Merge origin/main into tho/agent-profile-sidebar

Resolves conflicts in channels/ui (ChannelPane, ChannelScreen, useChannelAgentSessions, useChannelPanelHistoryState). Re-applies HEAD profile-panel deltas (UserProfilePanel tab/onTabChange, AgentSessionThreadPanel activity-list ternary) on top of main's reformatted auxiliary-pane render chain. Extracts the repeated RightAuxiliaryPane wrapper into a local wrapAux helper to keep ChannelPane under the 1000-line size guard.

Co-authored-by: Taylor Ho <taylorkmho@gmail.com>
Signed-off-by: Taylor Ho <taylorkmho@gmail.com>

Author: npub14vtk7pvazqrq9639qu7e560wnqtl0d53ca4gjuvq6jzf3k2el23qqlwa7f

ARCHITECTURE.md

@@ -718,11 +718,14 @@ Subcommands:
 
 | Subcommand | Purpose |
 |------------|---------|
-| `add-member` | Add a pubkey to the relay membership list (`--pubkey`, `--role`) |
+| `add-member` | Add a pubkey to the relay membership list (`--pubkey`, `--role`); accepts npub or hex; publishes kind:13534 roster |
+| `remove-member` | Remove a pubkey from the relay membership list (`--pubkey`, optional `--role` guard); publishes kind:13534 roster |
 | `list-members` | List all relay members |
 | `generate-key` | Generate a new Nostr keypair (for bootstrapping) |
 | `reconcile-channels` | Emit kind:39000/39002 discovery events for channels missing them (idempotent) |
 
+The `buzz-admin` binary is shipped in the relay Docker image (`/usr/local/bin/buzz-admin`) and is the recommended way to manage relay membership in production. Use `./run.sh add-member`, `./run.sh remove-member`, and `./run.sh list-members` in Docker Compose deployments.
+
 ---
 
 ### buzz-test-client — Integration Test Harness

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v0.3.33
+
+- fix(desktop): always use legacy keyring for blob entry on macOS ([#1271](https://github.com/block/buzz/pull/1271)) ([`e7c3638fe`](https://github.com/block/buzz/commit/e7c3638fe984e7785a6e51e547b5844e894ed013))
+- chore(release): release Buzz Relay version 0.1.1 ([#1269](https://github.com/block/buzz/pull/1269)) ([`68a0cc850`](https://github.com/block/buzz/commit/68a0cc8506be4ea1fb110b65eec0787e4cd84378))
+- perf(desktop): consolidate keychain secrets into a single blob entry ([#1267](https://github.com/block/buzz/pull/1267)) ([`fa942cb51`](https://github.com/block/buzz/commit/fa942cb51d0714cba54747bcc7197c14e770c338))
+- feat(desktop): re-snapshot persona config on every agent spawn ([#1268](https://github.com/block/buzz/pull/1268)) ([`048e8fdc0`](https://github.com/block/buzz/commit/048e8fdc004322e5feccc4fd76c8fc0dc87d91f0))
+- feat(relay): add buzz-admin member management CLI with NIP-43 roster publish ([#1265](https://github.com/block/buzz/pull/1265)) ([`0cee0435f`](https://github.com/block/buzz/commit/0cee0435f7f955a42d7824f1967e4f4fc6a02f74))
+- fix(desktop): fall back to old keychain when DPK unavailable (unsigned builds) ([#1266](https://github.com/block/buzz/pull/1266)) ([`958ac7aaa`](https://github.com/block/buzz/commit/958ac7aaaae90da76c864af744242f29ee4f08de))
+- Align channel management panel with profile ([#1066](https://github.com/block/buzz/pull/1066)) ([`9f35b0188`](https://github.com/block/buzz/commit/9f35b018803f56b2330bfb79de4ab19f18d80256))
+- fix(relay): multi-pod subscription coherence (one access-gated fan-out path + cross-pod cache invalidation + REQ/COUNT DB guard) ([#1261](https://github.com/block/buzz/pull/1261)) ([`628445429`](https://github.com/block/buzz/commit/6284454298cb5be72cefbeaf13abed04afe3cc9e))
+- fix(desktop): switch macOS keychain to Data Protection Keychain ([#1264](https://github.com/block/buzz/pull/1264)) ([`35522311a`](https://github.com/block/buzz/commit/35522311a963b54f32df864d338ab7d75102247f))
+- fix(desktop): use IPv4 loopback for media proxy URLs ([#1245](https://github.com/block/buzz/pull/1245)) ([`cee2c5f26`](https://github.com/block/buzz/commit/cee2c5f2634ae7d15262a2ec07cccacc8460cd0e))
+- perf(relay/git): stream read-path, manifest info/refs fast path, idx sidecar (A/B/C) ([#1240](https://github.com/block/buzz/pull/1240)) ([`856815994`](https://github.com/block/buzz/commit/856815994c3441268eb48d2264aeb3492b701fe5))
+
+
 ## v0.3.32
 
 - fix(desktop): restore solid dot for top-level channel unreads ([#1253](https://github.com/block/buzz/pull/1253)) ([`9d3bfd38b`](https://github.com/block/buzz/commit/9d3bfd38b0876cd1bdf5bb90d6639f200ceb12e0))

Cargo.lock

@@ -44,7 +44,9 @@ COPY --from=planner /build/recipe.json recipe.json
 RUN cargo chef cook --release --recipe-path recipe.json
 COPY . .
 RUN cargo build --release --locked -p buzz-relay --bin buzz-relay \
-    && strip target/release/buzz-relay
+                                   -p buzz-admin --bin buzz-admin \
+    && strip target/release/buzz-relay \
+    && strip target/release/buzz-admin
 
 # ─── Stage 4: web bundle (pnpm + vite) ──────────────────────────────────────
 # Independent of the Rust layers so a CSS change doesn't bust Rust cache and
@@ -82,6 +84,7 @@ RUN apt-get update \
                 --create-home --shell /usr/sbin/nologin buzz
 
 COPY --from=builder    /build/target/release/buzz-relay /usr/local/bin/buzz-relay
+COPY --from=builder    /build/target/release/buzz-admin /usr/local/bin/buzz-admin
 COPY --from=web-builder /build/web/dist                 /srv/buzz/web
 
 ENV BUZZ_WEB_DIR=/srv/buzz/web

Dockerfile

@@ -471,6 +471,117 @@ is dual-sourced: local snapshot metadata plus upstream edit events (kind:40003 
 
 ---
 
+## Relay Membership (NIP-43)
+
+When `BUZZ_REQUIRE_RELAY_MEMBERSHIP=true`, every authenticated connection is checked against the
+`relay_members` table. Only pubkeys with a row in that table may use the relay. The relay owner
+is bootstrapped automatically from `RELAY_OWNER_PUBKEY` on startup.
+
+### CLI: Managing Members
+
+Use `buzz-admin` — the operator CLI shipped in the relay image — to manage relay membership.
+In a Docker Compose deployment, use `run.sh`:
+
+```bash
+# Add a member (accepts bech32 npub or 64-char hex; default role: member)
+./run.sh add-member npub1abc...
+./run.sh add-member <64-char-hex-pubkey>
+./run.sh add-member npub1abc... --role admin
+
+# Remove a member
+./run.sh remove-member npub1abc...
+./run.sh remove-member npub1abc... --role member   # only removes if role matches
+
+# List all members
+./run.sh list-members
+```
+
+Or invoke `buzz-admin` directly inside the container:
+
+```bash
+docker compose exec relay buzz-admin add-member --pubkey npub1abc...
+docker compose exec relay buzz-admin add-member --pubkey npub1abc... --role admin
+docker compose exec relay buzz-admin remove-member --pubkey npub1abc...
+docker compose exec relay buzz-admin list-members
+```
+
+**Exit codes:**
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | Validation error (bad pubkey, bad role, usage error) |
+| 2 | Not found (remove: member does not exist) |
+| 3 | Cannot remove relay owner (use `RELAY_OWNER_PUBKEY` to change owner) |
+| 4 | Role mismatch (`--role` check failed) |
+| 5 | DB/Redis/internal error |
+
+**Required environment variables for member management:**
+
+| Variable | Notes |
+|----------|-------|
+| `DATABASE_URL` | Postgres connection string |
+| `REDIS_URL` | Redis connection string |
+| `BUZZ_RELAY_PRIVATE_KEY` | Hex private key — required to sign kind:13534 events |
+
+### NIP-43 Admin Events (WebSocket)
+
+Relay membership can also be managed over WebSocket using NIP-43 admin events. These require
+the sender to be authenticated (NIP-42) as the relay owner or an admin.
+
+| Kind | Action | Required tags |
+|------|--------|---------------|
+| 9030 | Add member | `["p", "<hex-pubkey>"]`, optional `["role", "member\|admin"]` |
+| 9031 | Remove member | `["p", "<hex-pubkey>"]`, optional `["role", "member\|admin"]` |
+| 9032 | Change role | `["p", "<hex-pubkey>"]`, `["role", "member\|admin"]` |
+
+Example using `nak`:
+
+```bash
+# Add a member (owner or admin must sign)
+nak event -k 9030 \
+  --tag "p=<target-hex-pubkey>" \
+  --tag "role=member" \
+  --auth --sec <owner-or-admin-privkey> \
+  ws://localhost:3000
+
+# Remove a member
+nak event -k 9031 \
+  --tag "p=<target-hex-pubkey>" \
+  --auth --sec <owner-or-admin-privkey> \
+  ws://localhost:3000
+
+# Change a member's role to admin
+nak event -k 9032 \
+  --tag "p=<target-hex-pubkey>" \
+  --tag "role=admin" \
+  --auth --sec <owner-or-admin-privkey> \
+  ws://localhost:3000
+```
+
+After each add/remove/role-change, the relay publishes a kind:13534 membership list event
+(relay-signed, NIP-70 protected) that clients can subscribe to:
+
+```bash
+# Subscribe to the live membership roster
+nak req -k 13534 --auth --sec <privkey> ws://localhost:3000
+```
+
+### Known Limitations
+
+1. **CLI intentionally does not emit kind 8000/8001 deltas** — `publish_nip43_delta` is
+   in-process-only (no Redis hop), so a sidecar call stores but never pushes. The 13534 list
+   snapshot is the authoritative roster and rides Redis to live clients. Do not wire a delta call
+   that passes in-process tests and silently no-ops in the deployed `compose exec` path.
+
+2. **The `custom_created_at = max(now, newest_existing_13534 + 1s)` bump defeats same-second
+   domination for serial invocations; it does NOT serialize concurrent CLI processes** — two
+   near-simultaneous adds can read the same newest timestamp and collide on the bumped second.
+   `run.sh` serialization is the guard against parallel adds (e.g. `xargs -P`). When adding
+   multiple members in a loop, add `sleep 1` between invocations.
+
+---
+
 ## Relay Environment Variables (NIP-29 relevant)
 
 | Variable | Required | Default | Description |

NOSTR.md

@@ -19,8 +19,6 @@ use crate::observer::{ObserverContext, ObserverHandle};
 /// Lines exceeding this limit are rejected to prevent OOM from rogue agents.
 const MAX_LINE_SIZE: usize = 10_000_000; // 10 MB
 
-// ─── Public types ────────────────────────────────────────────────────────────
-
 /// An MCP server configuration passed to `session/new`.
 ///
 /// Corresponds to the `McpServerStdio` variant in the ACP schema.
@@ -106,8 +104,6 @@ pub enum AcpError {
     AgentError(String),
 }
 
-// ─── AcpClient ───────────────────────────────────────────────────────────────
-
 /// ACP client that owns an agent subprocess and communicates over its stdio.
 ///
 /// One `AcpClient` per agent process. Multiple sessions can be created on the
@@ -151,8 +147,6 @@ pub struct AcpClient {
 }
 
 impl AcpClient {
-    // ── Lifecycle ─────────────────────────────────────────────────────────
-
     /// Kill the agent subprocess and wait for it to exit (no zombies).
     ///
     /// `Drop` only calls `start_kill()` (sends SIGKILL but doesn't reap).
@@ -568,8 +562,6 @@ impl AcpClient {
         self.parse_stop_reason(&result)
     }
 
-    // ── Internal helpers ──────────────────────────────────────────────────
-
     /// Serialize `value` as a single NDJSON line and flush to the agent's stdin.
     ///
     /// Bounded by a 30-second write timeout. If the agent stops reading stdin
@@ -1090,8 +1082,6 @@ impl AcpClient {
     }
 }
 
-// ─── Permission response constructors ────────────────────────────────────────
-
 /// Build `session/prompt` params from one or more text content blocks.
 fn build_prompt_params(session_id: &str, prompt_blocks: &[&str]) -> serde_json::Value {
     let blocks: Vec<serde_json::Value> = prompt_blocks
@@ -1122,8 +1112,6 @@ fn permission_response_cancelled(id: &serde_json::Value) -> serde_json::Value {
     })
 }
 
-// ─── Session response types ───────────────────────────────────────────────────
-
 /// Full `session/new` response — session ID plus the raw JSON result.
 ///
 /// Callers use the extractor helpers to pull model info from `raw`.
@@ -1215,8 +1203,6 @@ pub fn resolve_model_switch_method(
     None
 }
 
-// ─── Drop: kill child process ─────────────────────────────────────────────────
-
 impl Drop for AcpClient {
     fn drop(&mut self) {
         // Best-effort SIGKILL + reap. We cannot `await` in Drop (sync context).
@@ -1258,14 +1244,10 @@ fn kill_process_group(_pid: u32) -> bool {
     false
 }
 
-// ─── Tests ───────────────────────────────────────────────────────────────────
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    // ── StopReason parsing ────────────────────────────────────────────────
-
     #[test]
     fn stop_reason_parses_all_known_values() {
         assert_eq!(StopReason::from_str("end_turn"), Some(StopReason::EndTurn));
@@ -1310,8 +1292,6 @@ mod tests {
         assert_eq!(StopReason::from_str("Refusal"), Some(StopReason::Refusal));
     }
 
-    // ── Permission option finding ─────────────────────────────────────────
-
     #[test]
     fn find_allow_once_by_kind_not_by_option_id() {
         // optionId values are intentionally non-obvious to prove we don't hardcode them.
@@ -1371,8 +1351,6 @@ mod tests {
         assert_eq!(reject_once.unwrap()["optionId"].as_str(), Some("rej-x"));
     }
 
-    // ── JSON-RPC message construction ─────────────────────────────────────
-
     #[test]
     fn request_has_id_field() {
         let id: u64 = 42;
@@ -1563,8 +1541,6 @@ mod tests {
         assert_eq!(msg["params"]["sessionId"].as_str(), Some("sess_xyz789"));
     }
 
-    // ── String ID handling (Fix 1) ────────────────────────────────────────
-
     #[test]
     fn permission_request_with_string_id() {
         // Verify that permission response uses the same ID type as the request.
@@ -1617,8 +1593,6 @@ mod tests {
         assert!(cancelled_numeric["id"].is_number());
     }
 
-    // ── Model extractor tests ─────────────────────────────────────────────
-
     #[test]
     fn extract_model_config_options_finds_model_category() {
         let result = serde_json::json!({
@@ -1685,8 +1659,6 @@ mod tests {
         assert!(super::extract_model_state(&result).is_none());
     }
 
-    // ── resolve_model_switch_method tests ─────────────────────────────────
-
     #[test]
     fn resolve_prefers_stable_over_unstable() {
         let result = serde_json::json!({
@@ -1783,8 +1755,6 @@ mod tests {
         );
     }
 
-    // ── Error variant display ─────────────────────────────────────────────
-
     #[test]
     fn idle_timeout_error_includes_duration() {
         let err = AcpError::IdleTimeout(std::time::Duration::from_secs(320));
@@ -1805,8 +1775,6 @@ mod tests {
         );
     }
 
-    // ── Async integration tests with real subprocess ──────────────────────
-
     async fn spawn_script(script: &str) -> AcpClient {
         AcpClient::spawn("bash", &["-c".into(), script.into()], &[])
             .await
@@ -1977,8 +1945,6 @@ mod tests {
         assert_eq!(result.unwrap()["worked"], serde_json::json!(true));
     }
 
-    // ── Keepalive / tool-call idle reset tests (PR #935 fix) ─────────────
-
     #[tokio::test]
     async fn keepalive_resets_idle_past_deadline() {
         // Keepalive session/update lines every 50ms against a 100ms idle deadline.
@@ -2044,8 +2010,6 @@ mod tests {
         );
     }
 
-    // ── session_new_full systemPrompt serialization ──────────────────────
-
     #[tokio::test]
     async fn session_new_full_includes_system_prompt_when_some() {
         // Script: respond to initialize, then echo back the session/new request.

crates/buzz-acp/src/acp.rs

@@ -34,11 +34,13 @@ Run `buzz --help` or `buzz <group> --help` for full usage.
 
 ### Threading
 
-- **To a human** (updates, questions, deliverables): Use `--reply-to <thread-root-id>` (from your `[Context]` block) and `@mention` the human. Keeps messages at layer 1 where humans read.
-- **To another agent** (dispatching, collaborating): Thread however you want.
-- **When in doubt**, reply to thread root.
-- **Thread scope:** Respond in the thread where you were tagged. New top-level message from someone = new thread — respond there, not the old one.
-- **New topic → new top-level message.** Don't graft unrelated work onto an existing thread.
+Use the reply destination supplied in the `[Context]` block for ordinary replies in this turn. Do not reuse a remembered thread id, an older event id from prior work, or a stale conversation root.
+
+For human-facing work, keep the conversation flat and easy to read. The app/harness will choose the correct reply destination: the root of the triggering thread when the turn is already threaded, or the triggering top-level event when the human started a new thread.
+
+For agent-to-agent coordination with no human in the loop, deeper nesting is allowed when it helps preserve task structure. Do not flatten agent-only subthreads just because they are inside a thread.
+
+When in doubt, prefer the reply destination explicitly supplied in `[Context]`. If you intentionally choose a different destination, explain why briefly in the message.
 
 ### General