------------------------------------------------------
+# Admin Dashboard (private moderation surface)
+# -----------------------------------------------------------------------------
+# Host name that serves the moderation dashboard and its /api/admin/v1
+# endpoints. Leave unset to keep the admin surface absent.
+# BUZZ_ADMIN_HOST=admin.localhost:3000
+#
+# Authentication mode. Accepted values: nip98 (default), disabled.
+# Any other value is a startup error. Token authentication was removed:
+# BUZZ_ADMIN_TOKEN is ignored with a startup warning — remove it from the environment.
+# BUZZ_ADMIN_AUTH=nip98
+#
+# Option A — BUZZ_ADMIN_AUTH=nip98 (Nostr pubkey-based auth, default):
+# NIP-98 HTTP Auth. Each request must carry an Authorization: Nostr header
+# with a signed kind-27235 event. Authorized principals are resolved from:
+#   1. RELAY_OPERATOR_PUBKEYS — comma-separated 64-char hex pubkeys (config Operators).
+#   2. RELAY_OWNER_PUBKEY — implicit Operator fallback when RELAY_OPERATOR_PUBKEYS is unset.
+#   3. relay_operators table — DB-managed Operator/Moderator roster.
+# The dashboard requires a NIP-07 browser extension.
+# Setting RELAY_OPERATOR_PUBKEYS for the admin console does NOT require
+# RELAY_OPERATOR_API_ORIGIN; that origin is only for community provisioning
+# (see below). When BUZZ_ADMIN_HOST is set, the relay advertises the admin
+# origin in its NIP-11 document (`admin_api` field) so clients can auto-discover
+# the console without manual URL entry.
+# RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
+#
+# Option B — BUZZ_ADMIN_AUTH=disabled (network-layer auth only):
+# Set only when the admin API is already protected at the network layer
+# (VPN, private ingress). The relay logs a WARN on every startup.
+# `just admin` defaults to this mode for local review.
+#
+# Directory holding the built dashboard assets (`pnpm -C admin-web build`).
+# BUZZ_ADMIN_WEB_DIR=./admin-web/dist
+#
+# Canonical origin (http(s)://host[:port], no path) that community-provisioning
+# NIP-98 requests are verified against. Required only to USE the provisioning
+# endpoints (POST /operator/communities) — not for the admin console. When
+# RELAY_OPERATOR_PUBKEYS is set but this is unset, the relay boots with a WARN
+# and provisioning requests fail closed until it is set.
+# RELAY_OPERATOR_API_ORIGIN=http://127.0.0.1:3000
+
+# Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
+# authenticated desktop clients use this relay as the metadata/search proxy.
+# Keep the real value in your deployment's secret manager; never commit it.
+# BUZZ_KLIPY_API_KEY=
+
 # Shared Redis-backed admission limits. Defaults shown below; each value must
 # be a positive integer.
 # BUZZ_RATE_LIMIT_HUMAN_MESSAGES_PER_MIN=60
+# BUZZ_RATE_LIMIT_GIF_SEARCHES_PER_MIN=30
 # BUZZ_RATE_LIMIT_HUMAN_API_CALLS_PER_MIN=300
 # BUZZ_RATE_LIMIT_HUMAN_WS_EVENTS_PER_SEC=10
 # BUZZ_RATE_LIMIT_AGENT_STANDARD_MESSAGES_PER_MIN=120
@@ -180,6 +248,12 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # Use `buzz-acp models` to discover available model IDs.
 # BUZZ_ACP_MODEL=
 
+# Optional Databricks model-picker visibility filter. Discovery-only; this does
+# not grant inference access. Comma-separated full-string * / ? patterns are
+# OR-matched against raw workspace endpoint and Unity Catalog model-service IDs.
+# Unset or blank shows every catalog entry. A nonblank value with no usable patterns is invalid.
+# DATABRICKS_MODEL_FILTER=databricks-*,data_tools.goose.*
+
 # ── Timeouts & sessions ──────────────────────────────────────────────────────
 # Max seconds per agent turn before timeout (default 320 = ~5 min).
 # BUZZ_ACP_TURN_TIMEOUT=320
@@ -219,6 +293,10 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # dkg-trust@1 profile and trust_network query operation.
 # VITE_BUZZ_DKG_WEB_OF_TRUST=true
 
+# Protected internal builds only: selects the module graph that contains the
+# default-off Bestie experiment. Official OSS builds must leave this unset.
+# VITE_BUZZ_BESTIE=1
+
 # ── Subscription & filtering ─────────────────────────────────────────────────
 # Subscribe mode: "mentions" (default), "all", or "config" (rule-based).
 # BUZZ_ACP_SUBSCRIBE=mentions
@@ -242,6 +320,14 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # Set to true to process the agent's own messages (default: ignore self).
 # BUZZ_ACP_NO_IGNORE_SELF=false
 
+# ── Session scoping ──────────────────────────────────────────────────────────
+# How ACP provider sessions are scoped in channels: "channel" (default) or
+# "thread". "channel" keeps one provider session per channel (legacy). "thread"
+# gives each canonical channel thread its own isolated provider session; direct
+# messages stay conversation-scoped either way. Ships as "channel" so thread
+# scoping can be canaried and rolled back without code changes.
+# BUZZ_ACP_SESSION_POLICY=channel
+
 # ── Context ──────────────────────────────────────────────────────────────────
 # Max context messages fetched for thread replies and DMs (0–100). 0 = disabled.
 # BUZZ_ACP_CONTEXT_MESSAGE_LIMIT=12

.github/ISSUE_TEMPLATE/bug-report.md

@@ -4,6 +4,10 @@ about: Report a reproducible bug in Buzz
 labels: bug
 ---
 
+> [!IMPORTANT]
+> Do not include security vulnerabilities in a public issue. [Report them
+> privately through a GitHub security advisory](https://github.com/block/buzz/security/advisories/new).
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,5 @@
 blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/block/buzz/security/advisories/new
+    about: Report security vulnerabilities privately to the Buzz maintainers.