feat(agents): Harnesses Goose install (slice 3/5)

[salman1993]

Slice 3/5 — one-click Goose install

#277 (Harnesses card) and #272 (docs) have merged. This PR targets main. Settings → Agents → Harnesses offers Install for Goose CLI needed on macOS/Linux only; Windows keeps the status/hint but not the bash installer.

• Native goose_install IPC guards against concurrent installs; runs bash -o pipefail -c 'curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash' with scrubbed environment, a five-minute timeout and process-group teardown. It captures combined output in app-data agent-controller/goose-install.log (0600), returning a bounded tail and path on failure. HarnessSetup tracks the active process group and kills it on normal Quit, fencing late claims/spawns. The main-webview capability grants this IPC, while browser guests cannot use it.
• After install, native re-checks installed("goose"). Only enabled Goose agents whose prior start failed with Required runtime executable is missing are eligible for restart. The supervisor rechecks under the controller lock immediately before each restart; Stop/Edit/Start during download cannot re-enable an agent no longer waiting. Stopped/disabled/running agents and failures for other causes are not restarted.
• The installer has its own app-lifetime AgentControl lane, separate from agent writes: Stop remains usable during download and automatic restarts. Progress and the last result/log survive leaving and returning to Settings (but are not persisted across app restarts). On completion, control.refresh() re-detects via native snapshot after any older read or in-flight agent operation settles; the card displays progress, Ready/success/restart counts, or failure and the expandable log. A new attempt clears the previous report.

Command evidence: old Buzz desktop/src-tauri/src/managed_agents/discovery/catalog.rs:22 specifies the exact aaif-goose/goose URL above. The former block/goose URL redirects to the same release asset. Upstream's script installs to $HOME/.local/bin by default and skips goose configure with CONFIGURE=false. No docs were edited; the documented script and noninteractive behavior are unchanged. The approved upstream stable curl|bash trust model is deliberate, not a pin/checksum change in this PR.

Verification before restack (head b708ab48e4a0b86211498c35243f10434bc109d7)

• pnpm check, cargo fmt --all --check, cargo clippy -p buzz-foundation --all-targets -- -D warnings: passed.
• Native library tests: 85 passed / 3 intentionally ignored in a serial full-library run; agent-controller: 65 passed + 11 build-config passed / 1 ignored. A concurrent native run had unrelated intermittent host_command/terminal process tests fail under machine load; those passed in the serial run. New native tests use a local child, never the upstream installer.
• Focused Vitest (AgentSettings, control, control-native, AgentsPage): 138 passed. Browser agent-control, editor-grid and model journeys: 34 passed across Chromium and WebKit (--no-deps).
• Full Vitest: 3923 passed / 5 failed at this head. Three are the known inherited PluginImport, MessageRow, ProfileAgentIdentity failures fixed separately in test: repair three baseline Vitest failures #276 (not edited here); dev/vite-config.test.mjs timed out under load and NewMessage.test.tsx saw one extra request under load, then both affected files passed focused (25/25). The manually run repository pre-push group failed only inherited ProfileAgentIdentity (447 passed / 1 failed); its design group passed. The push used this worktree's existing global hook path after recording the failures. CI remains the source for the latest merged-tree status.
• An earlier manual disposable-HOME install verified the block/goose redirect's upstream script installs executable Goose 1.52.0 to $HOME/.local/bin without modifying the real user's installation; the disposable HOME was removed. The current native scrubbed-environment desktop install/restart, proxy, and Quit have not been hand-verified. Windows native runtime was not tested.

Integration update (head d4b1193597e11f7ab88cdd502a9389912a8a2592)

• Rebased the seven Goose installer commits onto main after feat(agents): Harnesses status card in Settings (slice 2/5, stacked on #272) #277 squash merged. The reviewer’s Quit serialization commit and all authors’ DCO trailers are preserved.
• bin/pnpm typecheck, focused Vitest (94 tests), the agent-control browser journey in Chromium and WebKit (28 tests), cargo fmt --all --check, and the repository pre-push group (552 related tests and design checks) passed.
• The serial native library suite passed (98 tests, 3 ignored). One parallel run failed in the unrelated load-sensitive host_command::tests::passes_exact_args_without_shell_interpretation; it passed in the serial run.
• Hosted CI, including JavaScript, Rust and tool integration, Chromium/WebKit journeys, browser measurements, DCO and static checks, passed on this head. The native desktop install, proxy, and Quit flows remain unverified by hand.

Hand-test before acceptance

1. With Goose missing, Install shows Installing Goose…, then Ready and a 0600 log in app-data.
2. An enabled Goose agent that failed to start due to the missing CLI restarts; stopped/disabled agents do not.
3. With network off, Install shows an alert with the log and can be retried.
4. An environment using HTTPS_PROXY can install.
5. Stop a running agent while the installer is pending; it must not re-enable from a late restart.
6. Leave Settings mid-install and return, before and after completion; progress/result/log persist.
7. Quit mid-install and confirm no installer process group remains.

Next slice

Slice 4 can reuse AgentHost/agents::start(..., Action::Restart, ...) and control.refresh()/snapshot wiring for native effective-settings restarts, but should compare changed effective settings before restarting running agents. Do not reuse the Goose-specific installer guard/log. The profile-editor fix belongs to #277, not this PR.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested. Reviewed head 9d3591e2b6dea539b614b53d061b9922a711fa01 against stacked base/merge-base 5b4b02e94666f5cfaa803367c8f219a1f0401a78, with complementary UI, installer-security, and restart/concurrency review. Findings and required fixes are inline.

Merge criteria: preserve recovery Stop throughout download/restarts and preserve install progress/result/logs across Settings navigation. Keep ownership in the existing app control/native setup owners; no new installation framework is needed. Include deferred-operation regressions for these transitions, plus a genuinely eligible missing-CLI agent before exercising restart/Stop fencing. The new native Stop test currently starts with an empty waiting list and therefore does not prove waiting → stopped recovery.

Validation: complete 13-file diff and relevant stack integration paths reviewed; pinned-range git diff --check passed. Hosted CI run 36173979013, merge f89e647 (this head into its stated base), has 3,921 Vitest passes and the three baseline failures repaired by #276. Rust/tool integration and Chromium/WebKit journeys passed; Windows validation was skipped. No local tests, builds, installers, native launches, or live workflows were run; author-reported isolated installation is not our native acceptance evidence. The tests do not exercise the real installer command/process teardown; normal-Quit cleanup is also unverified, and the existing app exit handlers do not explicitly stop HarnessSetup. Do not infer Quit cleanup from kill-on-drop alone. No accidental screenshot or generated review files appear in the diff.

The approved upstream stable curl|bash trust model is not a new finding. Native eligibility re-checks, start-ticket cancellation, and revision checks are coherent in source. The inherited #277 profile-editor finding stays on #277. The PR description is stale about the original URL, stopped-agent eligibility, and checks at its earlier commit; correct it without treating metadata as a separate merge blocker.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-25T23:13:54.400113Z	b708ab4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[wesbillman]

Star Lord’s automated source review via Wes’s GitHub account, with an independent native-lifecycle pass by Mantis.

Reviewed head b708ab48e4a0b86211498c35243f10434bc109d7 against stacked base/merge-base 5b4b02e94666f5cfaa803367c8f219a1f0401a78, focusing on the substantive follow-up from previously reviewed 9d3591e2b6dea539b614b53d061b9922a711fa01 and its integration with the full feature.

The two earlier P2 findings are addressed in source. Installation now has an independent control lane, so it no longer monopolizes recovery Stop during download/automatic restart waits. Progress, report, error and log stay with the existing app-owned control projection across Settings unmount/remount. Deferred-operation tests cover Stop, older reads, retry and navigation; the native Stop regression now establishes a genuinely eligible missing-Goose failure before stopping it. These tests were inspected, not executed.

One remaining P3, non-blocking correction is inline: the new normal-Quit hook handles an already tracked group, but spawning and recording that group are not atomic with shutdown. This is the remaining edge of the earlier Quit-cleanup finding, not a new installation framework or a request to revisit the approved upstream stable curl|bash trust model. No additional actionable defects were established in the reviewed follow-up. Ancestor #277/#272 issues remain with their owning PRs.

Validation limits: immutable pinned source and lifecycle callers inspected; 29 source extracts verified against Git blobs and SHA-256; pinned-range git diff --check passed. No tests, builds, installers, app/agent launches, credential operations or live workflows were run. The current-head hosted check snapshot shows JavaScript and CI required failed; Rust/tool integration, browser measurements, all four Chromium/WebKit journey shards, DCO and security checks passed; Windows validation was skipped. See CI run 36183982972. I did not inspect failure logs or establish their cause; the PR’s reported local passes/failures are author evidence, not checks rerun here. Current native scrubbed-environment installation/restarts, proxy behavior and actual Quit cleanup still need acceptance evidence.

This is a COMMENT review only—not approval, a blocking review, CI-green readiness or merge authorization. No prior review was dismissed.