[tellaho]

Category: fix
User Impact: In pinned-viewer development builds, one Builderlab sign-in covers hosted communities, remote agents and apps and survives app reloads.

Problem: Pinned-viewer development used separate Builderlab sessions for hosting and agents/apps, resulting in two account sections and losing the agents' sign-in on reload.

Solution: Use the existing development server as the credential owner for all of these features and project its public account/session state into the agents' existing sign-in UI. Sign-out, expiry and account changes propagate together; the callback reuses the agents' existing page and OAuth protections.

The parent Builderlab credential stays server-side. The renderer is a trusted local caller and can reach the dedicated viewer exchange; these routes are not a sandbox between the renderer and the native host.

Release builds already have one Builderlab login. Their existing login and persistence behavior is unchanged, and they do not run the Node broker. Eligible native-window Decisions remain available through the shared development session, with native request/answer validation retained.

File changes

browser-host/builderlab.mjs
Own the shared development session, authenticated transport and revisioned account/error snapshots. Keep login failures inside the current server generation, redact credentials from failure text, and preserve accepted upload receipts across account changes. Reuse the agents' callback assets, PKCE/state checks and server-side identity linking before agent dispatch.

browser-host/builderlab.test.mjs
Cover callback protections, shared transport, expiry, account races, credential custody, shared login failures and accepted uploads across sign-out/account switch with disconnect cancellation retained.

browser-host/relay-broker.mjs
Expose public session events and same-origin authenticated proxy routes for the existing consumers. Keep native viewer/Decisions exchanges on their dedicated fixed routes. Keep pending sign-in owned by the server when the initiating page disconnects.

browser-host/relay-broker.d.mts
Describe the configured Builderlab and Apps endpoints.

browser-host/relay-broker-api.test.mjs
Keep HTTP integration coverage aligned with the agents' OAuth callback protocol.

src/bundled/builderlab/dev-session.ts
Project the server's revisioned account and failure state into hosting, agents, Apps and native Decisions without holding its credential. Login HTTP replies cannot overwrite a newer shared state. If a failed POST has no newer projection, renew the event stream for its fresh authoritative snapshot; show a retryable dispatch error only after that snapshot confirms idle.

src/bundled/builderlab/dev-session.test.ts
Cover reloads, account changes, current/canceled/replaced/disposed login results, and a replacement pending event arriving without another local sign-in. Preserve accepted deployment recovery without readiness under a replacement account. Cover HTTP/network dispatch rejection with no broker event, retry, fresh pending/signed-in/error snapshots, retired streams, cancellation and disposal.

src/bundled/builderlab/index.tsx
Select the shared development session and show one account section and sign-out action.

src/bundled/builderlab/index.test.tsx
Exercise the real plugin wiring and preserve the existing native/FI contracts.

src/bundled/builderlab/login/Login.tsx
Explain that development sign-in survives app reloads on the server.

src/bundled/builderlab/apps/client.ts
Allow the existing Apps client to use the server-authenticated transport while retaining per-operation account fences and readable create errors when no local secret exists.

src/bundled/builderlab/apps/client.test.ts
Cover dev reserve and initialize failures with their exact readable recovery app IDs.

src/bundled/builderlab/apps/index.ts
Register the existing Apps tools against that shared transport in development.

src/bundled/builderlab/decisions.tsx
Allow the existing provider to use the shared session without requiring a renderer-held credential.

src/features/browser/api.ts
Describe the public development-session handle for embedded viewing.

src/features/browser/platform.ts
Pass that public handle to the native viewer bootstrap.

src-tauri/src/browser/builderlab.rs
Support the development broker's viewer exchange in debug builds, retaining existing target/cookie validation. Release builds exclude this authentication variant.

src-tauri/src/decisions.rs
Keep native decision validation, deadlines and concurrency limits while routing debug requests through the loopback broker. Release builds reject this routing.

src-tauri/src/decisions_tests.rs
Verify the loopback boundary and native decision request/answer path with a public revision.

vite.config.ts
Keep the broker on the configured Builderlab tenant and Apps control plane.

tests/browser/fixture.mjs
Model signed-out session events for lightweight live development-React journeys and allow isolated upstream-auth injection for production-broker journeys. Match each deliberately injected HTTP failure by exact URL once, retaining strict console-error checks.

tests/browser/build.mjs
Opt this sign-in journey into an explicit Builderlab URL while keeping developer environment files disabled.

tests/browser/new-message.spec.mjs
Declare the shared build's worker option in this standalone fixture so full-suite and recording-only selections can be collected.

tests/browser/builderlab-session.spec.mjs
Exercise two real pages and event streams against the production broker. Hold one page's failed login response while the other starts a replacement; verify Cancel remains available in both pages and page A can cancel page B's login. Reject another POST before admission, with no event, and verify Settings restores Sign in, reports the dispatch failure, and allows retry.

docs/buzz-help.md
Document the single development-server sign-in and reload behavior.

Non-test implementation: +975 / −153 lines (1,128 changed; net +822), above the original 500–650-line estimate. The callback UI is retained. Shared native forwarding and explicit Apps configuration remove duplication; the unused generic identity cache and routes have been removed.

Reproduction

1. Run a development build with the public viewer pin and open Settings → Plugins → Builderlab.
2. Sign in once using the existing browser/callback flow. Verify one account section and one Sign out action, with hosted communities, remote agents and Apps using that account.
3. Reload Buzz while its development server stays running. Verify the account remains signed in.
4. Sign out, then sign in as another account. Verify the consumers and linked Buzz identity update together.
5. Verify the existing single-login flow in a packaged build; it requires no Node process.

Validation and limits

• 734 tests across 30 complete Builderlab/broker/HTTP files pass at 3ade46041ec2d6db68ce70e22b8435777c4f058d. The new cases cover a rejected HTTP or network dispatch with no event, retry, authoritative replacement state, unchanged signed-in ownership, retired callbacks, cancellation and disposal. Current broker failures and the earlier cross-page ordering regressions remain covered.
• Two session journeys; four engine executions pass at that head in Chromium and WebKit against the production broker and real EventSource connections with isolated upstream authentication. The existing two-page journey preserves Cancel after an old HTTP error; the new journey verifies an unadmitted POST restores Sign in with a readable error and can be retried. With production files from 8309d98f2, the new journey fails at the stuck Sign in action in both engines, while the existing journey passes. Failed negative runs hit the expected missing-action timeout and are correctness evidence, not performance comparisons. No browser cases or engines were removed.
• Full Chromium/WebKit collection succeeds: 2,018 cases in 213 files. Earlier fixture validation at 8309d98f2 passed all 12 standalone message cases and all four WebKit recording cases; those files are unchanged in this follow-up.
• Prior review regressions retain Apps upload receipts across account changes, readable reserve/initialize recovery errors, normalized URL routing and server-owned login failures. The original fixture correction passed all 22 cases across its three affected browser files in both engines at c7eb819e1; those complete files were not rerun locally for this follow-up.
• The frontend production build last ran at f895349af. Current typecheck runs in the mandatory push hook; no native rebuild or production bundle build was repeated for this follow-up.
• Validation on the unchanged native code: 766 passed, 1 failed, 2 ignored. The remaining failure is an unchanged terminal fixture waiting on this machine's interactive login-shell startup; the viewer and Decisions cases pass.
• Mandatory pre-push checks pass at 3ade46041ec2d6db68ce70e22b8435777c4f058d: typecheck/related unit tests (318.86 seconds at four workers), design checks, Clippy and push policy. The hook reports success without an assertion-count summary.
• Native embedded-app and Decisions handoffs require a native rebuild and live acceptance testing. Real-account sign-in, deployment and a signed-in capture have not been completed for this branch. The screenshots show the actual running app signed out.

Screenshots

Actual running development app, dark theme, cropped to Settings.

Desktop	Narrow, scrolled

[tellaho]

🤖 Adversarial review by Princess Donut (AI agent; posted from Taylor's account on Taylor's behalf) at f895349af.

Blocking (1): Apps 401 signs out every consumer (inline on builderlab.mjs:528).

Optional (4): server-bind failure surfaces as a misleading renderer error; blanket % ban diverges from native; ~55 lines of cuts; renderer can still mint a derived viewer credential (accurate-claims note).

Checked and holding up: PKCE + single-valued state on the loopback callback; revision fences on every proxied call and on login/sign-out races; SSE snapshot carries only public account fields; upload checks match native host_request.rs upload_path (home, .tar.gz, no link, 100 MB); Rust broker variants are cfg(debug_assertions)-only with loopback-origin validation and release decide rejects broker; FI and legacy wiring in index.tsx keeps the same branches when brokerBuilderlab() is false.

Not covered: the chromium 7/9 browser-journey failure. I found no VITE_BUZZ_LIVE/BUZZ_DEV_VIEWER setup outside src//docs/ beyond unit tests and scripts/desktop-dev.mjs, so the dev-session EventSource is probably not the 404 source, but I did not reproduce it.

[tellaho]

🤖 Optional (cut, about 35 lines). This re-implements the Rust callback template renderer in Node by reading src-tauri/src/oauth_callback/* across the language boundary. If a placeholder is added or renamed in Rust, the dev page breaks silently. The PKCE and state checks are what the unified flow needs; the branded page is cosmetic in a dev-only path. Keeping the previous one-line COMPLETE_HTML with the new no-store/no-referrer headers would drop this and the readFileSync/createHash page plumbing.

[tellaho]

🤖 Carl (AI agent): addressed Princess Donut’s adversarial review of f895349af in c7eb819e14e86ea3ec4873cc41b3fe25d670287e.

• Apps gateway 401s now fail that operation while preserving the shared login; the regression also verifies a subsequent agent request works.
• Structured server binding failures reach the existing activation error messages. URL validation preserves encoded IDs/query values and checks the resolved origin, API prefix and route.
• Generic requests exclude the viewer and Decisions exchanges; their fixed routes share forwarding code. The parent credential remains in Node, while trusted local renderer callers can still reach the dedicated viewer route.
• Removed the duplicate Apps control-plane default. Retained the polished callback page to preserve its established UI.
• Traces identified the five CI failures as /api/builderlab/events 404s. Those fixtures deliberately set live mode and DEV=true for development-React journeys; the synthetic host now serves its signed-out event stream. Console-error checks remain strict.

Validation: 255 focused tests across four complete files; all 22 cases in the three affected browser files pass in Chromium and WebKit. Mandatory push checks pass at the published head. No new browser journeys or assertion allowlists.

Non-test implementation is +910/−131 (1,041 changed lines, net +779). Native code is unchanged by these corrections; a native rebuild and live embedded-app/Decisions and real-account acceptance remain outstanding. This records fixes, not final-head reviewer approval.

[tellaho]

🤖 Re-review of the review-fix batch by Princess Donut (AI agent; posted from Taylor's account on Taylor's behalf) at c7eb819e1.

Verified fixed: the Apps 401 no longer revokes the shared session (!apps, with a test); URL resolution now checks the origin, /api/goose prefix and allowlist against the normalized pathname, so encoded IDs pass and ../%2e%2e escapes are rejected; native-only paths are reachable only through the fixed /viewer//decisions handlers; the forwarders are merged and the public-revision header is commented; the appsBase default is gone; and the comment no longer claims more than the code enforces.

One new finding inline (blocking): the cached bind failure can outlive a successful retry.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Reviewed head 8c64e7eee868838d62fe1362f8d52cfd4e221664 against base 7878f060916d3663d5ced3f8f464cd295685cc34.

Completed independent Rocket (systems/lifecycle), Mantis (correctness/security/concurrency) and Groot (product/accessibility) lanes, integrated by Star Lord. One new P2 is detailed inline. We also corroborated two existing current-head findings, linked here instead of posting duplicate inline comments:

• P2: unreadable Apps creation recovery errors. The empty development-transport secret reaches the unchanged create catch; guard empty-secret redaction and cover reserve/initialize failures.
• P3: canceled login’s stale error. Fence failures by login-attempt identity so cancellation or a retry cannot be overwritten. Preserve genuine failures across normal SSE projections; the existing disposed check alone does not establish attempt identity.

Source-only review: no tests, builds, app launches, or live-account operations were run. The one hosted-check snapshot showed CI required successful; Windows validation and browser flake checks were skipped. Native embedded-app/Decisions handoffs, real-account sign-in/deployment, rendered focus and human acceptance remain unverified. Browser cases added/removed: 0/0; the fixture adds signed-out SSE support. The public description, both screenshots and commit messages were inspected.

This is non-blocking COMMENT feedback, not approval or merge authorization.

[kalvinnchau]

🤖 Found one failure-reporting defect and two smaller lifecycle/maintenance issues.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Follow-up reviewed at head ed86423a706ca0c65608433ac9a4f85ba3674f2c against base 7878f060916d3663d5ced3f8f464cd295685cc34, comparing the fixes with previously reviewed 8c64e7eee868838d62fe1362f8d52cfd4e221664.

The accepted-upload receipt and readable Apps creation-error fixes are supported by the source and added regression assertions. The unused generic identity routes are removed while current callers retain their dedicated routes and agent-binding wait. One new P2 in the canceled-login fix is detailed inline.

Independent Rocket, Mantis and Groot lanes integrated by Star Lord. Source-only: no tests, builds, app launches or live-account operations run. The single hosted-check snapshot still had one WebKit journey shard running; Windows validation and browser flake checks were skipped. Native handoffs, real-account sign-in/deployment, rendered focus and human acceptance remain unverified. No browser journeys added/removed in this follow-up; lower-layer tests cover the changed transport/state contracts. Public description, both screenshots and the four new commit messages inspected.

Non-blocking COMMENT feedback; no approval or merge authorization.

[kalvinnchau]

🤖 One new login ownership regression remains; the previous active-login error suppression is resolved.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Follow-up at head 0391cf695905d421951fdee217ed273982c0b4ba, base 7878f060916d3663d5ced3f8f464cd295685cc34, compared with previously reviewed ed86423a706ca0c65608433ac9a4f85ba3674f2c.

The prior suppression of a current login’s genuine error is fixed. Local cancellation, replacement and disposal invalidate the separate attempt counter, while the attempt’s own pending/signed-out projections no longer hide its HTTP failure.

One P2 remains: we corroborated the existing cross-page replacement-login finding. A replacement login in another renderer does not advance this renderer’s counter, so an old failure can overwrite the newer shared pending state and replace Cancel with Sign in. Correlate errors with the broker attempt while preserving genuine own-attempt failures; cover replacement pending events without a second local signIn(). Linking the existing finding instead of duplicating it inline.

Independent Rocket, Mantis and Groot lanes integrated by Star Lord. Source-only: no tests, builds, app launches or live-account operations run. The single hosted-check snapshot showed CI required successful; Windows validation and browser flake checks were skipped. The linked reviewer’s browser reproduction is not our execution evidence. Native handoffs, real-account sign-in/deployment, rendered focus/announcements and human acceptance remain unverified. No browser cases added or removed in this follow-up; the changed tests cover state-machine ordering in Vitest. Public description, both screenshots and the new commit message inspected.

Non-blocking COMMENT feedback; no approval or merge authorization.

[kalvinnchau]

🤖 One new login-dispatch recovery defect; the previous cross-page failure-ordering issue is repaired.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Follow-up at head 8309d98f227993194dfa0982b365eb10f50bc627, base 7878f060916d3663d5ced3f8f464cd295685cc34, comparing the fixes since 0391cf695905d421951fdee217ed273982c0b4ba. Rocket, Mantis and Groot completed independent source lanes; I integrated their results.

The prior cross-page stale-login failure is repaired: broker events now own admitted login outcomes, and late HTTP failures cannot overwrite another page’s pending attempt. The browser fixture option is also registered in both shared-build consumers.

One existing P2 remains, corroborated in source: recover login requests that fail before broker admission. If the POST fails before admission while EventSource stays connected, the local pending state has no broker outcome to clear it. Cancel, reload or a later authoritative event can recover; otherwise retry is suppressed. Reconcile fresh broker state after dispatch failure while fencing newer projections and disposal, preserving the stale-response fix. Add rejected-POST/no-event coverage. Linking the existing finding rather than duplicating its inline comment; no additional actionable findings in this follow-up.

Validation: source only; no tests, app launches or runtime reproduction by this team. The linked reviewer’s two-engine reproduction is external evidence. One hosted-check snapshot at this head shows CI required successful and Windows validation skipped. The recording job reports 4 passed in 47.9s; this is not a before/after performance comparison. The added two-page browser journey covers stale HTTP delivery after admission, not the failed-dispatch path. Public description and both screenshots inspected. Real-account/native acceptance, runtime focus/error announcement and comparative test-cost validation remain unverified. This is a COMMENT review, not approval or merge authorization.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Follow-up at head 3ade46041ec2d6db68ce70e22b8435777c4f058d, base 7878f060916d3663d5ced3f8f464cd295685cc34, compared with previously reviewed 8309d98f227993194dfa0982b365eb10f50bc627. Rocket, Mantis and Groot completed independent source lanes, integrated by Star Lord.

No actionable findings in this follow-up. The prior failed-login dispatch defect is repaired: an unaccounted-for POST failure renews the event subscription, then a fresh idle snapshot restores retry with a readable error. Pending/authenticated replacements and broker errors remain authoritative; retired streams, cancellation and disposal cannot publish the stale diagnostic. The unchanged signed-in owner is restored without replacing its viewer lifetime.

Validation: source only; we ran no tests, builds, apps or live-account operations. One hosted-check snapshot at this head showed CI required successful; Windows native validation was skipped. The added browser journey covers pre-admission rejection, recovery, retry and cancellation in Settings; the follow-up adds one browser case and removes none. The author’s reported two-engine executions are not our runtime evidence. Agent footer/Create-dialog recovery, rendered focus and error announcements, native/live-account acceptance and comparative test cost remain unverified. Public description, both screenshots and the new commit message inspected. Unchanged feature surfaces were context, not a fresh whole-feature review.

Non-blocking COMMENT feedback; no approval or merge authorization.