Add verified arelay.to agent profile pages

[khaliqgant]

Summary

• add dynamic profile pages at agentrelay.com/u/<handle>, reached from arelay.to/<handle> through the router
• add a per-handle /u/<handle>/agent.md guide that loads the verified registry profile, mints a fresh conversation, and uses the registered display name and https://arelay.to/<handle> base URL
• reuse the file-based curl --data-binary @file snippet from feat(agent-relay): /u/<handle> pages, curl-friendly agent guide, file-based messages #150 for every handle; no here-doc or third-party reply text enters shell source
• show the registered description and verified-domain badge, with a clear 410/no-snippet state for suspended profiles
• validate and cap registry responses, preserve true 404s for malformed/unknown handles, and keep profiles and conversation IDs uncached

Tests

• npm --workspace web test (422/422)
• npm --workspace web run build (Next production build emits ƒ /u/[handle] and ƒ /u/[handle]/agent.md)

This PR is stacked after #151 and should deploy only after the relay-agent registry API and router registry routes. No deploy, merge, secret, or production changes were performed.

---

Note

Medium Risk
New server-side dependency on the public agent registry and user-facing chat URLs per handle; suspended/invalid profile handling and name normalization affect what agents see in pasted snippets.

Overview
Adds dynamic verified-agent landing pages at /u/<handle> that load public registry profiles, show description and a verified-domain badge, and render a per-visit chat snippet (or a suspended/unavailable message with no snippet when status is not active).

Introduces /u/<handle>/agent.md, which returns the same file-based curl --data-binary @file agent guide with a fresh conversation ID and conversation base URL derived from the handle (agentChatUrlForHandle), plus strict no-store response headers.

Registry client (agent-registry) validates handle format, fetches arelay.to/api/v1/agents/<handle> with timeouts and bounded JSON parsing, and maps 404 to “not found” while surfacing other errors.

Chat snippet/guide text is generalized so non–Agent Relay handles are labeled as registered/verified agents (with normalized display names and handle-based identity checks so a spoofed “Agent Relay” name does not get official setup copy). The existing Agent Relay page gains a verified badge; shared CSS adds badge and suspended styles.

Tests cover registry fetching, snippet URL/name behavior, and the new markdown route (200 with minted conversation vs 410 for suspended).

^{Reviewed by Cursor Bugbot for commit 156e671. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Agent Relay sessions

• claude session a4302a83 · contributor · ran gh pr commands · last active 2026-10-08

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T00:36:14.555723Z	8b4d084	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 24875b20-9aa0-44b7-ade9-1a8962dbe0bc

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 4 potential issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b4d084343

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Stale Bugbot comment from a previous run.

[github-actions]

Preview deployed!

Environment	URL
Web	https://96724e76-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.

[cubic-dev-ai]

4 issues found across 7 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="web/lib/agent-registry.ts">

<violation number="1" location="web/lib/agent-registry.ts:38">
P3: The size cap only runs after `response.text()` has buffered the whole body, so it does not bound memory when `content-length` is absent (e.g. chunked transfer). A misbehaving registry that streams a large profile without a length header is fully read into memory before being rejected; only the pre-check on the declared `content-length` header limits bytes upfront.</violation>
</file>

<file name="web/app/[handle]/page.tsx">

<violation number="1" location="web/app/[handle]/page.tsx:67">
P3: Suspended profiles render the "✓ verified <domain>" badge and the "Chat with <name>" heading even though the profile is inactive. The badge is outside the `profile.status === 'active'` conditional, so the page simultaneously claims the domain is verified and that "domain verification is no longer current."</violation>

<violation number="2" location="web/app/[handle]/page.tsx:72">
P3: This hardcodes the conversation origin and bypasses the existing `NEXT_PUBLIC_AGENT_CHAT_URL` override that `agentChatSnippet` and the `/agent-relay` page honor. A build pointed at another origin (staging/preview, per the env-var contract in web/lib/agent-chat-snippet.ts) will still mint handle-page links into production arelay.to, unlike the `/agent-relay` snippet which follows the override.</violation>

<violation number="3" location="web/app/[handle]/page.tsx:72">
P2: Pass `profile.displayName` through `AgentChatSnippet` into the generated snippet; copied instructions currently tell the user's agent to chat with Agent Relay for every registered profile.</violation>
</file>

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fa5df22. Configure here.}