1438 Commits

Include renames

Author	SHA1	Message	Date
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	fcfd41dbff	test(desktop): area-4 serialization direction tests for workspace transition helpers ... Adds three tests to commands/mesh_llm_tests.rs exercising the lock-serialization contract between with_workspace_transition_preflight and install_client_under_workspace_transition: - test_active_client_stop_then_transition_preflight_succeeds: installs a mock client, calls production mesh_stop_client (clears the runtime slot), then calls with_workspace_transition_preflight; asserts fail_if_client_mesh_active sees an absent runtime and the transition body executes. - test_transition_held_queued_install_detects_stale_scope: holds workspace_transition directly, advances the generation counter and commits a distinct scope; spawns an install task that queues on the lock; after the guard drops, install_client_under_ workspace_transition acquires, detects the stale captured scope (generation + full identity mismatch), and returns Err without invoking the injected install closure. - test_install_held_transition_preflight_observes_client: holds workspace_transition directly and places a mock client runtime in AppState; spawns a transition task that queues on the lock; after the guard drops, with_workspace_transition_preflight acquires, runs fail_if_client_mesh_active, observes the installed client, and returns Err. All three tests call the production helpers directly. No port (127.0.0.1:9337) is touched. Generation-sensitive tests acquire SCOPE_GENERATION_TEST_LOCK to avoid cross-test interference. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 18:10:28 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	1dc537dad5	fix(desktop): area-3+4 snapshot import seams, transition helpers ... Area 3 — snapshot import phase seams: - Extract confirm_agent_snapshot_import_core and confirm_team_snapshot_import_core, generic over tauri::Runtime. - Add before_store (post-entry-capture, pre-Phase-3a-lock) and after_store (post-Phase-3a-lock, pre-Phase-3b) hooks; no-ops in production. - ProfilePublish<'a>/MemoryPublish<'a> borrowed arg structs — no secret-key cloning across closures. - Thin Tauri commands call cores with no-op hooks and real relay adapters; app.state::<AppState>() inside async move blocks avoids non-'static borrows. - Delete duplicate submit_engram_event from team_snapshot.rs; reuse import.rs version (pub(crate)) for both agent and team engram boundaries. - Add retain_team_pending_in_scope(scope, team) sibling in teams.rs; team snapshot Phase 3 calls it instead of live retain_team_pending to avoid re-resolving active scope after a possible switch. - Move egress-guard + avatar tests from import.rs into import_tests.rs (included via #[path]); update egress inventory and allowlists. - Add SCOPE_GENERATION_TEST_LOCK in scope.rs for cross-module serialization of generation-sensitive tests; agent + team seam tests share this lock. - 4 named seam tests all pass concurrently (verified with cargo test --lib). Area 4 — workspace transition helpers: - Extract with_workspace_transition_preflight: acquires workspace_transition, runs fail_if_client_mesh_active, invokes transition_body under guard. - Extract install_client_under_workspace_transition: acquires workspace_transition, validates full captured scope identity (scope_id, relay, owner_pubkey, generation) under guard, calls install. - Both helpers live in mesh_llm_scope.rs alongside fail_if_client_mesh_active. - Area 4 tests (3 named) implemented in mesh_llm_tests.rs (separate commit). Also: remove unused AppHandle import from nest.rs (zero warnings). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 17:52:26 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	1ec287f935	fix(desktop): area-2+5 captured restart context, epoch_for, teams param ... CapturedRestartContext struct prepared fallibly before any stop: loads personas, teams, and global config from captured definitions_dir with ?, verifies owner keys against captured_scope.owner_pubkey and derives owner_hex from keys, resolves effective Mesh model ID for pre-stop preflight. Failure in any pre-stop step returns Skipped without stopping the running agent. restart_under_captured_epoch_for: injected stop_fn/spawn_fn/write_receipt_fn (all FnMut for multi-relay support); core owns key construction, receipt construction, runtimes.insert with context.scope.scope_id, captured-dir saves; in-epoch re-resolve of Mesh model detects non-workspace TOCTOU edits (Skipped before stop); stop failure classified as Skipped/ stop-failed-before-irreversible, not FailedAfterStop. spawn_agent_child_at: teams: &[TeamRecord] parameter added; live wrapper loads live teams; captured epoch passes context.teams loaded fallibly from definitions_dir; internal live load_teams call removed. Area-1 completion: adds two missing concurrency tests test_compensate_drain_writer_vs_compensation_deterministic (channel- established ordering, BOTH effects on disk) and test_compensate_drain_concurrent_start_is_blocked (channel/barrier, contender blocked until transition guard released). Area-2 tests: all six Thufir-named tests implemented and passing (context_load_failure, mesh_preflight_failure, workspace_switch, record_mesh_change, full_tail_stop_spawn_receipt_register_save, relay_mesh_preflight_precedes_stop). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 16:56:20 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	3957d738a2	fix(desktop): area-1 compensation lock order — adapter acquires store lock before delegating to lock-free core ... Move managed_agents_store_lock acquisition, scope-generation validation, and load_managed_agents_at into the compensate_drain adapter; compensate_drain_for becomes a lock-free testable core that accepts records: &mut [ManagedAgentRecord] and start_fn: FnMut(&DrainJournalEntry, &mut [ManagedAgentRecord]). Store guard is held continuously through validate→load→restore→save so any store-lock-only writer is serialized on the store lock (not the transition guard). The transition guard is still received by value from the caller to ensure it stays alive through the entire compensation. Test coverage: - test_compensate_for_restarts_stopped_entries_in_order - test_compensate_for_reports_partial_restart_failure - test_compensate_for_start_fn_receives_records_slice - test_compensate_drain_empty_stopped_returns_none_with_real_app - test_compensate_drain_stale_scope_skips_all_with_real_app - test_compensate_drain_attempts_restart_and_reports_degradation_with_real_app Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 14:54:14 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	e73458efef	fix(desktop): resolve clippy empty_line_after_doc_comments in file-size extractions ... Two extraction sites had doc comment blocks adjacent with blank lines, triggering clippy::empty_line_after_doc_comments: - team_snapshot.rs: moved mod/use declarations before the doc block of confirm_team_snapshot_import (no longer adjacent to the doc comment). - runtime_commands.rs: inserted a non-doc // separator line directly between the compensate_drain and compensate_drain_for doc blocks (no blank line between // and /// so clippy treats them as connected). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 02:06:54 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	ff16a80b5b	fix(desktop): pass-2 review corrections (round 3) — captured respawn, behavioral tests, residue ... Global-config respawn: replace live-scope wrappers with one transition epoch. restart_under_captured_epoch acquires managed_agent_runtime_transition + managed_agents_store_lock, validates captured generation, stops, builds a captured spawn context (records/personas/global config/owner hex/scope_id from captured_scope), spawns/registers, saves — no live wrapper past the stop. persist_last_error takes captured_scope, validates generation under its own acquired store lock, never called while that lock is held, fails closed on poison. Two tauri::test::mock_app() tests: fresh-scope no-runtime → Skipped (proves generation guard passes + path proceeds), stale-scope → Skipped at generation step (switch-between-stop-and-spawn test, calls production fn). Behavioral tests on production paths: tauri = { version = "2", features = ["test"] } added to dev-dependencies. compensate_drain_for extracted with injectable start_fn; tests call it directly (compensate_drain_for is the production core). capture_agent_snapshot_import_entry and capture_team_snapshot_import_entry extracted as testable entry guards; tests call the real production functions (no-scope reject, owner-mismatch reject, matching-owner passes + relay verified, stale-generation rejects validate_scope_generation). registerNestNotifications extracted from useNestNotifications; test imports and calls the real function, asserts all three event registrations, workspace-degraded toast payload, unlisten cleanup per event. fail_if_client_mesh_active and mesh_stop_client tested via tauri::test::mock_builder() with real AppHandle (no-runtime, client-runtime, no-runtime stop paths). Generalized fail_if_client_mesh_active and mesh_stop_client to tauri::Runtime to allow mock_app usage. Residue: _compensation_gate_removed placeholder deleted from AppState. identity.rs:346-348 comment corrected (guard passed by value, not dropped). mesh_llm_scope.rs:59-64 stale re-arm comment replaced with accurate Option A note. Duplicate generation bump at identity.rs:544 removed (clear_active_scope calls next_scope_generation internally; no second bump needed). File-size gate: AgentSnapshotImportEntry + capture_agent_snapshot_import_entry extracted to import_entry.rs (import.rs: 995 lines); TeamSnapshotImportEntry + capture_team_snapshot_import_entry extracted to team_snapshot_entry.rs (team_snapshot.rs: 997 lines). Both within the 1000-line ratchet. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-04 01:57:40 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	6dc4e29155	Merge origin/main into duncan/workspace-scoped-agent-store ... Resolves two conflicts against main: AppShell.tsx: HEAD had const { activeCommunity, reinitKey } = communitiesHook for the composite workspace key; origin/main added useHuddlePresentation() destructuring from the Huddle redesign (#4281). Resolution keeps both: the composite key is required for useManagedAgentRuntimeReconciliation, and the Huddle hooks are needed for the new Huddle UI. MeshComputeSettingsCard.tsx: HEAD had the Stop using shared compute affordance plus the legacy inline model section; origin/main (#3735) replaced the inline model section with the MeshModelPicker component. Resolution keeps the Stop button block and adopts the MeshModelPicker layout, discarding the replaced inline model controls. Also corrects the false comment at runtime_commands_tests.rs:342-345 that claimed compensate_drain is covered by the desktop integration test suite. The compensation round-trip requires an AppHandle; the codebase has no tauri::test harness and no AppHandle mock. The honest coverage statement is: drain-prefix contract proven by unit test, restart path integration-only. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 22:39:51 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	40607d4a88	fix(desktop): pass-1 review corrections (round 2) — compensation, Mesh stop, scope, CI ... Item 1 — Compensation primitive: replace AtomicBool gate with lock-owning compensate_drain that takes the caller's already-held rt_transition guard by value, re-acquires only the store lock, validates captured scope generation, then restores journal entries via start_pair_under_held_locks. Split start_pair_under_held_locks out of start_pair so both the normal and compensation paths share the spawn-and-register body. execute_drain_journal refactored to accept an injectable stop_fn via drain_journal_with_stop; execute_drain_journal_with_stop_fn exposed for test injection. Tests: live SIGKILL drain, structural lock-release proof, deterministic partial-failure test with injected stop error covering stopped prefix and remaining tail. Item 2 — Client stop + start serialization: mesh_stop_client Tauri command in mesh_llm_scope.rs stops only a client-mode runtime; serve/absent are no-ops. Client start (ensure_relay_mesh_for_record) acquires workspace_transition through runtime installation to serialize against apply_workspace, which holds workspace_transition from before the Option A preflight through commit. fail_if_client_mesh_active preflight runs under workspace_transition so no new client can start in the check→commit gap. UI: 'Stop using shared compute' button in MeshComputeSettingsCard shown when isConsuming; calls new meshStopClient() in tauriMesh.ts. e2eBridge mock for mesh_stop_client added. Item 3 — Fallible migrations + atomic marker: rename_provider_to_runtime_in_personas propagates Result; migrate_agent_keys_to_dev_service_at returns Result and propagates from copy_agent_keys_between_stores. run_scoped_migrations uses ? on persona-provider step. _ready marker written via temp+rename (atomic). dev-key migration skipped in unit-test builds (#[cfg(not(test))]) to avoid macOS Keychain dialogs. Tests: old-marker upgrade (no scope deletion), partial migration failure withholds v1 until repair succeeds. Item 4 — Global-config captured respawn: Phase 2 restart validates captured scope generation under store lock before stop, and again before respawn via start_local_agent_pairs_with_preflight_at (new captured variant using definitions_dir). persist_last_error validates generation under store lock. Item 5 — Snapshot imports captured operation context: both confirm_agent_snapshot_import and confirm_team_snapshot_import capture owner keys at entry, verify against captured_scope.owner_pubkey immediately, thread captured keys through all mint/retention/engram phases. Re-verify owner key under store lock before Phase 3a write. Outbound profile/memory phases use captured_scope.relay_url. Item 6 — CI red: rustfmt applied (agents_scoped.rs, import.rs); clippy needless_borrow at team_snapshot.rs:793 fixed; e2eBridge apply_workspace mock returns { applied: true, degraded: [] } in both immediate and delayed branches; mesh_stop_client mock case added. Stale 3-line doc fragment removed from mesh_llm.rs; visibility of re-exported agents_scoped fns bumped to pub(crate). Item 7 — Listener behavioral test: useNestNotifications.test.mjs exercises workspace-degraded toast payload, unlisten cleanup, and boundary payloads without requiring a real Tauri runtime. Doc comment updated: event-sync dispatch failure does not emit workspace-degraded (shutdown-time, no toast surface). Item 8 — Dead code (minor): backfill_persona_snapshots AppHandle shim removed; stale scope_init.rs:388-393 comment corrected; make_base_dir test helper removed. File-size gate: mesh_llm.rs (999), import.rs (999), team_snapshot.rs (999). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 22:08:42 -04:00
9 people	631b05c883	feat: ship Buzz Term (#4347) ... ## Summary - ship **Buzz Term** end to end: the terminal engine/runtime, mounted desktop substrate, and user-visible naming - add Quinn's tape-deck-inspired banner: a beveled chassis filled by the `buzz term` wordmark, surrounded by a complete-hex field - derive the wordmark's three-stop sweep from each theme's terminal palette so primary, secondary, and accent roles remain visibly distinct across all 62 shipped themes, including light themes - paint the banner once on its own pointer-transparent canvas; PTY rendering beneath it remains unchanged ## Banner behavior - uses the renderer's shared `8.4 × 17` cell metrics and production aspect ratio `2.0238` - regenerates only for viewport/theme changes; palette switches repaint correctly while the banner is visible - dismisses on non-empty output from the active terminal session; empty output and inactive sessions do not dismiss it - fails closed below **70 columns** rather than squeezing or clipping the wordmark - adds **8 lines** to `terminalRenderer.ts` for shared cell metrics and **zero lines inside `paint()`** ## Screenshots | Buzz (light) | Buzz Dark | |---|---| |  |  | | Kanagawa Lotus (light) | Red | |---|---| |  |  | Additional production-aspect finals: [Vesper](https://buzz.block.builderlab.xyz/media/9ca6514b63f8cfb2107a85ca46f16a940c0883848e6fbc718e411af94aa13100.png), [Min Dark](https://buzz.block.builderlab.xyz/media/f67bd2970e5d64ffb07b1ae78ab58c847e6ebc23e7e7a48e067eb024dba64ec8.png), and [Dark Plus](https://buzz.block.builderlab.xyz/media/290fee08924f37d064abc687ecf3e9526ab05b87e8e56d610f23048949793dbe.png). The screenshot harness was checked against the shipped painter at this exact head: all **2,541 draw calls** matched on color, glyph, x, and y; four deliberate divergence controls fired. ## Verification at `98ebc8f9048bd5f0ceb7e843b67874d642f0b7fd` - desktop tests: **3,946 / 3,946** - TypeScript: clean - checks: pass (two pre-existing informational `useTemplate` notices only) - integration/e2e: PASS (independent exact-SHA lane; artifacts recorded in the originating Buzz thread) - artifact/dead-path sweep: clean - redteam G1–G7: PASS - all six named banner emitter-deletion mutants die - independent handwritten five-row full-wordmark fixture kills Quinn's seven-mutant battery, including a one-pixel glyph change - real `112 × 46` canvas-rect dismissal tests separately cover active non-empty, active empty, and inactive non-empty output - layer-drop and zero-draw painter mutants die; z-order and pointer-events verified - CI's `tsc && vite build` includes all three banner modules - performance at DPR 2 (worst-case measured envelope): - one-time content paint: **~0.7–0.8 ms**, paid only when the banner is built or its palette changes - busy compositor, CSS `1277 × 697`, backing `2554 × 1394`: **470–497 µs/frame** for the full banner (**2.82–2.98%** of a 60 Hz frame) - busy compositor, CSS `1920 × 1080`, backing `3840 × 2160`: **1,139–1,212 µs/frame** (**6.83–7.27%**) - empty, one-glyph, and full-banner controls converge: compositor cost follows backing-layer area and DPR rather than painted-cell count - in the actual idle welcome state, cost is below both vsync-clamped rigs' resolution; it is not claimed as zero - **Pane cross-rig spread: resolved at matched loop rate.** Two independent rigs initially differed 2.3× (58–68 vs 136 µs/Mpx of backing store; pane, CSS 1277×697 / backing 2554×1394, DPR 2). The cause of *that* spread is rAF loop rate: the higher figure came from a free-running loop at ~1600fps. Throttled to ~200–236fps, both rigs read 58–68 µs/Mpx (1.25–1.44% of a 60Hz frame). The busy-composite figures quoted above remain the **unthrottled worst case** and are conservative by ~2.3× at the pane. Not established: the mechanism and sign of free-running distortion (one rig under-charges ~15%, the other over-charges 2.3×), and the 1080p figure has not been re-measured throttled. - the layer paints only on generation/theme/resize and dismisses on first non-empty active-session output, so the measurable busy cost is a short-lived worst case rather than a persistent PTY paint-path tax ## Follow-ups in this PR These are intentionally subsequent commits after the certified static-banner head, not claims about `98ebc8f90`: 1. close the compositor metrology: remeasure the 1080p point throttled and characterize the opposite-sign free-running rAF distortion, with each measurement regime stated 2. add Tyler's animated honeycomb color waves, gated by `prefers-reduced-motion`, a full 62-theme phase-sweep contrast check, and DPR-2 per-tick performance certification 3. land the already-proven mounted theme-switch regression probe from `RESEARCH/BUZZ_TERM_G3A_PROBE/` 4. bound the slow/hang-shaped G1-c mutant `waitFor` 5. optionally trim the generator to its ink bounding box, reducing the minimum viewport from 70 to 62 columns --------- Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com> Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz> Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Signed-off-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz> Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@buzz.block.builderlab.xyz> Co-authored-by: npub1cc3ha7z055mu0rwwu7806t2wt8mj3pvu0uv5mfp2c50dahaqhczshdalg6 <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@buzz.block.builderlab.xyz> Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz> Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>	2026-08-03 21:51:17 -04:00
3 people	b42b093613	feat(mobile): sync per-group channel sorting (#4231) ... **Category:** improvement **User Impact:** Mobile users can sort each channel group by recent activity or A–Z, with their choices synchronized with desktop. **Problem:** Desktop supports persistent per-group channel sorting, but mobile shows the same groups without equivalent controls or shared preferences. The earlier mobile attempt coupled sorting to unsafe dirty-state behavior that could overwrite newer cross-client changes. **Solution:** Add mobile sorting controls and encrypted NIP-78 synchronization using the existing desktop `channel-sort` contract, while retaining ordinary whole-blob last-write-wins behavior. Local state is scoped by identity and normalized relay, startup closes fetch/subscription gaps, and both clients use the same deterministic ordering rules. <details> <summary>File changes</summary> **desktop/src/features/sidebar/lib/channelSortPreference.test.mjs** Updates ordering coverage for the deterministic, cross-client A–Z comparison rule. **desktop/src/features/sidebar/lib/channelSortPreference.ts** Aligns desktop channel-name collation with mobile so synchronized preferences produce the same visible order. **mobile/lib/features/channels/channel_sort/channel_sort_manager.dart** Adds encrypted relay synchronization with safe startup gap handling, clock checks, and ordinary last-write-wins conflicts. **mobile/lib/features/channels/channel_sort/channel_sort_provider.dart** Scopes sort state to the active identity and community lifecycle. **mobile/lib/features/channels/channel_sort/channel_sort_storage.dart** Defines the desktop-compatible payload, relay-scoped cache and migration, cleanup, and shared ordering behavior. **mobile/lib/features/channels/channels_page.dart** Connects sort state to the channel page. **mobile/lib/features/channels/channels_page/body.dart** Applies each selected order to Starred, custom groups, Channels, and DMs. **mobile/lib/features/channels/channels_page/sections.dart** Adds checked Recent and A–Z actions using the existing anchored-popover UI. **mobile/test/features/channels/channel_sort/channel_sort_manager_test.dart** Covers payload adoption, encrypted publication, conflicts, timestamps, retries, and cleanup. **mobile/test/features/channels/channel_sort/channel_sort_storage_test.dart** Covers parsing, relay isolation, migration, cleanup, and ordering modes. **mobile/test/features/channels/channels_page_test.dart** Verifies the group controls expose both choices. </details> ### Reproduction steps 1. Open the mobile channel list with populated built-in and custom groups. 2. Open a group menu and choose **Sort: Recent**; confirm active channels move to the top. 3. Choose **Sort: A–Z**; confirm deterministic alphabetical ordering returns. 4. Repeat for Starred, a custom group, Channels, and DMs. 5. Open desktop with the same identity and community and confirm each synchronized preference. 6. Switch communities and confirm cached preferences do not bleed across relays. ### Screenshots Approved `live` custom-section flow with `research` kept offscreen. | Recent selected | A–Z result | A–Z selected | |---|---|---| |  |  |  | ### Validation - Mobile `flutter analyze` — clean - Focused mobile sort and channel-page suites — 37/37 passed - Desktop full suite — 3906/3906 passed - Mobile full suite — 1034 passed, 1 skipped, 1 unrelated baseline failure reproduced at `ac4fa13b8` <!-- Originating Buzz channel: 2a16a2bb-6fd3-4d69-8182-2afcb21b2d14 --> --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-08-03 18:02:09 -07:00
4 people	b29c8cdaa4	feat(desktop): redesign the Huddle experience (#4281) ... ## Summary - open Huddles in a focused companion window with a clean handoff back to the in-app drawer and backing channel - redesign the participant film strip, sidebar control, transcript surface, and themed shell treatment - preserve microphone and device control across windows, start agent voice on the first reply, and show agent speaking activity in the film strip - give each agent a distinct session voice, beginning with the configured default, plus compact per-agent text-to-speech and voice controls - enroll only agents explicitly mentioned or deliberately added through an agent panel into the live Huddle roster - keep temporary Huddle channels out of the sidebar unless the user explicitly brings one into the main app - remove Huddle-only avatar policy badges and filter short silence or noise segments before speech-to-text posts ## Why The previous flow exposed the temporary channel as product UI, obscured who was present or speaking, and split transcript and audio state between the main and companion windows. This keeps backing channels as implementation details unless a user explicitly brings a Huddle into the app, while sharing the live conversation and audio lifecycle across both surfaces. Agent participants now join only after an explicit invitation, distinct voices make multi-agent Huddles easier to follow, and short microphone noise no longer becomes stray transcript messages. ## Validation - `pnpm check` - `pnpm build:e2e` - `pnpm exec playwright test tests/e2e/huddle-transcription.spec.ts --project=smoke` (13 passed) - Huddle sidebar visibility unit coverage (4 passed) - focused managed-agent and persona-mention E2E coverage (2 passed) - `pnpm test` (3,910 passed) - `cargo clippy --manifest-path desktop/src-tauri/Cargo.toml --all-targets -- -D warnings` - `cargo test --manifest-path desktop/src-tauri/Cargo.toml` (2,093 passed, 14 ignored; 3 diagnostics passed) --------- Signed-off-by: kenny lopez <klopez4212@gmail.com> Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>	2026-08-03 17:16:09 -07:00
3 people	985cdcc6ea	feat(agents): model-tuning parity in global Agent Defaults editor (#4578) ... ## Overview The global Agent Defaults surface (Settings card, defaults modal, onboarding) exposed structured controls for Effort but left Max Output Tokens, Context Limit, and Max Rounds as raw env vars. Per-agent dialogs had structured numeric fields but only for `isBuzzAgentRuntime` — incorrectly excluding Goose. This PR unifies numeric-tuning capability across all surfaces, fixes a pre-existing dual-editor defect, and adds full test coverage. ## What changed ### Phase 1 — Catalog projection - Add `max_rounds_env_var` to `KnownAcpRuntime` in `runtime_metadata.rs` (`Some("BUZZ_AGENT_MAX_ROUNDS")` for buzz-agent, `None` elsewhere). - Project all three numeric env-var fields (`max_tokens_env_var`, `context_limit_env_var`, `max_rounds_env_var`) end-to-end: `AcpRuntimeCatalogEntry` Rust struct, TS `types.ts`, `RawAcpRuntimeCatalogEntry` + `fromRawAcpRuntimeCatalogEntry` in `tauri.ts`, and the e2e mock bridge (`withMockRuntimeConfigMetadata`). ### Phase 2 — Field model - `deriveAgentConfigFieldModel` now derives `maxOutputTokens` / `contextLimit` / `maxRounds` descriptors from catalog-projected fields. - `structuredEnvKeys(descriptors)` — exported helper that takes the **rendered** descriptor set (not the whole model). Hidden keys follow what is actually rendered per surface: global hides effort + all three numeric keys for buzz-agent / two for Goose; per-agent buzz-agent hides effort + three numeric keys; per-agent Goose hides only its two numeric keys. `BUZZ_AGENT_THINKING_EFFORT` stays a visible generic env row per-agent because no effort control renders there. ### Phase 3 — UI - Extract `NumericTuningFields` from `buzzAgentModelTuningFields.tsx` as a shared descriptor-driven component (`descriptors`, `envVars`, `inheritedEnvVars`, `onEnvVarChange`). Kind-specific minima: `NUMERIC_KIND_MIN` map (`maxOutputTokens`/`contextLimit`: 1, `maxRounds`: 0) applied to `<input min>`. - **Global surface** (`AgentConfigFields.tsx`): deduplicate the previously duplicated Advanced env-editor block; render `NumericTuningFields` below the env editor when descriptors exist; `hiddenKeys` and `bakedGenericRows` exclusions use `structuredEnvKeys` so structured keys are never double-rendered. Under 1000 lines. - **Per-agent surfaces** (`EditAgentAdvancedFields`, `PersonaAdvancedFields`): replace `isBuzzAgentRuntime` as the numeric-field gate with `deriveNumericDescriptors(selectedRuntime)` from `agentConfigCore`; hidden keys come from `structuredEnvKeys(numericDescriptors)` — the same rendered descriptor set, no local rebuilding (fixes pre-existing dual-editor defect). Catalog status carried as `RuntimeCatalogStatus` (`loading | ready | error`); both error and loading withhold structured controls and leave saved values visible as generic rows, making error distinguishable from "runtime not capable" (`ready` + no runtime). - **Dialogs** (`AgentDefinitionDialog`, `AgentInstanceEditDialog`, callers): `AgentDefinitionDialog` accepts `runtimeCatalogStatus?: "loading" | "ready" | "error"` (replaces separate `runtimesLoading`/`runtimesError` booleans); all call sites — `AgentManagementDialogs`, `AgentsView`, `RequestedAgentCreateDialogs`, `UserProfilePersonaDialogs` — compute and pass the status. ### Phase 4 — Tests - `buildRecord` exported from `EnvVarsEditor.tsx` as a pure `(nextRows, value, requiredKeys, hiddenKeys) => Record<string, string>` helper for isolation testing. - **17 new node tests** in `agentConfigCore.test.mjs`: `deriveNumericDescriptors` (all three fields, partial, undefined runtime, matches field-model subset); `structuredEnvKeys` per surface including discriminating Goose per-agent effort-key invariant; `NUMERIC_KIND_MIN` values. - **4 new node tests** in `EnvVarsEditor.test.mjs`: hidden tuning key preserved through generic row edits; runtime-switch then generic edit (derives both descriptor sets, asserts new-runtime hidden key survives `buildRecord` via `hiddenKeys` and old-runtime key survives via generic rows); baked numeric key excluded via `filterBakedGenericRows` with `numericTuningPlaceholder` assertion; clearing a structured override — `numericTuningPlaceholder` verifies placeholder text. - **5 new Playwright tests** in `agent-numeric-tuning.spec.ts` (added to smoke project `testMatch`): global numeric fields visible for buzz-agent; global: non-capable runtime hides numeric controls; Goose per-agent shows `Inherit (16384)` after saving global value through the UI; delayed catalog: saved values visible as generic rows while loading then structured controls appear after settle; failed catalog: saved values remain visible as generic rows (never the "unsupported" empty state). ## Result - buzz-agent global defaults: Max output tokens, Context limit, Max rounds as structured inputs with `Inherit (N)` placeholders from baked env. - Goose global defaults: Max output tokens, Context limit as structured inputs. - A Goose global value surfaces as `Inherit (<value>)` in the per-agent Goose edit dialog. - No structured key is editable in two places on any surface; no persisted key has zero editors. - No `runtime.id === "buzz-agent"` comparison decides numeric-field visibility anywhere — capability flows catalog → `AcpRuntimeCatalogEntry` → field model → UI. Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-08-03 18:09:24 -04:00
klopez4212andGitHub	027a74a61c	Polish Share Compute settings (#3735) ... ## Summary - Refresh Share Compute with the shared agent-style model controls. - Reveal sharing details and advanced options only while sharing. - Remove the preview-only mesh API path. ## Validation - `pnpm check` - `pnpm test` - `pnpm exec playwright test tests/e2e/mesh-compute.spec.ts` Snapshots are attached in a follow-up comment. --------- Signed-off-by: kenny lopez <klopez4212@gmail.com>	2026-08-03 14:12:21 -07:00
3 people	7981597848	fix(reactions): wrap long popover names (#3834) ... **Category:** fix **User Impact:** Long custom emoji names now stay contained inside reaction popovers and remain fully readable. **Problem:** An unbroken custom emoji name could force a reaction popover beyond its intended maximum width and overflow the message view. **Solution:** Give the reaction popover a definite 288px width and allow the complete emoji name to wrap within it without truncation or ellipsis. Short names retain the same content and interaction behavior. <details> <summary>File changes</summary> **desktop/src/features/messages/ui/MessageReactions.tsx** Bounds the reaction popover width and allows long names to break across lines while preserving the full shortcode. **desktop/tests/e2e/reaction-names.spec.ts** Covers fixed width, full text preservation, and wrapping for the maximum supported colon-wrapped reaction name, with deterministic seeded Picsum visual fixtures and explicit image-load waits. </details> ## Reproduction Steps 1. Open a message with a custom emoji reaction whose name is 64 characters. 2. Hover or focus the reaction pill to open its details popover. 3. Confirm the popover remains 288px wide and the complete name wraps within it without ellipsis. 4. Open a short-name reaction and confirm its popover remains readable and unchanged in behavior. ## Screenshots | Before | After | | --- | --- | |  |  | **Short-name regression check**  ## Verification - `pnpm test` in `desktop`: 3,858 passed - Focused reaction-name E2E with seeded Picsum captures: 2 passed - Desktop checks and commit hooks passed Originating Buzz channel: `f2ec9671-d78e-4cde-894c-9f4c458c7f1f` --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-08-03 14:09:46 -07:00
3 people	d4a4570b97	fix(desktop): clarify inherited agent parallelism (#4010) ... ## Summary - show an unambiguous `App default (10)` inherited state for parallelism in create and edit forms - explain that blank inherits the app default and suppress create-form number steppers that could silently set `1` - align the E2E mint fallback with production while preserving explicit input → definition → app-default precedence ## Why The forms displayed `1` even though an untouched field is omitted and desktop minting materializes `10`. The create-form spinner could also turn blank/inherited into an explicit `1` with one click while leaving the field looking nearly unchanged. ## Testing - `pnpm test` (desktop: 3,886 passed) - `pnpm typecheck` (desktop) - `pnpm check` (desktop) - pre-push `desktop-check` and `desktop-test` --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>	2026-08-03 13:47:52 -07:00
3 people	5c98932c59	feat(desktop): make onboarding model defaults skippable (#3968) ... **Category:** improvement **User Impact:** Users can skip default model configuration during onboarding and finish it later in Settings → Agents. **Problem:** Requiring model defaults during onboarding can block users who are not ready to choose a harness, provider, or model. Skipping also needs to leave existing configuration untouched rather than persisting partial selections. **Solution:** Stage onboarding edits locally and persist them only when users choose Next or Back. A delayed Skip action advances without any configuration write, while a footer hint points users to the settings location for completing setup later. <details> <summary>File changes</summary> **desktop/src/features/onboarding/ui/DefaultConfigStep.tsx** Adds the skip action and future-settings hint, and makes model configuration transactional so Skip discards staged changes while Next and Back preserve the intended save behavior. **desktop/src/testing/e2eBridge.ts** Exposes model-config setter call counts so tests can distinguish a true zero-write skip from a write-and-rollback implementation. **desktop/tests/e2e/onboarding-agent-defaults.spec.ts** Covers skipping during loading and after staged edits, verifies zero persistence calls, and confirms Next and Back still commit changes. </details> ## Reproduction steps 1. Start fresh onboarding and continue through harness setup to **Configure your default model settings**. 2. Change the selected harness or model, then choose **Skip for now**. 3. Confirm onboarding advances to **Join or create a community** and the prior global model configuration remains unchanged. 4. Return through onboarding and confirm **Next** saves the staged selection; confirm **Back** also preserves staged changes before returning. 5. Confirm the footer says model defaults can be configured later in **Settings → Agents**. --------- Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Signed-off-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-08-03 13:05:47 -07:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	f1fb83c45b	fix(desktop): resolve file-size gate violations (import.rs, scope_init.rs) ... Move scope_init tests to scope_init_tests.rs via #[path] include to bring scope_init.rs under the 1000-line ratchet (603 lines after extraction). Move test_outbound_relay_uses_captured_scope_not_live_state from import_avatar_tests (in import.rs) to the adjacent tests.rs to bring import.rs under the 1000-line limit (999 lines after move). Both files previously crossed the limit after the resume-pass corrections added the versioned-ready test block and the captured-relay test. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 15:51:52 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	ad3230b480	fix(desktop): resume-pass corrections — Option A Mesh, versioned ready, captured scope, lock-aware compensation ... Eight corrections from the resumed loop (fresh 3-pass budget, Option A ruling): 1. Option A Mesh: delete pre-prepare drain_mesh_client_if_stale and rollback restore_mesh_sharing (compensated a drain that no longer happens). Replace with fail_if_client_mesh_active preflight in both apply_workspace and identity import. Journaled Mesh recipe deferred as tracked follow-up. 2. Versioned _ready: scope_is_ready now reads marker content and compares against READY_MARKER_VERSION ("v1"); old unversioned markers return false and force re-run through run_pre_ready_family. Delete log-only post-ready best-effort guards (backfill + retention migration) from apply_workspace. Add test: old marker -> pipeline re-runs -> version advances. 3. Snapshot outbound phases use captured scope relay: both confirm_agent_snapshot_import (Phase 3b profile) and confirm_team_snapshot_import (Phases 4/5 profile + memory) now use captured_scope.relay_url instead of relay_ws_url_with_override. Add test proving outbound relay is captured-scope, not live-state. 4. Generation checks atomic with writes: global_agent_config Phase 1 validates scope generation inside the store lock before writing config; Phase 2 (restart_local_agent_on_config_change) validates under lock before stop. collect_restart_candidates renamed to collect_restart_candidates_at with definitions_dir parameter. Mesh recovery helpers (persist_mesh_last_error_at, clear_mesh_last_error_if_set_at) take captured_scope and validate generation inside the store lock. 5. Lock-aware compensation gate: AtomicBool managed_agent_drain_compensation_in_progress added to AppState. compensate_drain sets it true (Release) before restarting entries, false after. start_pair loads it (Acquire) before taking the transition lock and returns Err if set. Closes the drop-then-compensate interleave window without recursive locking. Add deterministic partial-drain test. 6. Pre-scope migrations deleted: migrate_agent_keys_to_dev_service (AppHandle variant) removed from storage.rs. Pre-scope calls removed from run_boot_migrations_inner. Scoped variants in run_pre_ready_family are authoritative. 7. Degradation wired to UI: workspace-degraded Tauri event listener added to useNestNotifications.ts (toast.error with payload as description). False comment about emit_workspace_degradation removed from event_sync.rs. backfill_persona_snapshots_at (dead lock-taking wrapper) deleted. 8. e2e test docs: test_two_workspace_relay_partition comment corrected -- Direction 3 asserts len==1 (B's event), not zero. Explicit note added that this test does not cover desktop workspaces or substitute for the live probe. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 15:40:22 -04:00
3 people	651f637275	chore(release): release Buzz Desktop version 0.5.4 (#4562) ... ## Buzz Desktop release v0.5.4 - **Frozen main:** `6de85fe31d781122756aecf954bae7d357a56b9a` - **Reviewed candidate:** `5836cb8f0af478ed3ee3bc6464a20fa4cc91303f` - **Previous desktop release:** `desktop-v0.5.3` - **Proposed immutable tag:** `desktop-v0.5.4` This PR must be **squash merged** only after the Desktop Release Candidate check passes. The branch must remain based directly on current `main`; stale base, payload drift, incomplete notes, or an unauthorized merge produce no tag. The checked-in changelog accounts for every non-merge commit in the release range. Publication remains bound to the immutable candidate tag. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Release Automation <release-automation@users.noreply.github.com>	2026-08-03 10:33:19 -07:00
3 people	80315ac1a6	fix(desktop): harden Windows installs against Defender block and orphaned Node (#4382) ... This PR fixes two Windows-specific install failures: Windows Defender blocking the bare `irm|iex` PowerShell install command, and managed Node shims pointing at a version-bumped (now-absent) Node directory. The Defender block (Trojan:Win32/Commando.A!ml) fires before PowerShell runs and is not clearable via Allow. The Node orphaning means shims in the managed npm prefix resolve but fail at runtime with 'node not recognized' because they reference the deleted old Node path. - Replace all three Windows CLI install commands (Goose, Claude, Codex) with a two-step shape — `Invoke-RestMethod` to a named temp file, then execute — to eliminate the dropper signature; a new `windows_install_command!` macro in `discovery/windows_install.rs` generates all three strings at compile time so the shape cannot drift between runtimes - `$ErrorActionPreference='Stop'` aborts on download failure instead of falling through to a missing-file exit-0; `exit $LASTEXITCODE` propagates the vendor script's own exit code - Add `probe_node(executable, expected_version, timeout)` as a bounded seam: stdout goes to a temp file (not a pipe) so no exit path can block on an inherited handle; the child runs in its own process group on Unix so an unconditional group SIGKILL on every exit path terminates all descendants; on Windows `taskkill /T /F` provides the same tree-wide cleanup; `managed_node_runtime_ready()` is a thin wrapper that resolves the managed Node path and calls the seam - Add `resolve_adapter_path()` in `managed_node.rs`: resolves the candidate first, then calls `should_invalidate_adapter()` — a pure predicate that returns `true` only when the resolved path is under `buzz_managed_npm_bin_dir()` AND the managed Node runtime is orphaned; external adapters outside the managed prefix are always preserved Note: CI cannot reproduce the Defender block (no live Defender ML classifier). Proof of fix is structural — the command shape no longer matches the dropper signature. Canary validation on a real Windows machine with Defender enabled is the definitive check. --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-08-03 09:37:44 -07:00
3 people	c1b88af8d7	feat(desktop): improve channel template discovery (#4549) ... ## Summary - move **Channel templates** from Communities to Personal settings - always expose the template picker in New Channel, using **None** as the no-template value - create a channel template directly from the picker and select it on return - preview the selected template's current visibility, canvas, agents, and teams - order the channel-creation controls as **Type / Visibility / Template** and mark Template **Optional** - cover populated and empty libraries, inline creation, selection, visibility overrides, mixed agent/team inventory, field order, optional labeling, and settings navigation in Playwright ## Validation Validated at desktop-only tip `76442270c88aa1d533ddca5de9f87cd615183919` with a clean worktree: - focused channel-template Playwright: 2/2 passed - Type / Visibility / Template ordering and muted Optional treatment visually inspected in the replacement screenshot - `git diff --check origin/main...HEAD` passed - PR diff contains exactly nine Desktop files and no Mobile files The pre-push hook was bypassed only for the corrected history push because the inherited Mobile test `keeps follow mode off while a tall newest message stays visible` passes in Linux CI but fails on macOS because its offscreen-child mounting assertion is platform-sensitive. No Mobile code or tests are changed by this PR. ## Screenshot  Originating Buzz channel: `efba7343-e147-48b7-a2aa-15a5f04abc57` --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>	2026-08-03 09:30:15 -07:00
3 people	01c80aa9b3	fix(desktop): save key backups to authorized path (#4022) ... **Category:** fix **User Impact:** Users can save password-protected identity backups directly to protected macOS folders such as Downloads. **Problem:** Signed macOS builds could not save a portable `.ncryptsec` backup to Downloads because the atomic writer created an unauthorized sibling temporary file. This surfaced as an “Operation not permitted” error after the user completed backup creation. **Solution:** Portable exports now write only to the exact path authorized by the native Save panel, sync and verify the saved bytes, and refuse to truncate an existing backup. Buzz’s app-managed backup retains its atomic writer and durability guarantees. <details> <summary>File changes</summary> **desktop/src-tauri/src/commands/export_util.rs** Clarifies that secret exports use a dedicated writer compatible with native Save-panel authorization. **desktop/src-tauri/src/commands/identity.rs** Routes portable NIP-49 exports through the Save-panel-compatible writer while preserving canonical app state. **desktop/src-tauri/src/key_backup.rs** Adds an exclusive-create portable writer with owner-only permissions, disk sync, byte verification, and cleanup on failure. Keeps the existing atomic writer for app-managed backups. **desktop/src-tauri/src/key_backup_tests.rs** Covers portable export permissions, absence of sibling files, and preservation of existing backups. </details> ## Reproduction steps 1. Install a signed macOS build containing this change. 2. Open **Settings → Profile → Private key → Create backup** and complete backup creation. 3. Save a fresh `identity.ncryptsec` file into `~/Downloads` and confirm Buzz reports success. 4. Open and verify the saved backup with its password. 5. Repeat the save using an existing filename and confirm Buzz preserves the existing file and asks for a new filename. ## Verification - Full desktop Tauri suite: 2,049 passed, 14 ignored - Diagnostic suite: 3 passed - Focused backup coverage: 30 passed - Tauri clippy (`--all-targets -D warnings`), Rust formatting, and `git diff --check`: passed - Push hooks: org safety, branch skew, and desktop Tauri checks passed Signed-production Downloads smoke remains required after merge because the signing workflow is restricted to `main`. Signed-off-by: Taylor Ho <taylorkmho@gmail.com> Co-authored-by: npub1223z34hd7vtwc6qj4s7flsxkj644nlre2nthu7lrrmkumhu3xddsrx9r6w <52a228d6edf316ec6812ac3c9fc0d696ab59fc7954d77e7be31eedcddf91335b@buzz.block.builderlab.xyz>	2026-08-03 09:29:40 -07:00
klopez4212andGitHub	b0c6d6f744	Add channel activity hover menu (#3935) ... ## Summary - show relevant unread threads and active agents when hovering a channel - keep channel-level unread emphasis separate from thread activity dots - make activity rows navigate to the thread and remove demo-only data ## Test plan - `just ci` (all stages passed except the final duplicate native check, which ran out of disk after its earlier clippy pass) - `cd desktop && pnpm exec playwright test tests/e2e/channel-activity-popover.spec.ts --project=smoke` --------- Signed-off-by: kenny lopez <klopez4212@gmail.com>	2026-08-03 09:26:06 -07:00
3 people	f865c0054b	feat(desktop): show saved Run on settings when editing an agent (#4539) ... ## What When editing an agent, show where it runs. The edit dialog previously showed nothing about the backend; the "Where to run" section only existed in the create flow. This adds a read-only **Run on** section to `AgentInstanceEditDialog`: - **Local agents:** "This computer". - **Provider agents (e.g. Kubernetes):** the provider id plus its saved config rows — context, namespace, image, resources, etc. — with labels humanized from the stored keys and rows in provider-schema order (locators first, request/limit pairs adjacent, alphabetical spillover for unknown providers). - Copy states these are the settings **saved at creation** and that the run location can't be changed afterwards (a new agent is required). ## Design decisions (from thread review with @Wren + @Sami) - **No provider probe on edit.** `info` is executable work, and its schema reflects the plugin *today* (including a freshly generated random namespace default) — not what this agent was deployed with. The stored record is the only honest source. - **Saved settings, not effective settings.** Optional fields a record omits (e.g. `service_account`) are defaulted by the provider at deploy time; we render only what was persisted and never synthesize today's defaults. - **Safe rendering of opaque provider config.** Values render as safe scalars only; arrays/objects degrade to a summary row (React throws on object children — a hand-edited record must not crash the dialog). Falsy-but-present values (`0`, `false`) render honestly. Secret-shaped keys are redacted using the same word-split heuristic as the create-time `validate_provider_config` gate — one definition of "looks like a secret". The gate already blocks such keys on every app write path; display-side redaction is screenshot hygiene and covers hand-edited records. - **`backendAgentId` intentionally excluded:** deploy-time runtime state written on start, not saved creation intent. - **Read-only, no form state.** The backend is immutable post-create (`UpdateManagedAgentRequest` has no backend field), so the section renders straight from `agent.backend` with no reset effect. - `ADVANCED_FIELDS_MOTION_TRANSITION` was duplicated in both agent dialogs; hoisted to `agentConfigOptions` (also keeps the edit dialog inside the file-size ratchet). ## Testing - Unit contract for `summarizeRunOn` (9 tests): scalar honesty incl. `0`/`false`, structured-value fallback, secret redaction fail-safe, preferred ordering with spillover, key humanization. - Playwright spec (4 tests, registered in the smoke project): kubernetes agent with the exact eight-key record a real create flow persisted, local agent, blox agent (`workstation_name`), and redacted secret-shaped keys from a hypothetical future provider. - `pnpm typecheck`, `pnpm check`, full `pnpm test` (3937 pass) green at this head. - Live screenshots posted in the originating Buzz thread. --------- Signed-off-by: Tyler <109685178+tlongwell-block@users.noreply.github.com> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>	2026-08-03 12:08:29 -04:00
3 people	5e0efb0bb9	fix(desktop): disambiguate provider API key labels and annotate mint key (#4406) ... Two different credentials were presented under the same name throughout the app. The top-level credential field for non-Anthropic providers (OpenAI, OpenAI-compatible, OpenRouter) was labeled "OpenAI API Key" via a hardcoded binary ternary repeated in three dialogs. The card-minting key (`OPENAI_API_KEY`) and the runtime credential (`OPENAI_COMPAT_API_KEY`) have independent endpoint namespaces and consumers (`OPENAI_COMPAT_BASE_URL`/`OPENAI_COMPAT_API_KEY` for runtime, `OPENAI_BASE_URL`/`OPENAI_API_KEY` for minting) and must remain separate — either may require a different credential. This PR makes them impossible to confuse in the UI. ## Changes **Provider-accurate labels from the credential table.** `PROVIDER_CREDENTIAL_CONFIG` entries now carry an `apiKeyLabel` paired with `secretEnvVar` as a discriminated union (both present or neither — a future provider cannot ship a secret field with no label). `getProviderApiKeyLabel(providerId)` is the single source of truth. The three hardcoded ternaries in `AgentConfigFields`, `AgentInstanceEditDialog`, and `AgentDefinitionDialog` are replaced by this helper. Labels: `openai` → "OpenAI Runtime API Key", `openai-compat` → "OpenAI-compatible Runtime API Key", `openrouter` → "OpenRouter API Key" (was incorrectly "OpenAI API Key"), `anthropic` → "Anthropic API Key" (unchanged). **Field names its backing env var.** `PersonaProviderApiKeyField` renders the env var name as a monospace hint beneath the label with `aria-describedby` wiring. All three call sites pass their `secretEnvVar`. A user who sees `OPENAI_API_KEY` in the mint dialog can now confirm at a glance that the credential field shows `OPENAI_COMPAT_API_KEY` — a different key. **Signpost visible at the decision point.** `CARD_MINT_KEY_ANNOTATIONS` is exported from `agentConfigOptions.tsx` (single source) and passed as `keyAnnotations` to all three generic env editors: both `EnvVarsEditor` branches in Agent Defaults, `EditAgentAdvancedFields`, and `PersonaAdvancedFields`. `CardMintKeyCue` — a new small component — renders an always-visible muted cue beneath the Advanced toggle when `OPENAI_API_KEY` is present in global env (Advanced is collapsed by default, so the per-row annotation is invisible until the cue guides the user to open it). **Model discovery error copy.** The `OPENAI_COMPAT_API_KEY required` message now reads "Enter an OpenAI runtime API key (OPENAI_COMPAT_API_KEY) to load OpenAI models." — naming the env var explicitly so it cannot be confused with the mint key. ## Tests - `getProviderApiKeyLabel` helper: pinned correct label per provider including the new distinct labels for `openai` and `openai-compat` - `PersonaProviderApiKeyField` render: semantic label present; env-var hint rendered when `envVarName` provided; `aria-describedby` wired to hint id; hint and describedby absent when prop omitted - `EnvVarsEditor` render: annotation appears exactly once on the matching row; absent for non-matching rows - `personaModelDiscoveryStatus`: pinned new copy naming `OPENAI_COMPAT_API_KEY` explicitly - Playwright: stale `"OpenAI API Key"` selectors updated; new `card-mint-key-cue-visible-and-annotation-in-advanced` test covers Will's exact path (databricks_v2 global provider + saved `OPENAI_API_KEY` → cue visible before opening Advanced → annotation present after opening) ## File sizes (post-format) | File | Lines | |------|-------| | `AgentConfigFields.tsx` | 994 (≤ 996) | | `AgentInstanceEditDialog.tsx` | 1228 (≤ 1228) | | `AgentDefinitionDialog.tsx` | 1045 (≤ 1047) | Related: [#4140](https://github.com/block/buzz/pull/4140) --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1ng3jzsaqxdhrfq22dg85j3lpr0zsh3jp7g2h9jyxl59wraayapnsu6kvfg <9a232143a0336e34814a6a0f4947e11bc50bc641f21572c886fd0ae1f7a4e867@buzz.block.builderlab.xyz>	2026-08-03 11:12:34 -04:00
3 people	f810a2f49e	fix(desktop): make OpenAI key re-enterable after first save in card mint dialog (#4140) ... Fixes a write-once dead-end in the card mint dialog where a user with an expired OpenAI key had no way to replace it. **Source-aware key status (Rust + TypeScript).** `card_mint_key_status` returns a layer discriminant (`"none" | "global" | "persona" | "agent" | "process"`) instead of a boolean. A pure `resolve_key_layer()` helper in `card.rs` owns the classification logic; `card_mint_key_status` delegates to it, so the production path is under direct test with no duplicate logic. **Mint form always reachable.** The key panel replaces the mint form only for `none` (first-time setup) or when the user explicitly opens the edit panel (`editingKey`). Keys from agent/persona/process layers show an inline provenance row on the mint form with a "Why?" affordance; clicking it shows the read-only redirect in a panel with a Cancel button that returns to the mint form — never a terminal state. **Precise auth-error matching.** The 401 handling in `cardMintStore.ts` matches `startsWith("Card mint failed (HTTP 401 ")` plus the specific `Incorrect API key` text, so avatar-fetch 401 errors pass through unchanged. **Tri-state key status row.** "Using your saved OpenAI key · Update" renders only when `keyLayer === "global"` (confirmed writable key). Query pending or errored hides the row without asserting key existence. **Real tests.** Panel visibility derivations live in `cardMintKeyUtils.ts`, which `AgentCardMintDialog.tsx` imports directly. Tests cover all layers including the mint-reachability invariant (Mint reachable for every resolved layer; only `none` gates setup). - `card.rs` — new `resolve_key_layer()` pure helper; `card_mint_key_status` delegates to it; 999 lines (under the 1000-line ratchet) - `card/tests.rs` — precedence test calls `resolve_key_layer()` directly (no test-local closure); adds process-layer and blank-value cases - `tauriPersonas.ts` — `CardMintKeyLayer` type; updated `cardMintKeyStatus` signature - `cardMintKeyUtils.ts` — `showKeyPanel`, `showReadOnlyRow`, `showCancelButton`, `keyPanelTitle`, and helpers; component imports all of them - `AgentCardMintDialog.tsx` — inline provenance rows for all key sources; key panel only for setup/edit; no unused variables - `cardMintStore.ts` — precise 401 prefix matching - `e2eBridge.ts` — `card_mint_key_status` stub returns `"global"` (not boolean) - Tests: 3959 JS passing, 2089 Rust passing, `tsc --noEmit` clean Related: [block/buzz#4406](https://github.com/block/buzz/pull/4406) --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1ng3jzsaqxdhrfq22dg85j3lpr0zsh3jp7g2h9jyxl59wraayapnsu6kvfg <9a232143a0336e34814a6a0f4947e11bc50bc641f21572c886fd0ae1f7a4e867@buzz.block.builderlab.xyz>	2026-08-03 11:12:09 -04:00
3 people	be95a8a986	fix(config-bridge): add harness-definition env tier and fix equal-value model override (#3580) ... All seven normalized config fields resolve through sanitized `InheritedConfigTiers` passed wholesale to `read_config_surface`. The reader's precedence tiers now match spawn's Layer 2b exactly — including harness-definition env — and the equal-value model-override regression is fixed. ## Changes **`config_bridge/types.rs`** — add `InheritedConfigTiers`: persona env, global env, harness definition env, structured model/provider/prompt for both tiers. Add `HarnessDefault` `ConfigOrigin` variant for harness-definition env values. **`commands/agent_config.rs`** — `build_inherited_tiers` now resolves the harness definition env using the same lookup path as spawn (`record.runtime` → `persona.runtime` → empty string) and applies `sanitize_inherited_env` to it. `resolve_config_surface` is unchanged in shape — tiers passed to the reader now include `definition_env`. **`config_bridge/reader.rs`** — `env_candidates` extended to 4-element return (record, persona, global, definition). All five field builders that use env candidates now include the definition-env slot below global env and above the structured block, matching spawn Layer 2b. Magic `configured[..6]` slice replaced with `configured[..configured.len()-1]` (named split: all non-file candidates). Equal-value model-override arm falls through to the normal resolve path instead of early-returning `RuntimeOverride`, so the panel shows the baseline origin (e.g. `BuzzExplicit`) rather than a spurious "Live override" label for a no-op switch. **`config_bridge/reader_tests_ext.rs`** — three new Layer 2b tests: definition env beats structured persona model, global env beats definition env, reserved-key-absent fallthrough. **`commands/agent_config_tests.rs`** — `genuine_explicit_live_switch_to_same_model_yields_clean_field` updated to assert `origin == BuzzExplicit` (not `RuntimeOverride`); wrapped in `with_no_goose_config` for hermeticity. New `reserved_key_in_definition_env_shaped_map_is_stripped_by_sanitize` test pins the shared sanitization contract. **`AgentConfigPanel.tsx` / `types.ts`** — `HarnessDefault` origin variant wired end-to-end: TS union type and provenance sentence ("Inherited from harness definition"). --------- Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>	2026-08-03 11:04:49 -04:00
3 people	2c0ac24674	fix(desktop): stop the create-agent provider config probe from erasing keystrokes (#4411) ... ## What Fixes the create-agent dialog's "Run on" provider config fields eating keystrokes — reported by Tyler in buzz-remote-agents (channel `29414326`, thread `db76677a`): the Kubernetes **Kubeconfig context** field would not accept typing. ## Why it happened (the Typewriter Eraser, shipped in #4289) `WhereToRunSection`'s probe `useEffect` depended on the whole `draft`: 1. every keystroke changed the draft → effect re-fired → provider binary re-probed; 2. each probe result is a fresh object written into the draft → the effect re-triggered **itself**, respawning the provider binary in a loop for as long as the dialog sat on a provider; 3. every probe resolution reset `providerConfig` to schema defaults — erasing whatever was typed. A field with no schema default (`context`) snapped back to empty, i.e. "won't let me type". Unrelated to how many kubeconfig contexts you have. ## Fix - **Probe once per provider selection**, keyed on the provider's stable `binaryPath` — not the draft, not the provider object (a `useBackendProvidersQuery` refresh must not reprobe an unchanged selection). - **Latest-state resolution** via `React.useEffectEvent` + a new pure `applyProbeResult` helper: schema defaults merge **beneath** the current `providerConfig`, so a probe landing after the user typed can never clobber in-flight input (per Wren's pre-patch red-team: changing deps alone leaves a stale closure). Existing `cancelled` cleanup keeps provider-switch/unmount safe; selection reset (`emptyWhereToRunDraft`) and the fail-closed probe-error path are unchanged. ## Tests - **Unit** (`whereToRunIntent.test.mjs`): `applyProbeResult` merge semantics — defaults under typed values, user-cleared fields stay cleared, schema-less results, unrelated fields preserved. - **E2E** (new `where-to-run-config.spec.ts`, added to the smoke project, **red-first verified**: all 3 fail against the unfixed component): - typing into a defaultless provider field sticks, and `probe_backend_provider` fires exactly once per selection; - the config form is gated on probe resolution (slow probe: no half-rendered form, defaults prefill once); - provider → local → provider re-probes and resets cleanly. - Mock bridge gains `backendProviders` / `backendProviderProbeResult` / `backendProviderProbeDelayMs` seams (defaults preserve prior behavior). ## Verification at 8eb7680 - `pnpm check` + `tsc` clean, `pnpm test` 3926/3926; - new spec 3/3 green (and 3/3 red on the unfixed component); - pre-push lefthook: desktop-test, desktop-check, desktop-tauri-checks, rust-tests, mobile-test all green. --------- Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>	2026-08-03 07:36:13 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	db225c63dd	fix(desktop): repair clippy and doc-comment issues from pass-3 corrections ... - backfill.rs: remove blank line between two consecutive doc comment blocks - detach.rs: merge orphaned step-list doc comment into function doc comment - migration.rs: remove blank line after doc comment before private fn - migration_tests.rs, migration_command_tests.rs, migration_avatar_tests.rs, migration_databricks_tests.rs: add .unwrap() to calls that now return Result after C5 migration fallibility changes Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 04:30:47 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	b0cc726d3f	fix(desktop): pass-3 corrections C1–C7 (workspace-scoped agent store) ... C1 — Production agents-root contract: - scope_init.rs already had the correct base_dir contract (no extra 'agents' join); added production-shaped adoption test that mirrors the exact managed_agents_base_dir semantics to prevent regression. C2/C3 — Deadlock removal + store lock: - workspace.rs: drop rt_transition + store lock BEFORE compensate_drain on all three commit-guard failure paths; hold store lock from drain through commit so concurrent store writes cannot interleave. - identity.rs: drain returns Err((stopped, msg)); compensate uses the real stopped slice, not []; locks dropped before compensate_drain. C4 — Captured-scope completion: - confirm_team_snapshot_import and confirm_agent_snapshot_import: both now capture scope at entry, use _at() APIs throughout, validate generation before first write, resolve RetentionScope from captured. - Mesh recovery (recovery.rs): capture full WorkspaceAgentScope at entry; validate generation before each write to definitions_dir. - Restore missing-record stale-child: when find_managed_agent_mut fails for a spawned child (record deleted between Phase B and C), terminate the child and remove its receipt instead of leaking the process. C5 — Pre-Ready family in scope initializer: - ensure_scope_ready gains owner_pubkey parameter. - New run_pre_ready_family: runs legacy retention migration and persona snapshot backfill before writing _ready so a crash leaves the scope in a retryable state, not permanently marked Ready with incomplete data. - workspace.rs guards remain for pre-existing Ready scopes (idempotent). C6 — Delete dead boot-migration wrappers: - Deleted backfill_standalone_agents, detach_directory_backed_teams, and strip_baked_team_instructions (the #[allow(dead_code)]-suppressed app-level wrappers); their _in_dir equivalents are the authoritative scoped pipeline entry points. - Removed tests for the deleted functions from migration_command_tests.rs. C7 — Structured degradation reporting: - spawn_event_sync return type changed from Result<(), String> to (): the dispatch cannot fail; the false Result contract is removed. - workspace.rs restore spawn now emits workspace-degraded Tauri event when restore_managed_agents_on_launch returns Err, making restore failures observable to the UI instead of silently logged. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 04:16:42 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	d8ee40814e	fix(desktop): suppress dead_code clippy warnings on boot-migration shims ... After C5 stripped the per-scope definition migrations from the global boot path, the app-level wrapper functions (fold, materialize, backfill, detach, team_suffix, refresh_builtin_agent_avatars, reconcile_*) became unused. Their scoped _at()/_in_dir() variants are what the pipeline calls. Add #[allow(dead_code)] with a rationale comment to each wrapper rather than deleting them — the wrappers document the prior call shape and serve as reference for future integration. Also drop the spurious let _ = binding on remove_agent_runtime_receipt (returns (), not Result) flagged by clippy::let-unit-value. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 03:02:23 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	3ea3d70cfe	fix(desktop): use null-coalescing fallback in AppShell composite reconcile key ... Without the '?? "none"' fallback, a null activeCommunity?.id produces the string "undefined-N" rather than "none-N". Both are valid change signals, but the explicit fallback matches the existing pattern at line 233 of the same file and satisfies Thufir's pass-2 finding C7. The line expands to 3 lines after biome formatting (88 chars), landing AppShell.tsx at exactly 1000 gate-counted lines — still within the 1000-line ratchet (gate condition is > 1000). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:53:54 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	d4391c9097	fix(desktop): restore commit_active_scope as test-only helper ... C4 removed commit_active_scope from identity_storage.rs (no longer called in production after the inline commit). app_state_scope_tests.rs uses it as a test helper to set up a live scope without running the full apply_workspace pipeline. Re-add it under #[cfg(test)] so tests continue to compile. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:51:06 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	372b0fabd9	fix(desktop): pass-2 correction C7 — degraded results observable + AppShell composite key ... spawn_event_sync returns Result<(), String> so dispatch failure can be captured by the workspace-apply post-commit section rather than being silently ignored. The value is always Ok(()) since tauri::async_runtime::spawn is infallible; this establishes the typed interface for future signaling. try_regenerate_nest returns Result<(), String> instead of swallowing errors. All fire-and-forget callers updated to .ok() to explicitly discard the Result. apply_workspace post-commit: - try_regenerate_nest moved out of the spawn_blocking closure into the async post-commit section so its Result can populate the degraded vec. - spawn_event_sync Result captured; dispatch failure pushed to degraded. - Nest failure reported as 'nest context regeneration failed: ...' degradation. useCommunityInit.ts: post-commit degraded items now emit a toast.warning (8 s) via sonner so the user sees partial failures. Previously only console.warn. AppShell.tsx: useManagedAgentRuntimeReconciliation key changed from String(reinitKey) to `${activeCommunity?.id}-${reinitKey}`. A same-relay identity swap (new communityId, unchanged reinitKey) now correctly re-triggers runtime reconciliation. Destructured activeCommunity and reinitKey from communitiesHook and updated two other call sites for consistency. dead pub use exports in migration.rs removed (fold, backfill, detach, strip, materialize — all now accessed only through scoped _in_dir/_at variants). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:45:35 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	18c4be359d	fix(desktop): pass-2 correction C6 — derive RetentionScope and Mesh recovery from captured WorkspaceAgentScope ... active_retention_scope now derives relay and owner from capture_active_scope() rather than reading relay_ws_url_with_override + signing_keys() independently. Returns Err when no active scope exists (fail closed) or when signing keys pubkey disagrees with scope owner (defensive guard). rearm_relay_mesh_for_running_agents captures both relay and definitions_dir from the active scope at function entry. All store reads (load_managed_agents, load_personas, load_global_agent_config) and error-persist writes now use _at(definitions_dir) so they target the captured scope's store throughout the recovery pass, not whichever scope happens to be active when each helper runs. persist_mesh_last_error and clear_mesh_last_error_if_set refactored to _at() variants that take an explicit definitions_dir rather than resolving through the live active scope. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:40:30 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	78b4e84415	fix(desktop): pass-2 corrections C1-C5 (generation checks, fail-closed migrations, atomic drain, import drain protocol, boot migration strip) ... C1: Remove #[allow(dead_code)] from WorkspaceAgentScope owner_pubkey and generation fields; add validate_scope_generation() production helper; restore Phase B uses captured scope relay (not live relay_ws_url_with_override); Phase C validates generation before acquiring store lock and terminates stale-spawn children. C2: run_scoped_migrations returns Result<(), String> propagating first failure; ensure_scope_ready withholds _ready on Err; added Step 10 JSON validation gate; fixed crash-resume test fixture to use valid JSON; added migration-failure test that verifies no _ready on corrupt input, then repair+retry writes _ready. C3: (Already committed as 3325363bc.) Transition lock held continuously from drain through commit. C4: drain_managed_agent_runtimes_for_import returns Result<Vec<DrainJournalEntry>>; import_identity acquires managed_agent_runtime_transition lock for live-active path; drain failure compensates and returns Err before identity persist; persist failure compensates stopped entries and returns Err; removed commit_active_scope from identity_storage.rs. C5: run_boot_migrations_inner stripped of all definition-touching steps (now in scoped pipeline); backfill_persona_snapshots_at added and called in prepare stage; legacy retention migration moved to prepare stage; try_regenerate_nest removed from lib.rs boot (now post-commit in workspace.rs); managed_agent_restore_pending field and write removed from AppState and lib.rs. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:40:16 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	3325363bc7	fix(desktop): hold transition lock continuously from drain through commit (C3) ... Lock architecture fix: `managed_agent_runtime_transition` is now held from journal creation through the end of the commit swap so no concurrent start/reconcile can insert a runtime in the gap between drain and scope publication. All fallible commit guards (relay_url_override, keys, active_agent_scope) are acquired BEFORE any field is mutated. A lock-poison failure after drain runs compensation and returns `applied: false` — never a half-committed state. The prior code dropped the transition guard at the end of the drain block (inner scope) while the adjacent comment claimed "the commit below also holds it" — the comment was false. Removes that false claim. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 02:21:57 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	27370bc46f	fix(desktop): resolve clippy dead_code and lint warnings from push gate ... Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 01:47:18 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	370de88dac	chore(desktop): trim file-size ratchet violations to pass desktop-check ... Nine files were over the gate limit after the workspace-scoped store implementation. Trims/extractions to get all under limit: - app_state_tests.rs: move scope lifecycle tests to app_state_scope_tests.rs - app_state.rs: move pending_owned_channels methods to identity_storage.rs - AppShell.tsx: inline reconciliation key as String(reinitKey) (1 line vs 3) - tauri.ts: type alias ApplyWorkspaceResult + biome-ignore format to keep the applyCommunity body under the limit - runtime.rs: restructure scope capture to save a net line - storage.rs: trim doc comments on _at variants to single-liners - mesh_llm.rs: make scope_impl pub(crate) mod; fold scope relay capture inside check_mesh_runtime_relay_scope; remove verbose comments - migration.rs: extract scoped migration helpers to migration_scope.rs via include!(); trim SHARED_AGENT_FILES/DIRS block comments - migration_tests.rs: trim explanatory comments to save net 33 lines Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 01:40:11 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	e1234a26a3	test(desktop): Phase 4 scope lifecycle, crash-boundary, and Mesh relay tests ... Add 13 missing Phase 4 unit tests covering the full v4 test matrix: Scope model (scope.rs): - test_generation_staleness_detected_after_scope_change — stale-commit detection: captured generation G diverges from current after a switch - test_scope_switch_a_to_b_to_a_advances_generation — A→B→A round-trip produces strictly increasing generations; relay fields correct at each step - test_rapid_scope_switch_a_b_c_all_stale_after_c — rapid A→B→C: both A and B stale relative to C; counter order A < B < C - test_switch_during_restore_detected_by_generation_check — mid-flight switch detected by generation check without spawning threads Identity/scope lifecycle (app_state_tests.rs): - test_import_before_first_apply_leaves_scope_none — import when scope=None does not derive/claim any scope; only bumps generation - test_live_import_with_active_scope_clears_scope_and_bumps_generation — live import clears scope and advances generation; commands fail closed - test_fallback_relay_never_claims_during_identity_import — identity import operations (clear + bump) never touch the filesystem claim ledger - test_prepare_failure_leaves_old_scope_intact — old scope unchanged when commit_active_scope is never called (prepare error path) - test_inactive_runtime_exit_after_scope_cleared_is_safe — scope=None after clear is safe for runtime-exit observers Crash boundaries (scope_init.rs): - test_crash_after_claim_before_staging_resumes_correctly — fallback claim exists, no staging: full staged install runs, legacy adopted - test_crash_during_staging_copy_is_cleaned_on_retry — stale staging with partial content is cleaned; final file comes from legacy source - test_crash_after_staging_manifest_before_rename_resumes_correctly — staging with manifest but no rename: cleaned and re-run - test_crash_after_rename_before_ready_resumes_migrations — target exists with manifest but no _ready: skip re-staging, resume migrations, preserve post-crash writes Also fixes ensure_scope_ready to implement the plan's "installed-but-not-Ready resumes migrations" contract: when the target directory already has a manifest (rename completed), skip install_staged and go straight to migrations + ready marker, preserving any post-crash inbound/interactive writes. Mesh relay-scope (mesh_llm_tests.rs): - test_serve_pinned_relay_mismatch_fails_closed — relay mismatch detection + fail-closed error prefix verified against the exact code path - test_client_relay_mismatch_is_not_fail_closed — client mismatch falls through (treat as absent), not the serve fail-closed error - test_watchdog_scope_relay_check_uses_normalized_comparison — relay normalization consistency including trailing-slash and whitespace edge cases All 2138 tests pass (was 2125). Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 00:43:31 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	8a35f5ed2b	test(desktop): Phase 4 drain journal unit tests and execute_drain_journal extraction ... Extract execute_drain_journal() as a pure inner function that takes the runtime HashMap directly — no AppHandle needed — enabling deterministic unit testing of the drain/compensate logic without a Tauri mock app. Move the test block from runtime_commands.rs to the sibling runtime_commands_tests.rs (following the storage_tests.rs pattern) to keep the main file under the 1000-line size gate. New tests: - test_drain_empty_map_returns_success - test_drain_exited_process_counts_as_stopped_and_clears_map - test_drain_scope_id_propagates_from_runtime_starting - test_drain_missing_key_treated_as_already_stopped - test_drain_cleanup_fn_called_for_each_stopped_entry - test_workspace_apply_result_drain_failed_returns_applied_false - test_workspace_apply_result_degradation_accumulates All 2125 existing tests continue to pass. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 00:25:53 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	6eec536799	fix(desktop): update runtime test helper to pass scope_id to starting() ... ManagedAgentPairRuntime::starting() now takes a scope_id argument. Update the test helper that constructs a fake PairRuntime to pass None. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 00:09:31 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	91859ea806	feat(desktop): plumb WorkspaceApplyResult through frontend boundary (Phase 3e) ... Surfaces the degraded-apply result from the backend all the way to the UI: tauri.ts: - Add WorkspaceApplyResult interface { applied: boolean; degraded: string[] } - applyCommunity() now returns Promise<WorkspaceApplyResult> instead of Promise<void>; passes typed result through from apply_workspace command. useCommunityInit.ts: - Consumes applyResult from applyCommunity instead of discarding void. - applied: false (drain-failed) → park on the loading gate so the user can retry via a workspace switch; the specific degradation messages are shown as the error. - applied: true with degraded entries → console.warn (informational; workspace IS active; post-commit step failed gracefully). - Existing catch block still handles genuine Tauri errors (poisoned lock, invalid nsec, etc.) unchanged. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 00:05:11 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	00a3381902	feat(desktop): implement Phase 3 runtime ownership + Mesh scope rules ... Phase 3 of workspace-scoped agent store: 3a: reconcile_managed_agent_runtimes loses its `communities` parameter. The backend derives the sole target relay from the captured active scope; cross-scope fan-out is no longer representable at the API level. - runtime_commands.rs: capture active scope relay; remove communities Vec - runtime_types.rs: remove ManagedAgentCommunityTarget struct - tauriManagedAgents.ts: reconcileManagedAgentRuntimes() takes no args - managedAgentRuntimeHooks.ts: bootstrapManagedAgentRuntimePairs calls parameterless reconcile; drop communities list construction - useManagedAgentRuntimeReconciliation.ts: rewritten to track a single activeCommunityKey instead of per-relay state; simplified retry logic - AppShell.tsx: pass `${activeCommunity?.id}-${reinitKey}` as the key 3b: Mesh relay-match reuse rule + fail-closed serve preflight + watchdog. - mesh_llm.rs: ensure_relay_mesh_for_record captures scope relay at entry; a live runtime is only reused when its relay matches the scope relay; serve-mode mismatch fails closed with a precise 'Share Compute is currently pinned to <relay>' error; client-mode mismatch falls through to re-arm; drain_mesh_client_if_stale drains a client whose relay differs from the incoming workspace relay (Layer-1 async, non-fatal). - recovery.rs: rearm_relay_mesh_for_running_agents captures one scope per pass; Live early-return only taken on relay match; serve-mode Live mismatch skips the pass (machine-level pinning). - personas.rs: add scoped load_personas_at / save_personas_at variants. 3c: Drain journal + compensation + apply_workspace rewrite. - runtime_commands.rs: DrainJournalEntry struct, drain_scope_runtimes (snapshot journal + stop all live runtimes, returns stopped/remaining/ first_error), compensate_drain (restart exactly the stopped entries). - workspace.rs: apply_workspace return type changed from () to WorkspaceApplyResult. Layer-1 async drains the Mesh client before spawn_blocking. Drain stage acquires managed_agent_runtime_transition, calls drain_scope_runtimes; on failure calls compensate_drain and returns applied:false. Per-transition restore replaces the launch-only managed_agent_restore_pending one-shot. Post-commit failures (event sync, restore) surface as degraded entries on WorkspaceApplyResult. 3d: Scope-tagged runtime map entries. - runtime_types.rs: ManagedAgentPairRuntime gains scope_id: Option<String> - starting() constructor takes scope_id; captured from active scope at spawn time in runtime_commands.rs, restore.rs, and runtime.rs. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-03 00:05:02 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	b795ed6c79	feat(desktop): implement ordered per-scope migration pipeline and scoped dev-sync ... Completes Phase 2 of the workspace-scoped agent store: - scope_init.rs: replace the run_scoped_migrations no-op with the full ordered migration pipeline (fold, strip, refresh-avatars, backfill, detach, reconcile-names, reconcile-mcp, databricks-v1-to-v2, materialize) running against the scope directory after staged install. Ordering mirrors migration.rs::run_boot_migrations_inner's load-bearing order. - migration submodules: expose fold_personas_in_dir, strip_baked_team_ instructions_in_dir, backfill_standalone_agents_in_dir, detach_directory_ backed_teams_in_dir, materialize_runtimes_in_file as pub(crate) - migration.rs: add _at(definitions_dir) wrapper functions for reconcile_ provider_mcp_commands, reconcile_databricks_v1_to_v2, refresh_builtin_ agent_avatars, reconcile_legacy_command_names, materialize_agent_runtimes re-export the dir-level helpers under the crate's migration module - SHARED_AGENT_FILES: emptied; legacy unscoped files no longer symlinked across worktrees (they live under agents/scopes/ now) - SHARED_AGENT_DIRS: add agents/scopes so all scoped stores are shared across dev worktrees without requiring knowledge of the dynamic scope ID - migration_tests.rs: rewrite 8 sync tests to match the new SHARED_AGENT_DIRS layout; add scope-dir-based write-through and seed-up tests All 2118 tests pass. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 23:40:35 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	e6aa269814	feat(desktop): scope initialization state machine with canonical claim ledger ... Implements the Phase 2 scope initialization pipeline: - scope_init.rs: staged directory install with durable manifest (AdoptedLegacy | LegacyClaimedByOther | FreshNoLegacy), atomic rename, separate _ready marker, crash-safe restart semantics - Canonical family claim ledger: reads retention.db's retention_migrations table first (pre-existing claims win); falls back to agents/legacy-claim.json when no retention.db exists - Legacy adoption: copies managed-agents.json, teams.json, global-agent-config.json, and personas.json (when present) into a sibling ._staging directory, then renames atomically - apply_workspace: Prepare stage now calls ensure_scope_ready before the Layer-2 commit epoch; a failed prepare leaves the old scope active and untouched - 6 new unit tests cover FreshNoLegacy, AdoptedLegacy, second-scope LegacyClaimedByOther, idempotent re-init, staging cleanup on retry, and retention.db claim taking precedence over first-activation order All 2118 tests pass. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 23:30:50 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	6cb0a4aac7	feat(desktop): scope-stable restore, shutdown, and runtime list ... Convert restore.rs, shutdown.rs, and list_managed_agent_runtimes to use a single captured workspace scope per logical operation rather than re-resolving the active scope on every load/save call. restore.rs: - backfill_persona_snapshots captures scope at entry; uses load_managed_agents_at / save_managed_agents_at / load_personas_at throughout the single store-lock epoch. - restore_managed_agents_on_launch captures scope at function entry and clones definitions_dir; all three phases (A: collect, B: spawn, C: write-back) use the same captured path, preventing a concurrent workspace switch from writing Phase C results into the wrong scope. - persist_restore_error receives definitions_dir explicitly. - Both functions return Err (with a clear message) when no scope is active, keeping the fail-closed invariant. shutdown.rs: - When no workspace scope is active (boot before apply_workspace, or after import_identity cleared the scope) skip load_managed_agents and drain only from the in-memory runtime map. Prevents the shutdown path from panicking with 'no active workspace scope'. - record_idx: Option<usize> on AgentToStop distinguishes runtimes with a backing record from those drained without one. - save_managed_agents only called when records were actually loaded. runtime_commands.rs: - list_managed_agent_runtimes captures scope at function entry and uses load_personas_at / load_global_agent_config_at / load_managed_agents_at / save_managed_agents_at so all reads in one poll see the same scope, even if a workspace switch races between the pre-lock and in-lock loads. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 23:23:32 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	80a68775d5	feat(desktop): wire fail-closed scope seam + import_identity scope semantics ... Three storage chokepoints (managed_agents_store_path, teams_store_path, global_config_path) now route through capture_active_scope() and fail with a clear error when no workspace scope is active. There is no fallback to the legacy unscoped root — returning a legacy path would recreate split-brain storage. apply_workspace acquires the workspace_transition lock (Layer 1 async serialization) before entering spawn_blocking so scope transitions are serialized against concurrent import_identity calls. import_identity implements both scope modes per v4 plan: - No-active-scope path (recovery/onboarding): persist identity, clear scope, bump generation. No scope is derived or claimed; the next apply_workspace performs adoption. - Live-active path (membership-denied flow): drain managed-agent runtimes (delegates to shutdown_managed_agents), persist identity, clear scope, bump generation. Drain failures are logged but non-fatal; the frontend's re-apply restores agents. Both paths bump the scope generation so in-flight operations see a new generation and abort their commits. The fallback relay can never claim legacy data — claims are only written inside apply_workspace's prepare stage. All 2112 tests pass. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 23:11:07 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	108a31e9c1	feat(desktop): add scoped _at() storage APIs and retarget event-sync chokepoints ... ## Scoped storage APIs Add path-based `_at(definitions_dir)` variants alongside every `app: &AppHandle` storage chokepoint. These are the primary API for long-running operations that have captured a `WorkspaceAgentScope` at their entry point: - `storage.rs`: `load_agent_store_at`, `load_managed_agents_at`, `load_agent_definitions_at`, `save_managed_agents_at`, `save_agent_definitions_at`, `managed_agents_store_path_at`; the internal `write_agent_store` now delegates to `write_agent_store_to_path` which is shared with the new scoped write path. - `teams.rs`: `teams_store_path_at`, `load_teams_at`, `save_teams_at`. - `global_config/mod.rs`: `global_config_path_at`, `load_global_agent_config_at`, `save_global_agent_config_at`; the load path is factored into `load_global_agent_config_from_path`. ## AppState scope helpers - `capture_active_scope()` — snapshot of current `Option<WorkspaceAgentScope>`. Callers crossing `.await` or thread boundaries capture at entry. - `commit_active_scope(scope)` — infallible commit-stage setter (Layer 2). - `clear_active_scope()` — clear + generation bump for identity import drain and prepare-stage rollback. ## Event-sync retarget `run_event_sync`, `spawn_event_sync`, `migrate_personas_to_events`, `migrate_teams_to_events`, and `reconcile_agents_to_events` all gain a `definitions_dir: &Path` / `PathBuf` parameter. They no longer resolve the base dir from `AppHandle` — the caller passes the scoped definitions dir directly, closing the bypass that read from the legacy unscoped root. ## apply_workspace scope commit After applying relay + keys, `apply_workspace` derives a `WorkspaceAgentScope` from the effective (relay, owner) pair and commits it via `commit_active_scope`. The immediately following `spawn_event_sync` call reads the committed scope via `capture_active_scope()`, so event sync for this apply uses the scoped definitions dir. A legacy-root fallback is preserved during the Phase 1→2 transition period for pre-apply boot callers. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 22:53:30 -04:00
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger	7fe049359c	feat(desktop): add workspace-scoped agent definition store scope model ... Introduce the `WorkspaceAgentScope` type and the scaffolding for a four-stage workspace transition state machine (Phase 1 foundation). ## Scope model (managed_agents/scope.rs) - `WorkspaceAgentScope { scope_id, relay_url, owner_pubkey, definitions_dir, generation }` — the single scope authority for a workspace's agent definition store. Immutable; callers capture one scope at operation entry and thread it through `_at(scope)` APIs. - `derive_scope_id(relay_url, owner_pubkey)` — the canonical sha256 derivation, byte-identical to the retention DB derivation. Both subsystems now go through one shared helper so "same scope" can never disagree between definitions and retention. - `next_scope_generation()` / `current_scope_generation()` — global monotonic counter incremented on every scope change or identity-import clear. Long-running operations read at entry and revalidate before commit; a stale commit aborts. - `WorkspaceApplyResult { applied, degraded }` — typed result for the four-stage transition machine (prepare / drain / commit / post-commit). - Scoped layout: `agents/scopes/<scope_id>/{managed-agents.json, teams.json, global-agent-config.json}`. ## AppState additions (app_state.rs) - `identity_mutation: AsyncMutex<()>` (was `Mutex<()>`) — Layer 1 async lock; callers may `.await` while holding it. Converted so the workspace transition machine can hold it across awaits without blocking the executor. - `workspace_transition: AsyncMutex<()>` — serializes workspace transitions (`apply_workspace` and live identity import). Lock order: identity_mutation → workspace_transition → Mesh rearm → mesh_llm_runtime. - `active_agent_scope: Mutex<Option<WorkspaceAgentScope>>` — `None` from boot until the first successful `apply_workspace`. Every agent command fails closed on `None`; there is NO fallback to the legacy unscoped root. ## Retention parity (retention.rs) - `scoped_retention_db_path` now delegates to `derive_scope_id` instead of inlining its own sha256, making the hash provably identical. - `scope_for_arrival` / `arrival_retention_scope` extended to match on both relay AND owner pubkey. An in-flight old-owner event on the same relay can no longer land in the new owner's active store after an identity switch. ## Inbound reconcile (commands/personas/inbound.rs) - Both `arrival_retention_scope` call sites pass the event's pubkey as the owner dimension, closing the identity-switch cross-contamination gap. ## Caller updates - `identity.rs`: three `identity_mutation.lock().map_err()` callers converted to `.blocking_lock()` (Tokio async mutex's sync-context variant, safe from `spawn_blocking` threads). - `identity_key_backup_tests.rs`: test thread mirror updated to match. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>	2026-08-02 22:45:00 -04:00