Repository navigation
fix(builderlab): replace apps_share with visibility and community tools - #1934
Conversation
Compose removes workspace grants (squareup/blockplat-compose#496), so apps_share's sharing/workspaces route stops existing once Compose is bumped. Under the one-workspace model an app is open to its workspace or only its owner, plus any Buzz communities. - apps_visibility switches workspace/only_you through PUT .../visibility, as `bl apps visibility` does, and says who can open the app now. - apps_community grants or revokes a community at the grant revision it just read, as `bl apps community` does. - An app with no live version now says to deploy it first instead of "This app has no active sharing to change". BOT-2440 Co-authored-by: Dylan G <69953f73c9f5149d56f2155107338a5435823b938a6c430c63e779f9a8a446f9@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Nathan Thillairajah <nthillairajah@squareup.com>
Address review on #1934: a 200 sharing read without a valid lifecycle or non-negative integer revision now says nothing was changed instead of asking for a redeploy, and a mismatched visibility answer points at Share & manage rather than an access read no tool offers. Adds tests for the app_id mismatch, POST/DELETE 409 passthrough, tool-level grant and unknown action, and plural wording. Co-authored-by: Dylan G <69953f73c9f5149d56f2155107338a5435823b938a6c430c63e779f9a8a446f9@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Nathan Thillairajah <nthillairajah@squareup.com>
The mismatch test matched only the prefix, so it passed with the old "read the app's access" advice. Assert the full Share & manage text. Co-authored-by: Dylan G <69953f73c9f5149d56f2155107338a5435823b938a6c430c63e779f9a8a446f9@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Nathan Thillairajah <nthillairajah@squareup.com>
The remaining viewers on a private app include publishers, who were never "added". Matches the Share & manage dialog wording. Co-authored-by: Dylan G <69953f73c9f5149d56f2155107338a5435823b938a6c430c63e779f9a8a446f9@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Nathan Thillairajah <nthillairajah@squareup.com>
kalvinnchau
left a comment
kalvinnchau
left a comment
There was a problem hiding this comment.
🤖 Two documentation/test-contract corrections; no runtime or authorization defect established.
| const undeployed = new Error( | ||
| "This app has no live version to share yet. Deploy it with apps_deploy, then try again.", | ||
| ); | ||
| // Compose answers this read with 409 only when no version is live. |
There was a problem hiding this comment.
🤖 [P3] Describe the missing-lifecycle condition rather than undeployed apps. Compose reservation already sets HostedSiteLifecycleID (internal/deploy/reserve.go:150); the GET returns 409 only when that ID is empty (internal/app/sharing_grants.go:275–278). Consequently, create → community grant before deploy can succeed as a metadata-only update. Please rename the comment/test around missing sharing lifecycle and correct the PR description; the deploy hint can remain for that condition. This is established by upstream source inspection, not a live-server reproduction.
There was a problem hiding this comment.
🤖 Fixed in 46c92ba. The comment, error text and test now describe a missing sharing lifecycle; I confirmed reservation (reserve.go:150) and rollout (rollout.go:162) set it, so the deploy hint stays. The PR description is corrected too.
| Sharing follows the one-workspace model: `apps_visibility` switches an app | ||
| between everyone in the owner's workspace and only the owner, and | ||
| `apps_community` grants or revokes a Buzz community at the grant revision it just | ||
| read. Both keep existing viewers and community grants. |
There was a problem hiding this comment.
🤖 [P3] Scope the preservation promise to apps_visibility. apps_community revoke intentionally removes a community grant, so saying both tools keep existing community grants contradicts its behavior. Suggested wording: apps_visibility keeps existing viewers and community grants.
Compose answers the community sharing read with 409 only when the app has no sharing lifecycle. Reservation sets one, so a created but undeployed app can be shared; the 409 is for older apps, which a deploy fixes. Also scope the README's "keeps existing grants" promise to apps_visibility, since apps_community revoke removes one. Co-authored-by: Dylan G <69953f73c9f5149d56f2155107338a5435823b938a6c430c63e779f9a8a446f9@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Nathan Thillairajah <nthillairajah@squareup.com>
Buzz desktop gives local agents an
apps_sharetool for sharing a Builderlab app. It shares by granting access to another Builderlab workspace. That model is going away (BOT-2440): an account belongs to one workspace, and an app is open either to everyone in that workspace or only to its owner, plus any Buzz communities it's shared with. squareup/blockplat-compose#496 removes the workspace-grant route and #500 adds the visibility switch. Once Compose ships them,apps_sharefails every time, and agents have no way to make an app private or share it with a community.What changes
apps_shareis removed.apps_visibilityswitches an app between everyone in the owner's workspace and only the owner. The answer says who can open it now, for example "Only your owner. So can members of the Buzz community it is shared with."apps_communityshares an app with a Buzz community or stops sharing it.The requests match what
bl apps visibilityandbl apps communitysend (block/builderlab-cli#38, #39).Testing
Unit tests cover the requests and the agent-facing answers. It hasn't been tried in the app against staging yet. The owner still has to supply the community's ID.
Rollout
This needs to reach users in a Buzz release before, or together with, the production Compose update. Older Buzz builds keep the broken
apps_share.🤖 Generated with Claude Code