Connect participants can't get presence: /v1/agents rejects agent tokens; /v1/agents/presence shows REST-heartbeating agents offline #535

Relay Connect guests use Relaycast only through their own participant (agent) token. They cannot read a roster with correct presence, so connect status reports every participant's presence as unknown (desktop probe) or as offline.

Repro (2026-10-12, live, a throwaway Connect ended right after):

1. Join a Connect: POST https://agentrelay.com/cloud/connect/{id}/join. Use the returned participant.token against participant.relay_base_url (https://cast.agentrelay.com).
2. GET /v1/agents?status=all with Authorization: Bearer <participant token> returns 401 {"code":"unauthorized","message":"Workspace key required (rk_live_...)"}. The route is requireWorkspaceRead('agents:read', { allowAgent: false, allowNode: false }) in packages/engine/src/routes/agent.ts, so this is deliberate.
3. GET /v1/agents/presence with the same token returns 200 and both participants. Both are "status":"offline", including:
   • the guest itself, immediately after POST /v1/agents/heartbeat answered 200;
   • the hosted (MCP) host, which was active.

Questions / ask

• Should a REST heartbeat (POST /v1/agents/heartbeat) make getPresence report the agent online? getPresence uses presence.getOnline(workspaceId). It looks as if only WebSocket-connected agents count, but I haven't verified that. The probe and the @agent-relay/connect Node relay both heartbeat over REST every 30 s and never open a WebSocket for Connect.
• If REST heartbeats count, /v1/agents/presence is the participant-scoped roster clients should use, and /v1/agents can keep refusing agent tokens.
• If not, Connect clients need either a REST-heartbeat-aware presence or an agent-token-readable roster that includes status.

Client side: AgentWorkforce/relay-desktop issue (linked below), plus the paused Node relay AgentWorkforce/relay#1968, which hit the same 401.

🤖 Generated with Claude Code