I ship a product (Vibewatch) that gives customers a pre-made .agent.png snapshot to set up our agent in Buzz. Setup today: download the file, open Buzz, My agents > Import snapshot, pick the file. Works fine, but I'd love to put a one-click "Add to Buzz" button on our side instead.
Proposal:
buzz://import-agent?url=<https-url>&sha256=<hex>
Buzz fetches the snapshot from the url using the same bounded sha256-verified fetch the in-chat snapshot cards use, then routes the bytes into the existing import preview. The user still reviews and confirms in the app, so the trust model is the same as importing a downloaded file. Non-https urls and hash mismatches get rejected.
All the pieces are already there (buzz:// deep links, the verified fetch, the import preview), this just wires a new deep link kind into them.
Closest existing issue I found is #2624, which is the same import path from the CLI instead of a url.
Happy to build this as a PR if the approach sounds right.
I ship a product (Vibewatch) that gives customers a pre-made
.agent.pngsnapshot to set up our agent in Buzz. Setup today: download the file, open Buzz, My agents > Import snapshot, pick the file. Works fine, but I'd love to put a one-click "Add to Buzz" button on our side instead.Proposal:
buzz://import-agent?url=<https-url>&sha256=<hex>Buzz fetches the snapshot from the url using the same bounded sha256-verified fetch the in-chat snapshot cards use, then routes the bytes into the existing import preview. The user still reviews and confirms in the app, so the trust model is the same as importing a downloaded file. Non-https urls and hash mismatches get rejected.
All the pieces are already there (buzz:// deep links, the verified fetch, the import preview), this just wires a new deep link kind into them.
Closest existing issue I found is #2624, which is the same import path from the CLI instead of a url.
Happy to build this as a PR if the approach sounds right.