fix(mobile): resolve iOS pushes on a fresh connection and retry a stale one by brow · Pull Request #8722 · block/buzz

brow · 2026-10-29T23:53:28Z

Summary

iOS users were seeing a run of push notifications that just said "Reconnect to your relay now". That is the push gateway's fixed APNs body. It shows when the Notification Service Extension (NSE) can't fetch the message from the relay.

On-device logs from one affected iPhone over a full day showed 12 of 385 NSE runs fail to resolve. Each failed relay /query: 10 hit the 8 second timeout and 2 got NSURLErrorNetworkConnectionLost (-1005). All 12 ran on a reused pooled connection from URLSession.shared in a long-lived NSE process. That process lived for hours while the network path changed between VPN and cellular. Of the fresh connections, 0 of 473 failed.

This change:

Gives each notification its own ephemeral session, so it never inherits a pooled connection. The session is cancelled when the extension finishes or expires.
Retries /query once if it times out or loses its connection mid-request. The retry uses a new session and a freshly signed NIP-98 proof, because the relay rejects a replayed proof. Other failures (HTTP errors, offline, cancellation) are not retried. The retry is bounded to one attempt, so the worst case is about 16 seconds, inside the NSE's roughly 30 second budget.
Replaces the gateway body with "You have a new message." when the NSE can't resolve the push. The restricted fallback ("Open Buzz to view this message.") is unchanged, and so is the gateway payload.

Related issue

N/A. Reported in Buzz #buzz-mobile.

Validation

Added tests in BuzzPushNotificationResolverTests:
- A timeout or -1005 is retried once, on a new session and with a different Authorization proof, and resolves.
- Repeated timeouts stop after 2 attempts.
- notConnectedToInternet is not retried.
- The retry is skipped if the account key changed during the first attempt.
- cancel() (called when the NSE finishes or expires) stops a pending retry.
Each new test fails when the behavior it covers is removed: the retry, the new session, the account recheck, or the cancel guard.
The full BuzzPushKit swift test suite passes.
A debug simulator build of Runner and the NotificationService extension succeeded.
An agent review of the diff found no blockers. Its suggestions to create the session per didReceive and to cancel it on expiry are included.
Limitations:
- The NSE target has no unit tests, so the fallback text and the session lifecycle are covered only by build and review.
- I couldn't send a real push through the NSE. Test phones run a personal-team bundle that isn't the gateway's APNs topic. In the simulator, simctl push needs notification permission, which the app only requests after joining a community.
- Under the mobile testing exception, the human-test step does not apply.

🤖 Generated with Claude Code

…le one The Notification Service Extension used URLSession.shared. A long-lived extension process reuses pooled connections after the network path changes (VPN up or down), and a stale connection makes the relay /query time out or fail with -1005. The resolver then gives up and iOS shows the gateway's fixed "Reconnect to your relay now" body. - Use an ephemeral session per notification and invalidate it when done. - Retry /query once on timeout or a dropped connection, on a new session with a freshly signed NIP-98 proof. - Replace the gateway body with "You have a new message." so an unresolved push no longer reads like an instruction. Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

…expiry Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-10-29T23:53:31Z

@codex review

chatgpt-codex-connector · 2026-10-29T23:53:53Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T00:23:04.148607Z	`0bee7e9`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1aaa7cde4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-10-30T00:01:52Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 176dd62565

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Retry sessions now come from an injectable factory, and the resolver's cancel() stops a retry that is running or about to start. Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-10-30T00:14:44Z

@codex review

chatgpt-codex-connector · 2026-10-30T00:17:38Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 0bee7e95fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-10-30T00:22:36Z

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

Exact PR diff: ef4130da4bfeea9fe37477d621166675e0ab3ef7...0bee7e95fb0cb33b16e5a8a31c254587b5c20d62

Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability regressions found in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

Review used read-only source and history inspection. Builds and tests were not executed.

_{Generated by Codex Security Review |

Requested by: @brow |

Workflow run}

johnmatthewtennant

🤖 Reviewed exact head 0bee7e95fb0cb33b16e5a8a31c254587b5c20d62; no correctness blockers retained after all 35 fanout passes and source disposition. The retry cancellation owner now covers queued and active retries, and the fresh-session test distinguishes the retry session.

I independently inspected source and tests, but ran no Swift/native tests on Linux. A real push through the NSE and human acceptance remain unverified by this review.

…nity-storage-calculation * origin/main: fix(mobile): resolve iOS pushes on a fresh connection and retry a stale one (#8722) ci(loadgen): publish buzz-loadgen as ghcr.io/block/buzz-loadgen (#8717) test(relay): fix main's build after the test-state helper rename (#8718) fix(db): keep lease releases durable and deflake PostgreSQL lane tests (#8676) test: dedupe collect_until_eose by event id and uncap two shell tests (#8677) ci: cache the Tauri apt .debs and fit a cold Windows Rust run in its cap (#8679) test(desktop): gate flaky E2E specs on the state they assume (#8681) test(desktop): settle composer edits and press hover-only row actions by keyboard (#8682) Signed-off-by: Shu Hui <shu@squareup.com>

…vent-guards * origin/main: (29 commits) Restyle community invitations (#8728) feat(relay): add incremental artifact reads (#8523) fix(mobile): show agent DM typing and balance reply bubble padding (#8731) perf(relay): route author- and #p-scoped global subscriptions by selector (#8666) fix(desktop): fix the product races behind four E2E flakes (#8680) test(scripts): stop file-size fixtures leaking git repos and fsmonitor daemons (#8727) test(mobile): keep late callbacks and fixed sleeps from failing tests (#8678) fix(mobile): resolve iOS pushes on a fresh connection and retry a stale one (#8722) ci(loadgen): publish buzz-loadgen as ghcr.io/block/buzz-loadgen (#8717) test(relay): fix main's build after the test-state helper rename (#8718) fix(db): keep lease releases durable and deflake PostgreSQL lane tests (#8676) test: dedupe collect_until_eose by event id and uncap two shell tests (#8677) ci: cache the Tauri apt .debs and fit a cold Windows Rust run in its cap (#8679) test(desktop): gate flaky E2E specs on the state they assume (#8681) test(desktop): settle composer edits and press hover-only row actions by keyboard (#8682) test(desktop): measure inline video controls against their player (#8683) relay: open the search pool lazily so a dead reader can't block boot (#8662) fix(mobile): address #8650 second-pass review (#8691) Revert "fix(mobile): push every message in your own Solo chats (#8615)" (#8690) fix: don't notify workflow owners through their attribution tag (#8694) ... Signed-off-by: Ravneet Arora <rarora@squareup.com>

square-tomb and others added 2 commits October 29, 2026 16:47

fix(mobile): make the push session per notification and cancel it on …

b1aaa7c

…expiry Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

chatgpt-codex-connector Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread mobile/ios/BuzzPushKit/Sources/BuzzPushKit/BuzzPushNotificationResolver.swift Resolved

fix(mobile): recheck the account before retrying a push query

176dd62

Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

chatgpt-codex-connector Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread mobile/ios/BuzzPushKit/Sources/BuzzPushKit/BuzzPushNotificationResolver.swift Resolved

Comment thread mobile/ios/BuzzPushKit/Tests/BuzzPushKitTests/BuzzPushNotificationResolverTests.swift Resolved

brow marked this pull request as ready for review October 30, 2026 00:20

brow requested a review from a team as a code owner October 30, 2026 00:20

brow temporarily deployed to codex-review October 30, 2026 00:20 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Oct 30, 2026

johnmatthewtennant approved these changes Oct 30, 2026

View reviewed changes

brow enabled auto-merge (squash) October 30, 2026 00:26

brow merged commit d263e2c into main Oct 30, 2026
60 checks passed

brow deleted the mobile-nse-fresh-session branch October 30, 2026 00:34

Navigation Menu

Repository navigation

fix(mobile): resolve iOS pushes on a fresh connection and retry a stale one - #8722

fix(mobile): resolve iOS pushes on a fresh connection and retry a stale one#8722
brow merged 4 commits into
mainfrom
mobile-nse-fresh-session

brow commented Oct 29, 2026 •

edited

Loading

Uh oh!

brow commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

brow commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

brow commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

johnmatthewtennant left a comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

brow commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related issue

Validation

Uh oh!

brow commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

brow commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

brow commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

github-actions Bot commented Oct 30, 2026

🔐 Codex Security Review

Review Summary

Findings

Notes

Uh oh!

johnmatthewtennant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brow commented Oct 29, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading