fix(desktop): say the owner-only line admits the owner's agents

The line under Only me read "Only you can send instructions.", but the
harness gate admits the owner and every cryptographically verified
same-owner agent, and the built-in Welcome team depends on that: the lead
instructs its teammates while each teammate is created owner-only. The
line therefore promised a narrower boundary than the one enforced, and
this PR makes that boundary invariant in internal builds, so the copy has
to be accurate.

Say "Only you and your agents can send instructions." instead. The
dropdown label stays "Only me", which is the audience the user picks and
what that option has meant since before agents could instruct each other.
A contract test pins the new line, and the access_policy.rs module docs
now cite the copy rather than calling it a separate open question.

Co-authored-by: Tom Brow <tomb@block.xyz>
Signed-off-by: Tom Brow <tomb@block.xyz>

Loading branch information

npub12uu53ml9upy7ww9apmtv6vm0u8xlcldx7znsjvwgsr7uvy5g0kssw943ca and brow committed Aug 5, 2026

commit 579e9b10d389ba2202daac074b587fc225a5cc84

desktop/src-tauri/src/managed_agents/access_policy.rs

-Original file line number
+Diff line change
@@ Expand Up / @@ -42,9 +42,10 @@ @@
     //! while every teammate is created owner-only (see
     //! `welcomeTeammateHasExpectedAccess` in
     //! `desktop/src/features/onboarding/welcomeGuide.ts`). Read every use of
-    //! "owner-only" in this module as `owner ∪ verified same-owner agents`. Buzz's
-    //! own user-facing copy for the setting is narrower than that, which is a copy
-    //! question tracked outside this module, not a difference in enforcement.
+    //! "owner-only" in this module as `owner ∪ verified same-owner agents`. The
+    //! setting's own copy says so: the line under Only me reads "Only you and your
+    //! agents can send instructions." (`RespondToField.tsx`). The dropdown label
+    //! stays "Only me", which is the audience the user picks.
     use super::{validate_respond_to_allowlist, ManagedAgentRecord, RespondTo};
@@ Expand Down @@

desktop/src/features/agents/ui/RespondToField.tsx

-Original file line number
+Diff line change
@@ Expand Up @@
      * than an explanation, and stays one sentence — Only me already owns the line
      * below the control.
      *
+     * The line below Only me says "Only you and your agents", because the harness
+     * gate admits the owner and every verified same-owner agent, not the owner
+     * alone (see `managed_agents/access_policy.rs`). The dropdown label stays
+     * "Only me": it is the audience the user picks, and it has meant this since
+     * before agents could instruct each other.
+     *
      * Which machine and stakes it names follow the optional `runLocation` prop, and
      * an unknown location falls back to the local wording rather than hedging with
      * "computer or server" — see `lib/agentAccessWarning.ts` for the copy and the
@@ Expand Down Expand Up / @@ -236,7 +242,7 @@ export function CreateAgentRespondToField({ @@
           {mode === "anyone" ? accessWarning : null}
           {mode === "owner-only" ? (
             <p className="text-xs text-muted-foreground">
-              Only you can send instructions.
+              Only you and your agents can send instructions.
             </p>
           ) : null}
           {mode === "allowlist" ? (
@@ Expand Down @@

desktop/src/features/agents/ui/respondToFieldContract.test.mjs

-Original file line number
+Diff line change
@@ Expand Up @@
       assert.match(collapsedSource, /<p aria-live="polite"[^>]*> \{warningText\}/);
     });
+    test("the Only me line names the owner's agents, not the owner alone", () => {
+      // The harness gate admits the owner and every verified same-owner agent
+      // (`managed_agents/access_policy.rs`), and the built-in Welcome team depends
+      // on that, so a line promising the owner alone would overstate the boundary.
+      assert.match(
+        collapsedSource,
+        /mode === "owner-only" \? \( <p[^>]*> Only you and your agents can send instructions\./,
+      );
+    });
     test("primary respond-to copy does not expose implementation jargon", () => {
       const primaryFieldSource = respondToFieldSource.slice(
         respondToFieldSource.indexOf('data-testid="agent-respond-to"'),
@@ Expand Down @@

fix(desktop): enforce owner-only access in internal builds #4053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

brow merged 17 commits into main from internal-owner-only-enforcement

Aug 6, 2026

-Original file line number
+Diff line change
@@ Expand Up / @@ -42,9 +42,10 @@ @@
     //! while every teammate is created owner-only (see
     //! `welcomeTeammateHasExpectedAccess` in
     //! `desktop/src/features/onboarding/welcomeGuide.ts`). Read every use of
-    //! "owner-only" in this module as `owner ∪ verified same-owner agents`. Buzz's
-    //! own user-facing copy for the setting is narrower than that, which is a copy
-    //! question tracked outside this module, not a difference in enforcement.
+    //! "owner-only" in this module as `owner ∪ verified same-owner agents`. The
+    //! setting's own copy says so: the line under Only me reads "Only you and your
+    //! agents can send instructions." (`RespondToField.tsx`). The dropdown label
+    //! stays "Only me", which is the audience the user picks.
     use super::{validate_respond_to_allowlist, ManagedAgentRecord, RespondTo};
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
      * than an explanation, and stays one sentence — Only me already owns the line
      * below the control.
      *
+     * The line below Only me says "Only you and your agents", because the harness
+     * gate admits the owner and every verified same-owner agent, not the owner
+     * alone (see `managed_agents/access_policy.rs`). The dropdown label stays
+     * "Only me": it is the audience the user picks, and it has meant this since
+     * before agents could instruct each other.
+     *
      * Which machine and stakes it names follow the optional `runLocation` prop, and
      * an unknown location falls back to the local wording rather than hedging with
      * "computer or server" — see `lib/agentAccessWarning.ts` for the copy and the
@@ Expand Down Expand Up / @@ -236,7 +242,7 @@ export function CreateAgentRespondToField({ @@
           {mode === "anyone" ? accessWarning : null}
           {mode === "owner-only" ? (
             <p className="text-xs text-muted-foreground">
-              Only you can send instructions.
+              Only you and your agents can send instructions.
             </p>
           ) : null}
           {mode === "allowlist" ? (
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
       assert.match(collapsedSource, /<p aria-live="polite"[^>]*> \{warningText\}/);
     });
+    test("the Only me line names the owner's agents, not the owner alone", () => {
+      // The harness gate admits the owner and every verified same-owner agent
+      // (`managed_agents/access_policy.rs`), and the built-in Welcome team depends
+      // on that, so a line promising the owner alone would overstate the boundary.
+      assert.match(
+        collapsedSource,
+        /mode === "owner-only" \? \( <p[^>]*> Only you and your agents can send instructions\./,
+      );
+    });
     test("primary respond-to copy does not expose implementation jargon", () => {
       const primaryFieldSource = respondToFieldSource.slice(
         respondToFieldSource.indexOf('data-testid="agent-respond-to"'),
@@ Expand Down @@

Navigation Menu

Repository navigation

fix(desktop): enforce owner-only access in internal builds #4053

Uh oh!

Diff view

Diff view

Uh oh!

There are no files selected for viewing

Uh oh!