Open Buzz Agent Library.
HiveBuzz is a small, login-free library for portable Buzz Agent Snapshots
(.agent.json or .agent.png). It deliberately has one artifact type and one
job: review exact bytes before handing a stopped agent to Buzz Desktop.
- Live library: hivebuzz.xyz
- Contribute an agent: CONTRIBUTING.md
- Upstream Buzz project: block/buzz
The product does three things: lists curated releases, verifies the selected artifact locally, and hands the exact bytes to the user. It does not create an account, connect a wallet, or install anything in the background.
- Every handoff checks the catalog SHA-256 and byte size in the browser.
- Agent Snapshot checks reject plaintext memory, source-environment allowlists, remote avatar beacons, unknown fields, private keys, common secret patterns, and bundled executable capabilities.
- External artifact URLs are never fetched automatically. The user downloads and selects the file, preventing local-network and redirect probing.
- A verified download is still stopped data. Buzz provides the final import preview and activation decision.
- Download counts are aggregate activity only. HiveBuzz stores no user, public-key, cookie, device, or per-download event record. Counts are not a rank, endorsement, or safety score and can be gamed. Short-lived in-memory request limits and a release-level D1 write budget bound counter abuse without creating a persistent visitor identity.
- Choose an Agent release and select Get agent.
- Wait for the exact file to pass local checks and review the warning.
- Download the verified
.agent.jsonor.agent.png. - Drag it into Buzz Desktop's Agents page, review Buzz's import preview, and confirm. Buzz creates a fresh local identity; private state is not included.
HiveBuzz does not emit an unsupported deep link or silently bridge into a logged-in Desktop or CLI session.
The ready-agent directory contains 24 deliberately narrow, memory-free examples, with three agents in each work category:
| Category | Agents |
|---|---|
| Research | Quiet Researcher, Evidence Mapper, Option Comparator |
| Development | Code Reviewer, Spec Auditor, Bug Triage |
| Design | UX Flow Reviewer, Reader Tester, Accessibility Reviewer |
| Operations | Meeting Synthesizer, Decision Recorder, Handoff Builder |
| Data | Data Explainer, Metric Auditor, Experiment Reviewer |
| Marketing | Draft Polisher, Claim Guard, Content Brief Builder |
| Security | Threat Modeler, Prompt Safety Reviewer, Privacy Mapper |
| Personal | Study Coach, Next Step Planner, Decision Companion |
Every active agent uses explicit Role, Scope, Workflow, Evidence, Output,
Authority, and Stop sections. Each also has normal, missing-context, and
prompt-injection contract cases under tests/agent-prompts.test.ts. These tests
validate the portable prompt boundary; model behavior still requires review in
the selected Buzz harness.
Buzz itself ships broader starter personalities such as Fizz, Honey, and Bumble. HiveBuzz does not duplicate those built-ins; its examples are narrower artifacts intended to demonstrate safe public sharing. See the official Buzz persona source.
Open the site's Submit agent page for the no-code path. It scans the file locally, generates a SHA-256 receipt, and opens a public GitHub review request. The site never uploads the selected file.
The contribution path is deliberately source-reviewed instead of an anonymous write API:
- Export Agent only from Buzz Desktop with memory set to None.
- Run the local scanner or the site handoff against the exact artifact.
- Declare one primary work-domain category, a public GitHub repository, and the full source commit SHA.
- Open the review from the declared GitHub publisher account. Organization repositories require public approval from an organization maintainer.
- Add the immutable artifact and one bounded definition in
catalog/agent-definitions.ts, then runnpm run catalog:generate. - Submit the snapshot and scan receipt through the GitHub issue form, or open a pull request using CONTRIBUTING.md.
This keeps the public site focused on discovery and safe handoff while avoiding a HiveBuzz account system, Nostr signing risk, anonymous publication, and a spam-ready write API. Identity is required only at the publishing edge; browsing and downloads remain open.
The published GitHub account, or a maintainer of its declared source repository, can open the withdrawal form. HiveBuzz verifies that control against the original publisher and pinned source, then removes the listing and hosted artifact. Vulnerabilities, exposed secrets, and private data must use a private security advisory, not a public issue.
Withdrawal stops future HiveBuzz distribution. It cannot recall prior downloads, forks, browser caches, or Git history.
HiveBuzz source code is licensed under the Apache License 2.0. See NOTICE for attribution.
Agent snapshots and other third-party artifacts remain subject to the license declared by their publisher. Listing or distributing an artifact through HiveBuzz does not relicense it under the HiveBuzz project license.
Apache-2.0 does not grant permission to use the HiveBuzz name or logo to imply endorsement.
npm install
npm run devValidation:
npm run lint
npm run performance:check
npm test
npm auditCatalog generation is deterministic. Edit catalog/agent-definitions.ts, run
npm run catalog:generate, and commit the generated catalog and instruction
preview files together with the exact snapshot artifact.
Performance benchmark:
npm run build
npm run benchmark -- --label=current --output=benchmarks/current.jsonSee benchmarks/README.md for the checked before and after snapshots, methodology, byte budgets, and production baseline.
The deployable catalog is bundled from reviewed source. D1 stores one aggregate download count per release; catalog reads query only those counters and merge them into the immutable server catalog. Schema changes run through migrations, and the release rows needed by the guarded counter write are synchronized only when the catalog content version changes.