upstream(sync): Tier 2 notifications + agent identity (#6427, #6401, #6337, #6182)

[devin-ai-integration]

Summary

Ports the Tier 2 upstream Buzz changes for notifications and agent identity to Crew, keeping Crew's channel-first IA intact.

block#6182 — restore release agent mentions. Relay-agent mention candidates previously hardcoded ownerPubkey: null, so an owner-only agent was never mentionable after release — call-by-name (#230) could not wake it. Owner metadata is now carried end to end: list_relay_agents resolves each agent's owner from cryptographically verified NIP-OA auth tags (verified_agent_owners_from_profiles, kind-0 profiles queried author-scoped in batches of 10 with bounded concurrency of 8), surfaced as RelayAgent.ownerPubkey, and agentAutocompleteEligibility accepts an owner-only agent when the verified owner matches the viewer:

if (agent.respondTo === "owner-only" && normalizedCurrentPubkey && agent.ownerPubkey) {
  return normalizePubkey(agent.ownerPubkey) === normalizedCurrentPubkey;
}

Owner-only builds additionally retain only agents with a verified owner, so an unverifiable claim can never widen access. Also removes relay-directory churn from agents-data-changed (it now invalidates local keys only) and coalesces managed-agent startup backfill to the newest event per (pubkey, d-tag), tie-broken on lower event id.

block#6337 + block#6401 — distinguish/simplify duplicate agent identity. Same-named agents owned by the viewer but managed on another machine now carry an "Other setup" marker (title="From another Buzz setup") in mention autocomplete, the members sidebar and add-member results, and the redundant "managed by …" label is suppressed for those rows. Provenance is managed-here | managed-elsewhere | undefined and fails closed — nothing is labelled until the managed and relay directories are settled, and another owner's agent is never attributed to a device.

block#6427 — notification sender names + click-through routing. Notification titles resolve to a human sender name (display name → NIP-05 → neutral copy, never a pubkey), with background profile warm-up for cold caches. Activation is centralised: targets are built once per source (channel event, thread reply, forum post/comment, DM), activations are serialised FIFO with cancellation and per-activation error isolation, navigation is forced when the destination URL already matches, window reveal is bounded by a timeout, and the macOS activation queue is re-drained on focus/visibilitychange.

Crew divergences from upstream (deliberate)

• Channel-first IA preserved (upstream(sync): Guardrail — preserve channel-first IA during 0.5.18 merge #278). Notification activation routes only through Crew's goChannel / goForumPost / goHome; no path reintroduces or traverses the upstream Projects rail or Workbench navigation.
• Owner resolution is native, not a relay-directory rework. Upstream reaches owner identity via its larger membership-driven relay directory; Crew instead verifies NIP-OA owners in src-tauri (commands/agent_discovery/agent_discovery_ownership.rs). Frontend-only verification cannot be trusted for an access decision, which is why this port touches Rust at all.
• Crew's members sidebar kept. Activity peek (feat(desktop): redesign live agent activity peek #269), moderation, runtime status, pair actions and lifecycle controls are unchanged; only the marker was added. AddMemberSearchResultRow was extracted from MembersSidebar.tsx (Crew's own row implementation, not upstream's) to satisfy the desktop file-size ratchet.
• RelayAgent marker copy uses Crew's existing Badge/cn primitives rather than upstream's styling helpers.

Related issue

Fixes #288

Part of the Buzz 0.5.18 sync stack (meta #285). Upstream commits ported: ee992ff08 (block#6182), 2e7583bf5 (block#6337), aea0ef8df (block#6401), 4e3c9e619 (block#6427).

Testing

TDD throughout — RED logs captured before each implementation, GREEN after. Gates on the final tree:

Gate	Result
pnpm --filter buzz check	pass
pnpm --filter buzz typecheck	pass
pnpm --filter buzz test	5562 passed, 1 skipped
just _ensure-sidecar-stubs + just check-compile	pass
desktop file-size ratchet	pass
pnpm --filter buzz build:e2e	pass
E2E mentions.spec.ts	61 passed
E2E dm-double-notification.spec.ts (isolated relay)	1 passed — notification titled alice (sender), not the DM channel name
just test-unit	2 failures, reproduced identically on base 2c26b74bf (buzz-cli command inventory, buzz-db embedded migration count)

Duplicate-agent identity, before → after:

Owner-only agent mentionable again for its verified owner (block#6182):

Notification click-through, before (notification pending) → after (target thread/post open):

Not verifiable here: packaged macOS LaunchServices activation, native notification delivery and real macOS window focus cannot be exercised on Linux/xvfb — the queue, re-drain and routing logic are covered by unit tests and the mock bridge only. Per #288 this needs a manual pass on macOS.

---

NOTES (handover)

DONE

• All four ports implemented and committed on devin/issue-288-notif-agent-identity:
  • 67e9b792a fix(desktop): restore release agent mentions block/buzz#6182 restore release agent mentions (native NIP-OA owner verification, owner metadata plumbing, refresh-churn removal, backfill coalescing)
  • 28849c9d8 fix(desktop): distinguish duplicate agent devices block/buzz#6337 + fix(desktop): simplify duplicate agent provenance block/buzz#6401 duplicate-agent provenance + "Other setup" marker (mentions, members sidebar, add-member rows)
  • 8165277d3 fix(desktop): sender names in notifications + macOS click-through routing block/buzz#6427 notification sender names, target construction, FIFO activation queue with cancellation, forced navigation, bounded reveal, macOS re-drain
  • e8f3b2922, 3ed0fc978 remove host-specific screenshot paths from the E2E spec
• Tests added: otherSetupAgent.test.mjs, mentionSuggestionMapping.test.mjs, MentionAutocomplete.test.mjs, flushMentionDebounce case, AppShell.helpers.test.mjs, searchHitNavigation.test.mjs, desktopActivations.test.mjs, notificationFormat.test.mjs, target.test.mjs, Rust verified_agent_owners_from_profiles cases (valid / missing / forged auth tag / non-kind-0), plus E2E scenarios in mentions.spec.ts and channels.spec.ts and the DM notification title assertion.
• Gates: see the table above — all green except just test-unit's two reds, proven pre-existing on base.
• Evidence (full-window 1280x720 PNGs and untruncated logs) under /home/ubuntu/evidence-288/ — RED: red-frontend-tests.log, red-rust-tests.log, 6427/red-notification-routing.log; GREEN/gates: final-*.log, green-*.log, 6427/final2-*.log, 6427/final3-*.log, 6427/dm-relay-backed.log; base comparisons: base-just-test-unit.log, 6427/just-test-unit-failure-comparison.txt, 6427/profile-base.log, 6427/profile-branch-after-revert.log; screenshots in /home/ubuntu/evidence-288/screens/.

IN PROGRESS

• Base-vs-branch attribution of three remaining E2E reds is unresolved — the base run in a throwaway worktree never launched Playwright (error: unknown command 'test' from the resolved binary in that worktree) and was not retried under the stop order. So these three are named but not classified:
  • tests/e2e/channels.spec.ts (86 passed, 1 failed) — channel settings only prompt editors to add an empty description: expected "Add a description", got "General discussion for everyone". This spec was extended by 28849c9d8, so confirm this one first even though the assertion looks unrelated to the marker scenarios.
  • tests/e2e/profile.spec.ts (26 passed, 3 failed) — declared owner sees runtime tab for a remote relay agent and declared owner sees runtime tab without a relay-agent record. The third failure in that file (Inbox badge sidebar-home-count) is already proven pre-existing on base.
  • Branch-side logs: /home/ubuntu/evidence-288/6427/final3-playwright-channels.log, /home/ubuntu/evidence-288/6427/final3-playwright-profile.log; failed base attempt: /home/ubuntu/evidence-288/6427/base-attribution-*.log.
  • No code is half-written; the tree is clean and every gate above was run on the final tree.

TODO / NEXT

1. Finish the attribution above: get Playwright to actually run in a base 2c26b74bf worktree (the throwaway worktree's pnpm exec playwright test resolved to a binary that rejects test, so install/resolve Playwright there properly rather than reusing the branch install) and compare the three failures per test. If channels.spec.ts passes on base, the seeded-description expectation collides with the members-sidebar scenarios this PR added and is ours to fix.
2. tests/e2e/agents.spec.ts is 27 passed / 8 failed on this branch and the same eight named failures occur on base — no Agents E2E file was modified here, but it stays unverified territory.
3. Manual macOS pass for fix(desktop): sender names in notifications + macOS click-through routing block/buzz#6427: packaged-app notification click-through while the app is backgrounded, and window focus/re-drain behaviour.
4. Known risks / conflicts: docs/crew/upstream-buzz.json is intentionally not bumped here (sibling sync PRs own the pin). Expect conflicts with sibling upstream(sync): Meta — Buzz desktop-v0.5.18 pin (Tier 1 + Tier 2/3 children) #285 stack PRs in desktop/src/features/messages/lib/useMentions.ts, desktop/src/shared/api/tauri.ts (at its file-size ceiling — 1074 of an effective 1075-line cap, so any further growth needs a compensating deletion), desktop/src/features/channels/ui/MembersSidebar.tsx and desktop/src/app/navigation/useAppNavigation.ts.
5. CI: the parent session is serialising 'NuncioCrew CI' across the stack, so a cancelled run on this PR is expected and was not investigated or re-triggered. Nothing under .github/ was touched.

Link to Devin session: https://app.devin.ai/sessions/5c309cef93b24306aae91a7b06b74002
Requested by: @oscarlehuu

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

NOTES (handover)

DONE

• All four ports implemented and committed on devin/issue-288-notif-agent-identity:
  • 67e9b792a fix(desktop): restore release agent mentions block/buzz#6182 restore release agent mentions (native NIP-OA owner verification, owner metadata plumbing, refresh-churn removal, backfill coalescing)
  • 28849c9d8 fix(desktop): distinguish duplicate agent devices block/buzz#6337 + fix(desktop): simplify duplicate agent provenance block/buzz#6401 duplicate-agent provenance + "Other setup" marker (mentions, members sidebar, add-member rows)
  • 8165277d3 fix(desktop): sender names in notifications + macOS click-through routing block/buzz#6427 notification sender names, target construction, FIFO activation queue with cancellation, forced navigation, bounded reveal, macOS re-drain
  • e8f3b2922, 3ed0fc978 remove host-specific screenshot paths from the E2E spec
• Tests added: otherSetupAgent.test.mjs, mentionSuggestionMapping.test.mjs, MentionAutocomplete.test.mjs, flushMentionDebounce case, AppShell.helpers.test.mjs, searchHitNavigation.test.mjs, desktopActivations.test.mjs, notificationFormat.test.mjs, target.test.mjs, Rust verified_agent_owners_from_profiles cases (valid / missing / forged auth tag / non-kind-0), plus E2E scenarios in mentions.spec.ts and channels.spec.ts and the DM notification title assertion.
• Gates: see the table above — all green except just test-unit's two reds, proven pre-existing on base.
• Evidence (full-window 1280x720 PNGs and untruncated logs) under /home/ubuntu/evidence-288/ — RED: red-frontend-tests.log, red-rust-tests.log, 6427/red-notification-routing.log; GREEN/gates: final-*.log, green-*.log, 6427/final2-*.log, 6427/final3-*.log, 6427/dm-relay-backed.log; base comparisons: base-just-test-unit.log, 6427/just-test-unit-failure-comparison.txt, 6427/profile-base.log, 6427/profile-branch-after-revert.log; screenshots in /home/ubuntu/evidence-288/screens/.

IN PROGRESS

• Base-vs-branch attribution of three remaining E2E reds is unresolved — the base run in a throwaway worktree never launched Playwright (error: unknown command 'test' from the resolved binary in that worktree) and was not retried under the stop order. So these three are named but not classified:
  • tests/e2e/channels.spec.ts (86 passed, 1 failed) — channel settings only prompt editors to add an empty description: expected "Add a description", got "General discussion for everyone". This spec was extended by 28849c9d8, so confirm this one first even though the assertion looks unrelated to the marker scenarios.
  • tests/e2e/profile.spec.ts (26 passed, 3 failed) — declared owner sees runtime tab for a remote relay agent and declared owner sees runtime tab without a relay-agent record. The third failure in that file (Inbox badge sidebar-home-count) is already proven pre-existing on base.
  • Branch-side logs: /home/ubuntu/evidence-288/6427/final3-playwright-channels.log, /home/ubuntu/evidence-288/6427/final3-playwright-profile.log; failed base attempt: /home/ubuntu/evidence-288/6427/base-attribution-*.log.
  • No code is half-written; the tree is clean and every gate above was run on the final tree.

TODO / NEXT

1. Finish the attribution above: get Playwright to actually run in a base 2c26b74bf worktree (the throwaway worktree's pnpm exec playwright test resolved to a binary that rejects test, so install/resolve Playwright there properly rather than reusing the branch install) and compare the three failures per test. If channels.spec.ts passes on base, the seeded-description expectation collides with the members-sidebar scenarios this PR added and is ours to fix.
2. tests/e2e/agents.spec.ts is 27 passed / 8 failed on this branch and the same eight named failures occur on base — no Agents E2E file was modified here, but it stays unverified territory.
3. Manual macOS pass for fix(desktop): sender names in notifications + macOS click-through routing block/buzz#6427: packaged-app notification click-through while the app is backgrounded, and window focus/re-drain behaviour.
4. Known risks / conflicts: docs/crew/upstream-buzz.json is intentionally not bumped here (sibling sync PRs own the pin). Expect conflicts with sibling upstream(sync): Meta — Buzz desktop-v0.5.18 pin (Tier 1 + Tier 2/3 children) #285 stack PRs in desktop/src/features/messages/lib/useMentions.ts, desktop/src/shared/api/tauri.ts (at its file-size ceiling — 1074 of an effective 1075-line cap, so any further growth needs a compensating deletion), desktop/src/features/channels/ui/MembersSidebar.tsx and desktop/src/app/navigation/useAppNavigation.ts.
5. CI: the parent session is serialising 'NuncioCrew CI' across the stack, so a cancelled run on this PR is expected and was not investigated or re-triggered. Nothing under .github/ was touched.

[cursor]

Rebase + evidence (handoff)

Rebased devin/issue-288-notif-agent-identity onto current main (52042c44, #317 font/density). Conflicts: none. docs/crew/upstream-buzz.json not bumped.

E2E attribution vs current main

• channels.spec.ts channel settings only prompt editors to add an empty description — passes here after rebase (not a PR break; earlier red was stale/flake).
• profile.spec.ts declared-owner runtime tab + Inbox sidebar-home-count — fail here, spec is identical to main, and docs/crew/CI.md already lists them as accepted upstream drift. Not chased.
• Agents E2E not touched.

Screenshots (full-window 1280×720, after rebase)

Mentions Other setup marker:

Members sidebar Other setup marker:

Notification click-through (inbox before → #watercooler forum post after). Native macOS LaunchServices focus is not exercisable on Linux.

Screen recording (mentions marker + notification click-through):

pr-316-other-setup-and-notification.mp4