Upstream sync — Buzz Desktop v0.5.5 → v0.5.7 (catch-up)

[oscarlehuu]

Upstream sync — Buzz Desktop v0.5.5 → v0.5.7

Catch-up sync of the Crew fork onto upstream's latest desktop release.
Plan lives in this issue (no separate plans/ doc).

Sync target (pinned to a release, not to upstream/main)

	Value
Current pin	desktop-v0.5.5 / 8342dfcc5 (docs/crew/upstream-buzz.json)
New pin	desktop-v0.5.7 / f167818d25dd9f03115ab907a16f07daee2ece5c
Published	Buzz Desktop v0.5.7, 2026-08-07T23:09Z (v0.5.6 published 19:29Z the same day)
Commits between	81 (all non-merge)
Diff	508 files, +47362 / −7186
Merge conflicts	19 files, 30 hunks (measured on a trial merge of desktop-v0.5.7 into origin/main)

Scope note: the request was "catch up to 0.5.7", but Crew is still pinned at
0.5.5, so this sync necessarily carries 0.5.6 as well. 0.5.7 on its own is
5 PRs; 0.5.6 is the substantial release.

Per UPSTREAM-SYNC.md: merge the release tag,
never upstream/main; work on sync/upstream-YYYY-MM-DD.

What upstream shipped

v0.5.7 (the 5 PRs actually named in the ask)

Change	PR	Relevance to Crew
Recover from max-token response truncation	#5223	Take. Agent turn no longer dies when the model hits max tokens
Externalize boot <style> so Tauri CSP nonce does not override it	#5242	Take. Follow-up to CSP being enabled in 0.5.6
Imported/recovered identities can finish onboarding	#5228	Pure gain
Isolate relay admission tests	#5221	Test-only
Mobile: keep latest message above composer	#4981	Neutral (Crew CI excludes Flutter)

v0.5.6 — the parts that touch Crew

Change	PR	Relevance to Crew
Content Security Policy enabled	#4614	Highest risk. Any Crew-added inline style/script or external origin breaks at runtime, not at build time
edit_message reshaped into an EditMessageInput struct + suppressLinkPreviews	#3818	Direct collision with Crew's edit-as-undo removedMentionPubkeys
SDK preserves self-mention p tags (allow_self_tagging)	#4975	Overlaps Crew's mention/p-removed work
Private managed-agent wire protocol, kind 30179 accepted at ingest	#4593, #5133	Collides with Crew's kind registry additions (receipt 46043, user-input kinds)
Refine agent runtime controls / advanced agent setup	#5026, #4926	Collides with Crew's Hermes runtime + preset entries
Projects follow-ups — access restrictions, fast loading, activity feed	#5073	Collides with Crew's outcome-first Projects (#95) and the 30617 Repository rename (#88)
Retain distinct agent instances in autocomplete	#5202	Touches Crew's mention/agent-mention surface
Media reads require auth; private-channel invitations restricted; banned members lose git access	#4610, #4612, #4608	Security. Reason not to defer this sync
Rich link previews; per-community themes; identity recovery from a signed-in phone	#3818, #3653, #4845	Additive
buzz-agent resilience: context-window 400s, timeout classification, per-retry escalation	#4946, #4959, #5130	Pure gain

Conflicts (measured, not estimated)

30 hunks across 19 files. Default rule stays take upstream, re-apply the Crew
delta on top — do not hand-merge line by line, and do not resolve by keeping
"ours" wholesale.

Cluster	Files	Nature
Message edit contract	desktop/src-tauri/src/events.rs (4), commands/messages.rs (3), shared/api/tauri.ts (3), shared/api/types.ts, MessageComposer.tsx, MessageRow.tsx, MessageThreadPanel.tsx, useMentionSendFlow.ts	Semantic — see below
Managed agents / ACP catalog	managed_agents/{discovery.rs, discovery/presets.rs, types.rs, runtime/tests.rs, spawn_snapshot/tests.rs}, commands/agent_discovery.rs, src-tauri/src/lib.rs	Crew Hermes runtime + ratchet extraction vs upstream runtime controls
Kind registry	crates/buzz-relay/src/handlers/ingest.rs	Union of import lists — mechanical
SDK builders	crates/buzz-sdk/src/builders.rs	Test-only; keep both test sets
Projects UI	features/projects/ui/{ProjectsView.tsx, ProjectsCreateMenu.tsx}	Crew outcome-first Projects vs upstream Projects follow-ups

The one conflict that is a real design decision

Upstream turned edit_message from positional args into a serde
EditMessageInput struct and added suppress_link_previews. Crew's
edit-as-undo added a removed_mentions / p-removed argument to the same
function. Resolution: adopt upstream's struct and carry Crew's field inside
it —

pub struct EditMessageInput {
    // ...upstream fields...
    #[serde(default)] mention_pubkeys: Vec<String>,          // added   → `p`
    #[serde(default)] removed_mention_pubkeys: Vec<String>,  // removed → `p-removed`  (Crew)
    #[serde(default)] suppress_link_previews: bool,          // upstream
}

build_message_edit then takes both removed_mentions and
suppress_link_previews. Do not keep Crew's positional signature — that is a
parallel Crew version of an upstream model, which AGENTS.md forbids.

Also note upstream's allow_self_tagging (block#4975) now preserves self-mention p
tags: re-verify that Crew's p-removed undo path still cancels a queued agent
request when the editor mentioned themselves.

Phases

1 — Mechanical merge. git switch -c sync/upstream-2026-08-07 origin/main,
git merge desktop-v0.5.7. Clear the kind-registry union, the SDK test file,
and the ACP-catalog extraction. Keep the Crew delta out of shared files where
the Desktop file-size ratchet (D-022) applies — extract into Crew-owned files
rather than raising the limit.

2 — Message edit contract. Fold removedMentionPubkeys into upstream's
EditMessageInput across Rust command, tauri.ts, types.ts, and the four
message UI files. Crew's edit-as-undo contract test must pass unchanged.

3 — Managed agents / Hermes. Re-apply Crew's Hermes runtime entries and
preset catalog on top of upstream's reshaped runtime controls and the new
private managed-agent protocol. Confirm Crew kinds and upstream 30179 coexist
in the registry.

4 — CSP audit (new work this sync). CSP is now enforced. Audit every Crew
frontend addition — Mission Inbox, Projects panel, thread integration chips,
activity peek — for inline styles/scripts and non-allowlisted origins, and take
block#5242's externalized-boot-style pattern rather than re-inlining.

5 — Pin and docs. docs/crew/upstream-buzz.json →
0.5.7 / desktop-v0.5.7 / f167818d2. Record the EditMessageInput
resolution as a decision in docs/crew/DECISIONS.md. Run
gh workflow list --all and disable any newly imported out-of-scope workflows.

Acceptance criteria

• docs/crew/upstream-buzz.json names desktop-v0.5.7 / f167818d2.
• git merge-base --is-ancestor desktop-v0.5.7 <sync-branch> succeeds.
• NuncioCrew Gate green on the sync branch, and the manual
  NuncioCrew Upstream Sync workflow run's head SHA equals the sync branch HEAD.
• Editing a message that drops a mention still emits p-removed and cancels the
  queued agent request.
• Desktop app boots with CSP enforced — no console CSP violations on the Crew
  surfaces (Mission Inbox, Projects, thread panel).
• No Crew-only reimplementation of an upstream model is introduced by the merge.

Risks

Risk	Mitigation
CSP breaks a Crew surface at runtime, invisible to lint/typecheck	Phase 4 is an explicit audit, not a side effect; check the console on each Crew surface
Edit contract merge silently drops p-removed	Crew contract test is the gate; it must pass without being edited
Projects UI conflicts undo the outcome-first work from #95	Re-apply Crew's delta over upstream's version; do not keep "ours"
Mobile arrives untested	Crew CI excludes Flutter by design (D-017) — accepted, same as the 0.5.5 sync

Not verified

• Conflict counts and the diffstat come from a real trial merge; no build,
  lint, or test has been run on the merged tree yet.
• The CSP exposure of Crew's surfaces is a hypothesis from reading fix(desktop): enable the content security policy block/buzz#4614/fix(desktop): externalize boot <style> to prevent Tauri CSP nonce override block/buzz#5242,
  not an observed failure. Phase 4 exists to settle it.

Open question

• Upstream's rich link previews (feat(desktop): adding rich link previews to messages block/buzz#3818) now render preview cards. Crew's Buzz
  entity links / GitHub PR-CI chips render their own cards on the same
  surface — do they double up? Deferred until the merge is green.