Skip to content

fix(desktop): lock internal agents to owner access #2537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
brow wants to merge 7 commits into from
Closed

fix(desktop): lock internal agents to owner access #2537

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f0173c0
fix(desktop): lock internal agents to owner access
Jul 23, 2026
7f7c3c7
fix(desktop): explain locked internal agent access
Jul 24, 2026
d89b694
fix(desktop): avoid internal welcome agent churn
Jul 24, 2026
16d52d4
Merge remote-tracking branch 'origin/main' into quietly/internal-owne…
Jul 24, 2026
ec4c3ec
Merge origin/main into quietly/internal-owner-only
Jul 31, 2026
f45e8e8
fix(desktop): clamp internal agent access for every backend
Jul 31, 2026
8cad3aa
fix(desktop): clamp stale managed agent projections
Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix(desktop): lock internal agents to owner access 
Co-authored-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz>
Signed-off-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz>
  • Loading branch information
7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm
7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz authored and npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm committed Jul 23, 2026
commit f0173c0b4326880251ab388a2fbb35ef78d348c2
15 changes: 11 additions & 4 deletions desktop/scripts/check-file-sizes.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,9 @@ const overrides = new Map([
// ratcheting 1443 -> 1295. Queued to split further in the A2 fold.
// global-agent-config: resolve_deploy_model_provider + visibility exports
// add ~40 lines on top of the 1A.1 ratchet. Queued to split.
["src-tauri/src/commands/agents.rs", 1340],
// internal-owner-only: create-time policy normalization adds a small
// security boundary while keeping OSS respond-to behavior unchanged.
["src-tauri/src/commands/agents.rs", 1349],
// agent-lifecycle-fixes: cascade-delete in delete_persona restructured into
// 3-phase (stage/stop/commit) + commit_cascade_agents injectable helper for
// retry-safety. Load-bearing reviewer-required change; queued to split.
Expand Down Expand Up @@ -118,7 +120,8 @@ const overrides = new Map([
// receipts (write_agent_runtime_receipt atomic JSON + remove/read_all
// helpers) replace the pubkey-keyed PID file, plus the hashed pair-scoped
// runtime log path. Load-bearing crash-recovery surface; queued to split.
["src-tauri/src/managed_agents/storage.rs", 1383],
// internal-owner-only: persistence choke point normalizes local agent access.
["src-tauri/src/managed_agents/storage.rs", 1386],
// harness-persona-sync: persona-runtime resolution threaded into the spawn
// path here. Load-bearing feature growth; queued to split in the resolver
// unify refactor followup. +26 for resolve_effective_prompt_model_provider
Expand All @@ -131,7 +134,9 @@ const overrides = new Map([
// record_provider param + applies persona_field_with_record_fallback. +5 lines.
// global-agent-config: spawn_agent_child loads global config and merges as
// lowest env layer (+8 lines). Queued to split.
["src-tauri/src/managed_agents/runtime.rs", 2216],
// internal-owner-only: runtime authorization normalization protects stale
// or hand-edited records before spawning an internal managed agent.
["src-tauri/src/managed_agents/runtime.rs", 2228],
// config-bridge setup-payload env-boundary fix adds readiness wiring in
// spawn_agent_child; load-bearing security fix, queued to split.
["src-tauri/src/managed_agents/config_bridge/reader.rs", 1016],
Expand Down Expand Up @@ -541,7 +546,9 @@ const overrides = new Map([
// isRuntimeAutoSeededRef tracking for edit-mode seeding (Fizz shows models);
// runtimeSupportsLlmProviderSelection guard on discovery provider (codex fix);
// hideProviderIds computation for Databricks v1 gate. Queued to split.
["src/features/agents/ui/AgentDefinitionDialog.tsx", 1035],
// internal-owner-only: queries the backend policy so the internal build can
// hide definition-level access controls while OSS keeps them configurable.
["src/features/agents/ui/AgentDefinitionDialog.tsx", 1043],
]);

await runFileSizeCheck({
Expand Down
7 changes: 7 additions & 0 deletions desktop/src-tauri/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,15 @@ fn main() {
println!("cargo:rerun-if-env-changed=BUZZ_BUILD_RELAY_RECONNECT_CMD");
println!("cargo:rerun-if-env-changed=BUZZ_BUILD_OBSERVER_ARCHIVE_DEFAULT");
println!("cargo:rerun-if-env-changed=BUZZ_BUILD_AGENT_METRIC_ARCHIVE_DEFAULT");
println!("cargo:rerun-if-env-changed=BUZZ_BUILD_INTERNAL");
println!("cargo:rustc-check-cfg=cfg(buzz_updater_enabled)");

// Explicit distribution identity. Internal packaging sets this presence-only
// marker; OSS/custom builds remain public regardless of baked defaults.
if std::env::var("BUZZ_BUILD_INTERNAL").is_ok() {
println!("cargo:rustc-env=BUZZ_DESKTOP_BUILD_INTERNAL=1");
}

if let Ok(relay_url) = std::env::var("BUZZ_RELAY_URL") {
println!("cargo:rustc-env=BUZZ_DESKTOP_BUILD_RELAY_URL={relay_url}");
}
Expand Down
33 changes: 11 additions & 22 deletions desktop/src-tauri/src/commands/agent_models.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -767,6 +767,12 @@ async fn discover_databricks_models(
}))
}

/// Return whether this build enforces owner-only managed-agent access.
#[tauri::command]
pub fn agent_access_owner_only() -> bool {
crate::managed_agents::internal_build()
}

/// Update mutable fields on an existing managed agent record.
///
/// Does NOT auto-restart the agent. Runtime config changes (system prompt,
Expand Down Expand Up @@ -874,28 +880,11 @@ pub async fn update_managed_agent(
record.relay_mesh = Some(crate::managed_agents::RelayMeshConfig { model_ref });
}

// Inbound author gate: merge patch onto current values, then validate
// the merged state. This lets a single update switch to Allowlist AND
// supply pubkeys atomically.
let prospective_mode = input.respond_to.unwrap_or(record.respond_to);
let prospective_allowlist = match input.respond_to_allowlist.as_ref() {
Some(list) => crate::managed_agents::validate_respond_to_allowlist(list)?,
None => record.respond_to_allowlist.clone(),
};
if prospective_mode == crate::managed_agents::RespondTo::Allowlist
&& prospective_allowlist.is_empty()
{
return Err(
"respond-to mode 'allowlist' requires at least one pubkey in the allowlist"
.to_string(),
);
}
record.respond_to = prospective_mode;
// Preserve the persisted allowlist across mode toggles — only replace
// when the caller explicitly supplied a new list.
if input.respond_to_allowlist.is_some() {
record.respond_to_allowlist = prospective_allowlist;
}
crate::managed_agents::apply_update_access(
record,
input.respond_to,
input.respond_to_allowlist.as_deref(),
)?;

record.updated_at = now_iso();

Expand Down
24 changes: 7 additions & 17 deletions desktop/src-tauri/src/commands/agents.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,22 +578,12 @@ pub async fn create_managed_agent(
}
crate::managed_agents::validate_user_env_keys(&input.env_vars)?;

// Validate & normalize the respond-to allowlist BEFORE any side effects.
// The harness has its own validator (buzz-acp/src/config.rs) but we want
// to catch malformed input at the boundary so the agent never tries to
// start with a list that will crash it on launch. The mode/allowlist
// pairing (and the definition-default fallback) is resolved later at the
// mint site via `resolve_mint_behavioral_defaults`, where the linked
// definition is in hand.
let respond_to_allowlist =
crate::managed_agents::validate_respond_to_allowlist(&input.respond_to_allowlist)?;
if input.respond_to == Some(crate::managed_agents::RespondTo::Allowlist)
&& respond_to_allowlist.is_empty()
{
return Err(
"respond-to mode 'allowlist' requires at least one pubkey in the allowlist".to_string(),
);
}
let (requested_respond_to, respond_to_allowlist) =

@square-tomb square-tomb Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified the round-1 subtlety is now doubly protected: resolve_create_access returns an explicit Some(OwnerOnly) for internal local creates (overriding any definition default in resolve_mint_behavioral_defaults), AND definitions themselves are normalized to None in internal builds — so the mint can no longer inherit a widened definition default through either route.

crate::managed_agents::resolve_create_access(
&input.backend,
input.respond_to,
&input.respond_to_allowlist,
)?;

// Snapshot the workspace owner pubkey for the legacy-record auth_tag
// fallback. Computed outside the records lock to keep lock ordering simple.
Expand Down Expand Up @@ -817,7 +807,7 @@ pub async fn create_managed_agent(
// point for definition behavioral strings — fails loudly on a bad
// mode/range instead of minting an agent the author didn't describe.
let minted = crate::managed_agents::resolve_mint_behavioral_defaults(
input.respond_to,
requested_respond_to,
respond_to_allowlist.clone(),
input.parallelism,
linked_persona.as_ref(),
Expand Down
10 changes: 9 additions & 1 deletion desktop/src-tauri/src/commands/personas/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ pub async fn create_persona(
updated_at: now,
};
apply_persona_behavior(&mut persona, input.behavior)?;
crate::managed_agents::normalize_definition_access(&mut persona);
personas.push(persona.clone());
save_personas(&app, &personas)?;
retain_persona_pending(&app, &state, &persona);
Expand Down Expand Up @@ -197,6 +198,7 @@ pub async fn update_persona(
persona.env_vars = env_vars;
}
apply_persona_behavior(persona, input.behavior)?;
crate::managed_agents::normalize_definition_access(persona);
persona.updated_at = now_iso();

let result = persona.clone();
Expand Down Expand Up @@ -815,9 +817,14 @@ fn apply_inbound_persona(personas: &mut Vec<AgentDefinition>, inbound: AgentDefi
local.respond_to = inbound.respond_to;
local.respond_to_allowlist = inbound.respond_to_allowlist;
local.parallelism = inbound.parallelism;
crate::managed_agents::normalize_definition_access(local);
local.updated_at = inbound.updated_at;
}
None => personas.push(inbound),
None => {
let mut inbound = inbound;
crate::managed_agents::normalize_definition_access(&mut inbound);
personas.push(inbound);
}
}
}

Expand Down Expand Up @@ -859,6 +866,7 @@ fn apply_inbound_managed_agent(
local.parallelism = inbound.parallelism;
local.respond_to = inbound.respond_to;
local.respond_to_allowlist = inbound.respond_to_allowlist;
crate::managed_agents::normalize_managed_agent_access(local);
}
}

Expand Down
6 changes: 4 additions & 2 deletions desktop/src-tauri/src/commands/personas/snapshot/import.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,7 +393,7 @@ pub async fn confirm_agent_snapshot_import(
let persona_id = uuid::Uuid::new_v4().to_string();

// Build persona from snapshot definition.
let persona = AgentDefinition {
let mut persona = AgentDefinition {
id: persona_id.clone(),
display_name: display_name.clone(),
avatar_url: effective_avatar.clone(),
Expand All @@ -417,6 +417,7 @@ pub async fn confirm_agent_snapshot_import(
created_at: now.clone(),
updated_at: now.clone(),
};
crate::managed_agents::normalize_definition_access(&mut persona);

personas.push(persona.clone());
save_personas(&app, &personas)?;
Expand All @@ -426,7 +427,7 @@ pub async fn confirm_agent_snapshot_import(

// Build the managed agent record — no machine-local commands, no
// secrets, no lineage from the snapshot.
let record = ManagedAgentRecord {
let mut record = ManagedAgentRecord {
pubkey: pubkey.clone(),
name: display_name.clone(),
display_name: None,
Expand Down Expand Up @@ -485,6 +486,7 @@ pub async fn confirm_agent_snapshot_import(
runtime: snapshot.definition.runtime.clone(),
name_pool: snapshot.definition.name_pool.clone(),
};
crate::managed_agents::normalize_managed_agent_access(&mut record);

records.push(record.clone());
save_managed_agents(&app, &records)?;
Expand Down
9 changes: 6 additions & 3 deletions desktop/src-tauri/src/commands/team_snapshot.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ fn definition_from_snapshot(
let respond_to = (behavior.respond_to != crate::managed_agents::RespondTo::default())
.then(|| behavior.respond_to.as_str().to_string());

Ok(AgentDefinition {
let mut definition = AgentDefinition {
id: Uuid::new_v4().to_string(),
display_name: member.profile.display_name.trim().to_string(),
avatar_url: effective_avatar(member),
Expand All @@ -137,7 +137,9 @@ fn definition_from_snapshot(
parallelism: behavior.parallelism,
created_at: now.to_string(),
updated_at: now.to_string(),
})
};
crate::managed_agents::normalize_definition_access(&mut definition);
Ok(definition)
}

pub(crate) fn build_import_definitions(
Expand Down Expand Up @@ -547,7 +549,7 @@ pub async fn confirm_team_snapshot_import(
};

// Build the ManagedAgentRecord for this member.
let record = ManagedAgentRecord {
let mut record = ManagedAgentRecord {
pubkey: pubkey.clone(),
name: display_name.clone(),
display_name: None,
Expand Down Expand Up @@ -608,6 +610,7 @@ pub async fn confirm_team_snapshot_import(
runtime: member.definition.runtime.clone(),
name_pool: member.definition.name_pool.clone(),
};
crate::managed_agents::normalize_managed_agent_access(&mut record);

minted.push(MintedMember {
definition,
Expand Down
1 change: 1 addition & 0 deletions desktop/src-tauri/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -787,6 +787,7 @@ pub fn run() {
get_managed_agent_log,
get_agent_models,
discover_agent_models,
agent_access_owner_only,
get_agent_config_surface,
get_runtime_file_config,
get_baked_build_env_keys,
Expand Down
Loading
Loading