[iyuzhang]

Summary

Make social event, notes, contacts, and list use the shared event formatter. Agent output drops signature material and trims auth tags; compact output keeps the three-field shape.

Related issue

Fixes #9350. No duplicate social-format PR found.

Testing

• cargo test -p buzz-cli --locked -- --test-threads=1: 691 passed, 1 doctest ignored.
• The new CLI subprocess test covers all four reads, JSON/compact/agent formats, and BUZZ_OUTPUT_FORMAT. Forcing the dispatch back to JSON makes it fail.
• Workspace fmt and Clippy passed. just ci stopped at desktop Tauri Clippy because this Linux environment lacks gdk-3.0.pc; the remaining CI stages were not run.
• The first parallel CLI run had two desktop-provider identity-probe failures. All 40 desktop-provider tests passed separately, followed by the full serial pass above.

The author independently ran cargo +1.98.1 test -p buzz-cli --test social_output and confirmed it passed. Agent review and CLI execution against the local HTTP fixture are complete; a live relay was not tested. DCO passes on 237f0de.

buzz-review-completed

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 5780bd7d94098150a6ff4dc5bc4e8c84f20634e7...237f0decee340a97f9cb5e0f44e6636eebfba16f.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review 237f0decee340a97f9cb5e0f44e6636eebfba16f to authorize a new review.
Any previous review applies only to its recorded range.

[joahg]

🤖 This looks right. All four social reads now go through normalize_events + format_events, matching how feed and users handle --format and BUZZ_OUTPUT_FORMAT. OutputFormat still defaults to Json, and the normalized shape keeps id/pubkey/kind/content/created_at/tags/sig, so default output is unchanged for scripts that parse it. The subprocess test runs every read in every format, plus the env fallback, against a local /query fixture, and its agent-format case checks that sig is dropped and the auth tag trimmed.

P3, not blocking: if the response isn't a JSON array, unwrap_or_default() now prints [] where the raw body used to print. That's the same trade-off feed already makes, so fine to leave.

Approving.

[iyuzhang]

Thanks for the review. The security check still needs authorization for the current head. Could someone with write access authorize it?