feat(native): serve relay media and uploads in packaged builds

[kalvinnchau]

Problem

In packaged builds (including preview.25.1), custom emoji did not render and the upload form was missing. just web/just desktop use the development broker, but the packaged app uses the native transport, which had no authenticated media URL, uploader, or kind 30030 writer capability.

Change

• Register buzz-media:// as an async Tauri scheme for HTTPS relay /media/<64-hex>[.ext] URLs. A fresh strict Blossom kind 24242 get token is signed per request, including range reads. Only a single bounded Range is forwarded. Responses cap at 16 MiB for 206 and 100 MiB for whole-file 200; redirects are disabled. SVG and non-image/video/audio types are downloads with nosniff.
• Add native relay_upload and its main-webview ACL, plus relay_upload_cancel. Rust hashes, signs (t=upload and x), and PUTs the raw IPC bytes. x-buzz-content-type transports the file type because Tauri sets the raw IPC Content-Type. Cancellation settles the JS promise and drops the in-flight native future. Renderer-generated IDs cover reorderings of separate IPC commands. The follow-up at 7fc7cc65 separates active-upload admission from pending pre-start cancels, caps those pending records at 64 and expires them after 60 s; late cancels or early validation failures cannot permanently deny new uploads. Already accepted bytes cannot be undone.
• Reuse shared TypeScript hostUpload for limits (images 50 MiB, GIF 10 MiB, documents 100 MiB, video 500 MiB), timeout (600 s), error mapping and descriptor validation. Add optional Signer.upload/Signer.media host capabilities and native avatar previews. Preserve the development broker path.
• Add kind 30030 to nativeWriteKinds and the Rust relay_sign allowlist. JS still cannot sign kind 24242. Add only media scheme sources to CSP, not general HTTPS connect-src.
• Correct docs/identity.md to state the actual HTTPS + /media/<hash> URL validation instead of implying a saved-community allowlist. Update the stale README packaged-upload claim.

Review follow-up

• At 05cee7fae33f0435ca9c82d387aface971cc9f8c, align native whole-media timeout with the broker/native-upload 600 s deadline. A near-100 MiB document on a slow link otherwise failed natively at 120 s despite succeeding through the broker. Full-PR independent review now reports no actionable findings and scores minimalness/elegance/correctness 9/9/9; actual packaged behavior is a separate acceptance gate.

Known limitations

• HEIC and non-MP4 conversion is dev-broker-only; packaged uploads send those files unconverted and may be rejected by the relay.
• Uploads are buffered: JS reads the entire file into an ArrayBuffer and Rust clones the IPC body. Peak memory for a 500 MiB file can be multiple copies of the payload; this is not a streaming uploader.
• The media scheme accepts renderer-selected HTTPS origins with a valid media path; Rust does not enforce saved-community membership. The token is scoped to the target server for 60 seconds.
• Independent upload/cancel IPC calls have no causal ordering: a pending cancellation can be displaced under saturation or expire before a severely delayed upload dispatches. The renderer still fences its result; this is a bounded best-effort network abort, not a guarantee of remote rollback.

Verification

• Hosted CI at 05cee7fa passed JavaScript, Rust/tool integration, Chromium and WebKit journeys, measurements, DCO and required gate: https://github.com/block/buzz-app/actions/runs/36647977940. Windows native validation was skipped. Local full native package after the timeout fix passed 149 unit tests and 1 integration test (4 ignored); pinned build bin/pnpm tauri build --debug --bundles app --no-sign produced a macOS app (131 MiB; binary SHA-256 65101e0379ab5e19a54fa7dcb1f3af7f6bd0d3d587063aeee50f29558ef6355c) from a clean detached worktree at that head. Build is not packaged GUI validation. The native identity store reads SecKeychain::default() with a fixed service/account; changing bundle ID or data path does not isolate the user's Keychain, and this session lacks passwordless access to a separate OS user. The app was not launched; packaged upload, emoji, playback/seeking and human acceptance remain unverified.

• At fdc9a273bc0d37d9854df496b5c155b3dece42ee, rebased the five native/media commits onto f3fe889eec574a4ecee9b3dfa10697378ef0faa9 and removed our three CI-only commits. Upstream now owns the profile fixture and timeline-restoration fix; neither file appears in this PR diff. Focused profile, timeline-restoration and native relay tests passed (40/40). The mandatory pre-push hook passed TypeScript, related Vitest (193 files/2884 tests) and design checks. Hosted CI at this head is pending; DCO Check passed. Windows native validation was skipped.

• At 7fc7cc65e1a3efdd859bf80adfe2b351877a10ab: cargo test --manifest-path src-tauri/Cargo.toml --locked -- --test-threads=1 passed (149 unit tests; 4 intentionally ignored; integration/doc targets passed). New regression checks >64 late cancels, early validation-failure cancels, pre-start and active cancellation, and admission recovery. cargo fmt --check passed. The pre-push hook passed related Vitest (191 files/2872 tests), types and design checks. Hosted CI at that SHA failed Rust Clippy (drop(sender.send(())) drops a Copy result under -D warnings). At ae1bebcecdefffec723c39df10c548a102242856, the one-line lint fix uses let _ = sender.send(());; local workspace Clippy with -D warnings and full serial Rust tests passed. Hosted CI at the prior ae1bebce head: Rust/tool integration and all browser jobs passed; JavaScript failed twice (initial run and failed-jobs rerun) in unchanged src/app/App.profile.test.tsx because jsdom lacked window.matchMedia at AppShell.tsx:59 (4 tests; 5408 passed). CI required is red. Windows native validation was skipped.

• At prior eebacac7: full pnpm exec vitest run passed (445 files/5397 tests) twice independently on the implementer's machine. Hobbes observed one timeout in unchanged read-state.test.ts during a concurrent independent full run (444 passed/1 failed); no assertion failure was established, but repeatability is unresolved. pnpm check passed at eebacac; no frontend files changed in 7fc7cc6.

• pnpm tauri build --debug --bundles app --no-sign compiled and created Buzz Foundation.app at eebacac. Build only, not a GUI workflow test; this artifact predates the pending-cancellation follow-up.

• Default parallel native tests at eebacac twice encountered timing-sensitive failures in unchanged src-tauri/src/host_command.rs; full serial package runs passed. Do not interpret the serial run as fixing those tests.

Ready for review at Kalvin’s request; packaged acceptance is still outstanding. Full-PR independent review at 05cee7fa found no remaining actionable findings and scored 9/9/9 after the timeout correction. Safely isolated packaged media/upload/playback exercise and human acceptance remain open. The macOS debug build uses a shared default Keychain item; changing the app identifier/data directory alone does not isolate credentials, so no packaged GUI has been launched. No release-signed or live packaged media/upload acceptance is claimed.

[wesbillman]

One P2 integration finding inline. Star Lord’s automated source review via Wes’s account; head fdc9a273bc0d37d9854df496b5c155b3dece42ee, base f3fe889eec574a4ecee9b3dfa10697378ef0faa9.

Source-only, including independent native-boundary review; no tests, builds or app execution. Hosted CI was incomplete at the snapshot and Windows validation was skipped. Packaged media/upload/playback acceptance remains unverified.

[wesbillman]

Changes needed: one download-policy regression inline, plus a public-metadata issue below. The prior native source-classification repair is present; this does not establish packaged download/playback acceptance.

[P2] Remove internal identifiers from the new commits’ author/committer metadata. Both 05cee7fa and 3c164928 publish an internal relay hostname and agent-account identifier in author.email and committer.email. Use an approved public-facing address for the actual contributor when preparing the replacement commits. Preserve actual authorship and legitimate Signed-off-by trailers; the sign-offs are explicitly exempt from this finding.

Star Lord’s automated follow-up source review via Wes’s account. Head 3c164928a9f5f961361f17fa4700856b50b7ef28; base f3fe889eec574a4ecee9b3dfa10697378ef0faa9. No tests, builds or app execution. The hosted CI snapshot passed its required gate; Windows validation was skipped. Packaged media/upload/playback and human acceptance remain unverified.

[wesbillman]

Changes needed: repair the required Rust formatting gate and preserve OS download-origin metadata in the new native save path (inline). The previous download-policy regression is repaired in source. The prior public-metadata finding remains in the rebased commits’ author/committer contacts; legitimate sign-offs remain exempt.

Star Lord’s automated follow-up source review via Wes’s account — head 15d1fb1ba0192c69c24cee29af78ee322b284b0f, base 5b6bd71d389c8171652bbc009341a2e9a3b55031.

Source-only, including independent native-boundary review; no tests/builds/app execution. Hosted Rust CI stopped before tests, other lanes were still running, and Windows was skipped. Packaged download/playback, OS trust prompts and human acceptance remain unverified.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one Windows compilation blocker, detailed inline. Reviewed head ad6fb7d22b79ffc6b486c5195b7fb8257f580774 against its base snapshot b2f245e43841e831e098c5e27053eec212debe60. Independent UI, upload-lifecycle and saved-file safety lanes are complete.

• Prior repairs: native document/audio/image consumers and the broker/blob download policy are repaired in source. Quarantine/zone marking is now attempted before writing file contents, with cleanup on failure. The prior author/committer-address finding is not actionable: these managed-agent identities are approved by Wes; no metadata rewrite is required for them.
• Integration/CI: main advanced to e304e3f59aa8ae89a3982d9f144cc933ccaea5b7; GitHub reports conflicts, independently reproduced in build.rs, capabilities/default.json, browser_permissions_tests.rs, lib.rs and relay/tests.rs. The previous head’s Linux job stopped at formatting; ad6fb7d2 removes the offending blank line. Current-head DCO/security checks pass, but fresh required CI is not established. These merge/CI gates are separate from the inline code defect.
• Exit criteria: fix the inline blocker, reconcile with current main while retaining both command/ACL sets, then obtain passing required checks plus the existing Windows native validation. Packaged upload/emoji/display/playback/save and human acceptance remain unverified. Native provenance readback and forced failure-cleanup coverage remain validation gaps; Linux tests do not exercise the macOS/Windows branches.

Source/caller/test and hosted-log review only; no new local suites, packaged launch, credential access, approval or merge. Full diff, PR text and commit metadata inspected for public-material exposure.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No remaining code blockers found in this follow-up. The previous Windows compilation finding is addressed. Reviewed head 1185f7b71129a1ae93d8816eac22ace05c926180 against base snapshot e304e3f59aa8ae89a3982d9f144cc933ccaea5b7, concentrating on the repair and rebase since the prior review.

• Verified: the OsString repair removes the missing-trait call. Both media and sidebar command/permission sets survive the rebase; previously reviewed media consumers and upload/cancel behavior are retained. Required CI and the separate Windows native run passed at this head, including the Windows download-zone readback. The automatic workflow’s skipped Windows entry is not an outstanding Windows-test failure.
• Integration gate: current main f778cb40b80f7c8a0edfe4dcc84e8b1151085c34 conflicts in build.rs, capabilities/default.json, browser_permissions_tests.rs, lib.rs, and native.test.ts, independently reproduced with git merge-tree. Reconcile these and validate the resulting head; this is separate from a code-review finding.
• Acceptance gap: packaged upload/emoji/playback/seeking/save and human acceptance remain unverified. Source and hosted CI are not packaged GUI evidence.

Independent frontend and native follow-up lanes completed. No local suites duplicated, app launched, credentials accessed, approval, or merge.

[kalvinnchau]

🤖 Reconciled with main f778cb40 at head 1cad73fa (rebase, no merge commit). The conflicts in build.rs, capabilities/default.json, browser_permissions_tests.rs, lib.rs and native.test.ts were resolved as unions. Both the main-side relay_agent_* commands/ACLs and the PR's relay_upload, relay_upload_cancel and media_download sets are kept. Two style-only commits became empty and were dropped. Main changed fixture_server to take String, so one new commit updates the three media-download fixture calls to .into().

Local checks at 1cad73fa: cargo fmt --all --check, cargo clippy --workspace --locked --all-targets -D warnings and cargo test --workspace --locked all pass. The host_command large-output timing test failed once under load and passed on rerun; this PR doesn't touch that file. Also passing: full Vitest (450 files / 5,481 tests), tsc --noEmit and lint. PR CI is https://github.com/block/buzz-app/actions/runs/36660718445. Windows native validation was dispatched at https://github.com/block/buzz-app/actions/runs/36660733755. Neither has passed yet. Packaged upload/playback/save acceptance is still open.