Skip to content

feat(desktop): read-only shared fleet view for relay-hosted agents - #5412

Draft
bossriceshark wants to merge 1 commit into
block:mainfrom
bossriceshark:feat/shared-fleet-readonly
Draft

feat(desktop): read-only shared fleet view for relay-hosted agents#5412
bossriceshark wants to merge 1 commit into
block:mainfrom
bossriceshark:feat/shared-fleet-readonly

Conversation

@bossriceshark

Copy link
Copy Markdown

What

Adds a read-only Shared fleet section to the desktop Agents page and makes team cards relay-aware, so a Buzz Desktop acting as a controller against a self-hosted relay can see the agents that actually live there.

  • Shared fleet (read-only): lists remote workers from current kind:10100 agent-directory records (name, optional model label, presence, deduplicated assigned channels). Liveness comes from an independent presence read — a stale directory-only record never renders as an active worker. The surface exposes zero lifecycle/membership/global-mention controls; execution stays on the worker host.
  • Shared team catalog (kind:30178): strict reader — exact ["shared","true"] opt-in, exactly one d tag, schema-versioned, replaceable-head semantics (a newer malformed/unshared head hides older shared heads rather than falling back), bounded paging with event-id dedupe. Only safe fields (display name, member count) are projected; prompts/provider config/paths are never exposed.
  • Team cards: membership now resolves against local personas and the relay directory and the owner-scoped 30178 catalog. Relay-hosted members show as "resolved via the relay" instead of the false "no longer in your agents" warning; deploy gating stays conservative (remote-only members still block a local deploy that would fail).
  • Cache isolation: relay-agent, presence, and catalog query keys are scoped by the active canonical relay URL (+ account identity), so switching communities can never briefly serve another tenant's records from the query cache.

Why

Self-hosted multi-device use case: agents run as buzz-acp workers on a home server, and other devices (Windows desktop, mobile) connect to the same relay as controllers. Today the Agents page renders only locally managed agents, so a healthy relay-registered fleet is invisible and teams referencing relay members are flagged as broken. This is the same ecosystem gap discussed around #4128 (remote/managed-agent visibility), but a separate, additive feature: inspection only, no remote lifecycle control.

Testing

  • pnpm check (biome + file-size/px/pubkey guards) — clean
  • pnpm typecheck — clean
  • pnpm test — 4557 pass
  • pnpm build:e2e && playwright test tests/e2e/shared-fleet.spec.ts — 1 pass (bridge seeded with independent fixtures for directory, presence, and 30178 catalog; asserts a live worker renders with channels, a stale directory-only record does not, shared teams render with member counts, and the surface contains no action buttons)

🤖 Generated with Claude Code

https://claude.ai/code/session_01HYzfZG6xwRGefUB9EAsh8q

Add a Shared Fleet section to the Agents page that lists relay-hosted
remote workers from current kind:10100 directory records, gated by an
independent presence read so stale directory-only records never render
as live. The surface is strictly read-only: no lifecycle, membership,
or global-mention controls, and mention guidance stays channel-scoped.

Add a strict kind:30178 shared team catalog reader (exact ['shared',
'true'] opt-in, single d-tag, schema versioning, replaceable-head
semantics where a newer malformed/unshared head hides older shared
heads, bounded paging with event-id dedupe) that projects only safe
fields (name, member count).

Resolve team card membership against local personas, the relay agent
directory, and the owner-scoped shared catalog so relay-hosted members
are reported as resolved-via-relay instead of falsely missing, while
local deploy gating stays conservative.

Scope relay-agent, presence, and catalog query cache keys by the
active canonical relay URL (and account identity) so a community
switch cannot briefly serve another tenant's records.

Signed-off-by: Matt Rice <bossriceshark@users.noreply.github.com>
@bossriceshark
bossriceshark marked this pull request as ready for review August 9, 2026 17:03
@bossriceshark
bossriceshark requested a review from a team as a code owner August 9, 2026 17:03
@bossriceshark
bossriceshark marked this pull request as draft August 9, 2026 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant