refactor(probe): decide what sessions may do through a session policy

Closed
WI
10d ago
+274-258

The messaging core decides what a session may do on its own through one seam, SessionPolicy on Plugins.session_policy, asked in messaging terms. It knows nothing of uploads, sharing modes or installs.

Messaging decisionSessionPolicy method
Discovery's automatic join (relay::admission::admit)admitted(core, targets): which sessions may join the relay by themselves
The SessionStart join prompt (setup/policy.rs)may_ask_to_join(): whether a chat not on the relay may be asked to join, or None when the policy cannot say
Activity publicationpublishes_activity(targets): which sessions may say what they are doing

A core without a session policy lets every session join by itself, asks none to join and publishes no activity, as a core without an uploader did.

What leaves the core's control

  • AccountPlugin no longer hands out the uploader: uploader(), shared_uploads() and looked_for_install() are gone.
  • The core's watchers no longer start session-history work. relay_uploads::refresh_snapshots(core, uploader) (the background status refresh) and session_naming::watch(core, uploader) (naming agents from their prompts) take the uploader, for the build that owns it to start.
  • Admission and admit live in the messaging module relay::admission. relay_uploads::UploaderPolicy { uploader, uploads } is the policy the uploader's sharing makes: it admits what the install uploads, asks to join only under selected sharing (the attached install first, then the uploader's last status), and publishes the sessions shared with the workspace.
  • TestAccount holds no uploader.

This is the first step toward a messaging-only core. Every remaining tie to session history is now code the desktop drives (the uploader, relay_uploads, session naming), so that code can move to relay-desktop's desktop-core and the history feature can leave crates/probe.

relay-desktop's desktop-core needs a matching change when it moves its pin: set plugins.session_policy to an UploaderPolicy, start refresh_snapshots and session_naming::watch with its uploader, and drop the three removed AccountPlugin methods.

Tested: cargo test --locked (default features) and --no-default-features --features production-binaries, plus --no-default-features --features history builds.

🤖 Generated with Claude Code

Agent Relay sessions

  • claude session b881bd94 · opened via gh pr create · last active 2026-11-03