Linux support for live development

[MajorTal]

Live development only worked on macOS. Two reasons, both in dev/.

1. dev/relay-broker.mjs read the Buzz credential only via the macOS security tool. Buzz desktop keeps the same blob (service buzz-desktop, username secrets) in the freedesktop secret service on Linux. The broker now reads it there with secret-tool. Same checks as before: pin validated first, OS store is the only source, mismatch refused, empty read fails closed, no file or env fallback. Other platforms get a clear error before any reader runs.
2. dev/agent-library.mjs hard-coded the macOS app-data path, so Agents showed "Could not read the current Buzz agent library" on Linux. It now resolves the Tauri app-data dir like the dirs crate does: Library/Application Support on macOS, XDG_DATA_HOME on Linux when absolute, otherwise ~/.local/share. Still read-only. Nothing for other platforms.

README and docs/agents.md updated. Linux needs libsecret-tools.

Review round 1 (Carl): the identity suite under src/features/communities/ asserted the macOS command without pinning the platform and failed on the Ubuntu runner. Fixed in the third commit: every case pins process.platform, macOS assertions kept, Linux asserts its command and sanitized failure text, unsupported platforms are refused without touching a reader. XDG relative values now fall back like Tauri, with a test. Windows branch removed.

Tested on macOS (Apple Silicon), head of this branch:

• pnpm check: clean.
• pnpm exec vite build: ok.
• pnpm exec vitest run: 147 files, 1561 tests pass, including the platform-pinned identity cases for darwin, linux, win32 and freebsd.
• Live dev loop on this Mac unchanged.

Linux (Ubuntu x86_64, Buzz desktop signed in): before the change, just web failed with Keychain read unavailable or declined and Agents showed the "Could not read" notice. After the fix, both work: broker logs signing as …, community opens, Agents lists the library.

Full Vitest on that Linux machine at this head: pnpm exec vitest run --no-file-parallelism: 147 files, 1561 tests pass. With default parallelism the same laptop trips five to six timing cases in unrelated files (pages.integration, read-state, typing, unread-startup, one 490 ms wall-clock check in relay-broker-api); each passes in isolation and they all passed on the hosted Ubuntu runner on the previous head. That is machine capacity, not this change; nothing was retried or given a longer budget.

Not covered: Windows has no credential reader, so live development there still fails at the identity step with the platform message. Flatpak/Snap data dirs not handled.

🤖 Generated with Claude Code

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed head 7f49154a56114744591f04d8cb9f89bf75ce9ab0 against base a9194b24a3cc208abf6f9a9a05eed77583e6c0fa.

P2: update the identity tests for the new platform-dependent reader

The new Linux selection in dev/relay-broker.mjs:167–188 breaks the existing required Ubuntu JavaScript test gate:

• broker-identity.test.ts:99–109 has three parameterized cases that require /usr/bin/security and its macOS arguments, without controlling process.platform. Linux now calls secret-tool with different arguments.
• broker-identity.test.ts:137–145 requires the macOS read-failure text; Linux now correctly throws the new Secret Service error.
• The JavaScript CI job runs the full Vitest suite on ubuntu-24.04. The PR's vitest run dev validation excludes this test file under src/.

Reproduction: the unchanged head passes all 1,553 Vitest tests on macOS. Running that same full suite with an external Vite pre-transform selecting only the broker's Linux platform branch produces exactly these four failures: 1,549 pass, 4 fail. This is a deterministic Linux-branch simulation on macOS, not a claim of a native Linux run; the credential subprocess remains mocked by the existing tests.

Smallest repair: explicitly control/parameterize the platform in the existing identity suite. Preserve macOS coverage and assert Linux's exact command/arguments and sanitized read error, while retaining invalid-pin-before-access, mismatch, malformed-credential, and production-build refusal coverage. Cover unsupported-platform refusal without invoking a credential reader. Do not skip these tests on Linux. Then run the complete Vitest suite on Ubuntu; no production abstraction is needed to fix this regression.

P3, non-blocking: match Tauri's relative-XDG fallback

dev/agent-library.mjs:70–74 accepts any nonempty XDG_DATA_HOME. For XDG_DATA_HOME=relative, this reads relative/xyz.block.buzz.app/agents/managed-agents.json under the dev-server working directory. Installed Buzz uses Tauri app_data_dir() → dirs::data_dir(), which ignores nonabsolute XDG values and falls back to $HOME/.local/share. The adapter can therefore report an unavailable library while installed Buzz reads it normally. I independently checked the producer chain and reproduced the different paths.

Honor XDG only when absolute and add a relative-value regression. This is a small compatibility correction, not a request for another path abstraction. Because it requires invalid XDG configuration, I am not treating it as a separate merge blocker.

Scope and validation notes

This is a small development-platform extension/portability fix: Linux can use its OS-held Buzz identity and installed agent library. It does not alter packaged sign-in, production UI, protocol, dependencies, or agent management. Public-pin validation, mismatch refusal, host-only keys and read-only library projection remain in place.

The Windows %APPDATA% branch in installedBuzzDataDir is an unnecessary scope extra: the live broker still refuses Windows before its default library reader can run. Prefer omitting that branch/test from a strictly Linux-only fix, or explicitly treating it as deferred parity. This is non-blocking, not a hidden shipped Windows feature.

Hosted application CI is currently action_required, not a completed pass: https://github.com/block/buzz-app/actions/runs/35328217343 . Successful security/DCO checks do not establish application validation. No CI approval/rerun, GitHub approval, or merge was performed. Live Linux secret-service acceptance was reported by the author, not independently exercised in this review.