Merge upstream Buzz through eed74bde

.env.example

@@ -51,17 +51,70 @@ TYPESENSE_URL=http://localhost:8108
 BUZZ_BIND_ADDR=0.0.0.0:3000
 # Public WebSocket URL — used in NIP-42 auth challenges
 RELAY_URL=ws://localhost:3000
-# Stable relay signing key. Set this in dev if you want REST-created forum posts
-# to keep resolving to the original author across relay restarts.
+# Stable relay signing key (required). `just bootstrap` generates a random key in
+# the gitignored .env file. Preserve that value across restarts and backups.
 # BUZZ_RELAY_PRIVATE_KEY=<32-byte hex private key>
 # Optional: path to the web UI dist directory. When set, the relay serves
 # the web frontend at / for browser requests. Leave unset for local dev
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
+# never enables it. When enabled and the URL is absent, the canonical
+# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+BUZZ_PUSH_ENABLED=false
+# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+
+# -----------------------------------------------------------------------------
+# Admin Dashboard (private moderation surface)
+# -----------------------------------------------------------------------------
+# Host name that serves the moderation dashboard and its /api/admin/v1
+# endpoints. Leave unset to keep the admin surface absent.
+# BUZZ_ADMIN_HOST=admin.localhost:3000
+#
+# Authentication mode. Accepted values: nip98 (default), disabled.
+# Any other value is a startup error. Token authentication was removed:
+# BUZZ_ADMIN_TOKEN is ignored with a startup warning — remove it from the environment.
+# BUZZ_ADMIN_AUTH=nip98
+#
+# Option A — BUZZ_ADMIN_AUTH=nip98 (Nostr pubkey-based auth, default):
+# NIP-98 HTTP Auth. Each request must carry an Authorization: Nostr header
+# with a signed kind-27235 event. Authorized principals are resolved from:
+#   1. RELAY_OPERATOR_PUBKEYS — comma-separated 64-char hex pubkeys (config Operators).
+#   2. RELAY_OWNER_PUBKEY — implicit Operator fallback when RELAY_OPERATOR_PUBKEYS is unset.
+#   3. relay_operators table — DB-managed Operator/Moderator roster.
+# The dashboard requires a NIP-07 browser extension.
+# Setting RELAY_OPERATOR_PUBKEYS for the admin console does NOT require
+# RELAY_OPERATOR_API_ORIGIN; that origin is only for community provisioning
+# (see below). When BUZZ_ADMIN_HOST is set, the relay advertises the admin
+# origin in its NIP-11 document (`admin_api` field) so clients can auto-discover
+# the console without manual URL entry.
+# RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
+#
+# Option B — BUZZ_ADMIN_AUTH=disabled (network-layer auth only):
+# Set only when the admin API is already protected at the network layer
+# (VPN, private ingress). The relay logs a WARN on every startup.
+# `just admin` defaults to this mode for local review.
+#
+# Directory holding the built dashboard assets (`pnpm -C admin-web build`).
+# BUZZ_ADMIN_WEB_DIR=./admin-web/dist
+#
+# Canonical origin (http(s)://host[:port], no path) that community-provisioning
+# NIP-98 requests are verified against. Required only to USE the provisioning
+# endpoints (POST /operator/communities) — not for the admin console. When
+# RELAY_OPERATOR_PUBKEYS is set but this is unset, the relay boots with a WARN
+# and provisioning requests fail closed until it is set.
+# RELAY_OPERATOR_API_ORIGIN=http://127.0.0.1:3000
+
+# Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
+# authenticated desktop clients use this relay as the metadata/search proxy.
+# Keep the real value in your deployment's secret manager; never commit it.
+# BUZZ_KLIPY_API_KEY=
+
 # Shared Redis-backed admission limits. Defaults shown below; each value must
 # be a positive integer.
 # BUZZ_RATE_LIMIT_HUMAN_MESSAGES_PER_MIN=60
+# BUZZ_RATE_LIMIT_GIF_SEARCHES_PER_MIN=30
 # BUZZ_RATE_LIMIT_HUMAN_API_CALLS_PER_MIN=300
 # BUZZ_RATE_LIMIT_HUMAN_WS_EVENTS_PER_SEC=10
 # BUZZ_RATE_LIMIT_AGENT_STANDARD_MESSAGES_PER_MIN=120
@@ -166,6 +219,12 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # Use `buzz-acp models` to discover available model IDs.
 # BUZZ_ACP_MODEL=
 
+# Optional Databricks model-picker visibility filter. Discovery-only; this does
+# not grant inference access. Comma-separated full-string * / ? patterns are
+# OR-matched against raw workspace endpoint and Unity Catalog model-service IDs.
+# Unset or blank shows every catalog entry. A nonblank value with no usable patterns is invalid.
+# DATABRICKS_MODEL_FILTER=databricks-*,data_tools.goose.*
+
 # ── Timeouts & sessions ──────────────────────────────────────────────────────
 # Max seconds per agent turn before timeout (default 320 = ~5 min).
 # BUZZ_ACP_TURN_TIMEOUT=320

.github/ISSUE_TEMPLATE/bug-report.md

@@ -4,6 +4,10 @@ about: Report a reproducible bug in Buzz
 labels: bug
 ---
 
+> [!IMPORTANT]
+> Do not include security vulnerabilities in a public issue. [Report them
+> privately through a GitHub security advisory](https://github.com/block/buzz/security/advisories/new).
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,5 @@
 blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/block/buzz/security/advisories/new
+    about: Report security vulnerabilities privately to the Buzz maintainers.