镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

feat: send a User-Agent on relay WebSocket upgrades - #9246

Merged
wpfleger96 merged 3 commits into
mainfrom
hayt/relay-client-user-agent
Nov 9, 2026
Merged

wpfleger96 merged 3 commits into
mainfrom
hayt/relay-client-user-agent

Conversation

@wpfleger96

@wpfleger96 wpfleger96 commented Nov 7, 2026 •

Copy link
Copy Markdown
Member

Relay WebSocket clients in this repo now send a User-Agent of the form <name>/<version> on the upgrade request. The version comes from the build.

Client User-Agent
buzz-acp buzz-acp/<crate version>
buzz-cli buzz-cli/<crate version>
buzz-ws-client (default) buzz-ws-client/<crate version>
buzz-pairing-cli buzz-pairing-cli/<crate version>
buzz-audio-client (default) buzz-audio-client/<crate version>
mobile (relay and huddle sockets) Buzz-Mobile/<app version>
  • buzz-ws-client: every connect path sends the default. A User-Agent in the caller's connect_with_headers headers replaces it, so other consumers can identify themselves without any new API. buzz-cli uses this to send its own name.
  • buzz-audio-client: keeps a User-Agent already on the host-supplied request, and adds its default otherwise.
  • Mobile: openRelayWebSocket sets the HTTP client's userAgent, which also covers the huddle transport. Startup waits up to 500 ms for the app version from package_info_plus before the app runs, so the first socket carries it; if the lookup fails or times out, the value is Buzz-Mobile.

Each client has a test asserting the header on the upgrade request.

buzz-acp, buzz-cli, buzz-ws-client, buzz-pairing-cli, buzz-audio-client
and the mobile app now name themselves and their version on every relay
WebSocket upgrade. buzz-ws-client and buzz-audio-client default to their
own name and keep a User-Agent the caller supplies.

Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
@wpfleger96
wpfleger96 requested a review from a team as a code owner November 7, 2026 21:55
@github-actions github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 7, 2026
@github-actions

github-actions Bot commented Nov 7, 2026 •

Copy link
Copy Markdown

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

  • Exact PR diff: f3b127e3af5c14d2314faa2b63556c3f51ec6743...07e9da8cd0c5c099bdb1c7b475838c3b1efc5181
  • Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.


Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings in the authorized PR range. The header changes preserve host selection, authentication headers, and existing redirect protections.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

  • Review used read-only source and history inspection. Builds and tests were not executed, as instructed.

Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run

wpfleger96 and others added 2 commits November 7, 2026 17:30
…en; run ws-client and pairing tests in test-unit

Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <wpfleger@block.xyz>
@github-actions github-actions Bot added codex-security-review-current The posted Codex security review matches its recorded range. and removed codex-security-review-current The posted Codex security review matches its recorded range. labels Nov 7, 2026

@kalvinnchau kalvinnchau left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 LGTM. One nit: in crates/buzz-acp/src/relay.rs the new do_connect_sends_user_agent test was inserted between do_connect_wrong_scheme_is_terminal and its doc comment, so that doc block now sits on top of the new test. Moving it back is optional.

@wpfleger96
wpfleger96 merged commit 65e8643 into main Nov 9, 2026
200 of 202 checks passed
@wpfleger96
wpfleger96 deleted the hayt/relay-client-user-agent branch November 9, 2026 01:43
bostonaholic added a commit that referenced this pull request Nov 9, 2026
…ction-p

* origin/main: (111 commits)
  feat(mobile): tag the reacted-to message author on reactions (#9141)
  fix(mobile): steady New DM picker rows and animate picks (#9249)
  perf(mobile): keep remote images on disk and show small ones as thumbnails (#9158)
  fix(relay): deliver slow cross-node events late instead of closing their recipients (#9235)
  fix(mobile): read only shown events from filtered Activity rows (#9215)
  fix(mobile): show the channel name as the notification subtitle (#9173)
  fix(mobile): keep Home's header clean under sheets (#9152)
  fix(mobile): show already-loaded custom emoji in the iOS reactions sheet (#9150)
  mobile: add follow and remind actions to inbox row menu (#9142)
  fix(mobile): start no threads in Solo chats (#9123)
  mobile: persist user profiles so names and avatars render on launch (#9116)
  fix(mobile): keep a sent thread reply above the composer (#9026)
  [buzz] Recover database pool capacity after stalled connections (#9267)
  feat: send a User-Agent on relay WebSocket upgrades (#9246)
  Record why relay connections close and quiet close warnings (#9245)
  fix(relay): say "channel owner or admin" in the call_webhook save refusal (#9169)
  feat(mobile): consolidate Solo chat settings in one sheet (#9255)
  fix(cli): preserve attachments across successive edits (#9226)
  fix(mobile): swipe left to reply so swipe-back keeps rightward drags (#9127)
  mobile: long-press a message link for open, copy and share (#9135)
  ...

Signed-off-by: Matthew Boston <mboston@squareup.com>
yjc801 added a commit to yjc801/buzz that referenced this pull request Nov 9, 2026
Renumbers the fork-only waker kinds out of upstream's 3017x/3018x run:
KIND_WAKER_LAUNCH_BUNDLE 30180 -> 31180 (upstream block#8783 took 30180 for
KIND_EMOJI_ENTRY) and KIND_WAKER_START_REQUEST 30181 -> 31181 (the next
upstream slot). Both are payload labels only; every bundle and start
request travels as a kind:1059 envelope, so nothing stored or in flight
uses either number and no migration is needed.

Also adapts the fork's two desktop publish_event callers to upstream
block#9246's headers argument, and drops a needless borrow clippy flags.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Junchao Yan <yjc801@gmail.com>

This branch was previously deployed

1 inactive deployment
codex-review — 07e9da8c Deployed Nov 7, 2026 by wpfleger96 via Run Codex Security Review #13779
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex-security-review-current The posted Codex security review matches its recorded range.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants