[mcdickenson]

Summary

Adds a default-off Square employee sign-in path to the existing native BuilderLab session support. The employee authorizes their own Square browser session, returns only a short-lived S256 verifier-bound code to an exact loopback callback, and the native app redeems the existing CLI session. Session credentials never enter callback URLs or renderer IPC.

The native client binds the session to its current identity, workspace and exact pilot relay. It proves its own key to obtain a short-lived federated identity assertion and attaches it to protected WebSocket, relay HTTP, Blossom media and Huddle transport. Cancellation, logout, account/key/community changes and stale completions cannot commit another login. Ordinary communities retain the existing path. The shared connector preserves the generic upgrade-header API.

This draft includes an employee sign-in gate before relay-dependent onboarding, with community/identity recovery kept reachable. Settings reauthentication and retry preserve existing live subscriptions; all webviews observe native session changes. Access/binding refusals suspend automatic admission while preserving a valid CLI for explicit retry; ended sessions require login. Media retains Blossom proof kinds and streams with bounded lifetime/reflection filtering. desktop/EMPLOYEE_SIGN_IN.md documents setup, trust boundaries and the acceptance sequence. The employee sign-in feature and exact relay pin remain off by default; backend provisioning, verified employee grants and serving policy are deployment prerequisites.

For a staging Playpen pilot, optional BUZZ_EMPLOYEE_NATIVE_PLAYPEN_TARGET replaces ambient routing with a fixed Baggage selector on exactly three pinned public calls: redeem POST, auth-me GET and identity-assertion POST. Other origins/actions and URL-userinfo Basic auth are refused. Public proof URLs and signed request bodies remain unchanged; redirects stay disabled and Auth0 requests receive no selector.

Related issue / PR

No existing Square employee sign-in issue or PR found. Related existing BuilderLab work: #5939 (session persistence) and #3919 (hosted connect uses the local Buzz identity). This contribution reuses the existing BB session model; it does not replace generic operator sign-in or introduce another identity store.

Testing

• Normal current-head pre-push lanes pass: root Rust tests, desktop tests, native checks, TypeScript, formatting and size checks. No hooks were skipped. The initial just desktop-ci run also passed all applicable JavaScript/jsdom/native suites.
• Final focused tests: 32 employee-native, 10 component journeys,56 real relay IPC regressions,107 media tests and11 shared NIP-FI tests pass. All-target native clippy with -D warnings, TypeScript, biome and size checks pass.
• Renderer smoke: ordinary shell plus employee gate → mocked native authorization → actual chat App both pass. The employee regression asserts no profile read before authentication and direct chat for an existing profile. This uses existing cached Chromium 1234 through a temporary launch config; the pinned 1223 browser was absent. No repository configuration changed. Fixtures do not prove real Square login.
• An isolated debug Tauri client is built using the supported demo profile and package wrapper, with a hash-pinned launcher for the selected staging backend. It has not been launched. Local unit sidecar placeholders are used; this is not a production release bundle.
• Current full just ci passed root/desktop formatting and normal plus mesh all-target native Clippy, then stopped at unchanged mobile Dart formatting and unresolved flutter_lints. The remaining supported just test-unit desktop-test desktop-build desktop-tauri-test web-build lanes passed: 6,835 JavaScript, 171 jsdom and 3,454 native library tests, alongside workspace tests and desktop/web builds. No mobile source, dependency pins or policy configuration changed.
• Independent native and UI reviews are addressed, with a final read-only review finding no remaining blocker. Public-fork CI workflows still require upstream maintainer approval. The author has upstream READ access, and GitHub denied the request to add the buzz-oss-team code-owner reviewer; an upstream writer must request that review. No approval or permission bypass was attempted.

Real employee browser/native login, protected relay admission, message → bot receipt → reply, cross-employee isolation and revoke/re-enable acceptance remain pending compatible backends/configuration. No live employee credentials or sessions were used for these tests. This remains a draft pending upstream CI/owner review and human app acceptance; the repository completion attestation is intentionally absent.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2d289f720de0012fa36b5f6faa0e3bdd845ccfcf...8d70cb42b50c674ddf5bbb0bc4d381410e7b9a1c.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review 8d70cb42b50c674ddf5bbb0bc4d381410e7b9a1c to authorize a new review.
Any previous review applies only to its recorded range.