Per-account local workspace file leaks agent roster & relay info across communities
- Dominant language
- Rust
- Stars
- 32.7k
- Forks
- 4.3k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 253
Description
On a single Buzz account with multiple communities (e.g. a personal community and a separate business community), the local on-disk workspace directory is shared across all of that account's communities — including the file that lists active agents and workspace info (`AGENTS.md`).
Actual channel membership is correctly scoped: calling the channel-members endpoint for a given channel only returns the bots actually added to that specific channel.
However, the shared workspace file lists the *full* agent roster from every community under the account, not just the current one, and its documented relay differs from the relay the current session is actually connected to (each community appears to connect via its own relay subdomain, e.g. `.communities.buzz.xyz`). Several agent entries also appear duplicated in the roster table, consistent with the file being appended to by multiple communities without deduplication.
**Expected:** the local workspace file (or equivalent) should be scoped per-community, or at minimum clearly label which community each roster entry/relay reference belongs to.
**Actual:** roster and relay info from one community bleeds into another community's workspace file on the same account — likely also surfacing in Desktop's agent list/picker UI, which is confusing when a user has more than one community.
Contributor guide
Research direction
Start with the per-account workspace directory and AGENTS.md, then trace how the active-agent roster and relay information are assembled for each community. Check the Desktop agent list/picker as well as the channel-members endpoint behavior. Done means one community's workspace and UI show no other community's agents or relay, with duplicate roster entries removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100