From 3dfee163660c64670bba6d4505c3f4eee05cfa84 Mon Sep 17 00:00:00 2001
From: Albert Lee <albertleecs322@gmail.com>
Date: Tue, 4 Aug 2026 11:15:29 +0800
Subject: [PATCH 1/2] fix(desktop): allow bot channel members in mention picker
 from any device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

isAgentIdentityInManagedList was filtering out bot-role channel members
that aren't in the local managedAgentPubkeys set. On non-host devices this
set is empty, so every agent in the channel was silently dropped before
shouldHideAgentFromMentions could run — which already correctly gates on
invocability (respondTo=anyone + shared channel).

Fix: pass through candidates where isMember === true so shouldHideAgentFromMentions
handles the invocability decision, not a blanket local-ownership check.

Signed-off-by: Albert Lee <albertleecs322@gmail.com>
---
 .../agents/lib/agentAutocompleteEligibility.test.mjs     | 9 +++++++++
 .../features/agents/lib/agentAutocompleteEligibility.ts  | 3 ++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs b/desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs
index 4e02b7bd68..a0c945a20e 100644
--- a/desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs
+++ b/desktop/src/features/agents/lib/agentAutocompleteEligibility.test.mjs
@@ -160,6 +160,15 @@ test("isAgentIdentityInManagedList: keeps people and only current managed agent
     ),
     false,
   );
+  // Bot channel members from other devices are not locally managed but should
+  // pass through so shouldHideAgentFromMentions can gate on invocability.
+  assert.equal(
+    isAgentIdentityInManagedList(
+      { isAgent: true, isMember: true, pubkey: PUB_B },
+      managedAgentPubkeys,
+    ),
+    true,
+  );
 });
 
 test("shouldHideAgentFromMentions: never hides non-agents", () => {
diff --git a/desktop/src/features/agents/lib/agentAutocompleteEligibility.ts b/desktop/src/features/agents/lib/agentAutocompleteEligibility.ts
index e4afe7fea4..28e742a4f1 100644
--- a/desktop/src/features/agents/lib/agentAutocompleteEligibility.ts
+++ b/desktop/src/features/agents/lib/agentAutocompleteEligibility.ts
@@ -55,11 +55,12 @@ export function getMentionableAgentPubkeys({
 }
 
 export function isAgentIdentityInManagedList(
-  candidate: { isAgent?: boolean; pubkey: string },
+  candidate: { isAgent?: boolean; isMember?: boolean; pubkey: string },
   managedAgentPubkeys: ReadonlySet<string>,
 ) {
   return (
     candidate.isAgent !== true ||
+    candidate.isMember === true ||
     managedAgentPubkeys.has(normalizePubkey(candidate.pubkey))
   );
 }

From 14f3350667eb33c830c7c5825f9c10439d856c2b Mon Sep 17 00:00:00 2001
From: Albert Lee <albertleecs322@gmail.com>
Date: Tue, 4 Aug 2026 15:52:54 +0800
Subject: [PATCH 2/2] ci: add windows fork build workflow for patch testing

Signed-off-by: Albert Lee <albertleecs322@gmail.com>
---
 .github/workflows/windows-fork-build.yml | 64 ++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/windows-fork-build.yml

diff --git a/.github/workflows/windows-fork-build.yml b/.github/workflows/windows-fork-build.yml
new file mode 100644
index 0000000000..85052c259b
--- /dev/null
+++ b/.github/workflows/windows-fork-build.yml
@@ -0,0 +1,64 @@
+name: Windows Fork Build
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build Windows (patched)
+    runs-on: windows-latest
+    timeout-minutes: 90
+    env:
+      TARGET: x86_64-pc-windows-msvc
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Add Rust target
+        shell: bash
+        run: rustup target add "$TARGET"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.14.1
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11.4.0
+
+      - name: Install dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile
+
+      - name: Create sidecar stubs
+        shell: bash
+        run: |
+          mkdir -p desktop/src-tauri/binaries
+          for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do
+            touch "desktop/src-tauri/binaries/${bin}-${TARGET}.exe"
+          done
+          touch "desktop/src-tauri/binaries/buzz-backend-kubernetes-${TARGET}.exe" || true
+
+      - name: Build Windows NSIS installer
+        shell: bash
+        run: cd desktop && pnpm tauri build --target "$TARGET" --bundles nsis
+        env:
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+
+      - name: Locate installer
+        id: artifact
+        shell: bash
+        run: |
+          EXE=$(find desktop/src-tauri/target/${TARGET}/release/bundle/nsis -name '*.exe' | head -1)
+          echo "exe=$EXE" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: buzz-windows-patched
+          path: ${{ steps.artifact.outputs.exe }}
+          if-no-files-found: error
+          retention-days: 14