feat(profile): polish agent profile sidebar details

.github/workflows/auto-tag-on-release-pr-merge.yml

@@ -1,5 +1,26 @@
 name: Auto-tag on Release PR Merge
 
+# Three release lanes share this one workflow — adding a lane is one more branch
+# prefix, never a forked copy:
+#
+#   version-bump/<v>   → tag v<v>        → dispatch release.yml (desktop app)
+#   relay-release/<v>  → tag relay-v<v>  → dispatch docker.yml (relay image)
+#   mobile-release/<v> → tag mobile-v<v> → (manual sprout_ref for buzz-releases build — see below)
+#
+# Both the desktop and relay lanes dispatch their build workflow rather than
+# relying on the consumer's `on.push.tags` trigger: auto-tag pushes the tag
+# with the default GITHUB_TOKEN, which GitHub's recursion guard blocks from
+# firing any `on: push` trigger. So release.yml and docker.yml both have a
+# `push.tags` trigger that is dead for auto-pushed tags — the dispatch is the
+# real path. Each dispatch passes the bare version and the tag ref so the
+# consumer builds the tagged commit (github.ref on a dispatch is `main`).
+#
+# The mobile lane is push-only by infosec necessity: OSS `block/buzz` CI must
+# not trigger CI in the private `buzz-releases` repo, so auto-dispatch across
+# that boundary is deliberately disallowed. The mobile-v* tag is consumed
+# manually instead — a human feeds it as the `sprout_ref` input to the
+# `buzz-releases` Buildkite pipeline, which builds and ships mobile.
+
 on:
   pull_request:
     types: [closed]
@@ -13,7 +34,9 @@ jobs:
   auto-tag:
     if: >
       github.event.pull_request.merged == true &&
-      startsWith(github.event.pull_request.head.ref, 'version-bump/') &&
+      (startsWith(github.event.pull_request.head.ref, 'version-bump/') ||
+       startsWith(github.event.pull_request.head.ref, 'relay-release/') ||
+       startsWith(github.event.pull_request.head.ref, 'mobile-release/')) &&
       github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
@@ -22,42 +45,78 @@ jobs:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: 0
 
-      - name: Extract version from branch name
+      - name: Resolve lane and version from branch name
         env:
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
-          VERSION="${BRANCH#version-bump/}"
+          # Lane is decided by branch prefix: the tag prefix and whether a
+          # downstream workflow_dispatch is needed both follow from it.
+          case "$BRANCH" in
+            version-bump/*)
+              VERSION="${BRANCH#version-bump/}"
+              TAG_PREFIX="v"
+              DISPATCH="release" ;;
+            relay-release/*)
+              VERSION="${BRANCH#relay-release/}"
+              TAG_PREFIX="relay-v"
+              DISPATCH="docker" ;;
+            mobile-release/*)
+              VERSION="${BRANCH#mobile-release/}"
+              TAG_PREFIX="mobile-v"
+              DISPATCH="" ;;
+            *)
+              echo "::error::Unhandled branch prefix: '$BRANCH'"
+              exit 1 ;;
+          esac
           if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
             echo "::error::Invalid version in branch name: '$VERSION'"
             exit 1
           fi
           echo "version=$VERSION" >> "$GITHUB_ENV"
-          echo "Tagging v${VERSION}"
+          echo "tag=${TAG_PREFIX}${VERSION}" >> "$GITHUB_ENV"
+          echo "dispatch=$DISPATCH" >> "$GITHUB_ENV"
+          echo "Tagging ${TAG_PREFIX}${VERSION}"
 
       - name: Create and push tag
         env:
-          VERSION: ${{ env.version }}
+          TAG: ${{ env.tag }}
         run: |
-          EXISTING_SHA="$(git ls-remote --tags origin "refs/tags/v$VERSION" | awk '{print $1}')"
+          EXISTING_SHA="$(git ls-remote --tags origin "refs/tags/$TAG" | awk '{print $1}')"
           if [ -n "$EXISTING_SHA" ]; then
             if [ "$EXISTING_SHA" = "$GITHUB_SHA" ]; then
-              echo "Tag v$VERSION already exists at $GITHUB_SHA — skipping tag creation"
+              echo "Tag $TAG already exists at $GITHUB_SHA — skipping tag creation"
               exit 0
             else
-              echo "::error::Tag v$VERSION already exists at $EXISTING_SHA (expected $GITHUB_SHA)"
+              echo "::error::Tag $TAG already exists at $EXISTING_SHA (expected $GITHUB_SHA)"
               exit 1
             fi
           fi
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
-          git tag "v$VERSION"
-          git push origin "v$VERSION"
+          git tag "$TAG"
+          git push origin "$TAG"
 
       - name: Trigger release build
+        # The desktop and relay lanes dispatch their build workflow because the
+        # consumer's on:push:tags trigger is dead for auto-pushed tags (default
+        # GITHUB_TOKEN, recursion guard — see header comment). Mobile has no
+        # consumer yet, so dispatch="" skips this step entirely.
+        if: ${{ env.dispatch != '' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DISPATCH: ${{ env.dispatch }}
           VERSION: ${{ env.version }}
+          TAG: ${{ env.tag }}
         run: |
-          gh workflow run release.yml \
+          # Both workflows take the bare version (for the build) and the tag ref
+          # (so the dispatch builds the tagged commit, not main).
+          case "$DISPATCH" in
+            release) WORKFLOW="release.yml" ;;
+            docker)  WORKFLOW="docker.yml" ;;
+            *)
+              echo "::error::Unhandled dispatch target: '$DISPATCH'"
+              exit 1 ;;
+          esac
+          gh workflow run "$WORKFLOW" \
             -f version="$VERSION" \
-            -f ref="v$VERSION"
+            -f ref="$TAG"

.github/workflows/docker.yml

@@ -8,16 +8,42 @@ name: Docker image
 # This avoids QEMU emulation (~10× slower for Rust) at zero cost on free
 # GitHub-hosted runners.
 #
+# Versioning: the relay is versioned independently of the desktop app via
+# its own `relay-v*` tags (see `just release-relay`). Desktop `v*` tags and
+# agent `sprig-v*` tags do NOT publish this image — only `relay-v*` does, so
+# the relay image version tracks crates/buzz-relay/Cargo.toml, never desktop.
+#
 # Triggers:
-#   - push to main         → :main + :sha-<7>
-#   - push tags v*.*.*     → :latest + :{version} + :{major}.{minor} + :{major}
-#   - pull_request         → build only (no push), cache stays warm
-#   - workflow_dispatch    → manual canary
+#   - push to main           → :main + :sha-<7>
+#   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
+#                              (+ :latest for stable, NOT for prereleases)
+#   - pull_request           → build only (no push), cache stays warm
+#   - workflow_dispatch      → manual canary (no inputs), or relay-tag rescue
+#                              dispatch with version+ref inputs (see below)
+#
+# Why workflow_dispatch carries version/ref inputs:
+#   auto-tag-on-release-pr-merge.yml pushes relay-v* with the default
+#   GITHUB_TOKEN, which GitHub deliberately does NOT let fire on:push triggers
+#   (recursion guard). So the push:tags trigger above never runs for releases.
+#   auto-tag instead dispatches this workflow with the bare version + tag ref,
+#   the same rescue release.yml already uses for the desktop lane. On dispatch
+#   github.ref is `main`, so the tag ref is plumbed through explicitly: checkout
+#   pins to inputs.ref, and the semver tags take inputs.version via `value=`.
+#   On the rescue path inputs.version is already bare (e.g. 0.3.0), so the
+#   match=^relay-v(.*)$ regex simply no-ops (it warns, leaving the value
+#   intact) and the bare version flows straight to the semver parser. On a
+#   real push event value= is empty and the match strips relay-v from the ref.
+#   Inputless canary dispatch (version="", ref=main) renders no semver tag.
+#
+# The :latest tag tracks the latest STABLE relay release: metadata-action's
+# `flavor.latest=auto` (its default) emits :latest only for non-prerelease
+# semver, so relay-v0.3.0-rc.1 publishes :0.3.0-rc.1 without moving :latest,
+# and main pushes (no semver tag) never produce :latest.
 
 on:
   push:
     branches: [main]
-    tags: ["v[0-9]*"]
+    tags: ["relay-v[0-9]*"]
   pull_request:
     paths:
       - "Dockerfile"
@@ -33,6 +59,14 @@ on:
       - "pnpm-workspace.yaml"
       - "patches/**"
   workflow_dispatch:
+    inputs:
+      version:
+        description: "Semver version e.g. 0.3.0 (no relay-v prefix) — for relay-tag rescue dispatch"
+        required: false
+      ref:
+        description: "Tag/branch/SHA to build, e.g. relay-v0.3.0"
+        required: false
+        default: main
 
 # One image build per ref; cancel superseded PR builds, but never cancel
 # tag/main builds (publishing must not be aborted mid-flight).
@@ -77,6 +111,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
+          # On workflow_dispatch (relay-tag rescue) build the tagged commit,
+          # not main. Empty string = default ref for push/PR events.
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -103,15 +140,26 @@ jobs:
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
           images: ${{ env.IMAGE_NAME }}
-          # Tag matrix — every main commit gets sha-<7>, releases get full
-          # semver family. Pull requests get nothing (push: false below).
+          # Tag matrix — every main commit gets sha-<7>, relay releases get the
+          # full semver family. The semver entries carry match=^relay-v(.*)$
+          # because metadata-action does NOT strip a `relay-v` prefix on its
+          # own — it only strips refs/tags/, then runs the raw ref through
+          # semver.valid(), which rejects "relay-v0.3.0". The match capture
+          # group feeds the bare version to the semver parser. value= supplies
+          # the version on the auto-tag rescue dispatch (github.ref is `main`
+          # there, not the tag): it is already bare, so match no-ops (warns,
+          # value intact) and the bare version validates as-is. On push value=
+          # is empty, so the ref drives it and match strips relay-v — push
+          # behavior is unchanged. Pull requests get nothing (push: false
+          # below). :latest is intentionally absent — flavor.latest defaults to
+          # `auto`, which adds :latest for stable semver tags only (not
+          # prereleases, not main pushes).
           tags: |
-            type=ref,event=branch
-            type=sha,prefix=sha-,format=short
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
           labels: |
             org.opencontainers.image.title=Buzz
             org.opencontainers.image.description=WebSocket relay server for the Buzz communications platform
@@ -186,13 +234,17 @@ jobs:
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
           images: ${{ env.IMAGE_NAME }}
+          # Must mirror the build job's tag matrix exactly — the merge job
+          # re-derives tags to stamp them onto the multi-arch manifest. See
+          # the build job's `meta` step for why match=^relay-v(.*)$, why
+          # value=${{ inputs.version }} carries the rescue-dispatch version,
+          # and why :latest is left to flavor.latest=auto.
           tags: |
-            type=ref,event=branch
-            type=sha,prefix=sha-,format=short
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
 
       - name: Create and push manifest list
         id: manifest

.github/workflows/release.yml

@@ -173,7 +173,7 @@ jobs:
           key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
 
       - name: Build unsigned Tauri app
-        run: cd desktop && pnpm tauri build --verbose --no-sign --config src-tauri/tauri.release.conf.json
+        run: cd desktop && pnpm tauri build --verbose --no-sign --features mesh-llm --config src-tauri/tauri.release.conf.json
         env:
           BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
           BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
@@ -513,6 +513,8 @@ jobs:
       - name: Build Linux Tauri app
         run: cd desktop && pnpm tauri build --verbose --ci --bundles deb,appimage --config src-tauri/tauri.release.conf.json
         env:
+          BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
+          BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
@@ -647,6 +649,8 @@ jobs:
         shell: bash
         run: cd desktop && pnpm tauri build --verbose --target "$TARGET" --bundles nsis --config src-tauri/tauri.release.conf.json
         env:
+          BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }}
+          BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"

AGENTS.md

@@ -552,5 +552,5 @@ just mobile-dev
 - [CONTRIBUTING.md](CONTRIBUTING.md) — setup, code style, PR process, how to add event kinds / CLI subcommands / API endpoints
 - [TESTING.md](TESTING.md) — multi-agent E2E test guide
 - [ARCHITECTURE.md](ARCHITECTURE.md) — system design and component relationships
-- [RELEASING.md](RELEASING.md) — release process: `just release`, auto-tag, internal builds
+- [RELEASING.md](RELEASING.md) — release process: `release-desktop`, `release-relay`, `release-mobile`, auto-tag, internal builds
 - [README.md](README.md) — project overview and quick start

CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## v0.3.31
+
+- fix(release): publish versioned relay Docker tags via independent release lanes ([#1173](https://github.com/block/buzz/pull/1173)) ([`549b7d24`](https://github.com/block/buzz/commit/549b7d24813320045bdda629d865c6c7418e7450))
+- fix(desktop): align settings section headers ([#1165](https://github.com/block/buzz/pull/1165)) ([`6ad68a6b`](https://github.com/block/buzz/commit/6ad68a6b095cd5db328ae07dfac4013eeda5820a))
+- fix(desktop): ground agent workspace, migrate legacy nest, configurable repos_dir ([#1194](https://github.com/block/buzz/pull/1194)) ([`1011cea2`](https://github.com/block/buzz/commit/1011cea2682a5e8cd92c9da255d5ba6c8f7ced78))
+- fix(desktop): enable mesh llm for release builds ([#1221](https://github.com/block/buzz/pull/1221)) ([`fa1262a9`](https://github.com/block/buzz/commit/fa1262a92c85b96c1d643c247d28df4f2f57e81a))
+- fix(desktop): move crypto commands off the main thread ([#1222](https://github.com/block/buzz/pull/1222)) ([`e35e84b0`](https://github.com/block/buzz/commit/e35e84b08bdc44f1f5297e6957bcc52e7c31eb70))
+- fix: tolerate missing private_key_nsec in agent store ([#1220](https://github.com/block/buzz/pull/1220)) ([`c58e9880`](https://github.com/block/buzz/commit/c58e9880bf60324b0fbb64917b6d1c8e197d4ea4))
+- Update navigation header height ([#1212](https://github.com/block/buzz/pull/1212)) ([`6b5cf325`](https://github.com/block/buzz/commit/6b5cf325c2777f64696923cf5b1c1ffd4fdf82e2))
+- Improve global search ([#1195](https://github.com/block/buzz/pull/1195)) ([`5130a6a0`](https://github.com/block/buzz/commit/5130a6a0b60c56a5c31549d3d4e85b956e35a671))
+- Parse Typesense multi_search errors ([#1208](https://github.com/block/buzz/pull/1208)) ([`65ccb126`](https://github.com/block/buzz/commit/65ccb1262fb876b74584bca1165feef39eda67a6))
+- fix(desktop): keep settings shortcut from opening search ([#1204](https://github.com/block/buzz/pull/1204)) ([`89ff9504`](https://github.com/block/buzz/commit/89ff950444d03ea09eb54661a21f0cb96f0bfcb6))
+- Polish sidebar channel navigation ([#1213](https://github.com/block/buzz/pull/1213)) ([`c0a872e8`](https://github.com/block/buzz/commit/c0a872e898479bcb2c3dda1b642c0d1373174f68))
+- fix(desktop): restore channel unread badges ([#1218](https://github.com/block/buzz/pull/1218)) ([`89aaa264`](https://github.com/block/buzz/commit/89aaa26443486244b6f004a7c419f4e0dc86aa44))
+- Fix collapsed home header chrome overlap ([#1215](https://github.com/block/buzz/pull/1215)) ([`b4e75a1e`](https://github.com/block/buzz/commit/b4e75a1e41a614fa3449e814ccbd9f31090dfbfc))
+- fix(desktop): dedupe welcome intro per channel ([#1216](https://github.com/block/buzz/pull/1216)) ([`2a522826`](https://github.com/block/buzz/commit/2a522826edc6dfb4df79f34256beea6b8597505b))
+- fix(desktop): defer agent page secondary requests ([#1217](https://github.com/block/buzz/pull/1217)) ([`bee2d64c`](https://github.com/block/buzz/commit/bee2d64cf7f093088cc28463e96a6c94b64f280e))
+- ci(release): enable Tauri auto-updater on Windows and Linux builds ([#1206](https://github.com/block/buzz/pull/1206)) ([`3ef2a8e5`](https://github.com/block/buzz/commit/3ef2a8e5c7e655f3347931135dde5f65b919c915))
+- Hydrate reactions for rendered messages ([#1205](https://github.com/block/buzz/pull/1205)) ([`ed556f3d`](https://github.com/block/buzz/commit/ed556f3deb895e0adfa18274b3ed90f255b5f6ad))
+- fix(desktop): show NIP-OA owners in profile pane ([#1198](https://github.com/block/buzz/pull/1198)) ([`40070a58`](https://github.com/block/buzz/commit/40070a58559938ed649950ccabce0725dd3c966e))
+- fix(desktop): preserve login-shell PATH for managed agents ([#1193](https://github.com/block/buzz/pull/1193)) ([`29978b6f`](https://github.com/block/buzz/commit/29978b6f93cdd2c5d061093ddce87d567d8d4c17))
+- Fix nav chrome offset in fullscreen ([#1192](https://github.com/block/buzz/pull/1192)) ([`b3b0704e`](https://github.com/block/buzz/commit/b3b0704efb5afc74dca0a093a6e4594973e9edf4))
+- fix(desktop): show due-reminder count in the Inbox nav badge ([#1191](https://github.com/block/buzz/pull/1191)) ([`c0858dac`](https://github.com/block/buzz/commit/c0858dac12a3efd09d301f5424074f18df5cf422))
+
+
 ## v0.3.30
 
 - fix(desktop): collapse mark-read/unread menu into one toggling item ([#1188](https://github.com/block/buzz/pull/1188)) ([`ce994df74`](https://github.com/block/buzz/commit/ce994df74e60cf43b2fb0b97ea9989aacd47650e))