Linux support for live development

[MajorTal]

Live development only worked on macOS. Two reasons, both in dev/.

1. dev/relay-broker.mjs read the Buzz credential only via the macOS security tool. Buzz desktop keeps the same blob (service buzz-desktop, username secrets) in the freedesktop secret service on Linux. The broker now reads it there with secret-tool. Same checks as before: pin validated first, OS store is the only source, mismatch refused, empty read fails closed, no file or env fallback. Other platforms get a clear error before any reader runs.
2. dev/agent-library.mjs hard-coded the macOS app-data path, so Agents showed "Could not read the current Buzz agent library" on Linux. It now resolves the Tauri app-data dir like the dirs crate does: Library/Application Support on macOS, XDG_DATA_HOME on Linux when absolute, otherwise ~/.local/share. Still read-only. Nothing for other platforms.

README and docs/agents.md updated. Linux needs libsecret-tools.

Since the last review

Carl's round 1 findings are fixed (platform-pinned identity suite, absolute-only XDG_DATA_HOME, Windows branch removed); his re-review on 5075031 found no remaining code blocker. This push carries the same hunks: the three commits are squashed into two so each message matches its diff (the middle commit still said "Linux and Windows" after the Windows branch was removed), the branch is rebased onto current main, and three sentences in docs/communities.md, docs/channels.md and docs/agents.md that still called the broker macOS-only are corrected. Nothing else changed.

The hosted JavaScript job on 5075031 failed on one test: dev/relay-broker-api.test.mjs "queued request mints fresh auth at dispatch after wall time advances", expected 489.245 to be >= 490. That assertion measures the broker's 500 ms pacing interval against a 490 ms floor with real timers. The test injects its own identity, so the code this PR changes (loadIdentity in relay-broker.mjs) never runs in it, and the pacing lives in src/features/relay/http-admission.ts, untouched here. The measured gap is 500 ms plus the difference in signing time between the two dispatches plus timer slop, so a 10 ms skew on a loaded runner trips the floor. Same file passed on the previous head with an identical relay-broker.mjs hunk. On this Mac the test passed 30 of 30 runs on this head and 30 of 30 on main; on the Linux laptop under default parallelism it tripped the same way before this push (noted below). It needs a rerun, or a separate change to that test's floor, which I did not fold in here.

Tested

macOS (Apple Silicon), this code (the only edits after the run were the three doc sentences):

• pnpm check: clean.
• pnpm exec vite build: ok.
• pnpm exec vitest run: 155 files, 1617 tests pass, including the platform-pinned identity cases for darwin, linux, win32 and freebsd.
• Live dev loop on this Mac unchanged.

Linux (Ubuntu x86_64, Buzz desktop signed in): before the change, just web failed with Keychain read unavailable or declined and Agents showed the "Could not read" notice. After the fix, both work: broker logs signing as …, community opens, Agents lists the library.

Full Vitest on that Linux machine at the previous head (same tree): pnpm exec vitest run --no-file-parallelism: 147 files, 1561 tests pass. With default parallelism the same laptop trips five to six timing cases in unrelated files (pages.integration, read-state, typing, unread-startup, the 490 ms wall-clock check in relay-broker-api); each passes in isolation. That is machine capacity, not this change; nothing was retried or given a longer budget.

Before this push I also ran a security-review pass shaped like the relay repo's Codex prompt and an adversarial review in Carl's method against the exact range; neither found a blocker. Their notes are folded into this body.

Not covered: Windows has no credential reader, so live development there still fails at the identity step with the platform message. Flatpak/Snap data dirs not handled.

🤖 Generated with Claude Code

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed head 7f49154a56114744591f04d8cb9f89bf75ce9ab0 against base a9194b24a3cc208abf6f9a9a05eed77583e6c0fa.

P2: update the identity tests for the new platform-dependent reader

The new Linux selection in dev/relay-broker.mjs:167–188 breaks the existing required Ubuntu JavaScript test gate:

• broker-identity.test.ts:99–109 has three parameterized cases that require /usr/bin/security and its macOS arguments, without controlling process.platform. Linux now calls secret-tool with different arguments.
• broker-identity.test.ts:137–145 requires the macOS read-failure text; Linux now correctly throws the new Secret Service error.
• The JavaScript CI job runs the full Vitest suite on ubuntu-24.04. The PR's vitest run dev validation excludes this test file under src/.

Reproduction: the unchanged head passes all 1,553 Vitest tests on macOS. Running that same full suite with an external Vite pre-transform selecting only the broker's Linux platform branch produces exactly these four failures: 1,549 pass, 4 fail. This is a deterministic Linux-branch simulation on macOS, not a claim of a native Linux run; the credential subprocess remains mocked by the existing tests.

Smallest repair: explicitly control/parameterize the platform in the existing identity suite. Preserve macOS coverage and assert Linux's exact command/arguments and sanitized read error, while retaining invalid-pin-before-access, mismatch, malformed-credential, and production-build refusal coverage. Cover unsupported-platform refusal without invoking a credential reader. Do not skip these tests on Linux. Then run the complete Vitest suite on Ubuntu; no production abstraction is needed to fix this regression.

P3, non-blocking: match Tauri's relative-XDG fallback

dev/agent-library.mjs:70–74 accepts any nonempty XDG_DATA_HOME. For XDG_DATA_HOME=relative, this reads relative/xyz.block.buzz.app/agents/managed-agents.json under the dev-server working directory. Installed Buzz uses Tauri app_data_dir() → dirs::data_dir(), which ignores nonabsolute XDG values and falls back to $HOME/.local/share. The adapter can therefore report an unavailable library while installed Buzz reads it normally. I independently checked the producer chain and reproduced the different paths.

Honor XDG only when absolute and add a relative-value regression. This is a small compatibility correction, not a request for another path abstraction. Because it requires invalid XDG configuration, I am not treating it as a separate merge blocker.

Scope and validation notes

This is a small development-platform extension/portability fix: Linux can use its OS-held Buzz identity and installed agent library. It does not alter packaged sign-in, production UI, protocol, dependencies, or agent management. Public-pin validation, mismatch refusal, host-only keys and read-only library projection remain in place.

The Windows %APPDATA% branch in installedBuzzDataDir is an unnecessary scope extra: the live broker still refuses Windows before its default library reader can run. Prefer omitting that branch/test from a strictly Linux-only fix, or explicitly treating it as deferred parity. This is non-blocking, not a hidden shipped Windows feature.

Hosted application CI is currently action_required, not a completed pass: https://github.com/block/buzz-app/actions/runs/35328217343 . Successful security/DCO checks do not establish application validation. No CI approval/rerun, GitHub approval, or merge was performed. Live Linux secret-service acceptance was reported by the author, not independently exercised in this review.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review: previous findings addressed; no remaining code blocker found

Reviewed head 50750319437e2f75fa5c39538f3722e6df2d7b21 against base a9194b24a3cc208abf6f9a9a05eed77583e6c0fa, concentrating on the repair delta from previously reviewed 7f49154a56114744591f04d8cb9f89bf75ce9ab0.

• Previous P2 addressed: src/features/communities/broker-identity.test.ts explicitly pins and restores the platform. Matching-key cases verify the exact macOS and Linux subprocess commands/arguments. Denied and empty reads cover both platforms with sanitized errors; unsupported Windows/FreeBSD fail before credential access or middleware setup. Existing missing/invalid public-pin, mismatch, malformed credential and production-build refusal tests remain. The previous four host-dependent assertions are repaired rather than skipped.
• Previous P3 addressed: dev/agent-library.mjs honors only absolute XDG_DATA_HOME, otherwise using ~/.local/share; regression cases cover unset, absolute, empty and relative values. The unsupported Windows path branch was removed. The bounded read-only reader and public-field projection are unchanged. Independent path review reached the same conclusion.
• Scope/security preserved: the credential loader and Vite gating are unchanged from the prior review. No new credential fallback, library mutation, packaged-login behavior, dependency or production abstraction was added by this repair.

Validation: pinned source/diff review and git diff --check passed. No local suites or real credential/library access were performed in this re-review. The current exact-head CI run is still in progress at the final snapshot; its earlier attempt required authorization and ran no jobs. The author's reported Linux live smoke and full-suite results are not independently reproduced here. Required CI must finish successfully before merge.

I am withdrawing my outdated changes-requested review because its findings are addressed. This is a COMMENT review, not GitHub approval or authorization to merge.

Carl, an automated reviewer, commenting via Wes’s GitHub account. Superseded after re-review of 5075031: the platform-dependent identity test blocker and relative-XDG issue are addressed. Required CI remains in progress; this dismissal is not approval to merge.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review: no remaining code blockers found

Reviewed head 865a84762ade3c90c216f9281d5f561efe616ef9 against base ac492a7b89734d9a0a90b816cac76b5ff83d5855, concentrating on the rebase/squash and documentation delta from previously cleared 50750319437e2f75fa5c39538f3722e6df2d7b21.

• Previous fixes remain intact. The agent-library implementation/test and platform-pinned identity suite are byte-identical to the cleared revision. The complete credential loader and Vite startup gating are unchanged. Absolute-only XDG handling, unsupported-platform refusal, pin-before-access, mismatch rejection, sanitized credential failures, and read-only library projection remain in place.
• The new delta is accurately described. Comparing each revision against its own base shows identical implementation/test hunks; the only additional PR changes are the three macOS/Linux documentation corrections. Upstream media-proxy edits do not change identity initialization or library access. Independent review of the library/documentation lane found no blocker, and I verified its evidence.
• Validation is scoped, not overstated. Immutable-object diff/source review and git diff --check ac492a7..865a847 passed. At the final status snapshot, exact-head CI has passed JavaScript, Windows native notifications, and Browser measurements; Rust/tool integration and all four browser-journey shards remain in progress. Required CI is not yet fully green. No local suites or live OS credential/library access were performed in this re-review; the author's Linux live smoke remains author-reported evidence.

The earlier reported 490 ms assertion is in a harness that injects its own identity, bypassing this PR's credential reader; the HTTP pacing implementation is unchanged. It is not an outstanding code finding against this change.

This is a COMMENT review, not GitHub approval or authorization to merge. Required checks still need to finish successfully.