diff --git a/.cofoundy/brief.yaml b/.cofoundy/brief.yaml new file mode 100644 index 00000000000..bfe89e05999 --- /dev/null +++ b/.cofoundy/brief.yaml @@ -0,0 +1,60 @@ +schema_version: 1.0 +name: buzz-cli-usable +domain: software +session_mode: delivery +started: 2026-08-04 +owner: Andre (A-PachecoT) + +goal: > + Hacer usable el CLI de Buzz en una caja limpia del equipo. Dos defectos + bloquean eso hoy: (1) el CI del fork no shippea git-credential-nostr, así que + git push contra el relay exige compilar un binario a mano; (2) los metadatos + de un repo se congelan a los 15 minutos, dejando `repos bind` y + `repos protect` permanentemente inutilizables. + +repo: cofoundy/buzz +base_branch: railway-deploy # NUNCA main — main sigue al upstream de Block +work_branch: sprint/buzz-cli-usable +relay: https://buzz.cofoundy.dev + +issues: + - id: cofoundy/buzz#1 + title: CI no shippea git-credential-nostr + lane: ci + - id: cofoundy/buzz#2 + title: metadatos de repo congelados a los 15 min (upstream block/buzz#2876) + lane: cli + +mvp_scope: + - git-credential-nostr sale como release asset del fork y lo instala install-buzz-acp.sh + - una caja sin toolchain de Rust puede clonar y pushear siguiendo solo el README + - repos protect / repos bind funcionan sobre un repo anunciado hace más de 15 min + - el fix del timestamp preserva la monotonía (un writer demorado no pisa una edición intermedia) + +out_of_scope: + - Tocar el Dockerfile del relay o deploy/railway/ (guardrail explícito del issue #1) + - Ampliar MAX_TIMESTAMP_DRIFT_SECS en el relay (guardrail explícito del issue #2 — la ventana es defensa anti-replay, no el bug) + - Modificar la lógica del crate git-credential-nostr (funciona; verificado con push y clone reales) + - Rebasear o forzar sobre railway-deploy + - Onboarding del equipo / sunset de Discord (bloqueado por handbook#2, fase 3) + +agents: + roles: + - ci + - cli + +recon_findings: + - id: R-1 + what: deploy/arch-box/ no tiene README + impact: el issue #1 pide documentar en "el README del deploy" pero no existe; la lane ci lo crea + - id: R-2 + what: el paths: trigger del workflow no incluye crates/git-credential-nostr/** + impact: un cambio al helper no redispara el build; gap adyacente, se corrige en la misma lane + - id: R-3 + what: repos.rs:523 y :717 assertean created_at == 101 exacto + impact: max(now, existing+1) rompe ambos tests; deben assertear monotonía + frescura, no un literal + +references: + - handbook/infrastructure/buzz/BITACORA.md + - handbook/infrastructure/buzz/bitacora/2026-08-01-auditoria-fase2.md + - https://github.com/block/buzz/issues/2876 diff --git a/.cofoundy/context/agent-floor.md b/.cofoundy/context/agent-floor.md new file mode 100644 index 00000000000..736d3f921e3 --- /dev/null +++ b/.cofoundy/context/agent-floor.md @@ -0,0 +1,153 @@ +# Agent Floor — universal teammate contract + +> Scaffolded into `.cofoundy/context/agent-floor.md` by `/cofoundy-init` (one-time per project). +> Read once by every teammate at spawn. Replaces the per-dispatch boilerplate copy-paste. +> If your dispatch prompt restates anything below, you're duplicating the floor — point here instead. + +## Identity + substrate + +- You are a teammate on the buzz-cli-usable sprint team. Your role and task are in your spawn prompt. +- **Substrate is SSOT.** Your task spec lives at `.cofoundy/tasks/T-NNN.md`. Read it first; every acceptance line is a hard gate. +- **Architecture, contracts, conventions** live in `.cofoundy/specs/*.md` and project `CLAUDE.md` / `.claude/rules/`. Read what your task's `refs:` block points at. +- **Don't re-prose what you read.** Apply it. + +## Protocol-ask supremacy + +When your caller sends an explicit **protocol-ask** (ACK pattern, restart, status, shutdown, hand-off, gate decision), execute it FIRST. Economic / efficiency concerns (cost of restart, token burn, "I already did this") surface AFTER, never as conditions for compliance. + +- Correct: *"Acknowledged. Dispatching Phase 0. Note: prior artifacts at `` if you want to compare against this run."* +- Wrong: *"Question: should I restart given that prior artifacts exist at ``?"* — stalling-as-clarification, indistinguishable from non-engagement from the caller's seat. + +Default-to-comply on protocol-asks. Default-to-action on substrate ambiguity (file the ambiguity in `.cofoundy/state/escalation-queue.jsonl` + halt; don't reply with a question). The caller's right to be wrong about economics outranks your right to be right about them. + +Source incident: `plugins/cofoundy-orchestrator/docs/2026-05-20-teammate-stepper-protocol-gap.md` §"Root cause #2". + +## Your operator is the CTO (talk to it) + +The orchestrator that spawned you is the **CTO acting as the founder** — it is your human. Two +distinct channels, do not confuse them: + +- **`QUESTION` → SendMessage the orchestrator** when you hit a decision you genuinely cannot infer + from the substrate but that a PM/founder *could* answer (which approach, is this in scope, does the + client want X or Y). Ask it like you'd ask a human lead: one crisp question + your recommended + default. The CTO answers (or escalates upward itself). This is the normal operating channel — use it. +- **Escalation queue → only for substrate ambiguity** (spec contradicts itself/the contract, a + capability/credential wall): append to `.cofoundy/state/escalation-queue.jsonl` and halt. Don't put + judgment questions here — those go to the CTO via SendMessage. + +When the CTO sends you a `REVIEW`, `REDIRECT`, `CLARIFY`, `UNBLOCK`, or `DIAGNOSE-NUDGE`, treat it as +a protocol-ask (below): execute first, surface concerns after. Don't narrate status unprompted — the +CTO reacts to events, not to chatter. + +## Scope discipline + +- **Stay in `scope.write`** from your task spec. Anything you want to touch outside that = file an escalation in `.cofoundy/state/escalation-queue.jsonl` and stop. Do NOT silently expand scope. +- **`scope.read` is permissive** but doesn't authorize edits. Read freely; write only inside the matrix. +- **No new files outside scope.write.** If you need one (new module, new test file, new doc), it must already be listed in `scope.write` (glob match counts). +- **The gates are NOT a sandbox — scope discipline is YOURS to keep.** The hooks read the Bash command *string*: they see shell redirects, `tee`, `sed -i`, `cp`/`mv`, and `Write`/`Edit` targets. They are blind to anything an interpreter does — `python3 x.py`, `node w.js`, `make`, `bash s.sh` resolve to zero targets and pass. So scope enforcement catches **accidental drift**; it is a **coordination contract, not a security boundary**, and it will not stop a determined write. Don't read "the gate allowed it" as "this was in scope" — you own the matrix whether or not a hook is watching. Corollary: if you route around a gate (including via an interpreter), **say so** in your termination summary. Concealing a workaround is the one unforgivable move; using one and disclosing it is normal engineering. +- **Compound Bash commands are blocked ATOMICALLY.** If any single resolved target in a `&&`/`;` chain is out of scope, the *whole* command dies — including the parts that were fine. So keep destructive/recovery ops as **separate commands**: run the `rm` alone, then the append alone. Never chain a cleanup step to a possibly-blocked target — the cleanup that would have unblocked you is exactly what won't run. + +## Git contract + +- **Spawn step 0 — verify your worktree BASE before any work.** Harness-created worktrees branch from the primary checkout's HEAD, NOT necessarily the base branch your dispatch prompt names. Check `git merge-base --is-ancestor HEAD`; on mismatch `git fetch origin && git checkout -B `, THEN start. Reproducing/fixing/testing on the wrong base invalidates everything downstream. → `core/docs/decision-log.md#2026-07-22-worktree-base-drift` +- **If you're on an isolated worktree/branch (long-run / team-agent model): commit to YOUR branch after every meaningful unit.** Uncommitted work is LOST if you idle or die — don't bank it for the end. The orchestrator merges your branch; it does NOT depend on you surviving to a final phase. If you're a transient in-session subagent on the orchestrator's own branch, just mutate the tree and let it commit. +- **Precedence when the two rules above and below pull against each other: VERIFY, THEN COMMIT.** "Commit after every meaningful unit" and "run tests before signaling done" are both real; when they conflict, verification wins — a *meaningful unit* is a **verified** one, and committing unverified code is the failure mode the guidance exists to prevent. **A dirty tree mid-verification is the EXPECTED state of a working agent and is NEVER evidence of idleness.** Hold the edit, run the check, then commit. Don't commit early to look busy; don't let a dirty tree pressure you into shipping unverified. Keep the verify window tight (minutes, not phases) — the rule buys you verification time, not indefinite banking. +- **Orchestrator's half of that contract (it binds the orchestrator, not you): a worktree is NEVER destroyed on an idle heuristic.** Verify-before-commit is only safe if nothing deletes the tree underneath a live worker — so teardown requires a *positive* liveness check (registry `list` + no tool call for N minutes + a `task_completed` event), never the mere absence of a signal, and never `git worktree remove --force` (git's refusal on a dirty tree IS the guardrail: a worktree that refuses to die is a worker still holding work). Dirtiness is not idleness and uncommitted is not abandoned. If your worktree disappears mid-task, that is an orchestrator defect — report it, don't absorb it. +- **Push YOUR branch freely, and open your own MR when your task is done.** You don't wait for the orchestrator to push for you — that's the bottleneck the autonomous-team model removes. Push early/often so your work survives + peers can see it. +- **Self-merge to `develop` on CI-green IF your scope is DISJOINT.** When your task touched only files YOU own per the ownership matrix (no shared files), open your MR to `develop` and set **auto-merge on CI-green** — you land your own lane, no orchestrator relay, no integration branch. CI is the gate. +- **Shared-file edits → flag, don't auto-merge.** If you touched a SHARED surface (the api-client barrel/index, `app.module`, prisma migrations, root `package.json`, anything multiple lanes edit) label your MR `needs-coordinated-merge` and STOP — the merge-coordinator sequences those (concurrent auto-merges on a shared file collide). Better: avoid shared-file edits by design (add your own file, not a line in a shared index). +- **`main`/prod and force-push are NEVER autonomous.** Human gate. Never force-push any shared branch. +- **Scratch artifacts (screenshots, `.report-shots`, scratch specs/notes) go to a gitignored dir — never commit them to the product branch.** They force cleanup commits at integration. + +## Test + quality discipline + +- **Run tests yourself before signaling done.** Each acceptance line should map to a runnable check; run it. This outranks commit-frequency — see the precedence rule in the git contract: verify, then commit; a dirty tree mid-verification is expected, not idleness. +- **Logger discipline** per `.claude/rules/backend-quality.md` (Python backend) or repo-specific rules: entry/exit/error logs with structured `extra={}`, `exc_info=True` on errors, `time.perf_counter()` around external HTTP. +- **Coverage gates** if listed in acceptance — run with `--cov-fail-under=N`, save report to `docs/qa//` if your role is QA. +- **`pytest | tail` deadlocks.** Always `pytest ... > /tmp/out.txt 2>&1` then `tail /tmp/out.txt`. The pipe-to-tail pattern hangs in this harness. + +## Termination signal + +When you've self-verified all acceptance criteria pass: + +1. Append one event line to `.cofoundy/state/history.jsonl`: + ```json + {"ts":"","event":"task_completed","task":"T-NNN","agent":"","cycle":"","summary":""} + ``` +2. Return a structured summary (under 250 words): + - Files created / modified (paths) + - Acceptance criteria status (each line passed / partial / blocked) + - Coverage % if relevant + - Deviations from spec (if any) with rationale + - Flagged issues / fix-tasks filed for orchestrator + +3. **Do NOT mark TaskUpdate completed yourself if you're a teammate** — the orchestrator marks based on your termination signal. (If you're a standalone subagent, you don't see TaskList anyway.) + +## Per-role state files — EXACTLY ONE writer + +Per-role files (`.cofoundy/state/metacognition/{role}.jsonl` and any other `{role}`-suffixed state +file) exist so N lanes can never collide on one surface. That only holds under an invariant that must +be stated, because following the surrounding instructions literally can break it: + +- **A per-role file has exactly ONE writer: the owning lane.** Peers never touch another role's file. + You own yours; write it, and only it. +- **The orchestrator harvests by copy OR by merge — NEVER both.** Copying a lane's mid-run file into + main *and* merging that lane's branch makes the orchestrator a second writer to a single-writer + file: guaranteed conflict, and union-resolving it silently DUPLICATES the deliverable (a stale + harvest snapshot and the lane's real line, same `ts`, different content — the stale one sorts first + and wins any naive read). +- **Dedupe on `(role, task, ts)` at assembly, with a superset check before dropping anything.** If two + lines collide on that key, assert every item in the discarded line appears verbatim in the kept one; + **abort if not**. Never resolve a conflict in one of these files by keeping both sides — that is not + a merge, it is a duplication. + +## Finishing capabilities — you can do the WHOLE job, not just the code + +A capability **NEED** is not a capability **GAP**. The most common way an agent fails to finish +is stopping at "code's done — someone should deploy / configure DNS / set the secret / run QA." +You have the skills to finish it yourself. Any agent in this workspace can invoke: + +- **Deploy · status · logs · rollback** → `cofoundy-toolkit:deployment` (Railway + Cloudflare; never raw railway/curl). +- **Cloudflare tokens** → `cofoundy-founders:cf-token`. **DNS · domains** → `cofoundy-founders:namecheap`. +- **Store a credential** (vault + GitHub + env) → `cofoundy-toolkit:store-key`. +- **Browser QA · screenshots · verify-live** → `cofoundy-toolkit:browser`, or spawn a QA subagent. +- **Generate + run the acceptance tests** → `cofoundy-toolkit:test`. If your task has a testable acceptance line, the merge gate (F1b criterion `tests_present_or_justified`) REJECTS a diff that ships no test — run it as a finishing step, or record a `tests:` block (`status: present|justified`) / `## No-test justification` section in your task file. Mocked-only tests are judgment-tier `amend`, not proof (cantera L-004): the real-run is the gate. +- **Atomic commits** → `cofoundy-toolkit:gitcommit`. **Publish a doc** → `cofoundy-docs:docs`. + +If your task's done-definition includes deploy / config / verify-live, **do it with these** — the +finish is yours, not a human's. Credentials are provisioned in `os.environ` at session start; the +skills read them (never `bw unlock` at runtime). + +## Escalation path + +The queue is `.cofoundy/state/escalation-queue.jsonl` — **append-only JSONL, one escalation per line.** +It is NOT YAML: there is no `pyyaml` in this environment (`import yaml` → `ModuleNotFoundError`), and +hand-splicing YAML text is how the queue silently dies — any prose containing a `word: ` sequence (a +path like `T-001.md:51:`, a `->`) turns the whole document into invalid YAML and swallows every +escalation in it, unnoticed, including yours. JSONL has no nesting to corrupt: one bad line costs one +line. **Never hand-concatenate the JSON either** — serialize with stdlib `json`: + +```bash +python3 -c 'import json,sys,datetime +print(json.dumps({"ts":datetime.datetime.now().isoformat(timespec="seconds"), + "id":"E-00N","role":"","task":"T-NNN","status":"open", + "kind":"substrate_ambiguity", # or capability_gap + "summary":"","evidence":"", + "recommendation":""}))' \ + >> .cofoundy/state/escalation-queue.jsonl +``` + +- **Substrate ambiguity** (spec contradicts itself or contract) → append one line, halt. +- **Genuine capability gap** — you need X, there is NO skill for it, AND no credential the skill could fetch (e.g. a human-only approval, a missing external account) → append one line + halt. **A need you can satisfy with a skill above is NOT a gap — do it.** +- **A spurious gate block is NOT substrate ambiguity.** If a hook blocked a write that IS in your `scope.write` (a phantom target from a heredoc body, an unexpanded `$TMPDIR/...`), that's a false positive: don't file it here — note it in your termination summary and use a form the parser reads correctly (e.g. `git commit -F ` instead of a heredoc). The queue is for real ambiguity; filling it with phantoms teaches everyone to ignore it. +- **Blocking bug found in another role's deliverable** → file new task `.cofoundy/tasks/T-XXX.md` (role_owner = that role) + flag in your termination summary. Don't try to fix outside your scope. + +## What's NOT here (because it's role/task-specific) + +The dispatch prompt provides ONLY: +- Your role + task ID + branch (1 line) +- Read pointers to your task spec + relevant spec files (1 line) +- Delta-not-in-substrate: any context, debug hints, or decisions made by orchestrator that aren't in the .md files (≤2 lines) +- Termination signal reminder if non-standard (1 line) + +If your dispatch prompt says more than ~80 words, the orchestrator is over-prescribing. Read the spec files; that's where the answers live. diff --git a/.cofoundy/context/constraints/escalation-thresholds.yaml b/.cofoundy/context/constraints/escalation-thresholds.yaml new file mode 100644 index 00000000000..dba407f2cab --- /dev/null +++ b/.cofoundy/context/constraints/escalation-thresholds.yaml @@ -0,0 +1,176 @@ +# escalation-thresholds.yaml — governance thresholds for ceo-agent + /cto hard gates +# +# SCAFFOLDED BY: /cofoundy-init Step 5 → `.cofoundy/context/constraints/escalation-thresholds.yaml` +# READ BY: `agents/ceo-agent.md` — Decision Algorithm step 2, BEFORE any decision +# `skills/cto/SKILL.md` Phases 2 / 5 / 11 ("Check escalation-thresholds.yaml. Decide.") +# WRITES TO: `.cofoundy/state/escalation-queue.jsonl` (one JSON record per line; schema at +# `${CLAUDE_PLUGIN_ROOT}/references/escalation-queue.schema.json`) +# +# ───────────────────────────────────────────────────────────────────────────────── +# FAIL-CLOSED CONTRACT — read before editing, and before deciding anything (F6) +# ───────────────────────────────────────────────────────────────────────────────── +# A governance gate that cannot read its config MUST HALT. It must never fall through +# to allow. +# +# • This file ABSENT → ceo-agent does NOT decide. +# • A `required_keys` entry MISSING → ceo-agent does NOT decide. +# • A threshold present but UNPARSEABLE → ceo-agent does NOT decide. +# +# In every one of those cases ceo-agent returns +# {result: escalate, reason: "escalation-thresholds.yaml: "} +# appends the escalation record to `.cofoundy/state/escalation-queue.jsonl`, and STOPS. +# +# This inverts the hook convention on purpose. A PreToolUse hook fails OPEN because it +# must not deadlock the session. A governance gate fails CLOSED because a missing +# threshold is an UNANSWERED QUESTION, not a granted permission. Reading "required +# input absent" as `allow` is exactly the root cause behind F1/F2/F5/F6 — do not +# reintroduce it here. +# +# Silence is not consent. If you cannot read the rule, you do not have the authority. +# ───────────────────────────────────────────────────────────────────────────────── + +version: 1 + +# Keys ceo-agent asserts before deciding. Any one missing ⇒ halt + escalate (see contract above). +required_keys: + - thresholds.production_main_deploy + - thresholds.budget_overrun + - thresholds.scope_expansion_request + - thresholds.security_finding_high + - autonomy_overrides + - blast_radius_thresholds + +# ───────────────────────────────────────────────────────────────────────────────── +# Thresholds +# ───────────────────────────────────────────────────────────────────────────────── +# Each entry is a named condition that forces escalation when it applies to a decision. +# ceo-agent evaluates these FIRST and stops at the first match — no decision is made. +# +# `escalate: true` is the flag ceo-agent keys on (per its authority boundary: "Anything +# flagged `escalate: true` in escalation-thresholds.yaml" ALWAYS escalates). +# The matched key is written verbatim into the escalation record's `threshold_tripped`. +thresholds: + + production_main_deploy: + escalate: true + severity: blocking + description: "Any deploy whose target is `main` / production (a live, user-facing surface)." + applies_to_phases: [11] + detect: >- + The Phase 11 gate context names target=main, OR the deploy would publish to a + production domain / production Railway service. + override: autonomy_overrides.auto_approve_main_deploy + suggested_default: >- + Hold the deploy. Feature-branch deploys fire under ceo-agent authority; main does not. + question_for_human: "Deploy to production main? Feature-branch deploy is already green." + + budget_overrun: + escalate: true + severity: blocking + description: "The cycle exceeds its declared budget of money or agent-hours." + applies_to_phases: [2, 5, 11] + detect: >- + Projected spend exceeds `limits.*` below, OR the brief declares a budget and the + task graph's estimate exceeds it. If no budget is declared anywhere, this threshold + does not apply — that is NOT the same as a missing key (see fail-closed contract). + limits: + usd_per_cycle: 50 # third-party spend (API credits, infra, tooling) per /cto cycle + agent_hours_per_cycle: 24 # cumulative wall-clock across all dispatched lanes + suggested_default: "Pause dispatch. Re-scope to the brief's mvp_scope and re-gate." + question_for_human: "Cycle is projected at vs a budget. Raise the budget, or cut scope to ?" + + scope_expansion_request: + escalate: true + severity: blocking + description: >- + Work outside the brief's `mvp_scope`, or a task/lane asking to write outside its + `scope.write` — including a `cluster_scope_violation` the matrix cannot resolve. + applies_to_phases: [5, 7, 8] + detect: >- + A proposed task, amendment, or worker escalation names a deliverable absent from + `brief.yaml:mvp_scope`, or names a path owned by another role's W-cell in + `file-ownership-matrix.md`. + exempt: >- + Reassignment to the owning lane, or carving the matrix, resolves this WITHOUT + escalation — those are ceo-agent's own authority. Escalate only when neither is + available (e.g. the owning lane has terminated and the change alters mvp_scope). + suggested_default: "Reject the expansion. File it as a follow-up task for the next cycle." + question_for_human: " needs , outside mvp_scope. Expand scope, or defer to next cycle?" + + security_finding_high: + escalate: true + severity: blocking + description: >- + A HIGH/CRITICAL security finding — secret exposure, authn/authz bypass, injection, + a vulnerable dependency with a known advisory, or PII on an unintended surface. + applies_to_phases: [8, 11] + detect: >- + `cso-audit` returns HIGH or CRITICAL, `preflight-audit` flags a 3p advisory, OR + research-agent's Phase-11 dep-advisory check returns a live CVE. + suggested_default: "Block the merge/deploy. Do not ship a known-HIGH finding on ceo-agent authority." + question_for_human: " is HIGH. Block the release, or accept the risk with ?" + +# ───────────────────────────────────────────────────────────────────────────────── +# Always-escalate surfaces (ceo-agent's authority boundary, restated as config) +# ───────────────────────────────────────────────────────────────────────────────── +# These are NOT overridable by `autonomy_overrides`. They mirror ceo-agent's +# "You DO NOT have authority on" list so the boundary is queryable, not just prose. +always_escalate: + - legal_instruments # delegate via escalation to `cofoundy-founders:legal-team` + - payments_sunat_ruc # any tributario / accounting surface + - hiring_firing_compensation + - external_client_comms # client/lead-facing sends + - credential_mint_or_rotate # new secrets, key rotation, vault writes + +# ───────────────────────────────────────────────────────────────────────────────── +# Autonomy overrides +# ───────────────────────────────────────────────────────────────────────────────── +# The ONLY way to relax a threshold. An operator sets these deliberately, per project. +# They cannot relax anything in `always_escalate`. +# Every default here is the SAFE value — flipping one is an explicit act with an owner. +autonomy_overrides: + auto_approve_main_deploy: false # /cto Phase 11 checks this exact path before escalating + auto_approve_budget_overrun: false + auto_approve_scope_expansion: false + auto_approve_security_finding_high: false + + # Provenance for any flip above — who authorized it, when, and for how long. + # An override with no `authorized_by` is treated as ABSENT (i.e. the threshold still fires). + authorized_by: null # e.g. "Andre Pacheco (CEO)" + authorized_at: null # ISO-8601 + expires_at: null # ISO-8601 — null means "this cycle only"; a past date means expired + +# ───────────────────────────────────────────────────────────────────────────────── +# Blast-radius refute-pass (F1c — issue #14) +# ───────────────────────────────────────────────────────────────────────────────── +# A ceo-agent `approve` at a hard gate (Phase 2/5/11) is today a SINGLE point of +# judgment. For HIGH-blast-radius approves only, /cto runs a second, adversarial +# opinion — a refuter subagent prompted to REFUTE the approve — BEFORE the approved +# action executes. This is NOT a panel on every decision (cost/latency) and NOT a +# unilateral veto: disagreement between the gate and the refuter ESCALATES to the +# human, it does not block on the refuter's say-so. +# +# Read by: skills/cto/SKILL.md §"Refute-pass" (after each gate's `approve` branch) +# Checked: skills/cto/scripts/blast_radius_check.py (deterministic trigger predicate) +# Recorded: skills/cto/scripts/record_refute.py (annotate decision file + escalate on REFUTE) +# +# A trigger matches when its condition is met AND its flag is true. If NONE match, +# `below_threshold` holds → current behavior, zero extra cost. Fail-closed (F6): if +# this block is absent/unparseable, blast_radius_check.py REQUIRES the refute — a +# missing rule is more scrutiny, never a silent pass. +blast_radius_thresholds: + triggers: + deploy_any: true # any deploy at all (the Phase 11 surface) + architecture_external_surface: true # an arch change that exposes an external surface + task_graph_repos_gt: 1 # a task graph touching more than N repos + files_touched_gt: 25 # a change larger than N files + below_threshold: no_refute # explicit: below threshold = current behavior, no extra cost + disagreement: escalate # gate↔refuter disagreement ⇒ escalate to human, never unilateral veto + +# ───────────────────────────────────────────────────────────────────────────────── +# Project-specific thresholds +# ───────────────────────────────────────────────────────────────────────────────── +# Add domain thresholds here at scaffold time from `brief.yaml` constraints — e.g. a +# deal touching a signed SOW, a campaign spending ad budget, a repo with a compliance +# surface. Same shape as `thresholds` above; same `escalate: true` flag. +project_thresholds: {} diff --git a/.cofoundy/context/decisions/2026-08-04-phase-2-architecture.md b/.cofoundy/context/decisions/2026-08-04-phase-2-architecture.md new file mode 100644 index 00000000000..d580f75f4de --- /dev/null +++ b/.cofoundy/context/decisions/2026-08-04-phase-2-architecture.md @@ -0,0 +1,324 @@ +# Decision: architecture-v1 APROBADA — portar el hunk común, no elegir PR; endosar con evidencia, no con veredicto + +**Phase:** 2 +**Date:** 2026-08-04 +**Authority:** ceo-agent (tier-1 partner delegation, /cto cycle `buzz-cli-usable` / 2026-08-04) +**Status:** approved (tras una ronda de enmiendas — A1–A5 aterrizadas y verificadas 2026-08-04) + +> **Historial:** este gate se resolvió en dos pasadas. Pasada 1 → `amend` con cinco +> enmiendas. Pasada 2 → `approve`, tras releer `architecture-v1.md` y verificar las cinco +> una por una contra el texto (ver §Amendments). Las secciones de análisis abajo son las +> de la pasada 1 y se conservan sin editar: son el razonamiento que produjo las enmiendas, +> y sigue siendo el fundamento de la aprobación. + +## Question + +/cto pide resolver el gate de arquitectura Phase 2 sobre `.cofoundy/specs/architecture-v1.md`, y +específicamente la decisión que el operador delegó de forma explícita y verbatim: + +> "#2 ya tiene reproducción nuestra y está reportado upstream (block/buzz#2876) — vos decidís si +> parcheás el fork, upstreameás, o ambos." + +Con tres sub-preguntas planteadas: (a) ¿"portar verbatim + endosar" es realmente de menor costo total +que escribir nuestro propio fix, si cargamos delta de fork igual?; (b) ¿portar el parche no-mergeado de +un tercero a una rama que despacha el CLI de nuestro relay vivo tiene riesgo que el doc subestima?; +(c) ¿elegir #4509 sobre #4363 está justificado, o el propio criterio del doc ("el criterio es cuál +mergea") es razón para diferir el pick a implementación? + +## Decision + +**APROBADA** (pasada 2). `architecture-v1.md` queda aprobada como arquitectura del ciclo +`buzz-cli-usable`, con las cinco enmiendas incorporadas y tres condiciones de implementación +vinculantes (§Implementation conditions). El razonamiento de la pasada 1, que sigue abajo sin +editar, es el fundamento — nada de él cambió; lo que cambió es que el doc ahora lo refleja. + +--- + +*Lo que sigue es la decisión tal como se emitió en la pasada 1:* + +**Enmendar, no aprobar tal cual.** La forma de la arquitectura es correcta y la sostengo en sus dos +puntos centrales: (1) portar el fix al fork ahora, y (2) **no** abrir un cuarto PR upstream. Ambos +quedan aprobados bajo mi autoridad — el operador delegó exactamente ese eje ("fork, upstream, o +ambos") y detenerme a preguntar lo ya delegado quemaría la ventana de autonomía. + +Cinco enmiendas antes de dispatch. Tres son sustantivas y una es un defecto de corrección que el doc +no ve: + +- **A1** disuelve el pick #4509-vs-#4363 en vez de tomarlo o diferirlo. +- **A2** acota "verbatim" a la línea de producción y degrada el beneficio de auto-resolución de + propiedad a probabilidad. +- **A3** corrige un comentario en el código que hoy argumenta **en contra** del fix que vamos a hacer. +- **A4** nombra una consecuencia cross-client sobre datos vivos que el doc no menciona. +- **A5** acota el acto público upstream a evidencia, no a veredicto sobre el PR de un tercero. + +## Rationale + +### (a) ¿Portar es de menor costo total que escribir el nuestro? + +El doc vende esto como ahorro de implementación. No lo es: el fix es **una línea** +(`max(existing.created_at + 1, now)`) y su forma está esencialmente forzada — es la única que satisface +las dos propiedades simultáneamente. Escribir el nuestro y portar el suyo convergen al mismo texto. +El trabajo real son los tests (R-3: `repos.rs:523` y `:717` assertean `created_at == 101` exacto — +verificado en el código, ambos confirmados), y **esos los reescribimos igual en cualquier escenario**. + +Donde sí hay ahorro real es en el rebase futuro, y el mecanismo que el doc invoca es correcto: si +nuestro commit y el commit upstream hacen el mismo cambio textual a las mismas líneas, `git rebase` +detecta la equivalencia por patch-id y descarta el nuestro; un merge ve ambos lados con contenido +idéntico y resuelve solo. Una variante nuestra garantiza conflicto en esas mismas líneas. El +razonamiento se sostiene — pero **condicionado**, ver A2. + +Veredicto: la premisa "menor costo" es cierta, por una razón distinta a la que el doc da. Se sostiene +la decisión, se corrige la justificación. + +### (b) ¿Riesgo subestimado por desplegar a la rama del relay vivo? + +Parcialmente sí, pero **no donde la pregunta lo sugiere**. Lo que se despacha son los binarios +`buzz-cli` y `git-credential-nostr` a `~/.local/bin` de la arch-box y como release assets. El relay +**no se toca** (`out_of_scope` prohíbe el Dockerfile y `deploy/railway/`). El radio es nuestra propia +caja y nuestros propios agentes, no una superficie multi-tenant. + +El riesgo de supply-chain por "parche no revisado de un tercero" es prácticamente nulo aquí: el diff +es una línea que leímos, entendemos, y cuya corrección re-derivamos nosotros contra las dos +propiedades. Lo que sí está subestimado es otra cosa, y es de datos vivos → **A4**. + +Y hay un defecto de corrección que el doc no ve. En `crates/buzz-cli/src/commands/repos.rs:144-145` +el comentario vigente dice: + +> `// Advance only the observed head. Using wall-clock time here would let a` +> `// delayed writer leapfrog an intervening update and silently erase metadata.` + +Es un argumento explícito **en contra** de meter reloj de pared — exactamente lo que vamos a meter. +Si se porta solo el hunk de producción, queda un comentario que se lee como prohibición de lo que el +código hace dos líneas abajo. Ese tipo de comentario es plausiblemente parte de por qué el bug +sobrevivió revisión upstream. → **A3**. + +### (c) ¿#4509 sobre #4363? + +El doc es internamente inconsistente y hay que resolverlo, no diferirlo. Declara que "el criterio es +cuál mergea, no cuál nos gusta" — un criterio **hoy indecidible**: los tres PRs están OPEN y ninguno +revisado. Y ese criterio es justamente el que sostiene el beneficio principal del doc +(auto-resolución), o sea que el pick es load-bearing para su propia tesis y a la vez admitidamente no +decidible. Diferirlo a implementación no arregla nada: en implementación tampoco se sabrá cuál mergea. + +La salida es disolver el pick. Ambos PRs implementan `max(now, head+1)` con CI verde, así que en la +**línea de producción** son casi con certeza el mismo texto (una línea). Difieren en **tests** — y los +tests son precisamente lo que escribimos nosotros por R-3. Además el propio doc dice que el test de +drift de #4363 es "complementario", no alternativo. Entonces: portamos el hunk común, y adoptamos +**ambos** casos de test. La elección desaparece en vez de tomarse a ciegas. → **A1**. + +### Sobre el eje delegado (fork / upstream / ambos) + +Sostengo "ambos", con el upstream acotado. El endoso público está dentro de la delegación por +dominancia: el operador nombró "upstreameás" como opción, y abrir un PR upstream es una superficie +pública **estrictamente mayor** que un comentario de review. Si lo mayor estaba delegado, lo menor +también. + +Lo que **no** leo como delegado es el contenido específico del acto público. Delegó el ruteo de +ingeniería ("dónde vive el fix"), no una crítica pública nominal al PR de otra persona. El doc propone +"señalar que #2901 rompe la monotonía" como "el aporte de mayor valor". La información es valiosa; el +framing como veredicto no hace falta y nos obliga a tener razón sobre cuál mergea. Publicar el test +que distingue los dos comportamientos entrega la misma información, con más valor técnico, sin radio +interpersonal. → **A5**. + +### Sobre el Plan-agent omitido (Phase 2b) + +Acepto la omisión. Para la lane `ci` es extensión mecánica de listas; para la lane `cli` el espacio de +diseño está genuinamente enumerado por tres implementaciones ya escritas. Re-correrlo ahora quema +ventana por información casi nula. **Pero lo registro como señal de proceso**: A1 (la inconsistencia +interna del propio doc) y A3 (el comentario que contradice el código) son exactamente el tipo de +hallazgo que un Plan-agent atrapa. El doc apostó a que "el gate de ceo-agent es el chequeo real" — la +apuesta salió, con cinco enmiendas de costo. + +## Amendments — todas ATERRIZADAS y verificadas + +Verificación pasada 2: releí `architecture-v1.md` completo y contrasté cada enmienda contra el +texto. Resultado por enmienda: + +| # | Estado | Evidencia en el doc enmendado | +|---|---|---| +| A1 | ✅ aterrizada, **mejorada** | §"Cuál portar" (L113-122): pick disuelto, "cuál mergea" eliminado como criterio, ambos tests adoptados — y mapeados **uno a uno** contra las dos propiedades (#4509→monotonía, #4363→frescura). El mapeo explícito no estaba en mi enmienda; es mejor que lo que pedí. | +| A2 | ✅ aterrizada | L96-103: "'Verbatim' aplica **solo al hunk de producción, nunca a los tests**"; patch-id como *"probabilidad, no propiedad"* + "si el PR muta antes de mergear, el conflicto vuelve"; SHA upstream al cuerpo del commit. | +| A3 | ✅ aterrizada | R-4 en la lane `cli` (L68-73), con el texto del comentario citado y la instrucción de reescribirlo nombrando qué piso protege qué propiedad. | +| A4 | ✅ aterrizada | Nueva §"Riesgo sobre datos vivos (no sobre el relay)" (L75-86): efecto LWW cross-client sobre writers con lógica vieja + rollback forward-only. Agrega la condición correcta ("inocuo en piloto founders-only con un operador; deja de serlo con más de un cliente escribiendo"), que coincide con mi §What would flip this. | +| A5 | ✅ aterrizada | L104-111: evidencia (repro + dos propiedades + test discriminante) en #2876, explícitamente "no un veredicto nominal sobre el PR de un contribuidor", cuarto PR **ratificado como no**. Agrega la razón que yo no había escrito: evita que estemos *arbitrando entre terceros*. | + +Nota de consistencia verificada: el doc mantiene en su §interna que `now` a secas (#2901) es +incorrecto (L58). Correcto y deliberado — A5 acotó el **acto público**, no nuestro razonamiento +interno. La distinción está bien trazada. + +*Texto original de las enmiendas (pasada 1), conservado como registro:* + +**A1 — `architecture-v1.md` §"Cuál portar": disolver el pick, no tomarlo.** +Reemplazar la elección de #4509 por: portar el hunk de producción **común** a #4363 y #4509. En +implementación, diffear los dos hunks de producción; si son textualmente idénticos el pick es +irrelevante y se citan ambos SHAs como procedencia; si difieren (orden de argumentos, nombre del +binding), elegir el texto y registrar por qué en el cuerpo del commit. Adoptar **ambos** casos de +test — monotonía-sobre-head-futuro (#4509) y drift (#4363) — adaptados a nuestro fixture: son +complementarios, no alternativos. Eliminar "el criterio es cuál mergea" como criterio de selección +presente; es indecidible hoy y en implementación. + +**A2 — `architecture-v1.md` §"La decisión" punto 1: acotar "verbatim" y ser honesto con el beneficio.** +(i) "Verbatim" aplica **solo al hunk de producción**, nunca a los cuerpos de test de los PRs (R-3 ya +fuerza divergencia y los helpers/fixtures upstream pueden no existir en el fork). (ii) Declarar que la +auto-resolución en rebase ocurre **solo si el PR mergea sin cambios** — tres PRs sin revisar muy +probablemente aterricen enmendados tras review, en cuyo caso conflictúan igual que un fix propio. Es +probabilidad, no propiedad; el fallback (un conflicto de una línea en un hunk) es barato. (iii) +Registrar el SHA upstream portado en el cuerpo del commit para que un rebase futuro diffee intención +en segundos. + +**A3 — `crates/buzz-cli/src/commands/repos.rs:144-145` (declararlo en §lane `cli`): reescribir el comentario.** +El comentario vigente argumenta contra el reloj de pared y se vuelve engañoso en cuanto `now` entra en +la expresión. Debe reescribirse nombrando las dos propiedades y qué piso protege cada una: piso +`head + 1` = monotonía (un writer demorado no pisa una edición intermedia); piso `now` = frescura +(el relay acepta el evento dentro de `MAX_TIMESTAMP_DRIFT_SECS`). No se despacha código cuyo +comentario se lea como prohibición de lo que el código hace. + +**A4 — `architecture-v1.md` §lane `cli`: nombrar la consecuencia cross-client y el rollback asimétrico.** +Tras el fix, para repos con head viejo nuestro CLI escribe `created_at ≈ now`. Cualquier otro writer +que siga con la lógica vieja `head + 1` (app desktop, un CLI compilado de upstream en la caja de un +compañero, un agente con binario sin parchar) **deja de poder ganar** un write NIP-33 LWW contra un +repo que ya tocamos: su `+1` queda muy por debajo del reloj de pared. En nuestro relay único y con +nuestros writers es el comportamiento buscado y es lo que upstream hará al mergear — pero es un efecto +sobre datos vivos y entre clientes, y se declara, no se descubre. Rollback: el cambio es forward-only; +revertir el binario restaura el comportamiento viejo para escrituras nuevas pero **no baja** los +`created_at` ya publicados. + +**A5 — `architecture-v1.md` §"La decisión" punto 2: evidencia, no veredicto.** +El endoso publica (i) nuestra reproducción independiente, (ii) las dos propiedades que cualquier fix +debe preservar y el caso de test que las distingue, (iii) que corremos el fix contra un relay vivo. No +publica un veredicto nominal sobre el PR de un contribuidor ("#2901 rompe la monotonía" como callout). +Se expone el test que distingue; que la propiedad argumente sola. Un solo comentario, en #2876 o en el +PR que citemos, bajo A-PachecoT. **Se ratifica: ningún cuarto PR.** + +## Implementation conditions (vinculantes) + +Tres residuos que **no** justifican otra ronda de enmiendas — el fallback de cada uno es derivable +del propio doc, y una tercera pasada por el doc quemaría ventana de autonomía por ganancia marginal. +Se emiten como condiciones vinculantes de implementación: Phase 5 las hereda como criterio de +aceptación de la lane `cli`, y Phase 8 verifica que se cumplieron. + +**IC-1 — "el hunk común" es una premisa a verificar, no un hecho.** +El doc dice que la línea de producción de #4363 y #4509 es "casi con certeza el mismo texto" +(L114) y luego instruye portar "el hunk de producción común" (L120). Si el diff muestra que +**no** son idénticos, el doc no da instrucción. Condición: antes de portar, diffear los dos hunks +de producción. Si son equivalentes → portar y citar ambos SHAs. Si difieren de forma semántica → +el criterio de desempate es la tabla de las dos propiedades del propio doc (L60-63), no la +preferencia; registrar en el cuerpo del commit cuál se portó y por qué se descartó el otro. + +**IC-2 — R-4 se satisface aunque el port no lo traiga.** +R-4 cierra con "Ambos PRs portables ya lo reescriben; verificar que el port lo traiga" (L73). Esa +premisa no está en la tabla de estado verificado. Condición: si al portar resulta que ningún PR +reescribe el comentario de `repos.rs:144-145`, **lo reescribimos nosotros igual**. R-4 es un +requisito de corrección propio, no una dependencia del port. + +**IC-3 — el comentario upstream se publica una vez y no arbitra.** +Un solo comentario en #2876, bajo A-PachecoT, con el contenido que A5 fija. Si genera respuesta +que escale a debate entre PRs o a intercambio con mantenedores de Block, eso excede la lectura por +dominancia de la delegación del operador y **vuelve a gate humano** — no se contesta en autonomía. + +## Alternatives considered + +- **Aprobar tal cual** — rechazada: dejaría pasar a implementación el pick #4509 tomado contra el + criterio que el propio doc declara, y un acto público irreversible sin acotar el contenido. +- **Escribir nuestro propio fix, ignorar los PRs** — rechazada: mismo costo de implementación (una + línea), y garantiza conflicto de rebase en las mismas líneas cuando upstream mergee. Cero ganancia. +- **Abrir un cuarto PR upstream** — rechazada, coincido con el doc: un issue estancado con tres PRs sin + revisar necesita señal de review, no más cola. Un cuarto PR es ruido con nuestro nombre encima. +- **Diferir el pick #4509/#4363 a implementación** — rechazada: en implementación tampoco se sabrá cuál + mergea. A1 lo disuelve en vez de posponer una decisión igual de ciega. +- **`dispatch_research`** — rechazada: la única incógnita restante (cuál PR mergea) es **no + investigable** — depende de reviewers de Block que no han actuado en un issue abierto desde hace + meses. Investigar aquí quema la ventana por una pregunta sin respuesta. +- **Escalar al humano** — rechazada: el operador delegó este eje verbatim y está en contrato de + autonomía. Ningún threshold dispara (ver Sources). Escalar lo ya delegado es el desperdicio que el + contrato prohíbe explícitamente. + +## What would flip this + +- **Si el hunk de producción de #4363 y #4509 resulta NO ser textualmente equivalente** en un aspecto + semántico (no solo orden de argumentos): A1 vuelve a ser una elección real y hay que decidirla con + las dos propiedades como criterio, registrando el descarte. +- **Si un PR upstream recibe review y aterriza enmendado** antes de nuestro merge: el argumento de + auto-resolución cae (A2 ya lo anticipa); portamos el texto mergeado y descartamos el nuestro. +- **Si el fix tuviera que tocar el relay** (`MAX_TIMESTAMP_DRIFT_SECS`, Dockerfile, `deploy/railway/`): + deja de ser mi decisión — son guardrails no negociables del brief y superficie de producción. +- **Si el endoso upstream escalara de un comentario a un PR, un fork público, o un intercambio con + empleados de Block**: eso excede la lectura por dominancia de la delegación y vuelve a gate humano. +- **Si aparecieran writers de terceros no nuestros contra el mismo relay**: A4 pasa de consecuencia + aceptada a bloqueante y hay que coordinar el rollout de binarios antes de despachar. + +## Blast radius (F1c) + +Este gate está **sobre** umbral: `blast_radius_thresholds.triggers.architecture_external_surface` +dispara — la arquitectura publica un release asset nuevo en una superficie de distribución pública +(releases de `cofoundy/buzz`), propone un acto público en `block/buzz` (repo de un tercero), y su +criterio de cierre ejecuta escrituras contra el relay vivo `buzz.cofoundy.dev`. Además el plan toca +dos repos, relevante para `task_graph_repos_gt: 1` en Phase 5. + +Lo declaré en la pasada 1 porque me perjudicaba declararlo: **el `approve` del re-gate debe tomar el +refute-pass adversarial antes de ejecutar.** Un `amend` no lo dispara; el `approve` que venga +después, sí. + +**Pasada 2 — lo sostengo ahora que el `approve` es mío.** Este es el `approve` del que hablaba. +Declararlo cuando era barato (`amend`) y soltarlo cuando cuesta sería exactamente el modo de falla +que F1c existe para atrapar. `blast_radius_thresholds.triggers.architecture_external_surface: true` +dispara → **/cto corre el refute-pass sobre esta aprobación antes de que ejecute.** Si el refuter +disiente, `disagreement: escalate` — va al humano, no lo vetamos ni yo ni él. + +Escribí el archivo para que aguante esa segunda opinión: cada afirmación load-bearing tiene su +fuente, las premisas no verificadas están marcadas como tales (IC-1, IC-2), y §What would flip this +nombra las condiciones que me dan vuelta. + +## Sources + +- `.cofoundy/brief.yaml` — `mvp_scope` (4 ítems, todos fork-local), `out_of_scope` (guardrails de relay), + `recon_findings` R-1/R-2/R-3, `base_branch: railway-deploy` (nunca `main`). +- `.cofoundy/specs/architecture-v1.md` — artefacto bajo gate. +- `.cofoundy/context/constraints/escalation-thresholds.yaml` — `required_keys` **asertados: los 6 + presentes y parseables**, contrato fail-closed satisfecho. Evaluación: `production_main_deploy` no + aplica (Phase 11; base es `railway-deploy`, el relay no se toca); `budget_overrun` no aplica (el brief + no declara presupuesto — explícitamente distinto de key faltante); `security_finding_high` no aplica + (sin hallazgo); `scope_expansion_request` **evaluado y no disparado** — el endoso upstream está fuera + de `mvp_scope` pero dentro de la delegación verbatim del operador por dominancia (un PR upstream, que + sí nombró, es superficie mayor que un comentario); `always_escalate.external_client_comms` no aplica + (participación OSS no es envío a cliente/lead); `autonomy_overrides` todos `false` con + `authorized_by: null` — no invoco ninguno. +- Código verificado esta sesión: `crates/buzz-cli/src/commands/repos.rs:144-151` (comentario + anti-wall-clock + `checked_add(1)`), `:523` y `:717` (ambos assertean `created_at.as_secs() == 101` + — R-3 confirmado). +- Estado upstream verificado esta sesión (vía /cto): block/buzz#2876 OPEN, updated 2026-08-02; `main` + con el bug; #4363 y #4509 ambos `max(now, head+1)` con CI verde, sin revisar; #2901 wall-clock puro, + CI fallando. +- Prior decisions: **ninguna** — `.cofoundy/context/decisions/` vacío. Esta es la primera del ciclo, no + hay contradicción ni SUPERSEDES posible. +- Vault Cofoundy: **flag resuelto en pasada 2 — ausencia CONFIRMADA, no input sin leer.** En pasada 1 + registré como límite que no pude alcanzar `~/cofoundy/handbook/AGENT-INDEX.md` desde este worktree. + /cto lo cerró: grepeó `~/cofoundy/handbook/governance/` incluido `git-strategy.md` y **no existe + política de fork/upstream ni de contribución OSS** en ningún lado del handbook. O sea que no había + regla que consultar. La decisión se apoya donde debía: en la delegación verbatim del operador. Deja + de ser un límite de esta decisión y pasa a ser un hueco del handbook — ver §Next action, punto 5. +- `.cofoundy/specs/research-findings/` no existe — sin research de este ciclo (no se requirió). + +## Next action + +1. ~~Aplicar A1–A5~~ — **hecho**, verificado en pasada 2. +2. ~~Re-gate Phase 2~~ — **hecho**: esta decisión. Phase 2 CERRADA, `approve`. +3. **/cto corre el refute-pass F1c sobre esta aprobación antes de ejecutar** (sobre umbral por + `architecture_external_surface`). Disenso → escala al humano, no se resuelve en autonomía. +4. Superado el refute-pass, **Phase 5 (task graph)**. Dos cosas que llevar a ese gate: + - `blast_radius_thresholds.triggers.task_graph_repos_gt: 1` — el plan toca `cofoundy/buzz` y + `block/buzz`. Muy probablemente dispare refute también en Phase 5. + - **IC-1, IC-2 e IC-3 se heredan como criterio de aceptación de la lane `cli`**, y Phase 8 + verifica que se cumplieron. No son sugerencias. +5. **Follow-up fuera de ciclo (no bloquea nada):** el handbook no tiene política de fork/upstream ni + de contribución OSS, y este ciclo tuvo que resolver ese eje desde una delegación verbal del + operador. Con Buzz siendo un fork vivo de un repo de Block, ese hueco se va a volver a pisar. + Candidato a `handbook/governance/` en el próximo ciclo — anotado aquí para que exista rastro, no + para actuarlo ahora. + +## Refute-pass +**Triggered by:** blast-radius over threshold (n/a) +**Verdict:** SUSTAIN +**Refuter argument:** SUSTAIN con tres premisas refutadas, ninguna toca el radio de explosion. (1) No hay 'hunk comun': #4363 usa Timestamp::now().as_secs().max(head_floor), #4509 usa bumped_head.max(Timestamp::now().as_secs()) — semantica comun, texto distinto; IC-1 ya rutea el caso. (2) El beneficio de patch-id en rebase es estructuralmente CERO, no 'probabilidad': A1 (adoptar tests de ambos PRs) y A3 (comentario propio en el mismo hunk) garantizan cada una que nuestro diff no coincide con ningun patch-id upstream. Dos enmiendas del propio doc matan el beneficio en que descansa su justificacion. (3) 'CI verde' en #4363/#4509 es NO-SENAL: gh pr checks muestra solo DCO+Semgrep+zizmor, cero builds de Rust, cero unit tests — su codigo nunca fue compilado upstream. #2901, descartado como 'CI fallando', PASA Build linux/amd64+arm64, relay e2e y Desktop; falla solo DCO signoff + Security. Es exactamente el misread de statusCheckRollup que git-strategy pre-registra (inbox-ai#278). Consecuencia: los tests de #4363 traen asserts vacuos (>= 1000 contra fixture de 100; >= 101 contra wall clock ~1.7e9) que T-002 mandaba adoptar verbatim. La decision (portar al fork, ningun cuarto PR, comentario de evidencia, reescribir el comentario, verificacion contra relay vivo) sobrevive intacta: el rechazo de #2901 por perdida de monotonia es correcto por su cuenta, cargo test/clippy/fmt en T-002 es el gate real, el texto publicado en #2876 no contiene ninguna afirmacion sobre CI, e IC-3 ya rutea a gate humano un 'cual mergeamos' de un mantenedor. +**Disagreement handling:** no disagreement — approve stands +**Recorded:** 2026-08-04T12:49:08-05:00 diff --git a/.cofoundy/context/decisions/2026-08-04-phase-5-task-graph.md b/.cofoundy/context/decisions/2026-08-04-phase-5-task-graph.md new file mode 100644 index 00000000000..af2ef69aaed --- /dev/null +++ b/.cofoundy/context/decisions/2026-08-04-phase-5-task-graph.md @@ -0,0 +1,257 @@ +# Decision: task graph T-001/T-002 — enmendar antes de despachar; upstream sale del grafo, evidencia viva se carva a T-003 + +**Phase:** 5 +**Date:** 2026-08-04 +**Authority:** ceo-agent (tier-1 partner delegation, /cto cycle `buzz-cli-usable` / 2026-08-04) +**Status:** amended + +## Question + +/cto pide resolver el gate de Phase 5 sobre `.cofoundy/tasks/T-001.md`, `.cofoundy/tasks/T-002.md` y +`.cofoundy/specs/file-ownership-matrix.md`. Contratos a validar: (a) toda línea de aceptación +testeable, (b) ninguna celda de la matriz con 2+ writers, (c) dependencias en DAG, (d) ningún scope +contradice `brief.yaml:mvp_scope`. Más dos preguntas puntuales: si `block/buzz` pertenece al grafo, y +si el vault bloqueado hace el grafo inaprobable. + +## Decision + +**Enmendar, no despachar todavía.** Los cuatro contratos de Phase 5 pasan — el grafo es sólido y las +tres IC de Phase 2 aterrizaron. Pero hay **cuatro enmiendas**, y una de ellas (AM-3) es un hueco de +seguridad que por sí solo justifica no despachar así: nada en el grafo le prohíbe a un worker +**generar credenciales** cuando descubra que no las tiene. + +Las dos preguntas se responden: **el comentario upstream sale del grafo** (pasa a acción de CTO), y +**el vault bloqueado NO hace el grafo inaprobable** — se carva la evidencia viva a un T-003 +operator-gated. Consecuencia de la primera: el grafo baja a un repo y `task_graph_repos_gt` deja de +disparar (ver §Blast radius — lo declaro con su condicional, no como conveniencia). + +## Validación de los cuatro contratos + +**(a) Toda línea de aceptación testeable — PASA, con un hueco de cobertura.** + +T-001: las cuatro son verificables (1-3 por lectura de archivo, 4 por `gh release view`). Nota de +mérito: la línea 4 pre-registra el modo de falla — *"verificado con `gh release view`, no asumido del +log del job"*. Es exactamente la clase de misread que el refute-pass acaba de encontrar en el CI +upstream; verlo internalizado en el grafo es buena señal. + +T-002: las cuatro testeables. 1-3 son `cargo test/clippy/fmt` + lectura. La 4 es evidencia viva +(bloqueada — ver AM-2). + +**El hueco:** `mvp_scope` ítem 2 dice *"una caja sin toolchain de Rust puede clonar y pushear +siguiendo solo el README"*. La aceptación de T-001 verifica que el README **existe y documenta** los +dos requisitos (línea 3) y que el asset **se publica** (línea 4). Nunca verifica que un tercero +siguiendo solo ese README **logre pushear**. Un README puede ser correcto por archivo y aun así +insuficiente por omisión. T-001 puede darse por hecho sin satisfacer el ítem de scope que lo motiva. +→ **AM-4.** + +Corrijo de paso el encuadre que me pasó /cto: la última línea de aceptación de **T-001 no** es +evidencia contra el relay vivo — es `gh release view`. El bloqueo por vault en la lane `ci` no está +en una línea presente, está en la **línea ausente**. Eso cambia dónde hay que remediar. + +**(b) Ninguna celda con 2+ writers — PASA.** + +Verifiqué celda por celda y crucé cada `scope.write` de tarea contra su columna: + +| Tarea | `scope.write` | Celda de matriz | ¿Consistente? | +|---|---|---|---| +| T-001 | workflow, install script, README, `reports/ci.md` | `ci: W` en las cuatro | ✅ | +| T-002 | `repos.rs`, `reports/cli.md` | `cli: W` en ambas | ✅ | + +Intersección de los dos conjuntos de escritura: **vacía**. Las lanes son disjuntas por construcción +(`ci` en `.github/` + `deploy/arch-box/`, `cli` en un solo archivo Rust) ⇒ paralelizables sin rama de +integración, como afirma la matriz. Los tests de T-002 viven en el mismo `repos.rs` (`#[cfg(test)]` +in-file, verificado: `:523` y `:717`), así que no hace falta ampliar su scope de escritura. +`.cofoundy/state/reports/.md` aparece con `W` en ambas columnas pero es un glob parametrizado +por rol — un archivo por lane, colisión imposible. Notación algo laxa, semántica correcta. + +**(c) DAG — PASA.** `T-001.blockedBy: []`, `T-002.blockedBy: []`. Dos nodos independientes; DAG +trivial, sin ciclos. Con el T-003 de AM-2 (`blockedBy: [T-001, T-002]`) sigue siendo DAG. + +**(d) Ningún scope contradice `mvp_scope` — PASA.** Cobertura: ítem 1 → T-001 ✅; ítem 2 → T-001 +**parcial** (hueco de AM-4); ítem 3 → T-002 aceptación 4 (bloqueada); ítem 4 → T-002 aceptación 1 ✅. +Ninguna tarea propone nada **fuera** de `mvp_scope`, así que `thresholds.scope_expansion_request` — +que sí aplica a Phase 5 — **no dispara**. Los guardrails de `out_of_scope` están replicados en ambas +tareas y en la matriz (relay/Dockerfile/railway en solo-lectura, `MAX_TIMESTAMP_DRIFT_SECS` intocable, +sin rebase sobre `railway-deploy`). + +## Las tres IC de Phase 2 + +| IC | ¿Aterrizó? | Dónde | +|---|---|---| +| **IC-1** — "hunk común" es premisa a verificar; si difieren, desempata la tabla de propiedades y se registra el descarte | ✅ **y ya disparó** | T-002 L37-40 (*"No hay un 'hunk común' que copiar literalmente"*) + L65-66 (desempate + *"registrá qué descartaste"*). La condición que puse como hipotética se cumplió: difieren en binding y comentario. IC-1 se ganó el lugar. | +| **IC-2** — R-4 se satisface aunque el port no lo traiga | ✅ vía aceptación | T-002 L82-85 mantiene *"ambos PRs ya lo reescriben, verificá que tu port lo traiga"* — condicional. Pero **aceptación 3** (*"El comentario de `:144` describe las dos propiedades y qué piso protege cada una"*) es **incondicional** y no depende del port. Esa es la forma vinculante que pedí. Satisfecho. | +| **IC-3** — un solo comentario upstream, sin arbitrar, escala si deriva en debate | ⚠️ **parcial** | T-002 L110 saca la acción de la lane (*"La acción upstream la maneja el CTO"*) ✅. Pero el **contenido** de IC-3 no está escrito en ningún artefacto del grafo — vive solo en mi decisión de Phase 2. Ejecutable por /cto, no auditable desde el grafo. → **AM-1** lo formaliza. | + +**Sobre IC-2, una advertencia derivada del refute-pass:** el refuter demostró que *"CI verde en +#4363/#4509"* era no-señal leída como aprobación. La frase *"ambos PRs portables ya lo reescriben"* +(T-002 L84) pertenece a **la misma familia**: una aserción sobre esos PRs que nunca entró a la tabla +de estado verificado. Puede ser igual de falsa. No pido verificarla — la aceptación 3 la vuelve +irrelevante, que es justo por qué IC-2 se escribió incondicional. Queda como recordatorio de que las +premisas sobre PRs no compilados no se heredan. + +## Amendments + +**AM-1 — Sacar `block/buzz` del grafo de tareas.** +`file-ownership-matrix.md` §"Repos tocados" declara dos repos. Reescribir: **el grafo toca un repo**, +`cofoundy/buzz`. El comentario de evidencia en block/buzz#2876 es una **acción de CTO fuera de las +lanes**, gobernada por IC-3 de la decisión de Phase 2, y **secuenciada después de T-003** (su valor es +la reproducción contra relay vivo, que hoy está bloqueada). Añadir a la matriz el puntero a IC-3 para +que la restricción sea auditable desde el grafo y no solo desde mi decisión anterior. + +**AM-2 — Carvar la evidencia viva a `T-003`, operator-gated.** +Mover la aceptación 4 de T-002 (y la línea nueva de AM-4) a un **T-003** nuevo: +`blockedBy: [T-001, T-002]`, `status: blocked`, precondición explícita **"requiere que el operador +desbloquee Vaultwarden (`bw unlock`) y exporte `BUZZ_PRIVATE_KEY` / `NOSTR_PRIVATE_KEY`"**. T-001 y +T-002 quedan **enteramente desbloqueadas** y despachables ya. Consecuencia que hay que decir sin +maquillar: con T-003 pendiente, **el ciclo no puede declararse cerrado** — el `Criterio de cierre` del +brief es *"evidencia ejecutada contra buzz.cofoundy.dev, no compilación verde"*. El grafo es +despachable; el ciclo no es cerrable. Son cosas distintas y no hay que confundirlas al reportar. + +**AM-3 — Prohibir explícitamente mintear credenciales. (El motivo por el que no despacho aún.)** +T-002 L102-103 dice *"Si no tenés credenciales para el relay, decilo — no simules el resultado"*. Eso +prohíbe **simular**, no prohíbe **conseguir**. Un agente diligente lee "no simules" como "entonces +conseguí credenciales de verdad" y el camino obvio es generar un keypair nostr nuevo (`buzz keys +generate` o equivalente) y anunciarle un repo al relay. Eso sería +`always_escalate.credential_mint_or_rotate` — una superficie **no relajable por `autonomy_overrides`** +— disparada por un worker, dentro de un grafo que yo aprobé. Añadir a los guardrails de **ambas** +tareas, textual: + +> No generes, mintees ni rotes credenciales (claves nostr, tokens, entradas de vault) bajo ninguna +> circunstancia. Si falta una credencial, la tarea se detiene y lo reporta. Conseguir credenciales es +> acción del operador, nunca de la lane. + +**AM-4 — Cerrar el hueco de cobertura de `mvp_scope` ítem 2.** +Añadir a T-003 la línea que hoy no existe en ningún lado: en una caja **sin toolchain de Rust**, +siguiendo **solo** `deploy/arch-box/README.md`, un `git clone` + `git push` contra +`buzz.cofoundy.dev` completa verde. Es el único test real del README; su ausencia dejaba a T-001 +declarable "hecha" sin satisfacer el ítem de scope que la motiva. + +## Las dos preguntas, respondidas + +### 1. ¿`block/buzz` pertenece al grafo? — No. Es acción de CTO. + +Cuatro razones, la tercera decisiva: + +1. **No tiene aceptación testeable.** Es un acto comunicativo; no compila, no corre, no pasa/falla. + Meterlo en un grafo cuyo contrato es "toda línea de aceptación testeable" lo corrompe. +2. **Es irreversible y público bajo identidad de la organización**, en el repo de un tercero. + Asimétrico respecto de todo lo demás del grafo, que es reversible con un `git revert`. +3. **El operador me delegó la decisión a mí, no a un worker.** "Vos decidís si parcheás el fork, + upstreameás, o ambos" es delegación a este gate. Un agente de lane publicando en block/buzz es una + delegación **estrictamente mayor** que la que se hizo, y hecha por mí, no por él. No la hago. +4. **Su contenido es gobernanza, no implementación.** Lo rige A5/IC-3 (evidencia, no veredicto; sin + arbitrar entre terceros). Los workers no cargan gobernanza; cargan specs. + +Y hay una dependencia real que el grafo no modela: A5 exige publicar *"nuestra reproducción +independiente contra un relay vivo"*. Sin T-003 no tenemos esa reproducción — **el comentario upstream +está bloqueado por el mismo candado de vault**. Publicarlo antes sería publicar sin la evidencia que +es justamente nuestro aporte diferencial. Secuencia correcta: T-001 ∥ T-002 → T-003 → acción CTO +upstream. + +### 2. ¿El vault bloqueado hace el grafo inaprobable? — No. Aprobable con la evidencia viva diferida. + +El bloqueo es **de credencial, no de diseño**. Nada en el grafo está mal; falta una llave que solo el +operador tiene. Bloquear el dispatch entero por eso desperdiciaría toda la ventana de autonomía en un +candado que nadie más puede abrir — exactamente el desperdicio que el contrato de autonomía nombra +("parar ante una pregunta desperdicia la ventana"). Y lo que queda desbloqueado no es marginal: el +fix, sus tests de propiedad, clippy/fmt, el workflow de CI, el instalador, el README y el release +son la mayor parte del valor del ciclo, y todos verificables sin tocar el relay. + +Lo que **no** hago es fingir que eso cierra el ciclo. El brief pone la vara en evidencia ejecutada +contra `buzz.cofoundy.dev`; con T-003 pendiente el ciclo queda en *"todo verificable hecho y +verificado; falta la verificación viva, gated en el operador"*. Ese es el punto de resume limpio que +el contrato de autonomía sí exige: rama commiteada, lanes cerradas, un solo gesto humano pendiente y +nombrado. + +**Qué necesita Andre a la vuelta** — un gesto, no una sesión: + +```bash +bw unlock # y exportar BUZZ_PRIVATE_KEY / NOSTR_PRIVATE_KEY +``` + +Con eso T-003 corre solo y arrastra el comentario upstream detrás. + +## Alternatives considered + +- **Aprobar y despachar tal cual** — rechazada por AM-3. Despachar un grafo que no prohíbe mintear + credenciales, sabiendo que ambas tareas van a chocar contra una credencial faltante, es sembrar un + disparo de `always_escalate` en el trabajo de un worker. Barato de arreglar ahora, feo después. +- **Rechazar el grafo por el vault** — rechazada: convierte un candado de credencial en un defecto de + diseño y quema la ventana entera por algo que solo el operador destraba. +- **Escalar por el vault** — rechazada: ningún threshold dispara, y "el operador debe destrabar el + vault" es un punto de resume, no una pregunta de gobernanza. Se reporta, no se escala. +- **Dejar el comentario upstream como tarea de lane con guardrails fuertes** — rechazada: ninguna + cantidad de guardrails convierte un acto público irreversible en algo apropiado para un worker + autónomo. La delegación no da para eso. +- **Diferir la evidencia viva marcándola "deferred" dentro de T-001/T-002** — rechazada: dejaría dos + tareas en estado ambiguo (parcialmente aceptadas) y sin nodo que represente el gate del operador. + T-003 lo hace explícito, con `blockedBy` real y precondición nombrada. + +## What would flip this + +- **Si el operador destraba el vault durante el ciclo:** T-003 deja de estar gated, corre en línea, y + el ciclo sí cierra bajo su propio criterio. Nada más cambia. +- **Si /cto rechaza AM-1 y mantiene `block/buzz` en el grafo:** entonces `task_graph_repos_gt: 1` + **sí dispara** y el refute-pass sobre el approve de Phase 5 pasa a ser obligatorio. Las dos cosas + van juntas; no se puede quedar el segundo repo sin el refute. +- **Si al portar aparece que la semántica `max(head+1, now)` no satisface alguna de las dos + propiedades** en el fixture real: deja de ser port y vuelve a ser decisión de diseño → nuevo gate. +- **Si T-001 revela que el helper necesita cambios** para funcionar desde el release: choca con el + guardrail "no modificar `crates/git-credential-nostr/`" (`out_of_scope` del brief) → escala, no se + resuelve en lane. + +## Blast radius (F1c) + +Evaluación de `blast_radius_thresholds.triggers` para el approve de Phase 5 **una vez aplicadas las +enmiendas**: + +| Trigger | ¿Dispara? | Por qué | +|---|---|---| +| `task_graph_repos_gt: 1` | **No, con AM-1** | El grafo pasa a tocar un repo (`cofoundy/buzz`). El comentario upstream sale a acción de CTO. | +| `files_touched_gt: 25` | No | T-001 toca 3 archivos, T-002 uno, más dos reports. ~6. | +| `deploy_any` | No | Superficie de Phase 11. | +| `architecture_external_surface` | No | Es trigger de cambio arquitectónico; ya tomó su refute en Phase 2 (SUSTAIN). | + +**Lo declaro con su condicional porque me conviene el resultado y eso es justamente cuando hay que +mirarlo dos veces.** AM-1 tiene el efecto lateral de bajar el grafo por debajo del umbral. AM-1 se +sostiene **por sus méritos** — un acto público irreversible no es tarea de worker (cuatro razones +arriba) — y yo mismo levanté este umbral en Phase 2 cuando me costaba. Pero el condicional queda +escrito: **si /cto no aplica AM-1, el umbral dispara y el refute es obligatorio.** Y si /cto prefiere +correr el refute igual sobre este approve, no me opongo — `below_threshold: no_refute` es una +optimización de costo, no un derecho del gate. + +## Sources + +- `.cofoundy/tasks/T-001.md`, `.cofoundy/tasks/T-002.md`, `.cofoundy/specs/file-ownership-matrix.md`, + `.cofoundy/specs/architecture-v1.md` (enmendado) — artefactos bajo gate. +- `.cofoundy/brief.yaml` — `mvp_scope` (los 4 ítems, cruzados uno por uno en §(d)), `out_of_scope`, + `Criterio de cierre`. +- `.cofoundy/context/constraints/escalation-thresholds.yaml` — **`required_keys` re-asertados en esta + pasada**: los 6 presentes y parseables. Verifiqué además con `git log` que el archivo **no fue + tocado** por el commit de substrate `1722507f` (último cambio: `c0fe675b6`, el scaffold) — la + config bajo la que decido es la misma que leí en Phase 2. Evaluación: `scope_expansion_request` + aplica a Phase 5 y **no dispara** (ninguna tarea excede `mvp_scope`, ningún `scope.write` invade + celda ajena); `budget_overrun` no aplica (sin presupuesto declarado); `production_main_deploy` y + `security_finding_high` son de Phases 11/8; `always_escalate.credential_mint_or_rotate` **no + dispara — y AM-3 es lo que lo mantiene así.** +- Refute-pass F1c sobre Phase 2: SUSTAIN con tres premisas refutadas, bajadas a substrate en + `1722507f`. Las tres incorporadas a este análisis; la del CI upstream cambia lo que T-002 puede + heredar y ya está reflejada en el propio T-002 (§"El CI upstream no es garantía de nada acá"). +- Código verificado: `repos.rs:523` y `:717` son tests in-file (`#[cfg(test)]`), lo que confirma que + el `scope.write` de T-002 no necesita ampliarse. +- Prior decisions: `2026-08-04-phase-2-architecture.md` (approved, SUSTAIN). **Sin contradicción** — + esta decisión ejecuta sus IC-1/2/3, no las revisa. AM-1 formaliza IC-3 en el grafo; no la cambia. + +## Next action + +1. /cto aplica **AM-1** (matriz: un repo + puntero a IC-3), **AM-2** (crear `T-003`, mover la + aceptación 4 de T-002), **AM-3** (guardrail anti-minteo en T-001 **y** T-002), **AM-4** (línea de + push end-to-end en T-003). +2. Re-gate Phase 5 — espero `approve` directo si las cuatro aterrizan. +3. Ese approve queda **bajo umbral** de blast radius (con AM-1 aplicada) → sin refute obligatorio. + Si /cto conserva el segundo repo, **el refute vuelve a ser obligatorio**. +4. Dispatch: **T-001 ∥ T-002**, en paralelo, sin rama de integración (matriz §Validación: superficie + compartida cero). Ambas 100% desbloqueadas. +5. `T-003` queda `blocked` esperando al operador. **No se despacha, no se simula, no se saltea.** +6. Acción de CTO upstream (comentario en #2876 bajo IC-3) **después** de T-003, nunca antes — sin la + reproducción viva no tenemos el aporte que justifica el comentario. diff --git a/.cofoundy/prompts/2026-08-04-kickoff.md b/.cofoundy/prompts/2026-08-04-kickoff.md new file mode 100644 index 00000000000..ae9dd68c9b3 --- /dev/null +++ b/.cofoundy/prompts/2026-08-04-kickoff.md @@ -0,0 +1,31 @@ +# Prompt-as-source — ciclo buzz-cli-usable (2026-08-04) + +## Kickoff (operador, verbatim) + +> Sos el sitio `buzz-cli-usable` (bus: COFOUNDY_AGENT=buzz-cli-usable). Sprint: +> cofoundy/buzz#1 + #2, rama sprint/buzz-cli-usable — base origin/railway-deploy, +> NUNCA main (main sigue al upstream de Block). Contexto del piloto y sus reglas: +> ~/cofoundy/handbook/infrastructure/buzz/BITACORA.md + +> bitacora/2026-08-01-auditoria-fase2.md. Delta: el relay vivo es +> buzz.cofoundy.dev; #2 ya tiene reproducción nuestra y está reportado upstream +> (block/buzz#2876) — vos decidís si parcheás el fork, upstreameás, o ambos. +> Inbox en cada checkpoint: python3 .../bus.py inbox --as buzz-cli-usable --drain --full. +> Corré /cto. Cerrá publicando evidencia en Basalt. + +## Goal resuelto + +Hacer usable el CLI de Buzz en una caja limpia: shippear `git-credential-nostr` +por CI (#1) y desbloquear los metadatos de repo congelados (#2), con evidencia +contra el relay vivo `buzz.cofoundy.dev`. + +## Decisión delegada explícitamente al CTO + +> "vos decidís si parcheás el fork, upstreameás, o ambos" + +Resuelta en Phase 2 → `.cofoundy/context/decisions/`. + +--- + +## Dispatches + +_(se anexan por wave, cada uno anotado con el artefacto que produjo)_ diff --git a/.cofoundy/specs/architecture-v1.md b/.cofoundy/specs/architecture-v1.md new file mode 100644 index 00000000000..e9a4bd88541 --- /dev/null +++ b/.cofoundy/specs/architecture-v1.md @@ -0,0 +1,178 @@ +# architecture-v1 — buzz-cli-usable + +**Ciclo:** 2026-08-04 · **Base:** `origin/railway-deploy` · **Rama:** `sprint/buzz-cli-usable` + +> Nota de proceso: se omitió el dispatch de Plan-agent (Phase 2b). El espacio de +> diseño de #2 está enumerado exhaustivamente por tres implementaciones upstream +> ya escritas y leídas durante el recon; el de #1 es una adición mecánica a una +> matriz de build. Un Plan-agent habría reformulado lo que los PRs ya dicen. El +> gate de ceo-agent sí corre — ahí está el chequeo real. + +## Estado verificado (no inferido) + +| Aserción | Verificación | Resultado | +|---|---|---| +| block/buzz#2876 sigue abierto | `gh issue view 2876` | OPEN, updated 2026-08-02 | +| upstream `main` sigue con el bug | `git show origin/main:…/repos.rs` | sí, `checked_add(1)` intacto | +| existen PRs upstream para el bug | `gh pr list --search 2876` | **tres**, todos OPEN | +| qué CI corrió realmente en cada PR | `gh pr checks ` | ver abajo — **no** `statusCheckRollup` | + +### Corrección del refute-pass: "CI verde" era no-señal + +La pasada 1 de este doc afirmó que #4363 y #4509 tenían "CI verde", leyendo +`statusCheckRollup` con `jq`. El refute-pass F1c lo refutó y `gh pr checks` lo confirma: + +| PR | Checks que corrieron | Lectura correcta | +|---|---|---| +| #4363 | DCO, Semgrep, zizmor | **cero builds de Rust, cero tests** — su código nunca compiló upstream | +| #4509 | DCO, Semgrep, zizmor | ídem | +| #2901 | Build amd64+arm64, relay e2e, Desktop… todos **pass**; fallan solo DCO signoff y Security | es el único cuyo código Rust upstream sí compiló | + +Es exactamente el misread que `handbook/governance/git-strategy.md` pre-registra +(inbox-ai#278): un array de rollup vacío o trivial se lee como "sin fallos" cuando +significa **"sin señal"**. Consecuencias vinculantes: + +- **"CI verde" queda anulado como garantía de calidad.** Nuestro propio + `cargo test -p buzz-cli` es el **único** gate sobre el código portado. +- Los tests de #4363 nunca se compilaron y contienen asserts vacuos + (`>= 1000` contra un fixture de 100; `>= 101` contra reloj de pared ~1.7e9). + **No se adoptan verbatim** — ver §"Cuál portar". +- El rechazo de #2901 **se mantiene**, pero por su razón sustantiva (pierde la + monotonía), no por su CI. Esa razón es correcta con independencia del CI. + +## Las dos lanes + +### Lane `ci` — issue #1: shippear `git-credential-nostr` + +Puramente aditiva. El workflow ya construye dos binarios (`buzz-acp`, `buzz-cli`) +y publica assets + sha256 a un release por commit. Agregar un tercero es extender +tres listas que ya existen, más el instalador que las consume. + +``` +.github/workflows/buzz-acp-linux.yml + paths: + crates/git-credential-nostr/** ← R-2: hoy un cambio al helper no redispara + cargo build: + -p git-credential-nostr + smoke check: + --help del helper ← no shippear un binario que no arranca + assets: + git-credential-nostr-x86_64-linux (entra al sha256sum existente) + +deploy/arch-box/install-buzz-acp.sh + + HELPER_ASSET + install -m 0755 → $DEST/git-credential-nostr + +deploy/arch-box/README.md ← R-1: NO EXISTE, se crea + los dos requisitos de config no obvios que hacen fallar el push: + · git config credential.useHttpPath true (obligatorio — el helper aborta sin esto) + · NOSTR_PRIVATE_KEY en el entorno, o git config nostr.keyfile con 0600 +``` + +El nombre del release tag (`buzz-acp-linux-`) no cambia: el instalador ya +filtra por ese namespace y renombrarlo rompería los pins existentes. + +### Lane `cli` — issue #2: metadatos congelados + +El fix es conocido y está escrito tres veces upstream. **No escribimos un cuarto.** + +`build_updated_repo_announcement` (`crates/buzz-cli/src/commands/repos.rs:146`) +firma con `existing.created_at + 1`. El relay valida contra reloj de pared con +ventana ±900s (`MAX_TIMESTAMP_DRIFT_SECS`). Como el avance es de +1 y nunca +alcanza al presente, pasados 15 min los metadatos quedan congelados para siempre. + +**Fix:** `next_created_at = max(existing.created_at + 1, now)`. + +Las dos propiedades que el fix debe preservar simultáneamente — y que son la razón +de que `now` a secas (PR #2901) sea incorrecto: + +| Propiedad | Qué la protege | Caso que la ejercita | +|---|---|---| +| **Monotonía** — un writer demorado no pisa una edición intermedia | el piso `head + 1` | head en el **futuro** (reloj del peer adelantado) → resultado debe ser `head + 1`, no `now` | +| **Frescura** — el relay acepta el evento | el piso `now` | head de hace 2 h → drift resultante vs. reloj de pared ≤ 900s | + +R-3: `repos.rs:523` y `:717` assertean `created_at == 101` exacto. Con el fix eso +deja de ser cierto — pasan a assertear las dos propiedades de arriba, no un literal. + +**R-4 (hallado en el gate):** el comentario en `repos.rs:144-145` argumenta +explícitamente *en contra* del reloj de pared ("Using wall-clock time here would let +a delayed writer leapfrog…"). Tras el fix quedaría prohibiendo lo que el código hace +dos líneas abajo. Debe reescribirse para nombrar las dos propiedades y cuál piso +protege cuál — plausiblemente ese comentario es parte de por qué el bug sobrevivió +review upstream. Ambos PRs portables ya lo reescriben; verificar que el port lo traiga. + +### Riesgo sobre datos vivos (no sobre el relay) + +El relay no se toca — el radio de esta lane es nuestra caja y los repos que ya +anunciamos. Dos efectos que el cierre debe asumir conscientemente: + +- **Cross-client:** tras el fix, un writer que todavía corra la lógica vieja + (`head + 1`) no puede volver a ganar un write NIP-33 LWW contra un repo que + nosotros hayamos tocado — su timestamp queda permanentemente por debajo. En un + piloto founders-only con un solo operador esto es inocuo, pero deja de serlo + cuando haya más de un cliente escribiendo metadatos. +- **Rollback asimétrico:** revertir el binario no revierte los timestamps ya + emitidos. El fix es forward-only en la práctica. + +## La decisión: fork, upstream, o ambos + +El operador delegó esto explícitamente. El estado verificado la reencuadra: con +**tres** PRs abiertos, dos de ellos con exactamente nuestro enfoque y CI verde, un +cuarto PR es ruido, no ciudadanía OSS. + +**Propuesta: portar + endosar, no duplicar.** + +1. **Fork:** portar el fix de los PRs upstream existentes. Lo queremos ya — la + protección de ramas mutable es lo que desbloquea repos reales en Buzz. + + **Por qué portar y no escribir el nuestro — justificación corregida.** La pasada 1 + apoyó el port en el ahorro de rebase (patch-id equivalence descartaría nuestro + commit cuando upstream mergee). El refute-pass demostró que ese beneficio es + **estructuralmente cero, no "probable"**: adoptar tests de ambos PRs y escribir + nuestro propio comentario en el mismo hunk garantizan, cada uno por separado, que + nuestro diff no coincida con ningún patch-id upstream. Dos de las enmiendas de este + mismo doc matan el beneficio en que descansaba su justificación. + + Lo que sostiene el port es **procedencia y convergencia**, no ahorro mecánico: + partimos de código que otros ya derivaron del mismo diagnóstico, convergemos al + texto hacia el que upstream va a converger, y no inventamos una tercera variante de + un fix que ya tiene tres. Registrar el SHA upstream portado en el cuerpo del commit + — eso es lo que hace auditable el rebase futuro, con o sin patch-id. +2. **Upstream:** ningún cuarto PR — **ratificado**. En su lugar publicamos + **evidencia** en #2876: nuestra reproducción independiente contra un relay vivo, + las dos propiedades que cualquier fix debe preservar simultáneamente, y el caso de + test que las distingue. Un issue estancado con tres PRs sin review no necesita un + cuarto; necesita el material con el que un reviewer pueda decidir. Publicar + propiedades y un test discriminante — no un veredicto nominal sobre el PR de un + contribuidor — es lo que le sirve al mantenedor y lo que evita que estemos + arbitrando entre terceros. + +**Cuál portar: la pregunta se disuelve, pero no hay "hunk común" textual.** El +refute-pass verificó los dos diffs: #4363 escribe +`Timestamp::now().as_secs().max(head_floor)`, #4509 escribe +`bumped_head.max(Timestamp::now().as_secs())`. **Semántica idéntica, texto distinto** +(distinto nombre de binding, distinto comentario). No existe un hunk común que copiar +literalmente — se porta la *semántica* `max(head + 1, now)`, con nuestro propio +comentario (R-4), citando ambos SHAs. + +Los tests **no se adoptan verbatim** — nunca fueron compilados upstream (§corrección +del refute-pass). Se toma lo que cada uno aporta y se descarta lo vacuo: + +| De | Tomar | Descartar | +|---|---|---| +| #4509 | el test de monotonía (head futuro ⇒ exactamente `head + 1`) y los asserts ajustados `>= before && <= after` | — | +| #4363 | `updated_announcement_stays_within_relay_drift_window_for_stale_head` — el único que nombra el bound ±900 | los asserts vacuos `>= 1000` (fixture de 100) y `>= 101` (reloj de pared ~1.7e9): pasan siempre, no prueban nada | + +Los dos tests que quedan son **complementarios, no competidores**: uno por propiedad +de la tabla de arriba. El doc ya no elige entre PRs con un criterio ("cuál mergea") +que es indecidible hoy y lo seguiría siendo en implementación. + +## Guardrails heredados de los issues (no negociables) + +- No tocar el Dockerfile del relay ni `deploy/railway/`. +- No ampliar `MAX_TIMESTAMP_DRIFT_SECS` — la ventana es defensa anti-replay, el defecto es del CLI. +- No modificar el crate `git-credential-nostr` (funciona; verificado con push y clone reales). +- No rebasear ni forzar sobre `railway-deploy`. + +## Criterio de cierre + +Evidencia ejecutada contra `buzz.cofoundy.dev`, no compilación verde: + +- `git-credential-nostr` en `~/.local/bin` de una caja sin toolchain, vía instalador. +- `git push` verde contra el relay siguiendo solo el README. +- `repos protect set` sobre un repo anunciado hace >15 min → `accepted: true`. diff --git a/.cofoundy/specs/file-ownership-matrix.md b/.cofoundy/specs/file-ownership-matrix.md new file mode 100644 index 00000000000..ff3eee1da98 --- /dev/null +++ b/.cofoundy/specs/file-ownership-matrix.md @@ -0,0 +1,51 @@ +# file-ownership-matrix — buzz-cli-usable + +Roles = columnas. `W` = escribe · `R` = lee · `A` = append-only · vacío = sin acceso. + +| Path glob | ci | cli | notas | +|----------------------------------------------------|----|-----|-------| +| `.github/workflows/buzz-acp-linux.yml` | W | | issue #1 — matriz de build + assets | +| `deploy/arch-box/install-buzz-acp.sh` | W | | issue #1 — instalación del helper | +| `deploy/arch-box/README.md` | W | | issue #1 — **no existe**, lo crea (R-1) | +| `crates/buzz-cli/src/commands/repos.rs` | | W | issue #2 — el fix + sus tests | +| `crates/git-credential-nostr/**` | R | | guardrail: NO modificar | +| `crates/buzz-relay/src/handlers/ingest.rs` | | R | guardrail: NO modificar (MAX_TIMESTAMP_DRIFT_SECS) | +| `deploy/railway/**`, `Dockerfile*` | R | R | guardrail explícito: fuera de scope | +| `.cofoundy/state/reports/.md` | W | W | cada lane escribe SOLO su propio archivo | +| `.cofoundy/state/history.jsonl` | A | A | append-only | +| `.cofoundy/**` (resto) | R | R | el CTO es el único writer | + +## Validación + +Ninguna celda tiene 2+ `W`. Las dos lanes son **disjuntas por construcción**: `ci` +vive enteramente en `.github/` + `deploy/arch-box/`, `cli` en un solo archivo Rust. +Cero superficie compartida ⇒ ambas pueden correr en paralelo y aterrizar por su +cuenta (Phase 8 per-lane autonomous landing), sin rama de integración. + +`.cofoundy/state/reports/.md` es un archivo por rol — nombre único, colisión +de merge imposible. El índice compartido lo escribe solo el CTO. + +## Repos tocados + +**Uno: `cofoundy/buzz`.** (Corregido en el gate de Phase 5, AM-1.) + +El comentario de evidencia en `block/buzz#2876` **no está en el grafo de tareas** — es +una **acción de CTO**, fuera de las lanes, por cuatro razones: + +1. No tiene aceptación testeable: es un acto comunicativo, no compila ni corre. +2. Es irreversible y público bajo identidad de la organización, en el repo de un + tercero — asimétrico respecto de todo lo demás del grafo, revertible con `git revert`. +3. El operador delegó esa decisión **al gate**, no a un worker. Una lane publicando en + `block/buzz` sería una delegación estrictamente mayor que la que se hizo. +4. Su contenido es gobernanza (evidencia, no veredicto; no arbitrar entre terceros), + no implementación. Los workers cargan specs, no gobernanza. + +Restricción vinculante: **IC-3 — un solo comentario.** Si genera debate entre PRs o +intercambio con mantenedores de Block, excede la delegación y vuelve a gate humano. + +Secuencia: `T-001 ∥ T-002 → T-003 → acción CTO upstream`. El comentario está bloqueado +por el mismo candado de vault que T-003: su aporte diferencial es la reproducción +contra un relay vivo, así que publicarlo antes sería publicar sin la evidencia que lo +justifica. + +Ninguna lane escribe en `block/buzz`. Ninguna lane tiene esa ruta en su `scope.write`. diff --git a/.cofoundy/state/cto-loop.yaml b/.cofoundy/state/cto-loop.yaml new file mode 100644 index 00000000000..6e85f6ce100 --- /dev/null +++ b/.cofoundy/state/cto-loop.yaml @@ -0,0 +1,21 @@ +schema_version: 1.0 +cycle: relay-upgrade +last_phase: 11 +last_phase_at: 2026-08-25T22:30:00-05:00 +project_root: /Users/styreep/cofoundy/products/buzz-cto-relay-upgrade +worker_id: cto-e3e022 +branch: cto/relay-upgrade-rebase +upstream_base: 52621c09bea503f4d5860030dfabfaf9ade71bfa +pr: https://github.com/cofoundy/buzz/pull/5 +superseded_pr: https://github.com/cofoundy/buzz/pull/4 +verified: + - "cargo check -p buzz-relay -> Finished, sin errores" + - "7/7 archivos exclusivos del fork presentes tras el rebase" + - "6/6 migraciones presentes; 0 destructivas de filas" + - "remote HEAD == local HEAD (c28ac821)" +unverified: + - "CI de GitHub: en vuelo al cierre (monitor armado). El PR #4 no dio senal alguna." + - "docker build del deploy/railway/Dockerfile: NO ejecutado localmente" + - "migraciones contra una DB real: NO ejecutadas" +gates_pending: + - phase_11_deploy_approval: E-001 (backup del Postgres) diff --git a/.cofoundy/state/escalation-queue.jsonl b/.cofoundy/state/escalation-queue.jsonl new file mode 100644 index 00000000000..baebf64b657 --- /dev/null +++ b/.cofoundy/state/escalation-queue.jsonl @@ -0,0 +1 @@ +{"id": "E-001", "ts": "2026-08-25T22:25:53.818940-05:00", "by": "cto-e3e022", "kind": "capability_gap", "severity": "blocking", "status": "open", "branch": "cto/relay-upgrade-rebase", "phase_blocked": 11, "title": "No hay ruta de backup del Postgres de prod; PR #5 no puede mergearse sin ella", "detail": "PR #5 verificado (cargo check limpio, 20 commits del fork rebasados sobre upstream 52621c09). Mergear dispara redeploy + 6 migraciones. No existe ruta de backup: Postgres sin proxy TCP publico; CLI de Railway Unauthorized con el RAILWAY_API_TOKEN (sirve para GraphQL, no para el CLI); la query de backups nativos no existe en ese schema. Dos intentos, dos muros -> capa equivocada. Las salidas restantes son cambios de configuracion de produccion con superficie de seguridad, decision del founder. Mitigante medido: ninguna de las 6 migraciones borra filas (cero DELETE FROM / TRUNCATE / DROP TABLE); solo constraints, indices y triggers.", "options": {"A": "Andre saca el dump desde el dashboard de Railway", "B": "autorizar proxy TCP temporal; dump con pg17 ya instalado; borrar el proxy al terminar", "C": "mergear sin backup, apoyandose en que ninguna migracion borra filas", "D": "posponer el upgrade hasta decidir el cliente movil (Buzz lleva 2 turnos de uso real)"}, "suggested_default": "D", "evidence": ["gh pr checks 4 -> Detect Changed Paths fail, 15 jobs skipping (cero senal)", "cargo check -p buzz-relay -> Finished, sin errores", "railway whoami -> Unauthorized", "grep destructivas en migrations/0027..0032 -> 0 DELETE/TRUNCATE/DROP TABLE"]} diff --git a/.cofoundy/state/history.jsonl b/.cofoundy/state/history.jsonl new file mode 100644 index 00000000000..65d055d6a17 --- /dev/null +++ b/.cofoundy/state/history.jsonl @@ -0,0 +1,31 @@ +{"ts": "2026-08-04T17:29:25Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T17:38:58Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/.herdr/worktrees/buzz/sprint-buzz-cli-usable/.gitignore"]} +{"ts": "2026-08-04T17:49:07Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T17:51:36Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:00:05Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:00:14Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:00:24Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:00:44Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:01:08Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:03:36Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:04:03Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:04:07Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:04:31Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:04:35Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:05:02Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/cofoundy/products/buzz/.claude/worktrees/agent-aa4a3d4e9f60df421/crates/buzz-cli/src/commands/repos.rs"]} +{"ts": "2026-08-04T18:05:07Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:05:11Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:05:34Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:06:16Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:08:17Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:08:17Z", "event": "task_completed", "task": "T-002", "agent": "cli", "cycle": "buzz-cli-usable", "summary": "max(head+1,now) portado de #4363/#4509; 273 passed 0 failed, clippy -D warnings limpio, fmt limpio; ambas propiedades verificadas por mutacion"} +{"ts": "2026-08-04T18:08:38Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:08:54Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:08:59Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "cargo"} +{"ts": "2026-08-04T18:12:05Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:11:41Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:11:41Z", "event": "task_completed", "task": "T-001", "agent": "ci", "cycle": "2026-08-04", "summary": "git-credential-nostr shipped by CI: workflow builds/smokes/publishes 3 binaries, installer installs 3, deploy/arch-box/README.md created; verified green run 30936986998 + gh release view buzz-acp-linux-f40de5a"} +{"ts": "2026-08-04T18:15:46Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:17:55Z", "event": "cto_gate_allow_orchestrator", "target": ["/Users/styreep/.herdr/worktrees/buzz/sprint-buzz-cli-usable/docs/reports/buzz-cli-usable.md"]} +{"ts": "2026-08-04T18:21:15Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} +{"ts": "2026-08-04T18:21:15Z", "event": "scope_advisory", "reason": "interpreter_write_invisible", "interpreters": "python3"} diff --git a/.cofoundy/state/next-session-prompt.md b/.cofoundy/state/next-session-prompt.md new file mode 100644 index 00000000000..461f3260de0 --- /dev/null +++ b/.cofoundy/state/next-session-prompt.md @@ -0,0 +1,51 @@ +# Kickoff listo para la próxima sesión — `buzz-cli-usable` + +Copiá esto tal cual al arrancar. Re-fundamentá en el substrate (Step 2 de `/cto` +infiere la fase del disco) y parate en los gates. + +--- + +Sos el sitio `buzz-cli-usable`. Rama `sprint/buzz-cli-usable` @ `b7f5b2c38`, base +`railway-deploy`, **nunca `main`**. Estado y decisiones del ciclo anterior en +`.cofoundy/` — leelo antes de actuar, no re-derives. + +**Lo hecho (2026-08-04):** T-001 y T-002 mergeados y pusheados. cofoundy/buzz#1 y #2 +arreglados y verificados: 273 tests, clippy y fmt limpios, release +`buzz-acp-linux-f40de5a` con los tres binarios verificado por checksum. El fix de #2 +se **portó** de block/buzz#4363/#4509 en vez de escribirse — ya había tres PRs +abiertos upstream. + +**Lo pendiente, en orden:** + +1. **T-003 — la evidencia viva.** Es lo único que separa este ciclo de estar cerrado; + el criterio del brief es evidencia contra `buzz.cofoundy.dev`, no build verde. + Precondición: Andre corre `bw unlock` y exporta `BUZZ_PRIVATE_KEY`. Spec completa + en `.cofoundy/tasks/T-003.md`. Tres pruebas: `repos protect set` sobre un repo de + >15 min, el helper en `~/.local/bin` de una caja sin toolchain, y `clone`+`push` + siguiendo **solo** `deploy/arch-box/README.md`. +2. **El comentario a block/buzz#2876.** Redactado en + `.cofoundy/state/upstream-2876-comment.draft.md`, sin publicar. Va **detrás** de + T-003 porque su aporte diferencial es la reproducción contra relay vivo. Gobernado + por IC-3: **un solo comentario**; si genera debate entre PRs o intercambio con + mantenedores de Block, vuelve a gate humano. +3. **Publicar el exec-summary en Basalt** (`docs/reports/buzz-cli-usable.md`). Requiere + OAuth interactivo — `mcp__basalt__authenticate` y que Andre autorice en el browser. +4. Cerrar cofoundy/buzz#1 y #2 recién cuando corra T-003, no con el merge. + +**Contrato de autonomía que sigue vigente:** gates vía `ceo-agent`, nunca +`AskUserQuestion`; escalaciones a `.cofoundy/state/escalation-queue.jsonl`; y la +prohibición que el gate de Phase 5 hizo textual — **no generar, mintear ni rotar +credenciales bajo ninguna circunstancia**. Si falta una, la tarea se detiene y lo +reporta. + +**Decisiones que son de Andre, no tuyas:** + +- Autorizar el comentario upstream (acto público e irreversible en el repo de Block + bajo su identidad). +- Si `sprint/buzz-cli-usable` va a `railway-deploy` por PR o directo, y cuándo. +- Si el handbook necesita una política de fork/upstream. Este ciclo resolvió ese eje + desde una delegación verbal; con Buzz siendo un fork vivo de Block, el hueco se + vuelve a pisar. + +**Kill switch:** si el relay está caído o `bw` sigue locked, no hay nada que hacer acá +— reportá y parate. No inventes evidencia, no generes llaves. diff --git a/.cofoundy/state/reports/ci.md b/.cofoundy/state/reports/ci.md new file mode 100644 index 00000000000..2c0538f7d4c --- /dev/null +++ b/.cofoundy/state/reports/ci.md @@ -0,0 +1,139 @@ +# Lane `ci` — T-001 report + +**Branch:** `lane/ci-git-credential-nostr` (off `sprint/buzz-cli-usable`) +**Commit:** `f40de5a16` — DCO signed off +**Status:** all four acceptance lines pass, evidence below. + +## What changed + +| File | Change | +|---|---| +| `.github/workflows/buzz-acp-linux.yml` | `paths:` + `crates/git-credential-nostr/**`; `cargo build` + `-p git-credential-nostr`; smoke check + helper; asset `git-credential-nostr-x86_64-linux` into the existing `sha256sum` and both `gh release` branches | +| `deploy/arch-box/install-buzz-acp.sh` | `HELPER_ASSET` + `install -m 0755` → `$DEST/git-credential-nostr`, added to the final echo and the verification run | +| `deploy/arch-box/README.md` | **new** — deploy guide + the two config requirements | + +Tag scheme `buzz-acp-linux-` unchanged, as required. +`crates/git-credential-nostr/` read only, never modified. + +## Acceptance + +### 1. Workflow builds, smoke-checks and publishes all three; `paths:` includes the crate + +Green run on this branch: [`30936986998`](https://github.com/cofoundy/buzz/actions/runs/30936986998) +— every step ✓, `gh run watch --exit-status` returned 0. + +From the run log: + +``` +Run cargo build --release -p buzz-acp -p buzz-cli -p git-credential-nostr + Compiling git-credential-nostr v0.1.0 (/home/runner/work/buzz/buzz/crates/git-credential-nostr) +Smoke check: + ./target/release/buzz-acp --help > /dev/null + ./target/release/buzz --help > /dev/null + ./target/release/git-credential-nostr --help > /dev/null +``` + +`paths:` parsed back out of the YAML (no `pyyaml` in this env — used ruby): +`["crates/buzz-acp/**", "crates/buzz-sdk/**", "crates/buzz-ws-client/**",` +`"crates/git-credential-nostr/**", "rust-toolchain.toml", ".github/workflows/buzz-acp-linux.yml"]` +→ R-2 closed: a change to the helper now redispatches the build. + +### 2. Installer installs the three into `$DEST` + +`bash -n` clean, `shellcheck` clean. The asset name in the script +(`git-credential-nostr-x86_64-linux`) is byte-identical to what the workflow +published, and the existing download pattern `*x86_64-linux*` matches it — +proven by actually downloading the release with that pattern (all four files +came down). The pre-existing `sha256sum -c` now covers the helper for free: + +``` +$ shasum -a 256 -c buzz-acp-x86_64-linux.sha256 +buzz-acp-x86_64-linux: OK +buzz-x86_64-linux: OK +git-credential-nostr-x86_64-linux: OK exit=0 +``` + +Downloaded helper is a real target binary, not a truncated artifact: +`ELF 64-bit LSB pie executable, x86-64 … for GNU/Linux 3.2.0`. + +**Not executed end-to-end**: this lane runs on macOS, so the script's actual +`install` of Linux ELFs onto a host was not run. That is the arch box, and it is +T-003's gate. + +### 3. `deploy/arch-box/README.md` documents both requirements, verified against the crate + +Not copied by eye — every documented error string was **reproduced against a +locally built binary** (`cargo build --release -p git-credential-nostr`) by +feeding it the git credential protocol on stdin: + +| Documented cause | Reproduced output | +|---|---| +| `credential.useHttpPath` unset | `error: credential.useHttpPath must be true for NIP-98 auth` | +| keyfile at `0644` | `error: keyfile has insecure permissions (expected 0600)` | +| no key at all | `error: no nostr key configured. Set $NOSTR_PRIVATE_KEY or git config nostr.keyfile` | + +Permission rule stated precisely from `lib.rs:33` (`mode & 0o177 != 0`), so the +README says `0600` **and** `0400` pass — not the vaguer "must be 0600". + +Two additions beyond the two required requirements, both because they produce +the *same* symptom as the bug T-001 exists to fix and would otherwise send the +T-003 tester down the wrong path: + +- `git config credential.helper nostr` — without registering it, the helper is + installed but never invoked. +- **git 2.46+** — the helper needs the credential protocol's `authtype` + capability (`lib.rs:118`). On older git it exits *silently* (`lib.rs:160-163`) + and git falls through to a username prompt, i.e. the identical + `could not read Username` failure as having no helper at all. + +### 4. Green run + release carries the new asset with its sha256 + +Verified with `gh release view`, not from the job log: + +``` +$ gh release view buzz-acp-linux-f40de5a --repo cofoundy/buzz --json tagName,assets +buzz-acp-linux-f40de5a +buzz-acp-x86_64-linux 16118448 bytes +buzz-acp-x86_64-linux.sha256 272 bytes +buzz-x86_64-linux 16274208 bytes +git-credential-nostr-x86_64-linux 1462016 bytes +``` + +The `.sha256` manifest carries all three lines, including +`376c762f… git-credential-nostr-x86_64-linux`. + +## Flags for the orchestrator + +1. **The verification run published a release that is now `latest=true`.** + Triggering the workflow was the only way to satisfy acceptance 4, and + `install-buzz-acp.sh` with no pin takes the newest `buzz-acp-linux-*` tag — + so an unpinned install on the arch box now pulls `buzz-acp-linux-f40de5a`, + built from this lane branch rather than from `railway-deploy`. + Low risk, stated so it is a decision and not a surprise: this branch is + `railway-deploy` + 3 doc-only `.cofoundy/` commits + this CI commit, so the + binaries are functionally railway-deploy's plus the helper. To pin the deploy + path back: `gh release delete buzz-acp-linux-f40de5a --repo cofoundy/buzz`, + or install with an explicit sha. `railway-deploy` was not touched, rebased, + or force-pushed. + +2. **`--help` on the helper is a no-op, by design.** It has no clap; an unknown + argument hits `lib.rs:155` (`Some(_) => return 0`) and exits 0 with zero + output — confirmed locally. The spec asked for `--help` and it does deliver + the signal the step wants (the binary loads, links and runs); `get` would + block on stdin. Both the workflow and the installer carry a comment saying + so, so nobody later reads the silent output as breakage. + +3. **Deviation (small, deliberate):** the installer does not hard-fail when a + pinned *older* build has no helper asset. Pinning an old sha is documented + usage, and `install` would have died with `cannot stat`; it now warns and + names the consequence instead. Any build from this commit forward installs + all three. + +4. **Untested by this lane, by design:** that a third party following only this + README can push. That is T-003 / AM-4 and needs a credential only the + operator unlocks. No credential was generated, minted or rotated here. + +5. `.cofoundy/state/history.jsonl` accumulated hook-generated `scope_advisory` / + `cto_gate_allow_orchestrator` lines during this run. It is a shared surface, + so it was kept out of the deliverable commit to avoid a merge collision with + the `cli` lane; only the `task_completed` line is committed, separately. diff --git a/.cofoundy/state/reports/cli.md b/.cofoundy/state/reports/cli.md new file mode 100644 index 00000000000..81d9063e8bf --- /dev/null +++ b/.cofoundy/state/reports/cli.md @@ -0,0 +1,135 @@ +# Lane `cli` — T-002: descongelar los metadatos de repo + +**Branch:** `lane/cli-timestamp-unfreeze` (base `sprint/buzz-cli-usable`) +**Issue:** cofoundy/buzz#2 · **Upstream:** block/buzz#2876 +**Archivo tocado:** `crates/buzz-cli/src/commands/repos.rs` (único en `scope.write` de código) + +--- + +## Qué se portó y de dónde + +El fix es `next_created_at = max(head + 1, now)`. Se portó la **semántica** de los dos +PRs upstream, no el texto — como manda la tarea, porque no hay hunk común literal. + +| PR | SHA de la rama | Qué aporta | Qué se tomó | +|---|---|---|---| +| [#4363](https://github.com/block/buzz/pull/4363) | `Timestamp::now().as_secs().max(head_floor)` | el test que nombra el bound ±900 | `updated_announcement_stays_within_relay_drift_window_for_stale_head` | +| [#4509](https://github.com/block/buzz/pull/4509) | `bumped_head.max(Timestamp::now().as_secs())` | el test de monotonía + asserts ajustados | `update_of_fresh_head_stays_monotonic_over_it`, patrón `>= before && <= after` | +| [#2901](https://github.com/block/buzz/pull/2901) | reloj de pared a secas | — | **descartado**: pierde la monotonía (demostrado abajo, Mutación 2) | + +Verificado leyendo ambos diffs: difieren **solo** en nombre del binding +(`head_floor` vs `bumped_head`) y en el comentario. Semánticamente idénticos — +`a.max(b)` es conmutativo. No hubo que desempatar por la tabla de propiedades. +Se adoptó el orden de #4509 (`head_floor.max(now)`) con nombre de #4363 +(`head_floor`) y comentario propio (R-4). + +### Qué se descartó explícitamente + +- **Los asserts vacuos de #4363**, tal como los describe la tarea. Confirmado leyendo el + diff: `assert!(created_at >= 1000)` contra un fixture de `100` y + `assert!(created_at >= 101)` — con el fix `created_at ≈ 1.7e9`, así que ambos pasan + siempre y no prueban nada. +- **El test `protection_set_preserves_metadata_and_protections` de #4363** entero: duplica + la cobertura de tags del test que ya existe en nuestro árbol + (`protection_update_preserves_metadata_and_replaces_only_matching_pattern`) y su único + aporte nuevo eran los dos asserts vacuos de arriba. + +### Desviación consciente (una) + +En el sitio `:717` (`bind_channel_replaces_duplicates…`) **#4509 usa +`>= existing.created_at.as_secs()`**, o sea `>= 100` contra un reloj de ~1.7e9 — vacuo +por el mismo motivo que los de #4363. Se aplicó ahí el bracket ajustado +`>= before && <= after` en vez de portarlo literal. Es más estricto que cualquiera de los +dos PRs y sigue la directiva de la tarea: assertear las propiedades, **nunca** un literal. + +--- + +## R-3 y R-4 + +- **R-3** — los dos `assert_eq!(updated.created_at.as_secs(), 101)` (`:523`, `:717`) + eliminados. Ambos pasan a assertear la propiedad de frescura con el bracket + `before`/`after` que envuelve la llamada. Cero literales de timestamp en el archivo. +- **R-4** — el comentario de `:144` ya no argumenta contra el reloj de pared. Ahora nombra + las **dos** propiedades y **cuál piso protege cuál**: `head + 1` → monotonía (piso + vinculante con head futuro), `now` → frescura (piso vinculante con head stale), y por qué + cada uno solo es un bug distinto. + +--- + +## Las dos propiedades están enforced por separado (mutation testing) + +El riesgo central de esta tarea es shipear tests que pasan sin probar nada. Se verificó +mutando el fix en las dos direcciones y confirmando qué falla: + +| Variante de `next_created_at` | monotonía | frescura (3 tests) | total | +|---|---|---|---| +| `head_floor` — bug original | ok | **FAILED** | 270 passed, **3 failed** | +| `Timestamp::now()` — error de #2901 | **FAILED** | ok | 272 passed, **1 failed** | +| `head_floor.max(now)` — **el fix** | ok | ok | **273 passed, 0 failed** | + +Cada propiedad tiene al menos un test que falla cuando —y solo cuando— esa propiedad se +rompe. Ninguno de los dos es vacuo, y la tabla reproduce exactamente el argumento de la +tarea sobre por qué `now` a secas es incorrecto. + +--- + +## Aceptación — output real + +### 1. `cargo test -p buzz-cli` — verde + +``` +test commands::repos::tests::update_of_fresh_head_stays_monotonic_over_it ... ok +test commands::repos::tests::updated_announcement_stays_within_relay_drift_window_for_stale_head ... ok +test commands::repos::tests::protection_update_preserves_metadata_and_replaces_only_matching_pattern ... ok +test commands::repos::tests::bind_channel_replaces_duplicates_and_preserves_everything_else ... ok + +test result: ok. 273 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.01s + + Running unittests src/main.rs (target/debug/deps/buzz-d4a8c93353fd965f) +running 0 tests +test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s + + Doc-tests buzz_cli +running 1 test +test crates/buzz-cli/src/lib.rs - run_from_args (line 19) ... ignored +test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s +``` + +Los dos tests de propiedad presentes; los dos asserts literales eliminados. + +### 2. `cargo clippy -p buzz-cli -- -D warnings` — limpio + +``` + Checking buzz-ws-client v0.1.0 (/Users/.../crates/buzz-ws-client) + Checking buzz-cli v0.1.0 (/Users/.../crates/buzz-cli) + Finished `dev` profile [unoptimized + debuginfo] target(s) in 37.47s +``` + +Cero warnings con `-D warnings`. + +### 3. `cargo fmt --check` — limpio + +``` +(sin output — exit 0) +``` + +--- + +## Notas para el CTO + +- **Base drift al spawn (corregido).** El worktree nació en `b1b283cd4` = `main`, no en + `sprint/buzz-cli-usable`; `.cofoundy/` ni siquiera existía. Se aplicó el spawn step 0 del + agent-floor: `git checkout -B lane/cli-timestamp-unfreeze sprint/buzz-cli-usable`, luego + `merge-base --is-ancestor` OK. Vale la pena revisar por qué el harness lo creó off `main` + — es exactamente el fallo que el floor §2026-07-22-worktree-base-drift anticipa, y otras + lanes de este sprint arrancarían igual. +- **Evidencia contra relay vivo: NO incluida**, según la tarea (es de T-003, gate de Phase 5 + AM-2, depende de credencial que solo el operador desbloquea). No se generó, minteó ni rotó + ninguna credencial. Vaultwarden sigue locked y no se tocó. +- **`ingest.rs` solo lectura** — `MAX_TIMESTAMP_DRIFT_SECS` no se tocó. El valor `900` se + duplica como `const` local en el test nuevo solo para nombrar el bound en el mensaje de + fallo; no importa ni modifica el del relay. +- **Riesgo forward-only** (ya en el spec §"Riesgo sobre datos vivos"): revertir el binario no + revierte timestamps ya emitidos, y un cliente con lógica vieja (`head + 1`) queda + permanentemente por debajo en un LWW contra un repo que nosotros toquemos. Inocuo en + piloto founders-only con un operador; deja de serlo con >1 cliente escribiendo metadatos. diff --git a/.cofoundy/state/upstream-2876-comment.draft.md b/.cofoundy/state/upstream-2876-comment.draft.md new file mode 100644 index 00000000000..ffe1b973da5 --- /dev/null +++ b/.cofoundy/state/upstream-2876-comment.draft.md @@ -0,0 +1,72 @@ +# DRAFT — comentario para block/buzz#2876 + +**Estado:** NO PUBLICADO. Requiere (a) el gate de Phase 5 confirmando que esta acción +es del CTO y no de una lane, y (b) habilitación del operador — es un acto público en +el repo de un tercero, bajo la identidad `A-PachecoT`. + +**Restricciones que este texto respeta:** +- IC-3: **un solo comentario**. Si genera debate entre PRs o intercambio con + mantenedores de Block, eso excede la delegación y vuelve a gate humano. +- A5: publica **evidencia** (reproducción + propiedades + test discriminante), no un + veredicto sobre el PR de ningún contribuidor. No nombramos un ganador — eso sería + arbitrar entre terceros. +- Refute-pass: **ninguna afirmación sobre el CI de ningún PR.** Nuestra lectura previa + de `statusCheckRollup` fue no-señal leída como aprobación; no exportamos ese error. + +--- + +We hit this independently on a self-hosted relay and ended up reproducing it from +scratch before finding this issue. Since there are now several proposed fixes open, +here is the evidence we gathered, framed as the properties any fix has to satisfy +rather than a vote for a particular patch. + +### Reproduction + +Against a live relay, with a repo announced more than 15 minutes earlier: + +``` +$ buzz repos protect set --id --ref refs/heads/main --push owner --no-force-push +{"error":"relay_error","message":"... event timestamp too far from server time"} +``` + +The failure is permanent, not transient: `build_updated_repo_announcement` +(`crates/buzz-cli/src/commands/repos.rs`) stamps every mutation with +`existing.created_at + 1`, while the relay validates against wall clock with a ±900s +window (`MAX_TIMESTAMP_DRIFT_SECS`, `crates/buzz-relay/src/handlers/ingest.rs`). A +1 +advance never catches up to the present, so once an announcement is older than the +drift window its metadata is frozen for good — `repos bind`, `repos protect set` and +`repos protect remove` all stop being accepted. + +### Why it bites harder than it looks + +Combined with #2877 (the `buzz-channel` tag is the git ACL) and #2326 (no way to +delete a repo announcement), a repo announced without `--channel` becomes permanently +single-pusher with no in-band recovery. There is exactly one ~15-minute window at +creation time in which the binding can be made correct, forever. Our operational rule +while this is open is "always pass `--channel` in the same command as +`repos create`" — which works, but it is a rule humans have to remember rather than a +property the tool enforces. + +### The two properties, and the test that distinguishes them + +A fix has to preserve both of these **simultaneously**. This is the part worth +pinning down, because it is what separates the proposed patches: + +| Property | What protects it | Case that exercises it | +|---|---|---| +| **Monotonicity** — a delayed writer must not leapfrog an intervening update and silently erase metadata (the property the original `+1` comment was defending) | the `head + 1` floor | a head in the **future** (peer clock ahead, still inside the drift window) must yield exactly `head + 1`, **not** `now` | +| **Freshness** — the relay accepts the event | the `now` floor | a head from 2 hours ago must yield a timestamp whose drift from wall clock is ≤ 900s | + +A plain wall-clock stamp satisfies the second and loses the first. `head + 1` satisfies +the first and loses the second. The monotonicity case is the one we would suggest any +fix carry a regression test for, since it is the property that fails silently — a lost +`max()` floor does not produce an error, it produces an update that quietly loses to +the head it was derived from. + +One adjacent note for whoever picks this up: the comment currently above that code +argues explicitly *against* using wall-clock time. Whatever fix lands, that comment +needs to be rewritten to name both floors — left as-is it reads as a prohibition on +what the corrected code does two lines below, which is plausibly part of why this +survived review in the first place. + +Happy to test a candidate patch against our relay if that is useful. diff --git a/.cofoundy/tasks/T-001.md b/.cofoundy/tasks/T-001.md new file mode 100644 index 00000000000..939cf1fe9b5 --- /dev/null +++ b/.cofoundy/tasks/T-001.md @@ -0,0 +1,81 @@ +--- +id: T-001 +title: Shippear git-credential-nostr por CI + instalador + README de deploy +role: ci +status: ready +issue: cofoundy/buzz#1 +blockedBy: [] +scope: + write: + - .github/workflows/buzz-acp-linux.yml + - deploy/arch-box/install-buzz-acp.sh + - deploy/arch-box/README.md + - .cofoundy/state/reports/ci.md + read: + - crates/git-credential-nostr/** + - .cofoundy/specs/architecture-v1.md +--- + +# T-001 — `git-credential-nostr` en el release del fork + +Sin este binario, `git push` contra `buzz.cofoundy.dev` es imposible en una caja +limpia: el helper NIP-98 no existe y git aborta con +`fatal: could not read Username for 'https://buzz.cofoundy.dev'`. Hoy hay que +compilarlo a mano (`cargo build --release -p git-credential-nostr`, 1m35s + toolchain). + +## Qué hacer + +**`.github/workflows/buzz-acp-linux.yml`** — el workflow ya construye y publica dos +binarios; este es el tercero. Cuatro puntos: + +- `paths:` → agregar `crates/git-credential-nostr/**`. Hoy un cambio al helper **no + redispara el build** (R-2). Es un gap real, no cosmético. +- `cargo build` → agregar `-p git-credential-nostr`. +- smoke check → agregar el `--help` del helper. La razón declarada del paso es no + shippear un binario que no arranca; un tercer binario sin smoke lo contradice. +- assets → `git-credential-nostr-x86_64-linux`, dentro del `sha256sum` existente y + del `gh release upload/create`. + +**No renombrar el tag** (`buzz-acp-linux-`): el instalador filtra por ese +namespace y renombrarlo rompe los pins existentes. + +**`deploy/arch-box/install-buzz-acp.sh`** — instalar el tercer binario junto a los +otros dos (`install -m 0755` → `$DEST/git-credential-nostr`), y sumarlo al eco final +y al `--help` de verificación. + +**`deploy/arch-box/README.md`** — **no existe, lo creás vos** (R-1). El issue asume +que hay uno. Debe documentar los dos requisitos de config que no son obvios y que +hacen fallar el push con errores que no se explican solos: + +- `git config credential.useHttpPath true` — **obligatorio**; sin esto el helper + aborta con `credential.useHttpPath must be true for NIP-98 auth`. +- `NOSTR_PRIVATE_KEY` en el entorno, **o** `git config nostr.keyfile ` con + permisos `0600` (el helper valida el modo y rechaza si es más laxo). + +Leé `crates/git-credential-nostr/README.md` antes de escribirlo — no inventes la +config, copiala de la fuente. El crate es **solo lectura**: no lo modifiques. + +## Aceptación + +1. `.github/workflows/buzz-acp-linux.yml` construye, smoke-checkea y publica los + **tres** binarios, y su `paths:` incluye el crate del helper. +2. `install-buzz-acp.sh` instala los tres en `$DEST`. +3. `deploy/arch-box/README.md` existe y documenta los dos requisitos de config, + verificados contra el README del crate. +4. El workflow corre verde en GitHub Actions y el release trae el asset nuevo con su + sha256 — **verificado con `gh release view`, no asumido del log del job**. + +**Lo que NO verificás vos:** que un tercero siguiendo *solo* tu README logre pushear. +Eso es `T-003` (gate de Phase 5, AM-4) y necesita una credencial que solo el operador +desbloquea. Escribí el README como si esa prueba fuera a correr — porque va a correr, y +si falla, el bug es del README y vuelve acá. + +## Guardrails + +> **No generes, mintees ni rotes credenciales** (claves nostr, tokens, entradas de +> vault) bajo ninguna circunstancia. Si falta una credencial, la tarea se detiene y lo +> reporta. Conseguir credenciales es acción del operador, nunca de la lane. + +- No tocar `deploy/railway/`, ningún `Dockerfile`, ni el relay. +- No modificar `crates/git-credential-nostr/` (funciona; verificado con push y clone reales). +- No rebasear ni forzar sobre `railway-deploy`. diff --git a/.cofoundy/tasks/T-002.md b/.cofoundy/tasks/T-002.md new file mode 100644 index 00000000000..0ef54c7948e --- /dev/null +++ b/.cofoundy/tasks/T-002.md @@ -0,0 +1,113 @@ +--- +id: T-002 +title: Descongelar los metadatos de repo — max(head+1, now) portado de upstream +role: cli +status: ready +issue: cofoundy/buzz#2 +upstream: block/buzz#2876 +blockedBy: [] +scope: + write: + - crates/buzz-cli/src/commands/repos.rs + - .cofoundy/state/reports/cli.md + read: + - crates/buzz-relay/src/handlers/ingest.rs + - .cofoundy/specs/architecture-v1.md +--- + +# T-002 — metadatos de repo congelados a los 15 min + +`build_updated_repo_announcement` (`crates/buzz-cli/src/commands/repos.rs:146`) firma +toda mutación con `existing.created_at + 1`. El relay valida contra reloj de pared con +ventana ±900s (`MAX_TIMESTAMP_DRIFT_SECS`). El avance de +1 nunca alcanza al presente, +así que pasados 15 min desde la última edición **los metadatos quedan congelados para +siempre**: `repos bind`, `repos protect set` y `repos protect remove` dejan de entrar. + +## No escribas el fix — portalo + +Hay **tres PRs abiertos upstream** para este bug. Escribir un cuarto enfoque propio es +lo que NO queremos: un texto idéntico al que upstream mergee lo descarta `git` por +equivalencia de patch-id en el rebase; una variante nuestra garantiza conflicto. + +```bash +gh pr diff 4363 --repo block/buzz # Timestamp::now().as_secs().max(head_floor) +gh pr diff 4509 --repo block/buzz # bumped_head.max(Timestamp::now().as_secs()) +``` + +**No hay un "hunk común" que copiar literalmente.** Los dos son semánticamente +idénticos pero con distinto nombre de binding y distinto comentario. Portás la +semántica `max(head + 1, now)` con **tu propio comentario** (ver R-4), citando ambos +SHAs en el cuerpo del commit. + +Ignorá el PR #2901 — usa reloj de pared a secas y pierde la monotonía. Ojo: el motivo +es **ese**, no su CI (ver abajo). + +### ⚠️ El CI upstream no es garantía de nada acá + +`gh pr checks` (no `statusCheckRollup`) muestra que **#4363 y #4509 corrieron solo +DCO + Semgrep + zizmor: cero builds de Rust, cero unit tests.** Su código nunca se +compiló upstream. (#2901, en cambio, sí pasa Build amd64/arm64 + relay e2e; falla solo +por DCO signoff y Security.) + +Dos consecuencias que mandan sobre tu trabajo: + +- **`cargo test -p buzz-cli` en esta rama es el único gate real** sobre el código que + portás. No heredás confianza de upstream. +- **No adoptes los tests verbatim.** Los de #4363 contienen asserts vacuos que pasan + siempre y no prueban nada — `>= 1000` contra un fixture de `100`, y `>= 101` contra + un reloj de pared de ~1.7e9. Tomá: + + | De | Tomar | Descartar | + |---|---|---| + | #4509 | el test de monotonía (head futuro ⇒ exactamente `head + 1`) y los asserts ajustados `>= before && <= after` | — | + | #4363 | `updated_announcement_stays_within_relay_drift_window_for_stale_head` — el único que nombra el bound ±900 | los asserts vacuos `>= 1000` y `>= 101` | + +Si al leer los diffs encontrás que difieren en algo más que nombres y comentarios, el +desempate es la tabla de las dos propiedades de abajo — y **registrá qué descartaste**. + +## Las dos propiedades — el corazón de la tarea + +El fix debe preservar **ambas simultáneamente**. Es la razón de que `now` a secas sea +incorrecto: + +| Propiedad | Qué la protege | Caso que la ejercita | +|---|---|---| +| **Monotonía** — un writer demorado no pisa una edición intermedia | el piso `head + 1` | head en el **futuro** (reloj del peer adelantado) ⇒ resultado `head + 1`, no `now` | +| **Frescura** — el relay acepta el evento | el piso `now` | head de hace 2 h ⇒ drift vs. reloj de pared ≤ 900s | + +## Dos cosas que el issue no dice + +- **R-3:** `repos.rs:523` y `:717` assertean `created_at == 101` exacto. Con el fix eso + deja de ser cierto. Pasan a assertear las propiedades de arriba, **nunca un literal**. +- **R-4:** el comentario en `repos.rs:144-145` argumenta explícitamente *en contra* del + reloj de pared. Tras el fix quedaría prohibiendo lo que el código hace dos líneas + abajo — plausiblemente parte de por qué el bug sobrevivió review upstream. Ambos PRs + portables ya lo reescriben: **verificá que tu port lo traiga**, no lo dejes huérfano. + +## Aceptación + +1. `cargo test -p buzz-cli` verde, con los dos tests de propiedad presentes y los dos + asserts literales eliminados. +2. `cargo clippy -p buzz-cli -- -D warnings` limpio y `cargo fmt --check` limpio. +3. El comentario de `:144` describe las dos propiedades y qué piso protege cada una. +La evidencia contra el relay vivo **no es tuya** — se carvó a `T-003` (gate de Phase 5, +AM-2) porque depende de una credencial que solo el operador puede desbloquear. +Vaultwarden está locked. **Tu tarea está 100% desbloqueada sin ella**: el fix, los dos +tests de propiedad, clippy y fmt no tocan el relay. + +## Guardrails + +> **No generes, mintees ni rotes credenciales** (claves nostr, tokens, entradas de +> vault) bajo ninguna circunstancia. Si falta una credencial, la tarea se detiene y lo +> reporta. Conseguir credenciales es acción del operador, nunca de la lane. + +Esto es explícito porque "no simules el resultado" prohibía *simular* pero no prohibía +*conseguir* — y el camino obvio (generar un keypair nostr y anunciarle un repo al +relay) es `always_escalate.credential_mint_or_rotate`, una superficie que +`autonomy_overrides` no puede relajar. + +- **No** ampliar `MAX_TIMESTAMP_DRIFT_SECS` en el relay. La ventana de ±900s es defensa + anti-replay; el defecto es del CLI. `ingest.rs` es solo lectura. +- No reemplazar por `now` a secas — perdés la monotonía (ese es el error de #2901). +- No abrir un PR upstream. La acción upstream la maneja el CTO. +- No rebasear ni forzar sobre `railway-deploy`. diff --git a/.cofoundy/tasks/T-003.md b/.cofoundy/tasks/T-003.md new file mode 100644 index 00000000000..c31b2b4a0f9 --- /dev/null +++ b/.cofoundy/tasks/T-003.md @@ -0,0 +1,75 @@ +--- +id: T-003 +title: Verificación viva contra buzz.cofoundy.dev — operator-gated +role: cto +status: blocked +blockedBy: [T-001, T-002] +gate: operator +issues: [cofoundy/buzz#1, cofoundy/buzz#2] +scope: + write: + - .cofoundy/state/reports/live-evidence.md + read: + - deploy/arch-box/README.md +--- + +# T-003 — la evidencia que cierra el ciclo + +Carvada del gate de Phase 5 (AM-2 + AM-4). T-001 y T-002 producen código verificable +sin tocar el relay; **esto** es lo que el brief pone como criterio de cierre: +*"evidencia ejecutada contra `buzz.cofoundy.dev`, no compilación verde"*. + +## Precondición — un solo gesto del operador + +```bash +bw unlock # Vaultwarden está locked; nadie más puede abrirlo +# y exportar BUZZ_PRIVATE_KEY / NOSTR_PRIVATE_KEY (Founders Keys → buzz-relay-cofoundy) +``` + +Hasta que eso ocurra, esta tarea **no corre y no se simula**. El ciclo queda en +"todo lo verificable, hecho y verificado; falta la verificación viva". + +## Las tres evidencias + +**E-1 — el fix de #2 desbloquea metadatos congelados.** Con el binario compilado de +esta rama, sobre un repo anunciado hace **más de 15 minutos**: + +``` +buzz repos protect set --id --ref refs/heads/main --push owner --no-force-push +# antes: {"error":"relay_error","message":"... event timestamp too far from server time"} +# después: {"accepted":true,...} +buzz repos protect list --id # la regla aparece +``` +Candidatos de repo viejo: `audit-fase2`, `skewtest` (ambos del piloto, no borrables +por upstream #2326). + +**E-2 — el asset de #1 existe y se instala.** En la caja Arch, vía el instalador y +**sin toolchain de Rust**: `which git-credential-nostr` → `~/.local/bin/...`. + +**E-3 — el test real del README (AM-4).** En una caja **sin toolchain de Rust**, +siguiendo **solo** `deploy/arch-box/README.md` y nada más, un `git clone` + `git push` +contra `buzz.cofoundy.dev` completa verde. + +E-3 es el único test genuino del README: T-001 verifica que el archivo **existe y +documenta** los dos requisitos, nunca que un tercero siguiéndolo **logre pushear**. Un +README puede ser correcto por archivo y aun así insuficiente por omisión. Si E-3 falla, +el bug es del README y vuelve a la lane `ci` — no se parcha desde acá. + +## Guardrail — el que motivó no despachar el grafo tal como estaba + +> No generes, mintees ni rotes credenciales (claves nostr, tokens, entradas de vault) +> bajo ninguna circunstancia. Si falta una credencial, la tarea se detiene y lo +> reporta. Conseguir credenciales es acción del operador, nunca de la lane. + +Aplica con especial fuerza acá: esta tarea **existe** porque falta una credencial. El +camino "genero un keypair nuevo y le anuncio un repo al relay" resolvería la tarea y +sería exactamente `always_escalate.credential_mint_or_rotate` — una superficie que +`autonomy_overrides` **no puede relajar**. + +## Después de esto + +El comentario upstream en block/buzz#2876 (`.cofoundy/state/upstream-2876-comment.draft.md`) +se secuencia **detrás** de T-003: su aporte diferencial es la reproducción contra un +relay vivo, así que publicarlo antes sería publicar sin la evidencia que lo justifica. +Es acción de CTO, gobernada por IC-3 (un solo comentario), y requiere habilitación del +operador — es un acto público e irreversible en el repo de un tercero. diff --git a/.env.example b/.env.example index b9bfcada0ec..a6740f7a7d8 100644 --- a/.env.example +++ b/.env.example @@ -51,17 +51,23 @@ TYPESENSE_URL=http://localhost:8108 BUZZ_BIND_ADDR=0.0.0.0:3000 # Public WebSocket URL — used in NIP-42 auth challenges RELAY_URL=ws://localhost:3000 -# Stable relay signing key. Set this in dev if you want REST-created forum posts -# to keep resolving to the original author across relay restarts. +# Stable relay signing key (required). `just bootstrap` generates a random key in +# the gitignored .env file. Preserve that value across restarts and backups. # BUZZ_RELAY_PRIVATE_KEY=<32-byte hex private key> # Optional: path to the web UI dist directory. When set, the relay serves # the web frontend at / for browser requests. Leave unset for local dev # (use `just web` for Vite HMR instead). # BUZZ_WEB_DIR=./web/dist +# Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and +# authenticated desktop clients use this relay as the metadata/search proxy. +# Keep the real value in your deployment's secret manager; never commit it. +# BUZZ_KLIPY_API_KEY= + # Shared Redis-backed admission limits. Defaults shown below; each value must # be a positive integer. # BUZZ_RATE_LIMIT_HUMAN_MESSAGES_PER_MIN=60 +# BUZZ_RATE_LIMIT_GIF_SEARCHES_PER_MIN=30 # BUZZ_RATE_LIMIT_HUMAN_API_CALLS_PER_MIN=300 # BUZZ_RATE_LIMIT_HUMAN_WS_EVENTS_PER_SEC=10 # BUZZ_RATE_LIMIT_AGENT_STANDARD_MESSAGES_PER_MIN=120 @@ -102,11 +108,10 @@ BUZZ_S3_ADDRESSING_STYLE=path # BUZZ_MEDIA_MAX_CONCURRENT_UPLOADS=8 # BUZZ_MEDIA_MAX_CONCURRENT_UPLOADS_PER_PUBKEY=2 # BUZZ_MEDIA_UPLOADS_PER_MINUTE=30 -# Require Blossom t=get auth and relay membership for GET/HEAD /media/*. -# Keep off until desktop/mobile/CLI clients that attach media read auth are deployed. -# BUZZ_REQUIRE_MEDIA_GET_AUTH=false -# Legacy alias accepted by the relay while rollout docs catch up: -# BUZZ_REQUIRE_MEDIA_READ_AUTH=false +# GET/HEAD /media/* always require Blossom t=get auth and relay membership. +# BUZZ_REQUIRE_MEDIA_GET_AUTH and BUZZ_REQUIRE_MEDIA_READ_AUTH are no longer +# read; setting either (including to false) changes nothing and the relay warns +# about it at startup. # ----------------------------------------------------------------------------- # Ephemeral Channels (TTL testing) diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md index e383313452a..c951650eb1f 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.md +++ b/.github/ISSUE_TEMPLATE/bug-report.md @@ -4,6 +4,10 @@ about: Report a reproducible bug in Buzz labels: bug --- +> [!IMPORTANT] +> Do not include security vulnerabilities in a public issue. [Report them +> privately through a GitHub security advisory](https://github.com/block/buzz/security/advisories/new). + **Describe the bug** A clear and concise description of what the bug is. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 0086358db1e..67bfbe0ce46 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1 +1,5 @@ blank_issues_enabled: true +contact_links: + - name: Report a security vulnerability + url: https://github.com/block/buzz/security/advisories/new + about: Report security vulnerabilities privately to the Buzz maintainers. diff --git a/.github/workflows/auto-tag-on-release-pr-merge.yml b/.github/workflows/auto-tag-on-release-pr-merge.yml index f31d4b835f6..3db5c6baaaf 100644 --- a/.github/workflows/auto-tag-on-release-pr-merge.yml +++ b/.github/workflows/auto-tag-on-release-pr-merge.yml @@ -45,7 +45,7 @@ jobs: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.merge_commit_sha }} fetch-depth: 0 @@ -91,7 +91,7 @@ jobs: echo "enabled=true" echo "tag=${TAG_PREFIX}${VERSION}" if [[ "$TAG_PREFIX" == desktop-v ]]; then - echo "target_sha=${{ github.event.pull_request.merge_commit_sha }}" + echo "target_sha=${{ github.event.pull_request.head.sha }}" echo "desktop=true" else echo "target_sha=$GITHUB_SHA" @@ -112,6 +112,7 @@ jobs: PR_BASE_REF: ${{ github.event.pull_request.base.ref }} PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }} + MERGED_AT: ${{ github.event.pull_request.merged_at }} run: | VERSION="${VERSION#desktop-v}" export VERSION @@ -146,7 +147,17 @@ jobs: exit 1 fi fi - gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ + if ! gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ -f ref="refs/tags/$TAG" \ -f sha="$TARGET_SHA" \ - --silent + --silent; then + # Ref creation is atomic. A concurrent retry may have won the race; + # accept that only when it created the exact immutable ref. + EXISTING_SHA="$(gh api "repos/$GITHUB_REPOSITORY/commits/$TAG" --jq .sha)" + if [ "$EXISTING_SHA" = "$TARGET_SHA" ]; then + echo "Tag $TAG was concurrently created at $TARGET_SHA" + exit 0 + fi + echo "::error::Tag creation failed and $TAG resolves to $EXISTING_SHA (expected $TARGET_SHA)" + exit 1 + fi diff --git a/.github/workflows/benchmark-harbor.yml b/.github/workflows/benchmark-harbor.yml index 31efe933c58..a750ab6dc3e 100644 --- a/.github/workflows/benchmark-harbor.yml +++ b/.github/workflows/benchmark-harbor.yml @@ -5,10 +5,12 @@ on: branches: [main] paths: - "benchmarks/harbor-buzz-orchestra/**" + - "benchmarks/buzz-dataset/**" - ".github/workflows/benchmark-harbor.yml" pull_request: paths: - "benchmarks/harbor-buzz-orchestra/**" + - "benchmarks/buzz-dataset/**" - ".github/workflows/benchmark-harbor.yml" permissions: @@ -20,7 +22,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.12" @@ -31,6 +33,9 @@ jobs: python -m pip install --disable-pip-version-check -e ".[dev]" pytest -q ruff check . + # The task verifiers live in the sibling benchmarks/buzz-dataset, so + # they need the harness config passed explicitly to stay linted. + ruff check --config pyproject.toml ../buzz-dataset - name: Test provisioner working-directory: benchmarks/harbor-buzz-orchestra/testbed run: | diff --git a/.github/workflows/buzz-acp-linux.yml b/.github/workflows/buzz-acp-linux.yml index 580be3931f5..251da5893e5 100644 --- a/.github/workflows/buzz-acp-linux.yml +++ b/.github/workflows/buzz-acp-linux.yml @@ -21,6 +21,7 @@ on: - "crates/buzz-acp/**" - "crates/buzz-sdk/**" - "crates/buzz-ws-client/**" + - "crates/git-credential-nostr/**" - "rust-toolchain.toml" - ".github/workflows/buzz-acp-linux.yml" @@ -48,17 +49,28 @@ jobs: key: buzz-acp-${{ runner.os }}-${{ hashFiles('Cargo.lock') }} restore-keys: buzz-acp-${{ runner.os }}- - # Both binaries ship together on purpose: the harness's base prompt tells - # the agent "the buzz CLI is your primary interface", so a host with - # buzz-acp but no buzz CLI runs turns that silently produce no reply. + # All three binaries ship together on purpose: + # - buzz-acp the harness itself + # - buzz the harness's base prompt tells the agent "the buzz CLI is + # your primary interface", so a host with buzz-acp but no + # buzz CLI runs turns that silently produce no reply. + # - git-credential-nostr without it `git push` to the Buzz git server on + # a clean box dies with "could not read Username for ...": + # the NIP-98 helper simply is not on PATH. See + # deploy/arch-box/README.md for the two config requirements. - name: Build - run: cargo build --release -p buzz-acp -p buzz-cli + run: cargo build --release -p buzz-acp -p buzz-cli -p git-credential-nostr # Fail loudly here rather than shipping a binary that cannot start. + # Note: git-credential-nostr takes a git credential operation (get/store/ + # erase), not flags — `--help` lands in its unknown-arg branch and exits 0 + # without output. That is still the signal this step wants: the binary + # loads, links, and runs. Passing `get` instead would block on stdin. - name: Smoke check run: | ./target/release/buzz-acp --help > /dev/null ./target/release/buzz --help > /dev/null + ./target/release/git-credential-nostr --help > /dev/null echo "binaries ok" - name: Publish release asset @@ -70,16 +82,21 @@ jobs: TAG="buzz-acp-linux-${SHORT_SHA}" cp target/release/buzz-acp "buzz-acp-x86_64-linux" cp target/release/buzz "buzz-x86_64-linux" - sha256sum "buzz-acp-x86_64-linux" "buzz-x86_64-linux" > "buzz-acp-x86_64-linux.sha256" + cp target/release/git-credential-nostr "git-credential-nostr-x86_64-linux" + sha256sum \ + "buzz-acp-x86_64-linux" "buzz-x86_64-linux" "git-credential-nostr-x86_64-linux" \ + > "buzz-acp-x86_64-linux.sha256" # Idempotent: re-running the workflow on the same commit replaces the # assets instead of erroring on an existing tag. if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then gh release upload "$TAG" \ - "buzz-acp-x86_64-linux" "buzz-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \ + "buzz-acp-x86_64-linux" "buzz-x86_64-linux" \ + "git-credential-nostr-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \ --repo "$GITHUB_REPOSITORY" --clobber else gh release create "$TAG" \ - "buzz-acp-x86_64-linux" "buzz-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \ + "buzz-acp-x86_64-linux" "buzz-x86_64-linux" \ + "git-credential-nostr-x86_64-linux" "buzz-acp-x86_64-linux.sha256" \ --repo "$GITHUB_REPOSITORY" \ --title "buzz-acp linux x86_64 @ ${SHORT_SHA}" \ --notes "Built from ${GITHUB_SHA} by ${GITHUB_WORKFLOW}. Consumed by deploy/arch-box/install-buzz-acp.sh." diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 453a15de99d..fd2949492f6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,10 +28,11 @@ jobs: web: ${{ steps.filter.outputs.web }} mobile: ${{ steps.filter.outputs.mobile }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 2 - - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: filter with: token: '' @@ -46,23 +47,21 @@ jobs: - 'deny.toml' - '.github/workflows/ci.yml' - 'scripts/run-tests.sh' + - 'scripts/model-capabilities.json' + - 'scripts/normative-corpus.json' - 'justfile' desktop: - - 'scripts/check-file-sizes-core.mjs' - - 'scripts/check-file-sizes-core.test.mjs' + - 'scripts/model-capabilities.json' + - 'scripts/normative-corpus.json' - 'desktop/**' - '!desktop/src-tauri/**' - 'pnpm-lock.yaml' desktop-rust: - 'desktop/src-tauri/**' web: - - 'scripts/check-file-sizes-core.mjs' - - 'scripts/check-file-sizes-core.test.mjs' - 'web/**' - 'pnpm-lock.yaml' mobile: - - 'scripts/check-file-sizes-core.mjs' - - 'scripts/check-file-sizes-core.test.mjs' - 'mobile/**' - 'scripts/mobile-release.sh' - 'scripts/mobile-worktree-overrides.sh' @@ -76,16 +75,26 @@ jobs: - '.github/workflows/ci.yml' - name: Release workflow source contract run: scripts/test-release-ref-contract.sh + - name: Relay image eligibility contract + run: scripts/test-relay-image-eligibility-workflow.sh - name: Desktop release candidate contract run: scripts/test-desktop-release-candidate.sh + - name: OSS desktop promotion contract + run: | + scripts/test-oss-desktop-promotion.sh + scripts/test-oss-desktop-promotion-behavior.sh - name: Mobile release contract run: | scripts/test-mobile-release-contract.sh scripts/test-mobile-release-candidate-publisher.sh - name: Mobile worktree identity contract run: scripts/test-mobile-worktree-overrides.sh - - name: File size ratchet unit tests - run: node --test scripts/check-file-sizes-core.test.mjs + - name: Rust cache contract + run: | + scripts/test-rust-cache-contract.sh + scripts/test-rust-cache-contract-regressions.sh + - name: File size policy + run: just file-size-check rust-lint: name: Rust Lint @@ -96,9 +105,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: save-if: ${{ github.event_name != 'pull_request' }} - name: Format check @@ -117,11 +126,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: + key: sherpa-cache-v1 save-if: ${{ github.event_name != 'pull_request' }} - name: Install cargo-nextest uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15 @@ -139,12 +149,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 2 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: workspaces: desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} @@ -235,7 +245,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - name: Get pnpm store directory id: pnpm-cache @@ -317,8 +327,11 @@ jobs: if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true' permissions: contents: read + env: + SCCACHE_GHA_ENABLED: "true" + SCCACHE_GHA_RW_MODE: ${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.number == 5224)) && 'READ_WRITE' || 'READ_ONLY' }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 # Reuse the relay binaries and backend test archive when none of their # inputs changed (desktop-only PRs hit this every time). The key covers @@ -334,13 +347,20 @@ jobs: key: relay-artifacts-${{ runner.os }}-${{ hashFiles('crates/**', 'migrations/**', 'Dockerfile', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo/config.toml', '.github/workflows/ci.yml') }} - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1 if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' with: workspaces: | . desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} + # Cache rustc outputs for unchanged workspace crates. Trusted pushes write; + # the bounded PR 5224 trial writes only to its isolated merge-ref scope. + - name: Set up sccache + if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 # zizmor: ignore[cache-poisoning] Bounded trial: only PR 5224 writes to its isolated merge-ref scope; trusted pushes retain production writes. + with: + version: v0.16.0 - name: Install cargo-nextest if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15 @@ -348,6 +368,8 @@ jobs: tool: cargo-nextest@0.9.136 - name: Build relay artifacts if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + env: + RUSTC_WRAPPER: sccache run: | cargo build --profile ci -p buzz-relay -p git-credential-nostr cargo nextest archive \ @@ -359,7 +381,9 @@ jobs: --test e2e_event_reminder \ --archive-file target/ci/backend-integration-tests.tar.zst - name: Save relay artifacts cache - if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' + # PR-scoped exact-source entries cannot warm main or other PRs and churn + # the shared cache pool. sccache provides read-only PR reuse instead. + if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && github.event_name == 'push' uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: | @@ -391,7 +415,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - name: Start integration services run: | @@ -505,6 +529,7 @@ jobs: REDIS_URL=redis://localhost:6379 \ RELAY_URL=ws://localhost:3000 \ BUZZ_BIND_ADDR=0.0.0.0:3000 \ + BUZZ_RELAY_PRIVATE_KEY="$(openssl rand -hex 32)" \ BUZZ_REQUIRE_AUTH_TOKEN=false \ BUZZ_RECONCILE_CHANNELS=true \ BUZZ_RATE_LIMIT_HUMAN_MESSAGES_PER_MIN=100000 \ @@ -580,7 +605,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - name: Install cargo-nextest uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15 @@ -657,6 +682,31 @@ jobs: VALUES ('00000000-0000-4000-8000-00000000c0de', 'localhost:3000') ON CONFLICT (lower(host)) DO NOTHING ;" + - name: Replaceable persistence PostgreSQL tests + # Transaction, concurrency, and mention-index coverage for the + # replaceable-event store seam. These tests require real Postgres and + # are ignored by the infrastructure-free unit-test job. + run: | + filter='package(buzz-db) and test(/tests::(parameterized_|concurrent_parameterized_)/)' + cargo nextest run \ + --archive-file target/ci/backend-integration-tests.tar.zst \ + -E "${filter}" \ + --run-ignored ignored-only + env: + DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz + TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz + - name: Database pressure observability PostgreSQL tests + # Explicit pool acquisition and advisory-lock metrics require real + # Postgres and are ignored by the infrastructure-free unit-test job. + run: | + filter='package(buzz-db) and test(/observability::tests::(pool_acquire_records_success_timeout_and_error_with_wait_time|advisory_lock_records_success_contention_timeout_and_error)/)' + cargo nextest run \ + --archive-file target/ci/backend-integration-tests.tar.zst \ + -E "${filter}" \ + --run-ignored ignored-only + env: + DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz + TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz - name: Start relay run: | chmod +x ./target/ci/buzz-relay @@ -665,6 +715,7 @@ jobs: REDIS_URL=redis://localhost:6379 \ RELAY_URL=ws://localhost:3000 \ BUZZ_BIND_ADDR=0.0.0.0:3000 \ + BUZZ_RELAY_PRIVATE_KEY="$(openssl rand -hex 32)" \ BUZZ_REQUIRE_AUTH_TOKEN=false \ BUZZ_RECONCILE_CHANNELS=true \ BUZZ_GIT_PROBE_WRITERS=8 \ @@ -692,6 +743,18 @@ jobs: --run-ignored ignored-only env: DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz + - name: Workspace profile (kind:9033) gate tests + # Call-site integration for the 9033 authorization gate: open relay + # rosterless/steward transitions and the closed-relay admin/owner rule, + # against real Postgres. #[ignore]d in the default suite, selected + # explicitly here — see handlers::relay_admin::tests. + run: | + cargo nextest run \ + --archive-file target/ci/backend-integration-tests.tar.zst \ + -E 'package(buzz-relay) and test(/handlers::relay_admin::tests/)' \ + --run-ignored ignored-only + env: + DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz - name: NIP-ER reminder e2e # Feature e2e for NIP-ER (Event Reminders, kind:30300): write-path # validation, author-only read filtering, and scheduler delivery against @@ -732,9 +795,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: save-if: ${{ github.event_name != 'pull_request' }} # Reuse the relay + git-credential-nostr built by Desktop E2E Relay @@ -756,6 +819,19 @@ jobs: env: RELAY_URL: ws://localhost:3000 GIT_CREDENTIAL_NOSTR_BIN: ${{ github.workspace }}/target/ci/git-credential-nostr + - name: Media read-auth e2e + # Reads require kind:24242 `t=get` auth, so these binaries are the only + # coverage that a real relay rejects bare reads and honours host- and + # hash-scoped tokens. They were #[ignore]d and selected by no CI job, so + # the lane never ran; select it here, where MinIO and the seeded + # 'localhost:3000' community already exist. + # --no-fail-fast: without it cargo stops after the first failing binary, + # so one broken case hides every later binary's result. + run: | + cargo test -p buzz-test-client --no-fail-fast --test e2e_media --test e2e_media_extended --test e2e_media_video -- --ignored --nocapture + env: + RELAY_URL: ws://localhost:3000 + RELAY_HTTP_URL: http://localhost:3000 - name: Upload relay logs if: failure() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 @@ -773,7 +849,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 2 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -808,7 +884,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 2 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -849,8 +925,6 @@ jobs: with: path: ~/.pub-cache key: pub-${{ runner.os }}-${{ hashFiles('mobile/pubspec.lock') }} - - name: File size ratchet - run: node mobile/scripts/check-file-sizes.mjs - name: Format check run: cd mobile && dart format --output=none --set-exit-if-changed . - name: Analyze @@ -869,7 +943,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - name: Dependency policy run: cargo-deny check @@ -881,7 +955,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Check for dead API token references in client code run: | # Fail if dead API token patterns reappear in desktop, mobile, docs, or config. @@ -910,9 +984,9 @@ jobs: - x86_64-unknown-linux-musl - aarch64-unknown-linux-musl steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: key: cross-${{ matrix.target }} save-if: ${{ github.event_name != 'pull_request' }} @@ -947,13 +1021,13 @@ jobs: env: TARGET: x86_64-pc-windows-msvc steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # MSVC needs windows.h (aws-lc-sys et al.), so this runs on a real Windows # runner — hermit, used by the Linux jobs, does not provide MSVC. The # toolchain (1.95.0 + clippy via profile = default) comes from the # repo-root rust-toolchain.toml, which the runner's preinstalled rustup # honors on demand; the host triple already is x86_64-pc-windows-msvc. - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: workspaces: | . @@ -1011,7 +1085,7 @@ jobs: git log -1 --format=%s | grep -qx smoke echo "Host bash resolved and functional; git commit round-trip passed" - name: Check (Tauri crate) - run: cargo check --manifest-path desktop/src-tauri/Cargo.toml --target $env:TARGET + run: cargo check --manifest-path desktop/src-tauri/Cargo.toml --workspace --all-targets --target $env:TARGET env: CMAKE_POLICY_VERSION_MINIMUM: "3.5" - name: Test (Tauri crate) @@ -1028,9 +1102,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: workspaces: desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} @@ -1042,6 +1116,7 @@ jobs: mkdir -p desktop/src-tauri/binaries touch "desktop/src-tauri/binaries/buzz-acp-$TARGET" touch "desktop/src-tauri/binaries/buzz-agent-$TARGET" + touch "desktop/src-tauri/binaries/buzz-backend-kubernetes-$TARGET" touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET" touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET" touch "desktop/src-tauri/binaries/buzz-$TARGET" diff --git a/.github/workflows/desktop-release-cache-proof.yml b/.github/workflows/desktop-release-cache-proof.yml new file mode 100644 index 00000000000..71436d00c36 --- /dev/null +++ b/.github/workflows/desktop-release-cache-proof.yml @@ -0,0 +1,164 @@ +name: Desktop release cache tag-scope proof + +# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all +# four canaries. Every job restores only and requires an exact cache hit. +on: + workflow_dispatch: + +permissions: + contents: read + +jobs: + macos: + name: Prove macOS ${{ matrix.target }} cache visibility + if: github.repository == 'block/buzz' + runs-on: macos-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + include: + - target: aarch64-apple-darwin + features: mesh-llm + - target: x86_64-apple-darwin + features: default + steps: + - name: Require cache proof tag + run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }' + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + - name: Patch proof dependency graph + run: | + cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof" + cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT" + - name: Compute exact release cache key + id: rust_cache_key + env: + CACHE_TARGET: ${{ matrix.target }} + CACHE_FEATURES: ${{ matrix.features }} + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + - name: Restore exact default-branch cache from tag + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Require exact cache hit + env: + CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }} + CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }} + EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }} + run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }' + + linux: + name: Prove Linux cache visibility + if: github.repository == 'block/buzz' + runs-on: ubuntu-latest + container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea + timeout-minutes: 15 + defaults: + run: + shell: bash + steps: + - name: Require cache proof tag and install release native tools + run: | + [[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; } + apt-get update + apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + - name: Patch proof dependency graph + run: | + cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof" + cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT" + - name: Compute exact release cache key + id: rust_cache_key + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + - name: Restore exact default-branch cache from tag + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Require exact cache hit + env: + CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }} + CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }} + EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }} + run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }' + + windows: + name: Prove Windows cache visibility + if: github.repository == 'block/buzz' + runs-on: windows-latest + timeout-minutes: 15 + steps: + - name: Require cache proof tag + shell: bash + run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }' + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - name: Patch proof dependency graph + shell: bash + run: | + cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof" + cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + shell: bash + run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT" + - name: Compute exact release cache key + id: rust_cache_key + shell: bash + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + - name: Restore exact default-branch cache from tag + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Require exact cache hit + shell: bash + env: + CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }} + CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }} + EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }} + run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }' diff --git a/.github/workflows/desktop-release-candidate.yml b/.github/workflows/desktop-release-candidate.yml index eddebea6852..61ccc800af3 100644 --- a/.github/workflows/desktop-release-candidate.yml +++ b/.github/workflows/desktop-release-candidate.yml @@ -6,6 +6,7 @@ on: permissions: contents: read + pull-requests: read jobs: validate: @@ -20,6 +21,7 @@ jobs: - name: Validate immutable desktop candidate if: startsWith(github.event.pull_request.head.ref, 'version-bump/') env: + GH_TOKEN: ${{ github.token }} VERSION: ${{ github.event.pull_request.head.ref }} run: | VERSION="${VERSION#version-bump/}" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 52f21b28bc3..f48f1bc92fb 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -49,6 +49,10 @@ on: - "Dockerfile.push-gateway" - ".dockerignore" - ".github/workflows/docker.yml" + - "deploy/charts/buzz/Chart.yaml" + - "scripts/create-deployment-eligibility-predicate.jq" + - "scripts/select-qualified-ci-run.jq" + - "scripts/test-relay-image-eligibility-workflow.sh" - "Cargo.toml" - "Cargo.lock" - "rust-toolchain.toml" @@ -101,7 +105,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 persist-credentials: false @@ -172,6 +176,10 @@ jobs: target: runtime platforms: ${{ matrix.platform }} labels: ${{ steps.meta.outputs.labels }} + build-args: | + BUZZ_SOURCE_SHA=${{ github.sha }} + BUZZ_BUILD_ID=github-actions:${{ github.run_id }}:${{ github.run_attempt }} + BUZZ_BUILD_URL=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }} # Push by digest, not by tag — the merge job assembles the tags # into one multi-arch manifest. This is what makes the native-arm # matrix possible. @@ -190,6 +198,10 @@ jobs: target: runtime-debug platforms: ${{ matrix.platform }} labels: ${{ steps.meta.outputs.labels }} + build-args: | + BUZZ_SOURCE_SHA=${{ github.sha }} + BUZZ_BUILD_ID=github-actions:${{ github.run_id }}:${{ github.run_attempt }} + BUZZ_BUILD_URL=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }} outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }} cache-from: | type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }} @@ -222,11 +234,86 @@ jobs: if-no-files-found: error retention-days: 1 + qualify: + name: Qualify relay image source + if: github.event_name != 'pull_request' + runs-on: ubuntu-24.04 + timeout-minutes: 70 + permissions: + actions: read + contents: read + outputs: + source_sha: ${{ steps.qualify.outputs.source_sha }} + ci_run_id: ${{ steps.qualify.outputs.ci_run_id }} + ci_run_attempt: ${{ steps.qualify.outputs.ci_run_attempt }} + ci_run_url: ${{ steps.qualify.outputs.ci_run_url }} + chart_version: ${{ steps.qualify.outputs.chart_version }} + steps: + - name: Checkout source + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Require successful same-SHA CI run + id: qualify + env: + GH_TOKEN: ${{ github.token }} + SOURCE_SHA: ${{ github.sha }} + run: | + set -euo pipefail + + if [[ ! "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]; then + echo "::error::Invalid source SHA: $SOURCE_SHA" + exit 1 + fi + + deadline=$((SECONDS + 3900)) + while (( SECONDS < deadline )); do + payload=$(gh api \ + "/repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs?head_sha=${SOURCE_SHA}&event=push&per_page=100") + successful_run=$(jq -c --arg source_sha "$SOURCE_SHA" \ + -f "$GITHUB_WORKSPACE/scripts/select-qualified-ci-run.jq" <<<"$payload") + + if [[ -n "$successful_run" ]]; then + ci_run_id=$(jq -r '.id' <<<"$successful_run") + ci_run_attempt=$(jq -r '.run_attempt' <<<"$successful_run") + ci_run_url=$(jq -r '.html_url' <<<"$successful_run") + chart_version=$(awk '/^version:/ { print $2; exit }' deploy/charts/buzz/Chart.yaml) + if [[ ! "$chart_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then + echo "::error::Invalid Buzz chart version: $chart_version" + exit 1 + fi + { + echo "source_sha=$SOURCE_SHA" + echo "ci_run_id=$ci_run_id" + echo "ci_run_attempt=$ci_run_attempt" + echo "ci_run_url=$ci_run_url" + echo "chart_version=$chart_version" + } >>"$GITHUB_OUTPUT" + echo "Qualified source $SOURCE_SHA with CI run $ci_run_id (attempt $ci_run_attempt)." + exit 0 + fi + + matching=$(jq --arg source_sha "$SOURCE_SHA" '[.workflow_runs[] | select(.head_sha == $source_sha) | select(.event == "push") | select(.head_branch == "main" or .head_branch == "release")] | length' <<<"$payload") + pending=$(jq --arg source_sha "$SOURCE_SHA" '[.workflow_runs[] | select(.head_sha == $source_sha) | select(.event == "push") | select(.head_branch == "main" or .head_branch == "release") | select(.status != "completed")] | length' <<<"$payload") + if (( matching > 0 && pending == 0 )); then + echo "::error::No successful CI run exists for source $SOURCE_SHA" + jq -r --arg source_sha "$SOURCE_SHA" '.workflow_runs[] | select(.head_sha == $source_sha) | "run=\(.id) attempt=\(.run_attempt) status=\(.status) conclusion=\(.conclusion)"' <<<"$payload" + exit 1 + fi + + echo "Waiting for same-SHA CI qualification ($matching matching, $pending pending)..." + sleep 30 + done + + echo "::error::Timed out waiting for successful CI qualification of $SOURCE_SHA" + exit 1 + merge: name: Merge ${{ matrix.variant }} multi-arch manifest if: github.event_name != 'pull_request' runs-on: ubuntu-24.04 - needs: build + needs: [build, qualify] timeout-minutes: 15 permissions: contents: read @@ -243,6 +330,11 @@ jobs: tag_prefix: debug- steps: + - name: Checkout source + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - name: Download all per-arch digests uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -286,6 +378,10 @@ jobs: env: IMAGE_NAME: ${{ env.IMAGE_NAME }} META_TAGS: ${{ steps.meta.outputs.tags }} + SOURCE_SHA: ${{ needs.qualify.outputs.source_sha }} + CI_RUN_ID: ${{ needs.qualify.outputs.ci_run_id }} + CI_RUN_ATTEMPT: ${{ needs.qualify.outputs.ci_run_attempt }} + CHART_VERSION: ${{ needs.qualify.outputs.chart_version }} run: | set -euo pipefail # Build -t flags from the metadata-action output. @@ -300,7 +396,15 @@ jobs: digests+=("${IMAGE_NAME}@sha256:${digest}") done - docker buildx imagetools create "${tags[@]}" "${digests[@]}" + annotations=( + --annotation "index:org.opencontainers.image.revision=${SOURCE_SHA}" + --annotation "index:xyz.block.buzz.build.id=github-actions:${GITHUB_RUN_ID}:${GITHUB_RUN_ATTEMPT}" + --annotation "index:xyz.block.buzz.qualification.ci-run-id=${CI_RUN_ID}" + --annotation "index:xyz.block.buzz.qualification.ci-run-attempt=${CI_RUN_ATTEMPT}" + --annotation "index:xyz.block.buzz.qualification.ci-conclusion=success" + --annotation "index:xyz.block.buzz.helm-chart.version=${CHART_VERSION}" + ) + docker buildx imagetools create "${tags[@]}" "${annotations[@]}" "${digests[@]}" # Capture the merged manifest digest for the attestation step. first_tag=$(echo "$META_TAGS" | head -n1) @@ -317,17 +421,58 @@ jobs: subject-digest: ${{ steps.manifest.outputs.digest }} push-to-registry: true + - name: Create deployment eligibility predicate + if: matrix.variant == 'release' + env: + SOURCE_SHA: ${{ needs.qualify.outputs.source_sha }} + CI_RUN_ID: ${{ needs.qualify.outputs.ci_run_id }} + CI_RUN_ATTEMPT: ${{ needs.qualify.outputs.ci_run_attempt }} + CI_RUN_URL: ${{ needs.qualify.outputs.ci_run_url }} + CHART_VERSION: ${{ needs.qualify.outputs.chart_version }} + run: | + jq -n \ + --arg source_repository "$GITHUB_REPOSITORY" \ + --arg source_ref "$GITHUB_REF" \ + --arg source_sha "$SOURCE_SHA" \ + --arg build_workflow ".github/workflows/docker.yml" \ + --argjson build_run_id "$GITHUB_RUN_ID" \ + --argjson build_run_attempt "$GITHUB_RUN_ATTEMPT" \ + --arg build_run_url "https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" \ + --arg qualification_workflow ".github/workflows/ci.yml" \ + --argjson qualification_run_id "$CI_RUN_ID" \ + --argjson qualification_run_attempt "$CI_RUN_ATTEMPT" \ + --arg qualification_run_url "$CI_RUN_URL" \ + --arg chart_version "$CHART_VERSION" \ + -f "$GITHUB_WORKSPACE/scripts/create-deployment-eligibility-predicate.jq" \ + >/tmp/deployment-eligibility.json + + - name: Attest deployment eligibility + if: matrix.variant == 'release' + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 + with: + subject-name: ${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.manifest.outputs.digest }} + predicate-type: https://buzz.block.xyz/attestations/deployment-eligibility/v1 + predicate-path: /tmp/deployment-eligibility.json + push-to-registry: true + - name: Summary env: IMAGE_NAME: ${{ env.IMAGE_NAME }} VARIANT: ${{ matrix.variant }} MERGED_DIGEST: ${{ steps.manifest.outputs.digest }} META_TAGS: ${{ steps.meta.outputs.tags }} + SOURCE_SHA: ${{ needs.qualify.outputs.source_sha }} + CI_RUN_URL: ${{ needs.qualify.outputs.ci_run_url }} + CHART_VERSION: ${{ needs.qualify.outputs.chart_version }} run: | { echo "### Published \`${IMAGE_NAME}\` (${VARIANT})" echo echo "**Digest:** \`${MERGED_DIGEST}\`" + echo "**Source:** \`${SOURCE_SHA}\`" + echo "**Compatible Buzz chart:** \`${CHART_VERSION}\`" + echo "**Qualifying CI:** ${CI_RUN_URL} (success)" echo echo "**Tags:**" echo '```' @@ -338,6 +483,13 @@ jobs: echo '```' echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --owner block" echo '```' + if [[ "$VARIANT" == "release" ]]; then + echo + echo "Verify deployment eligibility:" + echo '```' + echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --repo block/buzz --signer-workflow block/buzz/.github/workflows/docker.yml --predicate-type https://buzz.block.xyz/attestations/deployment-eligibility/v1 --source-digest ${SOURCE_SHA}" + echo '```' + fi } >> "$GITHUB_STEP_SUMMARY" push-gateway-build: @@ -359,7 +511,7 @@ jobs: arch: arm64 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index e3d443d9f36..7118d16708d 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -59,7 +59,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: # On chart-tag rescue dispatch, lint/render the tagged commit that the # publish job will package, not whatever `main` is when the dispatch @@ -119,7 +119,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 @@ -166,7 +166,7 @@ jobs: packages: write # push the chart to GHCR steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: # On the rescue dispatch, build the tagged commit (github.ref is # `main` there); on a tag push, the default ref is already the tag. diff --git a/.github/workflows/linux-canary.yml b/.github/workflows/linux-canary.yml index 98064433789..cdf8fe3bda7 100644 --- a/.github/workflows/linux-canary.yml +++ b/.github/workflows/linux-canary.yml @@ -7,8 +7,8 @@ name: Linux Canary # Design notes vs. signed-macos-canary.yml: # - fix-appimage.sh is run without signing env vars; the script detects # their absence and skips re-signing, repacking only (documented inline). -# - mold linker added (rui314/setup-mold) to reduce link time, matching -# the Linux Rust CI jobs in ci.yml. +# - Build tools match release.yml; cache keys derive the concrete linker and +# native library identity rather than assuming the moving runner image. # - pnpm store restore/save pattern mirrors ci.yml:149-196. on: workflow_dispatch: @@ -21,7 +21,7 @@ jobs: name: Build Linux canary if: github.repository == 'block/buzz' runs-on: ubuntu-latest - container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 + container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea timeout-minutes: 60 permissions: contents: read @@ -83,18 +83,6 @@ jobs: - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1 - - # Rust cache covering both the workspace sidecar build and the Tauri - # crate build. shared-key scoped to linux-canary-release so canary runs - # warm each other without colliding with CI's debug-profile keys. - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - with: - workspaces: | - . - desktop/src-tauri - shared-key: linux-canary-release - - name: Install appimagetool run: | case "$(uname -m)" in @@ -154,6 +142,38 @@ jobs: cd desktop && node scripts/set-version-from-tag.mjs "$VERSION" cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT" + + # Compute this after cargo update so the key describes the graph that is + # actually compiled. The helper normalizes only Buzz Desktop's release + # version, allowing a canary to warm an otherwise identical tag build. + - name: Compute exact release cache key + id: rust_cache_key + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py \ + --platform "$RUNNER_OS" \ + --target x86_64-unknown-linux-gnu \ + --features mesh-llm \ + --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + echo "Release cache key: $KEY" + + - name: Restore exact release Cargo cache + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Generate non-updating bundle config run: | cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON' @@ -166,11 +186,11 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh - name: Build Linux Tauri app - run: cd desktop && pnpm tauri build --ci --bundles deb,appimage --config src-tauri/tauri.canary.conf.json + run: cd desktop && pnpm tauri build --ci --bundles deb,appimage --features mesh-llm --config src-tauri/tauri.canary.conf.json env: CMAKE_POLICY_VERSION_MINIMUM: "3.5" @@ -190,6 +210,24 @@ jobs: fi bash desktop/scripts/fix-appimage.sh "${APPIMAGES[0]}" + - name: Measure release Cargo cache inputs + if: always() + run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true + + # Only this trusted, main-bound canary writes the cache. Excluding bundle + # output prevents installers from entering it. + - name: Save exact release Cargo cache + if: steps.rust_cache.outputs.cache-hit != 'true' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Save pnpm store cache uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: diff --git a/.github/workflows/macos-intel-canary.yml b/.github/workflows/macos-intel-canary.yml new file mode 100644 index 00000000000..35b05313c9f --- /dev/null +++ b/.github/workflows/macos-intel-canary.yml @@ -0,0 +1,126 @@ +name: macOS Intel Canary + +# Produces an unsigned Intel DMG from trusted main. Its release-equivalent +# Cargo state warms the distinct x86_64 release target without signing or +# publishing anything. +on: + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + name: Build macOS Intel canary + if: github.repository == 'block/buzz' + runs-on: macos-latest + timeout-minutes: 60 + env: + TARGET: x86_64-apple-darwin + steps: + - name: Require main + env: + SOURCE_REF: ${{ github.ref }} + run: | + if [[ "$SOURCE_REF" != "refs/heads/main" ]]; then + echo "::error::Canary builds must run from main; got $SOURCE_REF" + exit 1 + fi + + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + + - name: Add Rust target + run: rustup target add "$TARGET" + + - name: Install desktop dependencies + run: just desktop-install-ci + + - name: Derive and patch canary version + run: | + BASE_VERSION=$(node -p "require('./desktop/package.json').version") + VERSION="${BASE_VERSION%%-*}-intel-test.${GITHUB_RUN_NUMBER}" + cd desktop && node scripts/set-version-from-tag.mjs "$VERSION" + cd src-tauri && cargo update --workspace + + - name: Resolve native toolchain identity + id: native_toolchain + run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT" + + - name: Compute exact release cache key + id: rust_cache_key + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py \ + --platform "$RUNNER_OS" \ + --target "$TARGET" \ + --features default \ + --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + echo "Release cache key: $KEY" + + - name: Restore exact release Cargo cache + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + + - name: Generate non-updating bundle config + run: | + cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON' + {"bundle":{"createUpdaterArtifacts":false,"macOS":{"minimumSystemVersion":"10.15"}}} + JSON + + - name: Build Intel sidecars + run: | + cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + ./scripts/bundle-sidecars.sh "$TARGET" + + - name: Build unsigned Intel DMG + run: cd desktop && pnpm tauri build --verbose --no-sign --target "$TARGET" --bundles dmg --config src-tauri/tauri.canary.conf.json + env: + CMAKE_POLICY_VERSION_MINIMUM: "3.5" + MACOSX_DEPLOYMENT_TARGET: "10.15" + CMAKE_OSX_DEPLOYMENT_TARGET: "10.15" + TAURI_BUNDLER_DMG_IGNORE_CI: "true" + + - name: Locate fresh Intel DMG + id: artifact + run: | + DMG=$(find "desktop/src-tauri/target/${TARGET}/release/bundle/dmg" -name '*.dmg' -type f | head -1) + [[ -n "$DMG" ]] || { echo "::error::No Intel DMG found"; exit 1; } + echo "dmg=$DMG" >> "$GITHUB_OUTPUT" + + - name: Upload Intel canary + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: buzz-macos-intel-canary-${{ github.sha }} + path: ${{ steps.artifact.outputs.dmg }} + if-no-files-found: error + retention-days: 7 + + - name: Measure release Cargo cache inputs + if: always() + run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true + + - name: Save exact release Cargo cache + if: steps.rust_cache.outputs.cache-hit != 'true' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} diff --git a/.github/workflows/mesh-lifecycle.yml b/.github/workflows/mesh-lifecycle.yml new file mode 100644 index 00000000000..c699439980b --- /dev/null +++ b/.github/workflows/mesh-lifecycle.yml @@ -0,0 +1,111 @@ +name: Mesh Lifecycle +# Relay-driven mesh lifecycle smoke: membership → signed discovery notes → +# relay-derived allowlist → join → CPU inference over QUIC → stranger denied +# (relay membership rejection + no routed inference, with a differential +# trusted-inference health proof so a dead serve node can't fake a denial). +# Runs the full Buzz "shared compute" join story with three real mesh-llm +# node processes on one runner, using the Buzz relay as the control plane +# (no hand-carried invite tokens). Mirrors the shape mesh-llm's own CI uses +# for its two-node smokes (tiny CPU model, one runner, real QUIC mesh). + +on: + push: + branches: [main] + paths: + - 'crates/buzz-relay/examples/mesh_*.rs' + - 'crates/buzz-relay/Cargo.toml' + - 'crates/buzz-admin/**' + - 'crates/buzz-test-client/**' + - 'crates/buzz-ws-client/**' + - 'Cargo.lock' + - 'desktop/src-tauri/src/mesh_llm/**' + - 'scripts/ci-mesh-lifecycle-smoke.sh' + - 'scripts/start-relay-for-tests.sh' + - '.github/workflows/mesh-lifecycle.yml' + pull_request: + paths: + - 'crates/buzz-relay/examples/mesh_*.rs' + - 'crates/buzz-relay/Cargo.toml' + - 'crates/buzz-admin/**' + - 'crates/buzz-test-client/**' + - 'crates/buzz-ws-client/**' + - 'Cargo.lock' + - 'desktop/src-tauri/src/mesh_llm/**' + - 'scripts/ci-mesh-lifecycle-smoke.sh' + - 'scripts/start-relay-for-tests.sh' + - '.github/workflows/mesh-lifecycle.yml' + workflow_dispatch: + +concurrency: + group: mesh-lifecycle-${{ github.event_name == 'pull_request' && github.ref || github.sha }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +env: + CARGO_TERM_COLOR: always + +jobs: + lifecycle-smoke: + name: Relay-Driven Mesh Lifecycle Smoke + runs-on: ubuntu-24.04 + timeout-minutes: 45 + permissions: + contents: read + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + + - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 + + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 + with: + save-if: ${{ github.event_name != 'pull_request' }} + + # The mesh-llm SDK downloads a signed native runtime (llama.cpp CPU + # build) on first init, and the serve node downloads the smoke model + # from HuggingFace on first run. Key on the lockfile so a mesh pin bump + # rolls the runtime cache; the model ref is stable. + - name: Restore mesh runtime + model caches + id: mesh-caches + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cache/mesh-llm/native-runtimes + ~/.cache/huggingface/hub + key: mesh-lifecycle-${{ runner.os }}-smollm2-135m-${{ hashFiles('Cargo.lock') }} + restore-keys: | + mesh-lifecycle-${{ runner.os }}-smollm2-135m- + + - name: Start integration services + run: | + for attempt in 1 2 3; do + if docker compose up -d postgres redis minio minio-init; then + break + fi + if [ "$attempt" -eq 3 ]; then + echo "docker compose up failed after 3 attempts" >&2 + exit 1 + fi + echo "docker compose up failed (attempt $attempt), retrying in $((attempt * 5))s..." >&2 + sleep $((attempt * 5)) + done + + - name: Run relay-driven mesh lifecycle smoke + run: ./scripts/ci-mesh-lifecycle-smoke.sh 2>&1 | tee /tmp/mesh-lifecycle-harness.log + + - name: Save mesh runtime + model caches + if: github.ref == 'refs/heads/main' && steps.mesh-caches.outputs.cache-hit != 'true' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cache/mesh-llm/native-runtimes + ~/.cache/huggingface/hub + key: mesh-lifecycle-${{ runner.os }}-smollm2-135m-${{ hashFiles('Cargo.lock') }} + + - name: Upload relay + harness logs + if: failure() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: mesh-lifecycle-logs + path: | + /tmp/buzz-relay.log + /tmp/mesh-lifecycle-harness.log + if-no-files-found: ignore diff --git a/.github/workflows/promote-oss-desktop-release.yml b/.github/workflows/promote-oss-desktop-release.yml new file mode 100644 index 00000000000..f73bbd032b1 --- /dev/null +++ b/.github/workflows/promote-oss-desktop-release.yml @@ -0,0 +1,45 @@ +name: Promote OSS Desktop Auto-Update +run-name: Promote desktop-v${{ inputs.version }} to auto-update + +on: + workflow_dispatch: + inputs: + version: + description: Stable desktop version to promote (X.Y.Z) + required: true + type: string + +concurrency: + group: oss-desktop-auto-update-promotion + cancel-in-progress: false + +permissions: + contents: read + +jobs: + promote: + if: github.repository == 'block/buzz' + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: write + steps: + - name: Require the reviewed workflow from main + env: + DISPATCH_REF: ${{ github.ref }} + run: | + if [ "$DISPATCH_REF" != "refs/heads/main" ]; then + echo "::error::OSS desktop promotion must be dispatched from main, not $DISPATCH_REF" + exit 1 + fi + + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + ref: ${{ github.sha }} + persist-credentials: false + + - name: Validate and promote exact release manifest + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ inputs.version }} + run: scripts/promote-oss-desktop-release.sh "$VERSION" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7d5f3fbf400..187604fcf4c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,7 +36,7 @@ jobs: exit 1 fi - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 persist-credentials: false @@ -64,7 +64,7 @@ jobs: env: VERSION: ${{ needs.setup.outputs.version }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ needs.setup.outputs.source_sha }} fetch-depth: 0 @@ -91,7 +91,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it. @@ -278,7 +278,7 @@ jobs: VERSION: ${{ needs.setup.outputs.version }} TARGET: x86_64-apple-darwin steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ needs.setup.outputs.source_sha }} fetch-depth: 0 @@ -308,7 +308,7 @@ jobs: - name: Build sidecars run: | - cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh "$TARGET" - name: Build unsigned Tauri app @@ -428,7 +428,7 @@ jobs: if: github.repository == 'block/buzz' runs-on: ubuntu-latest # Digest-pinned like the SHA-pinned actions below; Renovate keeps it fresh. - container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 + container: ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea needs: setup timeout-minutes: 60 permissions: @@ -495,7 +495,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends gh - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ needs.setup.outputs.source_sha }} fetch-depth: 0 @@ -511,7 +511,7 @@ jobs: - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 with: workspaces: desktop/src-tauri lookup-only: true @@ -563,7 +563,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh - name: Generate release config @@ -573,7 +573,7 @@ jobs: BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json - name: Build Linux Tauri app - run: cd desktop && pnpm tauri build --verbose --ci --bundles deb,appimage --config src-tauri/tauri.release.conf.json + run: cd desktop && pnpm tauri build --verbose --ci --bundles deb,appimage --features mesh-llm --config src-tauri/tauri.release.conf.json env: BUZZ_UPDATER_PUBLIC_KEY: ${{ secrets.BUZZ_UPDATER_PUBLIC_KEY || secrets.SPROUT_UPDATER_PUBLIC_KEY }} BUZZ_UPDATER_ENDPOINT: https://github.com/block/buzz/releases/download/buzz-desktop-latest/latest.json @@ -666,7 +666,7 @@ jobs: VERSION: ${{ needs.setup.outputs.version }} TARGET: x86_64-pc-windows-msvc steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ needs.setup.outputs.source_sha }} fetch-depth: 0 @@ -795,7 +795,7 @@ jobs: VERSION: ${{ needs.setup.outputs.version }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ needs.setup.outputs.source_sha }} fetch-depth: 0 @@ -907,6 +907,7 @@ jobs: [ "${#TRIPLES[@]}" -ge 3 ] || { echo "::error::too few platforms (${#TRIPLES[@]})"; exit 1; } bash desktop/scripts/generate-oss-latest-json.sh "$VERSION" "${TRIPLES[@]}" > latest.json cat latest.json + cp latest.json staged/updater-manifest.json - name: Create or verify versioned draft run: | @@ -946,7 +947,3 @@ jobs: - name: Publish complete versioned release if: env.already_published != 'true' run: gh release edit "desktop-v${VERSION}" --draft=false - - - name: Upload latest.json to rolling release last - if: ${{ !contains(needs.setup.outputs.version, '-') }} - run: gh release upload buzz-desktop-latest latest.json --clobber diff --git a/.github/workflows/signed-macos-canary.yml b/.github/workflows/signed-macos-canary.yml index fb0656028af..5957f4785dd 100644 --- a/.github/workflows/signed-macos-canary.yml +++ b/.github/workflows/signed-macos-canary.yml @@ -34,16 +34,6 @@ jobs: - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 - # Rust cache covering both the workspace sidecar build and the Tauri - # crate build. shared-key scoped to macos-canary-release so canary runs - # warm each other without colliding with CI's debug-profile keys. - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - with: - workspaces: | - . - desktop/src-tauri - shared-key: macos-canary-release - - name: Get pnpm store directory id: pnpm-cache run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" @@ -78,6 +68,38 @@ jobs: cd desktop && node scripts/set-version-from-tag.mjs "$VERSION" cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT" + + # Compute this after cargo update so the key describes the graph that is + # actually compiled. The helper normalizes only Buzz Desktop's release + # version, allowing a canary to warm an otherwise identical tag build. + - name: Compute exact release cache key + id: rust_cache_key + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py \ + --platform "$RUNNER_OS" \ + --target aarch64-apple-darwin \ + --features mesh-llm \ + --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + echo "Release cache key: $KEY" + + - name: Restore exact release Cargo cache + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Generate non-updating bundle config run: | cat > desktop/src-tauri/tauri.canary.conf.json <<'JSON' @@ -93,7 +115,7 @@ jobs: - name: Build sidecars run: | - cargo build --release -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli + cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli ./scripts/bundle-sidecars.sh # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache key tracks it. @@ -210,6 +232,24 @@ jobs: if-no-files-found: error retention-days: 7 + - name: Measure release Cargo cache inputs + if: always() + run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true + + # Only this trusted, main-bound canary writes the cache. Excluding bundle + # output prevents installers or signed artifacts from entering it. + - name: Save exact release Cargo cache + if: steps.rust_cache.outputs.cache-hit != 'true' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Save pnpm store cache uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: diff --git a/.github/workflows/sprig-image.yml b/.github/workflows/sprig-image.yml new file mode 100644 index 00000000000..5d5e12ae0cf --- /dev/null +++ b/.github/workflows/sprig-image.yml @@ -0,0 +1,233 @@ +name: Sprig image + +# Builds and publishes the public agent container image as +# ghcr.io/block/buzz-sprig — the digest-pinned box the Kubernetes backend +# deploys agents into (see Dockerfile.sprig and docs/remote-agents.md). +# +# Strategy mirrors docker.yml (the relay image): each architecture builds on +# its native runner, pushes to GHCR by digest, then a merge job stitches the +# per-arch digests into one multi-arch manifest and attests provenance. +# No QEMU emulation. +# +# Triggers: +# - push to main (paths-filtered) → :main + :sha-<7> +# - tag sprig-v* → semver family (shared with sprig.yml's +# binary release — one tag versions both) +# - pull_request (paths-filtered) → build only, no push +# - workflow_dispatch → manual publish at the current ref +# +# NOTE: the first push creates the GHCR package PRIVATE by default. An org +# admin must flip ghcr.io/block/buzz-sprig to public once (Package settings → +# Change visibility). Subsequent pushes keep the visibility. + +on: + push: + branches: [main] + tags: ["sprig-v[0-9]*"] + paths: + - "Dockerfile.sprig" + - "scripts/sprig-entrypoint.sh" + - ".github/workflows/sprig-image.yml" + - "Cargo.toml" + - "Cargo.lock" + - "rust-toolchain.toml" + - "crates/**" + pull_request: + paths: + - "Dockerfile.sprig" + - "scripts/sprig-entrypoint.sh" + - ".github/workflows/sprig-image.yml" + workflow_dispatch: {} + +concurrency: + group: sprig-image-${{ github.ref }} + cancel-in-progress: ${{ github.ref_type == 'branch' && github.event_name == 'pull_request' }} + +permissions: {} + +env: + # Single source of truth for the image name; override with the + # GHCR_SPRIG_IMAGE repo variable (same pattern as docker.yml). + IMAGE_NAME: ${{ vars.GHCR_SPRIG_IMAGE != '' && vars.GHCR_SPRIG_IMAGE || 'ghcr.io/block/buzz-sprig' }} + +jobs: + build: + name: Build (${{ matrix.platform }}) + runs-on: ${{ matrix.runner }} + timeout-minutes: 60 + permissions: + contents: read + packages: write + id-token: write + attestations: write + strategy: + fail-fast: false + matrix: + include: + - platform: linux/amd64 + runner: ubuntu-24.04 + arch: amd64 + - platform: linux/arm64 + runner: ubuntu-24.04-arm + arch: arm64 + + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + with: + # Same OOM cap as docker.yml — Rust compiles blow the 7GB runner + # at buildkit's default parallelism of 4. + buildkitd-config-inline: | + [worker.oci] + max-parallelism = 2 + + - name: Log in to GHCR + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 + with: + images: ${{ env.IMAGE_NAME }} + # match=^sprig-v(.*)$ strips the tag prefix for the semver parser, + # exactly as docker.yml does for relay-v. :latest comes from + # flavor.latest=auto — stable semver only, never main pushes. + tags: | + type=ref,event=branch + type=sha,prefix=sha-,format=short + type=semver,pattern={{version}},match=^sprig-v(.*)$ + type=semver,pattern={{major}}.{{minor}},match=^sprig-v(.*)$ + labels: | + org.opencontainers.image.title=Buzz Sprig + org.opencontainers.image.description=Agent runtime image for Buzz remote agents (buzz-acp multicall + git + curl) + org.opencontainers.image.licenses=Apache-2.0 + + - name: Build and push by digest + id: build + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + with: + context: . + file: ./Dockerfile.sprig + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }} + cache-from: | + type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }} + cache-to: | + ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }} + + - name: Export digest + if: github.event_name != 'pull_request' + env: + DIGEST: ${{ steps.build.outputs.digest }} + run: | + mkdir -p /tmp/digests + touch "/tmp/digests/${DIGEST#sha256:}" + + - name: Upload digest + if: github.event_name != 'pull_request' + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sprig-digest-${{ matrix.arch }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + merge: + name: Merge multi-arch manifest + if: github.event_name != 'pull_request' + runs-on: ubuntu-24.04 + needs: build + timeout-minutes: 15 + permissions: + contents: read + packages: write + id-token: write + attestations: write + + steps: + - name: Download per-arch digests + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + path: /tmp/digests + pattern: sprig-digest-* + merge-multiple: true + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + + - name: Log in to GHCR + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 + with: + images: ${{ env.IMAGE_NAME }} + # Must mirror the build job's tag matrix exactly (see docker.yml). + flavor: | + latest=auto + tags: | + type=ref,event=branch + type=sha,prefix=sha-,format=short + type=semver,pattern={{version}},match=^sprig-v(.*)$ + type=semver,pattern={{major}}.{{minor}},match=^sprig-v(.*)$ + + - name: Create and push manifest list + id: manifest + working-directory: /tmp/digests + env: + IMAGE_NAME: ${{ env.IMAGE_NAME }} + META_TAGS: ${{ steps.meta.outputs.tags }} + run: | + set -euo pipefail + tags=() + while IFS= read -r tag; do + [ -n "$tag" ] && tags+=("-t" "$tag") + done <<< "$META_TAGS" + + digests=() + for digest in *; do + digests+=("${IMAGE_NAME}@sha256:${digest}") + done + + docker buildx imagetools create "${tags[@]}" "${digests[@]}" + + first_tag=$(echo "$META_TAGS" | head -n1) + merged_digest=$(docker buildx imagetools inspect "$first_tag" \ + --format '{{json .Manifest}}' | jq -r '.digest') + echo "digest=${merged_digest}" >> "$GITHUB_OUTPUT" + + - name: Attest provenance for the merged image + # Verify with: gh attestation verify oci://ghcr.io/block/buzz-sprig: --owner block + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + with: + subject-name: ${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.manifest.outputs.digest }} + push-to-registry: true + + - name: Summary + env: + IMAGE_NAME: ${{ env.IMAGE_NAME }} + DIGEST: ${{ steps.manifest.outputs.digest }} + run: | + { + echo "### Sprig image published" + echo '```' + echo "${IMAGE_NAME}@${DIGEST}" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/sprig.yml b/.github/workflows/sprig.yml index b2dab3583f5..5e50808b3b7 100644 --- a/.github/workflows/sprig.yml +++ b/.github/workflows/sprig.yml @@ -42,7 +42,7 @@ jobs: - x86_64-unknown-linux-musl - aarch64-unknown-linux-musl steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 @@ -116,7 +116,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Download all Sprig artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 @@ -154,7 +154,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Download all Sprig artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/staging-dev-relay-image.yml b/.github/workflows/staging-dev-relay-image.yml new file mode 100644 index 00000000000..c8a746a0b94 --- /dev/null +++ b/.github/workflows/staging-dev-relay-image.yml @@ -0,0 +1,276 @@ +name: Staging dev relay image + +# Publishes pre-merge relay runtime images for bb-block staging only. +# +# Operators run this workflow from the default branch and provide a target ref in +# this repository. GitHub's workflow_dispatch permission model limits triggering +# to collaborators who can run repository workflows; no actor allowlist is kept +# here. The target ref is resolved to an immutable commit SHA before checkout, +# and the published tag is derived from that full SHA. + +on: + workflow_dispatch: + inputs: + target_ref: + description: "Branch, tag, refs/heads/*, or refs/tags/* in block/buzz to publish for bb-block staging" + required: true + type: string + +permissions: {} + +env: + IMAGE_NAME: ghcr.io/block/buzz-staging-dev + ECR_REPOSITORY: 929862310821.dkr.ecr.us-west-2.amazonaws.com/ghcr.io/block/buzz-staging-dev + +jobs: + resolve: + name: Resolve target ref + runs-on: ubuntu-24.04 + timeout-minutes: 5 + permissions: + contents: read + outputs: + target_sha: ${{ steps.resolve.outputs.target_sha }} + image_tag: ${{ steps.resolve.outputs.image_tag }} + steps: + - name: Require reviewed workflow from main in canonical repository + env: + DISPATCH_REF: ${{ github.ref }} + REPOSITORY: ${{ github.repository }} + run: | + set -euo pipefail + if [ "$REPOSITORY" != "block/buzz" ]; then + echo "::error::Staging dev relay image publication is restricted to block/buzz" + exit 1 + fi + + if [ "$DISPATCH_REF" != "refs/heads/main" ]; then + echo "::error::Dispatch this workflow from main, not $DISPATCH_REF" + exit 1 + fi + + - name: Resolve target ref in this repository + id: resolve + env: + TARGET_REF_INPUT: ${{ inputs.target_ref }} + GITHUB_REPOSITORY: ${{ github.repository }} + run: | + set -euo pipefail + + target_ref=$(printf '%s' "$TARGET_REF_INPUT" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//') + + if [ -z "$target_ref" ]; then + echo "target_ref must not be empty" >&2 + exit 1 + fi + + if [ ${#target_ref} -gt 255 ]; then + echo "target_ref is too long" >&2 + exit 1 + fi + + if [[ ! "$target_ref" =~ ^[A-Za-z0-9._/@-]+$ ]]; then + echo "target_ref contains unsupported characters; use a branch, tag, or full refs/heads/* or refs/tags/* name" >&2 + exit 1 + fi + + case "$target_ref" in + -*|*..*|*.lock|refs/pull/*|pull/*|*/pull/*) + echo "target_ref is not an allowed repository branch/tag/ref" >&2 + exit 1 + ;; + esac + + workdir=$(mktemp -d) + trap 'rm -rf "$workdir"' EXIT + git -C "$workdir" init --quiet + git -C "$workdir" remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" + + fetch_commit() { + local ref=$1 + git -C "$workdir" fetch --no-tags --depth=1 origin "$ref" >/dev/null 2>&1 + git -C "$workdir" rev-parse --verify "FETCH_HEAD^{commit}" + } + + target_sha="" + if [[ "$target_ref" == refs/heads/* || "$target_ref" == refs/tags/* ]]; then + target_sha=$(fetch_commit "$target_ref") || { + echo "target_ref did not resolve in ${GITHUB_REPOSITORY}: $target_ref" >&2 + exit 1 + } + else + if target_sha=$(fetch_commit "refs/heads/${target_ref}"); then + : + elif target_sha=$(fetch_commit "refs/tags/${target_ref}"); then + : + else + echo "target_ref did not resolve as a branch or tag in ${GITHUB_REPOSITORY}: $target_ref" >&2 + exit 1 + fi + fi + + target_sha=$(printf '%s' "$target_sha" | tr '[:upper:]' '[:lower:]') + if [[ ! "$target_sha" =~ ^[0-9a-f]{40}$ ]]; then + echo "resolved target SHA is invalid: $target_sha" >&2 + exit 1 + fi + + image_tag="dev-sha-${target_sha}-run-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" + { + echo "target_sha=${target_sha}" + echo "image_tag=${image_tag}" + } >> "$GITHUB_OUTPUT" + + printf "Resolved \`%s\` to \`%s\`; image tag \`%s\`.\n" "$target_ref" "$target_sha" "$image_tag" >> "$GITHUB_STEP_SUMMARY" + + build: + name: Build staging relay runtime (${{ matrix.platform }}) + runs-on: ${{ matrix.runner }} + needs: resolve + timeout-minutes: 60 + permissions: + contents: read + packages: write + strategy: + fail-fast: false + matrix: + include: + - platform: linux/amd64 + runner: ubuntu-24.04 + arch: amd64 + - platform: linux/arm64 + runner: ubuntu-24.04-arm + arch: arm64 + steps: + - name: Checkout resolved target + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + ref: ${{ needs.resolve.outputs.target_sha }} + fetch-depth: 1 + persist-credentials: false + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + with: + buildkitd-config-inline: | + [worker.oci] + max-parallelism = 2 + + - name: Log in to GHCR + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 + with: + images: ${{ env.IMAGE_NAME }} + labels: | + org.opencontainers.image.title=Buzz staging dev relay + org.opencontainers.image.description=Pre-merge Buzz relay runtime image for bb-block staging only + org.opencontainers.image.licenses=Apache-2.0 + org.opencontainers.image.revision=${{ needs.resolve.outputs.target_sha }} + + - name: Build and push runtime image by digest + id: build + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + with: + context: . + file: ./Dockerfile + target: runtime + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true + cache-from: | + type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }} + cache-to: | + type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }},mode=max,compression=zstd + + - name: Export digest + env: + DIGEST: ${{ steps.build.outputs.digest }} + run: | + set -euo pipefail + mkdir -p /tmp/digests-release + touch "/tmp/digests-release/${DIGEST#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: staging-dev-relay-digests-${{ matrix.arch }} + path: /tmp/digests-release/* + if-no-files-found: error + retention-days: 1 + + merge: + name: Publish staging relay runtime manifest + runs-on: ubuntu-24.04 + needs: + - resolve + - build + timeout-minutes: 15 + permissions: + contents: read + packages: write + steps: + - name: Download per-arch digests + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + path: /tmp/digests + pattern: staging-dev-relay-digests-* + merge-multiple: true + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + + - name: Log in to GHCR + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Create and push manifest list + id: manifest + working-directory: /tmp/digests + env: + IMAGE_NAME: ${{ env.IMAGE_NAME }} + IMAGE_TAG: ${{ needs.resolve.outputs.image_tag }} + run: | + set -euo pipefail + digests=() + for digest in *; do + digests+=("${IMAGE_NAME}@sha256:${digest}") + done + + docker buildx imagetools create -t "${IMAGE_NAME}:${IMAGE_TAG}" "${digests[@]}" + merged_digest=$(docker buildx imagetools inspect "${IMAGE_NAME}:${IMAGE_TAG}" \ + --format '{{json .Manifest}}' | jq -r '.digest') + echo "digest=${merged_digest}" >> "$GITHUB_OUTPUT" + + - name: Deployment summary + env: + IMAGE_NAME: ${{ env.IMAGE_NAME }} + ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }} + IMAGE_TAG: ${{ needs.resolve.outputs.image_tag }} + TARGET_SHA: ${{ needs.resolve.outputs.target_sha }} + MERGED_DIGEST: ${{ steps.manifest.outputs.digest }} + run: | + { + echo "### Published bb-block staging dev relay image" + echo + echo "**Source commit:** \`${TARGET_SHA}\`" + echo "**GHCR image:** \`${IMAGE_NAME}:${IMAGE_TAG}\`" + echo "**Manifest digest:** \`${MERGED_DIGEST}\`" + echo + echo "Set bb-block staging BPCI values to:" + echo '```yaml' + echo "buzz:" + echo " image:" + echo " repository: ${ECR_REPOSITORY}" + echo " tag: ${IMAGE_TAG}" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/windows-canary.yml b/.github/workflows/windows-canary.yml index 29f74fa0f64..7093efd2dc6 100644 --- a/.github/workflows/windows-canary.yml +++ b/.github/workflows/windows-canary.yml @@ -46,24 +46,9 @@ jobs: shell: bash run: rustup target add "$TARGET" - # Rust cache covering both the workspace sidecar build and the Tauri - # crate build. shared-key scoped to windows-canary-release so canary - # runs warm each other without colliding with CI's debug-profile key - # (CI windows job does clippy/check, not --release). - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - with: - workspaces: | - . - desktop/src-tauri - shared-key: windows-canary-release - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 24.14.1 - # Disable setup-node's built-in cache: we manage the pnpm store cache - # explicitly below (restore before install, save after) to mirror the - # pattern used by ci.yml and to keep caching logic consistent across - # all three canary workflows. package-manager-cache: false - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 @@ -108,6 +93,40 @@ jobs: cd desktop && node scripts/set-version-from-tag.mjs "$VERSION" cd src-tauri && cargo update --workspace + - name: Resolve native toolchain identity + id: native_toolchain + shell: bash + run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT" + + # Compute this after cargo update so the key describes the graph that is + # actually compiled. The helper normalizes only Buzz Desktop's release + # version, allowing a canary to warm an otherwise identical tag build. + - name: Compute exact release cache key + id: rust_cache_key + shell: bash + env: + NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }} + run: | + KEY=$(scripts/desktop-release-cache-key.py \ + --platform "$RUNNER_OS" \ + --target x86_64-pc-windows-msvc \ + --features default \ + --native-inputs "$NATIVE_TOOLCHAIN_ID") + echo "key=$KEY" >> "$GITHUB_OUTPUT" + echo "Release cache key: $KEY" + + - name: Restore exact release Cargo cache + id: rust_cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Generate non-updating bundle config shell: bash run: | @@ -152,6 +171,25 @@ jobs: if-no-files-found: error retention-days: 7 + - name: Measure release Cargo cache inputs + if: always() + shell: bash + run: du -sh ~/.cargo/registry ~/.cargo/git target desktop/src-tauri/target 2>/dev/null || true + + # Only this trusted, main-bound canary writes the cache. Excluding bundle + # output prevents installers from entering it. + - name: Save exact release Cargo cache + if: steps.rust_cache.outputs.cache-hit != 'true' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 + with: + path: | + ~/.cargo/registry + ~/.cargo/git + target + desktop/src-tauri/target + !desktop/src-tauri/target/**/release/bundle + key: ${{ steps.rust_cache_key.outputs.key }} + - name: Save pnpm store cache uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: diff --git a/.gitignore b/.gitignore index f26e74136c0..ad077f71dd3 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,8 @@ identity.key # Helm dependency tarballs — regenerable from Chart.lock via `helm dependency build` deploy/charts/*/charts/*.tgz + +# CTO worker identity — per-process runtime state, never shared substrate (F5/F15) +.cofoundy/state/active-agent.yaml +.cofoundy/state/active-task.yaml +.cofoundy/state/worker-id diff --git a/.release/desktop-candidate.json b/.release/desktop-candidate.json index 1bf2efb66bc..4751a7d3517 100644 --- a/.release/desktop-candidate.json +++ b/.release/desktop-candidate.json @@ -1,8 +1,10 @@ { - "schema": 1, - "version": "0.5.3", - "base_sha": "54c8ef30a9bb9c59a4415a8a7ee84c7c5454b48a", - "previous_tag": "v0.5.2", - "tag": "desktop-v0.5.3", - "commit_count": 58 + "schema": 2, + "version": "0.5.20", + "base_sha": "8471049c430073474939336dfc6aa98272bc8762", + "previous_tag": "desktop-v0.5.19", + "previous_base_sha": "ee6ca5fa28bce04dfecb6717de65b08a57f2ac47", + "previous_merge_sha": "7a1b7d8e09f96c10b6617a66bb8589e9984ffb3c", + "tag": "desktop-v0.5.20", + "commit_count": 4 } diff --git a/AGENTS.md b/AGENTS.md index 7ff0eb4d477..b1f11bd3db1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,6 +6,25 @@ code style, PR process, architecture), see [CONTRIBUTING.md](CONTRIBUTING.md). --- +## Product Contract + +Before planning or reviewing a non-trivial change: + +1. Read [VISION.md](VISION.md). +2. Read the `VISION_*.md` documents relevant to the affected product surface. +3. Read the applicable guidance in [TESTING.md](TESTING.md) and any + package-local `TESTING.md`. +4. Check that the proposed design advances, or at least does not contradict, + that product intent. Call out any intentional tension explicitly. + +Implementation describes the product today; the vision documents describe the +product it is becoming. A locally correct change can still be wrong if it works +against that direction. Scale validation to the change's risk and exercise the +real workflow for user-visible or integration behavior when practical; green CI +and runtime evidence answer different questions. + +--- + ## Ecosystem Buzz spans five repos. This one (`block/buzz`) is the OSS source for the relay, desktop, mobile, and CLI. The others handle internal builds and deployment: @@ -13,14 +32,14 @@ Buzz spans five repos. This one (`block/buzz`) is the OSS source for the relay, | Repo | Purpose | |------|---------| | [block/buzz](https://github.com/block/buzz) | OSS source — relay, desktop app, mobile app, CLI, agent harness | -| [squareup/sprout-releases](https://github.com/squareup/sprout-releases) | Buildkite pipeline producing Block-signed macOS + iOS builds with `-block` version suffix | +| [squareup/buzz-releases](https://github.com/squareup/buzz-releases) | Buildkite pipelines producing Block-signed macOS + iOS builds with `-block` desktop version suffix | | [squareup/sprout-oss](https://github.com/squareup/sprout-oss) | CI pipeline building the relay Docker image and pushing to internal ECR | | [squareup/block-coder-tf-stacks](https://github.com/squareup/block-coder-tf-stacks) | Terraform + ArgoCD deploying the relay to the staging Kubernetes cluster | | [squareup/sprout-backend-blox](https://github.com/squareup/sprout-backend-blox) | Desktop backend provider script connecting Blox workstation agents to the relay | ``` block/buzz (source) - ├─► sprout-releases (desktop + mobile builds → Artifactory, GitHub, Mobile Releases) + ├─► buzz-releases (desktop + mobile builds → Artifactory, GitHub, Mobile Releases) ├─► sprout-oss (relay Docker image → ECR) │ └─► block-coder-tf-stacks (Helm chart → ArgoCD → staging cluster) └─── sprout-backend-blox (Blox compute provider for Desktop agent launch) @@ -90,8 +109,9 @@ See CONTRIBUTING.md for full setup details and dependency requirements. ## Quality Gates -Run `just ci` before every PR — it runs `fmt` + `clippy` + desktop lint + -unit tests + builds. Clippy passing does not mean fmt passes; run both. +Run `just ci` before every PR — it runs repository-wide formatting, lint, +and static checks; Rust, Tauri, desktop, and mobile tests; and desktop and web +builds. Clippy passing does not mean fmt passes; run both. Run `just test` for integration tests if you touched `buzz-relay`, `buzz-db`, or `buzz-auth` — these require a running Postgres and Redis. @@ -100,13 +120,27 @@ Run `just test` for integration tests if you touched `buzz-relay`, formatting via `stage_fixed`. Pre-commit runs fix variants in parallel (Rust fmt, Tauri Rust fmt, desktop biome fix, web biome fix, mobile dart format). Auto-fixable issues are fixed and re-staged; unfixable lint issues block the -commit. **Pre-push hooks** run clippy (workspace + Tauri) and fast unit tests -in parallel (Rust, desktop JS, Tauri Rust, mobile Flutter) — no overlap with -pre-commit. Builds are CI-only. Run `just fix-all` to auto-fix all formatting -in one shot. Run `just ci` for the full local gate. Run `just hooks` to -re-install hooks after env changes. Before agents run Git or hooks, activate the -repo's Hermit environment (`. ./bin/activate-hermit`); do not rewrite hook -commands to compensate for an unconfigured shell `PATH`. +commit. **Pre-push hooks** run the repository-wide differential file-size gate, +clippy (workspace + Tauri), desktop TypeScript typechecking (`tsc --noEmit`), +and fast unit tests in parallel (Rust, desktop JS, Tauri Rust, mobile Flutter) +— no overlap with pre-commit. Builds are CI-only. Run `just fix-all` to auto-fix +all formatting in one shot. Run `just ci` for the full local gate. Run `just +hooks` to re-install hooks after env changes. Each globbed pre-push lane is +scoped to the branch's merge-base diff against `origin/main` (`git diff +origin/main...HEAD`), matching CI's paths-filter — so a lane only fires when this +branch actually changed a file it covers, never because `origin/main` moved. +These lanes validate the checked-out HEAD; pushing a non-HEAD ref (explicit +refspec, `--all`) gets a non-fatal `push-head-scope` warning and relies on CI for +its path-scoped checks. +Before agents run Git or hooks, activate the repo's Hermit environment +(`. ./bin/activate-hermit`) so `./bin` leads `PATH` and the pinned toolchain +(flutter, dart, lefthook) wins over any Homebrew version; do not +rewrite hook commands to compensate for an unconfigured shell `PATH`. The +pre-push hook self-pins regardless: `bin/.lefthookrc` (sourced by the generated +`.git/hooks/*`) prepends the Hermit `bin/` to `PATH` and pins `LEFTHOOK_BIN`, so +lane subprocesses resolve the pinned flutter/dart/lefthook even when an +unactivated shell has Homebrew first. Activating Hermit remains recommended for +non-hook commands. **Commit with `git commit -s`.** The required **DCO Check** fails any PR with a commit missing a `Signed-off-by` trailer, and `just hooks` installs a `commit-msg` hook that adds it to commits you create locally (`git rebase` and `git cherry-pick` still need `--signoff`) — if you build commit commands programmatically, include `-s` every time. To repair a branch that already has unsigned commits: `git rebase --signoff main`, then force-push. @@ -145,6 +179,10 @@ first, then implement handling in the relay. **Channel scoping**: Channels use `h` tags (NIP-29 group tag), not `e` tags. Filters and queries must scope to `h` tags when operating within a channel. +This applies to events *inside* a channel. Addressable events that describe a +channel carry its id in their `d` tag instead: kind:39000 (metadata), +kind:39001, kind:39002 (membership). `get_channels` resolves a user's channels +from the `d` tag of their kind:39002 events, not from `h`. **Agent-facing operations go in `buzz-cli`**: New agent-facing features belong in `buzz-cli` — add a subcommand there first, then wire the REST/WebSocket call in `client.rs`. `buzz-dev-mcp` (shell + file tools for `buzz-agent`) is separate. @@ -177,15 +215,16 @@ or invoke with the full path. ### Deep Links `buzz://message?channel=&id=` links reference a specific message -thread. To read the linked thread: +thread. Pass the link directly to the CLI: ```bash -buzz messages thread --channel --event --format compact +buzz --format compact messages thread --link '' ``` -Extract `channel` and `id` from the URL query parameters. The optional -`thread` parameter (root event ID) can be ignored — `messages thread` resolves -the full thread from the event ID alone. +The selected message ID is authoritative: `messages thread` verifies its +channel and derives its containing root. An optional `thread` parameter is +accepted only when it matches that derived root. The explicit +`--channel --event ` form remains available. All reads return sig-stripped JSON arrays; all writes return `{event_id, accepted, message}`; creates add the entity ID. Exit codes: @@ -211,7 +250,9 @@ E2E tests live in `crates/buzz-test-client/tests/`: - `e2e_media_extended.rs` — extended media scenarios - `e2e_nostr_interop.rs` — Nostr interop (NIP-50 search, NIP-10 threads, NIP-17 gift wraps) -Desktop E2E: `cd desktop && pnpm exec playwright test` +Desktop E2E: `cd desktop && pnpm test:e2e:smoke` for mock-bridge smoke +coverage, or `pnpm test:e2e:integration` for relay-backed coverage. These +scripts build the required E2E bridge before running Playwright. See [TESTING.md](TESTING.md) for the full multi-agent E2E guide. @@ -422,11 +463,10 @@ description. See [PR #803](https://github.com/block/buzz/pull/803). 1. **Kind `39000` for channel metadata, not `41`** — kind 41 is NIP-01 (unused). All kinds defined in `buzz-core/src/kind.rs`. 2. **Relay queries must specify `kinds`** — omitting `kinds` triggers the p-gate (403). Always include explicit kind filters. -3. **`messages search` must include `--kinds`** — an open-ended search (no kinds) hits the relay p-gate and returns 403. Pass at least `--kinds 9,45001,45003` to scope the query. +3. **`messages search` chooses its own supported kinds** — do not add a `--kinds` option; the current command does not accept one. This differs from raw relay filters, which still need explicit kinds. 4. **Worktrees: `cd` in the same command** — shell CWD doesn't persist between tool calls. Use `cd /path && cargo build` as one command. 5. **Desktop crate excluded from root workspace** — `cargo test` at repo root does NOT run desktop tests. Use `cargo test --manifest-path desktop/src-tauri/Cargo.toml` explicitly. -6. **Desktop Tauri fmt fails in worktrees and blocks commits** — the pre-commit hook runs `just desktop-tauri-fmt`, which fails in git worktrees because `cargo fmt` resolves workspace paths relative to the worktree root. Run `just desktop-tauri-fmt` from the main checkout to apply the fix, then re-stage and commit. CI is unaffected. -7. **React render perf: `React.memo` is all-or-nothing** — it only skips a re-render when *every* prop is reference-stable; one unstable prop (inline arrow/JSX, or a hook returning a fresh `{}`/`[]`/`Map` each render) defeats it. Two repeat offenders: (a) React Query results (`useMutation`/`useQuery`) are a **new object each render** — depend on the stable method (`mutation.mutateAsync`), not the object; (b) derived `Map`/array state that recomputes on a version bump — wrap in a content-equality ref cache (`shared/hooks/useStableReference.ts`). When chasing interaction lag, **measure with DevTools closed and no perf probes** (an open Web Inspector + per-keystroke `console.log` inflate the numbers), and isolate by removing one suspect at a time rather than guessing. +6. **React render perf: `React.memo` is all-or-nothing** — it only skips a re-render when *every* prop is reference-stable; one unstable prop (inline arrow/JSX, or a hook returning a fresh `{}`/`[]`/`Map` each render) defeats it. Two repeat offenders: (a) React Query results (`useMutation`/`useQuery`) are a **new object each render** — depend on the stable method (`mutation.mutateAsync`), not the object; (b) derived `Map`/array state that recomputes on a version bump — wrap in a content-equality ref cache (`shared/hooks/useStableReference.ts`). When chasing interaction lag, **measure with DevTools closed and no perf probes** (an open Web Inspector + per-keystroke `console.log` inflate the numbers), and isolate by removing one suspect at a time rather than guessing. --- @@ -450,11 +490,18 @@ are frozen.** So for any readable text, reach for rem-based Tailwind tokens, never arbitrary px: -- ✅ Stock rem tokens (`text-base`, `text-sm`, `text-xs`, …). **Chat body/author - text === `text-base` (16px) — chat is the app's base type size**, and the - surrounding timeline elements (timestamps, system rows, code, reactions) are - deliberate steps on that same stock ramp. -- ✅ The `text-2xs` (0.6875rem / 11px) and `text-3xs` (0.5rem / 8px) meta-text +- ✅ Stock rem tokens (`text-base`, `text-sm`, `text-xs`, …) for general + interface text. All of these derive from the virtual typography rem and + therefore follow the user's font-size preference and Cmd +/- zoom. +- ✅ Conversation text uses the named `text-message` token. Its + **Smaller / Default / Larger contract is 13 / 14 / 15px** before keyboard + zoom. Author names use the same conversation-size step; timestamps, system + rows, code, and reactions are deliberate neighboring steps on the shared + virtual-rem ramp. Keep those relationships tokenized rather than restoring a + fixed 16px chat baseline or hardcoding preference-specific values in + components. +- ✅ The `text-2xs` (0.6875rem / 11px at a 16px virtual rem) and `text-3xs` + (0.5rem / 8px at a 16px virtual rem) meta-text tokens (in `desktop/tailwind.config.js` under `theme.extend.fontSize`) for the sub-`text-xs` ramp — timestamps, count badges, tracking labels, tiny glyphs. These replaced the dozens of arbitrary `text-[…rem]` literals that had drifted @@ -487,26 +534,12 @@ class instances, cached promises) survive across remounts. Every community-scope singleton needs a reset function wired into `resetCommunityState()` in `desktop/src/features/communities/useCommunityInit.ts`. -Current singletons that are reset on relay boundary changes (same-relay -reconnects preserve pending avatar verification work): -- `relayClient.disconnect()` — WebSocket teardown + promise rejection -- `resetRateLimitGate()` — clears any active rate-limit window from the old relay -- `clearAllDrafts()` — message draft cache -- `resetAgentObserverStore()` — agent observer relay store -- `resetActiveAgentTurnsStore()` — active agent turn timers -- `resetAgentWorkingSignal()` — agent working indicator signal -- `resetAvatarProfileSync()` — pending verified-avatar profile writes -- `resetAvatarPresentations()` — avatar probes, previews, and Retry toasts -- `resetSidebarRelayConnectionCardState()` — sidebar relay card dismiss state -- `resetMediaCaches()` — proxy port and relay origin caches -- `resetVideoPlayerState()` — video player singleton -- `resetRenderScopedReactionHydration()` — reaction hydration cache -- `clearSearchHitEventCache()` — search result event cache -- `clearMarkdownNodeCache()` — markdown parse-node cache - -**If you add a new module-level cache, Map, or class instance that holds -community-scoped data, you must add its reset to `resetCommunityState()`.** -Failure to do so causes data from the old community to leak into the new one. +`resetCommunityState()` is the canonical inventory of community-scoped +singletons. **If you add a new module-level cache, Map, or class instance that +holds community-scoped data, add its reset there in the same change.** Failure +to do so causes data from the old community to leak into the new one. Avoid +duplicating its complete reset list here; the implementation is the source of +truth. Key files: - `desktop/src/app/App.tsx` — community key, init gate, remount boundary @@ -531,19 +564,33 @@ The mobile app lives in `mobile/` — a Flutter app using Riverpod + Hooks. - **NEVER use `StatefulWidget`** — favor Riverpod for state and always use `HookConsumerWidget` or `ConsumerWidget` with `flutter_hooks` for local state. -- **NEVER run `flutter run`, `flutter build`, `flutter clean`, or - `flutter upgrade`** — only `flutter test`, `flutter analyze`, and - `dart format` are safe for agents to run. +- Agents may build and run the Flutter app when it materially helps implement, + debug, or validate mobile changes. Prefer the smallest relevant command and + reuse an already-running simulator/emulator and the app's configured staging + or production community when that is sufficient. Do not start or rebuild + local relay services unless the task specifically requires relay-side or + isolated integration behavior. +- For iOS runtime validation, prefer `just mobile-dev`; it applies the + worktree-specific debug identity and runs `flutter run`. Direct `flutter run` + or IDE workflows are also allowed. Use `just mobile-build-android` only when + an APK build is relevant to the task. +- Do not rebuild, reinstall, or relaunch merely for ceremony. Preserve Flutter's + incremental build cache and use hot reload/restart where appropriate. Use + `flutter clean` only when stale build artifacts are a credible cause. Run + `flutter upgrade` only when the task explicitly requires a toolchain change. +- For user-visible or integration changes, exercise the affected workflow in a + real app when practical and report the device/simulator, connected community, + and workflow actually tested. - **Do NOT use `print()`** — use `debugPrint()` or structured logging. - Prefer `context.colors` and `context.textTheme` (via theme extensions) over raw `Theme.of(context)` calls. - **Keep widgets small and composable.** One public widget per file; push private sub-widgets (`_Foo`) into sibling `part` files under a `/` folder rather than growing the page file. Hard ceiling: - **1000 lines/file**, enforced by `mobile/scripts/check-file-sizes.mjs` via - `just mobile-check` (runs in `just check` + pre-push, mirroring desktop/web). - If the guard trips, **split the file — never bump the limit or add an - override to slip under it.** + **1000 lines/file**, enforced across Desktop, Web, and Mobile by the + repository-level `just file-size-check` gate (`just check`, CI, and every + pre-push). If the guard trips, **split the file — never bump the limit or add + an override to slip under it.** - Feature modules must not import from other feature modules — only from `shared/`. - Use `Grid` tokens for spacing, `Radii` for border radius. @@ -559,12 +606,16 @@ flutter test Or from repo root: `just mobile-fmt` (auto-fix), `just mobile-check` (lint + fmt check), `just mobile-test` (tests). -To run the app locally (starts Docker, relay, iOS simulator automatically): +To run the app locally with a worktree-specific debug identity and a +started or reused iOS Simulator: ```bash just mobile-dev ``` +This runs `flutter run` against the app's configured community; it does not +start Docker or local relay services. + When run from a git worktree, `just mobile-dev` (and `just mobile-build-android`) give the debug build a per-worktree app identifier (keyed to the worktree directory name) and a branch-labelled app name via diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 5c8e263a2a4..892082d96c6 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -139,7 +139,7 @@ The `kind` integer is the only dispatch switch. The relay routes, stores, and fa | 46001–46012 | KIND_WORKFLOW_* | Workflow execution events | | 20001 | KIND_PRESENCE_UPDATE | Ephemeral presence heartbeat | -`buzz-core` defines all 81 kinds as `pub const KIND_*: u32` and exports `ALL_KINDS: &[u32]`. Kinds are `u32` (NIP-01 specifies unsigned integer; `u32` covers the full range). Buzz uses both standard Nostr kinds (e.g., kind 7 for reactions) and custom ranges (40000+). +`buzz-core` defines each event kind as a `pub const u32` and exports the full registry as `ALL_KINDS: &[u32]` (127 kinds at the time of writing); `crates/buzz-core/src/kind.rs` is the source of truth for the current list. Kinds are `u32` (NIP-01 specifies unsigned integer; `u32` covers the full range). Buzz uses both standard Nostr kinds (e.g., kind 7 for reactions) and custom ranges (40000+). Note: `KIND_AUTH` (22242) is `pub const KIND_AUTH: u32` in `buzz-core/src/kind.rs` and imported by `buzz-relay/src/handlers/event.rs`. `KIND_CANVAS` (40100) is likewise `pub const KIND_CANVAS: u32` in `buzz-core/src/kind.rs`. diff --git a/CHANGELOG.md b/CHANGELOG.md index 71a4bbd4495..eec43c38716 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,610 @@ # Changelog +## v0.5.20 + +### Desktop and shared changes + +- feat(desktop): add KLIPY GIF search to composers ([#5554](https://github.com/block/buzz/pull/5554)) ([`8471049c430073474939336dfc6aa98272bc8762`](https://github.com/block/buzz/commit/8471049c430073474939336dfc6aa98272bc8762)) +- fix(desktop): respect automatic mention preference after send ([#6837](https://github.com/block/buzz/pull/6837)) ([`e8cd7516e6df62c2a9025d7a821bf98e0e8f83b4`](https://github.com/block/buzz/commit/e8cd7516e6df62c2a9025d7a821bf98e0e8f83b4)) + +### Other repository changes + +- fix(release): attribute desktop candidates to the operator ([#6831](https://github.com/block/buzz/pull/6831)) ([`820a8589971df49bb9285a236ce1e2955a301abd`](https://github.com/block/buzz/commit/820a8589971df49bb9285a236ce1e2955a301abd)) +- fix(ci): check out source in docker.yml merge job ([#6833](https://github.com/block/buzz/pull/6833)) ([`cae7f826b39b38e7d49a90d342499234dec007bf`](https://github.com/block/buzz/commit/cae7f826b39b38e7d49a90d342499234dec007bf)) + +[Compare desktop-v0.5.19...desktop-v0.5.20](https://github.com/block/buzz/compare/desktop-v0.5.19...desktop-v0.5.20) + +## v0.5.19 + +### Desktop and shared changes + +- docs(nest): make commit attribution policy-neutral ([#6707](https://github.com/block/buzz/pull/6707)) ([`22f32c99e2e983b7e015e8c058cac47438d05b2f`](https://github.com/block/buzz/commit/22f32c99e2e983b7e015e8c058cac47438d05b2f)) +- fix(desktop-messages): preserve inline agent mentions with persistent addressing ([#6793](https://github.com/block/buzz/pull/6793)) ([`b58de7cfa7a13b1a6dbb2fc269186439a6fb79a0`](https://github.com/block/buzz/commit/b58de7cfa7a13b1a6dbb2fc269186439a6fb79a0)) +- feat(desktop): persist agent addressing across composer messages ([#6714](https://github.com/block/buzz/pull/6714)) ([`7ba1197aa6b01616b5920487dd585a37d2e7f74d`](https://github.com/block/buzz/commit/7ba1197aa6b01616b5920487dd585a37d2e7f74d)) +- feat: navigate images across message threads ([#6705](https://github.com/block/buzz/pull/6705)) ([`a526dca9bcaa08dfb5db77999cc1f584a17a9d64`](https://github.com/block/buzz/commit/a526dca9bcaa08dfb5db77999cc1f584a17a9d64)) +- revert fixed mention highlight ([#6716](https://github.com/block/buzz/pull/6716)) ([`12f3fea26e4c638a5fae20dce1ec0876e3bbca41`](https://github.com/block/buzz/commit/12f3fea26e4c638a5fae20dce1ec0876e3bbca41)) +- highlight search terms in results and messages ([#6702](https://github.com/block/buzz/pull/6702)) ([`29f2054c69f2e0ea4ee90141ac6a80503e5f9bd1`](https://github.com/block/buzz/commit/29f2054c69f2e0ea4ee90141ac6a80503e5f9bd1)) +- fix(desktop): make lightbox zoom controls interactive ([#6710](https://github.com/block/buzz/pull/6710)) ([`9b6a637d014607760d116b90c57062f82ab27cf3`](https://github.com/block/buzz/commit/9b6a637d014607760d116b90c57062f82ab27cf3)) +- Support community deletion in versioned media buckets ([#6738](https://github.com/block/buzz/pull/6738)) ([`d12dea4e67c5224a626d9c00f45e68d1def72d4c`](https://github.com/block/buzz/commit/d12dea4e67c5224a626d9c00f45e68d1def72d4c)) +- Fix TipTap editor mount race ([#6779](https://github.com/block/buzz/pull/6779)) ([`bb5b9357a7c8ddeaee73f6252c7d9f8a9014dbc9`](https://github.com/block/buzz/commit/bb5b9357a7c8ddeaee73f6252c7d9f8a9014dbc9)) +- feat(buzz-agent): gate LLM tool calls on session/request_permission ([#5712](https://github.com/block/buzz/pull/5712)) ([`a1219070fa6c3263c8a29637c70b7a317d4ecd9d`](https://github.com/block/buzz/commit/a1219070fa6c3263c8a29637c70b7a317d4ecd9d)) +- Fix mobile Huddle agent voice turn states ([#6611](https://github.com/block/buzz/pull/6611)) ([`8b812017a79c9279594330fb2b04c1eaf0e6e6c1`](https://github.com/block/buzz/commit/8b812017a79c9279594330fb2b04c1eaf0e6e6c1)) +- fix(desktop): polish inline chip states ([#6718](https://github.com/block/buzz/pull/6718)) ([`a8e1c66c4a5017a32e41e04e2ba6059e2dfcae21`](https://github.com/block/buzz/commit/a8e1c66c4a5017a32e41e04e2ba6059e2dfcae21)) +- feat(workflows): discover trigger filter values ([#6712](https://github.com/block/buzz/pull/6712)) ([`e760c51820b2103d965c22b44254678e10fb689a`](https://github.com/block/buzz/commit/e760c51820b2103d965c22b44254678e10fb689a)) +- feat(desktop): simplify the message action rail ([#6529](https://github.com/block/buzz/pull/6529)) ([`c5166f2164035ca96787daee6528d5dc04c4a02e`](https://github.com/block/buzz/commit/c5166f2164035ca96787daee6528d5dc04c4a02e)) +- fix(desktop): restore icon-only remote marker ([#6491](https://github.com/block/buzz/pull/6491)) ([`30d2fc52f96138311f2006627ffc1a6d5ff1865b`](https://github.com/block/buzz/commit/30d2fc52f96138311f2006627ffc1a6d5ff1865b)) +- fix(composer): wrap Buzz chip labels without orphaning icons ([#6581](https://github.com/block/buzz/pull/6581)) ([`f79d346a178408661fcad85122364ac2ad7e9cb2`](https://github.com/block/buzz/commit/f79d346a178408661fcad85122364ac2ad7e9cb2)) +- fix(desktop): bound thread /query and surface load errors, not false-empty ([#6447](https://github.com/block/buzz/pull/6447)) ([`f6e6617a9dcc2308d5039f8afaab974b49fb9577`](https://github.com/block/buzz/commit/f6e6617a9dcc2308d5039f8afaab974b49fb9577)) +- fix(messages): route edits to the owning composer ([#6575](https://github.com/block/buzz/pull/6575)) ([`4bf80978f52981f0035e6c0b86bdf1108bbf64c8`](https://github.com/block/buzz/commit/4bf80978f52981f0035e6c0b86bdf1108bbf64c8)) +- fix(desktop): align jump-to-latest pill with composer height ([#6606](https://github.com/block/buzz/pull/6606)) ([`9f55bf67456be10ff7c8238bf0d9e12e582848f6`](https://github.com/block/buzz/commit/9f55bf67456be10ff7c8238bf0d9e12e582848f6)) +- fix(desktop): emit singular `mention` feed category so alerts route correctly ([#6665](https://github.com/block/buzz/pull/6665)) ([`db5617dd1541aeab7bacaf039b6ca98f856776d0`](https://github.com/block/buzz/commit/db5617dd1541aeab7bacaf039b6ca98f856776d0)) +- show mention counts in channel notifications ([#6696](https://github.com/block/buzz/pull/6696)) ([`0e69b3fd7c44c09da62e2c4e89fdb4a26e666869`](https://github.com/block/buzz/commit/0e69b3fd7c44c09da62e2c4e89fdb4a26e666869)) +- fix(desktop): hide selection formatting tray on composer right-click ([#6683](https://github.com/block/buzz/pull/6683)) ([`2f13e30e88e84851e7ad336364dd3cfd547b8c16`](https://github.com/block/buzz/commit/2f13e30e88e84851e7ad336364dd3cfd547b8c16)) +- fix(desktop): stabilize members dialog scrolling ([#6670](https://github.com/block/buzz/pull/6670)) ([`72ba987c365abb98939153c4d43dde73257c1264`](https://github.com/block/buzz/commit/72ba987c365abb98939153c4d43dde73257c1264)) +- fix(desktop): keep member runtime status off the UI thread ([#6445](https://github.com/block/buzz/pull/6445)) ([`17af15effac63e6bc5338448326ce52ba4426e5f`](https://github.com/block/buzz/commit/17af15effac63e6bc5338448326ce52ba4426e5f)) +- perf(desktop): persist channel heads, collapse thread reads and reply sends ([#6572](https://github.com/block/buzz/pull/6572)) ([`2d280376ad36134cec1f23bead6d866d30bed147`](https://github.com/block/buzz/commit/2d280376ad36134cec1f23bead6d866d30bed147)) +- Downgrade desktop Huddles to audio protocol v2 ([#6610](https://github.com/block/buzz/pull/6610)) ([`0720f5380ce8a6c050afac159f8462c06cd51ab5`](https://github.com/block/buzz/commit/0720f5380ce8a6c050afac159f8462c06cd51ab5)) +- perf(desktop): make the Projects surface render-cheap ([#6460](https://github.com/block/buzz/pull/6460)) ([`040b203f73576e15ef749b0ff0ee6243f06a5c48`](https://github.com/block/buzz/commit/040b203f73576e15ef749b0ff0ee6243f06a5c48)) +- refactor(acp): clarify agent prompt sections ([#6501](https://github.com/block/buzz/pull/6501)) ([`f99532585a0715bac73b4a6361a9b4966bdb5095`](https://github.com/block/buzz/commit/f99532585a0715bac73b4a6361a9b4966bdb5095)) +- Add mobile Huddles voice MVP ([#6056](https://github.com/block/buzz/pull/6056)) ([`8c0f42e187ca82d701251fc849217530178ebace`](https://github.com/block/buzz/commit/8c0f42e187ca82d701251fc849217530178ebace)) +- feat(desktop-messages): keep agents addressed across messages ([#6315](https://github.com/block/buzz/pull/6315)) ([`a2d8be5efa126221c7676f7797555dfb2bf5b0e0`](https://github.com/block/buzz/commit/a2d8be5efa126221c7676f7797555dfb2bf5b0e0)) +- fix(desktop): remove Buzz entity link previews ([#6512](https://github.com/block/buzz/pull/6512)) ([`723affe5d1340896209bf3aca94c7b791bdcf38b`](https://github.com/block/buzz/commit/723affe5d1340896209bf3aca94c7b791bdcf38b)) +- fix(composer): preserve caret when inserting mentions mid-message ([#6531](https://github.com/block/buzz/pull/6531)) ([`074561233eef71df9690ec22c2a9c5e798c297a7`](https://github.com/block/buzz/commit/074561233eef71df9690ec22c2a9c5e798c297a7)) +- chore(deps): update rust crate futures-util to v0.3.33 ([#5448](https://github.com/block/buzz/pull/5448)) ([`d874d67c117e4582cc9549ebe85c942e5e49faf7`](https://github.com/block/buzz/commit/d874d67c117e4582cc9549ebe85c942e5e49faf7)) +- fix(desktop): restore true zoom by scaling the root rem ([#6514](https://github.com/block/buzz/pull/6514)) ([`97b1fee5c3d9ad574196e974b520061fccc47d07`](https://github.com/block/buzz/commit/97b1fee5c3d9ad574196e974b520061fccc47d07)) +- chore(desktop): drop unused ORIGINAL_CONTENT from empty-edit-delete spec ([#6517](https://github.com/block/buzz/pull/6517)) ([`eb484387d5816b6f9155ad3a0be79ede3c3d7ad5`](https://github.com/block/buzz/commit/eb484387d5816b6f9155ad3a0be79ede3c3d7ad5)) +- feat(workflows): clarify workflow setup and activation ([#6470](https://github.com/block/buzz/pull/6470)) ([`0e48ff26915aa32d5f05208847b9aba75f4f19cd`](https://github.com/block/buzz/commit/0e48ff26915aa32d5f05208847b9aba75f4f19cd)) +- perf(desktop): stop the Projects fan refetching on re-entry and running after leave ([#6458](https://github.com/block/buzz/pull/6458)) ([`b85d680fb1e3cc7eef6d31d47598741b35836a2e`](https://github.com/block/buzz/commit/b85d680fb1e3cc7eef6d31d47598741b35836a2e)) +- perf(desktop): keep the member roster off the channel-switch path ([#6456](https://github.com/block/buzz/pull/6456)) ([`b0466ac465336cb773fbf7355ec05f7d61f4a3aa`](https://github.com/block/buzz/commit/b0466ac465336cb773fbf7355ec05f7d61f4a3aa)) +- Clarify huddle message destination ([#6496](https://github.com/block/buzz/pull/6496)) ([`7da8f9abf3245d7ab31ba6e4ad72598b03471f2b`](https://github.com/block/buzz/commit/7da8f9abf3245d7ab31ba6e4ad72598b03471f2b)) +- feat(archive): add observer-frame retention schema and gated DB adapter ([#5719](https://github.com/block/buzz/pull/5719)) ([`fc2ce6728b3b4805040c0a2f2cc5c15f1c1806ce`](https://github.com/block/buzz/commit/fc2ce6728b3b4805040c0a2f2cc5c15f1c1806ce)) +- fix(desktop): restore human barge-in over agent TTS in huddles ([#6431](https://github.com/block/buzz/pull/6431)) ([`6039fed565fd73a07cdddc3143c86733cad91709`](https://github.com/block/buzz/commit/6039fed565fd73a07cdddc3143c86733cad91709)) + +### Other repository changes + +- Remove public relay signing key fallback ([#6729](https://github.com/block/buzz/pull/6729)) ([`ee6ca5fa28bce04dfecb6717de65b08a57f2ac47`](https://github.com/block/buzz/commit/ee6ca5fa28bce04dfecb6717de65b08a57f2ac47)) +- Qualify canonical relay images for staged delivery ([#6781](https://github.com/block/buzz/pull/6781)) ([`f24971033178926153b49d320bd876d15d9cb2bf`](https://github.com/block/buzz/commit/f24971033178926153b49d320bd876d15d9cb2bf)) +- Add database pressure observability ([#6700](https://github.com/block/buzz/pull/6700)) ([`113a33b7e49b7173ee1767c49ef2f49c63803034`](https://github.com/block/buzz/commit/113a33b7e49b7173ee1767c49ef2f49c63803034)) +- Add staging dev relay image workflow ([#6709](https://github.com/block/buzz/pull/6709)) ([`931747c9c42df14d5c23c87fe57e30b995321ae3`](https://github.com/block/buzz/commit/931747c9c42df14d5c23c87fe57e30b995321ae3)) +- Extract community persistence ([#6668](https://github.com/block/buzz/pull/6668)) ([`9d1e4b257657f382d3111ce748f3da8d063b7671`](https://github.com/block/buzz/commit/9d1e4b257657f382d3111ce748f3da8d063b7671)) +- Add inline profile camera capture ([#6680](https://github.com/block/buzz/pull/6680)) ([`9aa332af03b4fb416dd8648b320447617ffd6fa5`](https://github.com/block/buzz/commit/9aa332af03b4fb416dd8648b320447617ffd6fa5)) +- Hide Huddles in mobile agent DMs ([#6676](https://github.com/block/buzz/pull/6676)) ([`822c5ab231bc253d809d2d13da4b381f723dcd25`](https://github.com/block/buzz/commit/822c5ab231bc253d809d2d13da4b381f723dcd25)) +- Centralize replaceable event persistence ([#6660](https://github.com/block/buzz/pull/6660)) ([`8d2d0ff5ad42733e9949442c4b6358d0ba87f9a8`](https://github.com/block/buzz/commit/8d2d0ff5ad42733e9949442c4b6358d0ba87f9a8)) +- fix(ci): prevent poisoned Rust caches ([#6618](https://github.com/block/buzz/pull/6618)) ([`69b1225923c9bd98784e86a6976bbc34a3dc8630`](https://github.com/block/buzz/commit/69b1225923c9bd98784e86a6976bbc34a3dc8630)) +- docs(security): route reports through private advisories ([#6728](https://github.com/block/buzz/pull/6728)) ([`02dc49f0e60f75027e926e33a2d0021f7b4e0cd3`](https://github.com/block/buzz/commit/02dc49f0e60f75027e926e33a2d0021f7b4e0cd3)) +- fix(mobile): join starter channels after accepting invite ([#5915](https://github.com/block/buzz/pull/5915)) ([`6eff84d1271eb1b90e07c5a0673343a76a0753fc`](https://github.com/block/buzz/commit/6eff84d1271eb1b90e07c5a0673343a76a0753fc)) +- Add mobile profile editing ([#6583](https://github.com/block/buzz/pull/6583)) ([`a0298539f7043cd0f2d961030e60cc0fd82970b1`](https://github.com/block/buzz/commit/a0298539f7043cd0f2d961030e60cc0fd82970b1)) +- fix(mobile): recover stale and shuffled messages ([#6691](https://github.com/block/buzz/pull/6691)) ([`01091c15a15d6057d80463dfd828e6e1e4b60743`](https://github.com/block/buzz/commit/01091c15a15d6057d80463dfd828e6e1e4b60743)) +- feat(mobile): browse and join open channels ([#6243](https://github.com/block/buzz/pull/6243)) ([`26f4c3ed304db2c273f0bd4d2746aa9598f38366`](https://github.com/block/buzz/commit/26f4c3ed304db2c273f0bd4d2746aa9598f38366)) +- Polish Huddle participant interactions ([#6312](https://github.com/block/buzz/pull/6312)) ([`e23632941331502c0330e51d407e667bea26ef57`](https://github.com/block/buzz/commit/e23632941331502c0330e51d407e667bea26ef57)) +- Downgrade mobile Huddles to audio protocol v2 ([#6558](https://github.com/block/buzz/pull/6558)) ([`4baccd5394d6166bb68ff03b24e376e322281a59`](https://github.com/block/buzz/commit/4baccd5394d6166bb68ff03b24e376e322281a59)) +- chore(deps): update rust crate async-trait to v0.1.92 ([#6094](https://github.com/block/buzz/pull/6094)) ([`f7942167372501576c9f0f589cf2c166882668bb`](https://github.com/block/buzz/commit/f7942167372501576c9f0f589cf2c166882668bb)) +- chore(deps): update dependency sonner to v2.0.8 ([#6093](https://github.com/block/buzz/pull/6093)) ([`2d93ea095535e42ee3a9933f00a4c0bd5e9e1c67`](https://github.com/block/buzz/commit/2d93ea095535e42ee3a9933f00a4c0bd5e9e1c67)) +- chore(deps): update rust crate http-body-util to v0.1.4 ([#5452](https://github.com/block/buzz/pull/5452)) ([`9390e11c9babeef221aeb0a22cc61a52700d168f`](https://github.com/block/buzz/commit/9390e11c9babeef221aeb0a22cc61a52700d168f)) +- chore(deps): update rust crate http to v1.4.2 ([#5451](https://github.com/block/buzz/pull/5451)) ([`1a0a27d3586b14fb79ec8e162441e610f8548188`](https://github.com/block/buzz/commit/1a0a27d3586b14fb79ec8e162441e610f8548188)) +- chore(deps): update rust crate futures to v0.3.33 ([#5445](https://github.com/block/buzz/pull/5445)) ([`2cef92df676490654f13ebe1de56923b2636123f`](https://github.com/block/buzz/commit/2cef92df676490654f13ebe1de56923b2636123f)) +- chore(deps): update dependency @tauri-apps/api to v2.11.1 ([#5444](https://github.com/block/buzz/pull/5444)) ([`f84511c169cf9a98ac03e9c1acb6bf4d68de5cb8`](https://github.com/block/buzz/commit/f84511c169cf9a98ac03e9c1acb6bf4d68de5cb8)) +- chore(deps): update ubuntu:24.04 docker digest to 561618e ([#5442](https://github.com/block/buzz/pull/5442)) ([`9008a4d1724afbd8dba0fd99e99cd8305b5d2ecb`](https://github.com/block/buzz/commit/9008a4d1724afbd8dba0fd99e99cd8305b5d2ecb)) +- chore(deps): update swatinem/rust-cache digest to 6323deb ([#5441](https://github.com/block/buzz/pull/5441)) ([`694d804b24cd0b97403b3caf159a55ffd1fc3b08`](https://github.com/block/buzz/commit/694d804b24cd0b97403b3caf159a55ffd1fc3b08)) +- fix(deletion): allow IRSA S3 credentials ([#6495](https://github.com/block/buzz/pull/6495)) ([`47526784d5c1967de6b2c5d1ee642bccfefbfab9`](https://github.com/block/buzz/commit/47526784d5c1967de6b2c5d1ee642bccfefbfab9)) +- docs(nips): comprehensive NIP-FI — core + claimable profiles (EDGE/LIFECYCLE/DELEG/CONF) ([#5946](https://github.com/block/buzz/pull/5946)) ([`d97780b4777f2fe3430b4e30a7d47fc6837ee059`](https://github.com/block/buzz/commit/d97780b4777f2fe3430b4e30a7d47fc6837ee059)) +- fix(benchmarks): wait for scripted event delivery ([#6487](https://github.com/block/buzz/pull/6487)) ([`025425591ed67518a63870316f1473ffd02dd520`](https://github.com/block/buzz/commit/025425591ed67518a63870316f1473ffd02dd520)) +- Polish mobile channel navigation and message sends ([#6488](https://github.com/block/buzz/pull/6488)) ([`aeb741fd31044ec560d953b0986dec2e7e93e2c6`](https://github.com/block/buzz/commit/aeb741fd31044ec560d953b0986dec2e7e93e2c6)) + +[Compare desktop-v0.5.18...desktop-v0.5.19](https://github.com/block/buzz/compare/desktop-v0.5.18...desktop-v0.5.19) + +## v0.5.18 + +### Desktop and shared changes + +- fix(desktop): simplify duplicate agent provenance ([#6401](https://github.com/block/buzz/pull/6401)) ([`aea0ef8df9fc24d9aa8bf5c761ab2910026a601b`](https://github.com/block/buzz/commit/aea0ef8df9fc24d9aa8bf5c761ab2910026a601b)) +- fix(desktop): sender names in notifications + macOS click-through routing ([#6427](https://github.com/block/buzz/pull/6427)) ([`4e3c9e619c93dd26677b392ad1f8cf0d12c8f855`](https://github.com/block/buzz/commit/4e3c9e619c93dd26677b392ad1f8cf0d12c8f855)) +- polish(desktop): finish Projects navigation and context chrome ([#6429](https://github.com/block/buzz/pull/6429)) ([`9b32e055fed45864e1982f3d99c5402ba35cd8a6`](https://github.com/block/buzz/commit/9b32e055fed45864e1982f3d99c5402ba35cd8a6)) +- fix(desktop): clarify add agents channel action ([#6374](https://github.com/block/buzz/pull/6374)) ([`9891e64f6b8358d78aa85f2ba248310d58b51ec0`](https://github.com/block/buzz/commit/9891e64f6b8358d78aa85f2ba248310d58b51ec0)) +- feat(desktop-messages): show compact Buzz link metadata ([#6252](https://github.com/block/buzz/pull/6252)) ([`de8a2741c7598c27e0d27cd4562d76b947934e2f`](https://github.com/block/buzz/commit/de8a2741c7598c27e0d27cd4562d76b947934e2f)) +- feat(workflows): reply in-thread from send_message action ([#6178](https://github.com/block/buzz/pull/6178)) ([`c6e3fe7dfa751096d8c4083aaf15d6f6af296572`](https://github.com/block/buzz/commit/c6e3fe7dfa751096d8c4083aaf15d6f6af296572)) +- perf(desktop): split discover_acp_providers into cheap and forced paths ([#6330](https://github.com/block/buzz/pull/6330)) ([`c63ac746cd4622e043574c305ff54021b07b847b`](https://github.com/block/buzz/commit/c63ac746cd4622e043574c305ff54021b07b847b)) +- fix(desktop): restore recent channel sorting ([#6402](https://github.com/block/buzz/pull/6402)) ([`569308c23c9c2bf620dd3a9a5e4baecbcfa22e16`](https://github.com/block/buzz/commit/569308c23c9c2bf620dd3a9a5e4baecbcfa22e16)) +- fix(desktop): isolate main timeline stacking context from focus drawer ([#6398](https://github.com/block/buzz/pull/6398)) ([`b298a175c4b9da1638f84c1f287e42d16a690a61`](https://github.com/block/buzz/commit/b298a175c4b9da1638f84c1f287e42d16a690a61)) +- fix(desktop): make reconnect repair lossless ([#6415](https://github.com/block/buzz/pull/6415)) ([`06e8be9098f099ff9036cfbe637390d5ac982809`](https://github.com/block/buzz/commit/06e8be9098f099ff9036cfbe637390d5ac982809)) +- perf(desktop): resolve references without directory scans ([#6328](https://github.com/block/buzz/pull/6328)) ([`54bbe7305b9ec82a6ac03f84ff5887f77858c0b6`](https://github.com/block/buzz/commit/54bbe7305b9ec82a6ac03f84ff5887f77858c0b6)) +- feat(llm): stamp thinking effort on call-completed log line ([#6424](https://github.com/block/buzz/pull/6424)) ([`b728a2af3197db52e2d847b095f27209f99dc977`](https://github.com/block/buzz/commit/b728a2af3197db52e2d847b095f27209f99dc977)) +- Fix cross-owner relay agent mentions in owner-only builds ([#6338](https://github.com/block/buzz/pull/6338)) ([`ee0c7076af83fe9e2aafdc1baf4113ad988f53bd`](https://github.com/block/buzz/commit/ee0c7076af83fe9e2aafdc1baf4113ad988f53bd)) +- feat(workflows): add workflow editor ([#6248](https://github.com/block/buzz/pull/6248)) ([`1934e83bf5a5d8cd00f0cf28b558547b8d0dffb0`](https://github.com/block/buzz/commit/1934e83bf5a5d8cd00f0cf28b558547b8d0dffb0)) +- fix(desktop): preserve huddle speech boundaries ([#6397](https://github.com/block/buzz/pull/6397)) ([`7ebe3ea699a24b2f95573b88db8f8fe5f1187eb4`](https://github.com/block/buzz/commit/7ebe3ea699a24b2f95573b88db8f8fe5f1187eb4)) +- test(desktop): use a wordlist-safe separator in passphrase word-count test ([#6356](https://github.com/block/buzz/pull/6356)) ([`886cef7f723a539c4026d12e6a0605062bf2208b`](https://github.com/block/buzz/commit/886cef7f723a539c4026d12e6a0605062bf2208b)) +- fix(models): curate Databricks alias-aware labels for 5 missing endpoints ([#6360](https://github.com/block/buzz/pull/6360)) ([`2ce8df8533d8c8598ab3d7a2faa797f8b5ee2eea`](https://github.com/block/buzz/commit/2ce8df8533d8c8598ab3d7a2faa797f8b5ee2eea)) +- feat(desktop): refine context-aware Projects collaboration ([#6396](https://github.com/block/buzz/pull/6396)) ([`3c228b1082a93aca302c7b6a67ec274c51ed5eaf`](https://github.com/block/buzz/commit/3c228b1082a93aca302c7b6a67ec274c51ed5eaf)) +- fix(desktop): distinguish duplicate agent devices ([#6337](https://github.com/block/buzz/pull/6337)) ([`2e7583bf5ad5926ca32367af9954bc79d108e42d`](https://github.com/block/buzz/commit/2e7583bf5ad5926ca32367af9954bc79d108e42d)) +- feat(desktop): close Buzz window with Cmd+W ([#6314](https://github.com/block/buzz/pull/6314)) ([`e5d1dfef7bf24ad527c9c8c1785b613abad574f7`](https://github.com/block/buzz/commit/e5d1dfef7bf24ad527c9c8c1785b613abad574f7)) +- feat(desktop): make Projects workspaces selectable ([#6368](https://github.com/block/buzz/pull/6368)) ([`2b7be9340dd0785bd04795d55e004a6dfedd4998`](https://github.com/block/buzz/commit/2b7be9340dd0785bd04795d55e004a6dfedd4998)) +- feat(desktop): make the Projects overview follow the selected section ([#6335](https://github.com/block/buzz/pull/6335)) ([`f88cda9eb886500ec7d205e1d265ac6f654aa433`](https://github.com/block/buzz/commit/f88cda9eb886500ec7d205e1d265ac6f654aa433)) +- refactor(desktop): coordinate TTS playback ([#6341](https://github.com/block/buzz/pull/6341)) ([`09718fbb60c1acd5a4c1aff1bd91248008977129`](https://github.com/block/buzz/commit/09718fbb60c1acd5a4c1aff1bd91248008977129)) +- fix(desktop): show complete repository trees ([#5102](https://github.com/block/buzz/pull/5102)) ([`9c2f05346fdf3f058e4c579f6eea03dbe65fcca4`](https://github.com/block/buzz/commit/9c2f05346fdf3f058e4c579f6eea03dbe65fcca4)) +- Add appearance preference previews ([#6193](https://github.com/block/buzz/pull/6193)) ([`9a1e861ab8507ee28e5f03010b7f36d1b74ec919`](https://github.com/block/buzz/commit/9a1e861ab8507ee28e5f03010b7f36d1b74ec919)) +- fix(desktop): restore emoji recents ([#6263](https://github.com/block/buzz/pull/6263)) ([`f96f1883c5ad94825d43a856e5d25e307a0540cb`](https://github.com/block/buzz/commit/f96f1883c5ad94825d43a856e5d25e307a0540cb)) +- perf(desktop): move five hot renderer paths from JS into Rust ([#6024](https://github.com/block/buzz/pull/6024)) ([`bbd20fae75ecc3bd7a83cc12a65379fac22a2b79`](https://github.com/block/buzz/commit/bbd20fae75ecc3bd7a83cc12a65379fac22a2b79)) +- fix(media): accept portrait video resolutions ([#6058](https://github.com/block/buzz/pull/6058)) ([`196d62f97c21d053ddf8715d75ef57e92bd0051f`](https://github.com/block/buzz/commit/196d62f97c21d053ddf8715d75ef57e92bd0051f)) +- fix(desktop): hide archived channels from #/Tab autocomplete ([#6156](https://github.com/block/buzz/pull/6156)) ([`fe7c6808e7430d185498178e07e58e378d2e4c7d`](https://github.com/block/buzz/commit/fe7c6808e7430d185498178e07e58e378d2e4c7d)) +- fix(desktop): morph the drawer panel icon instead of sliding it ([#6306](https://github.com/block/buzz/pull/6306)) ([`e5a6e2022fb59c3928b054bc8d51874465fbe3df`](https://github.com/block/buzz/commit/e5a6e2022fb59c3928b054bc8d51874465fbe3df)) +- feat(desktop): refine repository-aware project workspaces ([#6003](https://github.com/block/buzz/pull/6003)) ([`87f8ff82ae5d3fdd99831c62a869b39138e65a57`](https://github.com/block/buzz/commit/87f8ff82ae5d3fdd99831c62a869b39138e65a57)) +- perf(desktop): parallelize relay agent directory rebuild ([#6258](https://github.com/block/buzz/pull/6258)) ([`a362fecc2389955f942c9581bdfeba379ab115b3`](https://github.com/block/buzz/commit/a362fecc2389955f942c9581bdfeba379ab115b3)) +- fix(desktop): exclude archived agents from nest, order regeneration ([#5905](https://github.com/block/buzz/pull/5905)) ([`121e4b3ce7acab6ac310257f444997f58a97cb2e`](https://github.com/block/buzz/commit/121e4b3ce7acab6ac310257f444997f58a97cb2e)) +- Add font size and conversation density preferences ([#5644](https://github.com/block/buzz/pull/5644)) ([`7e2651791d598a3938ef4560a41801223fb9b2c9`](https://github.com/block/buzz/commit/7e2651791d598a3938ef4560a41801223fb9b2c9)) +- fix(desktop): emit camelCase config-write payload fields ([#6062](https://github.com/block/buzz/pull/6062)) ([`6e8d078ffe1ab27b8dde6bb697551b7d2d1a85b5`](https://github.com/block/buzz/commit/6e8d078ffe1ab27b8dde6bb697551b7d2d1a85b5)) +- fix(desktop): downscale large avatars for agent-share PNG body ([#6260](https://github.com/block/buzz/pull/6260)) ([`e2ade93f02f6d1b4db23e0c442a2c65608e54d36`](https://github.com/block/buzz/commit/e2ade93f02f6d1b4db23e0c442a2c65608e54d36)) +- fix(desktop): preserve early relay auth challenges ([#3320](https://github.com/block/buzz/pull/3320)) ([`6ea7a2b2211438359b227a9991cf8ccad2927fe2`](https://github.com/block/buzz/commit/6ea7a2b2211438359b227a9991cf8ccad2927fe2)) +- feat(managed-agents): close five Claude Code agent-config gaps ([#4557](https://github.com/block/buzz/pull/4557)) ([`50a71137e6f1c56f66e2f7348a917b2d2a1798f0`](https://github.com/block/buzz/commit/50a71137e6f1c56f66e2f7348a917b2d2a1798f0)) +- fix(shared-ui): delay hover disclosures by default ([#5821](https://github.com/block/buzz/pull/5821)) ([`d7e8fdb10ca5e055b7af6d22f67d9a8f42cec8ed`](https://github.com/block/buzz/commit/d7e8fdb10ca5e055b7af6d22f67d9a8f42cec8ed)) +- fix(desktop-chrome): preserve balanced layout when sidebar collapses ([#6000](https://github.com/block/buzz/pull/6000)) ([`c442a90a176845e3989436f2bb24eb6d0ca79d47`](https://github.com/block/buzz/commit/c442a90a176845e3989436f2bb24eb6d0ca79d47)) + +### Other repository changes + +- test(benchmarks): expand Buzz-native dataset ([#6448](https://github.com/block/buzz/pull/6448)) ([`b56a52ca11296b86ee41c41278a1169f92f245b6`](https://github.com/block/buzz/commit/b56a52ca11296b86ee41c41278a1169f92f245b6)) +- docs: clarify two-layer moderation ownership ([#6481](https://github.com/block/buzz/pull/6481)) ([`8740a1fa94dd14a3eb5cd2a570b0be2c4a68cbfe`](https://github.com/block/buzz/commit/8740a1fa94dd14a3eb5cd2a570b0be2c4a68cbfe)) +- Fix mobile thread tail and iOS channel header ([#6399](https://github.com/block/buzz/pull/6399)) ([`ffb12d3b05fe1ebd62006dbcd2f079be4e210b70`](https://github.com/block/buzz/commit/ffb12d3b05fe1ebd62006dbcd2f079be4e210b70)) +- chore(deps): pin earshot below 1.2.0 pending a VAD threshold re-pick ([#6392](https://github.com/block/buzz/pull/6392)) ([`2edacde4d4c01490834725774aa878dbc373c41d`](https://github.com/block/buzz/commit/2edacde4d4c01490834725774aa878dbc373c41d)) +- Repair stale large channel roster snapshots ([#6251](https://github.com/block/buzz/pull/6251)) ([`24ec6a468ec9d0d425ee58fbfc4d416412c446ad`](https://github.com/block/buzz/commit/24ec6a468ec9d0d425ee58fbfc4d416412c446ad)) +- fix(hooks): scope pre-push lanes to branch merge-base diff ([#6423](https://github.com/block/buzz/pull/6423)) ([`cd0d33f08507d07c8e8b8511bba92290c046ef03`](https://github.com/block/buzz/commit/cd0d33f08507d07c8e8b8511bba92290c046ef03)) +- Enforce a three-day dependency cooldown ([#6426](https://github.com/block/buzz/pull/6426)) ([`3ee465e12b815a191d902856440e2f3348bda506`](https://github.com/block/buzz/commit/3ee465e12b815a191d902856440e2f3348bda506)) +- feat(cli): accept Buzz message links for thread reads ([#6359](https://github.com/block/buzz/pull/6359)) ([`84c095f8bea14b55373e2d867100abe37aa6061e`](https://github.com/block/buzz/commit/84c095f8bea14b55373e2d867100abe37aa6061e)) +- fix(acp): guard against unrequested public relay skills ([#6394](https://github.com/block/buzz/pull/6394)) ([`d274a6e94928d64e27648f75320ab8af961396da`](https://github.com/block/buzz/commit/d274a6e94928d64e27648f75320ab8af961396da)) +- refactor(prompt): simplify Buzz agent guidance ([#6340](https://github.com/block/buzz/pull/6340)) ([`2a236e413723f207c2f6c1e8921fab4f071d0445`](https://github.com/block/buzz/commit/2a236e413723f207c2f6c1e8921fab4f071d0445)) +- Add Buzz-native collaboration benchmarks ([#6264](https://github.com/block/buzz/pull/6264)) ([`a9640c7cc4d55b0a0ac987aab4af02a204009d19`](https://github.com/block/buzz/commit/a9640c7cc4d55b0a0ac987aab4af02a204009d19)) +- Polish mobile timeline and emoji interactions ([#6297](https://github.com/block/buzz/pull/6297)) ([`da818eddc2f470c006a1073c8c5452f8a989f272`](https://github.com/block/buzz/commit/da818eddc2f470c006a1073c8c5452f8a989f272)) +- chore: serialize mobile pre-push checks ([#6322](https://github.com/block/buzz/pull/6322)) ([`81567b76a5d164b052c4e8526f453cf7a6ef43dc`](https://github.com/block/buzz/commit/81567b76a5d164b052c4e8526f453cf7a6ef43dc)) +- fix(buzz-acp): loosen workspace-scan guardrail to allow named paths ([#6261](https://github.com/block/buzz/pull/6261)) ([`934f3325c3fdaa3a6f23134b74518139aac8ca3f`](https://github.com/block/buzz/commit/934f3325c3fdaa3a6f23134b74518139aac8ca3f)) +- fix(buzz-dev-mcp): expand leading ~ in read_file/str_replace paths ([#6271](https://github.com/block/buzz/pull/6271)) ([`7f69b13b4586acedf6d898edf1be2a6babea3626`](https://github.com/block/buzz/commit/7f69b13b4586acedf6d898edf1be2a6babea3626)) +- Unify mobile channel details ([#6113](https://github.com/block/buzz/pull/6113)) ([`a567dfc2df870878dcf079550502a09a89cc8091`](https://github.com/block/buzz/commit/a567dfc2df870878dcf079550502a09a89cc8091)) +- Revert "fix(acp): gate relay-signed workflow messages on their attributed author" ([#6311](https://github.com/block/buzz/pull/6311)) ([`08eb46ef3c0894baa7e48d9229f45349751a4a57`](https://github.com/block/buzz/commit/08eb46ef3c0894baa7e48d9229f45349751a4a57)) +- Fix mobile Activity thread navigation ([#5850](https://github.com/block/buzz/pull/5850)) ([`93114c9c65138397de39729fde0a816eb9f314ab`](https://github.com/block/buzz/commit/93114c9c65138397de39729fde0a816eb9f314ab)) +- Refine the mobile emoji picker ([#5853](https://github.com/block/buzz/pull/5853)) ([`359fe646758d253ee94bf054a87904efd1dce7d1`](https://github.com/block/buzz/commit/359fe646758d253ee94bf054a87904efd1dce7d1)) +- Polish mobile message actions ([#5873](https://github.com/block/buzz/pull/5873)) ([`78267b0c3a75840d035ff0cc9ad1984def773886`](https://github.com/block/buzz/commit/78267b0c3a75840d035ff0cc9ad1984def773886)) +- Refine mobile pairing confirmation ([#6018](https://github.com/block/buzz/pull/6018)) ([`40f1dac6913d04c87d72610a69ed53bd12377b84`](https://github.com/block/buzz/commit/40f1dac6913d04c87d72610a69ed53bd12377b84)) +- chore(scripts): add buzz-adopt-prod-agents.sh ([#6250](https://github.com/block/buzz/pull/6250)) ([`4f9727a4b3d76389f862faa15241e16e2dd36108`](https://github.com/block/buzz/commit/4f9727a4b3d76389f862faa15241e16e2dd36108)) +- chore(hooks): keep mobile analysis out of pre-commit ([#6236](https://github.com/block/buzz/pull/6236)) ([`b74700daafa823e56c60b4e6470740ab28330888`](https://github.com/block/buzz/commit/b74700daafa823e56c60b4e6470740ab28330888)) +- Polish mobile timeline navigation ([#5874](https://github.com/block/buzz/pull/5874)) ([`417eea2230c1864e8c77f6440dbcfa109bfb63f6`](https://github.com/block/buzz/commit/417eea2230c1864e8c77f6440dbcfa109bfb63f6)) +- fix(prompt): simplify pickup follow-through ([#6186](https://github.com/block/buzz/pull/6186)) ([`d2cfd377e27dab8fdef0236dd8e92c89efbae829`](https://github.com/block/buzz/commit/d2cfd377e27dab8fdef0236dd8e92c89efbae829)) +- fix(mcp): scope todo usage ([#6216](https://github.com/block/buzz/pull/6216)) ([`5694e78def8b6ea674e101c1c988a5f17c9baf9d`](https://github.com/block/buzz/commit/5694e78def8b6ea674e101c1c988a5f17c9baf9d)) + +[Compare desktop-v0.5.17...desktop-v0.5.18](https://github.com/block/buzz/compare/desktop-v0.5.17...desktop-v0.5.18) + +## v0.5.17 + +### Desktop and shared changes + +- fix(desktop): bound remote agent mention authorization ([#6224](https://github.com/block/buzz/pull/6224)) ([`3fdf289b78c40f80abce86575c25b5ed6361d82c`](https://github.com/block/buzz/commit/3fdf289b78c40f80abce86575c25b5ed6361d82c)) +- fix(desktop): bind presence retry timers ([#6213](https://github.com/block/buzz/pull/6213)) ([`081910424a5b6f01b283ad632b0718240c6b3cbf`](https://github.com/block/buzz/commit/081910424a5b6f01b283ad632b0718240c6b3cbf)) +- ci: make file-size policy a first-class gate ([#6187](https://github.com/block/buzz/pull/6187)) ([`6d45f98665004d314468d98e50084996f4046cdf`](https://github.com/block/buzz/commit/6d45f98665004d314468d98e50084996f4046cdf)) +- fix(desktop): eliminate mounted-view CPU burn — compositor-safe shimmer, observer append fast path, poll-tick disk reads ([#6198](https://github.com/block/buzz/pull/6198)) ([`f0234f1449ab8a6d52d45a9e1ec19cc675b40fe9`](https://github.com/block/buzz/commit/f0234f1449ab8a6d52d45a9e1ec19cc675b40fe9)) + +### Other repository changes + +- fix: bump h2 for RUSTSEC-2026-0258 ([#6222](https://github.com/block/buzz/pull/6222)) ([`cc8a8b0dcbf5c01311b2ac7e1827ff3e582299f3`](https://github.com/block/buzz/commit/cc8a8b0dcbf5c01311b2ac7e1827ff3e582299f3)) + +[Compare desktop-v0.5.16...desktop-v0.5.17](https://github.com/block/buzz/compare/desktop-v0.5.16...desktop-v0.5.17) + +## v0.5.16 + +### Desktop and shared changes + +- fix(desktop): restore release agent mentions ([#6182](https://github.com/block/buzz/pull/6182)) ([`ee992ff0822f44d1c308822f116cb9d26f9a3386`](https://github.com/block/buzz/commit/ee992ff0822f44d1c308822f116cb9d26f9a3386)) +- test(desktop): cover exact workflow batch limit ([#6168](https://github.com/block/buzz/pull/6168)) ([`f8692fa9b52ddcfeb4b95fb4862109983509f131`](https://github.com/block/buzz/commit/f8692fa9b52ddcfeb4b95fb4862109983509f131)) + +### Other repository changes + +- None + +[Compare desktop-v0.5.15...desktop-v0.5.16](https://github.com/block/buzz/compare/desktop-v0.5.15...desktop-v0.5.16) + +## v0.5.15 + +### Desktop and shared changes + +- Preserve managed agent mentions during relay errors ([#6167](https://github.com/block/buzz/pull/6167)) ([`7f61cf431af1d8f0480a0baf525881a12f2be7f2`](https://github.com/block/buzz/commit/7f61cf431af1d8f0480a0baf525881a12f2be7f2)) +- fix(workflows): preserve multi-channel listing semantics ([#6009](https://github.com/block/buzz/pull/6009)) ([`f7a01bda7b1bf95cdbc9dc21bb69970955b14ecc`](https://github.com/block/buzz/commit/f7a01bda7b1bf95cdbc9dc21bb69970955b14ecc)) +- fix(desktop): align preview sidebar row styling ([#6163](https://github.com/block/buzz/pull/6163)) ([`439c03749182495ee09f85a73423dd17e7ccda61`](https://github.com/block/buzz/commit/439c03749182495ee09f85a73423dd17e7ccda61)) +- fix(desktop): repair dropped team membership links at boot and on edit ([#5904](https://github.com/block/buzz/pull/5904)) ([`57feca2f20bb3434d70ce770b9ed98b1c1472332`](https://github.com/block/buzz/commit/57feca2f20bb3434d70ce770b9ed98b1c1472332)) +- Rename Bumble agent to Pollen ([#5864](https://github.com/block/buzz/pull/5864)) ([`076081bfc646f8fdf8ff9dc6e00843b5bdae0ad0`](https://github.com/block/buzz/commit/076081bfc646f8fdf8ff9dc6e00843b5bdae0ad0)) +- fix(desktop): resolve agent profiles through one archive-aware selector ([#5706](https://github.com/block/buzz/pull/5706)) ([`d12d82577818a95babac4d30cf242c46124feb5e`](https://github.com/block/buzz/commit/d12d82577818a95babac4d30cf242c46124feb5e)) +- feat(workflows): add responsive library card actions ([#6008](https://github.com/block/buzz/pull/6008)) ([`edc4a09aaa41c29e2495a28247c895febaf6587d`](https://github.com/block/buzz/commit/edc4a09aaa41c29e2495a28247c895febaf6587d)) +- fix(desktop): enforce shared agent access across devices ([#6086](https://github.com/block/buzz/pull/6086)) ([`f716eef437dcf91994518b8df7f581e86bb51748`](https://github.com/block/buzz/commit/f716eef437dcf91994518b8df7f581e86bb51748)) +- feat(model-capabilities): drive model capabilities and labels from one manifest ([#5597](https://github.com/block/buzz/pull/5597)) ([`1b7e5ac1be641f5ecc2b2a0ba37a1dc400e073c9`](https://github.com/block/buzz/commit/1b7e5ac1be641f5ecc2b2a0ba37a1dc400e073c9)) +- fix(desktop): hide the offcanvas-collapsed sidebar so it stops painting over the community rail ([#5947](https://github.com/block/buzz/pull/5947)) ([`78cbffeb64c01220e705adf0aa9690fdbd0d7a37`](https://github.com/block/buzz/commit/78cbffeb64c01220e705adf0aa9690fdbd0d7a37)) + +### Other repository changes + +- Remove Startup Recovery section in base prompt ([#6161](https://github.com/block/buzz/pull/6161)) ([`f64899e5d17df4c928ea415a5f42052120edaecb`](https://github.com/block/buzz/commit/f64899e5d17df4c928ea415a5f42052120edaecb)) +- fix(cli): keep project replacement timestamps at or after wall clock ([#5666](https://github.com/block/buzz/pull/5666)) ([`a282e0643fe0f14ace4d9b57ead99d0635e38995`](https://github.com/block/buzz/commit/a282e0643fe0f14ace4d9b57ead99d0635e38995)) +- Remove GitHub security advisory commitment ([#6144](https://github.com/block/buzz/pull/6144)) ([`85bacea52b8359999f22c6ac07207a130809c488`](https://github.com/block/buzz/commit/85bacea52b8359999f22c6ac07207a130809c488)) +- fix(acp): gate relay-signed workflow messages on their attributed author ([#6129](https://github.com/block/buzz/pull/6129)) ([`54f11219efe6b2617ba74d1ef8701fb5413956d8`](https://github.com/block/buzz/commit/54f11219efe6b2617ba74d1ef8701fb5413956d8)) +- fix(acp): replace Goose native system prompt ([#5964](https://github.com/block/buzz/pull/5964)) ([`5b3f0375a26843d73b29b55cc2f3c313bd857ccb`](https://github.com/block/buzz/commit/5b3f0375a26843d73b29b55cc2f3c313bd857ccb)) +- docs: refresh agent development guidance ([#6049](https://github.com/block/buzz/pull/6049)) ([`f956e6fe06a76e50cbd8fba1a162482e752e7f1a`](https://github.com/block/buzz/commit/f956e6fe06a76e50cbd8fba1a162482e752e7f1a)) +- feat(mobile): require device authentication for identity export ([#5116](https://github.com/block/buzz/pull/5116)) ([`d8281b9c93395f15d55091b131bb2747a0a3da8a`](https://github.com/block/buzz/commit/d8281b9c93395f15d55091b131bb2747a0a3da8a)) +- Polish mobile message threads and composer ([#5645](https://github.com/block/buzz/pull/5645)) ([`69107dc3bfecbb80cc5f5b8bb6a7647ad054ce57`](https://github.com/block/buzz/commit/69107dc3bfecbb80cc5f5b8bb6a7647ad054ce57)) + +[Compare desktop-v0.5.14...desktop-v0.5.15](https://github.com/block/buzz/compare/desktop-v0.5.14...desktop-v0.5.15) + +## v0.5.14 + +### Desktop and shared changes + +- None + +### Other repository changes + +- ci(release): remove desktop smoke gate ([#5914](https://github.com/block/buzz/pull/5914)) ([`1b3dbcaaea882eeea90359c1db02e306d2f4f50a`](https://github.com/block/buzz/commit/1b3dbcaaea882eeea90359c1db02e306d2f4f50a)) + +[Compare desktop-v0.5.13...desktop-v0.5.14](https://github.com/block/buzz/compare/desktop-v0.5.13...desktop-v0.5.14) + +## v0.5.13 + +### Desktop and shared changes + +- fix(desktop): restore the agent trading-card mint button ([#5900](https://github.com/block/buzz/pull/5900)) ([`263c9bf76c18f0cde6cec9fb43d22f8895319380`](https://github.com/block/buzz/commit/263c9bf76c18f0cde6cec9fb43d22f8895319380)) +- Projects v3: unify sharing, discussions, and issue ownership ([#5792](https://github.com/block/buzz/pull/5792)) ([`122a8b8988869f0b1a7c056a76f7d16bfb0f6fdd`](https://github.com/block/buzz/commit/122a8b8988869f0b1a7c056a76f7d16bfb0f6fdd)) + +### Other repository changes + +- fix(ci): read Playwright version without nested shell quoting ([#5910](https://github.com/block/buzz/pull/5910)) ([`09768100ec3420f0aa7cd278bd00fe0baab5de8d`](https://github.com/block/buzz/commit/09768100ec3420f0aa7cd278bd00fe0baab5de8d)) +- fix(mobile): unwrap batched observer telemetry ([#5805](https://github.com/block/buzz/pull/5805)) ([`0bb7c60f824a05ac4d8c8569ee1e74d200069b45`](https://github.com/block/buzz/commit/0bb7c60f824a05ac4d8c8569ee1e74d200069b45)) + +[Compare desktop-v0.5.12...desktop-v0.5.13](https://github.com/block/buzz/compare/desktop-v0.5.12...desktop-v0.5.13) + +## v0.5.12 + +### Desktop and shared changes + +- perf(desktop): update active turns incrementally ([#5897](https://github.com/block/buzz/pull/5897)) ([`757779bb1ef22cc4a1c233344baa0946d907e5a6`](https://github.com/block/buzz/commit/757779bb1ef22cc4a1c233344baa0946d907e5a6)) +- fix(link-previews): send while previews finish in background ([#5697](https://github.com/block/buzz/pull/5697)) ([`f086eb6544fd9f450832ea22de74b5418d1f85a1`](https://github.com/block/buzz/commit/f086eb6544fd9f450832ea22de74b5418d1f85a1)) +- fix(desktop): cut steady-state relay traffic from polls and read-state echo ([#5879](https://github.com/block/buzz/pull/5879)) ([`01f76ec9719ebdacce3f6e67d545692a90e10b06`](https://github.com/block/buzz/commit/01f76ec9719ebdacce3f6e67d545692a90e10b06)) +- fix(desktop): support channel message path links ([#5889](https://github.com/block/buzz/pull/5889)) ([`207154706c87cbf207f2a2abbc096d17737b091a`](https://github.com/block/buzz/commit/207154706c87cbf207f2a2abbc096d17737b091a)) +- test(desktop): await channel E2E bridge readiness ([#5886](https://github.com/block/buzz/pull/5886)) ([`dbee2914ad806c7f038389eb95c7513f5df4e0d2`](https://github.com/block/buzz/commit/dbee2914ad806c7f038389eb95c7513f5df4e0d2)) +- fix(link-preview): refetch a link when it re-enters the composer ([#5510](https://github.com/block/buzz/pull/5510)) ([`fd0ab47a1b5526d7496b5a6d731f3c8d7e4dbe9f`](https://github.com/block/buzz/commit/fd0ab47a1b5526d7496b5a6d731f3c8d7e4dbe9f)) +- feat(desktop-messages): render compact Buzz permalink chips ([#5638](https://github.com/block/buzz/pull/5638)) ([`5acb930821ba56b5f4d1b487bffd237dd3ebe76a`](https://github.com/block/buzz/commit/5acb930821ba56b5f4d1b487bffd237dd3ebe76a)) +- Fix video comment effect wrapping ([#5748](https://github.com/block/buzz/pull/5748)) ([`17d2147ecadaef5891da598cf8f5257f7787992b`](https://github.com/block/buzz/commit/17d2147ecadaef5891da598cf8f5257f7787992b)) +- feat(desktop): one relative date ladder across chat and the Inbox ([#3769](https://github.com/block/buzz/pull/3769)) ([`caa64b5e8f584a740e331887a5dd1cda32bcb958`](https://github.com/block/buzz/commit/caa64b5e8f584a740e331887a5dd1cda32bcb958)) +- fix(desktop): amortize observer journal eviction with a low-water mark ([#5808](https://github.com/block/buzz/pull/5808)) ([`17977814d38a841ed475b318a5dfd4bc8405d049`](https://github.com/block/buzz/commit/17977814d38a841ed475b318a5dfd4bc8405d049)) +- Unify agent profile content ([#5788](https://github.com/block/buzz/pull/5788)) ([`34a7f2fb917cff8afd86bb59f6abcfa4cb8981d5`](https://github.com/block/buzz/commit/34a7f2fb917cff8afd86bb59f6abcfa4cb8981d5)) +- Standardize settings section layout ([#5855](https://github.com/block/buzz/pull/5855)) ([`43e53fc3491ecbd1def14ede3fb8c9e2d44e84d8`](https://github.com/block/buzz/commit/43e53fc3491ecbd1def14ede3fb8c9e2d44e84d8)) +- fix(desktop): share one timer across same-interval useNow consumers ([#5861](https://github.com/block/buzz/pull/5861)) ([`8b8445f5ef3338c58825194ebc008b98111a0962`](https://github.com/block/buzz/commit/8b8445f5ef3338c58825194ebc008b98111a0962)) +- Clarify immediate spoken huddle replies ([#5863](https://github.com/block/buzz/pull/5863)) ([`ea0960f8d0221de18d7d3504607594035519f33f`](https://github.com/block/buzz/commit/ea0960f8d0221de18d7d3504607594035519f33f)) +- Scope desktop presence subscriptions to active demand ([#5830](https://github.com/block/buzz/pull/5830)) ([`df9e773a13f17a270fd6531fc74948b8059d58c3`](https://github.com/block/buzz/commit/df9e773a13f17a270fd6531fc74948b8059d58c3)) +- fix(huddle): stop 20 Hz speaker-level churn from re-rendering the whole app ([#5825](https://github.com/block/buzz/pull/5825)) ([`57435628961d25bd24689cee82f1373e7a074040`](https://github.com/block/buzz/commit/57435628961d25bd24689cee82f1373e7a074040)) +- fix(desktop): match compact link preview thumbnail corners to card shell ([#5711](https://github.com/block/buzz/pull/5711)) ([`eedcd886a04833a78c18f49931abe68792518f97`](https://github.com/block/buzz/commit/eedcd886a04833a78c18f49931abe68792518f97)) +- feat(huddle): cut voice-turn time-to-first-audio from ~1.0 s to ~0.35 s (env-gated latency levers) ([#5671](https://github.com/block/buzz/pull/5671)) ([`068a83b09712703c71923fb22601dffd96554c91`](https://github.com/block/buzz/commit/068a83b09712703c71923fb22601dffd96554c91)) +- Speed up initial direct messages ([#5658](https://github.com/block/buzz/pull/5658)) ([`c8da06c5e9e92b2441927cdb4619318b4328c2bd`](https://github.com/block/buzz/commit/c8da06c5e9e92b2441927cdb4619318b4328c2bd)) +- Polish glass Huddle tray behavior ([#5590](https://github.com/block/buzz/pull/5590)) ([`0571f5455b1b2aeea7334082f0df9d1f19b22f7d`](https://github.com/block/buzz/commit/0571f5455b1b2aeea7334082f0df9d1f19b22f7d)) +- test: add deterministic desktop release smoke ([#5699](https://github.com/block/buzz/pull/5699)) ([`76f114a252866f17003520db0a11a8b6f5b3da0c`](https://github.com/block/buzz/commit/76f114a252866f17003520db0a11a8b6f5b3da0c)) +- feat(desktop): add Inbox message delete action ([#5779](https://github.com/block/buzz/pull/5779)) ([`514195b1d58d1a8679bfc8c63a2b410b6a227489`](https://github.com/block/buzz/commit/514195b1d58d1a8679bfc8c63a2b410b6a227489)) +- fix(desktop): enforce agent mention authorization at send boundaries ([#5681](https://github.com/block/buzz/pull/5681)) ([`bcf353c969b91991c22d0715aa2d7a618d630e1d`](https://github.com/block/buzz/commit/bcf353c969b91991c22d0715aa2d7a618d630e1d)) +- fix(desktop): route compact preview geometry fixture through media proxy ([#5799](https://github.com/block/buzz/pull/5799)) ([`b269e8df7e6ed3e1910b6f6eeef08fa4b89778bd`](https://github.com/block/buzz/commit/b269e8df7e6ed3e1910b6f6eeef08fa4b89778bd)) +- Make workflow run history authoritative in Desktop ([#5780](https://github.com/block/buzz/pull/5780)) ([`2693e0db1fc4980a551c2492031812dc4bad985f`](https://github.com/block/buzz/commit/2693e0db1fc4980a551c2492031812dc4bad985f)) +- fix(desktop): more compact "compact" link previews ([#5629](https://github.com/block/buzz/pull/5629)) ([`45f4b91a36145f2ce642548c34f699f1b529bcf5`](https://github.com/block/buzz/commit/45f4b91a36145f2ce642548c34f699f1b529bcf5)) +- Harden shared agent instruction review ([#4220](https://github.com/block/buzz/pull/4220)) ([`a96af89526f7181543e7651100a944aa8e21812b`](https://github.com/block/buzz/commit/a96af89526f7181543e7651100a944aa8e21812b)) + +### Other repository changes + +- feat(mobile-messages): render compact Buzz permalink chips ([#5639](https://github.com/block/buzz/pull/5639)) ([`5ddf23d700abdd96622de2d39750c56509a7561f`](https://github.com/block/buzz/commit/5ddf23d700abdd96622de2d39750c56509a7561f)) +- Teach agents to inherit Buzz product intent ([#5875](https://github.com/block/buzz/pull/5875)) ([`1d51081b8abf4d3f9ec7fc676207f967a843e860`](https://github.com/block/buzz/commit/1d51081b8abf4d3f9ec7fc676207f967a843e860)) +- Polish mobile profiles, DMs, and sheets ([#5401](https://github.com/block/buzz/pull/5401)) ([`b30f1f61299f6f559777f797be27f193a6a4f0b3`](https://github.com/block/buzz/commit/b30f1f61299f6f559777f797be27f193a6a4f0b3)) +- Fix channel list scroll interruption ([#5815](https://github.com/block/buzz/pull/5815)) ([`0f61f24ad659abf44a7a4fcde6a0a2cbcf78f13b`](https://github.com/block/buzz/commit/0f61f24ad659abf44a7a4fcde6a0a2cbcf78f13b)) +- fix(channels): return complete member rosters ([#5765](https://github.com/block/buzz/pull/5765)) ([`e0940927ff381f6a353c637732c7a81886f9639d`](https://github.com/block/buzz/commit/e0940927ff381f6a353c637732c7a81886f9639d)) +- Fix mobile composer input regressions ([#5594](https://github.com/block/buzz/pull/5594)) ([`98d3d77b426f1107c98b7826d0224624ea774385`](https://github.com/block/buzz/commit/98d3d77b426f1107c98b7826d0224624ea774385)) +- Add mobile community invites ([#5641](https://github.com/block/buzz/pull/5641)) ([`8abc2baf0b71844fc4ff7222aab5027c862b7d1f`](https://github.com/block/buzz/commit/8abc2baf0b71844fc4ff7222aab5027c862b7d1f)) + +[Compare desktop-v0.5.11...desktop-v0.5.12](https://github.com/block/buzz/compare/desktop-v0.5.11...desktop-v0.5.12) + +## v0.5.11 + +### Desktop and shared changes + +- perf(desktop): persist channel snapshot hash ([#5684](https://github.com/block/buzz/pull/5684)) ([`c86443c5997c96c42829ce200e73e6e6efe52d96`](https://github.com/block/buzz/commit/c86443c5997c96c42829ce200e73e6e6efe52d96)) +- fix(agent): raise output limit and allow 3 recoveries ([#5475](https://github.com/block/buzz/pull/5475)) ([`72d56e7bd3a94fa3ee20b5a50bd1b868a9329d9c`](https://github.com/block/buzz/commit/72d56e7bd3a94fa3ee20b5a50bd1b868a9329d9c)) +- fix(desktop): defer foreground resume work ([#5696](https://github.com/block/buzz/pull/5696)) ([`59f613c404958d8ac99525b4aaaf26843257de31`](https://github.com/block/buzz/commit/59f613c404958d8ac99525b4aaaf26843257de31)) +- perf(desktop): coalesce thread-activity localStorage writes ([#5693](https://github.com/block/buzz/pull/5693)) ([`c6c6e7eca70d6b526c43af925e596e8616b19fb8`](https://github.com/block/buzz/commit/c6c6e7eca70d6b526c43af925e596e8616b19fb8)) +- Batch observer-store publications per relay envelope ([#5680](https://github.com/block/buzz/pull/5680)) ([`c3b0ccf383fe4ee936abbe6b9c9134b5728cc2b5`](https://github.com/block/buzz/commit/c3b0ccf383fe4ee936abbe6b9c9134b5728cc2b5)) +- feat(buzz-acp): idle re-sleep for woken lazy pools ([#5682](https://github.com/block/buzz/pull/5682)) ([`dc2dbfe0f570abb818d3f3da8a71ea235555ed27`](https://github.com/block/buzz/commit/dc2dbfe0f570abb818d3f3da8a71ea235555ed27)) +- fix(desktop): preserve agent mention separator after send ([#5623](https://github.com/block/buzz/pull/5623)) ([`a8e5c89e23b85ee93306f2c3c11d8fe6300cd360`](https://github.com/block/buzz/commit/a8e5c89e23b85ee93306f2c3c11d8fe6300cd360)) +- fix(link-previews): proxy sent preview media ([#5627](https://github.com/block/buzz/pull/5627)) ([`884ed8a5d35dfba3892fc40437f39e08856dec7d`](https://github.com/block/buzz/commit/884ed8a5d35dfba3892fc40437f39e08856dec7d)) +- feat(deletion): add durable whole-community deletion ([#4425](https://github.com/block/buzz/pull/4425)) ([`8a2c9af2dbe0cf315e77f43a4560d3572da5e554`](https://github.com/block/buzz/commit/8a2c9af2dbe0cf315e77f43a4560d3572da5e554)) +- fix(desktop): preserve live channel timelines ([#5662](https://github.com/block/buzz/pull/5662)) ([`63d14a0e95c8d5ae19f3f80123027729ec209bb2`](https://github.com/block/buzz/commit/63d14a0e95c8d5ae19f3f80123027729ec209bb2)) +- Refine channel settings and profile panels ([#5574](https://github.com/block/buzz/pull/5574)) ([`63f961c7e4818a1d29f1185002c123e486bd4a19`](https://github.com/block/buzz/commit/63f961c7e4818a1d29f1185002c123e486bd4a19)) +- fix(deps): bump webbrowser to 1.2.4 for RUSTSEC-2026-0257 ([#5659](https://github.com/block/buzz/pull/5659)) ([`c966b862fe8b9018c68c384b1680ca0173d0128c`](https://github.com/block/buzz/commit/c966b862fe8b9018c68c384b1680ca0173d0128c)) +- fix(desktop): launch Databricks OAuth from passive model discovery ([#5607](https://github.com/block/buzz/pull/5607)) ([`1ff98fa685fdb7133dbc18437d23dcdeeb42ce6e`](https://github.com/block/buzz/commit/1ff98fa685fdb7133dbc18437d23dcdeeb42ce6e)) + +### Other repository changes + +- feat(acp): report standard adapter usage ([#4950](https://github.com/block/buzz/pull/4950)) ([`4749bc7be3cdb78c2db4ce4864775ba7ab60b4cc`](https://github.com/block/buzz/commit/4749bc7be3cdb78c2db4ce4864775ba7ab60b4cc)) +- fix(mobile): settle hydrated threads on latest reply ([#4702](https://github.com/block/buzz/pull/4702)) ([`7634fe74563ea7f3c86fb6017a0ad647a9934477`](https://github.com/block/buzz/commit/7634fe74563ea7f3c86fb6017a0ad647a9934477)) +- feat(acp): deliver channel description in prompt [Context] ([#4552](https://github.com/block/buzz/pull/4552)) ([`6e0631f6b5d2139e4e080bf94e27ecee8a3d4d74`](https://github.com/block/buzz/commit/6e0631f6b5d2139e4e080bf94e27ecee8a3d4d74)) + +[Compare desktop-v0.5.10...desktop-v0.5.11](https://github.com/block/buzz/compare/desktop-v0.5.10...desktop-v0.5.11) + +## v0.5.10 + +### Desktop and shared changes + +- fix(desktop): remove 0.5.9+ perf regressions, speed up get_channels ([#5599](https://github.com/block/buzz/pull/5599)) ([`f35930104bcbdb1332ff13735214ecb9fce1fc7b`](https://github.com/block/buzz/commit/f35930104bcbdb1332ff13735214ecb9fce1fc7b)) +- perf(desktop): coalesce read state localStorage persistence ([#5591](https://github.com/block/buzz/pull/5591)) ([`9203bf60eea44875cafb36410252f8705ce54e2d`](https://github.com/block/buzz/commit/9203bf60eea44875cafb36410252f8705ce54e2d)) +- fix(desktop): bound initial timeline retention ([#5603](https://github.com/block/buzz/pull/5603)) ([`d9dc76c0aa7ab8a96b2ecf89325eef6b1536039d`](https://github.com/block/buzz/commit/d9dc76c0aa7ab8a96b2ecf89325eef6b1536039d)) +- Improve desktop search scoping ([#5306](https://github.com/block/buzz/pull/5306)) ([`cf03bd7c37cb3918afd4fe2a561360d01e11b68e`](https://github.com/block/buzz/commit/cf03bd7c37cb3918afd4fe2a561360d01e11b68e)) +- Add glass appearance and cohesive settings ([#5478](https://github.com/block/buzz/pull/5478)) ([`cd2aa5c12d1c802ea9d93c30809f3625c49e9bd4`](https://github.com/block/buzz/commit/cd2aa5c12d1c802ea9d93c30809f3625c49e9bd4)) +- Add Send to channel for thread messages ([#5305](https://github.com/block/buzz/pull/5305)) ([`b0795a10ea0f63f2382f4028a1adc2bc3e039d79`](https://github.com/block/buzz/commit/b0795a10ea0f63f2382f4028a1adc2bc3e039d79)) +- Fix macOS attachment picker lifecycle and allow inert HTML downloads ([#5569](https://github.com/block/buzz/pull/5569)) ([`bba3e06386b8a0ca22e9867dc81aac1ca2b1b737`](https://github.com/block/buzz/commit/bba3e06386b8a0ca22e9867dc81aac1ca2b1b737)) +- fix(desktop): preserve fresh channel timelines ([#5577](https://github.com/block/buzz/pull/5577)) ([`d3ec831e0cecbff347d55a236e34b27d79961503`](https://github.com/block/buzz/commit/d3ec831e0cecbff347d55a236e34b27d79961503)) +- fix(desktop): suppress fresh focus-return refetches for channels and home-feed ([#5535](https://github.com/block/buzz/pull/5535)) ([`49357244945c2f4b8432eb8b5cebbba5b1c30a08`](https://github.com/block/buzz/commit/49357244945c2f4b8432eb8b5cebbba5b1c30a08)) +- chore: mesh upgrade, clean up legacy special case code, simplify model selection for mesh ([#5289](https://github.com/block/buzz/pull/5289)) ([`240cdd3ea17a8f4d521c8398a929294210bd1e1a`](https://github.com/block/buzz/commit/240cdd3ea17a8f4d521c8398a929294210bd1e1a)) +- fix(desktop): preserve theme when opening communities ([#5266](https://github.com/block/buzz/pull/5266)) ([`83ca595adadae32238197d9c34a5895a34950968`](https://github.com/block/buzz/commit/83ca595adadae32238197d9c34a5895a34950968)) +- fix(link-preview): resolve YouTube videos through oEmbed ([#5520](https://github.com/block/buzz/pull/5520)) ([`7eb8cc5a5f03c454a84f2b5c4369819ba6d4d11b`](https://github.com/block/buzz/commit/7eb8cc5a5f03c454a84f2b5c4369819ba6d4d11b)) +- fix(buzz-agent): harden Databricks OAuth token cache and callback ([#5534](https://github.com/block/buzz/pull/5534)) ([`5e4d0fe92508fc5e0c812ff3edbe8877d86b8ec6`](https://github.com/block/buzz/commit/5e4d0fe92508fc5e0c812ff3edbe8877d86b8ec6)) +- fix(link-preview): reliably render previews sent right after they resolve ([#5245](https://github.com/block/buzz/pull/5245)) ([`be48ce98bd163899197b79a82ad5b2bcf0bc9b54`](https://github.com/block/buzz/commit/be48ce98bd163899197b79a82ad5b2bcf0bc9b54)) +- fix(link-preview): restore Buzz entity link cards ([#5494](https://github.com/block/buzz/pull/5494)) ([`7e6e9c547fa97abff6929cf2702b956586eec9bc`](https://github.com/block/buzz/commit/7e6e9c547fa97abff6929cf2702b956586eec9bc)) + +### Other repository changes + +- fix(relay): stop panicking the ingest worker on reactions to project events ([#5294](https://github.com/block/buzz/pull/5294)) ([`16b7ae7ce623a57be1461adee3b8fce4115b3c3a`](https://github.com/block/buzz/commit/16b7ae7ce623a57be1461adee3b8fce4115b3c3a)) +- fix(relay): log event kind on the HTTP bridge /events line ([#5291](https://github.com/block/buzz/pull/5291)) ([`e8153f8f27f5a35f56b2a578ab749190787d9e91`](https://github.com/block/buzz/commit/e8153f8f27f5a35f56b2a578ab749190787d9e91)) +- feat(tracing): add PostgreSQL tracing spans ([#3678](https://github.com/block/buzz/pull/3678)) ([`397796c5f343db4251198f44505b1afebe88223f`](https://github.com/block/buzz/commit/397796c5f343db4251198f44505b1afebe88223f)) + +[Compare desktop-v0.5.9...desktop-v0.5.10](https://github.com/block/buzz/compare/desktop-v0.5.9...desktop-v0.5.10) + +## v0.5.9 + +### Desktop and shared changes + +- Polish desktop onboarding flow ([#5310](https://github.com/block/buzz/pull/5310)) ([`3f2f32641f4093d087fd9506bfac1fa0329e8b2e`](https://github.com/block/buzz/commit/3f2f32641f4093d087fd9506bfac1fa0329e8b2e)) +- fix(desktop): quiesce renderer polling while hidden (#3677) ([#5490](https://github.com/block/buzz/pull/5490)) ([`07a3c768d619db31fee3f0590f9433cdd1213e8f`](https://github.com/block/buzz/commit/07a3c768d619db31fee3f0590f9433cdd1213e8f)) +- fix(channels): restore member invitations to private channels ([#5493](https://github.com/block/buzz/pull/5493)) ([`2777189d960fa5b1d863166f36d6e37ff8ce0819`](https://github.com/block/buzz/commit/2777189d960fa5b1d863166f36d6e37ff8ce0819)) +- fix(desktop): bound nine unbounded localStorage stores ([#5454](https://github.com/block/buzz/pull/5454)) ([`9c074bb89b290721f839bbc84fdf4701269e43a0`](https://github.com/block/buzz/commit/9c074bb89b290721f839bbc84fdf4701269e43a0)) +- feat(desktop): time-based sweep for stale localStorage caches ([#5453](https://github.com/block/buzz/pull/5453)) ([`bb9aae1065d4a77ae3dcb36b7b4a4e7ac8e68ead`](https://github.com/block/buzz/commit/bb9aae1065d4a77ae3dcb36b7b4a4e7ac8e68ead)) +- feat(desktop): NIP-AM agent-usage backend — P2 emission/transport/archive + P4a aggregation/D6 ([#4000](https://github.com/block/buzz/pull/4000)) ([`5e4c05f90b062898e1827ba45cb826c6ff913741`](https://github.com/block/buzz/commit/5e4c05f90b062898e1827ba45cb826c6ff913741)) +- fix(desktop): resolve overlapping member mentions ([#5225](https://github.com/block/buzz/pull/5225)) ([`44456e200e3ca6a5d2882b58b447b80474041347`](https://github.com/block/buzz/commit/44456e200e3ca6a5d2882b58b447b80474041347)) +- chore(deps): update rust crate anyhow to v1.0.104 ([#4447](https://github.com/block/buzz/pull/4447)) ([`e1ff91ecc1269682a50c17da2c0708d1448b336f`](https://github.com/block/buzz/commit/e1ff91ecc1269682a50c17da2c0708d1448b336f)) +- fix(desktop): preserve Welcome banner dismissal ([#5406](https://github.com/block/buzz/pull/5406)) ([`97aa9e31856edb9d8abcdcb33c472027f5588890`](https://github.com/block/buzz/commit/97aa9e31856edb9d8abcdcb33c472027f5588890)) +- fix(agent): retry LLM completion on malformed 2xx JSON body ([#5351](https://github.com/block/buzz/pull/5351)) ([`5bf78671f45178f8de02ba18d3d321cbbf19cd1f`](https://github.com/block/buzz/commit/5bf78671f45178f8de02ba18d3d321cbbf19cd1f)) +- fix(desktop): welcome banner overlap and missing dismiss control ([#5330](https://github.com/block/buzz/pull/5330)) ([`f029deafae6ad3b63e13c29104f3be76122cb1df`](https://github.com/block/buzz/commit/f029deafae6ad3b63e13c29104f3be76122cb1df)) +- fix(desktop): prevent horizontal clipping in Prompt Context modal ([#5324](https://github.com/block/buzz/pull/5324)) ([`fbf89e3bed9adebc033a26b7c43362c004e816a2`](https://github.com/block/buzz/commit/fbf89e3bed9adebc033a26b7c43362c004e816a2)) +- fix(buzz-agent): recover from 400-shaped image rejections; unbound benchmark agent rounds ([#5318](https://github.com/block/buzz/pull/5318)) ([`261c46076166c6de5bb9a71fb4a0fd0b70aa1efa`](https://github.com/block/buzz/commit/261c46076166c6de5bb9a71fb4a0fd0b70aa1efa)) + +### Other repository changes + +- feat(cli): add --visibility flag to channels update ([#5119](https://github.com/block/buzz/pull/5119)) ([`f8f2ef0440e7a074223ec04dc3b32d817b8b9d9b`](https://github.com/block/buzz/commit/f8f2ef0440e7a074223ec04dc3b32d817b8b9d9b)) +- perf(ci): experiment with sccache for relay builds ([#5224](https://github.com/block/buzz/pull/5224)) ([`5a3b3d23226474f835a1cf41d2ecc5f53cacb070`](https://github.com/block/buzz/commit/5a3b3d23226474f835a1cf41d2ecc5f53cacb070)) +- ci(release): gate OSS desktop auto-update promotion ([#5398](https://github.com/block/buzz/pull/5398)) ([`43573d114b5bfaf7cefa75eee7e219dc05cf1cd1`](https://github.com/block/buzz/commit/43573d114b5bfaf7cefa75eee7e219dc05cf1cd1)) +- fix(release): pin desktop PR operations to block/buzz ([#5212](https://github.com/block/buzz/pull/5212)) ([`c1e20a814bf694db2af959adacb375ced27af023`](https://github.com/block/buzz/commit/c1e20a814bf694db2af959adacb375ced27af023)) +- fix(search): surface exact short profile names ([#5480](https://github.com/block/buzz/pull/5480)) ([`3c76f682c3c2dfe2cd296c277c5e63799d3424f9`](https://github.com/block/buzz/commit/3c76f682c3c2dfe2cd296c277c5e63799d3424f9)) +- Reduce repeated ACP session context ([#5423](https://github.com/block/buzz/pull/5423)) ([`563e4346da37d0fb2e9ec1c95e7f1eba79f83040`](https://github.com/block/buzz/commit/563e4346da37d0fb2e9ec1c95e7f1eba79f83040)) +- chore(deps): update react monorepo ([#4441](https://github.com/block/buzz/pull/4441)) ([`119a84897f225c1e3213a09cd149abb37dcb3abc`](https://github.com/block/buzz/commit/119a84897f225c1e3213a09cd149abb37dcb3abc)) +- ci(security): allow retired relay pool advisory ([#5404](https://github.com/block/buzz/pull/5404)) ([`d2ebaa95a7d2565fb217fdfae56bafb9509be444`](https://github.com/block/buzz/commit/d2ebaa95a7d2565fb217fdfae56bafb9509be444)) +- chore(deps): update dependency @tanstack/react-virtual to v3.14.9 ([#4439](https://github.com/block/buzz/pull/4439)) ([`c923e89a4b6d43ae0c507dbb5e58f2bdd9ab7888`](https://github.com/block/buzz/commit/c923e89a4b6d43ae0c507dbb5e58f2bdd9ab7888)) +- chore(deps): update all non-major dependencies ([#3049](https://github.com/block/buzz/pull/3049)) ([`856cdb848b0a849e33620887b145b7e598dfd95c`](https://github.com/block/buzz/commit/856cdb848b0a849e33620887b145b7e598dfd95c)) +- chore(deps): update rust crate arc-swap to v1.9.2 ([#4448](https://github.com/block/buzz/pull/4448)) ([`08de85c592106ea2ffe22ba16e3a0fc10687db54`](https://github.com/block/buzz/commit/08de85c592106ea2ffe22ba16e3a0fc10687db54)) +- chore(deps): update rust crate async-trait to v0.1.91 ([#4458](https://github.com/block/buzz/pull/4458)) ([`12b1f566480d4feddc171739097f9359d3f255c1`](https://github.com/block/buzz/commit/12b1f566480d4feddc171739097f9359d3f255c1)) +- chore(deps): update rust crate diffy to v0.5.1 ([#4466](https://github.com/block/buzz/pull/4466)) ([`d7cc724fa5391b23e7fac99fc65dc28b79e4c5c4`](https://github.com/block/buzz/commit/d7cc724fa5391b23e7fac99fc65dc28b79e4c5c4)) +- chore(deps): update rust crate async-compression to v0.4.43 ([#4456](https://github.com/block/buzz/pull/4456)) ([`7dd8791d0765e9f15fed3299b6948e2babbfd763`](https://github.com/block/buzz/commit/7dd8791d0765e9f15fed3299b6948e2babbfd763)) +- chore(deps): update rust crate clap to v4.6.6 ([#4465](https://github.com/block/buzz/pull/4465)) ([`e668c6bb4913e36e58d7f947dbaf982e704e9132`](https://github.com/block/buzz/commit/e668c6bb4913e36e58d7f947dbaf982e704e9132)) +- chore(release): release Buzz Relay version 0.2.1 ([#2856](https://github.com/block/buzz/pull/2856)) ([`6e5c462ac524de60d7edb46c66130fd779cc9006`](https://github.com/block/buzz/commit/6e5c462ac524de60d7edb46c66130fd779cc9006)) + +[Compare desktop-v0.5.8...desktop-v0.5.9](https://github.com/block/buzz/compare/desktop-v0.5.8...desktop-v0.5.9) + +## v0.5.8 + +### Desktop and shared changes + +- feat(desktop): unify add agent flows ([#5015](https://github.com/block/buzz/pull/5015)) ([`02f640bc4559c48ac0c2ec595ef34dd2c294b0db`](https://github.com/block/buzz/commit/02f640bc4559c48ac0c2ec595ef34dd2c294b0db)) +- fix(buzz-agent): budget summarizer reasoning separately so it cannot starve the handoff summary ([#5248](https://github.com/block/buzz/pull/5248)) ([`c7b663680a29a837dbd2fdde810f239f3d303025`](https://github.com/block/buzz/commit/c7b663680a29a837dbd2fdde810f239f3d303025)) + +### Other repository changes + +- Revert "fix(acp): reject unattended permission requests" ([#5323](https://github.com/block/buzz/pull/5323)) ([`6a17d035f79ad582ca3f4f3cdc38d376f2c4087f`](https://github.com/block/buzz/commit/6a17d035f79ad582ca3f4f3cdc38d376f2c4087f)) +- infra: bind development services to loopback ([#4871](https://github.com/block/buzz/pull/4871)) ([`65834d68d0d3441c4e628540d6d5c8b0a2e757c9`](https://github.com/block/buzz/commit/65834d68d0d3441c4e628540d6d5c8b0a2e757c9)) + +[Compare desktop-v0.5.7...desktop-v0.5.8](https://github.com/block/buzz/compare/desktop-v0.5.7...desktop-v0.5.8) + +## v0.5.7 + +### Desktop and shared changes + +- fix(desktop): isolate relay admission tests ([#5221](https://github.com/block/buzz/pull/5221)) ([`74b913cff8512c015dc6f1a7473b253fa803f954`](https://github.com/block/buzz/commit/74b913cff8512c015dc6f1a7473b253fa803f954)) +- fix(desktop): externalize boot + "; - assert!(detect_and_validate_mime(html).is_err()); + assert_eq!(detect_and_validate_mime(html).unwrap(), "text/html"); + } + + #[test] + fn test_detect_and_validate_mime_still_rejects_executable() { + let elf = [b"\x7fELF".as_slice(), &[0u8; 60]].concat(); + assert!(detect_and_validate_mime(&elf).is_err()); + } + + #[test] + fn test_blocked_mime_keeps_active_content_and_executables() { + for kept in [ + "image/svg+xml", + "application/xhtml+xml", + "application/javascript", + "text/javascript", + "application/x-executable", + "application/x-mach-binary", + ] { + assert!(BLOCKED_MIME.contains(&kept), "{kept} must stay blocked"); + } } #[test] diff --git a/desktop/src-tauri/src/commands/media_download.rs b/desktop/src-tauri/src/commands/media_download.rs index d3b1a9499dc..7bc94da25d2 100644 --- a/desktop/src-tauri/src/commands/media_download.rs +++ b/desktop/src-tauri/src/commands/media_download.rs @@ -8,7 +8,8 @@ use crate::commands::export_util::save_bytes_with_dialog; use crate::commands::media::{detect_and_validate_mime, mint_media_get_auth, sanitize_filename}; use crate::commands::{ personas::{ - decode_snapshot_from_bytes, MAX_SNAPSHOT_JSON_BYTES, MAX_SNAPSHOT_PNG_BYTES, PNG_MAGIC, + parse_snapshot_payload_from_bytes, MAX_SNAPSHOT_JSON_BYTES, MAX_SNAPSHOT_PNG_BYTES, + PNG_MAGIC, }, team_snapshot::{ decode_team_snapshot_from_bytes, MAX_TEAM_SNAPSHOT_JSON_BYTES, MAX_TEAM_SNAPSHOT_PNG_BYTES, @@ -505,10 +506,12 @@ pub async fn fetch_snapshot_bytes( // 4. Bytes must parse as the snapshot type selected by the filename. // Team parsing rejects retired flat JSON and persona-pack ZIP inputs - // before anything reaches the frontend. + // before anything reaches the frontend. Agent kinds accept both plain + // manifests and structurally valid locked (encrypted) card envelopes — + // transit validation never decrypts; unlock happens at import time. match kind { SnapshotFileKind::AgentJson | SnapshotFileKind::AgentPng => { - decode_snapshot_from_bytes(&bytes) + parse_snapshot_payload_from_bytes(&bytes) .map_err(|e| format!("invalid agent snapshot: {e}"))?; } SnapshotFileKind::TeamJson | SnapshotFileKind::TeamPng => { diff --git a/desktop/src-tauri/src/commands/media_raw.rs b/desktop/src-tauri/src/commands/media_raw.rs new file mode 100644 index 00000000000..97081571623 --- /dev/null +++ b/desktop/src-tauri/src/commands/media_raw.rs @@ -0,0 +1,113 @@ +use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine}; +use tauri::{ + ipc::{InvokeBody, Request}, + State, +}; + +use crate::app_state::AppState; + +use super::{ + media::{upload_media_bytes_inner, BlobDescriptor}, + media_upload_progress::{ + begin_media_upload, cancel_media_upload as cancel_registered_media_upload, + finish_media_upload, + }, +}; + +/// Upload raw bytes directly (for paste and drag-drop). +/// +/// The renderer already has the bytes in memory from the clipboard/drag event. +/// If the bytes are a video, they're written to a temp file, transcoded via +/// ffmpeg, and the transcoded output is uploaded instead. +#[tauri::command] +pub async fn upload_media_bytes( + data: Vec, + filename: Option, + progress_id: Option, + app: tauri::AppHandle, + state: State<'_, AppState>, +) -> Result { + let cancellation = begin_media_upload(progress_id.as_deref()); + let result = upload_media_bytes_inner( + data, + filename, + progress_id.clone(), + app, + state, + cancellation.as_ref(), + ) + .await; + finish_media_upload(progress_id.as_deref()); + result +} + +fn decode_raw_upload_header(value: &str) -> Result { + let bytes = URL_SAFE_NO_PAD + .decode(value) + .map_err(|error| format!("invalid raw upload header: {error}"))?; + String::from_utf8(bytes).map_err(|error| format!("invalid raw upload header text: {error}")) +} + +fn optional_raw_upload_header(request: &Request<'_>, name: &str) -> Result, String> { + request + .headers() + .get(name) + .map(|value| { + value + .to_str() + .map_err(|error| format!("invalid {name} header: {error}")) + .and_then(decode_raw_upload_header) + }) + .transpose() +} + +/// Cancel the native upload associated with a background progress ID. +#[tauri::command] +pub fn cancel_media_upload(progress_id: String) { + cancel_registered_media_upload(&progress_id); +} + +/// Release the renderer's ownership after its upload promise settles. +#[tauri::command] +pub fn release_media_upload(progress_id: String) { + finish_media_upload(Some(&progress_id)); +} + +/// Upload raw IPC bytes without expanding a large browser File into JSON. +#[tauri::command] +pub async fn upload_media_bytes_raw( + request: Request<'_>, + app: tauri::AppHandle, + state: State<'_, AppState>, +) -> Result { + let data = match request.body() { + InvokeBody::Raw(data) => data.clone(), + InvokeBody::Json(_) => return Err("raw upload requires a byte body".to_string()), + }; + let filename = optional_raw_upload_header(&request, "x-buzz-filename")?; + let progress_id = optional_raw_upload_header(&request, "x-buzz-progress-id")?; + + let cancellation = begin_media_upload(progress_id.as_deref()); + let result = upload_media_bytes_inner( + data, + filename, + progress_id.clone(), + app, + state, + cancellation.as_ref(), + ) + .await; + finish_media_upload(progress_id.as_deref()); + result +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_decode_raw_upload_header_preserves_unicode() { + let encoded = URL_SAFE_NO_PAD.encode("clip 🎬.mp4"); + assert_eq!(decode_raw_upload_header(&encoded).unwrap(), "clip 🎬.mp4"); + } +} diff --git a/desktop/src-tauri/src/commands/media_transcode.rs b/desktop/src-tauri/src/commands/media_transcode.rs index 46a5decaa70..3fb7eda5f07 100644 --- a/desktop/src-tauri/src/commands/media_transcode.rs +++ b/desktop/src-tauri/src/commands/media_transcode.rs @@ -6,6 +6,7 @@ //! `validate_video_file()`) and to produce a JPEG poster frame. use crate::managed_agents::resolve_command; +use tokio_util::sync::CancellationToken; /// Build an ffmpeg command without inheriting user-controlled process knobs. /// @@ -121,7 +122,7 @@ pub(super) fn has_heic_extension(path: &std::path::Path) -> bool { /// blocking a Tokio worker thread indefinitely. const FFMPEG_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(600); -/// Run an ffmpeg command with a wall-clock timeout. +/// Run an ffmpeg command with a wall-clock timeout and optional cancellation. /// /// Spawns the child process, polls `try_wait()` every 500ms, and kills it /// if the deadline is exceeded. Returns the same `Output` as `Command::output()`. @@ -131,10 +132,14 @@ const FFMPEG_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(600); /// enough progress/diagnostic output to fill the OS pipe buffer (~64 KiB), /// the child blocks on write() and never exits — causing a false timeout. /// `-loglevel error` suppresses progress spam, keeping stderr small. -pub(super) fn run_ffmpeg_with_timeout( +fn run_ffmpeg_with_cancellation( cmd: &mut std::process::Command, timeout: std::time::Duration, + cancellation: Option<&CancellationToken>, ) -> Result { + if cancellation.is_some_and(CancellationToken::is_cancelled) { + return Err("upload cancelled".to_string()); + } let mut child = cmd .spawn() .map_err(|e| format!("failed to spawn ffmpeg: {e}"))?; @@ -162,6 +167,11 @@ pub(super) fn run_ffmpeg_with_timeout( } Ok(None) => { // Still running — check deadline. + if cancellation.is_some_and(CancellationToken::is_cancelled) { + let _ = child.kill(); + let _ = child.wait(); + return Err("upload cancelled".to_string()); + } if std::time::Instant::now() > deadline { let _ = child.kill(); let _ = child.wait(); // reap zombie @@ -181,14 +191,15 @@ pub(super) fn run_ffmpeg_with_timeout( /// relay's `validate_video_file()`. /// /// Returns the path to a temp file. Caller must clean up. -pub(super) fn transcode_to_mp4( +fn transcode_to_mp4_with_cancellation( source: &std::path::Path, ffmpeg: &std::path::Path, + cancellation: Option<&CancellationToken>, ) -> Result { // UUID-based temp path — unique across concurrent uploads. let output = std::env::temp_dir().join(format!("buzz-transcode-{}.mp4", uuid::Uuid::new_v4())); - let result = run_ffmpeg_with_timeout( + let result = run_ffmpeg_with_cancellation( ffmpeg_command(ffmpeg) .args([ "-y", @@ -240,7 +251,11 @@ pub(super) fn transcode_to_mp4( .stdout(std::process::Stdio::null()) .stderr(std::process::Stdio::piped()), FFMPEG_TIMEOUT, - )?; + cancellation, + ) + .inspect_err(|_| { + let _ = std::fs::remove_file(&output); + })?; if !result.status.success() { let _ = std::fs::remove_file(&output); @@ -265,9 +280,10 @@ pub(super) fn transcode_to_mp4( /// Uses `-frames:v 1` so multi-image HEIF containers (Live Photos, bursts) /// yield a single still, and `-q:v 2` for high JPEG quality. Returns the path /// to a temp file. Caller must clean up. -pub(super) fn transcode_heic_to_jpeg( +fn transcode_heic_to_jpeg( source: &std::path::Path, ffmpeg: &std::path::Path, + cancellation: Option<&CancellationToken>, ) -> Result { // UUID-based temp path — unique across concurrent uploads. let output = std::env::temp_dir().join(format!("buzz-heic-{}.jpg", uuid::Uuid::new_v4())); @@ -275,7 +291,7 @@ pub(super) fn transcode_heic_to_jpeg( // Single-frame image decode — 60s is generous even for large HEICs. let heic_timeout = std::time::Duration::from_secs(60); - let result = run_ffmpeg_with_timeout( + let result = run_ffmpeg_with_cancellation( ffmpeg_command(ffmpeg) .args([ "-y", @@ -301,7 +317,11 @@ pub(super) fn transcode_heic_to_jpeg( .stdout(std::process::Stdio::null()) .stderr(std::process::Stdio::piped()), heic_timeout, - )?; + cancellation, + ) + .inspect_err(|_| { + let _ = std::fs::remove_file(&output); + })?; if !result.status.success() { let _ = std::fs::remove_file(&output); @@ -323,9 +343,16 @@ pub(super) fn transcode_heic_to_jpeg( /// file. Mirrors `transcode_and_extract_poster` but for images (no poster). pub(super) fn transcode_heic_path_to_jpeg_bytes( source: &std::path::Path, +) -> Result, String> { + transcode_heic_path_to_jpeg_bytes_with_cancellation(source, None) +} + +pub(super) fn transcode_heic_path_to_jpeg_bytes_with_cancellation( + source: &std::path::Path, + cancellation: Option<&CancellationToken>, ) -> Result, String> { let ffmpeg_path = find_ffmpeg()?; - let jpeg_path = transcode_heic_to_jpeg(source, &ffmpeg_path)?; + let jpeg_path = transcode_heic_to_jpeg(source, &ffmpeg_path, cancellation)?; let bytes = std::fs::read(&jpeg_path).map_err(|e| format!("failed to read transcoded HEIC: {e}")); let _ = std::fs::remove_file(&jpeg_path); @@ -340,9 +367,10 @@ pub(super) fn transcode_heic_path_to_jpeg_bytes( /// /// Best-effort: returns `Err` on failure — callers should log and continue /// without a poster rather than failing the entire video upload. -pub(super) fn extract_poster_frame( +fn extract_poster_frame_with_cancellation( mp4_path: &std::path::Path, ffmpeg: &std::path::Path, + cancellation: Option<&CancellationToken>, ) -> Result { let output = std::env::temp_dir().join(format!("buzz-poster-{}.jpg", uuid::Uuid::new_v4())); @@ -350,7 +378,7 @@ pub(super) fn extract_poster_frame( let poster_timeout = std::time::Duration::from_secs(30); // Try seeking to 1s first (avoids black first frames from fade-ins). - let result = run_ffmpeg_with_timeout( + let result = run_ffmpeg_with_cancellation( ffmpeg_command(ffmpeg) .args([ "-y", @@ -369,6 +397,7 @@ pub(super) fn extract_poster_frame( .stdout(std::process::Stdio::null()) .stderr(std::process::Stdio::piped()), poster_timeout, + cancellation, )?; // If seek to 1s failed (video shorter than 1s), retry from first frame. @@ -381,7 +410,7 @@ pub(super) fn extract_poster_frame( eprintln!("buzz-desktop: poster seek-to-1s failed, trying first frame: {stderr}"); } let _ = std::fs::remove_file(&output); - let fallback = run_ffmpeg_with_timeout( + let fallback = run_ffmpeg_with_cancellation( ffmpeg_command(ffmpeg) .args([ "-y", @@ -398,6 +427,7 @@ pub(super) fn extract_poster_frame( .stdout(std::process::Stdio::null()) .stderr(std::process::Stdio::piped()), poster_timeout, + cancellation, )?; if !fallback.status.success() || !output.exists() { @@ -417,22 +447,35 @@ pub(super) fn extract_poster_frame( /// and the video bytes are still valid. All temp files are cleaned up. pub(super) fn transcode_and_extract_poster( source: &std::path::Path, +) -> Result<(Vec, Option>), String> { + transcode_and_extract_poster_with_cancellation(source, None) +} + +pub(super) fn transcode_and_extract_poster_with_cancellation( + source: &std::path::Path, + cancellation: Option<&CancellationToken>, ) -> Result<(Vec, Option>), String> { let ffmpeg_path = find_ffmpeg()?; - let transcoded = transcode_to_mp4(source, &ffmpeg_path)?; + let transcoded = transcode_to_mp4_with_cancellation(source, &ffmpeg_path, cancellation)?; // Extract poster from the transcoded file (not the original — guarantees decodability). - let poster_bytes = match extract_poster_frame(&transcoded, &ffmpeg_path) { - Ok(poster_path) => { - let bytes = std::fs::read(&poster_path).ok(); - let _ = std::fs::remove_file(&poster_path); - bytes - } - Err(e) => { - eprintln!("buzz-desktop: poster extraction failed (non-fatal): {e}"); - None - } - }; + let poster_bytes = + match extract_poster_frame_with_cancellation(&transcoded, &ffmpeg_path, cancellation) { + Ok(poster_path) => { + let bytes = std::fs::read(&poster_path).ok(); + let _ = std::fs::remove_file(&poster_path); + bytes + } + Err(e) => { + eprintln!("buzz-desktop: poster extraction failed (non-fatal): {e}"); + None + } + }; + + if cancellation.is_some_and(CancellationToken::is_cancelled) { + let _ = std::fs::remove_file(&transcoded); + return Err("upload cancelled".to_string()); + } let video_bytes = std::fs::read(&transcoded).map_err(|e| format!("failed to read transcoded file: {e}")); @@ -599,7 +642,8 @@ mod tests { return; } - let output = transcode_to_mp4(&source, &ffmpeg).expect("transcode fixture"); + let output = + transcode_to_mp4_with_cancellation(&source, &ffmpeg, None).expect("transcode fixture"); let bytes = std::fs::read(&output).expect("read transcoded video"); let _ = std::fs::remove_file(&source); let _ = std::fs::remove_file(&output); diff --git a/desktop/src-tauri/src/commands/media_upload_progress.rs b/desktop/src-tauri/src/commands/media_upload_progress.rs new file mode 100644 index 00000000000..5ed3f786521 --- /dev/null +++ b/desktop/src-tauri/src/commands/media_upload_progress.rs @@ -0,0 +1,230 @@ +use std::{ + collections::HashMap, + sync::{LazyLock, Mutex}, +}; + +use tauri::Emitter; +use tokio_util::sync::CancellationToken; + +use crate::{app_state::AppState, relay::classify_request_error}; + +#[derive(Default)] +struct MediaUploadCancellations { + tokens: HashMap, +} + +impl MediaUploadCancellations { + fn begin(&mut self, progress_id: &str) -> CancellationToken { + if let Some(cancel) = self.tokens.get(progress_id).cloned() { + return cancel; + } + let cancel = CancellationToken::new(); + self.tokens.insert(progress_id.to_string(), cancel.clone()); + cancel + } + + fn cancel(&mut self, progress_id: &str) { + let cancel = self.tokens.entry(progress_id.to_string()).or_default(); + cancel.cancel(); + } + + fn finish(&mut self, progress_id: &str) { + self.tokens.remove(progress_id); + } +} + +static MEDIA_UPLOAD_CANCELLATIONS: LazyLock> = + LazyLock::new(|| Mutex::new(MediaUploadCancellations::default())); + +pub(super) fn begin_media_upload(progress_id: Option<&str>) -> Option { + let progress_id = progress_id?; + MEDIA_UPLOAD_CANCELLATIONS + .lock() + .ok() + .map(|mut uploads| uploads.begin(progress_id)) +} + +pub(super) fn cancel_media_upload(progress_id: &str) { + if let Ok(mut uploads) = MEDIA_UPLOAD_CANCELLATIONS.lock() { + uploads.cancel(progress_id); + } +} + +pub(super) fn finish_media_upload(progress_id: Option<&str>) { + let Some(progress_id) = progress_id else { + return; + }; + if let Ok(mut uploads) = MEDIA_UPLOAD_CANCELLATIONS.lock() { + uploads.finish(progress_id); + } +} + +pub(super) struct UploadAttempt<'a> { + pub url: String, + pub auth_header: &'a str, + pub mime: &'a str, + pub sha256: &'a str, + pub body: bytes::Bytes, + pub progress: Option<&'a (tauri::AppHandle, String)>, + pub cancellation: Option<&'a CancellationToken>, +} + +pub(super) async fn send_upload_attempt( + state: &AppState, + attempt: UploadAttempt<'_>, +) -> Result { + let UploadAttempt { + url, + auth_header, + mime, + sha256, + body, + progress, + cancellation, + } = attempt; + let req = state + .http_client + .put(url) + .header("Authorization", auth_header) + .header("Content-Type", mime) + .header("X-SHA-256", sha256); + + let response = if let Some((app, progress_id)) = progress { + let app = app.clone(); + let progress_id = progress_id.clone(); + let total = body.len() as u64; + let chunk_size = 64 * 1024; + let chunk_count = body.len().div_ceil(chunk_size); + let mut sent: u64 = 0; + let stream = futures_util::stream::iter((0..chunk_count).map(move |i| { + let start = i * chunk_size; + let end = usize::min(start + chunk_size, body.len()); + let chunk = body.slice(start..end); + sent += chunk.len() as u64; + let _ = app.emit( + "media-upload-progress", + serde_json::json!({ "id": progress_id, "sent": sent, "total": total }), + ); + Ok::(chunk) + })); + let request = req + .header(reqwest::header::CONTENT_LENGTH, total) + .body(reqwest::Body::wrap_stream(stream)) + .send(); + if let Some(cancellation) = cancellation { + tokio::select! { + _ = cancellation.cancelled() => return Err("upload cancelled".to_string()), + response = request => response, + } + } else { + request.await + } + } else { + let request = req.body(body).send(); + if let Some(cancellation) = cancellation { + tokio::select! { + _ = cancellation.cancelled() => return Err("upload cancelled".to_string()), + response = request => response, + } + } else { + request.await + } + }; + response.map_err(|error| classify_request_error(&error)) +} + +pub(super) fn emit_media_upload_phase( + app: &tauri::AppHandle, + progress_id: Option<&str>, + phase: &'static str, +) { + let Some(id) = progress_id else { + return; + }; + let _ = app.emit( + "media-upload-phase", + serde_json::json!({ "id": id, "phase": phase }), + ); +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn cancellation_before_begin_is_retained() { + let progress_id = format!("cancel-before-begin-{}", uuid::Uuid::new_v4()); + + cancel_media_upload(&progress_id); + let cancellation = begin_media_upload(Some(&progress_id)).expect("cancellation token"); + + assert!(cancellation.is_cancelled()); + finish_media_upload(Some(&progress_id)); + } + + #[test] + fn cancellation_after_begin_reaches_registered_token() { + let progress_id = format!("cancel-after-begin-{}", uuid::Uuid::new_v4()); + let cancellation = begin_media_upload(Some(&progress_id)).expect("cancellation token"); + + cancel_media_upload(&progress_id); + + assert!(cancellation.is_cancelled()); + finish_media_upload(Some(&progress_id)); + } + + #[test] + fn late_cancellation_after_native_finish_is_removed_on_release() { + let mut uploads = MediaUploadCancellations::default(); + let id = "late-cancel"; + + uploads.begin(id); + uploads.finish(id); + uploads.cancel(id); + assert!(uploads.tokens.contains_key(id)); + + uploads.finish(id); + assert!(!uploads.tokens.contains_key(id)); + } + + #[test] + fn repeated_concurrent_cycles_leave_no_registry_entries() { + let mut uploads = MediaUploadCancellations::default(); + let ids = (0..256) + .map(|index| format!("cycle-{index}")) + .collect::>(); + + for id in &ids { + uploads.begin(id); + } + for id in &ids { + uploads.cancel(id); + } + for id in &ids { + uploads.finish(id); + } + + assert!(uploads.tokens.is_empty()); + } + + #[test] + fn dispatched_cancellations_are_not_evicted_before_begin() { + let mut uploads = MediaUploadCancellations::default(); + let ids = (0..129) + .map(|index| format!("dispatched-{index}")) + .collect::>(); + + for id in &ids { + uploads.cancel(id); + } + + let oldest = uploads.begin(&ids[0]); + assert!(oldest.is_cancelled()); + assert_eq!(uploads.tokens.len(), ids.len()); + + for id in &ids { + uploads.finish(id); + } + assert!(uploads.tokens.is_empty()); + } +} diff --git a/desktop/src-tauri/src/commands/mesh_llm.rs b/desktop/src-tauri/src/commands/mesh_llm.rs index 998bc6e7d28..7356cd7fc0c 100644 --- a/desktop/src-tauri/src/commands/mesh_llm.rs +++ b/desktop/src-tauri/src/commands/mesh_llm.rs @@ -3,6 +3,7 @@ use std::path::PathBuf; use sha2::{Digest, Sha256}; use tauri::{AppHandle, Manager, State}; +use super::mesh_readiness::wait_for_mesh_inference; use crate::{app_state::AppState, mesh_llm, relay}; #[derive(Clone, Debug, serde::Deserialize, serde::Serialize)] @@ -364,8 +365,7 @@ pub(crate) async fn restore_mesh_sharing(app: &AppHandle, state: &AppState) -> C } // This is restoration of a previously inference-ready serving node. Keep // the enabled checkpoint armed while restoring so a transient startup - // failure does not silently turn Share Compute off. New starts remain - // disarmed in `mesh_start_node` until their first inference probe passes. + // failure does not silently turn Share Compute off. let request = mesh_llm::StartMeshNodeRequest { mode: mesh_llm::MeshNodeMode::Serve, model_id: Some(config.model_id.clone()), @@ -378,20 +378,26 @@ pub(crate) async fn restore_mesh_sharing(app: &AppHandle, state: &AppState) -> C let started = mesh_llm::DesktopMeshRuntime::start(request) .await .map_err(|error| format!("failed to restore Share Compute: {error:#}"))?; - if let Err(error) = wait_for_mesh_inference(&config.model_id).await { - let cleanup = started.stop().await; - if let Err(cleanup_error) = cleanup { - eprintln!( - "buzz-mesh: restored node failed inference readiness and cleanup was incomplete: {cleanup_error:#}" - ); - } - return Err(format!("failed to restore Share Compute: {error}")); - } + // Install the restored runtime immediately: it is tracked by AppState from + // here on, so it can never be orphaned. Restoring a previously + // inference-ready node still has to load ~tens of GB of weights and may + // download package layers after the ports bind, and the readiness probe + // itself serializes behind any first inference. None of that is a failed + // restore — stopping the node and reporting failure (the old behaviour) + // tore down a node that was simply still warming up. The checkpoint stays + // armed (`enabled`), so a genuinely broken restore is retried next launch + // rather than silently turning Share Compute off. *runtime = Some(started); config.enabled = true; config.start_on_next_launch = false; save_mesh_sharing_config(app, &config)?; drop(runtime); + if let Err(error) = wait_for_mesh_inference(&config.model_id).await { + eprintln!( + "buzz-mesh: restored node is not inference-ready yet ({error}); \ + leaving it to warm up without tearing it down" + ); + } mesh_llm::publish_current_status_once(app, "restore").await; Ok(()) } @@ -467,9 +473,11 @@ pub async fn mesh_start_node( } if let Some(config) = sharing_config.as_ref() { - // Do not arm launch restoration until the exact inference path used by - // agents succeeds. Mesh may bind its ports after primary weights load - // while package layers are still downloading. + // Persist a DISARMED checkpoint to cover the window of the potentially + // long `start()` below: if Buzz exits before the runtime is installed + // and tracked, the next launch stays stopped rather than trying to + // restore a node that never came up. The enabled config is armed right + // after install succeeds. save_mesh_sharing_config(&app, &pending_new_start_checkpoint(config))?; } @@ -496,166 +504,33 @@ pub async fn mesh_start_node( )); } }; - if let Some(config) = sharing_config.as_ref() { - if let Err(error) = wait_for_mesh_inference(&config.model_id).await { - let cleanup = started.stop().await; - if let Err(cleanup_error) = &cleanup { - eprintln!( - "buzz-mesh: started node failed inference readiness and cleanup was incomplete: {cleanup_error:#}" - ); - } - drop(runtime); - app.request_restart(); - return Err(format!( - "mesh node started but inference never became ready: {error}; Buzz is restarting to guarantee cleanup" - )); - } - } + // Install (track) the runtime BEFORE probing readiness so it can never be + // orphaned. A readiness timeout is not death: mesh binds its ports before + // weights finish loading / layers finish downloading, and serializes all + // ingress HTTP (this probe included) behind any in-flight turn — a cold + // start can take minutes. The old code stopped the node and restarted the + // app on that timeout, turning startup latency into a restart loop. *runtime = Some(started); drop(runtime); if let Some(config) = sharing_config.as_ref() { + // Installed + tracked == Share Compute is on, so persist the enabled + // config now (mirroring restore), not gated on the probe. Gating it + // meant a slow first start served fine but came back OFF next launch. + // Safe: neither the watchdog (evicts only a closed port) nor restore + // (leaves a warming node alone) can loop a slow-but-alive node, and an + // unstartable config fails earlier in `start()`. Probe is informational. save_mesh_sharing_config(&app, config)?; + if let Err(error) = wait_for_mesh_inference(&config.model_id).await { + eprintln!( + "buzz-mesh: node started but inference is not ready yet ({error}); \ + leaving it to warm up (Share Compute stays armed for next launch)" + ); + } } mesh_llm::publish_current_status_once(&app, "start").await; Ok(status) } -/// Mesh can bind its HTTP ingress and advertise a model shortly before the -/// router has installed a usable target. Probe the exact chat path agents use -/// so startup cannot race that gap (`single target None unavailable`). -/// Which startup stage a mesh client is stuck at when it never becomes -/// inference-ready. The two live-observed failure modes are physically -/// distinct and want different user copy: -/// -/// * `CatalogNeverSynced` — the local client node came up and connected to -/// the host at the control level (ping/RTT fine), but the served model -/// never appeared in the local `/v1/models` catalog. That catalog is -/// populated by the peer gossip exchange; when the gossip bi-stream can't -/// establish across the network (observed as iroh -/// `MultipathNotNegotiated` / unreachable direct path), the catalog stays -/// empty forever and every request is rejected "model not available". -/// Root cause is the network path between this machine and the host. -/// * `RoutingNeverCompleted` — the model *did* sync into the catalog, but -/// inference requests never completed (routing/transport to the host -/// failing per-request). The host is discoverable and advertised but not -/// actually serving us. -#[derive(Debug, Clone, Copy, PartialEq, Eq)] -enum MeshReadinessFailure { - CatalogNeverSynced, - RoutingNeverCompleted, -} - -/// Pure classifier: given whether the served model was ever observed in the -/// local `/v1/models` catalog during the wait, decide which stage failed. -/// Split out so the diagnosis is unit-testable without a live mesh. -fn classify_mesh_readiness_failure(model_ever_visible: bool) -> MeshReadinessFailure { - if model_ever_visible { - MeshReadinessFailure::RoutingNeverCompleted - } else { - MeshReadinessFailure::CatalogNeverSynced - } -} - -/// Actionable, non-technical copy for a readiness failure. `last_detail` is the -/// last raw transport/HTTP error, appended for support triage. -fn mesh_readiness_failure_message( - failure: MeshReadinessFailure, - model_id: &str, - last_detail: &str, -) -> String { - match failure { - MeshReadinessFailure::CatalogNeverSynced => format!( - "Buzz shared compute connected to the serving member but could not sync \ - the model list for \"{model_id}\" — this is a network path problem \ - between this machine and the host (the compute node is reachable for \ - pings but the model-sync stream did not establish). Try again, or have \ - the host and this machine on a more direct network. (last: {last_detail})" - ), - MeshReadinessFailure::RoutingNeverCompleted => format!( - "Buzz shared compute found \"{model_id}\" on a serving member but inference \ - requests did not complete — the host is discoverable but not currently \ - reachable for requests. Try again shortly. (last: {last_detail})" - ), - } -} - -/// Poll the local mesh OpenAI ingress until a real inference for `model_id` -/// succeeds, or a deadline elapses. On failure, returns a stage-specific, -/// actionable message (see [`MeshReadinessFailure`]) rather than a raw -/// `HTTP 429`, so the UI can tell "still warming up" apart from "can't reach -/// the host". -async fn wait_for_mesh_inference(model_id: &str) -> CmdResult<()> { - let client = reqwest::Client::builder() - .timeout(std::time::Duration::from_secs(30)) - .build() - .map_err(|error| format!("failed to build mesh readiness client: {error}"))?; - let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(120); - let models_url = format!("{}/models", crate::managed_agents::RELAY_MESH_API_BASE_URL); - let chat_url = format!( - "{}/chat/completions", - crate::managed_agents::RELAY_MESH_API_BASE_URL - ); - let mut last_error = "mesh inference is not ready".to_string(); - // Track whether the served model ever reached the local catalog — the - // signal that splits "catalog never synced" from "routing never completed". - let mut model_ever_visible = false; - - while tokio::time::Instant::now() < deadline { - // Refresh catalog visibility. "auto" delegates model choice to the - // router, so any advertised model counts as the catalog having synced. - if let Ok(response) = client - .get(&models_url) - .bearer_auth(crate::managed_agents::RELAY_MESH_API_KEY_PLACEHOLDER) - .send() - .await - { - if let Ok(body) = response.json::().await { - if let Some(data) = body.get("data").and_then(|d| d.as_array()) { - let wanted = model_id.trim().replace("@main", ""); - let visible = !data.is_empty() - && (model_id == crate::mesh_llm::AUTO_MODEL_ID - || data.iter().any(|m| { - m.get("id") - .and_then(|id| id.as_str()) - .map(|id| id.replace("@main", "") == wanted) - .unwrap_or(false) - })); - model_ever_visible |= visible; - } - } - } - - match client - .post(&chat_url) - .bearer_auth(crate::managed_agents::RELAY_MESH_API_KEY_PLACEHOLDER) - .json(&serde_json::json!({ - "model": model_id, - "messages": [{"role": "user", "content": "Reply OK"}], - "max_tokens": 1, - "stream": false - })) - .send() - .await - { - Ok(response) if response.status().is_success() => return Ok(()), - Ok(response) => { - let status = response.status(); - let body = response.text().await.unwrap_or_default(); - last_error = format!("HTTP {status}: {body}"); - } - Err(error) => last_error = error.to_string(), - } - tokio::time::sleep(std::time::Duration::from_secs(2)).await; - } - - let failure = classify_mesh_readiness_failure(model_ever_visible); - Err(mesh_readiness_failure_message( - failure, - model_id, - &last_error, - )) -} - pub(crate) async fn ensure_client_node_for_model( state: &AppState, model_id: impl AsRef, diff --git a/desktop/src-tauri/src/commands/mesh_llm_tests.rs b/desktop/src-tauri/src/commands/mesh_llm_tests.rs index 26eb1f5fbae..c4e1ae2e425 100644 --- a/desktop/src-tauri/src/commands/mesh_llm_tests.rs +++ b/desktop/src-tauri/src/commands/mesh_llm_tests.rs @@ -178,42 +178,6 @@ fn role_switch_checkpoint_starts_exactly_once_after_restart() { assert_eq!(consumed.relay_url, config.relay_url); } -#[test] -fn readiness_failure_is_catalog_sync_when_model_never_visible() { - assert_eq!( - classify_mesh_readiness_failure(false), - MeshReadinessFailure::CatalogNeverSynced - ); -} - -#[test] -fn readiness_failure_is_routing_when_model_was_visible() { - assert_eq!( - classify_mesh_readiness_failure(true), - MeshReadinessFailure::RoutingNeverCompleted - ); -} - -#[test] -fn readiness_messages_are_distinct_and_actionable() { - let catalog = mesh_readiness_failure_message( - MeshReadinessFailure::CatalogNeverSynced, - "auto", - "HTTP 429", - ); - let routing = mesh_readiness_failure_message( - MeshReadinessFailure::RoutingNeverCompleted, - "auto", - "HTTP 503", - ); - // Distinct diagnoses, each names the model and carries the raw detail. - assert_ne!(catalog, routing); - assert!(catalog.contains("network path")); - assert!(catalog.contains("HTTP 429")); - assert!(routing.contains("did not complete")); - assert!(routing.contains("HTTP 503")); -} - #[test] fn mesh_status_cursor_uses_relay_composite_tiebreak() { let event = nostr::EventBuilder::new(nostr::Kind::TextNote, "status") diff --git a/desktop/src-tauri/src/commands/mesh_readiness.rs b/desktop/src-tauri/src/commands/mesh_readiness.rs new file mode 100644 index 00000000000..023695a6f9c --- /dev/null +++ b/desktop/src-tauri/src/commands/mesh_readiness.rs @@ -0,0 +1,251 @@ +//! Startup readiness for Buzz shared compute. +//! +//! Mesh can bind its HTTP ingress and advertise a model shortly before the +//! router has installed a usable target. These helpers probe the exact chat +//! path agents use, so startup cannot race that gap +//! (`single target None unavailable`), and classify a timeout into copy that +//! names the actual stage rather than a raw `HTTP 429`. + +use super::CmdResult; + +/// Which startup stage a mesh client is stuck at when it never becomes +/// inference-ready. The two live-observed failure modes are physically +/// distinct and want different user copy: +/// +/// * `CatalogNeverSynced` — the local client node came up and connected to +/// the host at the control level (ping/RTT fine), but the served model +/// never appeared in the local `/v1/models` catalog. That catalog is +/// populated by the peer gossip exchange; when the gossip bi-stream can't +/// establish across the network (observed as iroh +/// `MultipathNotNegotiated` / unreachable direct path), the catalog stays +/// empty forever and every request is rejected "model not available". +/// Root cause is the network path between this machine and the host. +/// * `RoutingNeverCompleted` — the model *did* sync into the catalog, but +/// inference requests never completed (routing/transport to the host +/// failing per-request). The host is discoverable and advertised but not +/// actually serving us. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum MeshReadinessFailure { + CatalogNeverSynced, + RoutingNeverCompleted, +} + +/// Pure classifier: given whether the served model was ever observed in the +/// local `/v1/models` catalog during the wait, decide which stage failed. +/// Split out so the diagnosis is unit-testable without a live mesh. +/// Whether the catalog has synced enough to count, for the model actually being +/// requested (a wire name — see `relay_mesh_wire_model`). +/// +/// The virtual `mesh` model delegates the choice to the router, so any +/// advertised model proves the catalog synced. It has to work that way: MeshLLM +/// only advertises `mesh` itself once two non-virtual models are reachable +/// (`should_advertise_virtual_mesh`), so requiring it by name would leave a +/// single-worker mesh looking permanently unsynced and misreport a slow model +/// load as a network path problem. +fn mesh_catalog_shows_model(advertised: &[String], wire_model: &str) -> bool { + if advertised.is_empty() { + return false; + } + if wire_model == crate::managed_agents::RELAY_MESH_VIRTUAL_MODEL_ID { + return true; + } + let wanted = wire_model.trim().replace("@main", ""); + advertised + .iter() + .any(|id| id.replace("@main", "") == wanted) +} + +fn classify_mesh_readiness_failure(model_ever_visible: bool) -> MeshReadinessFailure { + if model_ever_visible { + MeshReadinessFailure::RoutingNeverCompleted + } else { + MeshReadinessFailure::CatalogNeverSynced + } +} + +/// Actionable, non-technical copy for a readiness failure. `last_detail` is the +/// last raw transport/HTTP error, appended for support triage. +fn mesh_readiness_failure_message( + failure: MeshReadinessFailure, + model_id: &str, + last_detail: &str, +) -> String { + match failure { + MeshReadinessFailure::CatalogNeverSynced => format!( + "Buzz shared compute connected to the serving member but could not sync \ + the model list for \"{model_id}\" — this is a network path problem \ + between this machine and the host (the compute node is reachable for \ + pings but the model-sync stream did not establish). Try again, or have \ + the host and this machine on a more direct network. (last: {last_detail})" + ), + MeshReadinessFailure::RoutingNeverCompleted => format!( + "Buzz shared compute found \"{model_id}\" on a serving member but inference \ + requests did not complete — the host is discoverable but not currently \ + reachable for requests. Try again shortly. (last: {last_detail})" + ), + } +} + +/// Poll the local mesh OpenAI ingress until a real inference for `model_id` +/// succeeds, or a deadline elapses. On failure, returns a stage-specific, +/// actionable message (see [`MeshReadinessFailure`]) rather than a raw +/// `HTTP 429`, so the UI can tell "still warming up" apart from "can't reach +/// the host". +pub(crate) async fn wait_for_mesh_inference(model_id: &str) -> CmdResult<()> { + // Probe the name that will actually be requested. Callers pass a stored + // value, which for shared-compute `auto` is not a model the mesh + // advertises: probing it would validate a route no agent uses, and could + // fail readiness while the real route works. Named models pass through + // unchanged, so this is safe for the serve-side callers too. + let requested_model = model_id; + let model_id = crate::managed_agents::relay_mesh_wire_model(model_id); + let client = reqwest::Client::builder() + .timeout(std::time::Duration::from_secs(30)) + .build() + .map_err(|error| format!("failed to build mesh readiness client: {error}"))?; + let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(120); + let models_url = format!("{}/models", crate::managed_agents::RELAY_MESH_API_BASE_URL); + let chat_url = format!( + "{}/chat/completions", + crate::managed_agents::RELAY_MESH_API_BASE_URL + ); + let mut last_error = "mesh inference is not ready".to_string(); + // Track whether the served model ever reached the local catalog — the + // signal that splits "catalog never synced" from "routing never completed". + let mut model_ever_visible = false; + + while tokio::time::Instant::now() < deadline { + // Refresh catalog visibility. The virtual `mesh` model delegates the + // choice to the router, so any advertised model counts as the catalog + // having synced — and it must, because MeshLLM only advertises `mesh` + // itself once two non-virtual models are reachable + // (`should_advertise_virtual_mesh`). Requiring it by name would leave a + // single-worker mesh looking permanently unsynced. + if let Ok(response) = client + .get(&models_url) + .bearer_auth(crate::managed_agents::RELAY_MESH_API_KEY_PLACEHOLDER) + .send() + .await + { + if let Ok(body) = response.json::().await { + if let Some(data) = body.get("data").and_then(|d| d.as_array()) { + let advertised: Vec = data + .iter() + .filter_map(|m| m.get("id").and_then(|id| id.as_str())) + .map(str::to_owned) + .collect(); + model_ever_visible |= mesh_catalog_shows_model(&advertised, model_id); + } + } + } + + match client + .post(&chat_url) + .bearer_auth(crate::managed_agents::RELAY_MESH_API_KEY_PLACEHOLDER) + .json(&serde_json::json!({ + "model": model_id, + "messages": [{"role": "user", "content": "Reply OK"}], + "max_tokens": 1, + "stream": false + })) + .send() + .await + { + Ok(response) if response.status().is_success() => return Ok(()), + Ok(response) => { + let status = response.status(); + let body = response.text().await.unwrap_or_default(); + last_error = format!("HTTP {status}: {body}"); + } + Err(error) => last_error = error.to_string(), + } + tokio::time::sleep(std::time::Duration::from_secs(2)).await; + } + + let failure = classify_mesh_readiness_failure(model_ever_visible); + Err(mesh_readiness_failure_message( + failure, + requested_model, + &last_error, + )) +} +#[cfg(test)] +mod tests { + use super::*; + + /// The regression this guards: MeshLLM only advertises the virtual `mesh` model + /// once two non-virtual models are reachable, so a single-worker mesh never + /// lists it by name. Keying visibility on the literal name would report a lone + /// host that is still loading weights as a network path problem. + #[test] + fn virtual_mesh_counts_any_advertised_model_as_a_synced_catalog() { + let one_worker = vec!["unsloth/gemma-4-E4B-it-GGUF:Q4_K_M".to_string()]; + assert!(mesh_catalog_shows_model( + &one_worker, + crate::managed_agents::RELAY_MESH_VIRTUAL_MODEL_ID + )); + } + + #[test] + fn an_empty_catalog_is_never_synced_even_for_the_virtual_model() { + assert!(!mesh_catalog_shows_model( + &[], + crate::managed_agents::RELAY_MESH_VIRTUAL_MODEL_ID + )); + } + + #[test] + fn a_named_model_must_actually_be_advertised() { + let advertised = vec!["unsloth/gemma-4-E4B-it-GGUF:Q4_K_M".to_string()]; + assert!(mesh_catalog_shows_model( + &advertised, + "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M" + )); + assert!(!mesh_catalog_shows_model(&advertised, "some/other-model")); + } + + #[test] + fn a_named_model_ignores_the_main_revision_suffix() { + let advertised = vec!["unsloth/gemma-4-E4B-it-GGUF:Q4_K_M@main".to_string()]; + assert!(mesh_catalog_shows_model( + &advertised, + "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M" + )); + } + + #[test] + fn readiness_failure_is_catalog_sync_when_model_never_visible() { + assert_eq!( + classify_mesh_readiness_failure(false), + MeshReadinessFailure::CatalogNeverSynced + ); + } + + #[test] + fn readiness_failure_is_routing_when_model_was_visible() { + assert_eq!( + classify_mesh_readiness_failure(true), + MeshReadinessFailure::RoutingNeverCompleted + ); + } + + #[test] + fn readiness_messages_are_distinct_and_actionable() { + let catalog = mesh_readiness_failure_message( + MeshReadinessFailure::CatalogNeverSynced, + "auto", + "HTTP 429", + ); + let routing = mesh_readiness_failure_message( + MeshReadinessFailure::RoutingNeverCompleted, + "auto", + "HTTP 503", + ); + // Distinct diagnoses, each names the model and carries the raw detail. + assert_ne!(catalog, routing); + assert!(catalog.contains("network path")); + assert!(catalog.contains("HTTP 429")); + assert!(routing.contains("did not complete")); + assert!(routing.contains("HTTP 503")); + } +} diff --git a/desktop/src-tauri/src/commands/messages.rs b/desktop/src-tauri/src/commands/messages.rs index b7c37bec3df..1e221b6bd18 100644 --- a/desktop/src-tauri/src/commands/messages.rs +++ b/desktop/src-tauri/src/commands/messages.rs @@ -3,19 +3,24 @@ use tauri::{AppHandle, State}; mod forum; -use forum::{forum_message_from_event, forum_reply_from_event}; +use forum::{ + apply_link_preview_suppression, fetch_agent_owner_pubkeys, link_preview_suppression_targets, +}; +pub use forum::{get_forum_posts, get_forum_thread}; use crate::{ app_state::AppState, events, managed_agents::{find_managed_agent_mut, load_managed_agents, ManagedAgentRecord}, models::{ - FeedItemInfo, FeedMeta, FeedResponse, FeedSections, ForumMessageInfo, ForumPostsResponse, - ForumThreadReplyInfo, ForumThreadResponse, SearchResponse, SendChannelMessageResponse, - ThreadRepliesResponse, + FeedItemCategory, FeedItemInfo, FeedMeta, FeedResponse, FeedSections, SearchResponse, + SendChannelMessageResponse, ThreadRepliesResponse, }, nostr_convert, - relay::{query_relay, submit_event, submit_event_with_keys}, + relay::{ + assert_expected_relay_scope, assert_expected_signer, query_relay, submit_event, + submit_event_at_created_at, submit_event_with_keys_created_at, + }, }; // ── Reads (pure-nostr) ────────────────────────────────────────────────────── @@ -113,13 +118,34 @@ pub async fn get_feed( Vec::new() }; + let mention_ids = mention_events + .iter() + .map(|event| event.id.to_hex()) + .collect::>(); + let mention_edits = if mention_ids.is_empty() { + Vec::new() + } else { + query_relay( + &state, + &[serde_json::json!({ "kinds": [40003], "#e": mention_ids })], + ) + .await + .unwrap_or_default() + }; + let mention_owner_pubkeys = fetch_agent_owner_pubkeys(&state, &mention_events).await; + let suppressed_mentions = + link_preview_suppression_targets(&mention_events, &mention_edits, &mention_owner_pubkeys); let mentions: Vec = mention_events .iter() - .map(|ev| feed_item_from_event(ev, "mentions")) + .map(|ev| { + let mut item = feed_item_from_event(ev, FeedItemCategory::Mention); + apply_link_preview_suppression(&mut item.tags, &item.id, &suppressed_mentions); + item + }) .collect(); let needs_action: Vec = approval_events .iter() - .map(|ev| feed_item_from_event(ev, "needs_action")) + .map(|ev| feed_item_from_event(ev, FeedItemCategory::NeedsAction)) .collect(); let total = (mentions.len() + needs_action.len()) as u64; @@ -192,7 +218,7 @@ pub async fn search_messages( until: Option, state: State<'_, AppState>, ) -> Result { - let cap = limit.unwrap_or(20).min(100); + let cap = search_messages_limit(limit); let filter = build_search_messages_filter( &q, cap, @@ -206,95 +232,15 @@ pub async fn search_messages( Ok(nostr_convert::search_response_from_events(&events)) } -#[tauri::command] -pub async fn get_forum_posts( - channel_id: String, - limit: Option, - before: Option, - state: State<'_, AppState>, -) -> Result { - let cap = limit.unwrap_or(20).min(100); - let mut filter = serde_json::Map::new(); - filter.insert("kinds".to_string(), serde_json::json!([45001])); - filter.insert("#h".to_string(), serde_json::json!([channel_id.clone()])); - filter.insert("limit".to_string(), serde_json::json!(cap)); - if let Some(t) = before { - filter.insert("until".to_string(), serde_json::json!(t)); - } - - let events = query_relay(&state, &[serde_json::Value::Object(filter)]).await?; - let messages: Vec = events - .iter() - .map(|ev| forum_message_from_event(ev, &channel_id)) - .collect(); - - let next_cursor = messages.last().map(|m| m.created_at); - Ok(ForumPostsResponse { - messages, - next_cursor, - }) -} - -#[tauri::command] -pub async fn get_forum_thread( - channel_id: String, - event_id: String, - limit: Option, - cursor: Option, - state: State<'_, AppState>, -) -> Result { - let _ = (limit, cursor); - // Two filters: the root event itself, plus any reply (kinds 9/45003) - // that references it via #e. - let events = query_relay( - &state, - &[ - serde_json::json!({ "ids": [event_id.clone()], "kinds": [9, 40002, 45001, 45003] }), - serde_json::json!({ - "kinds": [9, 45003], - "#e": [event_id.clone()], - "#h": [channel_id.clone()], - }), - ], - ) - .await?; - - let mut root: Option = None; - let mut replies: Vec = Vec::new(); - for ev in &events { - if ev.id.to_hex() == event_id { - root = Some(forum_message_from_event(ev, &channel_id)); - } else { - replies.push(forum_reply_from_event(ev, &channel_id, &event_id)); - } - } - let total_replies = replies.len() as u32; - - let root = root.ok_or_else(|| "forum thread root event not found".to_string())?; - Ok(ForumThreadResponse { - root, - replies, - total_replies, - next_cursor: None, - }) +fn search_messages_limit(limit: Option) -> u32 { + limit.unwrap_or(20).min(500) } -/// Fetch the full reply subtree under a thread root, server-side. -/// -/// Unlike the channel timeline (which the desktop assembles from its local -/// cache by grouping on `e`-root tags), this walks `thread_metadata` on the -/// relay via `get_thread_replies`, so a thread renders complete even when its -/// replies fell outside the channel cold-load window. Results are chronological -/// (oldest first) and are the *replies* under the root (depth >= 1); the root -/// event itself is NOT returned (the relay query keys on `root_event_id`, and a -/// root row has no `root_event_id`). Callers already hold the root — it is the -/// open thread head — so this closes the descendant gap without re-fetching it. +/// Fetch the reply subtree and its auxiliary events under a thread root. /// /// Paging is forward keyset on `(created_at, event_id)`: pass the `next_cursor` /// from a previous page back as `cursor` to fetch the next batch. The event-id -/// tiebreak is required because replies routinely share a `created_at` second; -/// a timestamp-only cursor would skip every tied reply past the page limit. -/// `next_cursor` is `Some` only when a full page was returned. +/// tiebreak prevents same-second replies from being skipped. #[tauri::command] pub async fn get_thread_replies( root_event_id: String, @@ -318,8 +264,12 @@ pub async fn get_thread_replies( // A full page implies there may be more; hand back the last event's // composite key as the next cursor (the DB returns replies strictly after // it, tiebroken by event_id so same-second replies are not skipped). - let next_cursor = if events.len() as u32 >= cap { - events.last().map(|ev| crate::models::ThreadCursor { + let reply_events: Vec<_> = events + .iter() + .filter(|event| TIMELINE_KINDS.contains(&(event.kind.as_u16() as u32))) + .collect(); + let next_cursor = if reply_events.len() as u32 >= cap { + reply_events.last().map(|ev| crate::models::ThreadCursor { created_at: ev.created_at.as_secs() as i64, event_id: ev.id.to_hex(), }) @@ -338,21 +288,9 @@ pub async fn get_thread_replies( }) } -/// Build the relay `/query` filter for the server-side thread-subtree read. -/// -/// The relay routes a filter to `get_thread_replies` purely off a single `#e` -/// (root) tag plus `depth_limit` — kind is NOT part of that routing or the -/// underlying DB query (it keys on `root_event_id`). Yet `kinds` is still -/// required here: the bridge runs the p-gate (`p_gated_filters_authorized`) on -/// every filter *before* routing, and a kindless filter "could match" a p-gated -/// kind, so the gate demands a `#p` tag we don't send -> HTTP 403 -/// `restricted: p-gated kinds require #p tag`, before the thread query ever -/// runs. Carrying non-p-gated [`TIMELINE_KINDS`] makes the filter provably -/// un-p-gated so it clears the gate. `build_channel_messages_before_filter` is -/// the sibling that already does this, which is why the dense-second channel -/// pager was never gated and this reader was. Extracted so a unit test can pin -/// that `kinds` is present (the e2e mock does not model p-gating, so only a -/// unit test guards this contract). +/// Build the relay `/query` filter for a thread-subtree read. +/// `kinds` is required to prove the filter cannot match p-gated events; without +/// it, relay authorization rejects this otherwise kindless query. fn build_thread_replies_filter( root_event_id: &str, channel_id: Option<&str>, @@ -367,6 +305,7 @@ fn build_thread_replies_filter( // defaults it to a deep-but-bounded value so nested replies aren't dropped. filter.insert("depth_limit".to_string(), serde_json::json!(depth_limit)); filter.insert("limit".to_string(), serde_json::json!(cap)); + filter.insert("include_aux".to_string(), serde_json::json!(true)); if let Some(cid) = channel_id { filter.insert("#h".to_string(), serde_json::json!([cid])); } @@ -457,74 +396,13 @@ pub async fn get_channel_messages_before( }) } -#[tauri::command] -pub async fn get_event(event_id: String, state: State<'_, AppState>) -> Result { - let events = query_relay( - &state, - &[serde_json::json!({ - "ids": [event_id], - "kinds": [0, 1, 3, 5, 7, 9, 30078, 40002, 40003, 40008, 40099, 40100, 45001, 45003, buzz_core_pkg::kind::KIND_HUDDLE_STARTED], - "limit": 1 - })], - ) - .await?; - - let ev = events - .first() - .ok_or_else(|| "event not found".to_string())?; - serde_json::to_string(ev).map_err(|e| format!("serialize event: {e}")) -} +mod event_batch; +pub use event_batch::{get_event, get_events}; // ── Writes ────────────────────────────────────────────────────────────────── -/// Fetch a parent event and extract the thread root from its NIP-10 e-tags. -async fn resolve_thread_ref( - parent_event_id: &str, - state: &AppState, -) -> Result { - let parent_eid = - EventId::from_hex(parent_event_id).map_err(|e| format!("invalid parent event ID: {e}"))?; - - let evs = query_relay( - state, - &[serde_json::json!({ - "ids": [parent_event_id], - "kinds": [9, 40002, 45001, 45003, buzz_core_pkg::kind::KIND_HUDDLE_STARTED], - "limit": 1 - })], - ) - .await?; - - let parent = evs - .first() - .ok_or_else(|| "parent event not found".to_string())?; - - // Walk tags looking for NIP-10 root/reply markers. - let (mut root, mut reply) = (None, None); - for tag in parent.tags.iter() { - let s = tag.as_slice(); - if s.len() >= 4 && s[0] == "e" { - match s[3].as_str() { - "root" => root = Some(s[1].clone()), - "reply" => reply = Some(s[1].clone()), - _ => {} - } - } - } - let root_hex = root.or(reply); - - let root_eid = match root_hex { - Some(hex) if hex != parent_event_id => { - EventId::from_hex(&hex).map_err(|e| format!("invalid root event ID: {e}"))? - } - _ => parent_eid, - }; - - Ok(events::ThreadRef { - root_event_id: root_eid, - parent_event_id: parent_eid, - }) -} +mod thread_ref; +use thread_ref::{resolve_thread_ref, thread_ref}; #[tauri::command] #[allow(clippy::too_many_arguments)] @@ -532,11 +410,16 @@ pub async fn send_channel_message( channel_id: String, content: String, parent_event_id: Option, + root_event_id: Option, media_tags: Option>>, emoji_tags: Option>>, mention_tags: Option>>, + link_preview_tags: Option>>, + sent_from_thread_tag: Option>, mention_pubkeys: Option>, kind: Option, + expected_relay_url: Option, + expected_signer_pubkey: Option, state: State<'_, AppState>, ) -> Result { let channel_uuid = uuid::Uuid::parse_str(&channel_id) @@ -546,7 +429,31 @@ pub async fn send_channel_message( let media = media_tags.unwrap_or_default(); let emoji = emoji_tags.unwrap_or_default(); let mention_refs_only = mention_tags.unwrap_or_default(); + let link_previews = link_preview_tags.unwrap_or_default(); + // Resolve the relay AND the signing identity once and use them for every + // read and the submission. Callers that captured a tenant scope before an + // await (Projects agent sends) pass `expected_relay_url` and + // `expected_signer_pubkey`; a mismatch on either means the active + // community changed mid-flight and the send must fail closed rather than + // publish the captured tenant's content to the new tenant's relay — or + // sign it under the new tenant's identity. The relay check alone cannot + // catch the latter: relay and keys mutate under separate locks during a + // workspace switch, so the keys are snapshotted here, asserted, and that + // exact snapshot signs the event and its NIP-98 auth below. + let relay_base = crate::relay::relay_api_base_url_with_override(&state); + assert_expected_relay_scope(expected_relay_url.as_deref(), &relay_base)?; + let signing_keys = state.signing_keys()?; + assert_expected_signer( + expected_signer_pubkey.as_deref(), + &signing_keys.public_key().to_hex(), + )?; let kind_num = kind.unwrap_or(buzz_core_pkg::kind::KIND_STREAM_MESSAGE); + if sent_from_thread_tag.is_some() && kind_num != buzz_core_pkg::kind::KIND_STREAM_MESSAGE { + return Err("sent-from-thread provenance requires a stream message".into()); + } + if root_event_id.is_some() && parent_event_id.is_none() { + return Err("root_event_id requires parent_event_id".into()); + } let mut resolved_root: Option = None; @@ -562,7 +469,14 @@ pub async fn send_channel_message( let parent_id = parent_event_id .as_deref() .ok_or("forum comment requires parent_event_id")?; - let thread_ref = resolve_thread_ref(parent_id, &state).await?; + let thread_ref = thread_ref( + parent_id, + root_event_id.as_deref(), + &state, + &relay_base, + Some(&signing_keys), + ) + .await?; resolved_root = Some(thread_ref.root_event_id.to_hex()); events::build_forum_comment( channel_uuid, @@ -576,7 +490,14 @@ pub async fn send_channel_message( _ => { let thread_ref = match parent_event_id.as_deref() { Some(pid) => { - let tr = resolve_thread_ref(pid, &state).await?; + let tr = thread_ref( + pid, + root_event_id.as_deref(), + &state, + &relay_base, + Some(&signing_keys), + ) + .await?; resolved_root = Some(tr.root_event_id.to_hex()); Some(tr) } @@ -590,11 +511,20 @@ pub async fn send_channel_message( &media, &emoji, &mention_refs_only, + &link_previews, + sent_from_thread_tag.as_deref(), + &relay_base, )? } }; - let result = submit_event(builder, &state).await?; + // `created_at` is the signed event's own second, not a post-publication + // clock read — persisted as an event cursor by the Projects opener. + // Submit through the base resolved (and scope-checked) above and the + // identity snapshotted (and signer-checked) above — a re-resolve or key + // re-read here would reopen the mid-command switch window. + let (result, created_at) = + submit_event_at_created_at(builder, &state, &relay_base, &signing_keys).await?; let depth = match (&parent_event_id, &resolved_root) { (None, _) => 0, @@ -608,7 +538,7 @@ pub async fn send_channel_message( root_event_id: resolved_root, parent_event_id, depth, - created_at: chrono::Utc::now().timestamp(), + created_at, }) } @@ -756,6 +686,9 @@ fn build_managed_agent_channel_message( &[], &[], &[], + &[], + None, + &crate::relay::relay_api_base_url(), client_tags, ) } @@ -808,7 +741,18 @@ pub async fn send_managed_agent_channel_message( let submission_auth_tag = managed_agent_submission_auth_tag(&record, &state, &keys.public_key())?; let thread_ref = match parent_event_id.as_deref() { - Some(parent_id) => Some(resolve_thread_ref(parent_id, &state).await?), + Some(parent_id) => Some( + // Same active-relay resolution as before — this path has no + // caller-captured tenant scope (yet), so resolve the override + // here and read through it with the active identity. + resolve_thread_ref( + parent_id, + &state, + &crate::relay::relay_api_base_url_with_override(&state), + None, + ) + .await?, + ), None => None, }; @@ -853,15 +797,18 @@ pub async fn send_managed_agent_channel_message( &mentions, &client_tags, )?; - let result = - submit_event_with_keys(builder, &state, &keys, submission_auth_tag.as_deref()).await?; + // Same contract as `send_channel_message`: `created_at` is the signed + // event's, not a post-publication clock read. + let (result, created_at) = + submit_event_with_keys_created_at(builder, &state, &keys, submission_auth_tag.as_deref()) + .await?; Ok(SendChannelMessageResponse { event_id: result.event_id, parent_event_id: parent_event_id.clone(), root_event_id: thread_ref.map(|reference| reference.root_event_id.to_hex()), depth: if parent_event_id.is_some() { 1 } else { 0 }, - created_at: chrono::Utc::now().timestamp(), + created_at, }) } @@ -919,38 +866,55 @@ pub async fn remove_reaction( Ok(()) } -#[tauri::command] -pub async fn edit_message( +#[derive(serde::Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct EditMessageInput { channel_id: String, event_id: String, content: String, + #[serde(default)] media_tags: Vec>, - emoji_tags: Option>>, - // Pubkeys of mentions *newly added* by this edit (the composer diffs the - // edited body against the original). Only these get a `p` tag, so a typo-fix - // edit that leaves the mention set unchanged never re-wakes anyone. - mention_pubkeys: Option>, + #[serde(default)] + emoji_tags: Vec>, + // Pubkeys of mentions *newly added* by this edit. Only these get a `p` + // tag, so a typo-fix edit never re-wakes existing mentions. + #[serde(default)] + mention_pubkeys: Vec, + // Full stable mention identity set selected in the edited composer. `None` + // means a partial edit that must preserve the existing snapshot; `Some`, + // including an empty set, authoritatively replaces it. + mention_tags: Option>>, + #[serde(default)] + suppress_link_previews: bool, +} + +#[tauri::command] +pub async fn edit_message( + input: EditMessageInput, state: State<'_, AppState>, ) -> Result<(), String> { - let channel_uuid = uuid::Uuid::parse_str(&channel_id) - .map_err(|_| format!("invalid channel UUID: {channel_id}"))?; - let target_eid = EventId::from_hex(&event_id).map_err(|e| format!("invalid event ID: {e}"))?; - let trimmed = content.trim(); + let channel_uuid = uuid::Uuid::parse_str(&input.channel_id) + .map_err(|_| format!("invalid channel UUID: {}", input.channel_id))?; + let target_eid = + EventId::from_hex(&input.event_id).map_err(|e| format!("invalid event ID: {e}"))?; + let trimmed = input.content.trim(); // Empty text is allowed when the edit still carries imeta attachments // (a media-only edit). Reject only when both are empty. - if trimmed.is_empty() && media_tags.is_empty() { + if trimmed.is_empty() && input.media_tags.is_empty() { return Err("edit must have content or attachments".into()); } - let emoji = emoji_tags.unwrap_or_default(); - let mentions = mention_pubkeys.unwrap_or_default(); - let mention_refs: Vec<&str> = mentions.iter().map(|s| s.as_str()).collect(); + let mention_refs: Vec<&str> = input.mention_pubkeys.iter().map(|s| s.as_str()).collect(); let builder = events::build_message_edit( channel_uuid, target_eid, trimmed, - &media_tags, - &emoji, - &mention_refs, + events::MessageEditTags { + media: &input.media_tags, + custom_emoji: &input.emoji_tags, + mentions: &mention_refs, + mention_refs: input.mention_tags.as_deref(), + }, + input.suppress_link_previews, )?; submit_event(builder, &state).await?; Ok(()) @@ -987,7 +951,7 @@ fn tags_to_vec(ev: &nostr::Event) -> Vec> { ev.tags.iter().map(|t| t.as_slice().to_vec()).collect() } -fn feed_item_from_event(ev: &nostr::Event, category: &str) -> FeedItemInfo { +fn feed_item_from_event(ev: &nostr::Event, category: FeedItemCategory) -> FeedItemInfo { let channel_id = channel_id_from_tags(ev); FeedItemInfo { id: ev.id.to_hex(), @@ -999,7 +963,7 @@ fn feed_item_from_event(ev: &nostr::Event, category: &str) -> FeedItemInfo { channel_name: String::new(), channel_type: None, tags: tags_to_vec(ev), - category: category.to_string(), + category, } } #[cfg(test)] diff --git a/desktop/src-tauri/src/commands/messages/event_batch.rs b/desktop/src-tauri/src/commands/messages/event_batch.rs new file mode 100644 index 00000000000..1bb51748683 --- /dev/null +++ b/desktop/src-tauri/src/commands/messages/event_batch.rs @@ -0,0 +1,128 @@ +use std::collections::HashSet; + +use tauri::State; + +use crate::{app_state::AppState, relay::query_relay}; + +// The relay clamps a single filter to this many events. Keep exact-ID reads in +// chunks so a large workflow list cannot silently lose late presentations. +const EVENT_QUERY_CHUNK_SIZE: usize = 1_000; + +const GET_EVENT_KINDS: [u32; 15] = [ + 0, + 1, + 3, + 5, + 7, + 9, + 30078, + 40002, + 40003, + 40008, + 40099, + 40100, + 45001, + 45003, + buzz_core_pkg::kind::KIND_HUDDLE_STARTED, +]; + +#[tauri::command] +pub async fn get_event(event_id: String, state: State<'_, AppState>) -> Result { + let events = query_relay( + &state, + &[serde_json::json!({ + "ids": [event_id], + "kinds": GET_EVENT_KINDS, + "limit": 1 + })], + ) + .await?; + + let event = events + .first() + .ok_or_else(|| "event not found".to_string())?; + serde_json::to_string(event).map_err(|error| format!("serialize event: {error}")) +} + +/// Resolve many exact event IDs in relay-sized chunks. Callers still validate +/// event kind, channel scope, and requested ID before using presentation data. +fn normalized_event_id_chunks(event_ids: Vec) -> Vec> { + let mut seen_ids = HashSet::new(); + let event_ids = event_ids + .into_iter() + .map(|event_id| event_id.trim().to_ascii_lowercase()) + .filter(|event_id| event_id.len() == 64 && event_id.chars().all(|c| c.is_ascii_hexdigit())) + .filter(|event_id| seen_ids.insert(event_id.clone())) + .collect::>(); + event_ids + .chunks(EVENT_QUERY_CHUNK_SIZE) + .map(<[String]>::to_vec) + .collect() +} + +#[tauri::command] +pub async fn get_events( + event_ids: Vec, + state: State<'_, AppState>, +) -> Result, String> { + let event_id_chunks = normalized_event_id_chunks(event_ids); + if event_id_chunks.is_empty() { + return Ok(Vec::new()); + } + + let mut events_by_id = std::collections::HashMap::new(); + for event_ids in event_id_chunks { + let events = query_relay( + &state, + &[serde_json::json!({ + "ids": event_ids, + "kinds": GET_EVENT_KINDS, + "limit": event_ids.len() + })], + ) + .await?; + for event in events { + events_by_id.entry(event.id).or_insert(event); + } + } + + events_by_id + .into_values() + .map(|event| { + serde_json::to_value(event).map_err(|error| format!("serialize event: {error}")) + }) + .collect() +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn keeps_exact_relay_ceiling_in_one_chunk() { + let chunks = normalized_event_id_chunks( + (0..EVENT_QUERY_CHUNK_SIZE) + .map(|index| format!("{index:064x}")) + .collect(), + ); + + assert_eq!(chunks.len(), 1); + assert_eq!(chunks[0].len(), EVENT_QUERY_CHUNK_SIZE); + } + + #[test] + fn normalizes_deduplicates_and_keeps_ids_beyond_relay_ceiling() { + let last_id = format!("{:064x}", EVENT_QUERY_CHUNK_SIZE); + let mut event_ids = (0..=EVENT_QUERY_CHUNK_SIZE) + .map(|index| format!("{index:064X}")) + .collect::>(); + event_ids.extend(["not-an-event-id".to_string(), format!(" {last_id} ")]); + + let chunks = normalized_event_id_chunks(event_ids); + + assert_eq!(chunks.iter().map(Vec::len).sum::(), 1_001); + assert_eq!(chunks.len(), 2); + assert_eq!(chunks[0].len(), EVENT_QUERY_CHUNK_SIZE); + assert_eq!(chunks[1], [last_id]); + } +} diff --git a/desktop/src-tauri/src/commands/messages/forum.rs b/desktop/src-tauri/src/commands/messages/forum.rs index ffcf3a62e05..086e8c9f793 100644 --- a/desktop/src-tauri/src/commands/messages/forum.rs +++ b/desktop/src-tauri/src/commands/messages/forum.rs @@ -1,4 +1,41 @@ -use crate::models::{ForumMessageInfo, ForumThreadReplyInfo, ThreadSummary}; +use tauri::State; + +use crate::{ + app_state::AppState, + models::{ + ForumMessageInfo, ForumPostsResponse, ForumThreadReplyInfo, ForumThreadResponse, + ThreadSummary, + }, + relay::query_relay, +}; + +pub(super) async fn fetch_agent_owner_pubkeys( + state: &AppState, + events: &[nostr::Event], +) -> std::collections::HashMap { + let authors = events + .iter() + .map(|event| event.pubkey.to_hex()) + .collect::>() + .into_iter() + .collect::>(); + if authors.is_empty() { + return std::collections::HashMap::new(); + } + + super::query_relay( + state, + &[serde_json::json!({ "kinds": [0], "authors": authors })], + ) + .await + .unwrap_or_default() + .into_iter() + .filter_map(|profile| { + crate::nostr_convert::profile_valid_oa_owner_pubkey(&profile) + .map(|owner| (profile.pubkey.to_hex(), owner)) + }) + .collect() +} fn tags_to_vec(event: &nostr::Event) -> Vec> { event @@ -68,3 +105,214 @@ pub(super) fn forum_reply_from_event( reactions: serde_json::Value::Null, } } + +pub(super) fn link_preview_suppression_targets( + originals: &[nostr::Event], + edits: &[nostr::Event], + owner_pubkeys: &std::collections::HashMap, +) -> std::collections::HashSet { + let originals_by_id = originals + .iter() + .map(|event| (event.id.to_hex(), event)) + .collect::>(); + + edits + .iter() + .filter(|event| { + event.kind.as_u16() == 40003 + && event + .tags + .iter() + .any(|tag| tag.as_slice() == ["link-preview".to_string(), "none".to_string()]) + }) + .filter_map(|edit| { + let target_id = edit.tags.iter().find_map(|tag| { + let values = tag.as_slice(); + (values.first().map(String::as_str) == Some("e")) + .then(|| values.get(1).cloned()) + .flatten() + })?; + let target = originals_by_id.get(&target_id)?; + let author = target.pubkey.to_hex(); + let signer = edit.pubkey.to_hex(); + (signer == author || owner_pubkeys.get(&author) == Some(&signer)).then_some(target_id) + }) + .collect() +} + +pub(super) fn apply_link_preview_suppression( + tags: &mut Vec>, + event_id: &str, + suppressed: &std::collections::HashSet, +) { + if suppressed.contains(event_id) + && !tags + .iter() + .any(|tag| tag.as_slice() == ["link-preview".to_string(), "none".to_string()]) + { + tags.push(vec!["link-preview".to_string(), "none".to_string()]); + } +} + +#[tauri::command] +pub async fn get_forum_posts( + channel_id: String, + limit: Option, + before: Option, + state: State<'_, AppState>, +) -> Result { + let cap = limit.unwrap_or(20).min(100); + let mut filter = serde_json::Map::new(); + filter.insert("kinds".to_string(), serde_json::json!([45001])); + filter.insert("#h".to_string(), serde_json::json!([channel_id.clone()])); + filter.insert("limit".to_string(), serde_json::json!(cap)); + if let Some(t) = before { + filter.insert("until".to_string(), serde_json::json!(t)); + } + + let events = query_relay(&state, &[serde_json::Value::Object(filter)]).await?; + let ids = events + .iter() + .map(|event| event.id.to_hex()) + .collect::>(); + let edits = if ids.is_empty() { + Vec::new() + } else { + query_relay( + &state, + &[serde_json::json!({ "kinds": [40003], "#e": ids })], + ) + .await + .unwrap_or_default() + }; + let owner_pubkeys = fetch_agent_owner_pubkeys(&state, &events).await; + let suppressed = link_preview_suppression_targets(&events, &edits, &owner_pubkeys); + let messages: Vec = events + .iter() + .map(|ev| { + let mut message = forum_message_from_event(ev, &channel_id); + apply_link_preview_suppression(&mut message.tags, &message.event_id, &suppressed); + message + }) + .collect(); + + let next_cursor = messages.last().map(|m| m.created_at); + Ok(ForumPostsResponse { + messages, + next_cursor, + }) +} + +#[tauri::command] +pub async fn get_forum_thread( + channel_id: String, + event_id: String, + limit: Option, + cursor: Option, + state: State<'_, AppState>, +) -> Result { + let _ = (limit, cursor); + // Two filters: the root event itself, plus any reply (kinds 9/45003) + // that references it via #e. + let events = query_relay( + &state, + &[ + serde_json::json!({ "ids": [event_id.clone()], "kinds": [9, 40002, 45001, 45003] }), + serde_json::json!({ + "kinds": [9, 45003], + "#e": [event_id.clone()], + "#h": [channel_id.clone()], + }), + ], + ) + .await?; + let ids = events + .iter() + .map(|event| event.id.to_hex()) + .collect::>(); + let edits = if ids.is_empty() { + Vec::new() + } else { + query_relay( + &state, + &[serde_json::json!({ "kinds": [40003], "#e": ids })], + ) + .await + .unwrap_or_default() + }; + let owner_pubkeys = fetch_agent_owner_pubkeys(&state, &events).await; + let suppressed = link_preview_suppression_targets(&events, &edits, &owner_pubkeys); + + let mut root: Option = None; + let mut replies: Vec = Vec::new(); + for ev in &events { + if ev.id.to_hex() == event_id { + let mut message = forum_message_from_event(ev, &channel_id); + apply_link_preview_suppression(&mut message.tags, &message.event_id, &suppressed); + root = Some(message); + } else if ev.kind.as_u16() as u32 != 40003 { + let mut reply = forum_reply_from_event(ev, &channel_id, &event_id); + apply_link_preview_suppression(&mut reply.tags, &reply.event_id, &suppressed); + replies.push(reply); + } + } + let total_replies = replies.len() as u32; + + let root = root.ok_or_else(|| "forum thread root event not found".to_string())?; + Ok(ForumThreadResponse { + root, + replies, + total_replies, + next_cursor: None, + }) +} + +#[cfg(test)] +mod tests { + use super::*; + use nostr::{EventBuilder, Keys, Kind}; + + fn signed_event(keys: &Keys, kind: u16, tags: Vec>) -> nostr::Event { + let tags = tags + .into_iter() + .map(nostr::Tag::parse) + .collect::, _>>() + .expect("valid tags"); + EventBuilder::new(Kind::Custom(kind), "body") + .tags(tags) + .sign_with_keys(keys) + .expect("event signs") + } + + #[test] + fn suppression_targets_accepts_author_and_verified_owner_only() { + let author = Keys::generate(); + let owner = Keys::generate(); + let attacker = Keys::generate(); + let original = signed_event(&author, 9, Vec::new()); + let marker = vec!["link-preview".to_string(), "none".to_string()]; + let target = vec!["e".to_string(), original.id.to_hex()]; + let author_edit = signed_event(&author, 40003, vec![target.clone(), marker.clone()]); + let owner_edit = signed_event(&owner, 40003, vec![target.clone(), marker.clone()]); + let spoofed_edit = signed_event(&attacker, 40003, vec![target, marker]); + let owners = std::collections::HashMap::from([( + author.public_key().to_hex(), + owner.public_key().to_hex(), + )]); + + for edit in [&author_edit, &owner_edit] { + assert!(link_preview_suppression_targets( + std::slice::from_ref(&original), + std::slice::from_ref(edit), + &owners, + ) + .contains(&original.id.to_hex())); + } + assert!(link_preview_suppression_targets( + std::slice::from_ref(&original), + std::slice::from_ref(&spoofed_edit), + &owners, + ) + .is_empty()); + } +} diff --git a/desktop/src-tauri/src/commands/messages/thread_ref.rs b/desktop/src-tauri/src/commands/messages/thread_ref.rs new file mode 100644 index 00000000000..8ec82beebb7 --- /dev/null +++ b/desktop/src-tauri/src/commands/messages/thread_ref.rs @@ -0,0 +1,97 @@ +use nostr::{EventId, Keys}; + +use crate::{ + app_state::AppState, + events, + relay::{query_relay_at, query_relay_at_with_keys}, +}; + +/// Build a thread reference from a renderer-supplied root and parent. +/// +/// Both IDs are parsed before signing. This path intentionally performs no +/// relay query: the renderer supplies a root only when the parent is already +/// present in its cache and the root can be read from that event's NIP-10 tags. +pub(super) fn provided_thread_ref( + root_event_id: &str, + parent_event_id: &str, +) -> Result { + let root_event_id = + EventId::from_hex(root_event_id).map_err(|e| format!("invalid root event ID: {e}"))?; + let parent_event_id = + EventId::from_hex(parent_event_id).map_err(|e| format!("invalid parent event ID: {e}"))?; + Ok(events::ThreadRef { + root_event_id, + parent_event_id, + }) +} + +pub(super) async fn thread_ref( + parent_event_id: &str, + root_event_id: Option<&str>, + state: &AppState, + api_base_url: &str, + signing_keys: Option<&Keys>, +) -> Result { + match root_event_id { + Some(root_event_id) => provided_thread_ref(root_event_id, parent_event_id), + None => resolve_thread_ref(parent_event_id, state, api_base_url, signing_keys).await, + } +} + +/// Fetch a parent event and extract the thread root from its NIP-10 e-tags. +/// +/// Reads through the explicit `api_base_url` the calling command resolved — +/// never re-resolving the workspace override — so a mid-command community +/// switch cannot split one logical send across two relays. Callers that +/// pinned a signer snapshot pass it as `keys` so this read's NIP-98 auth is +/// minted by the same identity that signs the eventual event; `None` +/// preserves the active-identity read for unpinned callers. +pub(super) async fn resolve_thread_ref( + parent_event_id: &str, + state: &AppState, + api_base_url: &str, + keys: Option<&nostr::Keys>, +) -> Result { + let parent_eid = + EventId::from_hex(parent_event_id).map_err(|e| format!("invalid parent event ID: {e}"))?; + + let filters = [serde_json::json!({ + "ids": [parent_event_id], + "kinds": [9, 40002, 45001, 45003, buzz_core_pkg::kind::KIND_HUDDLE_STARTED], + "limit": 1 + })]; + let evs = match keys { + Some(keys) => query_relay_at_with_keys(state, api_base_url, &filters, keys, None).await?, + None => query_relay_at(state, api_base_url, &filters).await?, + }; + + let parent = evs + .first() + .ok_or_else(|| "parent event not found".to_string())?; + + // Walk tags looking for NIP-10 root/reply markers. + let (mut root, mut reply) = (None, None); + for tag in parent.tags.iter() { + let s = tag.as_slice(); + if s.len() >= 4 && s[0] == "e" { + match s[3].as_str() { + "root" => root = Some(s[1].clone()), + "reply" => reply = Some(s[1].clone()), + _ => {} + } + } + } + let root_hex = root.or(reply); + + let root_eid = match root_hex { + Some(hex) if hex != parent_event_id => { + EventId::from_hex(&hex).map_err(|e| format!("invalid root event ID: {e}"))? + } + _ => parent_eid, + }; + + Ok(events::ThreadRef { + root_event_id: root_eid, + parent_event_id: parent_eid, + }) +} diff --git a/desktop/src-tauri/src/commands/messages_tests.rs b/desktop/src-tauri/src/commands/messages_tests.rs index a907a3dff1d..627e6326432 100644 --- a/desktop/src-tauri/src/commands/messages_tests.rs +++ b/desktop/src-tauri/src/commands/messages_tests.rs @@ -1,5 +1,12 @@ use super::*; +#[test] +fn search_messages_limit_allows_discussion_discovery_page() { + assert_eq!(search_messages_limit(None), 20); + assert_eq!(search_messages_limit(Some(500)), 500); + assert_eq!(search_messages_limit(Some(1_000)), 500); +} + #[test] fn marker_author_scope_validates_scope_and_required_pubkey() { assert_eq!( @@ -164,6 +171,7 @@ fn thread_replies_filter_carries_non_p_gated_kinds_to_clear_the_gate() { assert_eq!(filter["#e"], serde_json::json!(["root-hex"])); assert_eq!(filter["depth_limit"], serde_json::json!(64)); assert_eq!(filter["#h"], serde_json::json!(["channel-1"])); + assert_eq!(filter["include_aux"], serde_json::json!(true)); } #[test] @@ -217,3 +225,54 @@ fn legacy_managed_agent_auth_tag_skips_self_attestation() { assert_eq!(tag, None); } + +#[test] +fn provided_thread_ref_validates_and_preserves_root_and_parent() { + let root = "11".repeat(32); + let parent = "22".repeat(32); + let thread_ref = thread_ref::provided_thread_ref(&root, &parent) + .expect("valid 64-hex event ids should be accepted"); + assert_eq!(thread_ref.root_event_id.to_hex(), root); + assert_eq!(thread_ref.parent_event_id.to_hex(), parent); + assert!(thread_ref::provided_thread_ref("not-hex", &parent).is_err()); +} + +/// `FeedItem.category` is a wire contract with the desktop frontend +/// (`desktop/src/shared/api/types.ts`). The frontend routes notification +/// sounds, titles, mute-bypass, and inbox labels off these exact strings, so +/// the serialized form must stay singular `mention` — not the plural section +/// name `mentions` used by `FeedSections` and the `--types` filter. +#[test] +fn feed_item_category_serializes_to_frontend_contract() { + let cases = [ + (FeedItemCategory::Mention, "mention"), + (FeedItemCategory::NeedsAction, "needs_action"), + (FeedItemCategory::Activity, "activity"), + (FeedItemCategory::AgentActivity, "agent_activity"), + ]; + for (category, expected) in cases { + let value = serde_json::to_value(category).expect("category should serialize"); + assert_eq!(value, serde_json::Value::String(expected.to_string())); + } +} + +#[test] +fn feed_item_from_event_carries_singular_mention_category() { + let pubkey = Keys::generate().public_key().to_hex(); + let event = build_managed_agent_channel_message( + uuid::Uuid::new_v4(), + "hey @you", + None, + std::slice::from_ref(&pubkey), + &[], + ) + .expect("message should build") + .sign_with_keys(&Keys::generate()) + .expect("message should sign"); + + let item = feed_item_from_event(&event, FeedItemCategory::Mention); + let json = serde_json::to_value(&item).expect("feed item should serialize"); + + assert_eq!(json["category"], "mention"); + assert_eq!(json["id"], event.id.to_hex()); +} diff --git a/desktop/src-tauri/src/commands/mod.rs b/desktop/src-tauri/src/commands/mod.rs index 66ef7ef17b7..7cb2d8e3b83 100644 --- a/desktop/src-tauri/src/commands/mod.rs +++ b/desktop/src-tauri/src/commands/mod.rs @@ -1,3 +1,4 @@ +mod agent_access; mod agent_auth; mod agent_config; mod agent_discovery; @@ -11,6 +12,7 @@ mod agent_settings; mod agent_update_rollback; mod agents; mod canvas; +mod channel_reconnect_repair; mod channel_templates; mod channel_window; mod channels; @@ -24,14 +26,19 @@ mod identity_archive; mod join_policy; mod legacy_storage; mod link_preview; +mod managed_agent_definition; pub(crate) mod media; mod media_animated; mod media_download; mod media_gif; +mod media_raw; mod media_snapshot_png; mod media_transcode; +mod media_upload_progress; #[cfg(feature = "mesh-llm")] pub(crate) mod mesh_llm; +#[cfg(feature = "mesh-llm")] +pub(crate) mod mesh_readiness; mod messages; mod notifications; mod observer_archive; @@ -44,8 +51,11 @@ mod project_git; mod project_git_branches; mod project_git_diff; mod project_git_exec; +mod project_git_file_content; mod project_git_merge_error; mod project_git_push; +mod project_git_recipient_notes; +mod project_git_types; mod project_git_workflow; mod project_repo_paths; mod project_terminal; @@ -61,6 +71,7 @@ mod window_vibrancy; mod workflows; mod workspace; +pub use agent_access::*; pub use agent_auth::*; pub use agent_config::*; pub use agent_discovery::*; @@ -71,6 +82,7 @@ pub use agent_providers::*; pub use agent_settings::*; pub use agents::*; pub use canvas::*; +pub use channel_reconnect_repair::*; pub use channel_templates::*; pub use channel_window::*; pub use channels::*; @@ -85,6 +97,7 @@ pub use legacy_storage::*; pub use link_preview::*; pub use media::*; pub use media_download::*; +pub use media_raw::*; #[cfg(feature = "mesh-llm")] pub use mesh_llm::*; pub use messages::*; @@ -98,6 +111,8 @@ pub use profile::*; pub use project_git::*; pub use project_git_branches::*; pub use project_git_diff::*; +pub use project_git_file_content::*; +pub use project_git_recipient_notes::*; pub use project_git_workflow::*; pub use project_terminal::*; pub use qr_download::*; diff --git a/desktop/src-tauri/src/commands/notifications.rs b/desktop/src-tauri/src/commands/notifications.rs index c13d96ff6da..79aa15f969a 100644 --- a/desktop/src-tauri/src/commands/notifications.rs +++ b/desktop/src-tauri/src/commands/notifications.rs @@ -1,4 +1,4 @@ -//! Native (Linux) desktop-notification helper. +//! Native desktop-notification helpers. //! //! `tauri-plugin-notification` posts a notification by calling `notify_rust`'s //! `show()` and then immediately dropping the returned `NotificationHandle`. @@ -13,13 +13,15 @@ //! action, which we forward to the frontend so it can focus the window and //! route to the notification target. +pub(crate) const NATIVE_NOTIFICATION_ACTIVATED_EVENT: &str = "native-notification-activated"; + /// Show a desktop notification natively. /// -/// On Linux this uses the connection-preserving path described above. On other -/// platforms the bundled notification plugin already works correctly, so the -/// frontend never calls this and we simply report that it is unused. +/// Linux uses the connection-preserving D-Bus path described above. macOS uses +/// one application-lifetime `UNUserNotificationCenterDelegate`; it does not +/// allocate a listener or waiter for each notification. #[tauri::command] -pub fn show_native_notification( +pub async fn show_native_notification( app: tauri::AppHandle, title: String, body: Option, @@ -31,21 +33,24 @@ pub fn show_native_notification( Ok(()) } - #[cfg(not(target_os = "linux"))] + #[cfg(target_os = "macos")] + { + let _ = app; + crate::macos_notifications::show(title, body, target).await + } + + #[cfg(not(any(target_os = "linux", target_os = "macos")))] { let _ = (&app, &title, &body, &target); - Err("show_native_notification is only supported on Linux".to_string()) + Err("show_native_notification is only supported on Linux and macOS".to_string()) } } #[cfg(target_os = "linux")] mod linux { + use super::NATIVE_NOTIFICATION_ACTIVATED_EVENT; use tauri::Emitter; - /// Emitted to the frontend when the user clicks a native notification. The - /// payload is the opaque target object the frontend passed in. - const ACTIVATE_EVENT: &str = "native-notification-activated"; - pub fn show( app: tauri::AppHandle, title: String, @@ -96,7 +101,7 @@ mod linux { // The frontend focuses the window on activation (the same path // every other platform uses), so we only forward the target. - let _ = app.emit(ACTIVATE_EVENT, target); + let _ = app.emit(NATIVE_NOTIFICATION_ACTIVATED_EVENT, target); }); }); } diff --git a/desktop/src-tauri/src/commands/observer_archive.rs b/desktop/src-tauri/src/commands/observer_archive.rs index 707e86b63a7..d8b2832b927 100644 --- a/desktop/src-tauri/src/commands/observer_archive.rs +++ b/desktop/src-tauri/src/commands/observer_archive.rs @@ -1,54 +1,18 @@ -//! Build-time flag and runtime dev-nest check for observer-feed archive policy. +//! Observer-feed archive default — always enabled. //! -//! `observer_archive_default_enabled()` returns `true` when either: -//! - `BUZZ_BUILD_OBSERVER_ARCHIVE_DEFAULT` was set at build time (internal -//! builds bake in the flag via `build.rs`), **or** -//! - the running binary is using the dev nest (`~/.buzz-dev`), which is the -//! case for all dev builds launched with `just staging` or `just dev`. -//! -//! When `true`, the frontend reconciles the observer archive subscription -//! every startup — unconditionally ensuring kind 24200 exists in the DB -//! regardless of stale localStorage markers. -//! -//! OSS prod builds (baked flag unset, prod nest `~/.buzz`) return `false` — -//! no reconciliation; the user manages the subscription via Settings. +//! `observer_archive_default_enabled()` returns `true` unconditionally. +//! The frontend calls this every startup to decide whether to reconcile the +//! `owner_p` subscription for kind 24200 (observer frames). Kind 24200 events +//! are ephemeral — not stored by the relay — so local archiving is the only +//! way to retain them. -/// Returns `true` when observer-feed archive policy is enforced. +/// Returns `true`: observer-feed archive defaults to enabled for all builds. /// -/// True when the build has the internal baked flag set, or when the running -/// binary is using the dev nest (`~/.buzz-dev`). The frontend calls this -/// every startup to decide whether to reconcile the `owner_p` subscription. +/// The frontend reconciles the `owner_p` subscription every startup when this +/// returns `true`. A user who has explicitly disabled the toggle keeps it off +/// because the Settings card's explicit-opt-out path deletes the subscription +/// and the seed hook skips identities that already have an explicit choice. #[tauri::command] pub fn observer_archive_default_enabled() -> bool { - option_env!("BUZZ_DESKTOP_BUILD_OBSERVER_ARCHIVE_DEFAULT").is_some() - || crate::managed_agents::nest_is_dev() -} - -#[cfg(test)] -mod tests { - use super::*; - - // `nest_is_dev()` is deterministic-false in unit tests: NEST_DIR OnceLock - // is uninitialized → falls back to prod `~/.buzz` (nest.rs:101-106), so - // the compiled flag is the sole variable. No runner normalization needed. - // - // #[ignore]: requires BUZZ_TEST_EXPECTED_OBSERVER_ARCHIVE_DEFAULT to be - // set — `just desktop-tauri-test-compiled-flags` runs it explicitly with - // `--ignored` under both compile states; general `cargo test` skips it. - #[test] - #[ignore] - fn test_observer_archive_default_enabled_matches_expected() { - let result = observer_archive_default_enabled(); - let expected_str = std::env::var("BUZZ_TEST_EXPECTED_OBSERVER_ARCHIVE_DEFAULT").expect( - "BUZZ_TEST_EXPECTED_OBSERVER_ARCHIVE_DEFAULT must be set — \ - the dual-compile CI step supplies it; bare `cargo test` is \ - not sufficient to validate compiled-flag behavior", - ); - let expected = expected_str == "true" || expected_str == "1"; - assert_eq!( - result, expected, - "observer_archive_default_enabled() returned {result}, \ - expected {expected} (BUZZ_TEST_EXPECTED_OBSERVER_ARCHIVE_DEFAULT={expected_str:?})" - ); - } + true } diff --git a/desktop/src-tauri/src/commands/pairing.rs b/desktop/src-tauri/src/commands/pairing.rs index fc874a01500..aedd67854c1 100644 --- a/desktop/src-tauri/src/commands/pairing.rs +++ b/desktop/src-tauri/src/commands/pairing.rs @@ -9,7 +9,7 @@ use buzz_core_pkg::pairing::types::{AbortReason, PayloadType}; use futures_util::{SinkExt, StreamExt}; use nostr::ToBech32; use serde::Serialize; -use tauri::{AppHandle, Emitter, State}; +use tauri::{AppHandle, Emitter, Manager, State}; use tokio::sync::mpsc; use tokio_tungstenite::{connect_async, tungstenite::Message}; use tokio_util::sync::CancellationToken; @@ -33,16 +33,36 @@ struct PairingErrorPayload { message: String, } +#[derive(Clone, Copy, PartialEq, Eq)] +enum PairingMode { + SendIdentity, + RecoverIdentity, +} + +#[derive(Clone)] +struct PairingTaskContext { + mode: PairingMode, + generation: Arc, + generation_fence: Arc>, + task_generation: u64, +} + /// Managed Tauri state for an active pairing session. pub struct PairingHandle { session: Arc>>, generation: Arc, + /// Linearizes cancellation/replacement against recovered identity commits. + generation_fence: Arc>, + /// Serializes session setup so an older start cannot resume after relay + /// discovery and overwrite a newer session's shared state. + start_lock: tokio::sync::Mutex<()>, cancel: std::sync::Mutex>, /// Send JSON-serialized events to the background WS task for relay publication. outbound_tx: std::sync::Mutex>>, /// Pre-built payload string (contains nsec) to send after SAS confirmation. /// Wrapped in Zeroizing so the nsec is cleared from memory on drop. payload: std::sync::Mutex>>, + mode: Arc>, } impl PairingHandle { @@ -50,9 +70,12 @@ impl PairingHandle { Self { session: Arc::new(tokio::sync::Mutex::new(None)), generation: Arc::new(AtomicU64::new(0)), + generation_fence: Arc::new(std::sync::Mutex::new(())), + start_lock: tokio::sync::Mutex::new(()), cancel: std::sync::Mutex::new(None), outbound_tx: std::sync::Mutex::new(None), payload: std::sync::Mutex::new(None), + mode: Arc::new(std::sync::Mutex::new(PairingMode::SendIdentity)), } } @@ -63,21 +86,36 @@ impl PairingHandle { } } -/// Start a NIP-AB pairing session as the source device. -/// -/// Creates a `PairingSession`, connects to the relay, and returns the -/// `nostrpair://` QR URI for the frontend to display. The mobile peer will -/// receive the desktop's nsec (NIP-OA auth — no token minting needed). +/// Start a NIP-AB pairing session that sends this desktop identity to mobile. #[tauri::command] pub async fn start_pairing( app: AppHandle, state: State<'_, AppState>, pairing: State<'_, PairingHandle>, ) -> Result { - let task_generation = pairing - .generation - .fetch_add(1, Ordering::SeqCst) - .wrapping_add(1); + start_pairing_session(app, state, pairing, PairingMode::SendIdentity).await +} + +/// Start a recovery session. The fresh desktop shows the QR and receives the +/// full identity from an already-authorized phone after both users approve SAS. +#[tauri::command] +pub async fn start_identity_recovery_pairing( + app: AppHandle, + state: State<'_, AppState>, + pairing: State<'_, PairingHandle>, +) -> Result { + start_pairing_session(app, state, pairing, PairingMode::RecoverIdentity).await +} + +async fn start_pairing_session( + app: AppHandle, + state: State<'_, AppState>, + pairing: State<'_, PairingHandle>, + mode: PairingMode, +) -> Result { + let _start_guard = pairing.start_lock.lock().await; + let task_generation = + invalidate_pairing_generation(&pairing.generation, &pairing.generation_fence)?; if let Some(token) = pairing.cancel.lock().map_err(|e| e.to_string())?.take() { token.cancel(); } @@ -86,54 +124,52 @@ pub async fn start_pairing( let mut session = pairing.session.lock().await; *session = None; } - - let keys = state.signing_keys()?; - let nsec = keys - .secret_key() - .to_bech32() - .map_err(|e| format!("encode nsec: {e}"))?; - let pubkey_hex = keys.public_key().to_hex(); + *pairing.mode.lock().map_err(|e| e.to_string())? = mode; + *pairing.payload.lock().map_err(|e| e.to_string())? = None; let ws_url = relay_ws_url_with_override(&state); let http_url = relay_api_base_url_with_override(&state); - - // NIP-43 relays gate connections on membership, so an unpaired peer can't - // reach the main relay yet — it must go through the /pair sidecar. Open - // relays (no NIP-43) accept the peer directly. We key off the relay's - // own NIP-11 declaration of NIP-43 support rather than `auth_required`, - // which is also true for plain NIP-42 / NIP-OA relays where the main - // relay is reachable. let pairing_relay_url = resolve_pairing_relay_url(&ws_url, probe_pairing_relay(&ws_url).await)?; - let (session, qr_payload) = PairingSession::new_source(pairing_relay_url.clone()); - let qr_uri = encode_qr(&qr_payload); + let mut qr_uri = encode_qr(&qr_payload); + if mode == PairingMode::RecoverIdentity { + qr_uri.push_str("&mode=recover"); + } - let payload_json = serde_json::json!({ - "relayUrl": http_url, - "pubkey": pubkey_hex, - "nsec": nsec, - }); + if mode == PairingMode::SendIdentity { + let keys = state.signing_keys()?; + let nsec = keys + .secret_key() + .to_bech32() + .map_err(|e| format!("encode nsec: {e}"))?; + let payload_json = serde_json::json!({ + "relayUrl": http_url, + "pubkey": keys.public_key().to_hex(), + "nsec": nsec, + }); + *pairing.payload.lock().map_err(|e| e.to_string())? = + Some(Zeroizing::new(payload_json.to_string())); + } { - let mut s = pairing.session.lock().await; - *s = Some(session); + let mut active = pairing.session.lock().await; + *active = Some(session); } - *pairing.payload.lock().map_err(|e| e.to_string())? = - Some(Zeroizing::new(payload_json.to_string())); let (outbound_tx, outbound_rx) = mpsc::channel::(16); let cancel = CancellationToken::new(); - *pairing.outbound_tx.lock().map_err(|e| e.to_string())? = Some(outbound_tx); *pairing.cancel.lock().map_err(|e| e.to_string())? = Some(cancel.clone()); - let session_arc = Arc::clone(&pairing.session); - let generation = Arc::clone(&pairing.generation); tauri::async_runtime::spawn(pairing_ws_task( pairing_relay_url, - session_arc, - generation, - task_generation, + Arc::clone(&pairing.session), + PairingTaskContext { + mode, + generation: Arc::clone(&pairing.generation), + generation_fence: Arc::clone(&pairing.generation_fence), + task_generation, + }, cancel, outbound_rx, app, @@ -161,27 +197,30 @@ pub async fn confirm_pairing_sas(pairing: State<'_, PairingHandle>) -> Result<() tx.send(sas_confirm_json) .await - .map_err(|_| "failed to send sas-confirm")?; - - let payload = pairing - .payload - .lock() - .map_err(|e| e.to_string())? - .take() - .ok_or("no payload prepared")?; + .map_err(|_| "Pairing code expired. Create a new code and try again.")?; - let payload_json = { - let mut guard = pairing.session.lock().await; - let session = guard.as_mut().ok_or("no active pairing session")?; - let event = session - .send_payload(PayloadType::Custom, payload) - .map_err(|e| e.to_string())?; - event_to_relay_json(&event) - }; - - tx.send(payload_json) - .await - .map_err(|_| "failed to send payload")?; + let mode = *pairing.mode.lock().map_err(|e| e.to_string())?; + if mode == PairingMode::SendIdentity { + let payload = pairing + .payload + .lock() + .map_err(|e| e.to_string())? + .take() + .ok_or("no payload prepared")?; + + let payload_json = { + let mut guard = pairing.session.lock().await; + let session = guard.as_mut().ok_or("no active pairing session")?; + let event = session + .send_payload(PayloadType::Custom, payload) + .map_err(|e| e.to_string())?; + event_to_relay_json(&event) + }; + + tx.send(payload_json) + .await + .map_err(|_| "failed to send payload")?; + } Ok(()) } @@ -189,6 +228,14 @@ pub async fn confirm_pairing_sas(pairing: State<'_, PairingHandle>) -> Result<() /// Cancel the active pairing session. #[tauri::command] pub async fn cancel_pairing(pairing: State<'_, PairingHandle>) -> Result<(), String> { + // Invalidate the task before waiting for its session lock. Recovery may be + // blocked on identity persistence after releasing this lock, and must see + // cancellation before crossing the durable commit boundary. + invalidate_pairing_generation(&pairing.generation, &pairing.generation_fence)?; + if let Some(token) = pairing.cancel.lock().map_err(|e| e.to_string())?.take() { + token.cancel(); + } + let abort_json = { let mut guard = pairing.session.lock().await; if let Some(session) = guard.as_mut() { @@ -213,11 +260,6 @@ pub async fn cancel_pairing(pairing: State<'_, PairingHandle>) -> Result<(), Str } } - pairing.generation.fetch_add(1, Ordering::SeqCst); - - if let Some(token) = pairing.cancel.lock().map_err(|e| e.to_string())?.take() { - token.cancel(); - } pairing.clear(); { @@ -231,8 +273,7 @@ pub async fn cancel_pairing(pairing: State<'_, PairingHandle>) -> Result<(), Str async fn pairing_ws_task( relay_url: String, session: Arc>>, - generation: Arc, - task_generation: u64, + context: PairingTaskContext, cancel: CancellationToken, mut outbound_rx: mpsc::Receiver, app: AppHandle, @@ -240,26 +281,24 @@ async fn pairing_ws_task( if let Err(e) = pairing_ws_task_inner( &relay_url, &session, - &generation, - task_generation, + &context, &cancel, &mut outbound_rx, &app, ) .await { - if pairing_task_is_current(&generation, task_generation) { + if pairing_task_is_current(&context.generation, context.task_generation) { let _ = app.emit("pairing-error", PairingErrorPayload { message: e }); } } - clear_pairing_session_if_current(&session, &generation, task_generation).await; + clear_pairing_session_if_current(&session, &context.generation, context.task_generation).await; } async fn pairing_ws_task_inner( relay_url: &str, session: &Arc>>, - generation: &AtomicU64, - task_generation: u64, + context: &PairingTaskContext, cancel: &CancellationToken, outbound_rx: &mut mpsc::Receiver, app: &AppHandle, @@ -290,14 +329,14 @@ async fn pairing_ws_task_inner( tokio::pin!(hard_timeout); loop { - if !pairing_task_is_current(generation, task_generation) { + if !pairing_task_is_current(&context.generation, context.task_generation) { break; } tokio::select! { _ = cancel.cancelled() => break, _ = &mut hard_timeout => { - if pairing_task_is_current(generation, task_generation) { + if pairing_task_is_current(&context.generation, context.task_generation) { let _ = app.emit("pairing-error", PairingErrorPayload { message: "Session timed out".into(), }); @@ -317,7 +356,7 @@ async fn pairing_ws_task_inner( let Message::Text(text) = msg else { continue }; if let Some(event) = parse_relay_event(text.as_str(), "pair") { - if !pairing_task_is_current(generation, task_generation) { + if !pairing_task_is_current(&context.generation, context.task_generation) { break; } @@ -325,7 +364,7 @@ async fn pairing_ws_task_inner( let Some(s) = guard.as_mut() else { break }; if let Ok(reason) = s.handle_abort(&event) { - if pairing_task_is_current(generation, task_generation) { + if pairing_task_is_current(&context.generation, context.task_generation) { let _ = app.emit("pairing-aborted", PairingAbortedPayload { reason: format!("{reason:?}"), }); @@ -334,28 +373,83 @@ async fn pairing_ws_task_inner( } if let Ok(sas) = s.handle_offer(&event) { - if pairing_task_is_current(generation, task_generation) { + if pairing_task_is_current(&context.generation, context.task_generation) { let _ = app.emit("pairing-sas-received", PairingSasPayload { sas }); } continue; } - match s.handle_complete(&event) { - Ok(()) => { - if pairing_task_is_current(generation, task_generation) { - let _ = app.emit("pairing-complete", serde_json::json!({})); + if context.mode == PairingMode::RecoverIdentity { + if let Ok((payload_type, payload)) = s.handle_return_payload(&event) { + if let Err(message) = validate_recovery_payload_type(payload_type) { + let complete = s + .send_source_complete(false) + .map_err(|e| e.to_string())?; + write + .send(Message::Text(event_to_relay_json(&complete).into())) + .await + .map_err(|e| format!("publish complete failed: {e}"))?; + if pairing_task_is_current( + &context.generation, + context.task_generation, + ) { + let _ = app.emit( + "pairing-error", + PairingErrorPayload { message }, + ); + } + break; } + + let payload = payload; + drop(guard); + + let imported = import_recovered_identity( + app, + payload, + &context.generation, + &context.generation_fence, + context.task_generation, + ) + .await; + let success = imported.is_ok(); + let complete = { + let mut guard = session.lock().await; + if !pairing_task_is_current( + &context.generation, + context.task_generation, + ) { + break; + } + let Some(s) = guard.as_mut() else { break }; + s.send_source_complete(success) + .map_err(|e| e.to_string())? + }; + let completion_result = write + .send(Message::Text(event_to_relay_json(&complete).into())) + .await + .map_err(|e| format!("publish complete failed: {e}")); + finish_recovery(imported, completion_result, context, app)?; break; } - Err(ref e) if format!("{e}").contains("success=false") => { - if pairing_task_is_current(generation, task_generation) { - let _ = app.emit("pairing-error", PairingErrorPayload { - message: "Mobile device reported failure importing credentials".into(), - }); + } else { + match s.handle_complete(&event) { + Ok(()) => { + if pairing_task_is_current(&context.generation, context.task_generation) { + let _ = app.emit("pairing-complete", serde_json::json!({})); + } + break; } - break; + Err(ref e) if format!("{e}").contains("success=false") => { + if pairing_task_is_current(&context.generation, context.task_generation) { + let _ = app.emit("pairing-error", PairingErrorPayload { + message: "Mobile device reported failure importing credentials".into(), + }); + } + break; + } + Err(_) => {} } - Err(_) => {} } } } @@ -365,10 +459,111 @@ async fn pairing_ws_task_inner( Ok(()) } +async fn import_recovered_identity( + app: &AppHandle, + nsec: Zeroizing, + generation: &Arc, + generation_fence: &Arc>, + task_generation: u64, +) -> Result<(), String> { + let app = app.clone(); + let generation = Arc::clone(generation); + let generation_fence = Arc::clone(generation_fence); + tokio::task::spawn_blocking(move || { + let keys = nostr::Keys::parse(nsec.trim()) + .map_err(|e| format!("Phone sent an invalid identity: {e}"))?; + let state = app.state::(); + let _mutation_guard = state.identity_mutation.lock().map_err(|e| e.to_string())?; + commit_recovery_if_current(&generation, &generation_fence, task_generation, || { + let data_dir = app + .path() + .app_data_dir() + .map_err(|e| format!("app data dir: {e}"))?; + std::fs::create_dir_all(&data_dir).map_err(|e| format!("create app data dir: {e}"))?; + let key_path = data_dir.join("identity.key"); + crate::commands::identity::commit_imported_identity(&state, &data_dir, keys, |keys| { + let store = + crate::secret_store::SecretStore::shared(crate::app_state::keyring_service()); + crate::app_state::persist_imported_identity(store, keys, &key_path, &data_dir) + })?; + Ok(()) + }) + }) + .await + .map_err(|e| format!("identity recovery task failed: {e}"))? +} + +fn ensure_pairing_task_is_current( + generation: &AtomicU64, + task_generation: u64, +) -> Result<(), String> { + if pairing_task_is_current(generation, task_generation) { + Ok(()) + } else { + Err("Pairing session was superseded or cancelled".into()) + } +} + +fn invalidate_pairing_generation( + generation: &AtomicU64, + generation_fence: &std::sync::Mutex<()>, +) -> Result { + let _fence = generation_fence.lock().map_err(|e| e.to_string())?; + Ok(generation.fetch_add(1, Ordering::SeqCst).wrapping_add(1)) +} + +fn commit_recovery_if_current( + generation: &AtomicU64, + generation_fence: &std::sync::Mutex<()>, + task_generation: u64, + commit: impl FnOnce() -> Result, +) -> Result { + let _fence = generation_fence.lock().map_err(|e| e.to_string())?; + ensure_pairing_task_is_current(generation, task_generation)?; + commit() +} + +fn recovery_result_after_completion( + imported: Result<(), String>, + _completion_result: Result<(), String>, +) -> Result<(), String> { + // Once the identity is durable, notifying the peer cannot roll it back. + imported +} + +fn finish_recovery( + imported: Result<(), String>, + completion_result: Result<(), String>, + context: &PairingTaskContext, + app: &AppHandle, +) -> Result<(), String> { + if !pairing_task_is_current(&context.generation, context.task_generation) { + return Ok(()); + } + + match recovery_result_after_completion(imported, completion_result) { + Ok(()) => { + let _ = app.emit("pairing-complete", serde_json::json!({})); + } + Err(message) => { + let _ = app.emit("pairing-error", PairingErrorPayload { message }); + } + } + Ok(()) +} + fn pairing_task_is_current(generation: &AtomicU64, task_generation: u64) -> bool { generation.load(Ordering::SeqCst) == task_generation } +fn validate_recovery_payload_type(payload_type: PayloadType) -> Result<(), String> { + if payload_type == PayloadType::Nsec { + Ok(()) + } else { + Err("Mobile device sent an unsupported recovery payload".into()) + } +} + async fn clear_pairing_session_if_current( session: &Arc>>, generation: &AtomicU64, @@ -590,143 +785,9 @@ where } #[cfg(test)] -mod pairing_generation_tests { - use std::sync::atomic::{AtomicU64, Ordering}; - use std::sync::Arc; - - use super::{clear_pairing_session_if_current, PairingSession}; - - #[tokio::test] - async fn stale_task_does_not_clear_replacement_session() { - let (initial, _) = PairingSession::new_source("ws://initial.example".to_string()); - let session = Arc::new(tokio::sync::Mutex::new(Some(initial))); - let generation = AtomicU64::new(1); - - generation.store(2, Ordering::SeqCst); - let (replacement, _) = PairingSession::new_source("ws://replacement.example".to_string()); - *session.lock().await = Some(replacement); - - clear_pairing_session_if_current(&session, &generation, 1).await; - - assert!(session.lock().await.is_some()); - } - - #[tokio::test] - async fn current_task_clears_its_session() { - let (active, _) = PairingSession::new_source("ws://active.example".to_string()); - let session = Arc::new(tokio::sync::Mutex::new(Some(active))); - let generation = AtomicU64::new(3); - - clear_pairing_session_if_current(&session, &generation, 3).await; - - assert!(session.lock().await.is_none()); - } -} +#[path = "pairing_generation_tests.rs"] +mod pairing_generation_tests; #[cfg(test)] -mod pairing_relay_tests { - use super::{ - pairing_relay_from_nip11, probe_pairing_relay, resolve_pairing_relay_url, PairingRelay, - }; - use tokio::io::{AsyncReadExt, AsyncWriteExt}; - - #[tokio::test] - async fn live_nip11_probe_discovers_configured_pairing_relay() { - let listener = tokio::net::TcpListener::bind("127.0.0.1:0") - .await - .expect("bind test NIP-11 server"); - let addr = listener.local_addr().expect("test server address"); - let server = tokio::spawn(async move { - let (mut stream, _) = listener.accept().await.expect("accept NIP-11 request"); - let mut request = vec![0; 2048]; - let bytes_read = stream.read(&mut request).await.expect("read request"); - let request = String::from_utf8_lossy(&request[..bytes_read]); - assert!(request.starts_with("GET / HTTP/1.1")); - assert!(request - .to_ascii_lowercase() - .contains("accept: application/nostr+json")); - - let body = r#"{"pairing_relay_url":"ws://127.0.0.1:5000"}"#; - let response = format!( - "HTTP/1.1 200 OK\r\nContent-Type: application/nostr+json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", - body.len() - ); - stream - .write_all(response.as_bytes()) - .await - .expect("write response"); - }); - - assert_eq!( - probe_pairing_relay(&format!("ws://{addr}")).await, - PairingRelay::Configured("ws://127.0.0.1:5000".to_string()) - ); - server.await.expect("NIP-11 server task"); - } - - #[test] - fn configured_pairing_relay_takes_precedence_over_legacy_path() { - let document = serde_json::json!({ - "pairing_relay_url": "wss://pairing.buzz.xyz", - "supported_nips": [43] - }); - - assert_eq!( - pairing_relay_from_nip11(&document), - PairingRelay::Configured("wss://pairing.buzz.xyz".to_string()) - ); - } - - #[test] - fn invalid_pairing_relay_url_falls_back_to_legacy_path() { - let document = serde_json::json!({ - "pairing_relay_url": "https://pairing.buzz.xyz", - "supported_nips": [43] - }); - - assert_eq!( - pairing_relay_from_nip11(&document), - PairingRelay::LegacyPath - ); - } - - #[test] - fn document_without_pairing_configuration_uses_main_relay() { - let document = serde_json::json!({ "supported_nips": [1, 11] }); - - assert_eq!(pairing_relay_from_nip11(&document), PairingRelay::MainRelay); - } - - #[test] - fn configured_pairing_relay_resolves_to_configured_url() { - let resolved = resolve_pairing_relay_url( - "wss://flint.communities.buzz.xyz", - PairingRelay::Configured("wss://pairing.buzz.xyz".to_string()), - ) - .expect("resolve configured pairing relay"); - - assert_eq!(resolved, "wss://pairing.buzz.xyz"); - } - - #[test] - fn legacy_pairing_relay_appends_pair_path() { - let resolved = resolve_pairing_relay_url( - "wss://flint.communities.buzz.xyz/community", - PairingRelay::LegacyPath, - ) - .expect("resolve legacy pairing relay"); - - assert_eq!(resolved, "wss://flint.communities.buzz.xyz/community/pair"); - } - - #[test] - fn main_relay_pairing_uses_main_relay_url() { - let resolved = resolve_pairing_relay_url( - "wss://sprout-oss.stage.blox.sqprod.co", - PairingRelay::MainRelay, - ) - .expect("resolve main pairing relay"); - - assert_eq!(resolved, "wss://sprout-oss.stage.blox.sqprod.co"); - } -} +#[path = "pairing_relay_tests.rs"] +mod pairing_relay_tests; diff --git a/desktop/src-tauri/src/commands/pairing_generation_tests.rs b/desktop/src-tauri/src/commands/pairing_generation_tests.rs new file mode 100644 index 00000000000..8a2291ae86f --- /dev/null +++ b/desktop/src-tauri/src/commands/pairing_generation_tests.rs @@ -0,0 +1,129 @@ +use std::sync::atomic::{AtomicU64, Ordering}; +use std::sync::Arc; +use std::time::Duration; + +use super::{ + clear_pairing_session_if_current, commit_recovery_if_current, invalidate_pairing_generation, + recovery_result_after_completion, validate_recovery_payload_type, PairingHandle, + PairingSession, PayloadType, +}; + +#[tokio::test] +async fn overlapping_starts_are_serialized() { + let pairing = Arc::new(PairingHandle::new()); + let first_pairing = Arc::clone(&pairing); + let (locked_tx, locked_rx) = tokio::sync::oneshot::channel(); + let first = tokio::spawn(async move { + let _guard = first_pairing.start_lock.lock().await; + locked_tx.send(()).expect("signal acquired start lock"); + tokio::time::sleep(Duration::from_millis(50)).await; + }); + + locked_rx.await.expect("first start acquired lock"); + assert!(pairing.start_lock.try_lock().is_err()); + first.await.expect("first start task"); + assert!(pairing.start_lock.try_lock().is_ok()); +} + +#[test] +fn recovery_rejects_non_nsec_payloads() { + assert!(validate_recovery_payload_type(PayloadType::Nsec).is_ok()); + assert_eq!( + validate_recovery_payload_type(PayloadType::Custom).unwrap_err(), + "Mobile device sent an unsupported recovery payload" + ); +} + +#[test] +fn superseded_recovery_cannot_commit_identity() { + let generation = AtomicU64::new(2); + let committed = std::sync::atomic::AtomicBool::new(false); + + let generation_fence = std::sync::Mutex::new(()); + let result = commit_recovery_if_current(&generation, &generation_fence, 1, || { + committed.store(true, Ordering::SeqCst); + Ok(()) + }); + + assert_eq!( + result.unwrap_err(), + "Pairing session was superseded or cancelled" + ); + assert!(!committed.load(Ordering::SeqCst)); +} + +#[test] +fn invalidation_after_check_waits_for_identity_commit() { + let generation = Arc::new(AtomicU64::new(7)); + let generation_fence = Arc::new(std::sync::Mutex::new(())); + let (checked_tx, checked_rx) = std::sync::mpsc::channel(); + let (finish_tx, finish_rx) = std::sync::mpsc::channel(); + let committed = Arc::new(std::sync::atomic::AtomicBool::new(false)); + + let recovery_generation = Arc::clone(&generation); + let recovery_fence = Arc::clone(&generation_fence); + let recovery_committed = Arc::clone(&committed); + let recovery = std::thread::spawn(move || { + commit_recovery_if_current(&recovery_generation, &recovery_fence, 7, || { + checked_tx.send(()).expect("signal generation checked"); + finish_rx.recv().expect("release identity commit"); + recovery_committed.store(true, Ordering::SeqCst); + Ok(()) + }) + }); + + checked_rx.recv().expect("generation checked"); + let invalidation_generation = Arc::clone(&generation); + let invalidation_fence = Arc::clone(&generation_fence); + let (attempted_tx, attempted_rx) = std::sync::mpsc::channel(); + let (invalidated_tx, invalidated_rx) = std::sync::mpsc::channel(); + let invalidation = std::thread::spawn(move || { + attempted_tx.send(()).expect("signal invalidation attempt"); + let next = invalidate_pairing_generation(&invalidation_generation, &invalidation_fence) + .expect("invalidate generation"); + invalidated_tx.send(next).expect("signal invalidated"); + }); + + attempted_rx.recv().expect("invalidation attempted"); + assert!(invalidated_rx + .recv_timeout(Duration::from_millis(50)) + .is_err()); + assert!(!committed.load(Ordering::SeqCst)); + + finish_tx.send(()).expect("finish identity commit"); + recovery.join().expect("recovery task").unwrap(); + assert!(committed.load(Ordering::SeqCst)); + assert_eq!(invalidated_rx.recv().expect("invalidation completed"), 8); + invalidation.join().expect("invalidation task"); +} + +#[test] +fn completion_publish_failure_does_not_undo_successful_import() { + assert!(recovery_result_after_completion(Ok(()), Err("socket closed".into())).is_ok()); +} + +#[tokio::test] +async fn stale_task_does_not_clear_replacement_session() { + let (initial, _) = PairingSession::new_source("ws://initial.example".to_string()); + let session = Arc::new(tokio::sync::Mutex::new(Some(initial))); + let generation = AtomicU64::new(1); + + generation.store(2, Ordering::SeqCst); + let (replacement, _) = PairingSession::new_source("ws://replacement.example".to_string()); + *session.lock().await = Some(replacement); + + clear_pairing_session_if_current(&session, &generation, 1).await; + + assert!(session.lock().await.is_some()); +} + +#[tokio::test] +async fn current_task_clears_its_session() { + let (active, _) = PairingSession::new_source("ws://active.example".to_string()); + let session = Arc::new(tokio::sync::Mutex::new(Some(active))); + let generation = AtomicU64::new(3); + + clear_pairing_session_if_current(&session, &generation, 3).await; + + assert!(session.lock().await.is_none()); +} diff --git a/desktop/src-tauri/src/commands/pairing_relay_tests.rs b/desktop/src-tauri/src/commands/pairing_relay_tests.rs new file mode 100644 index 00000000000..f0e765eb9c5 --- /dev/null +++ b/desktop/src-tauri/src/commands/pairing_relay_tests.rs @@ -0,0 +1,104 @@ +use super::{ + pairing_relay_from_nip11, probe_pairing_relay, resolve_pairing_relay_url, PairingRelay, +}; +use tokio::io::{AsyncReadExt, AsyncWriteExt}; + +#[tokio::test] +async fn live_nip11_probe_discovers_configured_pairing_relay() { + let listener = tokio::net::TcpListener::bind("127.0.0.1:0") + .await + .expect("bind test NIP-11 server"); + let addr = listener.local_addr().expect("test server address"); + let server = tokio::spawn(async move { + let (mut stream, _) = listener.accept().await.expect("accept NIP-11 request"); + let mut request = vec![0; 2048]; + let bytes_read = stream.read(&mut request).await.expect("read request"); + let request = String::from_utf8_lossy(&request[..bytes_read]); + assert!(request.starts_with("GET / HTTP/1.1")); + assert!(request + .to_ascii_lowercase() + .contains("accept: application/nostr+json")); + + let body = r#"{"pairing_relay_url":"ws://127.0.0.1:5000"}"#; + let response = format!( + "HTTP/1.1 200 OK\r\nContent-Type: application/nostr+json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", + body.len() + ); + stream + .write_all(response.as_bytes()) + .await + .expect("write response"); + }); + + assert_eq!( + probe_pairing_relay(&format!("ws://{addr}")).await, + PairingRelay::Configured("ws://127.0.0.1:5000".to_string()) + ); + server.await.expect("NIP-11 server task"); +} + +#[test] +fn configured_pairing_relay_takes_precedence_over_legacy_path() { + let document = serde_json::json!({ + "pairing_relay_url": "wss://pairing.buzz.xyz", + "supported_nips": [43] + }); + + assert_eq!( + pairing_relay_from_nip11(&document), + PairingRelay::Configured("wss://pairing.buzz.xyz".to_string()) + ); +} + +#[test] +fn invalid_pairing_relay_url_falls_back_to_legacy_path() { + let document = serde_json::json!({ + "pairing_relay_url": "https://pairing.buzz.xyz", + "supported_nips": [43] + }); + + assert_eq!( + pairing_relay_from_nip11(&document), + PairingRelay::LegacyPath + ); +} + +#[test] +fn document_without_pairing_configuration_uses_main_relay() { + let document = serde_json::json!({ "supported_nips": [1, 11] }); + + assert_eq!(pairing_relay_from_nip11(&document), PairingRelay::MainRelay); +} + +#[test] +fn configured_pairing_relay_resolves_to_configured_url() { + let resolved = resolve_pairing_relay_url( + "wss://flint.communities.buzz.xyz", + PairingRelay::Configured("wss://pairing.buzz.xyz".to_string()), + ) + .expect("resolve configured pairing relay"); + + assert_eq!(resolved, "wss://pairing.buzz.xyz"); +} + +#[test] +fn legacy_pairing_relay_appends_pair_path() { + let resolved = resolve_pairing_relay_url( + "wss://flint.communities.buzz.xyz/community", + PairingRelay::LegacyPath, + ) + .expect("resolve legacy pairing relay"); + + assert_eq!(resolved, "wss://flint.communities.buzz.xyz/community/pair"); +} + +#[test] +fn main_relay_pairing_uses_main_relay_url() { + let resolved = resolve_pairing_relay_url( + "wss://sprout-oss.stage.blox.sqprod.co", + PairingRelay::MainRelay, + ) + .expect("resolve main pairing relay"); + + assert_eq!(resolved, "wss://sprout-oss.stage.blox.sqprod.co"); +} diff --git a/desktop/src-tauri/src/commands/personas/card.rs b/desktop/src-tauri/src/commands/personas/card.rs new file mode 100644 index 00000000000..14c7c196b2b --- /dev/null +++ b/desktop/src-tauri/src/commands/personas/card.rs @@ -0,0 +1,999 @@ +//! `mint_agent_card` / `save_agent_card` Tauri commands — Agent Trading Cards. +//! +//! Mints a collectible trading-card PNG for an agent via one OpenAI Responses +//! API call (designer model + native `image_generation` tool), then embeds the +//! agent's `buzz_agent_snapshot` manifest through the existing snapshot +//! encoder so the card IS an importable `.agent.png`. +//! +//! Boundary rules (agreed with Wren, buzz-agent-trading-cards thread): +//! - Snapshot construction/injection reuses `agent_snapshot.rs` — cards +//! inherit manifest-v1 behavior, exclusions, and size checks. No card-only +//! wire format exists. +//! - Memory inclusion is opt-in and shares the export flow's semantics: the +//! same three levels (`none`/`core`/`everything`), the same owner-gated +//! `get_agent_memory` fetch, and a memory source DERIVED from the resolved +//! instance (never caller-supplied), so cross-agent memory pairing is +//! structurally impossible. The default is `none`; the encoder still +//! rejects `none` + entries. +//! - The 10 MiB `.agent.png` ceiling is enforced on the FINAL bytes (after +//! resize + chunk injection) via `validate_snapshot_encode_size`. +//! - Round-trip verification decodes the final bytes and compares the logical +//! manifest before anything is returned to the frontend. +//! - The API key is resolved through the same env layering the agent runtime +//! uses (global config < persona < agent record) and never leaves Rust. +//! It is never logged. + +use base64::{engine::general_purpose::STANDARD, Engine as _}; +use serde::{Deserialize, Serialize}; +use tauri::{AppHandle, State}; + +use super::super::export_util::save_bytes_with_dialog; +use super::snapshot::{ + memory_entries_from_listing, parse_memory_level, resolve_from_lists, + validate_snapshot_encode_size, +}; +use crate::{ + app_state::AppState, + commands::engrams::get_agent_memory, + managed_agents::{ + agent_snapshot::{ + build_snapshot, decode_avatar_data_url, decode_snapshot_png, encode_snapshot_png, + extract_chunk_payload_png, MemoryLevel, + }, + agent_snapshot_envelope::{ + decrypt_envelope, encode_locked_snapshot_png, parse_chunk_payload, ChunkPayload, + }, + load_agent_definitions, load_global_agent_config, load_managed_agents, load_personas, + save_global_agent_config, validate_global_config, + }, +}; + +/// The Buzz card frame template — Tyler's gold-honeycomb base. Generation +/// input only: it never participates in the snapshot manifest, PNG chunk, +/// import decoder, or attachment validation. Embedded at compile time for +/// deterministic packaging (see `card_template_decodes` test). +const CARD_TEMPLATE_PNG: &[u8] = include_bytes!("../../../assets/card_template.png"); + +/// Designer model driving copy + art direction. +const DESIGNER_MODEL: &str = "gpt-5.6-sol"; +/// Image model invoked natively via the Responses `image_generation` tool. +const IMAGE_MODEL: &str = "gpt-image-2"; +/// Final card width in pixels (2:3 portrait → 1500x2250). +const CARD_WIDTH: u32 = 1500; +/// Longest edge for the real avatar inlined into an unlocked card's manifest. +/// Kind:0 pictures render small; 512px keeps the doubly-base64-encoded +/// manifest chunk modest next to the 1500-wide card body. +const MANIFEST_AVATAR_MAX_DIM: u32 = 512; +/// Upper bound for a fetched avatar (pre-resize input to the model). +const MAX_AVATAR_FETCH_BYTES: usize = 10 * 1024 * 1024; +/// One mint is a single long API call (~2–3 minutes observed). +const MINT_TIMEOUT_SECS: u64 = 600; + +/// Error prefix the frontend matches to route the user to provider settings +/// instead of showing a raw failure. +pub(crate) const NO_KEY_ERROR_PREFIX: &str = "NO_OPENAI_KEY:"; + +/// Wire shape returned by `mint_agent_card`. +#[derive(Debug, Serialize)] +#[serde(rename_all = "camelCase")] +pub struct MintedCard { + /// Final `.agent.png` bytes (chunk-injected, round-trip verified), + /// base64-encoded for the IPC boundary. + pub card_png_base64: String, + /// Suggested filename, e.g. `eva.agent.png`. + pub file_name: String, + /// Designer commentary emitted alongside the image (may be empty). + pub designer_notes: String, + /// True when the embedded snapshot is NIP-44-encrypted to the + /// (owner, agent) pair — only their nsecs can import this card. + pub locked: bool, + /// How much memory is embedded in the card's snapshot ("none"/"core"/ + /// "everything"). The viewer's import disclosure depends on this. + pub memory_level: MemoryLevel, +} + +// ── Card archive ────────────────────────────────────────────────────────────── + +/// Sidecar metadata for one archived card PNG. Stored as `.json` next +/// to `.agent.png` in the cards dir — two plain files per mint, no +/// shared index to corrupt. Listing scans sidecars; a card whose PNG is +/// missing is skipped rather than failing the whole list. +#[derive(Debug, Clone, Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ArchivedCardMeta { + /// Unique on-disk PNG file name within the cards dir. + pub stored_file_name: String, + /// Suggested save-as name, e.g. `eva.agent.png`. + pub file_name: String, + /// The id the card was minted for (instance pubkey or definition slug). + pub agent_id: String, + pub agent_name: String, + pub designer_notes: String, + pub locked: bool, + /// Memory embedded in this card's snapshot. Defaults to `None` when the + /// sidecar predates the field — every pre-field mint was minted with + /// `MemoryLevel::None` (it was structural), so the default is honest. + #[serde(default)] + pub memory_level: MemoryLevel, + /// ISO-8601 mint timestamp. + pub minted_at: String, + /// Small JPEG preview for gallery grids, base64. Populated by + /// `list_agent_cards` from the sidecar thumb file — never stored in the + /// JSON sidecar itself. + #[serde(default, skip_deserializing)] + pub thumb_jpeg_base64: Option, +} + +fn cards_dir(app: &AppHandle) -> Result { + let dir = crate::managed_agents::managed_agents_base_dir(app)?.join("cards"); + std::fs::create_dir_all(&dir).map_err(|e| format!("failed to create cards dir: {e}"))?; + Ok(dir) +} + +/// Persist a freshly minted card to the archive. Failures are surfaced to the +/// caller (which logs and continues) — an archive write must never fail a +/// mint the user already paid for. +fn archive_minted_card( + app: &AppHandle, + agent_id: &str, + agent_name: &str, + card: &MintedCard, + bytes: &[u8], +) -> Result { + let dir = cards_dir(app)?; + let stem = format!( + "{}-{}", + crate::util::slugify(agent_name, "agent", 50), + uuid::Uuid::new_v4() + ); + let stored_file_name = format!("{stem}.agent.png"); + let meta = ArchivedCardMeta { + stored_file_name: stored_file_name.clone(), + file_name: card.file_name.clone(), + agent_id: agent_id.to_string(), + agent_name: agent_name.to_string(), + designer_notes: card.designer_notes.clone(), + locked: card.locked, + memory_level: card.memory_level, + minted_at: crate::util::now_iso(), + thumb_jpeg_base64: None, + }; + // PNG first, sidecar second: a crash between the two leaves an orphaned + // PNG (invisible to the list), never a sidecar pointing at nothing. + std::fs::write(dir.join(&stored_file_name), bytes) + .map_err(|e| format!("failed to write archived card: {e}"))?; + let meta_json = serde_json::to_string_pretty(&meta) + .map_err(|e| format!("failed to serialize card metadata: {e}"))?; + std::fs::write(dir.join(format!("{stem}.json")), meta_json) + .map_err(|e| format!("failed to write card metadata: {e}"))?; + // Thumb last and best-effort: the gallery grid falls back to lazy + // full-card loading for a card whose thumb is missing. + if let Ok(thumb) = encode_card_thumb(bytes) { + let _ = std::fs::write(dir.join(format!("{stem}.thumb.jpg")), thumb); + } + Ok(meta) +} + +/// Downscale card PNG bytes to a small JPEG for gallery grids. The full card +/// is ~1500x2250 PNG (megabytes); shipping that per card over IPC just to +/// draw a grid tile is waste. +fn encode_card_thumb(bytes: &[u8]) -> Result, String> { + const THUMB_WIDTH: u32 = 300; + let img = image::load_from_memory(bytes).map_err(|e| format!("thumb decode: {e}"))?; + let scale = THUMB_WIDTH as f64 / img.width() as f64; + let thumb = img.resize( + THUMB_WIDTH, + (img.height() as f64 * scale).round().max(1.0) as u32, + image::imageops::FilterType::Triangle, + ); + let mut out = Vec::new(); + // JPEG has no alpha; cards are opaque, so flatten unconditionally. + let rgb = image::DynamicImage::ImageRgb8(thumb.to_rgb8()); + rgb.write_to( + &mut std::io::Cursor::new(&mut out), + image::ImageFormat::Jpeg, + ) + .map_err(|e| format!("thumb encode: {e}"))?; + Ok(out) +} + +/// Reject any archive file name that could escape the cards dir or name a +/// non-archive file. Archive names are generated by `archive_minted_card` +/// (slug + UUID), so a strict shape check loses nothing legitimate. +fn validate_archive_file_name(stored_file_name: &str) -> Result<(), String> { + let valid = stored_file_name.ends_with(".agent.png") + && !stored_file_name.contains(['/', '\\']) + && !stored_file_name.contains(".."); + if !valid { + return Err("Invalid archived card file name.".to_string()); + } + Ok(()) +} + +/// List all archived cards, newest first. +#[tauri::command] +pub fn list_agent_cards(app: AppHandle) -> Result, String> { + let dir = cards_dir(&app)?; + let entries = std::fs::read_dir(&dir).map_err(|e| format!("failed to read cards dir: {e}"))?; + let mut cards = Vec::new(); + for entry in entries.flatten() { + let path = entry.path(); + if path.extension().and_then(|e| e.to_str()) != Some("json") { + continue; + } + let Ok(content) = std::fs::read_to_string(&path) else { + continue; + }; + let Ok(meta) = serde_json::from_str::(&content) else { + // A malformed sidecar hides one card, never the archive. + eprintln!( + "buzz-desktop: card-archive: skipping malformed sidecar {}", + path.display() + ); + continue; + }; + let mut meta = meta; + if validate_archive_file_name(&meta.stored_file_name).is_ok() + && dir.join(&meta.stored_file_name).is_file() + { + // Attach the pre-rendered grid thumb when present (best-effort). + if let Some(stem) = path.file_stem().and_then(|s| s.to_str()) { + meta.thumb_jpeg_base64 = std::fs::read(dir.join(format!("{stem}.thumb.jpg"))) + .ok() + .map(|b| STANDARD.encode(&b)); + } + cards.push(meta); + } + } + // ISO-8601 sorts lexicographically; newest first. + cards.sort_by(|a, b| b.minted_at.cmp(&a.minted_at)); + Ok(cards) +} + +/// Load one archived card's PNG bytes as base64, keyed by its stored file +/// name (as returned by `list_agent_cards`). +#[tauri::command] +pub fn load_agent_card(stored_file_name: String, app: AppHandle) -> Result { + validate_archive_file_name(&stored_file_name)?; + let bytes = std::fs::read(cards_dir(&app)?.join(&stored_file_name)) + .map_err(|e| format!("failed to read archived card: {e}"))?; + Ok(STANDARD.encode(&bytes)) +} + +// ── Key resolution ──────────────────────────────────────────────────────────── + +/// Pure layering: global env < persona env < agent record env, then the +/// process environment as a development fallback. Returns the first +/// non-empty value for `key`. +pub(crate) fn resolve_env_from_layers( + key: &str, + global_env: &std::collections::BTreeMap, + persona_env: &std::collections::BTreeMap, + record_env: &std::collections::BTreeMap, + process_value: Option, +) -> Option { + for layer in [record_env, persona_env, global_env] { + if let Some(v) = layer.get(key) { + let v = v.trim(); + if !v.is_empty() { + return Some(v.to_string()); + } + } + } + process_value.filter(|k| !k.trim().is_empty()) +} + +/// Pure classification: same four env inputs as `resolve_env_from_layers`, +/// returns which layer supplies `OPENAI_API_KEY` (agent > persona > global > +/// process > none). +pub(crate) fn resolve_key_layer( + global_env: &std::collections::BTreeMap, + persona_env: &std::collections::BTreeMap, + record_env: &std::collections::BTreeMap, + process_value: Option, +) -> &'static str { + let key = "OPENAI_API_KEY"; + let nonempty = |m: &std::collections::BTreeMap| { + m.get(key).is_some_and(|v| !v.trim().is_empty()) + }; + if nonempty(record_env) { + return "agent"; + } + if nonempty(persona_env) { + return "persona"; + } + if nonempty(global_env) { + return "global"; + } + let proc = process_value.as_deref().unwrap_or(""); + if !proc.trim().is_empty() { + return "process"; + } + "none" +} + +/// The Responses endpoint to post mints to. `OPENAI_BASE_URL` (same env +/// layering as the key) overrides the default host, supporting endpoints and +/// proxies that speak the OpenAI Responses shape with Bearer auth. Azure +/// OpenAI is NOT covered by this override alone — it uses its own URL scheme +/// and `api-key` auth header, which would need a real driver. +pub(crate) fn responses_url(base_url: Option) -> String { + let base = base_url.unwrap_or_else(|| "https://api.openai.com/v1".to_string()); + format!("{}/responses", base.trim_end_matches('/')) +} + +// ── Prompt construction ─────────────────────────────────────────────────────── + +/// Build the designer instructions. Pure so tests can pin the contract: +/// style-match-the-avatar is DEFAULT behavior; owner directions (art AND +/// card text) take primacy over those style defaults, but never over the +/// fixed contract (frame identity, geometry, text fidelity). +pub(crate) fn build_card_instructions( + agent_name: &str, + persona_notes: &str, + style_notes: &str, +) -> String { + let owner_directions = if style_notes.trim().is_empty() { + String::new() + } else { + format!( + "\nOWNER'S DIRECTIONS — these override the default art-style and copy guidance \ + below wherever they conflict (they cannot change the frame, layout, or \ + text-fidelity requirements). The owner may direct the art, the card text \ + (type line, ability, flavor), or both:\n{style_notes}\n" + ) + }; + format!( + r#"You are designing one premium collectible trading card for the Buzz agent "{agent_name}". + +Input image 1 is the official Buzz card frame template (gold honeycomb border, dark interior, name banner top, hex badge top-right, text box lower third). Input image 2 is the agent's avatar — study its exact art style: medium, pixel grid if any, palette, shading, background motifs. + +Persona notes for the card copy: +{persona_notes} +{owner_directions} +First, write professional trading-card copy at Magic: The Gathering editorial quality: +- a type line (e.g. "Legendary Agent — Team Lead"), +- ONE keyworded ability: short bolded ability name + one sentence of crisp rules text written like real MTG rules (present tense, precise, no fluff), +- ONE italic flavor-text line, evocative and short, the kind that gets quoted. +Where the owner's directions specify card text, use their wording within the 220-character text-box limit below (edited only for spelling; if their text exceeds the limit, condense it minimally while keeping their words and intent); invent copy only for the parts they left open. +Keep total text-box copy under 220 characters so it renders cleanly. + +Then generate the finished card with the image tool, exactly 1024x1536 portrait: +- The frame must follow input image 1 faithfully: same gold honeycomb border, same layout, honey drip detail. +- Default art style: match input image 2's art style EXACTLY — same medium, same pixel density if pixel art, same palette, same background honeycomb-lattice sky. It must look like the same artist drew a larger scene: the character in a confident pose, conjuring glowing golden hexagons. The owner's directions above override any of this default styling where they conflict. +- Name banner: "{agent_name}" plus the type line beneath it in smaller type. +- Text box: the ability name in bold, rules text in regular, then the flavor line in italics, cleanly typeset like a real MTG card — professional kerning, no misspellings, hyphenate nothing. +- Top-right hex badge: one small emblem of your choice, no text. +Render all text with perfect fidelity."# + ) +} + +/// Encode raw image bytes as a `data:image/png;base64,` URL, downscaling to +/// `max_dim` on the longest edge so request payloads stay small. +fn image_data_url(bytes: &[u8], max_dim: u32) -> Result { + Ok(format!( + "data:image/png;base64,{}", + STANDARD.encode(png_bytes_resized(bytes, max_dim)?) + )) +} + +/// Re-encode an image as PNG, downscaling so neither side exceeds `max_dim`. +fn png_bytes_resized(bytes: &[u8], max_dim: u32) -> Result, String> { + let img = image::load_from_memory(bytes).map_err(|e| format!("Failed to decode image: {e}"))?; + let img = if img.width().max(img.height()) > max_dim { + img.resize(max_dim, max_dim, image::imageops::FilterType::Lanczos3) + } else { + img + }; + let mut png = Vec::new(); + img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png) + .map_err(|e| format!("Failed to encode image: {e}"))?; + Ok(png) +} + +// ── Response parsing ────────────────────────────────────────────────────────── + +/// Extract the generated image (base64) and any designer text from a +/// Responses API payload. Pure for testability. +pub(crate) fn extract_card_output(resp: &serde_json::Value) -> Result<(String, String), String> { + let output = resp + .get("output") + .and_then(|o| o.as_array()) + .ok_or_else(|| "Responses payload has no output array".to_string())?; + + let mut image_b64 = None; + let mut notes = Vec::new(); + for item in output { + match item.get("type").and_then(|t| t.as_str()) { + Some("image_generation_call") => { + if let Some(result) = item.get("result").and_then(|r| r.as_str()) { + image_b64 = Some(result.to_string()); + } + } + Some("message") => { + if let Some(content) = item.get("content").and_then(|c| c.as_array()) { + for c in content { + if c.get("type").and_then(|t| t.as_str()) == Some("output_text") { + if let Some(text) = c.get("text").and_then(|t| t.as_str()) { + notes.push(text.to_string()); + } + } + } + } + } + _ => {} + } + } + + let image_b64 = image_b64.ok_or_else(|| { + let types: Vec<&str> = output + .iter() + .filter_map(|i| i.get("type").and_then(|t| t.as_str())) + .collect(); + format!("No image in Responses output (item types: {types:?})") + })?; + Ok((image_b64, notes.join("\n"))) +} + +// ── Commands ────────────────────────────────────────────────────────────────── + +/// Save an `OPENAI_API_KEY` into the global Agent Defaults env for card +/// minting — a narrow seam with deliberately different semantics from the +/// general `set_global_agent_config`: +/// +/// - **No agent restarts.** The general command stops/restarts every running +/// local agent whose effective env changes, because agent env is baked at +/// spawn time. The mint command re-reads the config from disk on every +/// mint, so minting needs no restart — and a card setup must never disrupt +/// running agents as a side effect. Agents pick the key up naturally on +/// their next (re)start. +/// - **Read-modify-write of the latest on-disk config.** The config is +/// re-read immediately before the single-key insert + write (under the +/// managed-agents store lock, which serializes it against the other card +/// and agent-store commands), so a settings save that landed after this +/// dialog opened is not clobbered with a stale dialog-open snapshot. +/// (The general settings editor performs its own whole-config write; as +/// today, the last writer wins between the two surfaces.) +/// +/// Standard global-config validation still applies (POSIX key shape, +/// reserved-key reject, size caps) — this is not a validation bypass. +#[tauri::command] +pub fn card_mint_save_openai_key( + key: String, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + let key = key.trim().to_string(); + if key.is_empty() { + return Err("API key cannot be empty.".to_string()); + } + + let _store_guard = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + + let mut config = load_global_agent_config(&app)?; + config.env_vars.insert("OPENAI_API_KEY".to_string(), key); + validate_global_config(&config)?; + save_global_agent_config(&app, &config) +} + +/// Report which env layer resolves the OpenAI key for a card mint of agent +/// `id` — same layering as `mint_agent_card`. Delegates to `resolve_key_layer` +/// for the classification; see that helper for the return-value contract. +#[tauri::command] +pub fn card_mint_key_status( + id: String, + app: AppHandle, + state: State<'_, AppState>, +) -> Result { + let _store_guard = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + + let instances = load_managed_agents(&app)?; + let definitions = load_agent_definitions(&app)?; + let (record, _) = resolve_from_lists(&id, &instances, &definitions)?; + + let global = load_global_agent_config(&app).unwrap_or_default(); + let personas = load_personas(&app).unwrap_or_default(); + let persona_env = record + .persona_id + .as_deref() + .and_then(|pid| personas.iter().find(|p| p.id == pid)) + .map(|p| p.env_vars.clone()) + .unwrap_or_default(); + + Ok(resolve_key_layer( + &global.env_vars, + &persona_env, + &record.env_vars, + std::env::var("OPENAI_API_KEY").ok(), + ) + .to_string()) +} + +/// Mint a trading card for the agent identified by `id` (instance pubkey, +/// instance slug, or definition slug — same resolution as snapshot export). +/// +/// When `lock` is true the embedded manifest is NIP-44-encrypted to the +/// (owner, agent) pair per the locked-envelope contract — this requires a +/// linked agent instance (the second key endpoint); bare definitions cannot +/// be locked. +/// +/// When `memory_level` is `"core"` or `"everything"`, the owner's decrypted +/// memory for the agent is embedded in the manifest — same levels and fetch +/// as snapshot export. The memory source is always the resolved instance +/// itself (derived, never caller-supplied), so it requires a linked instance; +/// bare definitions can only mint `"none"` (the default). +/// +/// Returns the final, chunk-injected, round-trip-verified `.agent.png` bytes. +/// Reroll = call again; the command holds no session state. +#[tauri::command] +pub async fn mint_agent_card( + id: String, + style_notes: Option, + lock: Option, + memory_level: Option, + app: AppHandle, + state: State<'_, AppState>, +) -> Result { + let lock = lock.unwrap_or(false); + let memory_level = parse_memory_level(memory_level.as_deref().unwrap_or(""))?; + // ── Resolve the record + API key under lock ────────────────────────────── + let (mut record, is_definition, api_key, base_url) = { + let _store_guard = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + + let instances = load_managed_agents(&app)?; + let definitions = load_agent_definitions(&app)?; + let (record, is_definition) = + resolve_from_lists(&id, &instances, &definitions).map(|(r, d)| (r.clone(), d))?; + + let global = load_global_agent_config(&app).unwrap_or_default(); + let personas = load_personas(&app).unwrap_or_default(); + let persona_env = record + .persona_id + .as_deref() + .and_then(|pid| personas.iter().find(|p| p.id == pid)) + .map(|p| p.env_vars.clone()) + .unwrap_or_default(); + + let api_key = resolve_env_from_layers( + "OPENAI_API_KEY", + &global.env_vars, + &persona_env, + &record.env_vars, + std::env::var("OPENAI_API_KEY").ok(), + ) + .ok_or_else(|| { + format!( + "{NO_KEY_ERROR_PREFIX} No OPENAI_API_KEY found. Add one in the agent's \ + environment variables or global agent settings to mint cards." + ) + })?; + let base_url = resolve_env_from_layers( + "OPENAI_BASE_URL", + &global.env_vars, + &persona_env, + &record.env_vars, + std::env::var("OPENAI_BASE_URL").ok(), + ); + + (record, is_definition, api_key, base_url) + }; + + // ── Locking needs its two exact key endpoints up front, BEFORE the + // API spend: the owner identity secret and the agent instance pubkey. + let lock_keys = if lock { + if is_definition { + return Err( + "Locked cards need a linked agent instance — this persona has never been \ + started, so there is no agent key to lock to." + .to_string(), + ); + } + let owner_keys = state.signing_keys()?; + // Same canonical check the envelope decoder enforces (incl. curve + // validation) — a non-point record pubkey must fail BEFORE the API + // spend, not at post-mint encryption. + let agent_pubkey = crate::managed_agents::agent_snapshot_envelope::parse_canonical_pubkey( + "agentPubkey", + &record.pubkey, + ) + .map_err(|_| { + "Agent record has an invalid pubkey (not a canonical x-only key).".to_string() + })?; + if owner_keys.public_key() == agent_pubkey { + return Err("Cannot lock a card to itself: owner and agent keys match.".to_string()); + } + Some((owner_keys, agent_pubkey)) + } else { + None + }; + + // ── Memory needs a keyed instance, resolved up front BEFORE the API + // spend — the memory source is always the resolved instance itself + // (derived, never caller-supplied), so cross-agent pairing cannot be + // expressed. A failed fetch fails the mint here, not after payment. + let memory_entries = if memory_level == MemoryLevel::None { + Vec::new() + } else { + if is_definition { + return Err( + "Cards with memory need a linked agent instance — this persona has never \ + been started, so there is no agent memory to include." + .to_string(), + ); + } + let listing = get_agent_memory(record.pubkey.clone(), app.clone(), state.clone()).await?; + memory_entries_from_listing(listing, memory_level) + }; + + let display_name = record + .display_name + .clone() + .unwrap_or_else(|| record.name.clone()); + + // ── Prefer the agent's own kind:0 profile picture ──────────────────────── + // The record's `avatar_url` is a stale presentation snapshot: with + // agent-managed profiles the agent updates its own kind:0 `picture` and + // desktop reconciliation is disabled (`agent_settings.rs`), so the relay + // profile — not the local record — is the live source of truth for how the + // agent looks. Definitions have no keypair and thus no kind:0; they keep + // the record's avatar. A relay error fails the mint here, BEFORE the API + // spend (same fail-early rule as the key/memory guards above) — minting + // with the wrong face wastes the spend it was supposed to protect. + if !is_definition { + let relay_url = crate::relay::effective_agent_relay_url( + &record.relay_url, + &crate::relay::relay_ws_url_with_override(&state), + ); + let profile = crate::relay::query_agent_profile(&state, &relay_url, &record.pubkey) + .await + .map_err(|e| format!("Could not read the agent's profile for its avatar: {e}"))?; + record.avatar_url = preferred_avatar_url( + profile.and_then(|info| info.picture), + record.avatar_url.take(), + ); + } + + // ── Resolve avatar bytes (data URL, else fetch) ────────────────────────── + let avatar_bytes = match record.avatar_url.as_deref() { + Some(url) if url.starts_with("data:") => decode_avatar_data_url(url) + .ok_or_else(|| "Agent avatar data URL could not be decoded.".to_string())?, + Some(url) if url.starts_with("http://") || url.starts_with("https://") => { + // Relay-hosted avatars (kind:0 pictures under the relay's /media/) + // require Blossom get-auth. Mint the header ONLY for same-origin URLs + // so the token never leaves the relay (same contract as + // `media_download.rs`). + let relay_base = crate::relay::relay_api_base_url_with_override(&state); + let auth = is_same_origin(url, &relay_base) + .then(|| crate::commands::media::mint_media_get_auth(&state, &relay_base)) + .flatten(); + fetch_avatar(url, auth.as_deref()).await? + } + _ => { + return Err( + "Agent has no avatar image. Set an avatar before minting a card.".to_string(), + ) + } + }; + + // ── Build the manifest now (with any requested memory) so a broken agent + // fails before we spend minutes on the API call. ─────────────────────── + let manifest_avatar = manifest_avatar_bytes( + lock_keys.is_some(), + &avatar_bytes, + record.avatar_url.as_deref(), + )?; + let snapshot = build_snapshot( + &record, + memory_level, + memory_entries, + manifest_avatar.as_deref(), + ); + + // ── One Responses API call ─────────────────────────────────────────────── + // For locked mints, prove the manifest (including any embedded memory) + // fits the NIP-44 plaintext cap BEFORE spending minutes on the API call + // (same fail-early rule as the memory guard above). + if lock_keys.is_some() { + let json_len = + crate::managed_agents::agent_snapshot::encode_snapshot_json(&snapshot)?.len(); + if json_len > buzz_core_pkg::engram::NIP44_PLAINTEXT_MAX { + let hint = if memory_level == MemoryLevel::None { + "Reduce the avatar size or mint an unlocked card." + } else { + "Include less memory, reduce the avatar size, or mint an unlocked card." + }; + return Err(format!( + "Agent manifest is too large to lock ({json_len} bytes; the encrypted \ + format caps at {}). {hint}", + buzz_core_pkg::engram::NIP44_PLAINTEXT_MAX + )); + } + } + let instructions = build_card_instructions( + &display_name, + snapshot.definition.system_prompt.as_deref().unwrap_or(""), + style_notes.as_deref().unwrap_or(""), + ); + let body = serde_json::json!({ + "model": DESIGNER_MODEL, + "reasoning": {"effort": "high"}, + "instructions": "You are a senior TCG card designer and MTG rules editor.", + "input": [{ + "role": "user", + "content": [ + {"type": "input_text", "text": instructions}, + {"type": "input_image", "image_url": image_data_url(CARD_TEMPLATE_PNG, 1024)?}, + {"type": "input_image", "image_url": image_data_url(&avatar_bytes, 1024)?}, + ], + }], + "tools": [{ + "type": "image_generation", + "model": IMAGE_MODEL, + "quality": "high", + "size": "1024x1536", + "output_format": "png", + }], + "tool_choice": "required", + }); + + let client = reqwest::Client::builder() + .timeout(std::time::Duration::from_secs(MINT_TIMEOUT_SECS)) + .build() + .map_err(|e| format!("Failed to build HTTP client: {e}"))?; + let resp = client + .post(responses_url(base_url)) + .bearer_auth(&api_key) + .json(&body) + .send() + .await + .map_err(|e| format!("Card mint request failed: {e}"))?; + + let status = resp.status(); + let payload: serde_json::Value = resp + .json() + .await + .map_err(|e| format!("Card mint response was not JSON: {e}"))?; + if !status.is_success() { + // Never echo the request (it embeds nothing secret, but keep the + // failure surface small); the OpenAI error body is safe to surface. + let detail = payload + .get("error") + .and_then(|e| e.get("message")) + .and_then(|m| m.as_str()) + .unwrap_or("unknown error"); + return Err(format!("Card mint failed (HTTP {status}): {detail}")); + } + + let (image_b64, designer_notes) = extract_card_output(&payload)?; + let raw_card = STANDARD + .decode(image_b64.as_bytes()) + .map_err(|e| format!("Generated image was not valid base64: {e}"))?; + + // ── Resize to 1500-wide, inject chunk via the existing encoder ────────── + let card_img = image::load_from_memory(&raw_card) + .map_err(|e| format!("Generated image could not be decoded: {e}"))?; + let scale = CARD_WIDTH as f64 / card_img.width() as f64; + let card_img = card_img.resize( + CARD_WIDTH, + (card_img.height() as f64 * scale).round() as u32, + image::imageops::FilterType::Lanczos3, + ); + let mut card_png = Vec::new(); + card_img + .write_to( + &mut std::io::Cursor::new(&mut card_png), + image::ImageFormat::Png, + ) + .map_err(|e| format!("Failed to encode card PNG: {e}"))?; + + let final_bytes = match &lock_keys { + None => encode_snapshot_png(&snapshot, Some(&card_png)) + .map_err(|e| format!("Failed to embed agent snapshot in card: {e}"))?, + Some((owner_keys, agent_pubkey)) => { + encode_locked_snapshot_png(&snapshot, owner_keys, agent_pubkey, Some(&card_png)) + .map_err(|e| format!("Failed to embed locked agent snapshot in card: {e}"))? + } + }; + + // ── Verify: size ceiling + round-trip on the FINAL bytes ──────────────── + // Locked cards: extract the actual chunk, parse the envelope, decrypt + // with the owner key, then compare the logical manifest (ciphertext is + // nondeterministic — never compare bytes). + validate_snapshot_encode_size(final_bytes.len(), true)?; + let decoded = match &lock_keys { + None => decode_snapshot_png(&final_bytes) + .map_err(|e| format!("Card failed round-trip verification: {e}"))?, + Some((owner_keys, _)) => { + let payload = extract_chunk_payload_png(&final_bytes) + .map_err(|e| format!("Card failed round-trip verification: {e}"))?; + match parse_chunk_payload(&payload) + .map_err(|e| format!("Card failed round-trip verification: {e}"))? + { + ChunkPayload::Locked(envelope) => { + decrypt_envelope(&envelope, owner_keys.secret_key()) + .map_err(|e| format!("Card failed round-trip verification: {e}"))? + } + ChunkPayload::Plain(_) => { + return Err( + "Card round-trip verification failed: expected a locked envelope." + .to_string(), + ) + } + } + } + }; + if decoded != snapshot { + return Err("Card round-trip verification failed: manifest mismatch.".to_string()); + } + + let slug = crate::util::slugify(&display_name, "agent", 50); + let minted = MintedCard { + card_png_base64: STANDARD.encode(&final_bytes), + file_name: format!("{slug}.agent.png"), + designer_notes, + locked: lock_keys.is_some(), + memory_level, + }; + + // Archive best-effort: the mint is already paid for and verified, so a + // failed archive write logs and continues — it never fails the mint. + if let Err(e) = archive_minted_card(&app, &id, &display_name, &minted, &final_bytes) { + eprintln!("buzz-desktop: card-archive: failed to archive minted card: {e}"); + } + + Ok(minted) +} + +/// The avatar the mint should use: the agent's kind:0 `picture` when one is +/// published and non-blank, else the local record's `avatar_url`. +/// +/// Pure so the precedence is unit-testable without a relay: a blank or +/// whitespace-only `picture` must NOT shadow a real record avatar. +fn preferred_avatar_url( + kind0_picture: Option, + record_avatar_url: Option, +) -> Option { + kind0_picture + .filter(|p| !p.trim().is_empty()) + .or(record_avatar_url) +} + +/// The avatar bytes the card manifest should inline. +/// +/// Unlocked cards must carry the agent's REAL avatar inline: the PNG body is +/// the generated card artwork, and the importer only adopts the body as the +/// avatar when the manifest carries no inline bytes (`import.rs`) — without +/// these bytes an imported agent would wear the card as its face. Downscaled +/// to [`MANIFEST_AVATAR_MAX_DIM`] so the manifest tEXt chunk stays small. +/// +/// Locked cards keep the data-URL-only behavior: the whole manifest must fit +/// the NIP-44 plaintext cap (65 KB), which cannot carry inline pixels, and a +/// locked envelope never reaches the import body override anyway. +fn manifest_avatar_bytes( + locked: bool, + avatar_bytes: &[u8], + record_avatar_url: Option<&str>, +) -> Result>, String> { + if locked { + return Ok(decode_avatar_data_url(record_avatar_url.unwrap_or(""))); + } + png_bytes_resized(avatar_bytes, MANIFEST_AVATAR_MAX_DIM) + .map(Some) + .map_err(|e| format!("Failed to inline the agent avatar into the card manifest: {e}")) +} + +/// True when `url` shares an origin (scheme, host, port) with `relay_base`. +/// +/// Gate for attaching the minted media get-auth header — the token must never +/// be sent to a non-relay origin (same contract as `validate_download_url` in +/// `media_download.rs`, but non-fatal: a foreign origin just fetches +/// unauthenticated instead of failing the mint). +fn is_same_origin(url: &str, relay_base: &str) -> bool { + match (url::Url::parse(url), url::Url::parse(relay_base)) { + (Ok(u), Ok(b)) => u.origin() == b.origin(), + _ => false, + } +} + +/// Fetch an avatar over HTTP with a hard size cap. +/// +/// `auth` is an optional pre-minted Blossom get-auth header value, attached +/// verbatim — the caller is responsible for only supplying it for +/// relay-origin URLs. Redirects are not followed when auth is present +/// (redirect-hop guard, same rule as `media_download.rs`). +/// +/// The cap bounds network and memory, not just the final buffer: the +/// Content-Length header is checked before any body bytes are read, and the +/// body is streamed with a running count so a missing or dishonest header +/// still cannot exceed the cap (same contract as `media_download.rs`). +async fn fetch_avatar(url: &str, auth: Option<&str>) -> Result, String> { + use futures_util::StreamExt; + + let mut builder = reqwest::Client::builder().timeout(std::time::Duration::from_secs(30)); + if auth.is_some() { + // Never let a relay 3xx forward the auth header across origins. + builder = builder.redirect(reqwest::redirect::Policy::none()); + } + let client = builder + .build() + .map_err(|e| format!("Failed to build HTTP client: {e}"))?; + let mut req = client.get(url); + if let Some(auth) = auth { + req = req.header("authorization", auth); + } + let resp = req + .send() + .await + .map_err(|e| format!("Failed to fetch agent avatar: {e}"))?; + if !resp.status().is_success() { + return Err(format!("Avatar fetch failed: HTTP {}", resp.status())); + } + + if let Some(content_length) = resp.content_length() { + if content_length > MAX_AVATAR_FETCH_BYTES as u64 { + return Err("Agent avatar is too large to use as card input.".to_string()); + } + } + + let mut bytes = Vec::new(); + let mut stream = resp.bytes_stream(); + while let Some(chunk) = stream.next().await { + let chunk = chunk.map_err(|e| format!("Failed to read avatar bytes: {e}"))?; + append_within_avatar_cap(&mut bytes, &chunk)?; + } + Ok(bytes) +} + +/// Append a body chunk to the avatar buffer, rejecting before the append if +/// the total would cross `MAX_AVATAR_FETCH_BYTES`. Split out so the cap +/// boundary is unit-testable without an HTTP server. +fn append_within_avatar_cap(buf: &mut Vec, chunk: &[u8]) -> Result<(), String> { + if buf.len() + chunk.len() > MAX_AVATAR_FETCH_BYTES { + return Err("Agent avatar is too large to use as card input.".to_string()); + } + buf.extend_from_slice(chunk); + Ok(()) +} + +/// Save previously minted card bytes to disk via the OS save dialog. +/// +/// Re-validates the bytes (chunk parses as a plain manifest or a +/// structurally valid locked envelope, size within the import ceiling) so a +/// corrupted preview can never be written as a `.agent.png`. No decryption +/// happens here — the mint already round-trip-verified with the real key. +#[tauri::command] +pub async fn save_agent_card( + card_png_base64: String, + file_name: String, + app: AppHandle, +) -> Result { + let bytes = STANDARD + .decode(card_png_base64.as_bytes()) + .map_err(|e| format!("Card bytes were not valid base64: {e}"))?; + validate_snapshot_encode_size(bytes.len(), true)?; + let payload = extract_chunk_payload_png(&bytes) + .map_err(|e| format!("Refusing to save: card failed snapshot validation: {e}"))?; + parse_chunk_payload(&payload) + .map_err(|e| format!("Refusing to save: card failed snapshot validation: {e}"))?; + + let safe_name = if file_name.ends_with(".agent.png") && !file_name.contains(['/', '\\']) { + file_name + } else { + "card.agent.png".to_string() + }; + save_bytes_with_dialog(&app, &safe_name, "Agent card", &["png"], &bytes).await +} + +// ── Tests ───────────────────────────────────────────────────────────────────── + +#[cfg(test)] +mod tests; diff --git a/desktop/src-tauri/src/commands/personas/card/tests.rs b/desktop/src-tauri/src/commands/personas/card/tests.rs new file mode 100644 index 00000000000..407ab449744 --- /dev/null +++ b/desktop/src-tauri/src/commands/personas/card/tests.rs @@ -0,0 +1,399 @@ +//! Unit tests for `card.rs` — split into a child module file so the parent +//! stays under the 1000-line gate (same layout as `snapshot/tests.rs`). + +use super::*; +use std::collections::BTreeMap; + +#[test] +fn archive_file_name_validation_rejects_escapes() { + assert!(validate_archive_file_name("eva-1234.agent.png").is_ok()); + for bad in [ + "../escape.agent.png", + "sub/dir.agent.png", + "sub\\dir.agent.png", + "not-a-card.png", + "plain.json", + "", + ] { + assert!( + validate_archive_file_name(bad).is_err(), + "expected rejection: {bad:?}" + ); + } +} + +#[test] +fn card_template_decodes_with_expected_shape() { + // The embedded template is generation input only, but a corrupt or + // accidentally swapped asset should fail the build's test gate, not a + // user's first mint. + let img = image::load_from_memory(CARD_TEMPLATE_PNG).expect("template must decode"); + // 2:3-ish portrait frame. + assert!(img.height() > img.width(), "template must be portrait"); + assert!(img.width() >= 512, "template unexpectedly small"); +} + +#[test] +fn key_resolution_layering_record_wins() { + let mut global = BTreeMap::new(); + global.insert("OPENAI_API_KEY".to_string(), "global".to_string()); + let mut persona = BTreeMap::new(); + persona.insert("OPENAI_API_KEY".to_string(), "persona".to_string()); + let mut record = BTreeMap::new(); + record.insert("OPENAI_API_KEY".to_string(), "record".to_string()); + + assert_eq!( + resolve_env_from_layers("OPENAI_API_KEY", &global, &persona, &record, None).as_deref(), + Some("record") + ); + record.clear(); + assert_eq!( + resolve_env_from_layers("OPENAI_API_KEY", &global, &persona, &record, None).as_deref(), + Some("persona") + ); + persona.clear(); + assert_eq!( + resolve_env_from_layers("OPENAI_API_KEY", &global, &persona, &record, None).as_deref(), + Some("global") + ); + global.clear(); + assert_eq!( + resolve_env_from_layers( + "OPENAI_API_KEY", + &global, + &persona, + &record, + Some("process".to_string()) + ) + .as_deref(), + Some("process") + ); + assert!(resolve_env_from_layers("OPENAI_API_KEY", &global, &persona, &record, None).is_none()); +} + +/// Prove that `resolve_key_layer` classifies layers in the same precedence +/// order that `mint_agent_card`/`resolve_env_from_layers` uses, so the dialog +/// update path is only offered when writing global will actually win. +#[test] +fn key_status_layer_matches_mint_resolution_priority() { + let key = "OPENAI_API_KEY"; + let mut global = BTreeMap::new(); + let mut persona = BTreeMap::new(); + let mut record = BTreeMap::new(); + + // No key anywhere → "none" + assert_eq!(resolve_key_layer(&global, &persona, &record, None), "none"); + + // Only global → "global" (the only writable layer) + global.insert(key.to_string(), "sk-global".to_string()); + assert_eq!( + resolve_key_layer(&global, &persona, &record, None), + "global" + ); + // mint resolution also picks global when record and persona are empty + assert_eq!( + resolve_env_from_layers(key, &global, &persona, &record, None).as_deref(), + Some("sk-global") + ); + + // Persona overrides global → status must report "persona", NOT "global" + persona.insert(key.to_string(), "sk-persona".to_string()); + assert_eq!( + resolve_key_layer(&global, &persona, &record, None), + "persona" + ); + // mint would use the persona key + assert_eq!( + resolve_env_from_layers(key, &global, &persona, &record, None).as_deref(), + Some("sk-persona") + ); + // Writing to global would NOT change what mint resolves — status correctly + // returns "persona" so the dialog shows a read-only redirect instead. + let mut global_updated = global.clone(); + global_updated.insert(key.to_string(), "sk-new-global".to_string()); + assert_eq!( + resolve_env_from_layers(key, &global_updated, &persona, &record, None).as_deref(), + Some("sk-persona"), + "writing global must not change resolution when persona key exists" + ); + + // Agent record overrides both → status must report "agent" + record.insert(key.to_string(), "sk-agent".to_string()); + assert_eq!(resolve_key_layer(&global, &persona, &record, None), "agent"); + assert_eq!( + resolve_env_from_layers(key, &global, &persona, &record, None).as_deref(), + Some("sk-agent") + ); + + // Process env is last resort (only when all map layers are empty) + let empty = BTreeMap::new(); + assert_eq!( + resolve_key_layer(&empty, &empty, &empty, Some("sk-process".to_string())), + "process" + ); + + // Blank values are skipped — process wins over a whitespace global + let mut blank_global = BTreeMap::new(); + blank_global.insert(key.to_string(), " ".to_string()); + assert_eq!( + resolve_key_layer( + &blank_global, + &empty, + &empty, + Some("sk-process".to_string()) + ), + "process" + ); +} + +#[test] +fn key_resolution_skips_blank_values() { + let mut record = BTreeMap::new(); + record.insert("OPENAI_API_KEY".to_string(), " ".to_string()); + let mut persona = BTreeMap::new(); + persona.insert("OPENAI_API_KEY".to_string(), "persona".to_string()); + assert_eq!( + resolve_env_from_layers("OPENAI_API_KEY", &BTreeMap::new(), &persona, &record, None) + .as_deref(), + Some("persona") + ); +} + +#[test] +fn responses_url_default_and_override() { + assert_eq!(responses_url(None), "https://api.openai.com/v1/responses"); + // Trailing slashes must not produce a double-slash path. + assert_eq!( + responses_url(Some("https://proxy.example/v1/".to_string())), + "https://proxy.example/v1/responses" + ); + assert_eq!( + responses_url(Some("https://proxy.example/v1".to_string())), + "https://proxy.example/v1/responses" + ); +} + +#[test] +fn instructions_pin_style_match_default_and_owner_primacy() { + let base = build_card_instructions("Eva", "leads the team", ""); + assert!(base.contains("match input image 2's art style EXACTLY")); + assert!(base.contains("\"Eva\"")); + assert!(!base.contains("OWNER'S DIRECTIONS")); + + let directed = build_card_instructions("Eva", "leads the team", "make it stormy"); + // Owner directions take primacy over style defaults... + assert!(directed.contains("OWNER'S DIRECTIONS")); + assert!(directed.contains("make it stormy")); + assert!(directed.contains("override the default art-style and copy guidance")); + // ...but the fixed contract survives: frame, style anchor (as an + // overridable default), and text-fidelity requirements stay present. + assert!(directed.contains("match input image 2's art style EXACTLY")); + assert!(directed.contains("cannot change the frame, layout, or")); + assert!(directed.contains("Render all text with perfect fidelity")); + // Card-text direction is an explicitly named capability, and the + // owner-wording rule acknowledges the fixed 220-char text-box limit + // (no mutually impossible "verbatim" vs "under 220 chars" pair). + assert!(directed.contains("card text")); + assert!(directed.contains("use their wording within the 220-character text-box limit")); +} + +#[test] +fn extract_card_output_happy_path_and_missing_image() { + let ok = serde_json::json!({ + "output": [ + {"type": "reasoning"}, + {"type": "image_generation_call", "result": "aW1n"}, + {"type": "message", "content": [ + {"type": "output_text", "text": "notes here"} + ]} + ] + }); + let (img, notes) = extract_card_output(&ok).unwrap(); + assert_eq!(img, "aW1n"); + assert_eq!(notes, "notes here"); + + let missing = serde_json::json!({"output": [{"type": "message", "content": []}]}); + let err = extract_card_output(&missing).unwrap_err(); + assert!(err.contains("No image"), "{err}"); + + let no_output = serde_json::json!({}); + assert!(extract_card_output(&no_output).is_err()); +} + +#[test] +fn kind0_picture_wins_over_record_avatar_unless_blank() { + let some = |s: &str| Some(s.to_string()); + // Published picture wins. + assert_eq!( + preferred_avatar_url(some("https://relay/media/k0.png"), some("data:image/png;x")), + some("https://relay/media/k0.png") + ); + // No profile / no picture: record avatar survives. + assert_eq!( + preferred_avatar_url(None, some("data:image/png;x")), + some("data:image/png;x") + ); + // Blank or whitespace picture must not shadow a real avatar. + assert_eq!( + preferred_avatar_url(some(""), some("data:image/png;x")), + some("data:image/png;x") + ); + assert_eq!( + preferred_avatar_url(some(" "), some("data:image/png;x")), + some("data:image/png;x") + ); + // Nothing anywhere: None (caller surfaces the "no avatar" error). + assert_eq!(preferred_avatar_url(None, None), None); +} + +#[test] +fn unlocked_manifest_inlines_real_avatar_bytes_downscaled() { + // 700px source (over MANIFEST_AVATAR_MAX_DIM) in a solid color. + let avatar = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel( + 700, + 700, + image::Rgba([9, 120, 33, 255]), + )); + let mut avatar_png = std::io::Cursor::new(Vec::new()); + avatar + .write_to(&mut avatar_png, image::ImageFormat::Png) + .unwrap(); + + let inlined = manifest_avatar_bytes(false, avatar_png.get_ref(), None) + .unwrap() + .expect("unlocked mints must inline the real avatar"); + let img = image::load_from_memory(&inlined).unwrap(); + assert_eq!( + (img.width(), img.height()), + (MANIFEST_AVATAR_MAX_DIM, MANIFEST_AVATAR_MAX_DIM) + ); + assert_eq!(img.to_rgba8().get_pixel(0, 0).0, [9, 120, 33, 255]); + + // Undecodable avatar bytes fail the mint (pre-spend), never silently + // produce a card whose import would wear the artwork as a face. + assert!(manifest_avatar_bytes(false, b"not a png", None).is_err()); +} + +#[test] +fn locked_manifest_keeps_data_url_only_avatar() { + // Locked mints must not inline fetched bytes (NIP-44 cap): only a record + // data URL carries over, exactly as before. + let unused = [0u8; 4]; + assert_eq!( + manifest_avatar_bytes(true, &unused, Some("data:image/png;base64,aGk=")) + .unwrap() + .as_deref(), + Some(b"hi".as_slice()) + ); + assert_eq!( + manifest_avatar_bytes(true, &unused, Some("https://relay/media/a.png")).unwrap(), + None + ); + assert_eq!(manifest_avatar_bytes(true, &unused, None).unwrap(), None); +} + +#[test] +fn media_get_auth_gate_is_same_origin_only() { + // The minted Blossom get-auth header may only travel to the relay's own + // origin — scheme, host, and port all count (same contract as + // `validate_download_url` in `media_download.rs`). + let relay = "https://relay.example.com"; + assert!(is_same_origin( + "https://relay.example.com/media/abc.png", + relay + )); + // Different host, scheme, or port: no auth. + assert!(!is_same_origin( + "https://evil.example.com/media/abc.png", + relay + )); + assert!(!is_same_origin( + "http://relay.example.com/media/abc.png", + relay + )); + assert!(!is_same_origin( + "https://relay.example.com:8443/media/abc.png", + relay + )); + // Unparseable inputs fail closed. + assert!(!is_same_origin("not a url", relay)); + assert!(!is_same_origin( + "https://relay.example.com/x", + "also not a url" + )); + // Explicit port on both sides matches. + assert!(is_same_origin( + "http://localhost:3100/media/abc.png", + "http://localhost:3100" + )); +} + +#[test] +fn avatar_cap_rejects_before_appending_crossing_chunk() { + // The streaming accumulator must reject a chunk that would cross the + // cap BEFORE buffering it — this is what bounds memory when + // Content-Length is missing or dishonest. + let mut buf = vec![0u8; MAX_AVATAR_FETCH_BYTES - 1]; + assert!(append_within_avatar_cap(&mut buf, &[0u8]).is_ok()); + assert_eq!(buf.len(), MAX_AVATAR_FETCH_BYTES); + // Exactly at the cap: one more byte must fail and not grow the buffer. + assert!(append_within_avatar_cap(&mut buf, &[0u8]).is_err()); + assert_eq!(buf.len(), MAX_AVATAR_FETCH_BYTES); + + // A single oversized chunk is rejected outright. + let mut fresh = Vec::new(); + let oversized = vec![0u8; MAX_AVATAR_FETCH_BYTES + 1]; + assert!(append_within_avatar_cap(&mut fresh, &oversized).is_err()); + assert!(fresh.is_empty()); +} + +#[test] +fn save_rejects_plain_png_without_snapshot_chunk() { + // A plain PNG (no buzz_agent_snapshot chunk) must not be saveable as + // a card. Exercise the same validation the command runs. + let img = image::DynamicImage::new_rgba8(4, 4); + let mut png = Vec::new(); + img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png) + .unwrap(); + assert!(decode_snapshot_png(&png).is_err()); +} + +#[test] +fn archived_sidecar_without_memory_level_defaults_to_none() { + // Every mint before the memory option existed embedded MemoryLevel::None + // structurally, so old sidecars (no memoryLevel field) must deserialize + // to None — the gallery's disclosure depends on this being honest. + let legacy = r#"{ + "storedFileName": "eva-1234.agent.png", + "fileName": "eva.agent.png", + "agentId": "abc", + "agentName": "Eva", + "designerNotes": "", + "locked": false, + "mintedAt": "2026-07-28T00:00:00Z" + }"#; + let meta: ArchivedCardMeta = serde_json::from_str(legacy).unwrap(); + assert_eq!(meta.memory_level, MemoryLevel::None); + + let with_level = legacy.replace( + "\"locked\": false,", + "\"locked\": false, \"memoryLevel\": \"everything\",", + ); + let meta: ArchivedCardMeta = serde_json::from_str(&with_level).unwrap(); + assert_eq!(meta.memory_level, MemoryLevel::Everything); +} + +#[test] +fn minted_card_serializes_memory_level_snake_case_value() { + // The TS layer narrows on the exact wire strings "none"/"core"/ + // "everything" — pin the serde representation the frontend will see. + let minted = MintedCard { + card_png_base64: String::new(), + file_name: "eva.agent.png".to_string(), + designer_notes: String::new(), + locked: false, + memory_level: MemoryLevel::Core, + }; + let json = serde_json::to_value(&minted).unwrap(); + assert_eq!(json["memoryLevel"], "core"); +} diff --git a/desktop/src-tauri/src/commands/personas/create.rs b/desktop/src-tauri/src/commands/personas/create.rs index c00de1c6da1..944013029b8 100644 --- a/desktop/src-tauri/src/commands/personas/create.rs +++ b/desktop/src-tauri/src/commands/personas/create.rs @@ -7,8 +7,8 @@ use uuid::Uuid; use crate::{ app_state::AppState, managed_agents::{ - apply_persona_behavior, load_personas, save_personas, try_regenerate_nest, AgentDefinition, - CatalogSource, CreatePersonaRequest, + apply_persona_behavior, load_personas, save_personas, try_regenerate_nest, + validate_agent_definition_text, AgentDefinition, CatalogSource, CreatePersonaRequest, }, util::now_iso, }; @@ -25,7 +25,10 @@ pub async fn create_persona( let state = app.state::(); let display_name = trim_required(&input.display_name, "Display name")?; // System prompt optional: core memory is auto-injected. Empty is valid. - let system_prompt = input.system_prompt.trim().to_string(); + // Preserve it byte-for-byte: shared/import review surfaces show this + // exact string before the ACP harness executes it. + let system_prompt = input.system_prompt.clone(); + validate_agent_definition_text(&display_name, &system_prompt)?; let avatar_url = trim_optional(input.avatar_url); let runtime = trim_optional(input.runtime); let model = trim_optional(input.model); diff --git a/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs b/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs index 8ff7cfbd9bd..a4bbdeb677c 100644 --- a/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs +++ b/desktop/src-tauri/src/commands/personas/delete_cascade_tests.rs @@ -42,6 +42,7 @@ fn make_agent( runtime_pid, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -66,6 +67,7 @@ fn make_agent( source_team_persona_slug: None, catalog_source: None, relay_mesh: None, + effort_level: None, auto_restart_on_config_change: false, definition_respond_to: None, definition_respond_to_allowlist: vec![], diff --git a/desktop/src-tauri/src/commands/personas/inbound.rs b/desktop/src-tauri/src/commands/personas/inbound.rs index d7ffecef2d6..5214dd5a27e 100644 --- a/desktop/src-tauri/src/commands/personas/inbound.rs +++ b/desktop/src-tauri/src/commands/personas/inbound.rs @@ -17,6 +17,21 @@ use crate::{ #[cfg(test)] mod inbound_tests; +#[derive(Debug)] +enum InboundRuntimeRefresh { + Local { + pubkey: String, + relay_urls: Vec, + }, + Provider { + pubkey: String, + provider_id: String, + config: serde_json::Value, + cached_binary_path: Option, + agent_json: Result, + }, +} + /// Apply an inbound kind:30175 persona event from the relay onto the local /// store. The frontend's live subscription invokes this per event for our own /// authored coordinate so Device B inherits Device A's edits. @@ -57,23 +72,86 @@ pub async fn reconcile_inbound_persona_event( arrival_relay_url: String, app: AppHandle, ) -> Result<(), String> { - tokio::task::spawn_blocking(move || { - reconcile_inbound_persona_event_blocking(event_json, arrival_relay_url, app) + let blocking_app = app.clone(); + let restart = tokio::task::spawn_blocking(move || { + reconcile_inbound_persona_event_blocking(event_json, arrival_relay_url, blocking_app) }) .await - .map_err(|e| format!("spawn_blocking failed: {e}"))? + .map_err(|e| format!("spawn_blocking failed: {e}"))??; + + match restart { + Some(InboundRuntimeRefresh::Local { pubkey, relay_urls }) => { + let state = app.state::(); + super::super::agents::start_local_agent_pairs_with_preflight( + &app, + &state, + &pubkey, + &relay_urls, + ) + .await + .map_err(|error| { + format!( + "Inbound agent access was saved, but its runtime failed to restart with the new policy: {error}" + ) + })?; + } + Some(InboundRuntimeRefresh::Provider { + pubkey, + provider_id, + config, + cached_binary_path, + agent_json, + }) => { + let state = app.state::(); + let agent_json = match agent_json { + Ok(agent_json) => agent_json, + Err(error) => { + let message = format!( + "Inbound agent access was saved, but its provider deployment could not be refreshed safely: {error}" + ); + super::super::agents::provider_access::persist_failure( + &app, &state, &pubkey, &message, + )?; + let _ = app.emit("agents-data-changed", ()); + return Err(message); + } + }; + super::super::agents::deploy_to_provider( + &app, + &state, + &pubkey, + &provider_id, + &config, + agent_json, + cached_binary_path.as_deref(), + None, + None, + ) + .await + .map_err(|error| { + format!( + "Inbound agent access was saved, but its provider deployment failed to refresh with the new policy: {error}" + ) + })?; + } + None => {} + } + Ok(()) } fn reconcile_inbound_persona_event_blocking( event_json: String, arrival_relay_url: String, app: AppHandle, -) -> Result<(), String> { +) -> Result, String> { use crate::managed_agents::{ agent_events::managed_agent_content_from_event, load_managed_agents, load_teams, persona_events::persona_from_event, - retention::{open_retention_db, retain_inbound_event, InboundOutcome, RetainedEvent}, + retention::{ + inbound_event_outcome, open_retention_db, retain_inbound_event, InboundOutcome, + RetainedEvent, + }, save_managed_agents, save_teams, team_events::team_content_from_event, }; @@ -93,21 +171,31 @@ fn reconcile_inbound_persona_event_blocking( // in its `a` tag (`::`). Handled before the // upsert dispatch because its coordinate and retention key differ. if kind == KIND_DELETION { - return reconcile_inbound_tombstone(&event, &arrival_relay_url, &app, &state); + reconcile_inbound_tombstone(&event, &arrival_relay_url, &app, &state)?; + return Ok(None); } if !matches!(kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) { - return Ok(()); + return Ok(None); } // The d-tag identifies the record within its kind. Persona derives it from // the parsed record (`persona_d_tag`); team/agent carry it as the event's - // d-tag directly. The persona is parsed once here and reused in the apply - // branch below — team/agent content is parsed in-branch since their d-tag - // comes from the event tag, not the content. + // d-tag directly. Definition-bearing content is parsed and validated once + // here, before retention, then reused in the apply branch below. This keeps + // an unsafe event out of both the retention database and the local store. let inbound_persona = (kind == KIND_PERSONA) .then(|| persona_from_event(&event)) .transpose()?; + if let Some(persona) = &inbound_persona { + validate_inbound_persona_definition(persona)?; + } + let inbound_managed_agent = (kind == KIND_MANAGED_AGENT) + .then(|| managed_agent_content_from_event(&event)) + .transpose()?; + if let Some(managed_agent) = &inbound_managed_agent { + validate_inbound_managed_agent_definition(managed_agent)?; + } let d_tag = match &inbound_persona { Some(persona) => persona_d_tag(persona), None => event_d_tag(&event)?, @@ -128,25 +216,35 @@ fn reconcile_inbound_persona_event_blocking( &arrival_relay_url, )? else { - return Ok(()); + return Ok(None); }; let conn = open_retention_db(&scope.db_path)?; - let outcome = retain_inbound_event( - &conn, - &RetainedEvent { - kind, - pubkey: event.pubkey.to_hex(), - d_tag: d_tag.clone(), - content: event.content.to_string(), - created_at: event.created_at.as_secs() as i64, - raw_event: event.as_json(), - pending_sync: false, - }, - )?; - if outcome == InboundOutcome::Skipped { - return Ok(()); + let inbound_retained_event = RetainedEvent { + kind, + pubkey: event.pubkey.to_hex(), + d_tag: d_tag.clone(), + content: event.content.to_string(), + created_at: event.created_at.as_secs() as i64, + raw_event: event.as_json(), + pending_sync: false, + }; + // Managed-agent access changes can fail while stopping a runtime. Preflight + // the retention decision now, but do not advance the durable head until the + // local store has been saved; otherwise replay sees the failed revocation as + // already consumed and can never retry it. Persona/team paths retain first + // as before because they have no fallible runtime transition. + if kind == KIND_MANAGED_AGENT + && inbound_event_outcome(&conn, &inbound_retained_event)? == InboundOutcome::Skipped + { + return Ok(None); + } + if kind != KIND_MANAGED_AGENT + && retain_inbound_event(&conn, &inbound_retained_event)? == InboundOutcome::Skipped + { + return Ok(None); } + let mut runtime_refresh = None; match kind { KIND_PERSONA => { let mut personas = load_personas(&app)?; @@ -159,17 +257,79 @@ fn reconcile_inbound_persona_event_blocking( } KIND_TEAM => { let mut teams = load_teams(&app)?; - apply_inbound_team(&mut teams, d_tag, team_content_from_event(&event)?); - save_teams(&app, &teams)?; + commit_inbound_team( + &mut teams, + d_tag, + team_content_from_event(&event)?, + |teams| save_teams(&app, teams), + || load_managed_agents(&app), + |records| save_managed_agents(&app, records), + )?; } KIND_MANAGED_AGENT => { let mut agents = load_managed_agents(&app)?; - apply_inbound_managed_agent( - &mut agents, - &d_tag, - managed_agent_content_from_event(&event)?, - ); + let managed_agent = inbound_managed_agent.ok_or_else(|| { + "managed-agent content was not parsed before retention".to_string() + })?; + let access_changed = apply_inbound_managed_agent(&mut agents, &d_tag, managed_agent); + if access_changed { + let record = agents + .iter_mut() + .find(|record| record.pubkey == d_tag) + .ok_or_else(|| format!("agent {d_tag} disappeared during inbound apply"))?; + match &record.backend { + crate::managed_agents::BackendKind::Local => { + let mut runtimes = state + .managed_agent_processes + .lock() + .map_err(|error| error.to_string())?; + let mut relay_urls = + crate::managed_agents::managed_agent_runtime_keys(&runtimes, &d_tag) + .into_iter() + .map(|key| key.relay_url) + .collect::>(); + if relay_urls.is_empty() && record.runtime_pid.is_some() { + relay_urls.push(crate::relay::effective_agent_relay_url( + &record.relay_url, + &crate::relay::relay_ws_url_with_override(&state), + )); + } + if !relay_urls.is_empty() { + crate::managed_agents::stop_managed_agent_process( + &app, + record, + &mut runtimes, + )?; + runtime_refresh = Some(InboundRuntimeRefresh::Local { + pubkey: d_tag.clone(), + relay_urls, + }); + } + } + crate::managed_agents::BackendKind::Provider { id, config } + if record.backend_agent_id.is_some() => + { + // Persist the unacknowledged policy transition in the + // same write as the narrowed policy. If the process + // exits before or during deployment, workspace apply + // can still recover it in every build. + record.provider_policy_pending = true; + runtime_refresh = Some(InboundRuntimeRefresh::Provider { + pubkey: d_tag.clone(), + provider_id: id.clone(), + config: config.clone(), + cached_binary_path: record.provider_binary_path.clone(), + agent_json: super::super::agents::build_deploy_payload( + &app, &state, record, + ), + }); + } + crate::managed_agents::BackendKind::Provider { .. } => {} + } + } save_managed_agents(&app, &agents)?; + let outcome = retain_inbound_event(&conn, &inbound_retained_event)?; + debug_assert_eq!(outcome, InboundOutcome::Applied); } _ => unreachable!("kind gated above"), } @@ -179,7 +339,26 @@ fn reconcile_inbound_persona_event_blocking( // land on disk silently, leaving the Agents tab stale until restart. let _ = app.emit("agents-data-changed", ()); - Ok(()) + Ok(runtime_refresh) +} + +fn validate_inbound_persona_definition(persona: &AgentDefinition) -> Result<(), String> { + crate::managed_agents::validate_agent_definition_text( + &persona.display_name, + &persona.system_prompt, + ) + .map_err(|error| format!("Inbound persona definition is unsafe: {error}")) +} + +fn validate_inbound_managed_agent_definition( + managed_agent: &ManagedAgentEventContent, +) -> Result<(), String> { + crate::managed_agents::validate_managed_agent_definition_text( + &managed_agent.name, + managed_agent.persona_id.as_deref(), + managed_agent.system_prompt.as_deref(), + ) + .map_err(|error| format!("Inbound managed-agent definition is unsafe: {error}")) } /// Parse an inbound wire event and enforce the signature gate. Everything @@ -382,8 +561,10 @@ fn apply_inbound_managed_agent( agents: &mut [ManagedAgentRecord], d_tag: &str, inbound: ManagedAgentEventContent, -) { +) -> bool { if let Some(local) = agents.iter_mut().find(|record| record.pubkey == d_tag) { + let previous_mode = local.respond_to; + let previous_allowlist = local.respond_to_allowlist.clone(); local.name = inbound.name; // Mirror of the slimmed writer (agent_event_content): a // definition-linked event omits the definition quad because those @@ -401,7 +582,62 @@ fn apply_inbound_managed_agent( local.parallelism = inbound.parallelism; local.respond_to = inbound.respond_to; local.respond_to_allowlist = inbound.respond_to_allowlist; + return super::super::agent_models::managed_agent_access_policy_changed( + previous_mode, + &previous_allowlist, + local.respond_to, + &local.respond_to_allowlist, + crate::managed_agents::owner_only_access_build(), + ); } + false +} + +/// In-memory core of the inbound `KIND_TEAM` reconcile: capture the matched +/// team's roster *before* applying the inbound projection, apply it, persist +/// teams authoritatively, then propagate the prior→current membership delta to +/// live instances best-effort — the same binding semantics the local +/// create/update commands use. Without this, a 30176 team edit from another +/// device lands on `teams.json` but never touches `ManagedAgentRecord.team_id`: +/// an added persona's running instances stay unbound (member in roster, not in +/// behavior) and a removed persona's instances keep drawing the old team's +/// instructions at spawn until restart. +/// +/// A no-match insert has no prior roster, so its whole roster is the added +/// delta — symmetric with `commit_team_create`. Injected persistence keeps it +/// `AppHandle`-free so the prior-roster capture and delta direction are +/// unit-testable; a `persist_teams` error propagates, agent IO is best-effort +/// (mirrors the local command path: the authoritative team write already +/// landed, and boot repair is the designed retry for a stale binding). +fn commit_inbound_team( + teams: &mut Vec, + d_tag: String, + inbound: TeamEventContent, + persist_teams: impl FnOnce(&[TeamRecord]) -> Result<(), String>, + load_agents: impl FnOnce() -> Result, String>, + save_agents: impl FnOnce(&[ManagedAgentRecord]) -> Result<(), String>, +) -> Result<(), String> { + let team_id = d_tag.clone(); + let previous_persona_ids = teams + .iter() + .find(|record| record.id == team_id) + .map(|record| record.persona_ids.clone()) + .unwrap_or_default(); + apply_inbound_team(teams, d_tag, inbound); + let current_persona_ids = teams + .iter() + .find(|record| record.id == team_id) + .map(|record| record.persona_ids.clone()) + .unwrap_or_default(); + persist_teams(teams)?; + crate::commands::teams::propagate_membership_best_effort( + &team_id, + &previous_persona_ids, + ¤t_persona_ids, + load_agents, + save_agents, + ); + Ok(()) } /// Merge an inbound kind:30176 team projection into the local set. diff --git a/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs b/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs index 1005a83432d..fbfede35886 100644 --- a/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs +++ b/desktop/src-tauri/src/commands/personas/inbound/inbound_tests.rs @@ -4,7 +4,7 @@ use super::*; use std::collections::BTreeMap; -const UUID: &str = "11111111-2222-3333-4444-555555555555"; +const UUID: &str = "11111111-2222-3333-4444-555555555555"; // sadscan:disable sq.pii.cc.visa -- fixed test UUID /// A local in-app persona: `source_team_persona_slug` is None, so its d-tag /// IS its UUID id. Carries env_vars + source_team that must survive a patch. @@ -188,6 +188,7 @@ fn local_agent() -> ManagedAgentRecord { config: serde_json::json!({ "api_key": "localproviderkey" }), }, backend_agent_id: Some("local-remote-id".to_string()), + provider_policy_pending: false, provider_binary_path: Some("/local/bin".to_string()), team_id: None, persona_team_dir: None, @@ -215,6 +216,7 @@ fn local_agent() -> ManagedAgentRecord { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -262,8 +264,13 @@ fn inbound_managed_agent_drops_injected_secrets_and_harness() { let content = crate::managed_agents::agent_events::managed_agent_content_from_event(&event).unwrap(); let mut agents = vec![local_agent()]; - apply_inbound_managed_agent(&mut agents, AGENT_PUBKEY, content); + let access_changed = apply_inbound_managed_agent(&mut agents, AGENT_PUBKEY, content); + assert_eq!( + access_changed, + !crate::managed_agents::owner_only_access_build(), + "only an effective access change may trigger a runtime refresh" + ); let a = &agents[0]; // Secrets / harness / runtime — every one preserved from the local record. assert_eq!( @@ -544,6 +551,176 @@ fn inbound_team_no_match_inserts_idempotently() { assert_eq!(teams.len(), 2, "re-receive of inserted team no-ops"); } +// ── Inbound team → membership propagation (commit_inbound_team wiring) ───── + +use std::cell::RefCell; + +/// A running instance of `persona_id`, optionally bound to a team. +fn team_instance(seed: char, persona_id: &str, team_id: Option<&str>) -> ManagedAgentRecord { + let mut record = local_agent(); + record.pubkey = seed.to_string().repeat(64); + record.name = persona_id.to_string(); + record.persona_id = Some(persona_id.to_string()); + record.team_id = team_id.map(str::to_string); + record +} + +/// An inbound team edit that ADDS a persona must bind that persona's unbound +/// running instances to the team — exactly like a local `update_team`. Without +/// the propagation wiring the instance stays unbound (member in roster, not in +/// behavior) until restart. +#[test] +fn inbound_team_add_binds_unbound_instance_through_wiring() { + let mut teams = vec![local_team()]; + teams[0].persona_ids = vec!["p-existing".to_string()]; + let existing = vec![ + team_instance('a', "p-added", None), + team_instance('b', "p-existing", Some(TEAM_ID)), + ]; + let saved = RefCell::new(None); + + commit_inbound_team( + &mut teams, + TEAM_ID.to_string(), + TeamEventContent { + name: "Team".to_string(), + description: None, + instructions: None, + persona_ids: Some(vec!["p-existing".to_string(), "p-added".to_string()]), + }, + |_| Ok(()), + || Ok(existing.clone()), + |records| { + *saved.borrow_mut() = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("inbound add succeeds"); + + let saved = saved + .borrow() + .clone() + .expect("add must save the agent store"); + assert_eq!( + saved[0].team_id.as_deref(), + Some(TEAM_ID), + "the added persona's unbound instance is bound to the team" + ); + assert_eq!( + saved[1].team_id.as_deref(), + Some(TEAM_ID), + "an instance already on the team is untouched" + ); +} + +/// An inbound team edit that REMOVES a persona ("keep agents") must detach that +/// persona's instances bound to this team, so a kept instance stops drawing the +/// team's instructions at spawn. +#[test] +fn inbound_team_removal_detaches_instance_through_wiring() { + let mut teams = vec![local_team()]; + teams[0].persona_ids = vec!["p-removed".to_string()]; + let existing = vec![team_instance('a', "p-removed", Some(TEAM_ID))]; + let saved = RefCell::new(None); + + commit_inbound_team( + &mut teams, + TEAM_ID.to_string(), + TeamEventContent { + name: "Team".to_string(), + description: None, + instructions: None, + persona_ids: Some(vec![]), + }, + |_| Ok(()), + || Ok(existing.clone()), + |records| { + *saved.borrow_mut() = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("inbound removal succeeds"); + + let saved = saved + .borrow() + .clone() + .expect("removal must save the agent store"); + assert_eq!( + saved[0].team_id, None, + "the removed persona's instance is detached from the team" + ); +} + +/// An inbound edit that omits `persona_ids` (a pre-always-publish client) +/// preserves local membership, so the delta is empty and no instance is +/// re-pointed — a metadata-only inbound edit must not disturb bindings. +#[test] +fn inbound_team_omitted_roster_leaves_bindings_untouched() { + let mut teams = vec![local_team()]; + teams[0].persona_ids = vec!["p-a".to_string()]; + let existing = vec![team_instance('a', "p-a", None)]; + let saved = RefCell::new(None); + + commit_inbound_team( + &mut teams, + TEAM_ID.to_string(), + team_content_omitting_optional_fields("Renamed"), + |_| Ok(()), + || Ok(existing.clone()), + |records| { + *saved.borrow_mut() = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("inbound metadata-only edit succeeds"); + + assert!( + saved.borrow().is_none(), + "an empty membership delta writes nothing to the agent store" + ); +} + +/// A failing agent-store write after the authoritative `save_teams` is +/// swallowed: the inbound reconcile still succeeds (boot repair is the retry), +/// so a secondary-store hiccup never aborts an inbound event whose team write +/// already landed. +#[test] +fn inbound_team_swallows_agent_store_failure() { + let mut teams = vec![local_team()]; + teams[0].persona_ids = vec![]; + commit_inbound_team( + &mut teams, + TEAM_ID.to_string(), + TeamEventContent { + name: "Team".to_string(), + description: None, + instructions: None, + persona_ids: Some(vec!["p-added".to_string()]), + }, + |_| Ok(()), + || Err("agent store unreadable".to_string()), + |_| Ok(()), + ) + .expect("inbound reconcile swallows secondary-store failure"); +} + +/// A `persist_teams` error propagates — the authoritative team write failing is +/// a real reconcile failure, unlike best-effort agent IO. +#[test] +fn inbound_team_propagates_persist_teams_error() { + let mut teams = vec![local_team()]; + let err = commit_inbound_team( + &mut teams, + TEAM_ID.to_string(), + team_content("Team"), + |_| Err("disk full".to_string()), + || Ok(vec![]), + |_| Ok(()), + ) + .expect_err("a failed team persist must propagate"); + assert_eq!(err, "disk full"); +} + // ── Tombstone (kind:5) consume ──────────────────────────────────────────── fn deletion_event(coord: &str) -> nostr::Event { @@ -673,3 +850,63 @@ fn inbound_gate_accepts_validly_signed_event() { let parsed = parse_verified_inbound_event(&event.as_json()).unwrap(); assert_eq!(parsed.pubkey, keys.public_key()); } + +#[test] +fn inbound_persona_rejects_invisible_definition_text() { + let mut inbound = inbound_for("unsafe", "Remote"); + inbound.system_prompt = "Review\u{200B} code.".to_string(); + + let error = validate_inbound_persona_definition(&inbound) + .expect_err("relay sync must reject invisible instructions"); + + assert!(error.contains("U+200B")); +} + +fn inbound_managed_agent_content( + name: &str, + persona_id: Option<&str>, + system_prompt: Option<&str>, +) -> crate::managed_agents::agent_events::ManagedAgentEventContent { + crate::managed_agents::agent_events::ManagedAgentEventContent { + name: name.to_string(), + persona_id: persona_id.map(str::to_string), + system_prompt: system_prompt.map(str::to_string), + model: None, + provider: None, + persona_source_version: None, + parallelism: 1, + respond_to: crate::managed_agents::RespondTo::OwnerOnly, + respond_to_allowlist: vec![], + } +} + +#[test] +fn inbound_definition_less_agent_rejects_invisible_prompt() { + let inbound = inbound_managed_agent_content("Remote Agent", None, Some("Review\u{200B} code.")); + + let error = validate_inbound_managed_agent_definition(&inbound) + .expect_err("definition-less sync must reject invisible instructions"); + + assert!(error.contains("U+200B")); +} + +#[test] +fn inbound_managed_agent_rejects_bidirectional_name() { + let inbound = inbound_managed_agent_content("Remote\u{202E} Agent", None, None); + + let error = validate_inbound_managed_agent_definition(&inbound) + .expect_err("managed-agent sync must reject bidirectional names"); + + assert!(error.contains("U+202E")); +} + +#[test] +fn inbound_definition_less_agent_accepts_visible_multiline_prompt() { + let inbound = inbound_managed_agent_content( + "Remote Agent", + None, + Some("Review code.\n\tCall out security risks."), + ); + + assert!(validate_inbound_managed_agent_definition(&inbound).is_ok()); +} diff --git a/desktop/src-tauri/src/commands/personas/mod.rs b/desktop/src-tauri/src/commands/personas/mod.rs index 66f7296a251..3be24d04131 100644 --- a/desktop/src-tauri/src/commands/personas/mod.rs +++ b/desktop/src-tauri/src/commands/personas/mod.rs @@ -237,7 +237,7 @@ pub async fn delete_persona(id: String, app: AppHandle) -> Result<(), String> { // Remove nsec from keyring after the record is gone. delete_agent_key(pk); super::agents::tombstone_managed_agent_pending(&app, &state, pk); - super::agents::archive_managed_agent_pending(&app, &state, pk); + super::agents::archive_managed_agent_pending(&app, &state, pk, Some(&id)); } tombstone_persona_pending(&app, &state, &d_tag); @@ -306,11 +306,14 @@ pub async fn set_persona_active( } pub(crate) const PNG_MAGIC: [u8; 4] = [0x89, 0x50, 0x4E, 0x47]; +mod card; mod snapshot; -pub use snapshot::encode_agent_snapshot_for_send; -pub use snapshot::export_agent_snapshot; +pub use card::*; +#[cfg(test)] +pub(crate) use snapshot::import::decode_snapshot_from_bytes; pub(crate) use snapshot::import::{ - decode_snapshot_from_bytes, resolve_snapshot_import_behavior, MAX_SNAPSHOT_JSON_BYTES, + parse_snapshot_payload_from_bytes, resolve_snapshot_import_behavior, MAX_SNAPSHOT_JSON_BYTES, MAX_SNAPSHOT_PNG_BYTES, }; pub use snapshot::{confirm_agent_snapshot_import, preview_agent_snapshot_import}; +pub use snapshot::{encode_agent_snapshot_for_send, export_agent_snapshot}; diff --git a/desktop/src-tauri/src/commands/personas/pending.rs b/desktop/src-tauri/src/commands/personas/pending.rs index cab5fababcd..89f2d1519ec 100644 --- a/desktop/src-tauri/src/commands/personas/pending.rs +++ b/desktop/src-tauri/src/commands/personas/pending.rs @@ -165,6 +165,12 @@ pub(super) fn prepare_persona_publication_at( let mut scoped_persona = persona.clone(); scoped_persona.shared = shared_override.unwrap_or_else(|| retained_persona_is_shared(existing.as_ref())); + if scoped_persona.shared { + crate::managed_agents::validate_agent_definition_text( + &scoped_persona.display_name, + &scoped_persona.system_prompt, + )?; + } let event = build_persona_event(&scoped_persona)? .custom_created_at(monotonic_created_at( existing.as_ref().map(|row| row.created_at), @@ -396,4 +402,18 @@ mod tests { .expect_err("a directory cannot be opened as the retention database"); assert!(error.contains("failed to open retention db")); } + + #[test] + fn shared_publication_rejects_invisible_definition_text() { + let dir = tempfile::tempdir().unwrap(); + let keys = nostr::Keys::generate(); + let db_path = dir.path().join("retention.sqlite3"); + let mut unsafe_persona = persona(); + unsafe_persona.system_prompt = "Review\u{200B} the catalog.".to_string(); + + let error = prepare_persona_publication_at(&db_path, &keys, &unsafe_persona, Some(true)) + .expect_err("sharing must reject an invisible instruction character"); + + assert!(error.contains("U+200B")); + } } diff --git a/desktop/src-tauri/src/commands/personas/snapshot.rs b/desktop/src-tauri/src/commands/personas/snapshot.rs index 583296dac0c..e7bd1597e63 100644 --- a/desktop/src-tauri/src/commands/personas/snapshot.rs +++ b/desktop/src-tauri/src/commands/personas/snapshot.rs @@ -142,7 +142,7 @@ pub(crate) fn validate_snapshot_encode_size(bytes_len: usize, is_png: bool) -> R } /// Parse a `memory_level` string to `MemoryLevel`. -fn parse_memory_level(s: &str) -> Result { +pub(crate) fn parse_memory_level(s: &str) -> Result { match s { "none" | "" => Ok(MemoryLevel::None), "core" => Ok(MemoryLevel::Core), @@ -153,6 +153,32 @@ fn parse_memory_level(s: &str) -> Result { } } +/// Flatten an owner-decrypted memory listing into manifest entries for +/// `memory_level`: `Core` takes the core entry only; `Everything` appends all +/// `mem/*` entries after it. Pure so both the export and card-mint paths share +/// (and tests can pin) the level → entries selection. +pub(crate) fn memory_entries_from_listing( + listing: crate::commands::engrams::AgentMemoryListing, + memory_level: MemoryLevel, +) -> Vec { + let mut entries = Vec::new(); + if let Some(core) = listing.core { + entries.push(AgentSnapshotMemoryEntry { + slug: core.slug, + body: core.body, + }); + } + if memory_level == MemoryLevel::Everything { + for mem in listing.memories { + entries.push(AgentSnapshotMemoryEntry { + slug: mem.slug, + body: mem.body, + }); + } + } + entries +} + /// Parse a `format` string to a PNG flag. fn parse_format_is_png(s: &str) -> Result { match s { @@ -267,22 +293,7 @@ pub(crate) async fn materialize_snapshot_bytes( // ── Fetch memory ───────────────────────────────────────────────────────── let memory_entries: Vec = if let Some(pubkey) = memory_pubkey { let listing = get_agent_memory(pubkey, app.clone(), state).await?; - let mut entries = Vec::new(); - if let Some(core) = listing.core { - entries.push(AgentSnapshotMemoryEntry { - slug: core.slug, - body: core.body, - }); - } - if memory_level == MemoryLevel::Everything { - for mem in listing.memories { - entries.push(AgentSnapshotMemoryEntry { - slug: mem.slug, - body: mem.body, - }); - } - } - entries + memory_entries_from_listing(listing, memory_level) } else { Vec::new() }; diff --git a/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs b/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs index 00a14573938..341426fe940 100644 --- a/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs +++ b/desktop/src-tauri/src/commands/personas/snapshot/fidelity_tests.rs @@ -39,6 +39,7 @@ fn make_definition(slug: &str) -> ManagedAgentRecord { runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -64,6 +65,7 @@ fn make_definition(slug: &str) -> ManagedAgentRecord { definition_respond_to_allowlist: vec![], definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -208,3 +210,64 @@ fn import_png_placeholder_keeps_manifest_avatar_fallback() { assert!(decoded.profile.avatar_data_url.is_none()); assert_eq!(decoded.profile.avatar_url, snapshot.profile.avatar_url); } + +/// An unlocked trading card imports the agent's REAL avatar, never the card. +/// +/// Mint-shaped input: the PNG body is the generated card artwork, while the +/// manifest inlines the source avatar (`manifest_avatar_bytes` in `card.rs`). +/// The #3578 body-wins override must not fire when the manifest already +/// carries inline avatar bytes — otherwise the imported agent publishes the +/// 1500-wide card as its kind:0 picture. +#[test] +fn import_unlocked_card_uses_manifest_avatar_not_card_artwork() { + use crate::managed_agents::agent_snapshot::{decode_avatar_data_url, encode_snapshot_png}; + use base64::{engine::general_purpose::STANDARD, Engine as _}; + + // The real avatar: 4×3 solid blue, inlined in the manifest at mint time. + let real_avatar = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel( + 4, + 3, + image::Rgba([23, 91, 177, 255]), + )); + let mut real_avatar_png = std::io::Cursor::new(Vec::new()); + real_avatar + .write_to(&mut real_avatar_png, image::ImageFormat::Png) + .unwrap(); + + let mut snapshot = make_snapshot(MemoryLevel::None, vec![]); + snapshot.profile.avatar_data_url = Some(format!( + "data:image/png;base64,{}", + STANDARD.encode(real_avatar_png.get_ref()) + )); + snapshot.profile.avatar_url = Some("https://relay.example/media/live-kind0.png".to_string()); + + // The card artwork: a distinct 1500×2250 solid red "trading card" as the + // PNG body — the exact dimensions the minter encodes for unlocked cards. + // Size matters: 2250px exceeds `snapshot_avatar`'s 2048px decode limit, + // so reaching the body override here wouldn't just import the wrong + // face — it would fail the import outright. + let card_art = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel( + 1500, + 2250, + image::Rgba([200, 16, 16, 255]), + )); + let mut card_png = std::io::Cursor::new(Vec::new()); + card_art + .write_to(&mut card_png, image::ImageFormat::Png) + .unwrap(); + let file_bytes = encode_snapshot_png(&snapshot, Some(card_png.get_ref())).unwrap(); + + // Production import decode: the effective avatar must be the real one. + let decoded = decode_snapshot_from_bytes(&file_bytes).unwrap(); + let avatar_bytes = + decode_avatar_data_url(decoded.profile.avatar_data_url.as_deref().unwrap()).unwrap(); + let imported = image::load_from_memory(&avatar_bytes).unwrap(); + assert_eq!( + (imported.width(), imported.height()), + (4, 3), + "imported avatar must be the source avatar, not the card artwork" + ); + assert_eq!(imported.to_rgba8().get_pixel(0, 0).0, [23, 91, 177, 255]); + // The live kind:0 URL fallback survives untouched. + assert_eq!(decoded.profile.avatar_url, snapshot.profile.avatar_url); +} diff --git a/desktop/src-tauri/src/commands/personas/snapshot/import.rs b/desktop/src-tauri/src/commands/personas/snapshot/import.rs index eccf8ee601e..75a1edea65e 100644 --- a/desktop/src-tauri/src/commands/personas/snapshot/import.rs +++ b/desktop/src-tauri/src/commands/personas/snapshot/import.rs @@ -13,7 +13,11 @@ use tauri::{AppHandle, Emitter, State}; use crate::{ app_state::AppState, managed_agents::{ - agent_snapshot::{decode_snapshot_json, decode_snapshot_png, AgentSnapshot, MemoryLevel}, + agent_snapshot::{extract_chunk_payload_png, AgentSnapshot, MemoryLevel}, + agent_snapshot_envelope::{ + decrypt_envelope, parse_chunk_payload, resolve_unlock_secret, ChunkPayload, + LOCKED_CARD_REFUSAL, + }, load_managed_agents, load_personas, save_managed_agents, save_personas, AgentDefinition, ManagedAgentRecord, RespondTo, }, @@ -72,6 +76,16 @@ pub struct AgentSnapshotImportPreview { pub has_source_allowlist: bool, /// Number of source allowlist entries. pub source_allowlist_count: usize, + /// Full source allowlist entries, surfaced before import so hidden access + /// configuration is never reduced to a count. + pub source_allowlist: Vec, + /// Pretty-printed, validated manifest exactly as decoded from the file. + /// The UI makes this available before confirmation for full payload review. + pub manifest_json: String, + /// True when the snapshot came from a locked (encrypted) card that this + /// machine successfully unlocked. Cards that cannot be unlocked never + /// reach a preview — they fail closed with the locked-card refusal. + pub locked: bool, } /// The confirmation request sent from the UI after the user reviews the preview. @@ -210,50 +224,112 @@ const PNG_MAGIC: [u8; 4] = [0x89, 0x50, 0x4e, 0x47]; /// /// **Size cap:** PNG inputs over 10 MiB and JSON inputs over 5 MiB are rejected /// before allocation to avoid avoidable large-input work. -pub(crate) fn decode_snapshot_from_bytes( - file_bytes: &[u8], -) -> Result { - if file_bytes.len() >= 4 && file_bytes[..4] == PNG_MAGIC { +/// +/// **Locked cards:** a structurally valid locked envelope parses successfully +/// as `ChunkPayload::Locked` — no decryption happens here. Callers that can +/// unlock go through [`decode_snapshot_for_import`]; callers that only need +/// transit validation (e.g. `fetch_snapshot_bytes`) accept `Locked` as-is. +pub(crate) fn parse_snapshot_payload_from_bytes(file_bytes: &[u8]) -> Result { + let payload: ChunkPayload = if file_bytes.len() >= 4 && file_bytes[..4] == PNG_MAGIC { if file_bytes.len() > MAX_SNAPSHOT_PNG_BYTES { return Err(format!( "Snapshot file is too large ({} MiB). PNG snapshots must be under 10 MiB.", file_bytes.len() / (1024 * 1024) )); } - let mut snapshot = decode_snapshot_png(file_bytes)?; + let chunk_json = extract_chunk_payload_png(file_bytes)?; + let mut payload = parse_chunk_payload(&chunk_json)?; // The PNG image body is the portable avatar. It deliberately wins over - // manifest avatar fields, whose URL may only be reachable by the - // sender. A 1×1 export placeholder leaves the manifest fallback intact. - if let Some(avatar_data_url) = - crate::managed_agents::snapshot_avatar::snapshot_png_avatar_data_url(file_bytes)? - { - snapshot.profile.avatar_data_url = Some(avatar_data_url); + // a manifest avatar *URL*, which may only be reachable by the sender. + // A 1×1 export placeholder leaves the manifest fallback intact. + // Inline manifest avatar *bytes* are authoritative and never + // overridden: trading cards supply the generated card artwork as the + // PNG body and carry the agent's real avatar inline — adopting the + // body there would import the card as the agent's face. + // Locked envelopes stay opaque here — there is no manifest to override + // until the unlock path decrypts one. + if let ChunkPayload::Plain(snapshot) = &mut payload { + if snapshot.profile.avatar_data_url.is_none() { + if let Some(avatar_data_url) = + crate::managed_agents::snapshot_avatar::snapshot_png_avatar_data_url( + file_bytes, + )? + { + snapshot.profile.avatar_data_url = Some(avatar_data_url); + } + } } - if snapshot.memory.level == MemoryLevel::None && !snapshot.memory.entries.is_empty() { - return Err( - "Snapshot is malformed: memory.level is 'none' but entries are present." - .to_string(), - ); + payload + } else { + // JSON path — apply size cap before serde allocation. + if file_bytes.len() > MAX_SNAPSHOT_JSON_BYTES { + return Err(format!( + "Snapshot file is too large ({} MiB). JSON snapshots must be under 5 MiB.", + file_bytes.len() / (1024 * 1024) + )); } - return Ok(snapshot); - } - // JSON path — apply size cap before serde allocation. - if file_bytes.len() > MAX_SNAPSHOT_JSON_BYTES { - return Err(format!( - "Snapshot file is too large ({} MiB). JSON snapshots must be under 5 MiB.", - file_bytes.len() / (1024 * 1024) - )); - } - let snapshot = decode_snapshot_json(file_bytes)?; + parse_chunk_payload(file_bytes)? + }; // Consistency check: none + non-empty entries is always malformed, - // regardless of format. Mirrors the PNG path above so the rule is - // enforced at decode time for both formats. - if !snapshot.memory.entries.is_empty() && snapshot.memory.level == MemoryLevel::None { + // regardless of enclosing format. Enforced at decode time for plain + // payloads here, and after decryption for locked ones (see + // `enforce_memory_consistency` callers). + if let ChunkPayload::Plain(snapshot) = &payload { + enforce_memory_consistency(snapshot)?; + } + Ok(payload) +} + +/// The shared malformed-memory guard: `memory.level == none` with non-empty +/// entries is always rejected before any write. +fn enforce_memory_consistency( + snapshot: &crate::managed_agents::agent_snapshot::AgentSnapshot, +) -> Result<(), String> { + if snapshot.memory.level == MemoryLevel::None && !snapshot.memory.entries.is_empty() { return Err( "Snapshot is malformed: memory.level is 'none' but entries are present.".to_string(), ); } - Ok(snapshot) + Ok(()) +} + +/// Decode a plain snapshot from raw bytes, refusing locked cards. +/// +/// Test-only convenience: production call sites either unlock through +/// [`decode_snapshot_for_import`] or validate structurally through +/// [`parse_snapshot_payload_from_bytes`]. +#[cfg(test)] +pub(crate) fn decode_snapshot_from_bytes( + file_bytes: &[u8], +) -> Result { + match parse_snapshot_payload_from_bytes(file_bytes)? { + ChunkPayload::Plain(snapshot) => Ok(*snapshot), + ChunkPayload::Locked(_) => Err(LOCKED_CARD_REFUSAL.to_string()), + } +} + +/// Decode a snapshot for import, unlocking locked cards when — and only +/// when — this machine holds one of the envelope's two exact key endpoints +/// (the owner identity or the named local agent record). +/// +/// Returns the decoded manifest and whether it came from a locked envelope. +/// When neither endpoint exists, fails closed with the locked-card refusal — +/// never partial plaintext, never crypto details. +pub(crate) fn decode_snapshot_for_import( + file_bytes: &[u8], + owner_keys: Option<&nostr::Keys>, + records: &[ManagedAgentRecord], +) -> Result<(crate::managed_agents::agent_snapshot::AgentSnapshot, bool), String> { + match parse_snapshot_payload_from_bytes(file_bytes)? { + ChunkPayload::Plain(snapshot) => Ok((*snapshot, false)), + ChunkPayload::Locked(envelope) => { + let secret = resolve_unlock_secret(&envelope, owner_keys, records) + .ok_or_else(|| LOCKED_CARD_REFUSAL.to_string())?; + let snapshot = decrypt_envelope(&envelope, &secret)?; + enforce_memory_consistency(&snapshot)?; + Ok((snapshot, true)) + } + } } async fn materialize_import_avatar( @@ -283,19 +359,38 @@ where /// `.agent.png` file. The format is sniffed from the content, not the /// extension, so an incorrectly-named file is handled correctly. /// +/// Locked cards are unlocked here when this machine holds one of the +/// envelope's two exact key endpoints; a card that cannot be unlocked fails +/// with the locked-card refusal (shown directly to the user), never a +/// partial preview. Identity-recovery mode is tolerated: owner keys are +/// simply unavailable, so only the agent-record endpoint can unlock. +/// /// Returns an `AgentSnapshotImportPreview` or a descriptive error. Errors -/// represent irrecoverable failures (corrupt / unsupported file) and are -/// shown directly to the user. +/// represent irrecoverable failures (corrupt / unsupported / locked-to- +/// someone-else file) and are shown directly to the user. #[tauri::command] pub async fn preview_agent_snapshot_import( file_bytes: Vec, file_name: String, + app: AppHandle, + state: State<'_, AppState>, ) -> Result { + // Key material + records are gathered up front (cheap, lock-scoped) so + // the blocking decode below owns plain data. + let owner_keys = state.signing_keys().ok(); + let records = { + let _store_guard = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + load_managed_agents(&app)? + }; tokio::task::spawn_blocking(move || { reject_legacy_persona_filename(&file_name)?; - let snapshot = decode_snapshot_from_bytes(&file_bytes)?; + let (snapshot, locked) = + decode_snapshot_for_import(&file_bytes, owner_keys.as_ref(), &records)?; - Ok(build_agent_snapshot_import_preview(&snapshot)) + build_agent_snapshot_import_preview(&snapshot, locked) }) .await .map_err(|e| format!("spawn_blocking failed: {e}"))? @@ -303,7 +398,8 @@ pub async fn preview_agent_snapshot_import( pub(crate) fn build_agent_snapshot_import_preview( snapshot: &AgentSnapshot, -) -> AgentSnapshotImportPreview { + locked: bool, +) -> Result { let memory_level = match snapshot.memory.level { MemoryLevel::None => "none", MemoryLevel::Core => "core", @@ -311,7 +407,11 @@ pub(crate) fn build_agent_snapshot_import_preview( } .to_string(); - AgentSnapshotImportPreview { + let manifest_json = serde_json::to_string_pretty(snapshot) + .map_err(|e| format!("failed to render snapshot manifest: {e}"))?; + let source_allowlist = snapshot.definition.respond_to_allowlist.clone(); + + Ok(AgentSnapshotImportPreview { display_name: snapshot.profile.display_name.clone(), is_builtin: snapshot.definition.source_is_builtin, model: snapshot.definition.model.clone(), @@ -325,9 +425,12 @@ pub(crate) fn build_agent_snapshot_import_preview( .or_else(|| snapshot.profile.avatar_url.clone()), memory_level, memory_entry_count: snapshot.memory.entries.len(), - source_allowlist_count: snapshot.definition.respond_to_allowlist.len(), - has_source_allowlist: !snapshot.definition.respond_to_allowlist.is_empty(), - } + source_allowlist_count: source_allowlist.len(), + has_source_allowlist: !source_allowlist.is_empty(), + source_allowlist, + manifest_json, + locked, + }) } // ── `confirm_agent_snapshot_import` ────────────────────────────────────────── @@ -355,8 +458,20 @@ pub async fn confirm_agent_snapshot_import( app: AppHandle, state: State<'_, AppState>, ) -> Result { - // ── Phase 1: validate (no I/O) ─────────────────────────────────────────── - let snapshot = decode_snapshot_from_bytes(&input.file_bytes)?; + // ── Phase 1: validate (no writes) ──────────────────────────────────────── + // Locked cards unlock only via this machine's exact key endpoints; + // anything else fails closed here, before key generation. + let snapshot = { + let owner_keys = state.signing_keys().ok(); + let records = { + let _store_guard = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + load_managed_agents(&app)? + }; + decode_snapshot_for_import(&input.file_bytes, owner_keys.as_ref(), &records)?.0 + }; let display_name = snapshot.profile.display_name.trim().to_string(); if display_name.is_empty() { @@ -511,6 +626,7 @@ pub async fn confirm_agent_snapshot_import( runtime_pid: None, backend: crate::managed_agents::BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -537,6 +653,7 @@ pub async fn confirm_agent_snapshot_import( definition_respond_to_allowlist: minted.respond_to_allowlist.clone(), definition_parallelism: minted_parallelism, relay_mesh: None, + effort_level: None, runtime: snapshot.definition.runtime.clone(), name_pool: snapshot.definition.name_pool.clone(), }; diff --git a/desktop/src-tauri/src/commands/personas/snapshot/tests.rs b/desktop/src-tauri/src/commands/personas/snapshot/tests.rs index 42893102807..fedb0e60585 100644 --- a/desktop/src-tauri/src/commands/personas/snapshot/tests.rs +++ b/desktop/src-tauri/src/commands/personas/snapshot/tests.rs @@ -48,6 +48,7 @@ fn make_definition(slug: &str) -> ManagedAgentRecord { runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -73,6 +74,7 @@ fn make_definition(slug: &str) -> ManagedAgentRecord { definition_respond_to_allowlist: vec![], definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -564,7 +566,7 @@ fn import_preview_includes_exported_definition_metadata() { let bytes = crate::managed_agents::agent_snapshot::encode_snapshot_json(&snapshot).unwrap(); let decoded = decode_snapshot_from_bytes(&bytes).unwrap(); - let preview = build_agent_snapshot_import_preview(&decoded); + let preview = build_agent_snapshot_import_preview(&decoded, false).unwrap(); assert!(preview.is_builtin); assert_eq!(preview.model.as_deref(), Some("claude-opus-4-5")); @@ -949,51 +951,14 @@ fn test_parse_format_is_png_invalid_returns_error() { } // ── Export: validate_snapshot_encode_size ──────────────────────────────────── -// -// Tests call `validate_snapshot_encode_size` directly so they prove the exact -// production guard — not a manual reconstruction. Removing or reversing the -// check in production code will cause these tests to fail. -/// JSON: boundary-1 passes, boundary is the last legal byte count. -#[test] -fn validate_encode_size_json_at_boundary_minus_1_passes() { - assert!(super::validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES - 1, false).is_ok()); -} +#[path = "tests_memory_entries.rs"] +mod memory_entries; -/// JSON: exactly at the boundary is the last accepted size. -#[test] -fn validate_encode_size_json_at_boundary_passes() { - assert!(super::validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES, false).is_ok()); -} +#[path = "tests_encode_size.rs"] +mod encode_size; -/// JSON: boundary+1 is rejected. -#[test] -fn validate_encode_size_json_over_boundary_is_rejected() { - let err = super::validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES + 1, false).unwrap_err(); - assert!( - err.contains("size limit"), - "error must mention size limit, got: {err}" - ); -} +// ── Import: decode_snapshot_for_import (locked cards) ───────────────────── -/// PNG: boundary-1 passes. -#[test] -fn validate_encode_size_png_at_boundary_minus_1_passes() { - assert!(super::validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES - 1, true).is_ok()); -} - -/// PNG: exactly at the boundary passes. -#[test] -fn validate_encode_size_png_at_boundary_passes() { - assert!(super::validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES, true).is_ok()); -} - -/// PNG: boundary+1 is rejected. -#[test] -fn validate_encode_size_png_over_boundary_is_rejected() { - let err = super::validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES + 1, true).unwrap_err(); - assert!( - err.contains("size limit"), - "error must mention size limit, got: {err}" - ); -} +#[path = "tests_locked.rs"] +mod locked_import; diff --git a/desktop/src-tauri/src/commands/personas/snapshot/tests_encode_size.rs b/desktop/src-tauri/src/commands/personas/snapshot/tests_encode_size.rs new file mode 100644 index 00000000000..36eaa997163 --- /dev/null +++ b/desktop/src-tauri/src/commands/personas/snapshot/tests_encode_size.rs @@ -0,0 +1,55 @@ +//! Export-size guard tests for `validate_snapshot_encode_size`. +//! +//! Kept in a sibling file so `snapshot/tests.rs` stays under the +//! 1000-line gate; `#[path]`-included from there as a child module, +//! so `super::*` still resolves to the shared test imports. +//! +//! Tests call `validate_snapshot_encode_size` directly so they prove the +//! exact production guard — not a manual reconstruction. Removing or +//! reversing the check in production code will cause these tests to fail. + +use super::*; + +/// JSON: boundary-1 passes, boundary is the last legal byte count. +#[test] +fn validate_encode_size_json_at_boundary_minus_1_passes() { + assert!(validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES - 1, false).is_ok()); +} + +/// JSON: exactly at the boundary is the last accepted size. +#[test] +fn validate_encode_size_json_at_boundary_passes() { + assert!(validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES, false).is_ok()); +} + +/// JSON: boundary+1 is rejected. +#[test] +fn validate_encode_size_json_over_boundary_is_rejected() { + let err = validate_snapshot_encode_size(MAX_SNAPSHOT_JSON_BYTES + 1, false).unwrap_err(); + assert!( + err.contains("size limit"), + "error must mention size limit, got: {err}" + ); +} + +/// PNG: boundary-1 passes. +#[test] +fn validate_encode_size_png_at_boundary_minus_1_passes() { + assert!(validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES - 1, true).is_ok()); +} + +/// PNG: exactly at the boundary passes. +#[test] +fn validate_encode_size_png_at_boundary_passes() { + assert!(validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES, true).is_ok()); +} + +/// PNG: boundary+1 is rejected. +#[test] +fn validate_encode_size_png_over_boundary_is_rejected() { + let err = validate_snapshot_encode_size(MAX_SNAPSHOT_PNG_BYTES + 1, true).unwrap_err(); + assert!( + err.contains("size limit"), + "error must mention size limit, got: {err}" + ); +} diff --git a/desktop/src-tauri/src/commands/personas/snapshot/tests_locked.rs b/desktop/src-tauri/src/commands/personas/snapshot/tests_locked.rs new file mode 100644 index 00000000000..296444f78d0 --- /dev/null +++ b/desktop/src-tauri/src/commands/personas/snapshot/tests_locked.rs @@ -0,0 +1,129 @@ +//! Locked-card import tests for `decode_snapshot_for_import`. +//! +//! Kept in a sibling file so `snapshot/tests.rs` stays under the +//! 1000-line gate; `#[path]`-included from there as a child module, +//! so `super::*` still resolves to the shared test helpers. + +use super::*; +use crate::commands::personas::snapshot::import::{ + decode_snapshot_for_import, parse_snapshot_payload_from_bytes, +}; +use crate::managed_agents::agent_snapshot_envelope::{ + encode_locked_snapshot_png, encrypt_snapshot_envelope, ChunkPayload, LOCKED_CARD_REFUSAL, +}; + +/// Build a keyed instance record holding real key material, so the +/// agent-endpoint unlock path resolves exactly as production does. +fn record_for(agent: &nostr::Keys) -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey: agent.public_key().to_hex(), + slug: None, + persona_id: Some("locked-test".to_string()), + private_key_nsec: nostr::ToBech32::to_bech32(agent.secret_key()).unwrap(), + ..make_definition("") + } +} + +fn locked_png(owner: &nostr::Keys, agent: &nostr::Keys) -> (AgentSnapshot, Vec) { + let snapshot = make_snapshot(MemoryLevel::None, vec![]); + let png = encode_locked_snapshot_png(&snapshot, owner, &agent.public_key(), None).unwrap(); + (snapshot, png) +} + +/// Owner identity key unlocks a locked card; `locked` is reported true. +#[test] +fn owner_endpoint_unlocks_locked_png() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let (snapshot, png) = locked_png(&owner, &agent); + let (decoded, locked) = decode_snapshot_for_import(&png, Some(&owner), &[]).unwrap(); + assert_eq!(decoded, snapshot); + assert!(locked); +} + +/// A local managed-agent record holding the agent nsec unlocks the card +/// even when the owner identity does not match (e.g. re-import on the +/// agent's own machine under a different owner identity). +#[test] +fn agent_record_endpoint_unlocks_locked_png() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let (snapshot, png) = locked_png(&owner, &agent); + let other_identity = nostr::Keys::generate(); + let records = vec![record_for(&agent)]; + let (decoded, locked) = + decode_snapshot_for_import(&png, Some(&other_identity), &records).unwrap(); + assert_eq!(decoded, snapshot); + assert!(locked); +} + +/// No matching endpoint → only the locked-card refusal, nothing else. +#[test] +fn stranger_fails_closed_with_refusal_only() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let (_snapshot, png) = locked_png(&owner, &agent); + let stranger = nostr::Keys::generate(); + let unrelated_record = record_for(&nostr::Keys::generate()); + let err = decode_snapshot_for_import(&png, Some(&stranger), &[unrelated_record]).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); + // And with no key material at all. + let err = decode_snapshot_for_import(&png, None, &[]).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); +} + +/// Plain snapshots pass through unchanged with `locked == false`, with or +/// without key material in scope. +#[test] +fn plain_snapshot_passes_through_unlocked() { + use crate::managed_agents::agent_snapshot::encode_snapshot_png; + let snapshot = make_snapshot(MemoryLevel::None, vec![]); + let png = encode_snapshot_png(&snapshot, None).unwrap(); + let owner = nostr::Keys::generate(); + let (decoded, locked) = decode_snapshot_for_import(&png, Some(&owner), &[]).unwrap(); + assert_eq!(decoded, snapshot); + assert!(!locked); + let (decoded, locked) = decode_snapshot_for_import(&png, None, &[]).unwrap(); + assert_eq!(decoded, snapshot); + assert!(!locked); +} + +/// The memory-consistency guard fires AFTER decryption too: a locked +/// envelope whose plaintext declares level none + non-empty entries is +/// rejected even for a legitimate endpoint. +#[test] +fn decrypted_manifest_memory_consistency_enforced() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let malformed = make_snapshot( + MemoryLevel::None, + vec![AgentSnapshotMemoryEntry { + slug: "core".to_string(), + body: "leaked".to_string(), + }], + ); + // encrypt_snapshot_envelope does not guard memory consistency (the + // PNG encoder does), so this constructs the malicious payload. + let envelope = encrypt_snapshot_envelope(&malformed, &owner, &agent.public_key()).unwrap(); + let json = serde_json::to_vec(&envelope).unwrap(); + let err = decode_snapshot_for_import(&json, Some(&owner), &[]).unwrap_err(); + assert!( + err.contains("'none' but entries are present"), + "post-decrypt consistency guard must fire, got: {err}" + ); +} + +/// Transit validation (`fetch_snapshot_bytes` path) accepts a locked PNG +/// without any key material — structural validation only, no decryption. +#[test] +fn transit_validation_accepts_locked_png_without_keys() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let (_snapshot, png) = locked_png(&owner, &agent); + let payload = parse_snapshot_payload_from_bytes(&png).unwrap(); + assert!(matches!(payload, ChunkPayload::Locked(_))); +} + +/// The keyless plain decoder refuses locked cards with the refusal. +#[test] +fn plain_decoder_refuses_locked_cards() { + let (owner, agent) = (nostr::Keys::generate(), nostr::Keys::generate()); + let (_snapshot, png) = locked_png(&owner, &agent); + let err = decode_snapshot_from_bytes(&png).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); +} diff --git a/desktop/src-tauri/src/commands/personas/snapshot/tests_memory_entries.rs b/desktop/src-tauri/src/commands/personas/snapshot/tests_memory_entries.rs new file mode 100644 index 00000000000..b17efa1ad11 --- /dev/null +++ b/desktop/src-tauri/src/commands/personas/snapshot/tests_memory_entries.rs @@ -0,0 +1,55 @@ +//! Tests for `memory_entries_from_listing` — the shared level → entries +//! selection used by both snapshot export and card minting. Split from +//! `tests.rs` to keep that file under the 1000-line gate; `#[path]`-included +//! from there as a child module, so `super::*` resolves to `tests`'s parent +//! scope re-exports. + +use super::*; + +fn listing_fixture() -> crate::commands::engrams::AgentMemoryListing { + let entry = |slug: &str, body: &str| crate::commands::engrams::EngramEntry { + slug: slug.to_string(), + body: body.to_string(), + event_id: "e".repeat(64), + created_at: 1, + outgoing_refs: vec![], + }; + crate::commands::engrams::AgentMemoryListing { + core: Some(entry("core", "core body")), + memories: vec![entry("mem/a", "a body"), entry("mem/b", "b body")], + truncated: false, + fetched_at: 1, + } +} + +#[test] +fn memory_entries_core_takes_core_only() { + let entries = memory_entries_from_listing(listing_fixture(), MemoryLevel::Core); + assert_eq!(entries.len(), 1); + assert_eq!(entries[0].slug, "core"); + assert_eq!(entries[0].body, "core body"); +} + +#[test] +fn memory_entries_everything_appends_mem_entries_after_core() { + let entries = memory_entries_from_listing(listing_fixture(), MemoryLevel::Everything); + assert_eq!( + entries.iter().map(|e| e.slug.as_str()).collect::>(), + vec!["core", "mem/a", "mem/b"] + ); +} + +#[test] +fn memory_entries_missing_core_still_yields_mem_entries_for_everything() { + let mut listing = listing_fixture(); + listing.core = None; + let entries = memory_entries_from_listing(listing, MemoryLevel::Everything); + assert_eq!( + entries.iter().map(|e| e.slug.as_str()).collect::>(), + vec!["mem/a", "mem/b"] + ); + + let mut core_only = listing_fixture(); + core_only.core = None; + assert!(memory_entries_from_listing(core_only, MemoryLevel::Core).is_empty()); +} diff --git a/desktop/src-tauri/src/commands/personas/update.rs b/desktop/src-tauri/src/commands/personas/update.rs index ed2472d54ea..b3830e62b52 100644 --- a/desktop/src-tauri/src/commands/personas/update.rs +++ b/desktop/src-tauri/src/commands/personas/update.rs @@ -9,7 +9,7 @@ use crate::{ managed_agents::{ apply_persona_behavior, effective_agent_command, load_managed_agents, load_personas, managed_agent_avatar_url, save_managed_agents, save_personas, try_regenerate_nest, - AgentDefinition, ManagedAgentRecord, UpdatePersonaRequest, + validate_agent_definition_text, AgentDefinition, ManagedAgentRecord, UpdatePersonaRequest, }, util::now_iso, }; @@ -91,6 +91,7 @@ pub(super) async fn update_persona_with( let state = app.state::(); let display_name = trim_required(&input.display_name, "Display name")?; let system_prompt = input.system_prompt.clone(); + validate_agent_definition_text(&display_name, &system_prompt)?; let avatar_url = trim_optional(input.avatar_url); let runtime = trim_optional(input.runtime); let model = trim_optional(input.model); diff --git a/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs b/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs index c60215ae4dd..556127373bf 100644 --- a/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs +++ b/desktop/src-tauri/src/commands/personas/update/name_propagation_tests.rs @@ -31,6 +31,7 @@ fn agent(persona_id: &str, name: &str, display_name: Option<&str>) -> ManagedAge runtime_pid: None, backend: Default::default(), backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -58,6 +59,7 @@ fn agent(persona_id: &str, name: &str, display_name: Option<&str>) -> ManagedAge definition_respond_to_allowlist: vec![], definition_parallelism: None, relay_mesh: None, + effort_level: None, } } diff --git a/desktop/src-tauri/src/commands/project_git.rs b/desktop/src-tauri/src/commands/project_git.rs index 201f3a05079..5b8b2adf8ee 100644 --- a/desktop/src-tauri/src/commands/project_git.rs +++ b/desktop/src-tauri/src/commands/project_git.rs @@ -2,92 +2,25 @@ use super::project_git_exec::{ build_git_auth_config, clean_branch, clean_target_ref, run_git, validate_workspace_clone_url, GitAuthConfig, }; +use super::project_git_file_content::{checkout_project_repo, read_preview_content}; use super::project_git_push::push_project_local_repository_blocking; +pub use super::project_git_types::{ + GitIdentityInfo, ProjectLocalRepoInfo, ProjectLocalRepoSnapshotInfo, ProjectRepoCommitInfo, + ProjectRepoContributorInfo, ProjectRepoFileInfo, ProjectRepoPullResult, ProjectRepoPushResult, + ProjectRepoSnapshotInfo, ProjectRepoSyncStatusInfo, +}; use super::project_repo_paths::{canonical_repos_roots, find_local_repo_dir}; use crate::app_state::AppState; -use serde::Serialize; use std::time::UNIX_EPOCH; -use tauri::State; -#[derive(Clone, Serialize)] -pub struct ProjectRepoCommitInfo { - pub hash: String, - pub short_hash: String, - pub author_name: String, - pub author_email: String, - pub timestamp: i64, - pub subject: String, -} -#[derive(Serialize)] -pub struct ProjectRepoFileInfo { - pub path: String, - pub kind: String, - pub size: Option, - pub preview_content: Option, - pub last_changed_at: Option, - pub latest_commit: Option, -} -#[derive(Serialize)] -pub struct ProjectRepoContributorInfo { - pub name: String, - pub email: String, - pub commit_count: usize, - pub last_commit_at: i64, -} -#[derive(Serialize)] -pub struct ProjectRepoSnapshotInfo { - pub latest_commit: Option, - pub commits: Vec, - pub files: Vec, - pub contributors: Vec, -} -#[derive(Serialize)] -pub struct ProjectLocalRepoSnapshotInfo { - pub path: String, - pub snapshot: ProjectRepoSnapshotInfo, -} -#[derive(Serialize)] -pub struct ProjectLocalRepoInfo { - pub name: String, - pub path: String, -} -#[derive(Serialize)] -pub struct ProjectRepoSyncStatusInfo { - pub local_path: Option, - pub local_branch: Option, - pub local_branches: Vec, - pub local_head: Option, - pub local_short_head: Option, - pub remote_branch: Option, - pub remote_head: Option, - pub remote_short_head: Option, - pub merge_base: Option, - pub ahead_count: usize, - pub behind_count: usize, - pub has_uncommitted_changes: bool, - pub has_untracked_files: bool, - pub can_push: bool, - pub push_block_reason: Option, - pub can_pull: bool, - pub pull_block_reason: Option, -} -#[derive(Serialize)] -pub struct ProjectRepoPushResult { - pub pushed: bool, - pub message: String, - pub branch: String, - pub commit: String, - pub merge_base: Option, -} -#[derive(Serialize)] -pub struct ProjectRepoPullResult { - pub pulled: bool, - pub message: String, -} -#[derive(Serialize)] -pub struct GitIdentityInfo { - pub name: Option, - pub email: Option, -} +use tauri::{AppHandle, State}; +use tauri_plugin_opener::OpenerExt; + +// Bound eager content without truncating the repository tree. +const MAX_EAGER_FILE_PREVIEWS: usize = 250; + +#[cfg(test)] +#[path = "project_git_tests.rs"] +mod tests; fn parse_latest_commit(output: &str) -> Option { let line = output.lines().next()?; let mut parts = line.split('\0'); @@ -134,30 +67,6 @@ fn has_untracked_files(output: &str) -> bool { output.lines().any(|line| line.starts_with("??")) } -fn read_preview_content( - repo_dir: &std::path::Path, - path: &str, - size: Option, -) -> Option { - const MAX_PREVIEW_BYTES: u64 = 64 * 1024; - if size.is_some_and(|value| value > MAX_PREVIEW_BYTES) { - return None; - } - - let full_path = repo_dir.join(path); - let normalized = full_path.canonicalize().ok()?; - let repo_root = repo_dir.canonicalize().ok()?; - if !normalized.starts_with(repo_root) { - return None; - } - - let bytes = std::fs::read(normalized).ok()?; - if bytes.contains(&0) { - return None; - } - String::from_utf8(bytes).ok() -} - fn parse_commits(output: &str) -> Vec { output .lines() @@ -254,24 +163,26 @@ fn parse_worktree_files( .filter_map(|path| { let full_path = repo_dir.join(path); let metadata = std::fs::metadata(&full_path).ok()?; - if !metadata.is_file() { - return None; - } + metadata.is_file().then_some((path, full_path, metadata)) + }) + .enumerate() + .map(|(index, (path, full_path, metadata))| { let size = Some(metadata.len()); let latest_commit = latest_commit_by_path.get(path).cloned(); - Some(ProjectRepoFileInfo { + ProjectRepoFileInfo { path: path.to_string(), kind: "blob".to_string(), size, - preview_content: read_preview_content(repo_dir, path, size), + preview_content: (index < MAX_EAGER_FILE_PREVIEWS) + .then(|| read_preview_content(repo_dir, path, size)) + .flatten(), last_changed_at: latest_commit .as_ref() .map(|commit| commit.timestamp) .or_else(|| path_modified_at(&full_path)), latest_commit, - }) + } }) - .take(250) .collect() } @@ -314,6 +225,7 @@ fn parse_ls_tree( output: &str, latest_commit_by_path: &std::collections::HashMap, ) -> Vec { + let mut blob_index = 0; output .lines() .filter_map(|line| { @@ -323,11 +235,12 @@ fn parse_ls_tree( let kind = parts.next()?.to_string(); let _object = parts.next()?; let size = parts.next().and_then(|value| value.parse::().ok()); - let preview_content = if kind == "blob" { - read_preview_content(repo_dir, path, size) - } else { - None - }; + if kind == "blob" { + blob_index += 1; + } + let preview_content = (kind == "blob" && blob_index <= MAX_EAGER_FILE_PREVIEWS) + .then(|| read_preview_content(repo_dir, path, size)) + .flatten(); Some(ProjectRepoFileInfo { path: path.to_string(), kind, @@ -339,7 +252,6 @@ fn parse_ls_tree( latest_commit: latest_commit_by_path.get(path).cloned(), }) }) - .take(250) .collect() } @@ -727,61 +639,14 @@ pub async fn get_project_repo_snapshot( tauri::async_runtime::spawn_blocking(move || { let temp_dir = tempfile::tempdir().map_err(|error| format!("create temp dir: {error}"))?; let repo_dir = temp_dir.path().join("repo"); - let repo_path = repo_dir - .to_str() - .ok_or_else(|| "temporary repository path is not UTF-8".to_string())?; - - let explicit_target = target_ref.as_deref().or(target_commit.as_deref()); - if let Some(fetch_ref) = explicit_target { - run_git( - &[ - "clone", - "--filter=blob:none", - "--no-checkout", - clone_url.as_str(), - repo_path, - ], - None, - &auth, - )?; - run_git( - &["fetch", "--depth=100", "origin", fetch_ref], - Some(&repo_dir), - &auth, - )?; - if let Some(expected_commit) = target_commit.as_deref() { - let fetched_commit = run_git(&["rev-parse", "FETCH_HEAD"], Some(&repo_dir), &auth) - .ok() - .and_then(|output| first_output_line(&output)) - .map(|commit| commit.to_ascii_lowercase()) - .ok_or_else(|| "Could not resolve the requested repository ref.".to_string())?; - if fetched_commit != expected_commit { - return Err( - "The requested repository ref changed. Refresh and try again.".to_string(), - ); - } - } - run_git( - &["checkout", "--detach", "FETCH_HEAD"], - Some(&repo_dir), - &auth, - )?; - } else { - let mut clone_args = vec!["clone", "--filter=blob:none"]; - if let Some(ref branch) = branch { - clone_args.push("--branch"); - clone_args.push(branch.as_str()); - } - clone_args.push(clone_url.as_str()); - clone_args.push(repo_path); - if run_git(&clone_args, None, &auth).is_err() && branch.is_some() { - run_git( - &["clone", "--filter=blob:none", clone_url.as_str(), repo_path], - None, - &auth, - )?; - } - } + checkout_project_repo( + &repo_dir, + &clone_url, + branch.as_deref(), + target_ref.as_deref(), + target_commit.as_deref(), + &auth, + )?; let snapshot = snapshot_from_repo(&repo_dir, &auth, branch.as_deref(), base_branch.as_deref()); @@ -861,6 +726,26 @@ pub async fn list_project_local_repositories( .map_err(|error| format!("local repo list task failed: {error}"))? } +#[tauri::command] +pub async fn open_project_repository_folder( + repos_dir: Option, + project_dtag: String, + clone_url: String, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + validate_workspace_clone_url(&clone_url, &state)?; + let repo_dir = tauri::async_runtime::spawn_blocking(move || { + find_local_repo_dir(repos_dir.as_deref(), &project_dtag, Some(&clone_url))? + .ok_or_else(|| "No local checkout found.".to_string()) + }) + .await + .map_err(|error| format!("local repo lookup task failed: {error}"))??; + app.opener() + .open_path(repo_dir.to_string_lossy(), None::<&str>) + .map_err(|error| format!("open local repository folder: {error}")) +} + #[tauri::command] pub async fn get_project_repo_sync_status( repos_dir: Option, diff --git a/desktop/src-tauri/src/commands/project_git_exec.rs b/desktop/src-tauri/src/commands/project_git_exec.rs index e4a8ad7b410..c616d39db1e 100644 --- a/desktop/src-tauri/src/commands/project_git_exec.rs +++ b/desktop/src-tauri/src/commands/project_git_exec.rs @@ -203,6 +203,22 @@ pub(crate) fn build_git_auth_config(state: &AppState) -> Result Result { + if validate_github_clone_url(clone_url).is_ok() { + return Ok(GitAuthConfig { + git_path: resolve_command("git") + .ok_or_else(|| "git was not found on PATH".to_string())?, + credential_helper: None, + nsec: String::new(), + allow_file_transport: false, + }); + } + build_git_auth_config(state) +} + pub(crate) fn build_git_auth_config_for_keys(keys: &Keys) -> Result { let git_path = resolve_command("git").ok_or_else(|| "git was not found on PATH".to_string())?; let credential_helper = resolve_command("git-credential-nostr"); @@ -288,6 +304,56 @@ pub(crate) fn validate_clone_url(clone_url: &str) -> Result<(), String> { Ok(()) } +fn validate_github_clone_url(clone_url: &str) -> Result<(), String> { + let parsed = Url::parse(clone_url).map_err(|error| format!("invalid clone URL: {error}"))?; + if parsed.scheme() != "https" + || parsed.host_str() != Some("github.com") + || parsed.port().is_some() + || !parsed.username().is_empty() + || parsed.password().is_some() + || parsed.query().is_some() + || parsed.fragment().is_some() + { + return Err("GitHub clone URL must use public https://github.com/owner/repository".into()); + } + let segments = parsed + .path_segments() + .map(|segments| { + segments + .filter(|segment| !segment.is_empty()) + .collect::>() + }) + .unwrap_or_default(); + let valid_segment = |segment: &&str| { + !segment.starts_with('-') + && !segment.contains("..") + && segment.chars().all(|character| { + character.is_ascii_alphanumeric() || matches!(character, '.' | '_' | '-') + }) + }; + if segments.len() != 2 || !segments.iter().all(valid_segment) { + return Err("GitHub clone URL must name one owner and repository".into()); + } + Ok(()) +} + +pub(crate) fn validate_local_clone_url(clone_url: &str) -> Result<(), String> { + if validate_clone_url(clone_url).is_ok() || validate_github_clone_url(clone_url).is_ok() { + return Ok(()); + } + Err("clone URL must point at a Buzz repository or public GitHub repository".into()) +} + +pub(crate) fn validate_local_clone_url_for_workspace( + clone_url: &str, + state: &AppState, +) -> Result<(), String> { + if validate_github_clone_url(clone_url).is_ok() { + return Ok(()); + } + validate_workspace_clone_url(clone_url, state) +} + pub(crate) fn clone_url_owner(clone_url: &str) -> Option { let parsed = Url::parse(clone_url).ok()?; let segments = parsed @@ -329,6 +395,7 @@ mod tests { use super::{ clean_branch, clean_target_ref, credential_helper_config_value, git_needs_credentials, git_subcommand, validate_clone_url, validate_clone_url_against_relay, + validate_local_clone_url, }; #[test] @@ -441,4 +508,15 @@ mod tests { ) .is_err()); } + + #[test] + fn local_clone_url_allows_only_public_github_https_urls() { + assert!(validate_local_clone_url("https://github.com/block/buzz").is_ok()); + assert!(validate_local_clone_url("https://github.com/block/buzz.git").is_ok()); + assert!(validate_local_clone_url("http://github.com/block/buzz").is_err()); + assert!(validate_local_clone_url("https://github.com/block/buzz/issues").is_err()); + assert!(validate_local_clone_url("https://user@github.com/block/buzz").is_err()); + assert!(validate_local_clone_url("https://github.com.evil.test/block/buzz").is_err()); + assert!(validate_local_clone_url("https://gitlab.com/block/buzz").is_err()); + } } diff --git a/desktop/src-tauri/src/commands/project_git_file_content.rs b/desktop/src-tauri/src/commands/project_git_file_content.rs new file mode 100644 index 00000000000..1ada9f664fc --- /dev/null +++ b/desktop/src-tauri/src/commands/project_git_file_content.rs @@ -0,0 +1,178 @@ +use super::project_git::first_output_line; +use super::project_git_exec::{ + build_git_auth_config, clean_branch, clean_target_ref, run_git, validate_workspace_clone_url, + GitAuthConfig, +}; +use super::project_repo_paths::find_local_repo_dir; +use crate::app_state::AppState; +use tauri::State; + +const MAX_PREVIEW_BYTES: u64 = 64 * 1024; + +pub(crate) fn read_preview_content( + repo_dir: &std::path::Path, + path: &str, + size: Option, +) -> Option { + if size.is_some_and(|value| value > MAX_PREVIEW_BYTES) { + return None; + } + + let full_path = repo_dir.join(path); + if std::fs::symlink_metadata(&full_path) + .ok()? + .file_type() + .is_symlink() + { + return None; + } + let normalized = full_path.canonicalize().ok()?; + let repo_root = repo_dir.canonicalize().ok()?; + if !normalized.starts_with(repo_root) { + return None; + } + + let metadata = std::fs::metadata(&normalized).ok()?; + if !metadata.is_file() || metadata.len() > MAX_PREVIEW_BYTES { + return None; + } + let bytes = std::fs::read(normalized).ok()?; + if bytes.contains(&0) { + return None; + } + String::from_utf8(bytes).ok() +} + +pub(crate) fn validate_repo_file_path(path: &str) -> Result<(), String> { + if path.is_empty() + || std::path::Path::new(path) + .components() + .any(|component| !matches!(component, std::path::Component::Normal(_))) + { + return Err("Repository file path must be a relative file path.".to_string()); + } + Ok(()) +} + +pub(crate) fn checkout_project_repo( + repo_dir: &std::path::Path, + clone_url: &str, + branch: Option<&str>, + target_ref: Option<&str>, + target_commit: Option<&str>, + auth: &GitAuthConfig, +) -> Result<(), String> { + let repo_path = repo_dir + .to_str() + .ok_or_else(|| "temporary repository path is not UTF-8".to_string())?; + let explicit_target = target_ref.or(target_commit); + + if let Some(fetch_ref) = explicit_target { + run_git( + &[ + "clone", + "--filter=blob:none", + "--no-checkout", + clone_url, + repo_path, + ], + None, + auth, + )?; + run_git( + &["fetch", "--depth=100", "origin", fetch_ref], + Some(repo_dir), + auth, + )?; + if let Some(expected_commit) = target_commit { + let fetched_commit = run_git(&["rev-parse", "FETCH_HEAD"], Some(repo_dir), auth) + .ok() + .and_then(|output| first_output_line(&output)) + .map(|commit| commit.to_ascii_lowercase()) + .ok_or_else(|| "Could not resolve the requested repository ref.".to_string())?; + if fetched_commit != expected_commit { + return Err( + "The requested repository ref changed. Refresh and try again.".to_string(), + ); + } + } + run_git( + &["checkout", "--detach", "FETCH_HEAD"], + Some(repo_dir), + auth, + )?; + return Ok(()); + } + + let mut clone_args = vec!["clone", "--filter=blob:none"]; + if let Some(branch) = branch { + clone_args.push("--branch"); + clone_args.push(branch); + } + clone_args.push(clone_url); + clone_args.push(repo_path); + if run_git(&clone_args, None, auth).is_err() && branch.is_some() { + run_git( + &["clone", "--filter=blob:none", clone_url, repo_path], + None, + auth, + )?; + } + Ok(()) +} + +#[tauri::command] +pub async fn get_project_repo_file_content( + clone_url: String, + default_branch: Option, + target_ref: Option, + target_commit: Option, + path: String, + state: State<'_, AppState>, +) -> Result, String> { + validate_workspace_clone_url(&clone_url, &state)?; + validate_repo_file_path(&path)?; + let auth = build_git_auth_config(&state)?; + let branch = clean_branch(default_branch); + let target_ref = clean_target_ref(target_ref); + let target_commit = target_commit + .map(|value| value.to_ascii_lowercase()) + .filter(|value| matches!(value.len(), 40 | 64)) + .filter(|value| value.chars().all(|c| c.is_ascii_hexdigit())); + + tauri::async_runtime::spawn_blocking(move || { + let temp_dir = tempfile::tempdir().map_err(|error| format!("create temp dir: {error}"))?; + let repo_dir = temp_dir.path().join("repo"); + checkout_project_repo( + &repo_dir, + &clone_url, + branch.as_deref(), + target_ref.as_deref(), + target_commit.as_deref(), + &auth, + )?; + Ok(read_preview_content(&repo_dir, &path, None)) + }) + .await + .map_err(|error| format!("repo file content task failed: {error}"))? +} + +#[tauri::command] +pub async fn get_project_local_repo_file_content( + repos_dir: Option, + project_dtag: String, + clone_url: Option, + path: String, +) -> Result, String> { + validate_repo_file_path(&path)?; + tauri::async_runtime::spawn_blocking(move || { + let Some(repo_dir) = + find_local_repo_dir(repos_dir.as_deref(), &project_dtag, clone_url.as_deref())? + else { + return Ok(None); + }; + Ok(read_preview_content(&repo_dir, &path, None)) + }) + .await + .map_err(|error| format!("local repo file content task failed: {error}"))? +} diff --git a/desktop/src-tauri/src/commands/project_git_recipient_notes.rs b/desktop/src-tauri/src/commands/project_git_recipient_notes.rs new file mode 100644 index 00000000000..4695749fed7 --- /dev/null +++ b/desktop/src-tauri/src/commands/project_git_recipient_notes.rs @@ -0,0 +1,430 @@ +//! Labeled recipient notes for the Projects workflow: kind:1 comments whose +//! `p` tags name recipients on a root event. Pull-request review requests +//! (`t: review-request`) and issue assignments (`t: assignment`) share this +//! shape so clients can parse them with one code path. + +use super::project_git_workflow::{ + normalize_event_id, project_owner_identity, validate_repo_address, +}; +use crate::app_state::AppState; +use crate::relay::submit_signed_event_with_keys; +use nostr::{Event, EventBuilder, JsonUtil, Keys, Kind, Tag, Timestamp}; +use serde::Deserialize; +use tauri::{AppHandle, State}; + +/// Repository-scoped metadata for an agent-signed review request. +#[derive(Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ProjectPullRequestReviewRequestInput { + target_owner: String, + repo_address: String, + pull_request_id: String, + reviewers: Vec, + reviewer_label: String, +} + +/// Repository-scoped metadata for an agent-signed issue assignee operation. +#[derive(Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ProjectIssueAssigneeOperationInput { + target_owner: String, + repo_address: String, + issue_id: String, + assignees: Vec, + assignee_label: String, + created_at: u64, +} + +#[derive(Clone, Copy)] +enum IssueAssigneeOperation { + Assign, + Unassign, +} + +impl IssueAssigneeOperation { + fn label(self) -> &'static str { + match self { + Self::Assign => "assignment", + Self::Unassign => "unassignment", + } + } + + fn content(self, assignee_label: &str) -> String { + match self { + Self::Assign => format!("Assigned this issue to {assignee_label}"), + Self::Unassign => format!("Unassigned {assignee_label} from this issue"), + } + } +} + +/// Parameters for [`build_labeled_recipient_note_event`]. +struct LabeledRecipientNote<'a> { + repo_address: &'a str, + root_id: &'a str, + root_id_error: &'a str, + recipients: &'a [String], + recipient_noun: &'a str, + label: &'a str, + content: String, + created_at: Option, +} + +/// Shared builder for labeled kind:1 notes tagging recipients (`p`) on a +/// root event — the convention used by both PR review requests +/// (`t: review-request`) and issue assignments (`t: assignment`). +fn build_labeled_recipient_note_event( + keys: &Keys, + note: LabeledRecipientNote<'_>, +) -> Result { + let LabeledRecipientNote { + repo_address, + root_id, + root_id_error, + recipients, + recipient_noun, + label, + content, + created_at, + } = note; + let owner = keys.public_key().to_hex(); + validate_repo_address(repo_address, &owner)?; + let root_id = normalize_event_id(root_id).ok_or_else(|| root_id_error.to_string())?; + if recipients.is_empty() || recipients.len() > 50 { + return Err(format!("Select between 1 and 50 {recipient_noun}s.")); + } + let mut recipients = recipients + .iter() + .map(|recipient| { + normalize_event_id(recipient).ok_or_else(|| format!("Invalid {recipient_noun} pubkey.")) + }) + .collect::, _>>()?; + recipients.sort(); + recipients.dedup(); + + let mut raw_tags = vec![ + vec!["e".to_string(), root_id, String::new(), "root".to_string()], + vec!["a".to_string(), repo_address.to_string()], + ]; + raw_tags.extend( + recipients + .into_iter() + .map(|recipient| vec!["p".to_string(), recipient]), + ); + raw_tags.push(vec!["t".to_string(), label.to_string()]); + let tags = raw_tags + .into_iter() + .map(Tag::parse) + .collect::, _>>() + .map_err(|error| format!("build {label} tags: {error}"))?; + let mut builder = EventBuilder::new(Kind::TextNote, content).tags(tags); + if let Some(created_at) = created_at { + builder = builder.custom_created_at(Timestamp::from_secs(created_at)); + } + builder + .sign_with_keys(keys) + .map(|event| event.as_json()) + .map_err(|error| format!("sign {label} note: {error}")) +} + +fn build_review_request_event( + keys: &Keys, + repo_address: &str, + pull_request_id: &str, + reviewers: &[String], + reviewer_label: &str, +) -> Result { + let reviewer_label = reviewer_label.trim(); + if reviewer_label.is_empty() || reviewer_label.chars().count() > 128 { + return Err("Reviewer label must be between 1 and 128 characters.".to_string()); + } + build_labeled_recipient_note_event( + keys, + LabeledRecipientNote { + repo_address, + root_id: pull_request_id, + root_id_error: "Invalid pull request event ID.", + recipients: reviewers, + recipient_noun: "reviewer", + label: "review-request", + content: format!("Requested a review from {reviewer_label}"), + created_at: None, + }, + ) +} + +#[cfg(test)] +fn build_issue_assignment_event( + keys: &Keys, + repo_address: &str, + issue_id: &str, + assignees: &[String], + assignee_label: &str, + created_at: Option, +) -> Result { + build_issue_assignee_operation_event( + keys, + repo_address, + issue_id, + assignees, + assignee_label, + created_at, + IssueAssigneeOperation::Assign, + ) +} + +#[cfg(test)] +fn build_issue_unassignment_event( + keys: &Keys, + repo_address: &str, + issue_id: &str, + assignees: &[String], + assignee_label: &str, + created_at: Option, +) -> Result { + build_issue_assignee_operation_event( + keys, + repo_address, + issue_id, + assignees, + assignee_label, + created_at, + IssueAssigneeOperation::Unassign, + ) +} + +#[allow(clippy::too_many_arguments)] +fn build_issue_assignee_operation_event( + keys: &Keys, + repo_address: &str, + issue_id: &str, + assignees: &[String], + assignee_label: &str, + created_at: Option, + operation: IssueAssigneeOperation, +) -> Result { + let assignee_label = assignee_label.trim(); + if assignee_label.is_empty() || assignee_label.chars().count() > 128 { + return Err("Assignee label must be between 1 and 128 characters.".to_string()); + } + build_labeled_recipient_note_event( + keys, + LabeledRecipientNote { + repo_address, + root_id: issue_id, + root_id_error: "Invalid issue event ID.", + recipients: assignees, + recipient_noun: "assignee", + label: operation.label(), + content: operation.content(assignee_label), + created_at, + }, + ) +} + +#[tauri::command] +pub async fn sign_project_pull_request_review_request( + input: ProjectPullRequestReviewRequestInput, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + let target_owner = input.target_owner.trim().to_ascii_lowercase(); + if normalize_event_id(&target_owner).is_none() { + return Err("Invalid target repository owner.".to_string()); + } + let identity = project_owner_identity(&app, &state, &target_owner)?; + let event = Event::from_json(build_review_request_event( + &identity.keys, + &input.repo_address, + &input.pull_request_id, + &input.reviewers, + &input.reviewer_label, + )?) + .map_err(|error| format!("parse signed review request: {error}"))?; + submit_signed_event_with_keys(&event, &state, &identity.keys, identity.auth_tag.as_deref()) + .await?; + Ok(()) +} + +#[tauri::command] +pub async fn sign_project_issue_assignment( + input: ProjectIssueAssigneeOperationInput, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + sign_project_issue_assignee_operation(input, IssueAssigneeOperation::Assign, app, state).await +} + +#[tauri::command] +pub async fn sign_project_issue_unassignment( + input: ProjectIssueAssigneeOperationInput, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + sign_project_issue_assignee_operation(input, IssueAssigneeOperation::Unassign, app, state).await +} + +async fn sign_project_issue_assignee_operation( + input: ProjectIssueAssigneeOperationInput, + operation: IssueAssigneeOperation, + app: AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + let target_owner = input.target_owner.trim().to_ascii_lowercase(); + if normalize_event_id(&target_owner).is_none() { + return Err("Invalid target repository owner.".to_string()); + } + let identity = project_owner_identity(&app, &state, &target_owner)?; + let event = Event::from_json(build_issue_assignee_operation_event( + &identity.keys, + &input.repo_address, + &input.issue_id, + &input.assignees, + &input.assignee_label, + Some(input.created_at), + operation, + )?) + .map_err(|error| format!("parse signed issue {}: {error}", operation.label()))?; + submit_signed_event_with_keys(&event, &state, &identity.keys, identity.auth_tag.as_deref()) + .await?; + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::{ + build_issue_assignment_event, build_issue_unassignment_event, build_review_request_event, + }; + use nostr::{Event, JsonUtil, Keys}; + + #[test] + fn issue_assignment_is_signed_by_repository_owner() { + let keys = Keys::generate(); + let owner = keys.public_key().to_hex(); + let assignee = "b".repeat(64); + let repo_address = format!("30617:{owner}:buzz"); + let event = Event::from_json( + build_issue_assignment_event( + &keys, + &repo_address, + &"d".repeat(64), + std::slice::from_ref(&assignee), + "Bob", + None, + ) + .unwrap(), + ) + .unwrap(); + + assert_eq!(event.pubkey, keys.public_key()); + assert_eq!(event.kind, nostr::Kind::TextNote); + assert_eq!(event.content, "Assigned this issue to Bob"); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["p", assignee.as_str()])); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["t", "assignment"])); + assert!(event.verify().is_ok()); + } + + #[test] + fn issue_assignment_rejects_invalid_metadata() { + let keys = Keys::generate(); + let owner = keys.public_key().to_hex(); + let repo_address = format!("30617:{owner}:buzz"); + + assert!(build_issue_assignment_event( + &keys, + &repo_address, + &"d".repeat(64), + &[], + "Bob", + None, + ) + .is_err()); + assert!(build_issue_assignment_event( + &keys, + &repo_address, + &"d".repeat(64), + &["b".repeat(64)], + " ", + None, + ) + .is_err()); + assert!(build_issue_assignment_event( + &keys, + &repo_address, + "not-an-event-id", + &["b".repeat(64)], + "Bob", + None, + ) + .is_err()); + } + + #[test] + fn issue_unassignment_is_signed_by_repository_owner() { + let keys = Keys::generate(); + let owner = keys.public_key().to_hex(); + let assignee = "b".repeat(64); + let repo_address = format!("30617:{owner}:buzz"); + let event = Event::from_json( + build_issue_unassignment_event( + &keys, + &repo_address, + &"d".repeat(64), + std::slice::from_ref(&assignee), + "Bob", + Some(123), + ) + .unwrap(), + ) + .unwrap(); + + assert_eq!(event.content, "Unassigned Bob from this issue"); + assert_eq!(event.created_at.as_secs(), 123); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["p", assignee.as_str()])); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["t", "unassignment"])); + assert!(event.verify().is_ok()); + } + + #[test] + fn review_request_is_signed_by_repository_owner() { + let keys = Keys::generate(); + let owner = keys.public_key().to_hex(); + let reviewer = "b".repeat(64); + let repo_address = format!("30617:{owner}:buzz"); + let event = Event::from_json( + build_review_request_event( + &keys, + &repo_address, + &"d".repeat(64), + std::slice::from_ref(&reviewer), + "Bob", + ) + .unwrap(), + ) + .unwrap(); + + assert_eq!(event.pubkey, keys.public_key()); + assert_eq!(event.kind, nostr::Kind::TextNote); + assert_eq!(event.content, "Requested a review from Bob"); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["p", reviewer.as_str()])); + assert!(event + .tags + .iter() + .any(|tag| tag.as_slice() == ["t", "review-request"])); + assert!(event.verify().is_ok()); + } +} diff --git a/desktop/src-tauri/src/commands/project_git_tests.rs b/desktop/src-tauri/src/commands/project_git_tests.rs new file mode 100644 index 00000000000..99e31d77748 --- /dev/null +++ b/desktop/src-tauri/src/commands/project_git_tests.rs @@ -0,0 +1,111 @@ +use super::super::project_git_file_content::validate_repo_file_path; +use super::*; + +#[test] +fn parse_ls_tree_keeps_paths_after_eager_preview_limit() { + let repo_dir = tempfile::tempdir().expect("create temporary repository"); + std::fs::create_dir(repo_dir.path().join("src")).expect("create source directory"); + std::fs::write(repo_dir.path().join("README.md"), "# Deferred README") + .expect("write deferred README"); + std::fs::write( + repo_dir.path().join("src/application.rs"), + "fn deferred() {}", + ) + .expect("write deferred source file"); + let hidden_entries = (0..MAX_EAGER_FILE_PREVIEWS) + .map(|index| { + format!( + "100644 blob {} 1\t.agents/generated-{index:03}.txt", + "a".repeat(40) + ) + }) + .collect::>() + .join("\n"); + let output = format!( + "{hidden_entries}\n100644 blob {} 17\tREADME.md\n100644 blob {} 16\tsrc/application.rs", + "b".repeat(40), + "c".repeat(40) + ); + + let files = parse_ls_tree(repo_dir.path(), &output, &std::collections::HashMap::new()); + + assert_eq!(files.len(), MAX_EAGER_FILE_PREVIEWS + 2); + let readme = files + .iter() + .find(|file| file.path == "README.md") + .expect("README metadata remains visible"); + assert_eq!(readme.preview_content, None); + assert_eq!( + read_preview_content(repo_dir.path(), &readme.path, readme.size).as_deref(), + Some("# Deferred README") + ); + assert_eq!( + files.last().map(|file| file.path.as_str()), + Some("src/application.rs") + ); + let source = files.last().expect("source metadata remains visible"); + assert_eq!(source.preview_content, None); + assert_eq!( + read_preview_content(repo_dir.path(), &source.path, source.size).as_deref(), + Some("fn deferred() {}") + ); +} + +#[test] +fn repo_file_paths_reject_traversal_and_absolute_paths() { + assert!(validate_repo_file_path("src/application.rs").is_ok()); + assert!(validate_repo_file_path("../outside.txt").is_err()); + assert!(validate_repo_file_path("src/../outside.txt").is_err()); + assert!(validate_repo_file_path("/absolute.txt").is_err()); +} + +#[test] +fn parse_ls_tree_counts_only_blobs_toward_eager_preview_limit() { + let repo_dir = tempfile::tempdir().expect("create temporary repository"); + std::fs::write(repo_dir.path().join("application.rs"), "fn main() {}") + .expect("write preview file"); + let non_blob_entries = (0..MAX_EAGER_FILE_PREVIEWS) + .map(|index| { + format!( + "160000 commit {} -\tvendor/dependency-{index:03}", + "a".repeat(40) + ) + }) + .collect::>() + .join("\n"); + let output = format!( + "{non_blob_entries}\n100644 blob {} 12\tapplication.rs", + "b".repeat(40) + ); + + let files = parse_ls_tree(repo_dir.path(), &output, &std::collections::HashMap::new()); + + assert_eq!( + files + .last() + .and_then(|file| file.preview_content.as_deref()), + Some("fn main() {}") + ); +} + +#[test] +fn parse_worktree_files_counts_only_files_toward_eager_preview_limit() { + let repo_dir = tempfile::tempdir().expect("create temporary repository"); + std::fs::create_dir(repo_dir.path().join("directory")).expect("create directory"); + let paths = (0..MAX_EAGER_FILE_PREVIEWS) + .map(|index| { + let path = format!("file-{index:03}.txt"); + std::fs::write(repo_dir.path().join(&path), "preview").expect("write preview file"); + path + }) + .collect::>(); + let output = std::iter::once("directory") + .chain(paths.iter().map(String::as_str)) + .collect::>() + .join("\0"); + + let files = parse_worktree_files(repo_dir.path(), &output, &std::collections::HashMap::new()); + + assert_eq!(files.len(), MAX_EAGER_FILE_PREVIEWS); + assert!(files.iter().all(|file| file.preview_content.is_some())); +} diff --git a/desktop/src-tauri/src/commands/project_git_types.rs b/desktop/src-tauri/src/commands/project_git_types.rs new file mode 100644 index 00000000000..ce04c73f005 --- /dev/null +++ b/desktop/src-tauri/src/commands/project_git_types.rs @@ -0,0 +1,91 @@ +use serde::Serialize; + +#[derive(Clone, Serialize)] +pub struct ProjectRepoCommitInfo { + pub hash: String, + pub short_hash: String, + pub author_name: String, + pub author_email: String, + pub timestamp: i64, + pub subject: String, +} + +#[derive(Serialize)] +pub struct ProjectRepoFileInfo { + pub path: String, + pub kind: String, + pub size: Option, + pub preview_content: Option, + pub last_changed_at: Option, + pub latest_commit: Option, +} + +#[derive(Serialize)] +pub struct ProjectRepoContributorInfo { + pub name: String, + pub email: String, + pub commit_count: usize, + pub last_commit_at: i64, +} + +#[derive(Serialize)] +pub struct ProjectRepoSnapshotInfo { + pub latest_commit: Option, + pub commits: Vec, + pub files: Vec, + pub contributors: Vec, +} + +#[derive(Serialize)] +pub struct ProjectLocalRepoSnapshotInfo { + pub path: String, + pub snapshot: ProjectRepoSnapshotInfo, +} + +#[derive(Serialize)] +pub struct ProjectLocalRepoInfo { + pub name: String, + pub path: String, +} + +#[derive(Serialize)] +pub struct ProjectRepoSyncStatusInfo { + pub local_path: Option, + pub local_branch: Option, + pub local_branches: Vec, + pub local_head: Option, + pub local_short_head: Option, + pub remote_branch: Option, + pub remote_head: Option, + pub remote_short_head: Option, + pub merge_base: Option, + pub ahead_count: usize, + pub behind_count: usize, + pub has_uncommitted_changes: bool, + pub has_untracked_files: bool, + pub can_push: bool, + pub push_block_reason: Option, + pub can_pull: bool, + pub pull_block_reason: Option, +} + +#[derive(Serialize)] +pub struct ProjectRepoPushResult { + pub pushed: bool, + pub message: String, + pub branch: String, + pub commit: String, + pub merge_base: Option, +} + +#[derive(Serialize)] +pub struct ProjectRepoPullResult { + pub pulled: bool, + pub message: String, +} + +#[derive(Serialize)] +pub struct GitIdentityInfo { + pub name: Option, + pub email: Option, +} diff --git a/desktop/src-tauri/src/commands/project_git_workflow.rs b/desktop/src-tauri/src/commands/project_git_workflow.rs index 624bbf4dfc8..2784068c7ca 100644 --- a/desktop/src-tauri/src/commands/project_git_workflow.rs +++ b/desktop/src-tauri/src/commands/project_git_workflow.rs @@ -3,8 +3,9 @@ use super::project_git::{first_output_line, normalize_branch_option}; use super::project_git_diff::clean_commit; use super::project_git_exec::{ - build_git_auth_config, build_git_auth_config_for_keys, clone_url_owner, run_git, - validate_clone_url, validate_workspace_clone_url, GitAuthConfig, + build_git_auth_config_for_keys, build_git_clone_auth_config, clone_url_owner, run_git, + validate_local_clone_url, validate_local_clone_url_for_workspace, validate_workspace_clone_url, + GitAuthConfig, }; use super::project_repo_paths::{ canonical_repos_roots, canonicalize_repos_root, default_repos_root_candidates, @@ -58,17 +59,6 @@ pub struct ProjectPullRequestMergeInput { expected_commit: String, } -/// Repository-scoped metadata for an agent-signed review request. -#[derive(Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct ProjectPullRequestReviewRequestInput { - target_owner: String, - repo_address: String, - pull_request_id: String, - reviewers: Vec, - reviewer_label: String, -} - /// Repository-scoped metadata for an agent-signed lifecycle status. #[derive(Deserialize)] #[serde(rename_all = "camelCase")] @@ -89,21 +79,41 @@ pub struct ProjectPullRequestMergedStatusInput { status_event: String, } +/// A project or repository announcement signed by its direct or managed owner. +#[derive(Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct ProjectOwnerAnnouncementInput { + target_owner: String, + kind: u16, + content: String, + created_at: Option, + tags: Vec>, +} + +/// Signed announcement plus any relay publication failure for recovery. +#[derive(Serialize)] +pub struct ProjectOwnerAnnouncementResult { + /// Serialized signed Nostr event. + event: String, + /// Relay error when signing succeeded but publication did not. + publication_error: Option, +} + fn normalize_commit(value: &str) -> Option { clean_commit(Some(value.trim().to_ascii_lowercase())) } -fn normalize_event_id(value: &str) -> Option { +pub(crate) fn normalize_event_id(value: &str) -> Option { let value = value.trim().to_ascii_lowercase(); (value.len() == 64 && value.chars().all(|c| c.is_ascii_hexdigit())).then_some(value) } -struct ProjectOwnerIdentity { - keys: Keys, - auth_tag: Option, +pub(crate) struct ProjectOwnerIdentity { + pub(crate) keys: Keys, + pub(crate) auth_tag: Option, } -fn project_owner_identity( +pub(crate) fn project_owner_identity( app: &AppHandle, state: &AppState, target_owner: &str, @@ -125,7 +135,7 @@ fn project_owner_identity( .iter() .find(|record| record.pubkey.eq_ignore_ascii_case(target_owner)) .ok_or_else(|| { - "Only the repository owner or the owner of its managed agent can merge pull requests." + "Only the owner identity or the owner of its managed agent can perform this action." .to_string() })?; if let Some(error) = spawn_key_refusal(record) { @@ -142,7 +152,7 @@ fn project_owner_identity( }) } -fn validate_repo_address(repo_address: &str, owner: &str) -> Result<(), String> { +pub(crate) fn validate_repo_address(repo_address: &str, owner: &str) -> Result<(), String> { let prefix = format!("30617:{owner}:"); if repo_address.strip_prefix(&prefix).is_none_or(str::is_empty) { return Err("Repository address does not match the repository owner.".to_string()); @@ -150,6 +160,67 @@ fn validate_repo_address(repo_address: &str, owner: &str) -> Result<(), String> Ok(()) } +fn validate_project_owner_announcement( + input: &ProjectOwnerAnnouncementInput, +) -> Result<(), String> { + if !matches!(input.kind, 30_617 | 30_621) { + return Err("Only project and repository announcements can be signed here.".to_string()); + } + let has_valid_d_tag = input.tags.iter().any(|tag| { + tag.first().is_some_and(|value| value == "d") + && tag.get(1).is_some_and(|value| !value.trim().is_empty()) + }); + if !has_valid_d_tag { + return Err("Project and repository announcements require a non-empty d tag.".to_string()); + } + if let Some(created_at) = input.created_at { + // Mirror the ACP publish path (`build_project_owner_announcement_events`): + // these are addressable events where the latest created_at wins, so a + // far-future timestamp would wedge the head until that time. Reject + // anything more than 5 minutes ahead. + if created_at > Timestamp::now().as_secs().saturating_add(300) { + return Err("Announcement timestamp is too far in the future.".to_string()); + } + } + Ok(()) +} + +/// Sign and publish an addressable project event as a direct or managed owner. +#[tauri::command] +pub async fn publish_project_owner_announcement( + input: ProjectOwnerAnnouncementInput, + app: AppHandle, + state: State<'_, AppState>, +) -> Result { + validate_project_owner_announcement(&input)?; + let target_owner = input.target_owner.trim().to_ascii_lowercase(); + if normalize_event_id(&target_owner).is_none() { + return Err("Invalid project owner.".to_string()); + } + let identity = project_owner_identity(&app, &state, &target_owner)?; + let nostr_tags = input + .tags + .into_iter() + .map(|tag| Tag::parse(tag).map_err(|error| format!("invalid tag: {error}"))) + .collect::, _>>()?; + let mut builder = EventBuilder::new(Kind::Custom(input.kind), input.content).tags(nostr_tags); + if let Some(created_at) = input.created_at { + builder = builder.custom_created_at(Timestamp::from(created_at)); + } + let event = builder + .sign_with_keys(&identity.keys) + .map_err(|error| format!("sign failed: {error}"))?; + let publication_error = + submit_signed_event_with_keys(&event, &state, &identity.keys, identity.auth_tag.as_deref()) + .await + .err(); + + Ok(ProjectOwnerAnnouncementResult { + event: event.as_json(), + publication_error, + }) +} + fn validate_merge_status_metadata( repo_address: &str, owner: &str, @@ -242,63 +313,6 @@ fn build_pull_request_status_event( .map_err(|error| format!("sign pull request status: {error}")) } -fn build_review_request_event( - keys: &Keys, - repo_address: &str, - pull_request_id: &str, - reviewers: &[String], - reviewer_label: &str, -) -> Result { - let owner = keys.public_key().to_hex(); - validate_repo_address(repo_address, &owner)?; - let pull_request_id = normalize_event_id(pull_request_id) - .ok_or_else(|| "Invalid pull request event ID.".to_string())?; - if reviewers.is_empty() || reviewers.len() > 50 { - return Err("Select between 1 and 50 reviewers.".to_string()); - } - let mut reviewers = reviewers - .iter() - .map(|reviewer| { - normalize_event_id(reviewer).ok_or_else(|| "Invalid reviewer pubkey.".to_string()) - }) - .collect::, _>>()?; - reviewers.sort(); - reviewers.dedup(); - let reviewer_label = reviewer_label.trim(); - if reviewer_label.is_empty() || reviewer_label.chars().count() > 128 { - return Err("Reviewer label must be between 1 and 128 characters.".to_string()); - } - - let mut raw_tags = vec![ - vec![ - "e".to_string(), - pull_request_id, - String::new(), - "root".to_string(), - ], - vec!["a".to_string(), repo_address.to_string()], - ]; - raw_tags.extend( - reviewers - .into_iter() - .map(|reviewer| vec!["p".to_string(), reviewer]), - ); - raw_tags.push(vec!["t".to_string(), "review-request".to_string()]); - let tags = raw_tags - .into_iter() - .map(Tag::parse) - .collect::, _>>() - .map_err(|error| format!("build review request tags: {error}"))?; - EventBuilder::new( - Kind::TextNote, - format!("Requested a review from {reviewer_label}"), - ) - .tags(tags) - .sign_with_keys(keys) - .map(|event| event.as_json()) - .map_err(|error| format!("sign pull request review request: {error}")) -} - fn same_repository(left: &str, right: &str) -> bool { left.trim() .trim_end_matches('/') @@ -353,7 +367,7 @@ pub(crate) fn clone_project_repository_blocking( default_branch: Option<&str>, auth: &GitAuthConfig, ) -> Result { - validate_clone_url(clone_url)?; + validate_local_clone_url(clone_url)?; let branch = normalize_branch_option(default_branch); if let Some(repo_dir) = find_local_repo_dir(repos_dir, project_dtag, Some(clone_url))? { return Ok(ProjectRepoCloneResult { @@ -411,8 +425,8 @@ pub async fn clone_project_repository( default_branch: Option, state: State<'_, AppState>, ) -> Result { - validate_workspace_clone_url(&clone_url, &state)?; - let auth = build_git_auth_config(&state)?; + validate_local_clone_url_for_workspace(&clone_url, &state)?; + let auth = build_git_clone_auth_config(&clone_url, &state)?; tauri::async_runtime::spawn_blocking(move || { clone_project_repository_blocking( repos_dir.as_deref(), @@ -451,30 +465,6 @@ pub async fn sign_project_pull_request_status( Ok(()) } -#[tauri::command] -pub async fn sign_project_pull_request_review_request( - input: ProjectPullRequestReviewRequestInput, - app: AppHandle, - state: State<'_, AppState>, -) -> Result<(), String> { - let target_owner = input.target_owner.trim().to_ascii_lowercase(); - if normalize_event_id(&target_owner).is_none() { - return Err("Invalid target repository owner.".to_string()); - } - let identity = project_owner_identity(&app, &state, &target_owner)?; - let event = Event::from_json(build_review_request_event( - &identity.keys, - &input.repo_address, - &input.pull_request_id, - &input.reviewers, - &input.reviewer_label, - )?) - .map_err(|error| format!("parse signed review request: {error}"))?; - submit_signed_event_with_keys(&event, &state, &identity.keys, identity.auth_tag.as_deref()) - .await?; - Ok(()) -} - #[tauri::command] pub async fn publish_project_pull_request_merged_status( input: ProjectPullRequestMergedStatusInput, @@ -682,8 +672,8 @@ pub async fn merge_project_pull_request( mod tests { use super::{ align_unborn_head_branch, build_merged_status_event, build_pull_request_status_event, - build_review_request_event, normalize_commit, same_repository, - validate_merge_status_metadata, + normalize_commit, same_repository, validate_merge_status_metadata, + validate_project_owner_announcement, ProjectOwnerAnnouncementInput, }; use crate::commands::project_git_exec::{build_test_git_auth_config, run_git}; use nostr::{Event, JsonUtil, Keys, Timestamp}; @@ -716,6 +706,62 @@ mod tests { assert_eq!(normalize_commit(&"z".repeat(40)), None); } + #[test] + fn project_owner_announcement_is_limited_to_addressable_project_kinds() { + let valid = ProjectOwnerAnnouncementInput { + target_owner: "a".repeat(64), + kind: 30_621, + content: String::new(), + created_at: Some(1), + tags: vec![vec!["d".to_string(), "project".to_string()]], + }; + assert!(validate_project_owner_announcement(&valid).is_ok()); + + let invalid_kind = ProjectOwnerAnnouncementInput { kind: 1, ..valid }; + assert_eq!( + validate_project_owner_announcement(&invalid_kind), + Err("Only project and repository announcements can be signed here.".to_string()) + ); + } + + #[test] + fn project_owner_announcement_requires_an_address() { + let input = ProjectOwnerAnnouncementInput { + target_owner: "a".repeat(64), + kind: 30_617, + content: String::new(), + created_at: None, + tags: vec![vec!["name".to_string(), "buzz".to_string()]], + }; + assert_eq!( + validate_project_owner_announcement(&input), + Err("Project and repository announcements require a non-empty d tag.".to_string()) + ); + } + + #[test] + fn project_owner_announcement_rejects_far_future_timestamps() { + // Mirrors the ACP path's +300s cap: an addressable head stamped far in + // the future could not be superseded until that time. + let base = ProjectOwnerAnnouncementInput { + target_owner: "a".repeat(64), + kind: 30_621, + content: String::new(), + created_at: Some(Timestamp::now().as_secs() + 200), + tags: vec![vec!["d".to_string(), "project".to_string()]], + }; + assert!(validate_project_owner_announcement(&base).is_ok()); + + let far_future = ProjectOwnerAnnouncementInput { + created_at: Some(Timestamp::now().as_secs() + 301), + ..base + }; + assert_eq!( + validate_project_owner_announcement(&far_future), + Err("Announcement timestamp is too far in the future.".to_string()) + ); + } + #[test] fn repository_comparison_normalizes_git_suffix_and_trailing_slash() { assert!(same_repository( @@ -849,36 +895,4 @@ mod tests { ) .is_err()); } - - #[test] - fn review_request_is_signed_by_repository_owner() { - let keys = Keys::generate(); - let owner = keys.public_key().to_hex(); - let reviewer = "b".repeat(64); - let repo_address = format!("30617:{owner}:buzz"); - let event = Event::from_json( - build_review_request_event( - &keys, - &repo_address, - &"d".repeat(64), - std::slice::from_ref(&reviewer), - "Bob", - ) - .unwrap(), - ) - .unwrap(); - - assert_eq!(event.pubkey, keys.public_key()); - assert_eq!(event.kind, nostr::Kind::TextNote); - assert_eq!(event.content, "Requested a review from Bob"); - assert!(event - .tags - .iter() - .any(|tag| tag.as_slice() == ["p", reviewer.as_str()])); - assert!(event - .tags - .iter() - .any(|tag| tag.as_slice() == ["t", "review-request"])); - assert!(event.verify().is_ok()); - } } diff --git a/desktop/src-tauri/src/commands/project_terminal.rs b/desktop/src-tauri/src/commands/project_terminal.rs index 31dbc74c6db..c583dd0db56 100644 --- a/desktop/src-tauri/src/commands/project_terminal.rs +++ b/desktop/src-tauri/src/commands/project_terminal.rs @@ -9,7 +9,10 @@ use crate::app_state::AppState; use super::project_git::{first_output_line, normalize_branch_option}; use super::project_git_diff::clean_commit; -use super::project_git_exec::{build_git_auth_config, run_git, validate_workspace_clone_url}; +use super::project_git_exec::{ + build_git_auth_config, build_git_clone_auth_config, run_git, + validate_local_clone_url_for_workspace, validate_workspace_clone_url, +}; use super::project_git_workflow::clone_project_repository_blocking; use super::project_repo_paths::find_local_repo_dir; @@ -99,9 +102,8 @@ fn launch_terminal_at(path: &std::path::Path) -> Result<(), String> { } /// Opens the OS terminal at the project's local checkout. When there is no -/// local checkout yet, clones the repository from `clone_url` (authenticated -/// with the identity key, same as push/snapshot) into the repos dir first, -/// then opens the terminal at the fresh checkout. +/// local checkout yet, clones the repository from `clone_url` into the repos +/// dir first, then opens the terminal at the fresh checkout. #[tauri::command] pub async fn open_project_terminal( repos_dir: Option, @@ -111,11 +113,16 @@ pub async fn open_project_terminal( state: State<'_, AppState>, ) -> Result { if let Some(clone_url) = clone_url.as_deref() { - validate_workspace_clone_url(clone_url, &state)?; + validate_local_clone_url_for_workspace(clone_url, &state)?; } - // Auth is only needed for the clone path — keep the result outside the - // blocking task so it owns no borrowed Tauri state. - let auth = build_git_auth_config(&state); + // Public GitHub clones stay anonymous; Buzz remotes use the workspace + // identity. Keep the result outside the blocking task so it borrows no + // Tauri state. + let auth = if let Some(clone_url) = clone_url.as_deref() { + build_git_clone_auth_config(clone_url, &state) + } else { + build_git_auth_config(&state) + }; tauri::async_runtime::spawn_blocking(move || { // An inaccessible repos root (fresh machine, nothing cloned yet) is // not fatal here — the clone path below creates the default root. A diff --git a/desktop/src-tauri/src/commands/relay_members.rs b/desktop/src-tauri/src/commands/relay_members.rs index a9230dff950..9ccf8baac0d 100644 --- a/desktop/src-tauri/src/commands/relay_members.rs +++ b/desktop/src-tauri/src/commands/relay_members.rs @@ -17,8 +17,15 @@ struct RelayInformationDocument { } #[tauri::command] -pub async fn relay_requires_membership(state: State<'_, AppState>) -> Result { - let url = format!("{}/info", relay_api_base_url_with_override(&state)); +pub async fn relay_requires_membership( + relay_url: Option, + state: State<'_, AppState>, +) -> Result { + let base_url = relay_url + .as_deref() + .map(crate::relay::relay_http_base_url) + .unwrap_or_else(|| relay_api_base_url_with_override(&state)); + let url = format!("{}/info", base_url.trim_end_matches('/')); let response = state .http_client .get(url) diff --git a/desktop/src-tauri/src/commands/team_snapshot.rs b/desktop/src-tauri/src/commands/team_snapshot.rs index 97cd11933d7..e4c08a14be0 100644 --- a/desktop/src-tauri/src/commands/team_snapshot.rs +++ b/desktop/src-tauri/src/commands/team_snapshot.rs @@ -579,6 +579,7 @@ pub async fn confirm_team_snapshot_import( runtime_pid: None, backend: crate::managed_agents::BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: Some(imported_team.id.clone()), persona_team_dir: None, @@ -609,6 +610,7 @@ pub async fn confirm_team_snapshot_import( definition_respond_to_allowlist: definition.respond_to_allowlist.clone(), definition_parallelism: minted_parallelism, relay_mesh: None, + effort_level: None, runtime: member.definition.runtime.clone(), name_pool: member.definition.name_pool.clone(), }; diff --git a/desktop/src-tauri/src/commands/team_snapshot/tests.rs b/desktop/src-tauri/src/commands/team_snapshot/tests.rs index c9a6d8812a5..bec7f43bf8a 100644 --- a/desktop/src-tauri/src/commands/team_snapshot/tests.rs +++ b/desktop/src-tauri/src/commands/team_snapshot/tests.rs @@ -206,6 +206,7 @@ fn team_export_with_instance_and_memory_level_uses_supplied_entries() { runtime_pid: None, backend: crate::managed_agents::BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: Some("t1".to_string()), persona_team_dir: None, @@ -229,6 +230,7 @@ fn team_export_with_instance_and_memory_level_uses_supplied_entries() { definition_respond_to_allowlist: vec![], definition_parallelism: None, relay_mesh: None, + effort_level: None, runtime: None, name_pool: vec![], }; diff --git a/desktop/src-tauri/src/commands/teams.rs b/desktop/src-tauri/src/commands/teams.rs index 4377ddaa434..e17c5bdb247 100644 --- a/desktop/src-tauri/src/commands/teams.rs +++ b/desktop/src-tauri/src/commands/teams.rs @@ -4,8 +4,9 @@ use uuid::Uuid; use crate::{ app_state::AppState, managed_agents::{ - delete_team_with_cascade, ensure_persona_ids_are_active, load_personas, load_teams, - save_teams, try_regenerate_nest, CreateTeamRequest, TeamRecord, UpdateTeamRequest, + delete_team_with_cascade, ensure_persona_ids_are_active, load_managed_agents, + load_personas, load_teams, save_managed_agents, save_teams, try_regenerate_nest, + CreateTeamRequest, TeamRecord, UpdateTeamRequest, }, util::now_iso, }; @@ -25,6 +26,174 @@ fn trim_optional(value: Option) -> Option { }) } +/// Propagate a team's membership *change* to its members' already-running +/// instances, best-effort. Loads the agent store, applies the roster delta via +/// [`apply_team_membership_delta`], and re-saves only when something changed; +/// any load/save error is logged and swallowed. Called after the authoritative +/// `save_teams` succeeds — the team already exists on disk and boot repair is +/// the designed retry for a stale/unset binding, so a secondary-store hiccup +/// must not fail a command whose team write already landed (a UI retry would +/// then mint a duplicate team). +/// +/// `load_agents`/`save_agents` are injected so the command wiring (prior-roster +/// capture, delta direction, and this best-effort policy) is unit-testable +/// without an `AppHandle`; the commands pass the real store IO. +/// +/// Shared with the inbound reconcile path (`commands::personas::inbound`): a +/// 30176 team edit arriving from another device must bind/detach instances the +/// same way a local edit does, so both call this one wrapper. +pub(in crate::commands) fn propagate_membership_best_effort( + team_id: &str, + previous_persona_ids: &[String], + current_persona_ids: &[String], + load_agents: impl FnOnce() -> Result, String>, + save_agents: impl FnOnce(&[crate::managed_agents::ManagedAgentRecord]) -> Result<(), String>, +) { + let result = (|| -> Result<(), String> { + let mut records = load_agents()?; + if apply_team_membership_delta( + &mut records, + team_id, + previous_persona_ids, + current_persona_ids, + ) { + save_agents(&records)?; + } + Ok(()) + })(); + if let Err(e) = result { + eprintln!("buzz-desktop: team-membership-propagate: {e}"); + } +} + +/// In-memory core of [`create_team`]: push the built team, persist teams +/// authoritatively, then propagate its whole roster (no prior members ⇒ the +/// whole roster is the added delta) to live instances best-effort. Decoupled +/// from the `AppHandle` shell via injected persistence so the create wiring is +/// unit-testable. A `persist_teams` error propagates; agent IO is best-effort. +fn commit_team_create( + teams: &mut Vec, + team: TeamRecord, + persist_teams: impl FnOnce(&[TeamRecord]) -> Result<(), String>, + load_agents: impl FnOnce() -> Result, String>, + save_agents: impl FnOnce(&[crate::managed_agents::ManagedAgentRecord]) -> Result<(), String>, +) -> Result { + teams.push(team.clone()); + persist_teams(teams)?; + propagate_membership_best_effort(&team.id, &[], &team.persona_ids, load_agents, save_agents); + Ok(team) +} + +/// In-memory core of [`update_team`]: mutate the matching team, capturing its +/// roster *before* the edit, persist teams authoritatively, then propagate the +/// prior→current delta to live instances best-effort. The prior-roster capture +/// and its use as the delta baseline live here — not at a command call site — +/// so a miswire to the wrong baseline is caught by a test. Injected persistence +/// keeps it `AppHandle`-free; a `persist_teams` error propagates, agent IO is +/// best-effort. Returns the updated team. +#[allow(clippy::too_many_arguments)] +fn commit_team_update( + teams: &mut [TeamRecord], + id: &str, + name: String, + description: Option, + instructions: Option, + persona_ids: Vec, + now: String, + persist_teams: impl FnOnce(&[TeamRecord]) -> Result<(), String>, + load_agents: impl FnOnce() -> Result, String>, + save_agents: impl FnOnce(&[crate::managed_agents::ManagedAgentRecord]) -> Result<(), String>, +) -> Result { + let team = teams + .iter_mut() + .find(|record| record.id == id) + .ok_or_else(|| format!("team {id} not found"))?; + + // Capture the pre-edit roster before mutation: the propagation delta + // (added → backfill, removed → detach) is computed against it. + let previous_persona_ids = team.persona_ids.clone(); + team.name = name; + team.description = description; + team.instructions = instructions; + team.persona_ids = persona_ids; + team.updated_at = now; + + let updated = team.clone(); + persist_teams(teams)?; + propagate_membership_best_effort( + &updated.id, + &previous_persona_ids, + &updated.persona_ids, + load_agents, + save_agents, + ); + Ok(updated) +} + +/// Pure core of the membership propagation: apply the roster delta to `records` +/// in place and report whether anything changed. Decoupled from the store IO so +/// the binding rules are unit-testable. +/// +/// Two directions, keyed on the delta between the pre-edit and post-edit +/// rosters: +/// +/// - **Added** (`current` but not `previous`): backfill `team_id` on the +/// persona's *unbound* instances, so an added persona spawns with the team's +/// instructions (`spawn_snapshot::effective_team_instructions` keys on +/// `record.team_id`). Only an unset field is set — a shared persona keeps an +/// existing binding — and an explicit add is legitimate binding evidence even +/// when the persona belongs to several teams. +/// - **Removed** (`previous` but not `current`): clear `team_id` on instances +/// bound to *this* team, so a "keep agents" removal stops feeding a kept +/// instance the instructions of a team it no longer belongs to. Bindings to +/// other teams are untouched. +/// +/// Delta-scoping is what keeps a metadata-only edit inert: with no roster +/// change both sets are empty and no instance is re-pointed — a shared unbound +/// persona is not silently bound to whichever team was last edited. `create` +/// has no prior roster, so it passes an empty `previous` and the whole roster is +/// "added" (the pre-fix whole-roster backfill). A persona both removed and +/// re-added in one edit appears in neither set (set difference, not +/// operation order), so its binding is left as-is. +fn apply_team_membership_delta( + records: &mut [crate::managed_agents::ManagedAgentRecord], + team_id: &str, + previous_persona_ids: &[String], + current_persona_ids: &[String], +) -> bool { + let added: Vec<&str> = current_persona_ids + .iter() + .filter(|id| !previous_persona_ids.iter().any(|p| p == *id)) + .map(String::as_str) + .collect(); + let removed: Vec<&str> = previous_persona_ids + .iter() + .filter(|id| !current_persona_ids.iter().any(|p| p == *id)) + .map(String::as_str) + .collect(); + if added.is_empty() && removed.is_empty() { + return false; + } + + let mut changed = false; + for record in records.iter_mut() { + if record.pubkey.is_empty() { + continue; + } + let Some(persona_id) = record.persona_id.as_deref() else { + continue; + }; + if record.team_id.is_none() && added.contains(&persona_id) { + record.team_id = Some(team_id.to_string()); + changed = true; + } else if record.team_id.as_deref() == Some(team_id) && removed.contains(&persona_id) { + record.team_id = None; + changed = true; + } + } + changed +} + /// Retain a freshly authored team event in the local store, flagged for relay /// sync. Called inside a command's `managed_agents_store_lock`-held body after /// `save_teams`; the background flush loop publishes it out-of-band. @@ -171,8 +340,13 @@ pub async fn create_team(input: CreateTeamRequest, app: AppHandle) -> Result Result Result) -> ManagedAgentRecord { + let mut record = serde_json::from_value::(serde_json::json!({ + "pubkey": seed.to_string().repeat(64), + "name": persona_id, + "persona_id": persona_id, + "relay_url": "ws://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "goose", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "system_prompt": "prompt", + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + })) + .unwrap(); + record.team_id = team_id.map(str::to_string); + record + } + + fn ids(list: &[&str]) -> Vec { + list.iter().map(|s| s.to_string()).collect() + } + + /// A metadata-only edit (no roster change) never re-points an instance — + /// including an unbound instance of a persona this team shares with another. + #[test] + fn metadata_only_edit_leaves_bindings_untouched() { + let mut records = vec![instance('a', "duncan", None)]; + let roster = ids(&["duncan"]); + assert!(!apply_team_membership_delta( + &mut records, + "team-a", + &roster, + &roster + )); + assert_eq!(records[0].team_id, None); + } + + /// Only the *added* persona's unbound instance is bound; an untouched member + /// already present in the previous roster is not re-pointed. + #[test] + fn added_persona_backfills_only_its_unbound_instance() { + let mut records = vec![ + instance('a', "duncan", None), + instance('b', "paul", Some("team-b")), + ]; + assert!(apply_team_membership_delta( + &mut records, + "team-a", + &ids(&["paul"]), + &ids(&["paul", "duncan"]), + )); + assert_eq!(records[0].team_id.as_deref(), Some("team-a")); + // Paul was already on the team and bound elsewhere — untouched. + assert_eq!(records[1].team_id.as_deref(), Some("team-b")); + } + + /// An added persona binds even when shared across teams: an explicit add is + /// legitimate evidence (unlike the boot-repair's order-blind case). + #[test] + fn added_shared_persona_binds_to_the_edited_team() { + let mut records = vec![instance('a', "duncan", None)]; + assert!(apply_team_membership_delta( + &mut records, + "team-a", + &[], + &ids(&["duncan"]), + )); + assert_eq!(records[0].team_id.as_deref(), Some("team-a")); + } + + /// Removing a persona ("keep agents") clears its binding to *this* team so a + /// kept instance stops drawing the team's instructions at spawn. + #[test] + fn removed_persona_detaches_instance_bound_to_this_team() { + let mut records = vec![instance('a', "duncan", Some("team-a"))]; + assert!(apply_team_membership_delta( + &mut records, + "team-a", + &ids(&["duncan"]), + &[], + )); + assert_eq!(records[0].team_id, None); + } + + /// Removal only clears a binding pointing at *this* team — an instance of + /// the same persona bound to a different team is left alone. + #[test] + fn removed_persona_leaves_other_team_binding_untouched() { + let mut records = vec![instance('a', "duncan", Some("team-b"))]; + assert!(!apply_team_membership_delta( + &mut records, + "team-a", + &ids(&["duncan"]), + &[], + )); + assert_eq!(records[0].team_id.as_deref(), Some("team-b")); + } + + /// A minimal owner-authored team record for wiring tests. + fn team(id: &str, persona_ids: &[&str]) -> TeamRecord { + TeamRecord { + id: id.to_string(), + name: id.to_string(), + description: None, + instructions: None, + persona_ids: ids(persona_ids), + is_builtin: false, + source_dir: None, + is_symlink: false, + symlink_target: None, + version: None, + created_at: "2026-01-01T00:00:00Z".to_string(), + updated_at: "2026-01-01T00:00:00Z".to_string(), + } + } + + /// Records the injected store IO a commit performs, so a test can assert + /// the wiring saved (or deliberately did not) the agent store. + #[derive(Default)] + struct StoreSpy { + saved: Option>, + } + + /// Metadata-only `update_team` must pass the TRUE prior roster into the + /// delta, so an unchanged roster is an empty delta and no agent write fires. + /// The `&previous_persona_ids` → `&[]` miswire would drop the prior roster, + /// making the whole roster look "added" and re-pointing the unbound instance. + #[test] + fn commit_team_update_uses_true_prior_roster() { + let mut teams = vec![team("team-a", &["duncan"])]; + let existing = vec![instance('a', "duncan", None)]; + let spy = RefCell::new(StoreSpy::default()); + + let updated = commit_team_update( + &mut teams, + "team-a", + "Team A".to_string(), + None, + Some("new instructions".to_string()), + ids(&["duncan"]), + "2026-02-02T00:00:00Z".to_string(), + |_| Ok(()), + || Ok(existing.clone()), + |records| { + spy.borrow_mut().saved = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("metadata-only update succeeds"); + + assert_eq!(updated.instructions.as_deref(), Some("new instructions")); + // Empty delta ⇒ nothing changed ⇒ no save (the true-prior-roster gate). + assert!( + spy.borrow().saved.is_none(), + "metadata-only edit must not write the agent store" + ); + } + + /// Removing a persona from the roster must reach the detach branch through + /// the command wiring: the instance bound to this team is cleared and saved. + #[test] + fn commit_team_update_removal_detaches_through_wiring() { + let mut teams = vec![team("team-a", &["duncan"])]; + let existing = vec![instance('a', "duncan", Some("team-a"))]; + let spy = RefCell::new(StoreSpy::default()); + + commit_team_update( + &mut teams, + "team-a", + "team-a".to_string(), + None, + None, + ids(&[]), + "2026-02-02T00:00:00Z".to_string(), + |_| Ok(()), + || Ok(existing.clone()), + |records| { + spy.borrow_mut().saved = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("removal update succeeds"); + + let saved = spy.borrow().saved.clone().expect("detach must save"); + assert_eq!(saved[0].team_id, None, "removed persona detaches from team"); + } + + /// `create_team` has no prior roster, so its whole roster is the added delta: + /// the unbound instance of a listed persona is bound through the wiring. + #[test] + fn commit_team_create_treats_full_roster_as_added() { + let mut teams: Vec = Vec::new(); + let existing = vec![instance('a', "duncan", None)]; + let spy = RefCell::new(StoreSpy::default()); + + let created = commit_team_create( + &mut teams, + team("team-a", &["duncan"]), + |_| Ok(()), + || Ok(existing.clone()), + |records| { + spy.borrow_mut().saved = Some(records.to_vec()); + Ok(()) + }, + ) + .expect("create succeeds"); + + assert_eq!(created.id, "team-a"); + let saved = spy.borrow().saved.clone().expect("backfill must save"); + assert_eq!( + saved[0].team_id.as_deref(), + Some("team-a"), + "whole roster is the added delta on create" + ); + } + + /// A failing secondary agent write after successful `save_teams` is + /// swallowed: both commits still return the persisted team. Otherwise a UI + /// retry of a create whose team already landed would mint a duplicate. + #[test] + fn commit_returns_ok_when_agent_save_fails() { + let mut teams: Vec = Vec::new(); + let created = commit_team_create( + &mut teams, + team("team-a", &["duncan"]), + |_| Ok(()), + || Ok(vec![instance('a', "duncan", None)]), + |_| Err("disk full".to_string()), + ) + .expect("create swallows secondary-store failure"); + assert_eq!(created.id, "team-a"); + + let mut teams = vec![team("team-a", &["duncan"])]; + let updated = commit_team_update( + &mut teams, + "team-a", + "team-a".to_string(), + None, + None, + ids(&[]), + "2026-02-02T00:00:00Z".to_string(), + |_| Ok(()), + || Err("agent store unreadable".to_string()), + |_| Ok(()), + ) + .expect("update swallows secondary-store failure"); + assert_eq!(updated.persona_ids, Vec::::new()); + } +} + #[tauri::command] pub async fn delete_team(id: String, app: AppHandle) -> Result<(), String> { use tauri::Manager; diff --git a/desktop/src-tauri/src/commands/window_vibrancy.rs b/desktop/src-tauri/src/commands/window_vibrancy.rs index 5eb1f16b8b9..39dcef3c6e5 100644 --- a/desktop/src-tauri/src/commands/window_vibrancy.rs +++ b/desktop/src-tauri/src/commands/window_vibrancy.rs @@ -1,15 +1,29 @@ //! Runtime macOS window vibrancy (blur-behind) toggle. //! +//! **Invariant:** the main window is created opaque (`tauri.conf.json` +//! `transparent: false`) and the NSWindow is never made transparent at runtime. +//! Behind-window vibrancy renders correctly inside opaque windows — this is +//! exactly how Finder and Notes render vibrant sidebars — so glass only requires +//! runtime webview-canvas transparency, which this command sets on the enable +//! path. When glass is disabled the webview canvas may remain non-drawing +//! (wry's `drawsBackground` flag is one-way at runtime), but that is harmless: +//! glass-off CSS paints the full background opaque and the always-opaque NSWindow +//! is beneath it. +//! +//! Why not `transparent: true`? A creation-time transparent window causes tao to +//! call `NSWindow.setOpaque(false)` and `setBackgroundColor(clearColor)`. The +//! runtime `Window::set_background_color(None)` then resolves `None` to +//! `clearColor` instead of the opaque system default — and there is no runtime +//! `setOpaque(true)` path through tauri — leaving the compositor blending the +//! whole window even with glass off. +//! //! Vibrancy applies an `NSVisualEffectView` behind the webview so the desktop -//! (and windows behind Buzz) blur through wherever the app's CSS is +//! (and windows behind Buzz) blurs through wherever the WKWebView canvas is //! transparent. It is a native, macOS-only effect: there is no "intensity" //! setting at the OS level, only a set of material presets. The frontend tunes -//! perceived intensity by changing CSS surface opacity while this command -//! handles the native material. -//! -//! This is fully reversible at runtime: enabling applies the chosen material, -//! disabling clears it. On non-macOS platforms the command is a no-op so the -//! shared frontend can call it unconditionally. +//! perceived intensity by adjusting CSS surface opacity while this command +//! handles the native material. On non-macOS platforms the command is a no-op +//! so the shared frontend can call it unconditionally. #[cfg(target_os = "macos")] use tauri::Manager; @@ -35,6 +49,16 @@ pub fn set_window_vibrancy( .ok_or_else(|| "main window not found".to_string())?; if !enabled { + // The NSWindow layer is permanently opaque, so no window-layer + // reset is needed here. Skipping `set_background_color(None)` at + // the webview layer also avoids tauri mapping `None` to opaque + // white, which would still force `drawsBackground=false` on the + // WKWebView (counterproductive). After a glass session the webview + // canvas may stay non-drawing — wry's `drawsBackground` flag is + // one-way at runtime — but that is harmless: glass-off CSS paints + // the full background opaque and the always-opaque NSWindow is + // beneath it. If `clear_vibrancy` fails, the opaque CSS already + // covers everything, so no see-through state is reachable. clear_vibrancy(&window).map_err(|e| e.to_string())?; return Ok(()); } @@ -58,7 +82,22 @@ pub fn set_window_vibrancy( // clear is a no-op (returns `false`) when none is present. let _ = clear_vibrancy(&window); + // Install the blur layer first: a failure of the canvas write leaves + // the window with vibrancy behind an opaque webview, not a see-through + // one. Either mixed state self-corrects on the next toggle. apply_vibrancy(&window, material, None, None).map_err(|e| e.to_string())?; + + // Make only the WKWebView canvas transparent so native vibrancy shows + // through; the NSWindow layer stays opaque by design. Targeting the + // webview layer directly (via `AsRef`) avoids the + // `WebviewWindow::set_background_color` path, which also writes the + // NSWindow layer. Must follow `apply_vibrancy` so the blur layer is + // present before the canvas becomes see-through. + let webview: &tauri::Webview<_> = window.as_ref(); + webview + .set_background_color(Some(tauri::window::Color(0, 0, 0, 0))) + .map_err(|e| e.to_string())?; + Ok(()) } diff --git a/desktop/src-tauri/src/commands/workflows.rs b/desktop/src-tauri/src/commands/workflows.rs index 1d5f309fb5c..c4e5d38c8ba 100644 --- a/desktop/src-tauri/src/commands/workflows.rs +++ b/desktop/src-tauri/src/commands/workflows.rs @@ -1,3 +1,5 @@ +use std::collections::HashSet; + use serde::Serialize; use serde_json::Value; use tauri::State; @@ -5,7 +7,7 @@ use tauri::State; use crate::{ app_state::AppState, events, - relay::{parse_command_response, query_relay, submit_event}, + relay::{get_relay_json, parse_command_response, query_relay, submit_event}, }; // ── Wire shapes (snake_case, consumed by tauriWorkflows.ts) ────────────────── @@ -27,6 +29,8 @@ use crate::{ #[derive(Debug, Clone, Serialize, PartialEq)] pub struct WorkflowWire { pub id: String, + /// Event id of the current kind:30620 revision, used for conflict-protected updates. + pub revision: String, pub name: String, pub owner_pubkey: String, pub channel_id: Option, @@ -47,6 +51,41 @@ pub struct WorkflowSaveWire { pub webhook_secret: Option, } +#[derive(Debug, Clone, serde::Deserialize, Serialize, PartialEq)] +pub struct WorkflowRunCursorWire { + pub before: String, + pub before_id: String, +} + +#[derive(Debug, Clone, serde::Deserialize, Serialize, PartialEq)] +pub struct WorkflowRunsWire { + pub runs: Vec, + pub next: Option, +} + +#[derive(Debug, Clone, serde::Deserialize, Serialize, PartialEq)] +pub struct WorkflowApprovalsWire { + pub approvals: Vec, +} + +/// Canonical trigger acknowledgement consumed by the Desktop client. +/// +/// The relay currently returns only `run_id`; the workflow id is the command +/// input and a newly-created run always begins pending. Keeping that adaptation +/// here prevents the frontend from guessing fields or confusing the trigger +/// event id with the persisted run id. +#[derive(Debug, Clone, Serialize, PartialEq)] +pub struct WorkflowTriggerWire { + pub run_id: String, + pub workflow_id: String, + pub status: String, +} + +#[derive(Debug, serde::Deserialize)] +struct WorkflowTriggerAck { + run_id: String, +} + // ── Reads ──────────────────────────────────────────────────────────────────── #[tauri::command] @@ -66,34 +105,73 @@ pub async fn get_channel_workflows( Ok(events.iter().map(workflow_from_event).collect()) } -/// Fetch workflows across many channels in a single relay round-trip. +// Keep this aligned with the relay's aggregate explicit-`#h` request bound. +// Each filter below carries exactly one explicit value so old relays retain the +// known-compatible shape while current relays cannot reject large memberships. +const WORKFLOW_QUERY_CHANNEL_BATCH_SIZE: usize = 128; + +/// Fetch workflows across many channels using bounded relay round-trips. /// /// The Workflows overview screen previously issued one `get_channel_workflows` /// query per member channel (`Promise.all` fanout in `WorkflowsView`), i.e. N -/// relay POSTs. A nostr `#h` filter matches ANY of its listed values, so one -/// query with all channel ids returns the same set. Each `WorkflowWire` carries -/// its own `channel_id` (from the event's `h` tag), so the frontend can still -/// group results by channel. Neither this nor the per-channel command sets a -/// `limit`, so batching does not change result completeness. +/// relay POSTs. This sends one single-channel filter per channel, in requests of +/// at most 128 filters. Using one multi-value `#h` filter is equivalent under +/// NIP-01, but older relays incorrectly narrowed that shape to its first +/// channel. Each `WorkflowWire` carries its own `channel_id` (from the event's +/// `h` tag), so the frontend can still group results by channel. Neither this +/// nor the per-channel command sets a `limit`, so batching does not change +/// result completeness. Results are deduplicated by signed event ID in case a +/// caller supplies duplicate channel IDs. #[tauri::command] pub async fn get_channels_workflows( channel_ids: Vec, state: State<'_, AppState>, ) -> Result, String> { - if channel_ids.is_empty() { - return Ok(Vec::new()); + let filter_batches = channel_workflow_filter_batches(channel_ids)?; + let mut seen_event_ids = HashSet::new(); + let mut workflows = Vec::new(); + + for filters in filter_batches { + let events = query_relay(&state, &filters).await?; + append_unique_workflows(&mut workflows, &mut seen_event_ids, &events); } - let events = query_relay( - &state, - &[serde_json::json!({ - "kinds": [30620], - "#h": channel_ids, - })], - ) - .await?; + Ok(workflows) +} - Ok(events.iter().map(workflow_from_event).collect()) +fn append_unique_workflows( + workflows: &mut Vec, + seen_event_ids: &mut HashSet, + events: &[nostr::Event], +) { + workflows.extend( + events + .iter() + .filter(|event| seen_event_ids.insert(event.id)) + .map(workflow_from_event), + ); +} + +fn channel_workflow_filter_batches(channel_ids: Vec) -> Result>, String> { + let filters = channel_workflow_filters(channel_ids)?; + Ok(filters + .chunks(WORKFLOW_QUERY_CHANNEL_BATCH_SIZE) + .map(<[Value]>::to_vec) + .collect()) +} + +fn channel_workflow_filters(channel_ids: Vec) -> Result, String> { + channel_ids + .into_iter() + .map(|channel_id| { + let channel_id = uuid::Uuid::parse_str(channel_id.trim()) + .map_err(|_| "invalid channel id".to_string())?; + Ok(serde_json::json!({ + "kinds": [30620], + "#h": [channel_id.to_string()], + })) + }) + .collect() } #[tauri::command] @@ -121,26 +199,16 @@ pub async fn get_workflow( pub async fn get_workflow_runs( workflow_id: String, limit: Option, - _state: State<'_, AppState>, -) -> Result, String> { - // TODO(workflow-runs): Run reconstruction is a clearly-scoped follow-up. - // The authoritative run record the frontend's `WorkflowRun` shape needs - // (status / current_step / execution_trace / error_message) lives in the - // relay DB and is not exposed to the desktop client as a single queryable - // record. If the relay starts emitting lifecycle events (46001–46007, …), - // folding that stream into `WorkflowRun` would be another viable design. - // The important bit for this command is that raw lifecycle events are not - // the `RawWorkflowRun` contract. - // - // Until then we return a bare empty array — NOT a raw-event wrapper. The - // frontend wrapper (`getWorkflowRuns`) does `raw.map(fromRawWorkflowRun)`, - // so it must receive an array; the wrapped `{ runs: [...] }` shape would - // make `.map()` throw and crash the detail panel (the same TypeError class - // as the original page bug). Raw lifecycle events also don't carry the - // `id`/`workflow_id`/`status`/… fields `RawWorkflowRun` expects, so an - // empty list is the honest, safe placeholder. - let _ = (workflow_id, limit); - Ok(Vec::new()) + state: State<'_, AppState>, +) -> Result { + let workflow_id = + uuid::Uuid::parse_str(&workflow_id).map_err(|_| "invalid workflow id".to_string())?; + let limit = limit.unwrap_or(20).clamp(1, 100); + get_relay_json( + &state, + &format!("/workflows/{workflow_id}/runs?limit={limit}"), + ) + .await } // ── Writes ─────────────────────────────────────────────────────────────────── @@ -152,7 +220,8 @@ pub async fn create_workflow( state: State<'_, AppState>, ) -> Result { let workflow_id = uuid::Uuid::new_v4().to_string(); - let builder = events::build_workflow_definition(&workflow_id, &channel_id, &yaml_definition)?; + let builder = + events::build_workflow_definition(&workflow_id, &channel_id, &yaml_definition, None)?; let result = submit_event(builder, &state).await?; // The relay returns `webhook_secret` in the OK response message for @@ -170,6 +239,7 @@ pub async fn create_workflow( let now = now_secs(); let workflow = workflow_record( workflow_id, + result.event_id, Some(channel_id), current_pubkey_hex(&state)?, &yaml_definition, @@ -187,6 +257,7 @@ pub async fn create_workflow( pub async fn update_workflow( workflow_id: String, yaml_definition: String, + expected_revision: String, state: State<'_, AppState>, ) -> Result { // Find the channel id (and creation time) from the existing workflow event @@ -205,15 +276,24 @@ pub async fn update_workflow( let prior_event = prior .first() .ok_or_else(|| "workflow not found".to_string())?; + if prior_event.id.to_hex() != expected_revision { + return Err("workflow changed since it was loaded; refresh and try again".to_string()); + } let channel_id = tag_value(prior_event, "h").ok_or_else(|| "workflow not found".to_string())?; let created_at = prior_event.created_at.as_secs() as i64; - let builder = events::build_workflow_definition(&workflow_id, &channel_id, &yaml_definition)?; - submit_event(builder, &state).await?; + let builder = events::build_workflow_definition( + &workflow_id, + &channel_id, + &yaml_definition, + Some(&expected_revision), + )?; + let result = submit_event(builder, &state).await?; let updated_at = now_secs(); let workflow = workflow_record( workflow_id, + result.event_id, Some(channel_id), current_pubkey_hex(&state)?, &yaml_definition, @@ -242,10 +322,10 @@ pub async fn delete_workflow( pub async fn trigger_workflow( workflow_id: String, state: State<'_, AppState>, -) -> Result { +) -> Result { let builder = events::build_workflow_trigger(&workflow_id)?; let result = submit_event(builder, &state).await?; - Ok(serde_json::json!({ "event_id": result.event_id })) + trigger_wire_from_message(workflow_id, &result.message) } // ── Approvals ──────────────────────────────────────────────────────────────── @@ -254,15 +334,17 @@ pub async fn trigger_workflow( pub async fn get_run_approvals( workflow_id: String, run_id: String, - _state: State<'_, AppState>, -) -> Result, String> { - // TODO(workflow-runs): Like runs (see `get_workflow_runs`), reconstructing - // approvals into the frontend's `WorkflowApproval` shape from lifecycle - // events (46010/46011/46012) is a clearly-scoped follow-up tracked under - // TODO(workflow-runs). Return a bare empty array so the frontend's - // `getRunApprovals` (`raw.map(fromRawApproval)`) is safe. - let _ = (workflow_id, run_id); - Ok(Vec::new()) + state: State<'_, AppState>, +) -> Result { + let workflow_id = + uuid::Uuid::parse_str(&workflow_id).map_err(|_| "invalid workflow id".to_string())?; + let run_id = + uuid::Uuid::parse_str(&run_id).map_err(|_| "invalid workflow run id".to_string())?; + get_relay_json( + &state, + &format!("/workflows/{workflow_id}/runs/{run_id}/approvals"), + ) + .await } #[tauri::command] @@ -289,6 +371,21 @@ pub async fn deny_approval( // ── Helpers (pure, unit-tested in workflows_tests.rs) ───────────────────────── +fn trigger_wire_from_message( + workflow_id: String, + message: &str, +) -> Result { + let ack: WorkflowTriggerAck = parse_command_response(message)?; + if ack.run_id.trim().is_empty() { + return Err("workflow trigger response contained an empty run_id".to_string()); + } + Ok(WorkflowTriggerWire { + run_id: ack.run_id, + workflow_id, + status: "pending".to_string(), + }) +} + fn current_pubkey_hex(state: &AppState) -> Result { let keys = state.keys.lock().map_err(|e| e.to_string())?; Ok(keys.public_key().to_hex()) @@ -325,6 +422,7 @@ fn parse_definition(yaml: &str) -> Value { /// (from a relay event) and the write path (from local inputs). fn workflow_record( id: String, + revision: String, channel_id: Option, owner_pubkey: String, yaml_definition: &str, @@ -341,6 +439,7 @@ fn workflow_record( WorkflowWire { id, + revision, name, owner_pubkey, channel_id, @@ -356,7 +455,15 @@ fn workflow_from_event(ev: &nostr::Event) -> WorkflowWire { let id = tag_value(ev, "d").unwrap_or_default(); let channel_id = tag_value(ev, "h"); let ts = ev.created_at.as_secs() as i64; - workflow_record(id, channel_id, ev.pubkey.to_hex(), &ev.content, ts, ts) + workflow_record( + id, + ev.id.to_hex(), + channel_id, + ev.pubkey.to_hex(), + &ev.content, + ts, + ts, + ) } #[cfg(test)] diff --git a/desktop/src-tauri/src/commands/workflows_tests.rs b/desktop/src-tauri/src/commands/workflows_tests.rs index f07f4b0f421..6523d458629 100644 --- a/desktop/src-tauri/src/commands/workflows_tests.rs +++ b/desktop/src-tauri/src/commands/workflows_tests.rs @@ -41,6 +41,7 @@ fn workflow_from_event_maps_all_fields() { let wf = workflow_from_event(&ev); assert_eq!(wf.id, WF); + assert_eq!(wf.revision, ev.id.to_hex()); assert_eq!(wf.channel_id.as_deref(), Some(CHAN)); assert_eq!(wf.owner_pubkey, ev.pubkey.to_hex()); assert_eq!(wf.name, "Greet on join"); @@ -120,6 +121,7 @@ fn tag_value_reads_d_and_h_and_misses_absent() { fn workflow_record_shapes_save_inputs() { let wf = workflow_record( WF.to_string(), + "revision-1".to_string(), Some(CHAN.to_string()), "deadbeef".to_string(), YAML, @@ -139,6 +141,7 @@ fn workflow_record_shapes_save_inputs() { fn save_wire_serializes_flat_with_optional_secret() { let workflow = workflow_record( WF.to_string(), + "revision-1".to_string(), Some(CHAN.to_string()), "deadbeef".to_string(), YAML, @@ -176,6 +179,7 @@ fn workflow_wire_serializes_with_snake_case_keys() { let v = serde_json::to_value(workflow_from_event(&ev)).expect("serialize"); for key in [ "id", + "revision", "name", "owner_pubkey", "channel_id", @@ -189,21 +193,122 @@ fn workflow_wire_serializes_with_snake_case_keys() { } #[test] -fn runs_and_approvals_serialize_to_bare_empty_array() { - // Regression guard for the crash class this fix closed. The frontend - // wrappers `getWorkflowRuns` / `getRunApprovals` do `raw.map(...)`, so the - // Rust side MUST return a bare JSON array. A wrapped `{ runs: [...] }` / - // `{ approvals: [...] }` shape would make `.map()` throw and crash the - // detail panel — the same TypeError class as the original page bug. - // - // The commands take `State`, so we can't invoke them directly in - // a unit test; instead we pin the exact value they return (`Vec::new()` of - // their `Vec` element type) and assert its serialized shape. - let runs: Vec = Vec::new(); - let approvals: Vec = Vec::new(); - assert_eq!(serde_json::to_string(&runs).expect("serialize runs"), "[]"); +fn multi_channel_workflow_query_uses_one_filter_per_channel() { + let other_channel = "33333333-3333-3333-3333-333333333333"; + let filters = channel_workflow_filters(vec![CHAN.to_string(), other_channel.to_string()]) + .expect("valid channels"); + + assert_eq!(filters.len(), 2); + assert_eq!( + filters[0], + serde_json::json!({ + "kinds": [30620], + "#h": [CHAN], + }) + ); + assert_eq!( + filters[1], + serde_json::json!({ + "kinds": [30620], + "#h": [other_channel], + }) + ); +} + +#[test] +fn workflow_queries_respect_relay_explicit_channel_limit() { + for (channel_count, expected_batch_sizes) in [ + (WORKFLOW_QUERY_CHANNEL_BATCH_SIZE, vec![128]), + (WORKFLOW_QUERY_CHANNEL_BATCH_SIZE + 1, vec![128, 1]), + ] { + let channel_ids = (0..channel_count) + .map(|index| uuid::Uuid::from_u128(index as u128 + 1).to_string()) + .collect(); + let batches = channel_workflow_filter_batches(channel_ids).expect("valid channels"); + + assert_eq!( + batches.iter().map(Vec::len).collect::>(), + expected_batch_sizes + ); + assert!(batches.iter().flatten().all(|filter| filter["#h"] + .as_array() + .is_some_and(|values| values.len() == 1))); + } +} + +#[test] +fn workflow_query_results_are_deduplicated_by_event_id() { + let first = wf_event(WF, CHAN, YAML); + let second_workflow = "33333333-3333-3333-3333-333333333333"; + let second = wf_event(second_workflow, CHAN, YAML); + let mut workflows = Vec::new(); + let mut seen_event_ids = HashSet::new(); + + append_unique_workflows( + &mut workflows, + &mut seen_event_ids, + &[first.clone(), second.clone()], + ); + append_unique_workflows(&mut workflows, &mut seen_event_ids, &[first, second]); + + assert_eq!(workflows.len(), 2); + assert_eq!(workflows[0].id, WF); + assert_eq!(workflows[1].id, second_workflow); +} + +#[test] +fn channel_workflow_filters_reject_malformed_or_blank_channel_ids() { + for channel_id in ["not-a-uuid", "", " "] { + let error = channel_workflow_filters(vec![channel_id.to_string()]) + .expect_err("malformed channel id must fail before querying the relay"); + assert_eq!(error, "invalid channel id"); + } +} + +#[test] +fn channel_workflow_filters_accepts_empty_input() { + assert_eq!( + channel_workflow_filters(Vec::new()).expect("empty input is valid"), + Vec::::new() + ); +} + +#[test] +fn trigger_response_uses_persisted_run_id_contract() { + let wire = trigger_wire_from_message( + WF.to_string(), + "response:{\"run_id\":\"33333333-3333-3333-3333-333333333333\"}", + ) + .expect("parse trigger response"); + + assert_eq!(wire.run_id, "33333333-3333-3333-3333-333333333333"); + assert_eq!(wire.workflow_id, WF); + assert_eq!(wire.status, "pending"); + let value = serde_json::to_value(wire).expect("serialize trigger response"); + assert!(value.get("event_id").is_none()); +} + +#[test] +fn trigger_response_rejects_missing_or_empty_run_id() { + assert!(trigger_wire_from_message(WF.to_string(), "response:{}").is_err()); + assert!(trigger_wire_from_message(WF.to_string(), "response:{\"run_id\":\" \"}",).is_err()); +} + +#[test] +fn run_reads_serialize_to_backend_envelopes() { + let runs = WorkflowRunsWire { + runs: Vec::new(), + next: None, + }; + let approvals = WorkflowApprovalsWire { + approvals: Vec::new(), + }; + assert_eq!( + serde_json::to_value(runs).expect("serialize runs"), + serde_json::json!({ "runs": [], "next": null }) + ); assert_eq!( - serde_json::to_string(&approvals).expect("serialize approvals"), - "[]" + serde_json::to_value(approvals).expect("serialize approvals"), + serde_json::json!({ "approvals": [] }) ); } diff --git a/desktop/src-tauri/src/commands/workspace.rs b/desktop/src-tauri/src/commands/workspace.rs index 731a99d9d9b..77d519b94ba 100644 --- a/desktop/src-tauri/src/commands/workspace.rs +++ b/desktop/src-tauri/src/commands/workspace.rs @@ -10,6 +10,32 @@ use crate::managed_agents::{ }; use crate::relay; +const WORKSPACE_APPLY_SUPERSEDED: &str = "workspace apply superseded by a newer request"; + +fn next_apply_generation(generation: &std::sync::atomic::AtomicU64) -> u64 { + generation.fetch_add(1, Ordering::AcqRel).wrapping_add(1) +} + +fn assert_current_apply_generation( + generation: &std::sync::atomic::AtomicU64, + ticket: u64, +) -> Result<(), String> { + if generation.load(Ordering::Acquire) == ticket { + Ok(()) + } else { + Err(WORKSPACE_APPLY_SUPERSEDED.to_string()) + } +} + +async fn begin_workspace_apply( + lock: std::sync::Arc>, + generation: &std::sync::atomic::AtomicU64, +) -> (tokio::sync::OwnedMutexGuard<()>, u64) { + let guard = lock.lock_owned().await; + let ticket = next_apply_generation(generation); + (guard, ticket) +} + /// Adopt the pre-scoping global retention database's pending rows into `scope`. /// /// Best-effort: a failure is logged and the boot proceeds. The migration's own @@ -131,8 +157,24 @@ pub async fn apply_workspace( agent_managed_profiles: Option, app: AppHandle, ) -> Result<(), String> { + let state = app.state::(); + // Take the generation only after entering the serialized transaction. An + // apply that is already running remains authoritative until it releases + // the lock; the next apply then advances the generation. This keeps every + // awaited reconciliation/event-sync phase inside one ordered transaction. + let (apply_guard, apply_generation) = begin_workspace_apply( + state.workspace_apply_lock.clone(), + &state.workspace_apply_generation, + ) + .await; + let restore_app = app.clone(); + let apply_app = app.clone(); + // Capture the caller's relay before the blocking apply. Reading shared + // state afterward could pick up a newer concurrent community switch. + let profile_reconcile_relay = relay_url.clone(); tokio::task::spawn_blocking(move || { + let app = apply_app; let state = app.state::(); // ── Validate before mutating ────────────────────────────────────────── @@ -163,6 +205,11 @@ pub async fn apply_workspace( None => None, }; + // Defense in depth: this transaction still owns the serialized apply + // generation before making its first mutation. Normal queued applies + // cannot advance it until this transaction releases the guard. + assert_current_apply_generation(&state.workspace_apply_generation, apply_generation)?; + // ── Apply all state changes (nothing below can fail) ────────────────── { let mut override_guard = state.relay_url_override.lock().map_err(|e| e.to_string())?; @@ -211,7 +258,19 @@ pub async fn apply_workspace( .await .map_err(|e| format!("spawn_blocking failed: {e}"))??; + assert_current_apply_generation(&state.workspace_apply_generation, apply_generation)?; + let state = restore_app.state::(); + super::agents::provider_access::reconcile_on_workspace_apply(&restore_app, &state).await?; + // The Bumble→Pollen migration may have renamed stopped agents. Reconcile + // their relay profiles independently of runtime restore; successful writes + // record this relay while retaining the agent for other communities, and + // failures retry on the next workspace apply. + crate::managed_agents::spawn_pending_profile_reconciliations( + &restore_app, + &profile_reconcile_relay, + ); + // Backfill this exact relay+owner scope only after the workspace has been // applied. Running at process boot would target the fallback relay and // collapse every community into one pending-event store. @@ -220,16 +279,39 @@ pub async fn apply_workspace( // Adopt whatever the pre-scoping release left queued in the global // retention database BEFORE the scoped reconcile and flush run, so // stranded tombstones and archive requests publish on this boot - // instead of being abandoned by the storage cutover. + // instead of being abandoned by the storage cutover. Best-effort: + // it is not a prerequisite for the superseding head — the team leg + // below builds the repaired roster's head fresh from disk with a + // monotonic `created_at` regardless of what the legacy copy left. migrate_legacy_retention_into(&restore_app, &scope); - crate::event_sync::spawn_event_sync( + // Await the reconcile to completion — do NOT spawn it — and + // propagate its failure. The boot migration may have repaired team + // membership on disk; the frontend starts inbound history replay + // the moment `useCommunityInit` observes the applied workspace, and + // an old relay team head could otherwise win that race and overwrite + // the repaired `persona_ids`. The team leg is fatal (see + // `run_event_sync`): only its success durably retains the corrected + // head with a superseding `monotonic_created_at`, so + // `retain_inbound_event`'s equal/older guard rejects the stale head. + // On failure we return `Err` — the command reports failure, + // `useCommunityInit` never exposes the community, and inbound replay + // never starts against an un-superseded disk state. + crate::event_sync::run_event_sync_blocking( restore_app.clone(), scope.owner_keys, scope.db_path, ) + .await?; } Err(error) => { - eprintln!("buzz-desktop: scoped event-sync unavailable after workspace apply: {error}"); + // Scope resolution is a prerequisite for establishing the + // superseding head, so its failure is fatal for the same reason: + // without a scope we cannot retain the repaired roster ahead of an + // inbound replay. Fail the command rather than silently opening the + // inbound lane. + return Err(format!( + "scoped event-sync unavailable after workspace apply: {error}" + )); } } @@ -237,17 +319,15 @@ pub async fn apply_workspace( .managed_agent_restore_pending .swap(false, Ordering::AcqRel); - // The coordinator starts before React applies the selected workspace, so - // its startup publication may have used the fallback relay and placeholder - // identity. Correct it off the command path so an unavailable relay cannot - // hold the frontend on its loading gate. On initial launch, restore MeshLLM - // first so a slow stopped-status request cannot overwrite a newly restored - // serving status, then restore managed agents after the admission identity - // has been published (or the bounded publication attempt has timed out). + // Transfer the apply guard to launch restoration. The command can return + // promptly, but a queued workspace cannot mutate relay/identity until the + // restore has completed every mutable workspace read and side effect. #[cfg(feature = "mesh-llm")] { + let restore_lock = apply_guard; let app = restore_app.clone(); tauri::async_runtime::spawn(async move { + let _restore_lock = restore_lock; let state = app.state::(); if restore_pending { if let Err(error) = @@ -265,12 +345,15 @@ pub async fn apply_workspace( } } }); + return Ok(()); } #[cfg(not(feature = "mesh-llm"))] if restore_pending { + let restore_lock = apply_guard; let app = restore_app.clone(); tauri::async_runtime::spawn(async move { + let _restore_lock = restore_lock; let state = app.state::(); if let Err(error) = restore_managed_agents_on_launch(&app, &state.shutdown_started).await @@ -278,7 +361,59 @@ pub async fn apply_workspace( eprintln!("buzz-desktop: failed to restore managed agents: {error}"); } }); + return Ok(()); } + assert_current_apply_generation(&state.workspace_apply_generation, apply_generation)?; + Ok(()) } + +#[cfg(test)] +mod tests { + use std::sync::{ + atomic::{AtomicU64, Ordering}, + Arc, + }; + + use super::{assert_current_apply_generation, begin_workspace_apply, next_apply_generation}; + + #[test] + fn explicit_newer_generation_supersedes_older_ticket() { + let generation = AtomicU64::new(0); + let older = next_apply_generation(&generation); + let newer = next_apply_generation(&generation); + + let error = assert_current_apply_generation(&generation, older).unwrap_err(); + assert!(error.contains("superseded"), "{error}"); + assert_current_apply_generation(&generation, newer).unwrap(); + } + + #[tokio::test] + async fn queued_apply_cannot_supersede_running_transaction_or_restore_phase() { + let lock = Arc::new(tokio::sync::Mutex::new(())); + let generation = Arc::new(AtomicU64::new(0)); + let (running_guard, running_ticket) = + begin_workspace_apply(Arc::clone(&lock), &generation).await; + + let queued_lock = Arc::clone(&lock); + let queued_generation = Arc::clone(&generation); + let queued = tokio::spawn(async move { + let (_guard, ticket) = begin_workspace_apply(queued_lock, &queued_generation).await; + ticket + }); + tokio::task::yield_now().await; + + // A queued workspace has not advanced the generation, so every awaited + // phase of the running transaction, including one-shot launch restore, + // remains authoritative while it holds the lock. + assert_eq!(generation.load(Ordering::Acquire), running_ticket); + assert_current_apply_generation(&generation, running_ticket).unwrap(); + assert!(!queued.is_finished()); + + drop(running_guard); + let queued_ticket = queued.await.unwrap(); + assert!(queued_ticket > running_ticket); + assert_current_apply_generation(&generation, queued_ticket).unwrap(); + } +} diff --git a/desktop/src-tauri/src/deep_link.rs b/desktop/src-tauri/src/deep_link.rs index ffe951dc367..83ac7e59ff9 100644 --- a/desktop/src-tauri/src/deep_link.rs +++ b/desktop/src-tauri/src/deep_link.rs @@ -20,6 +20,79 @@ pub(crate) struct PendingCommunityDeepLink { #[derive(Default)] pub(crate) struct PendingCommunityDeepLinks(Mutex>); +#[derive(Debug, Clone, PartialEq, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct PendingNavigationDeepLink { + id: String, + kind: String, + channel_id: String, + message_id: Option, + thread_root_id: Option, +} + +#[derive(Default)] +pub(crate) struct PendingNavigationDeepLinks(Mutex>); + +impl PendingNavigationDeepLinks { + fn lock(&self) -> std::sync::MutexGuard<'_, VecDeque> { + self.0.lock().unwrap_or_else(|poisoned| { + eprintln!("buzz-desktop: recovering poisoned pending navigation deep-link queue"); + poisoned.into_inner() + }) + } + + fn enqueue(&self, pending: PendingNavigationDeepLink) { + let mut queue = self.lock(); + if queue.iter().any(|item| { + item.kind == pending.kind + && item.channel_id == pending.channel_id + && item.message_id == pending.message_id + && item.thread_root_id == pending.thread_root_id + }) { + return; + } + queue.push_back(pending); + } + + fn clear(&self) { + self.lock().clear(); + } + + fn first(&self) -> Option { + self.lock().front().cloned() + } + + fn acknowledge(&self, id: &str) -> bool { + let mut queue = self.lock(); + if queue.front().is_some_and(|item| item.id == id) { + queue.pop_front(); + true + } else { + false + } + } +} + +#[tauri::command] +pub(crate) fn clear_pending_navigation_deep_links(pending: State<'_, PendingNavigationDeepLinks>) { + pending.clear(); +} + +#[tauri::command] +pub(crate) fn take_pending_navigation_deep_link( + pending: State<'_, PendingNavigationDeepLinks>, +) -> Option { + pending.first() +} + +#[tauri::command] +pub(crate) fn acknowledge_pending_navigation_deep_link( + id: String, + pending: State<'_, PendingNavigationDeepLinks>, +) -> bool { + pending.acknowledge(&id) +} + impl PendingCommunityDeepLinks { fn enqueue(&self, pending: PendingCommunityDeepLink) { let mut queue = self.0.lock().expect("pending deep-link queue poisoned"); @@ -54,6 +127,49 @@ impl PendingCommunityDeepLinks { } } +#[derive(Debug, Clone, PartialEq, Eq, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct PendingEntityDeepLink { + id: String, + href: String, +} + +#[derive(Default)] +pub(crate) struct PendingEntityDeepLinks(Mutex>); + +impl PendingEntityDeepLinks { + fn enqueue(&self, href: String) -> PendingEntityDeepLink { + let mut queue = self.0.lock().expect("pending deep-link queue poisoned"); + if let Some(existing) = queue.iter().find(|item| item.href == href) { + return existing.clone(); + } + let pending = PendingEntityDeepLink { + id: uuid::Uuid::new_v4().to_string(), + href, + }; + queue.push_back(pending.clone()); + pending + } + + fn first(&self) -> Option { + self.0 + .lock() + .expect("pending deep-link queue poisoned") + .front() + .cloned() + } + + fn acknowledge(&self, id: &str) -> bool { + let mut queue = self.0.lock().expect("pending deep-link queue poisoned"); + if queue.front().is_some_and(|item| item.id == id) { + queue.pop_front(); + true + } else { + false + } + } +} + #[tauri::command] pub(crate) fn take_pending_community_deep_link( pending: State<'_, PendingCommunityDeepLinks>, @@ -69,6 +185,21 @@ pub(crate) fn acknowledge_pending_community_deep_link( pending.acknowledge(&id) } +#[tauri::command] +pub(crate) fn take_pending_entity_deep_link( + pending: State<'_, PendingEntityDeepLinks>, +) -> Option { + pending.first() +} + +#[tauri::command] +pub(crate) fn acknowledge_pending_entity_deep_link( + id: String, + pending: State<'_, PendingEntityDeepLinks>, +) -> bool { + pending.acknowledge(&id) +} + fn queue_community_deep_link( app: &tauri::AppHandle, kind: &str, @@ -88,6 +219,24 @@ fn queue_community_deep_link( }); } +fn queue_navigation_deep_link(app: &tauri::AppHandle, kind: &str, payload: &serde_json::Value) { + let Some(channel_id) = payload["channelId"].as_str() else { + return; + }; + app.state::() + .enqueue(PendingNavigationDeepLink { + id: uuid::Uuid::new_v4().to_string(), + kind: kind.to_owned(), + channel_id: channel_id.to_owned(), + message_id: payload["messageId"].as_str().map(str::to_owned), + thread_root_id: payload["threadRootId"].as_str().map(str::to_owned), + }); +} + +fn queue_entity_deep_link(app: &tauri::AppHandle, href: String) -> PendingEntityDeepLink { + app.state::().enqueue(href) +} + fn activate_main_window(app: &tauri::AppHandle) { let Some(window) = app.get_webview_window("main") else { return; @@ -104,6 +253,58 @@ fn activate_main_window(app: &tauri::AppHandle) { } } +fn parse_channel_deep_link(url: &Url) -> Option { + if url.query().is_some() + || url.fragment().is_some() + || !url.username().is_empty() + || url.password().is_some() + { + return None; + } + let mut segments = url.path_segments()?; + let channel_id = segments.next()?; + let message_id = segments.next(); + if segments.next().is_some() { + return None; + } + let channel_id = uuid::Uuid::parse_str(channel_id).ok()?.to_string(); + if message_id.is_some_and(|value| { + value.len() != 64 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) + }) { + return None; + } + Some(match message_id { + Some(message_id) => serde_json::json!({ + "channelId": channel_id, + "messageId": message_id.to_ascii_lowercase(), + }), + None => serde_json::json!({ "channelId": channel_id }), + }) +} + +#[cfg(desktop)] +pub(crate) fn install_deep_link_handlers(app: &mut tauri::App) { + use tauri_plugin_deep_link::DeepLinkExt; + + let dl_handle = app.handle().clone(); + app.deep_link().on_open_url(move |event| { + for url in event.urls() { + handle_deep_link_url(&dl_handle, url.as_str()); + } + }); + + #[cfg(any(target_os = "windows", target_os = "linux"))] + match app.deep_link().get_current() { + Ok(Some(urls)) => { + for url in urls { + handle_deep_link_url(app.handle(), url.as_str()); + } + } + Ok(None) => {} + Err(error) => eprintln!("buzz-desktop: failed to read launch deep link: {error}"), + } +} + /// Parse the query string of a `buzz://message?…` URL into the JSON /// payload emitted on `deep-link-message`. Returns `None` when a required /// param (`channel`, `id`) is missing or empty — mirroring the validation @@ -163,6 +364,100 @@ fn parse_join_deep_link(url: &Url) -> Option { })) } +/// Hosts of the `buzz://` git-entity links built by +/// `desktop/src/shared/lib/entityLink.ts` and `crates/buzz-cli/src/links.rs`. +const ENTITY_LINK_HOSTS: [&str; 4] = ["repo", "project", "pr", "issue"]; + +fn is_hex64(value: &str) -> bool { + value.len() == 64 && value.chars().all(|c| c.is_ascii_hexdigit()) +} + +fn is_git_object_id(value: &str) -> bool { + matches!(value.len(), 40 | 64) && value.chars().all(|c| c.is_ascii_hexdigit()) +} + +/// Mirrors `isValidDtag` in `entityLink.ts` — the link format addresses a +/// narrower d-tag charset than Nostr allows. +fn is_linkable_dtag(value: &str) -> bool { + !value.is_empty() + && value.len() <= 64 + && value + .chars() + .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-')) + && !value.starts_with('.') + && !value.contains("..") +} + +/// Validate a `buzz://repo|project|pr|issue?…` link and return it verbatim +/// for the frontend, which re-parses it with `parseEntityLink` before +/// navigating. Validating here too keeps a malformed link from raising and +/// focusing the window for a navigation that would then be declined. +/// +/// Workspace tabs addressable by `buzz://repo|project` links — mirrors +/// `ENTITY_LINK_TABS` in `entityLink.ts`. +const ENTITY_LINK_TABS: [&str; 6] = [ + "files", + "commits", + "issues", + "prs", + "contributors", + "channels", +]; + +/// The canonical-form rules match `parseEntityLink`: no path segments, no +/// fragment, and no parameters beyond `owner`/`d` (plus `id` for event +/// links and the optional `tab` for coordinate links), so a future +/// extension of the format is declined by old builds rather than silently +/// misread. +fn parse_entity_deep_link(url: &Url) -> Option<()> { + let host = url.host_str()?; + if !ENTITY_LINK_HOSTS.contains(&host) { + return None; + } + if !matches!(url.path(), "" | "/") || url.fragment().is_some() { + return None; + } + + let needs_event_id = host == "pr" || host == "issue"; + let allows_tab = host == "repo" || host == "project"; + let (mut owner, mut dtag, mut id, mut tab, mut commit) = (None, None, None, None, None); + for (key, value) in url.query_pairs() { + let slot = match key.as_ref() { + "owner" => &mut owner, + "d" => &mut dtag, + "id" if needs_event_id => &mut id, + "tab" if allows_tab => &mut tab, + "commit" if host == "repo" => &mut commit, + _ => return None, + }; + if slot.is_some() { + return None; + } + *slot = Some(value.into_owned()); + } + + if !owner.is_some_and(|owner| is_hex64(&owner)) { + return None; + } + if !dtag.is_some_and(|dtag| is_linkable_dtag(&dtag)) { + return None; + } + if needs_event_id && !id.is_some_and(|id| is_hex64(&id)) { + return None; + } + if let Some(tab) = tab.as_deref() { + if !ENTITY_LINK_TABS.contains(&tab) { + return None; + } + } + if let Some(commit) = commit { + if tab.as_deref() != Some("commits") || !is_git_object_id(&commit) { + return None; + } + } + Some(()) +} + #[derive(Debug, Clone, PartialEq, Eq, Serialize)] #[serde(rename_all = "camelCase")] struct AddCommunityDeepLinkPayload { @@ -295,6 +590,7 @@ fn parse_nostr_bind_deep_link(url: &Url) -> Result` — emits `deep-link-connect` to the frontend +/// - `buzz://repo|project|pr|issue?…` — emits `deep-link-entity` to the frontend pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) { let url = match Url::parse(url_str) { Ok(u) => u, @@ -350,6 +646,20 @@ pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) { ); let _ = app.emit("deep-link-add-community", payload); } + Some("channel") => { + let Some(payload) = parse_channel_deep_link(&url) else { + eprintln!("buzz-desktop: channel deep link missing/invalid channel: {url_str}"); + return; + }; + activate_main_window(app); + if payload["messageId"].is_string() { + queue_navigation_deep_link(app, "message", &payload); + let _ = app.emit("deep-link-message", payload); + } else { + queue_navigation_deep_link(app, "channel", &payload); + let _ = app.emit("deep-link-channel", payload); + } + } Some("message") => { // `buzz://message?channel=&id=[&thread=]` // @@ -364,8 +674,23 @@ pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) { return; }; activate_main_window(app); + queue_navigation_deep_link(app, "message", &payload); let _ = app.emit("deep-link-message", payload); } + Some("repo" | "project" | "pr" | "issue") => { + // `buzz://repo|project?owner=&d=` and + // `buzz://pr|issue?id=&owner=&d=` — the + // share links copied from the Projects UI. The frontend owns + // routing (`useEntityDeepLinks`), so the validated URL is + // forwarded unchanged. + if parse_entity_deep_link(&url).is_none() { + eprintln!("buzz-desktop: malformed entity deep link: {url_str}"); + return; + } + activate_main_window(app); + let pending = queue_entity_deep_link(app, url_str.to_owned()); + let _ = app.emit("deep-link-entity", pending); + } Some("nostr-bind") => match parse_nostr_bind_deep_link(&url) { Ok(payload) => { activate_main_window(app); @@ -385,327 +710,5 @@ pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) { } #[cfg(test)] -mod tests { - use url::Url; - - use super::{ - parse_add_community_deep_link, parse_join_deep_link, parse_message_deep_link, - parse_nostr_bind_deep_link, PendingCommunityDeepLink, PendingCommunityDeepLinks, - }; - - fn pending(id: &str, relay_url: &str, code: Option<&str>) -> PendingCommunityDeepLink { - PendingCommunityDeepLink { - id: id.to_owned(), - kind: if code.is_some() { "join" } else { "connect" }.to_owned(), - relay_url: relay_url.to_owned(), - code: code.map(str::to_owned), - policy_receipt: None, - name: None, - } - } - - #[test] - fn pending_join_serializes_policy_receipt_for_cold_launch_recovery() { - let mut link = pending("join", "wss://relay.example", Some("invite")); - link.policy_receipt = Some("relay-signed-receipt".to_owned()); - - let payload = serde_json::to_value(link).unwrap(); - assert_eq!(payload["policyReceipt"], "relay-signed-receipt"); - } - - #[test] - fn pending_community_links_are_fifo_and_acknowledged_in_order() { - let queue = PendingCommunityDeepLinks::default(); - queue.enqueue(pending("first", "wss://one.example", Some("one"))); - queue.enqueue(pending("second", "wss://two.example", Some("two"))); - assert_eq!(queue.first().unwrap().id, "first"); - assert!(!queue.acknowledge("second")); - assert!(queue.acknowledge("first")); - assert_eq!(queue.first().unwrap().id, "second"); - } - - #[test] - fn pending_community_links_dedupe_exact_intents() { - let queue = PendingCommunityDeepLinks::default(); - queue.enqueue(pending("first", "wss://one.example", Some("one"))); - queue.enqueue(pending("duplicate", "wss://one.example", Some("one"))); - assert!(queue.acknowledge("first")); - assert!(queue.first().is_none()); - } - - fn valid_nostr_bind_url() -> Url { - Url::parse( - "buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard", - ) - .unwrap() - } - - #[test] - fn parse_add_community_deep_link_extracts_relay_and_name() { - let url = Url::parse( - "buzz://add-community?relay=wss%3A%2F%2Facme.communities.buzz.xyz&name=Acme%20Team&ignored=value", - ) - .unwrap(); - let payload = parse_add_community_deep_link(&url).unwrap(); - assert_eq!(payload.relay_url, "wss://acme.communities.buzz.xyz"); - assert_eq!(payload.name.as_deref(), Some("Acme Team")); - } - - #[test] - fn parse_add_community_deep_link_accepts_an_omitted_or_empty_name() { - for raw in [ - "buzz://add-community?relay=wss%3A%2F%2Facme.example", - "buzz://add-community?relay=wss%3A%2F%2Facme.example&name=", - ] { - assert!(parse_add_community_deep_link(&Url::parse(raw).unwrap()) - .unwrap() - .name - .is_none()); - } - } - - #[test] - fn parse_add_community_deep_link_rejects_invalid_relays() { - for raw in [ - "buzz://add-community", - "buzz://add-community?relay=", - "buzz://add-community?relay=not-a-url", - "buzz://add-community?relay=https%3A%2F%2Facme.example", - "buzz://add-community?relay=wss%3A%2F%2F", - ] { - assert!(parse_add_community_deep_link(&Url::parse(raw).unwrap()).is_none()); - } - } - - #[test] - fn parse_message_deep_link_extracts_required_params() { - let url = Url::parse("buzz://message?channel=abc&id=xyz").unwrap(); - let payload = parse_message_deep_link(&url).expect("required params present"); - assert_eq!(payload["channelId"], "abc"); - assert_eq!(payload["messageId"], "xyz"); - assert!(payload["threadRootId"].is_null()); - } - - #[test] - fn parse_message_deep_link_accepts_buzz_scheme() { - let url = Url::parse("buzz://message?channel=abc&id=xyz").unwrap(); - let payload = parse_message_deep_link(&url).expect("required params present"); - assert_eq!(payload["channelId"], "abc"); - assert_eq!(payload["messageId"], "xyz"); - } - - #[test] - fn parse_message_deep_link_includes_thread_root() { - let url = Url::parse("buzz://message?channel=abc&id=xyz&thread=root1").unwrap(); - let payload = parse_message_deep_link(&url).expect("required params present"); - assert_eq!(payload["threadRootId"], "root1"); - } - - #[test] - fn parse_message_deep_link_rejects_missing_id() { - let url = Url::parse("buzz://message?channel=abc").unwrap(); - assert!(parse_message_deep_link(&url).is_none()); - } - - #[test] - fn parse_message_deep_link_rejects_empty_channel() { - // Regression: `channel=&id=foo` previously produced channelId: "". - let url = Url::parse("buzz://message?channel=&id=foo").unwrap(); - assert!(parse_message_deep_link(&url).is_none()); - } - - #[test] - fn parse_message_deep_link_rejects_empty_id() { - let url = Url::parse("buzz://message?channel=abc&id=").unwrap(); - assert!(parse_message_deep_link(&url).is_none()); - } - - #[test] - fn parse_message_deep_link_treats_empty_thread_as_absent() { - let url = Url::parse("buzz://message?channel=abc&id=xyz&thread=").unwrap(); - let payload = parse_message_deep_link(&url).expect("required params present"); - assert!(payload["threadRootId"].is_null()); - } - - #[test] - fn parse_join_deep_link_extracts_relay_and_code() { - let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example&code=abc.def").unwrap(); - let payload = parse_join_deep_link(&url).expect("required params present"); - assert_eq!(payload["relayUrl"], "wss://relay.example"); - assert_eq!(payload["code"], "abc.def"); - assert!(payload["policyReceipt"].is_null()); - } - - #[test] - fn parse_join_deep_link_extracts_policy_receipt() { - let url = Url::parse( - "buzz://join?relay=wss%3A%2F%2Frelay.example&code=abc.def&policy_receipt=receipt.value", - ) - .unwrap(); - let payload = parse_join_deep_link(&url).expect("required params present"); - assert_eq!(payload["policyReceipt"], "receipt.value"); - } - - #[test] - fn parse_join_deep_link_rejects_missing_code() { - let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example").unwrap(); - assert!(parse_join_deep_link(&url).is_none()); - } - - #[test] - fn parse_join_deep_link_rejects_empty_code() { - let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example&code=").unwrap(); - assert!(parse_join_deep_link(&url).is_none()); - } - - #[test] - fn parse_join_deep_link_rejects_missing_relay() { - let url = Url::parse("buzz://join?code=abc.def").unwrap(); - assert!(parse_join_deep_link(&url).is_none()); - } - - #[test] - fn parse_join_deep_link_rejects_non_websocket_relay() { - let url = Url::parse("buzz://join?relay=https%3A%2F%2Frelay.example&code=abc.def").unwrap(); - assert!(parse_join_deep_link(&url).is_none()); - } - - #[test] - fn parse_nostr_bind_deep_link_accepts_valid_url() { - let payload = parse_nostr_bind_deep_link(&valid_nostr_bind_url()).unwrap(); - assert_eq!(payload.challenge_id, "550e8400-e29b-41d4-a716-446655440000"); - assert_eq!(payload.nonce, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567"); - assert_eq!(payload.verification_code, "123456"); - assert_eq!(payload.audience, "buzz:nostr-identity"); - assert_eq!(payload.action, "bind_nostr_identity"); - assert_eq!(payload.protocol, "buzz-nostr-identity"); - assert_eq!(payload.version, "1"); - assert_eq!(payload.origin, "https://example.com"); - assert_eq!(payload.expires_at, "2999-01-01T00:00:00Z"); - assert_eq!(payload.return_mode, "clipboard"); - assert_eq!(payload.callback_url, None); - } - - #[test] - fn parse_nostr_bind_deep_link_accepts_same_origin_callback_url() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=https%3A%2F%2Fexample.com%2Fbuzz%3FmockSession%3D1").unwrap(); - let payload = parse_nostr_bind_deep_link(&url).unwrap(); - assert_eq!( - payload.callback_url.as_deref(), - Some("https://example.com/buzz?mockSession=1") - ); - } - - #[test] - fn parse_nostr_bind_deep_link_accepts_browser_fragment_return() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=browser_fragment_v1&callback_url=https%3A%2F%2Fexample.com%2Fbuzz").unwrap(); - let payload = parse_nostr_bind_deep_link(&url).unwrap(); - - assert_eq!(payload.return_mode, "browser_fragment_v1"); - assert_eq!( - payload.callback_url.as_deref(), - Some("https://example.com/buzz") - ); - } - - #[test] - fn parse_nostr_bind_deep_link_requires_callback_for_browser_fragment_return() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=browser_fragment_v1").unwrap(); - - assert_eq!( - parse_nostr_bind_deep_link(&url).unwrap_err(), - "browser_fragment_v1 requires callback_url" - ); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_cross_origin_callback_url() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=https%3A%2F%2Fevil.example%2Fbuzz").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_http_callback_url() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=http%3A%2F%2Fexample.com%2Fbuzz").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_missing_challenge_id() { - let url = Url::parse("buzz://nostr-bind?nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_empty_nonce() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_missing_verification_code() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_short_verification_code() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=12345&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_long_verification_code() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=1234567&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_non_digit_verification_code() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=12345a&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_wrong_action() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=wrong&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_wrong_audience() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=other&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_non_https_origin() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=http%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_origin_with_path() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com%2Fbind&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_origin_with_credentials() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fuser%40example.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_rejects_unsupported_return_mode() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=callback").unwrap(); - assert!(parse_nostr_bind_deep_link(&url).is_err()); - } - - #[test] - fn parse_nostr_bind_deep_link_accepts_expired_link_for_user_facing_error() { - let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2000-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); - let payload = parse_nostr_bind_deep_link(&url).unwrap(); - assert_eq!(payload.expires_at, "2000-01-01T00:00:00Z"); - } -} +#[path = "deep_link_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/deep_link_tests.rs b/desktop/src-tauri/src/deep_link_tests.rs new file mode 100644 index 00000000000..84a08c4c64e --- /dev/null +++ b/desktop/src-tauri/src/deep_link_tests.rs @@ -0,0 +1,576 @@ +use url::Url; + +use super::{ + parse_add_community_deep_link, parse_channel_deep_link, parse_entity_deep_link, + parse_join_deep_link, parse_message_deep_link, parse_nostr_bind_deep_link, + PendingCommunityDeepLink, PendingCommunityDeepLinks, PendingEntityDeepLinks, + PendingNavigationDeepLink, PendingNavigationDeepLinks, ENTITY_LINK_TABS, +}; + +fn entity_link_golden() -> serde_json::Value { + serde_json::from_str(include_str!("../../../test-fixtures/entity-links.json")) + .expect("valid entity-links golden fixture") +} + +#[test] +fn parse_entity_deep_link_accepts_every_share_link_shape() { + let golden = entity_link_golden(); + let owner = golden["owner"].as_str().unwrap(); + let dtag = golden["dtag"].as_str().unwrap(); + for raw in golden["links"] + .as_object() + .unwrap() + .values() + .map(|value| value.as_str().unwrap().to_owned()) + .chain(golden["tabs"].as_array().unwrap().iter().map(|tab| { + format!( + "buzz://repo?owner={owner}&d={dtag}&tab={}", + tab.as_str().unwrap() + ) + })) + { + assert!( + parse_entity_deep_link(&Url::parse(&raw).unwrap()).is_some(), + "{raw}" + ); + } + let commit_link = format!( + "buzz://repo?owner={owner}&d={dtag}&tab=commits&commit={}", + golden["eventId"].as_str().unwrap() + ); + assert!(parse_entity_deep_link(&Url::parse(&commit_link).unwrap()).is_some()); + let expected_tabs = golden["tabs"] + .as_array() + .unwrap() + .iter() + .map(|tab| tab.as_str().unwrap()) + .collect::>(); + assert_eq!(ENTITY_LINK_TABS.as_slice(), expected_tabs); +} + +#[test] +fn parse_entity_deep_link_rejects_malformed_and_non_canonical_links() { + let golden = entity_link_golden(); + let owner = golden["owner"].as_str().unwrap(); + let event_id = golden["eventId"].as_str().unwrap(); + for raw in [ + // Missing or malformed identifiers. + format!("buzz://repo?owner={owner}"), + "buzz://repo?owner=nope&d=buzz-world".to_owned(), + format!("buzz://repo?owner={owner}&d=.hidden"), + format!("buzz://repo?owner={owner}&d=has%20space"), + format!("buzz://pr?owner={owner}&d=buzz-world"), + format!("buzz://pr?id=short&owner={owner}&d=buzz-world"), + // Coordinate links take no event id. + format!("buzz://repo?id={event_id}&owner={owner}&d=buzz-world"), + // Non-canonical: unknown param, duplicate param, path, fragment. + format!("buzz://repo?owner={owner}&d=buzz-world&relay=wss%3A%2F%2Fx.example"), + format!("buzz://repo?owner={owner}&owner={owner}&d=buzz-world"), + // Unknown tab value, duplicate tab, and tab on an event link. + format!("buzz://repo?owner={owner}&d=buzz-world&tab=overview"), + format!("buzz://repo?owner={owner}&d=buzz-world&tab=prs&tab=prs"), + format!("buzz://repo?owner={owner}&d=buzz-world&tab=files&commit={event_id}"), + format!("buzz://repo?owner={owner}&d=buzz-world&tab=commits&commit=short"), + format!("buzz://pr?id={event_id}&owner={owner}&d=buzz-world&tab=prs"), + format!("buzz://repo/extra?owner={owner}&d=buzz-world"), + format!("buzz://repo?owner={owner}&d=buzz-world#top"), + // Not an entity host. + format!("buzz://message?owner={owner}&d=buzz-world"), + ] { + assert!( + parse_entity_deep_link(&Url::parse(&raw).unwrap()).is_none(), + "{raw}" + ); + } +} + +fn pending(id: &str, relay_url: &str, code: Option<&str>) -> PendingCommunityDeepLink { + PendingCommunityDeepLink { + id: id.to_owned(), + kind: if code.is_some() { "join" } else { "connect" }.to_owned(), + relay_url: relay_url.to_owned(), + code: code.map(str::to_owned), + policy_receipt: None, + name: None, + } +} + +fn pending_navigation( + id: &str, + kind: &str, + channel_id: &str, + message_id: Option<&str>, + thread_root_id: Option<&str>, +) -> PendingNavigationDeepLink { + PendingNavigationDeepLink { + id: id.to_owned(), + kind: kind.to_owned(), + channel_id: channel_id.to_owned(), + message_id: message_id.map(str::to_owned), + thread_root_id: thread_root_id.map(str::to_owned), + } +} + +#[test] +fn pending_navigation_links_are_fifo_acknowledged_and_deduplicated() { + let queue = PendingNavigationDeepLinks::default(); + queue.enqueue(pending_navigation( + "first", + "channel", + "channel-1", + None, + None, + )); + queue.enqueue(pending_navigation( + "duplicate", + "channel", + "channel-1", + None, + None, + )); + queue.enqueue(pending_navigation( + "second", + "message", + "channel-1", + Some("message-1"), + Some("root-1"), + )); + + assert_eq!(queue.first().unwrap().id, "first"); + assert!(!queue.acknowledge("second")); + assert!(queue.acknowledge("first")); + assert_eq!(queue.first().unwrap().id, "second"); + assert!(queue.acknowledge("second")); + assert!(queue.first().is_none()); +} + +#[test] +fn pending_navigation_links_can_be_cleared() { + let queue = PendingNavigationDeepLinks::default(); + queue.enqueue(pending_navigation( + "first", + "channel", + "channel-1", + None, + None, + )); + queue.enqueue(pending_navigation( + "second", + "message", + "channel-1", + Some("message-1"), + None, + )); + + queue.clear(); + assert!(queue.first().is_none()); +} + +#[test] +fn pending_navigation_queue_recovers_after_mutex_poisoning() { + let queue = std::sync::Arc::new(PendingNavigationDeepLinks::default()); + let poisoner = std::sync::Arc::clone(&queue); + assert!(std::thread::spawn(move || { + let _guard = poisoner.0.lock().unwrap(); + panic!("poison queue for recovery regression"); + }) + .join() + .is_err()); + + queue.enqueue(pending_navigation( + "after-poison", + "channel", + "channel-1", + None, + None, + )); + assert_eq!(queue.first().unwrap().id, "after-poison"); + assert!(queue.acknowledge("after-poison")); + assert!(queue.first().is_none()); +} + +#[test] +fn pending_join_serializes_policy_receipt_for_cold_launch_recovery() { + let mut link = pending("join", "wss://relay.example", Some("invite")); + link.policy_receipt = Some("relay-signed-receipt".to_owned()); + + let payload = serde_json::to_value(link).unwrap(); + assert_eq!(payload["policyReceipt"], "relay-signed-receipt"); +} + +#[test] +fn pending_community_links_are_fifo_and_acknowledged_in_order() { + let queue = PendingCommunityDeepLinks::default(); + queue.enqueue(pending("first", "wss://one.example", Some("one"))); + queue.enqueue(pending("second", "wss://two.example", Some("two"))); + assert_eq!(queue.first().unwrap().id, "first"); + assert!(!queue.acknowledge("second")); + assert!(queue.acknowledge("first")); + assert_eq!(queue.first().unwrap().id, "second"); +} + +#[test] +fn pending_community_links_dedupe_exact_intents() { + let queue = PendingCommunityDeepLinks::default(); + queue.enqueue(pending("first", "wss://one.example", Some("one"))); + queue.enqueue(pending("duplicate", "wss://one.example", Some("one"))); + assert!(queue.acknowledge("first")); + assert!(queue.first().is_none()); +} + +#[test] +fn pending_entity_links_survive_until_acknowledged_in_order() { + let queue = PendingEntityDeepLinks::default(); + let first = queue.enqueue("buzz://project?owner=aa&d=first".to_owned()); + let second = queue.enqueue("buzz://project?owner=aa&d=second".to_owned()); + + assert_eq!(queue.first(), Some(first.clone())); + assert!(!queue.acknowledge(&second.id)); + assert!(queue.acknowledge(&first.id)); + assert_eq!(queue.first(), Some(second)); +} + +#[test] +fn pending_entity_links_dedupe_launch_and_open_callbacks() { + let queue = PendingEntityDeepLinks::default(); + let href = "buzz://project?owner=aa&d=buzz".to_owned(); + let first = queue.enqueue(href.clone()); + let duplicate = queue.enqueue(href); + + assert_eq!(duplicate.id, first.id); + assert!(queue.acknowledge(&first.id)); + assert!(queue.first().is_none()); +} + +fn valid_nostr_bind_url() -> Url { + Url::parse( + "buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard", + ) + .unwrap() +} + +#[test] +fn parse_add_community_deep_link_extracts_relay_and_name() { + let url = Url::parse( + "buzz://add-community?relay=wss%3A%2F%2Facme.communities.buzz.xyz&name=Acme%20Team&ignored=value", + ) + .unwrap(); + let payload = parse_add_community_deep_link(&url).unwrap(); + assert_eq!(payload.relay_url, "wss://acme.communities.buzz.xyz"); + assert_eq!(payload.name.as_deref(), Some("Acme Team")); +} + +#[test] +fn parse_add_community_deep_link_accepts_an_omitted_or_empty_name() { + for raw in [ + "buzz://add-community?relay=wss%3A%2F%2Facme.example", + "buzz://add-community?relay=wss%3A%2F%2Facme.example&name=", + ] { + assert!(parse_add_community_deep_link(&Url::parse(raw).unwrap()) + .unwrap() + .name + .is_none()); + } +} + +#[test] +fn parse_add_community_deep_link_rejects_invalid_relays() { + for raw in [ + "buzz://add-community", + "buzz://add-community?relay=", + "buzz://add-community?relay=not-a-url", + "buzz://add-community?relay=https%3A%2F%2Facme.example", + "buzz://add-community?relay=wss%3A%2F%2F", + ] { + assert!(parse_add_community_deep_link(&Url::parse(raw).unwrap()).is_none()); + } +} + +#[test] +fn parse_channel_deep_link_accepts_one_path_segment() { + let url = Url::parse("buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32").unwrap(); + let payload = parse_channel_deep_link(&url).unwrap(); + assert_eq!(payload["channelId"], "580ca78b-9dae-46f3-8854-bd671853ba32"); +} + +#[test] +fn parse_channel_deep_link_accepts_message_path() { + let message_id = "8455293f0123456789abcdef0123456789abcdef0123456789abcdef01234567"; + let url = Url::parse(&format!( + "buzz://channel/a372f080-5961-4535-b1a3-edffface377d/{message_id}" + )) + .unwrap(); + let payload = parse_channel_deep_link(&url).unwrap(); + assert_eq!(payload["channelId"], "a372f080-5961-4535-b1a3-edffface377d"); + assert_eq!(payload["messageId"], message_id); +} + +#[test] +fn parse_channel_deep_link_accepts_v7_and_normalizes_uppercase() { + for (raw, expected) in [ + ( + "buzz://channel/018fdb5d-3a64-7c35-b5f9-4a23e1f9d2d9", + "018fdb5d-3a64-7c35-b5f9-4a23e1f9d2d9", + ), + ( + "buzz://channel/580CA78B-9DAE-46F3-8854-BD671853BA32", + "580ca78b-9dae-46f3-8854-bd671853ba32", + ), + ] { + let payload = parse_channel_deep_link(&Url::parse(raw).unwrap()).unwrap(); + assert_eq!(payload["channelId"], expected); + } +} + +#[test] +fn parse_channel_deep_link_rejects_malformed_forms() { + for raw in [ + "buzz://channel", + "buzz://channel/", + "buzz://channel/one/two", + "buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32/not-hex", + "buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/extra", + "buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32/", + "buzz://channel/one?extra=true", + "buzz://channel/one#fragment", + "buzz://:pass@channel/580ca78b-9dae-46f3-8854-bd671853ba32/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "buzz://channel/not-a-uuid", + "buzz://channel/%2F", + "buzz://channel/%00", + ] { + assert!(parse_channel_deep_link(&Url::parse(raw).unwrap()).is_none()); + } +} + +#[test] +fn parse_message_deep_link_extracts_required_params() { + let url = Url::parse("buzz://message?channel=abc&id=xyz").unwrap(); + let payload = parse_message_deep_link(&url).expect("required params present"); + assert_eq!(payload["channelId"], "abc"); + assert_eq!(payload["messageId"], "xyz"); + assert!(payload["threadRootId"].is_null()); +} + +#[test] +fn parse_message_deep_link_accepts_buzz_scheme() { + let url = Url::parse("buzz://message?channel=abc&id=xyz").unwrap(); + let payload = parse_message_deep_link(&url).expect("required params present"); + assert_eq!(payload["channelId"], "abc"); + assert_eq!(payload["messageId"], "xyz"); +} + +#[test] +fn parse_message_deep_link_includes_thread_root() { + let url = Url::parse("buzz://message?channel=abc&id=xyz&thread=root1").unwrap(); + let payload = parse_message_deep_link(&url).expect("required params present"); + assert_eq!(payload["threadRootId"], "root1"); +} + +#[test] +fn parse_message_deep_link_rejects_missing_id() { + let url = Url::parse("buzz://message?channel=abc").unwrap(); + assert!(parse_message_deep_link(&url).is_none()); +} + +#[test] +fn parse_message_deep_link_rejects_empty_channel() { + // Regression: `channel=&id=foo` previously produced channelId: "". + let url = Url::parse("buzz://message?channel=&id=foo").unwrap(); + assert!(parse_message_deep_link(&url).is_none()); +} + +#[test] +fn parse_message_deep_link_rejects_empty_id() { + let url = Url::parse("buzz://message?channel=abc&id=").unwrap(); + assert!(parse_message_deep_link(&url).is_none()); +} + +#[test] +fn parse_message_deep_link_treats_empty_thread_as_absent() { + let url = Url::parse("buzz://message?channel=abc&id=xyz&thread=").unwrap(); + let payload = parse_message_deep_link(&url).expect("required params present"); + assert!(payload["threadRootId"].is_null()); +} + +#[test] +fn parse_join_deep_link_extracts_relay_and_code() { + let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example&code=abc.def").unwrap(); + let payload = parse_join_deep_link(&url).expect("required params present"); + assert_eq!(payload["relayUrl"], "wss://relay.example"); + assert_eq!(payload["code"], "abc.def"); + assert!(payload["policyReceipt"].is_null()); +} + +#[test] +fn parse_join_deep_link_extracts_policy_receipt() { + let url = Url::parse( + "buzz://join?relay=wss%3A%2F%2Frelay.example&code=abc.def&policy_receipt=receipt.value", + ) + .unwrap(); + let payload = parse_join_deep_link(&url).expect("required params present"); + assert_eq!(payload["policyReceipt"], "receipt.value"); +} + +#[test] +fn parse_join_deep_link_rejects_missing_code() { + let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example").unwrap(); + assert!(parse_join_deep_link(&url).is_none()); +} + +#[test] +fn parse_join_deep_link_rejects_empty_code() { + let url = Url::parse("buzz://join?relay=wss%3A%2F%2Frelay.example&code=").unwrap(); + assert!(parse_join_deep_link(&url).is_none()); +} + +#[test] +fn parse_join_deep_link_rejects_missing_relay() { + let url = Url::parse("buzz://join?code=abc.def").unwrap(); + assert!(parse_join_deep_link(&url).is_none()); +} + +#[test] +fn parse_join_deep_link_rejects_non_websocket_relay() { + let url = Url::parse("buzz://join?relay=https%3A%2F%2Frelay.example&code=abc.def").unwrap(); + assert!(parse_join_deep_link(&url).is_none()); +} + +#[test] +fn parse_nostr_bind_deep_link_accepts_valid_url() { + let payload = parse_nostr_bind_deep_link(&valid_nostr_bind_url()).unwrap(); + assert_eq!(payload.challenge_id, "550e8400-e29b-41d4-a716-446655440000"); + assert_eq!(payload.nonce, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567"); + assert_eq!(payload.verification_code, "123456"); + assert_eq!(payload.audience, "buzz:nostr-identity"); + assert_eq!(payload.action, "bind_nostr_identity"); + assert_eq!(payload.protocol, "buzz-nostr-identity"); + assert_eq!(payload.version, "1"); + assert_eq!(payload.origin, "https://example.com"); + assert_eq!(payload.expires_at, "2999-01-01T00:00:00Z"); + assert_eq!(payload.return_mode, "clipboard"); + assert_eq!(payload.callback_url, None); +} + +#[test] +fn parse_nostr_bind_deep_link_accepts_same_origin_callback_url() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=https%3A%2F%2Fexample.com%2Fbuzz%3FmockSession%3D1").unwrap(); + let payload = parse_nostr_bind_deep_link(&url).unwrap(); + assert_eq!( + payload.callback_url.as_deref(), + Some("https://example.com/buzz?mockSession=1") + ); +} + +#[test] +fn parse_nostr_bind_deep_link_accepts_browser_fragment_return() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=browser_fragment_v1&callback_url=https%3A%2F%2Fexample.com%2Fbuzz").unwrap(); + let payload = parse_nostr_bind_deep_link(&url).unwrap(); + + assert_eq!(payload.return_mode, "browser_fragment_v1"); + assert_eq!( + payload.callback_url.as_deref(), + Some("https://example.com/buzz") + ); +} + +#[test] +fn parse_nostr_bind_deep_link_requires_callback_for_browser_fragment_return() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=browser_fragment_v1").unwrap(); + + assert_eq!( + parse_nostr_bind_deep_link(&url).unwrap_err(), + "browser_fragment_v1 requires callback_url" + ); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_cross_origin_callback_url() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=https%3A%2F%2Fevil.example%2Fbuzz").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_http_callback_url() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard&callback_url=http%3A%2F%2Fexample.com%2Fbuzz").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_missing_challenge_id() { + let url = Url::parse("buzz://nostr-bind?nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_empty_nonce() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_missing_verification_code() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_short_verification_code() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=12345&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_long_verification_code() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=1234567&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_non_digit_verification_code() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=12345a&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_wrong_action() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=wrong&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_wrong_audience() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=other&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_non_https_origin() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=http%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_origin_with_path() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com%2Fbind&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_origin_with_credentials() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fuser%40example.com&expires_at=2999-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_rejects_unsupported_return_mode() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2999-01-01T00%3A00%3A00Z&return=callback").unwrap(); + assert!(parse_nostr_bind_deep_link(&url).is_err()); +} + +#[test] +fn parse_nostr_bind_deep_link_accepts_expired_link_for_user_facing_error() { + let url = Url::parse("buzz://nostr-bind?challenge_id=550e8400-e29b-41d4-a716-446655440000&nonce=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghi01234567&verification_code=123456&audience=buzz%3Anostr-identity&action=bind_nostr_identity&protocol=buzz-nostr-identity&version=1&origin=https%3A%2F%2Fexample.com&expires_at=2000-01-01T00%3A00%3A00Z&return=clipboard").unwrap(); + let payload = parse_nostr_bind_deep_link(&url).unwrap(); + assert_eq!(payload.expires_at, "2000-01-01T00:00:00Z"); +} diff --git a/desktop/src-tauri/src/egress_guard_tests.rs b/desktop/src-tauri/src/egress_guard_tests.rs index f487c8ce167..0c2a9573af6 100644 --- a/desktop/src-tauri/src/egress_guard_tests.rs +++ b/desktop/src-tauri/src/egress_guard_tests.rs @@ -156,14 +156,36 @@ async fn boundary_submit_signed_event_with_keys_blocks_ncryptsec() { fn boundary_huddle_stt_blocks_ncryptsec() { let keys = nostr::Keys::generate(); let channel = uuid::Uuid::new_v4(); - let builder = - crate::events::build_message(channel, NCRYPTSEC, None, &[], &[], &[], &[]).unwrap(); + let builder = crate::events::build_message( + channel, + NCRYPTSEC, + None, + &[], + &[], + &[], + &[], + &[], + None, + &crate::relay::relay_api_base_url(), + ) + .unwrap(); let err = crate::huddle::pipeline::sign_and_guard_stt_body(builder, &keys).unwrap_err(); assert_guard_error(&err); // Clean transcripts pass through the same seam. - let builder = - crate::events::build_message(channel, "hello huddle", None, &[], &[], &[], &[]).unwrap(); + let builder = crate::events::build_message( + channel, + "hello huddle", + None, + &[], + &[], + &[], + &[], + &[], + None, + &crate::relay::relay_api_base_url(), + ) + .unwrap(); assert!(crate::huddle::pipeline::sign_and_guard_stt_body(builder, &keys).is_ok()); } @@ -254,6 +276,10 @@ const EVENTS_INVENTORY: &[(&str, usize, usize)] = &[ // Mock-relay route in its in-file tests; production publish goes through // the guarded boundary-1 funnel (`submit_signed_event_at_with_keys`). ("src/commands/personas/sharing.rs", 1, 0), + // Loopback submit relay in `identity_archive.rs`'s in-file regen tests; + // production archive/unarchive publish through the guarded boundary-1 + // funnel via `submit_event`. + ("src/commands/identity_archive.rs", 1, 0), ]; // Needles are assembled at runtime so this scan file itself contains no diff --git a/desktop/src-tauri/src/event_sync.rs b/desktop/src-tauri/src/event_sync.rs index ee8e0d8b108..93990f2b24e 100644 --- a/desktop/src-tauri/src/event_sync.rs +++ b/desktop/src-tauri/src/event_sync.rs @@ -13,32 +13,44 @@ use std::path::Path; /// `sync_team_personas` wrote in [`crate::migration::run_boot_migrations`] /// (see its `# Ordering` guard). Event signing needs the resolved owner keys, /// so this runs after identity resolution, not in the boot migrations. -pub fn run_event_sync(app: &tauri::AppHandle, owner_keys: &nostr::Keys, db_path: &Path) { +pub fn run_event_sync( + app: &tauri::AppHandle, + owner_keys: &nostr::Keys, + db_path: &Path, +) -> Result<(), String> { + // Persona and agent legs stay best-effort: they log and swallow, and their + // failure does not undo the boot team-membership repair. The team leg is + // fatal — it establishes the superseding local head (a monotonic + // `created_at`) that lets `retain_inbound_event`'s equal/older guard reject + // a stale relay roster. If it fails, the caller must not let the frontend + // expose the community and start inbound replay against an un-superseded + // disk state. migrate_personas_to_events(app, owner_keys, db_path); - migrate_teams_to_events(app, owner_keys, db_path); + migrate_teams_to_events(app, owner_keys, db_path)?; crate::managed_agents::reconcile::reconcile_agents_to_events(app, owner_keys, db_path); + Ok(()) } -/// Spawn the best-effort event reconcile off the synchronous Tauri setup path. +/// Run the scoped event reconcile to completion on the blocking pool. +/// +/// Callers that must not let downstream work observe a not-yet-retained disk +/// state (e.g. `apply_workspace` before the frontend can start inbound history +/// replay) await this so the repaired local heads are durably retained — with a +/// superseding `monotonic_created_at` — before an old relay head can race in. +/// The owner keys are moved in so the task never touches the `AppState::keys` +/// mutex; the reconcile itself is synchronous JSON/SQLite/signing work, so it +/// runs on the blocking pool rather than an async worker. /// -/// The owner keys are cloned before spawning so the task never touches the -/// `AppState::keys` mutex. The reconcile itself is still synchronous JSON, -/// SQLite, and signing work, so it runs on the blocking pool rather than an -/// async worker. -pub fn spawn_event_sync( +/// Returns `Err` if the task fails to join or the fatal team leg errors, so the +/// caller can withhold community exposure until the superseding head is durable. +pub async fn run_event_sync_blocking( app: tauri::AppHandle, owner_keys: nostr::Keys, db_path: std::path::PathBuf, -) { - tauri::async_runtime::spawn(async move { - if let Err(e) = tauri::async_runtime::spawn_blocking(move || { - run_event_sync(&app, &owner_keys, &db_path); - }) +) -> Result<(), String> { + tauri::async_runtime::spawn_blocking(move || run_event_sync(&app, &owner_keys, &db_path)) .await - { - eprintln!("buzz-desktop: event-sync: spawn_blocking failed: {e}"); - } - }); + .map_err(|e| format!("event-sync: spawn_blocking failed: {e}"))? } /// Reconcile `personas.json` into the persona-event retention store. @@ -219,21 +231,23 @@ fn migrate_personas_in_dir_at( /// /// Must run after the persisted identity is resolved (it signs each event with /// the owner's keys). -pub fn migrate_teams_to_events(app: &tauri::AppHandle, keys: &nostr::Keys, db_path: &Path) { +pub fn migrate_teams_to_events( + app: &tauri::AppHandle, + keys: &nostr::Keys, + db_path: &Path, +) -> Result<(), String> { use crate::managed_agents::managed_agents_base_dir; - let Ok(base_dir) = managed_agents_base_dir(app) else { - return; - }; + let base_dir = managed_agents_base_dir(app) + .map_err(|e| format!("team-event-migration: base dir unavailable: {e}"))?; match migrate_teams_in_dir_at(&base_dir, keys, db_path) { - Ok(0) => {} + Ok(0) => Ok(()), Ok(migrated) => { eprintln!("buzz-desktop: team-event-migration: {migrated} teams migrated to retention"); + Ok(()) } - Err(e) => { - eprintln!("buzz-desktop: team-event-migration: {e}"); - } + Err(e) => Err(format!("team-event-migration: {e}")), } } diff --git a/desktop/src-tauri/src/event_sync_team_events_tests.rs b/desktop/src-tauri/src/event_sync_team_events_tests.rs index 0f7ab52bf59..b1a56b06616 100644 --- a/desktop/src-tauri/src/event_sync_team_events_tests.rs +++ b/desktop/src-tauri/src/event_sync_team_events_tests.rs @@ -133,3 +133,132 @@ fn migrate_teams_no_file_is_noop() { let keys = nostr::Keys::generate(); assert_eq!(migrate_teams_in_dir(base.path(), &keys).unwrap(), 0); } + +/// Error-contract for the fatal team leg. `run_event_sync` propagates a team +/// leg failure via `?`, and `apply_workspace` returns that `Err` so the +/// frontend never exposes the community against an un-superseded disk state. +/// This proves the leg genuinely surfaces failure (rather than logging and +/// swallowing) on an unreadable store — the precondition that made the +/// propagation load-bearing. +#[test] +fn migrate_teams_surfaces_error_on_unparseable_store() { + let base = tempfile::tempdir().unwrap(); + std::fs::write(base.path().join("teams.json"), "{ not valid json").unwrap(); + let keys = nostr::Keys::generate(); + assert!(migrate_teams_in_dir(base.path(), &keys).is_err()); +} + +/// Build a signed inbound team head at an explicit `created_at`, mirroring a +/// relay replay of a stale, pre-namespacing roster. +fn stale_inbound_head( + keys: &nostr::Keys, + id: &str, + bare_persona_ids: &[&str], + created_at: i64, +) -> crate::managed_agents::retention::RetainedEvent { + use crate::managed_agents::{team_events::build_team_event, TeamRecord}; + use buzz_core_pkg::kind::KIND_TEAM; + use nostr::JsonUtil; + + let record = TeamRecord { + id: id.to_string(), + name: "Sietch Tabr".to_string(), + description: None, + instructions: None, + persona_ids: bare_persona_ids.iter().map(|s| s.to_string()).collect(), + is_builtin: false, + source_dir: None, + is_symlink: false, + symlink_target: None, + version: None, + created_at: "2025-01-01T00:00:00Z".to_string(), + updated_at: "2025-01-01T00:00:00Z".to_string(), + }; + let event = build_team_event(&record) + .unwrap() + .custom_created_at(nostr::Timestamp::from(created_at as u64)) + .sign_with_keys(keys) + .unwrap(); + crate::managed_agents::retention::RetainedEvent { + kind: KIND_TEAM, + pubkey: keys.public_key().to_hex(), + d_tag: id.to_string(), + content: event.content.to_string(), + created_at: event.created_at.as_secs() as i64, + raw_event: event.as_json(), + pending_sync: false, + } +} + +/// Finding-1 retention-precedence guarantee. This proves the *mechanic* the +/// awaited-reconcile ordering relies on — it does not itself exercise +/// `apply_workspace` (an `AppHandle`-level path). Given the boot reconcile has +/// retained the repaired namespaced roster with a monotonic `created_at` +/// (reconcile-first), a stale relay head replayed afterward is older, so +/// `retain_inbound_event` skips it and the repaired roster stays. The +/// inbound-first lane is the counterfactual the ordering closes: with no +/// repaired head retained yet, the very same stale head is applied and restores +/// bare membership. Retention order is the only difference between the lanes; +/// `apply_workspace` awaiting the reconcile (see `commands/workspace.rs`) is +/// what forces the reconcile-first order in production. +#[test] +fn reconcile_first_makes_stale_inbound_team_head_lose() { + use crate::managed_agents::retention::{ + get_retained_event, open_retention_db, retain_inbound_event, InboundOutcome, + }; + use buzz_core_pkg::kind::KIND_TEAM; + + let keys = nostr::Keys::generate(); + let pubkey = keys.public_key().to_hex(); + let repaired = serde_json::json!([{ + "id": "sietch-tabr", + "name": "Sietch Tabr", + "persona_ids": ["sietch-tabr:thufir", "sietch-tabr:paul", "sietch-tabr:duncan"], + "is_builtin": false, + "created_at": "2025-01-01T00:00:00Z", + "updated_at": "2025-01-01T00:00:00Z" + }]); + let bare = ["thufir", "paul", "duncan"]; + + // Reconcile-first lane (the fix): the awaited boot reconcile retains the + // repaired namespaced roster with a monotonic `created_at`; a stale relay + // head replayed afterward is older, so `retain_inbound_event` skips it and + // the retained roster stays repaired. + let ordered = tempfile::tempdir().unwrap(); + let ordered_db = ordered.path().join("retention.db"); + write_base_teams(ordered.path(), &repaired); + assert_eq!( + migrate_teams_in_dir_at(ordered.path(), &keys, &ordered_db).unwrap(), + 1 + ); + let conn = open_retention_db(&ordered_db).unwrap(); + let repaired_head = get_retained_event(&conn, KIND_TEAM, &pubkey, "sietch-tabr") + .unwrap() + .unwrap(); + let stale = stale_inbound_head(&keys, "sietch-tabr", &bare, repaired_head.created_at - 1); + assert_eq!( + retain_inbound_event(&conn, &stale).unwrap(), + InboundOutcome::Skipped + ); + let head = get_retained_event(&conn, KIND_TEAM, &pubkey, "sietch-tabr") + .unwrap() + .unwrap(); + assert!(head.content.contains("sietch-tabr:thufir")); + assert!(!head.content.contains("\"thufir\"")); + + // Inbound-first lane (the race the fix closes): with no repaired head + // retained yet, the very same stale relay head is applied, restoring the + // bare pre-namespacing roster. Ordering is the only difference. + let raced = tempfile::tempdir().unwrap(); + let raced_db = raced.path().join("retention.db"); + let raced_conn = open_retention_db(&raced_db).unwrap(); + let stale = stale_inbound_head(&keys, "sietch-tabr", &bare, repaired_head.created_at - 1); + assert_eq!( + retain_inbound_event(&raced_conn, &stale).unwrap(), + InboundOutcome::Applied + ); + let head = get_retained_event(&raced_conn, KIND_TEAM, &pubkey, "sietch-tabr") + .unwrap() + .unwrap(); + assert!(head.content.contains("\"thufir\"")); +} diff --git a/desktop/src-tauri/src/events.rs b/desktop/src-tauri/src/events.rs index 777d56d02ef..1828b3f5605 100644 --- a/desktop/src-tauri/src/events.rs +++ b/desktop/src-tauri/src/events.rs @@ -8,11 +8,15 @@ //! //! Each function validates inputs and returns a nostr::EventBuilder. //! Signing and submission happen in relay::submit_event. - use buzz_core_pkg::kind::{KIND_IA_ARCHIVE_REQUEST, KIND_IA_UNARCHIVE_REQUEST}; use nostr::{EventBuilder, EventId, Kind, Tag}; use uuid::Uuid; +mod message_tags; + +use message_tags::{ + append_client_tags, append_sent_from_thread_tag, emoji_tags, imeta_tags, mention_reference_tags, +}; // ── Constants ──────────────────────────────────────────────────────────────── /// Maximum content size — matches buzz-sdk (64 KiB). @@ -76,56 +80,6 @@ fn mention_tags(mentions: &[&str]) -> Result, String> { Ok(tags) } -fn mention_reference_tags(mentions: &[Vec], tags: &mut Vec) -> Result<(), String> { - for mention in mentions { - if mention.first().map(String::as_str) != Some("mention") { - return Err(format!( - "mention reference tags must use 'mention' prefix (got {:?})", - mention.first() - )); - } - let Some(pubkey) = mention.get(1) else { - return Err("mention reference tag missing pubkey".into()); - }; - check_pubkey(pubkey)?; - tags.push(tag(vec!["mention", &pubkey.to_ascii_lowercase()])?); - } - Ok(()) -} - -/// Validate and append imeta tags. Rejects any tag whose first element is not "imeta" -/// to prevent injection of arbitrary tags (e.g., forged "h", "e", or "p" tags). -fn imeta_tags(media_tags: &[Vec], tags: &mut Vec) -> Result<(), String> { - for mt in media_tags { - if mt.first().map(String::as_str) != Some("imeta") { - return Err(format!( - "media tags must use 'imeta' prefix (got {:?})", - mt.first() - )); - } - let parts: Vec<&str> = mt.iter().map(String::as_str).collect(); - tags.push(Tag::parse(parts).map_err(|e| format!("invalid imeta tag: {e}"))?); - } - Ok(()) -} - -/// Validate and append NIP-30 custom-emoji tags. Mirrors `imeta_tags`: rejects -/// any tag whose first element is not "emoji" so this path can't be used to -/// smuggle forged "h"/"e"/"p" tags. Each tag is `["emoji", shortcode, url]`. -fn emoji_tags(emoji_tags: &[Vec], tags: &mut Vec) -> Result<(), String> { - for et in emoji_tags { - if et.first().map(String::as_str) != Some("emoji") { - return Err(format!( - "emoji tags must use 'emoji' prefix (got {:?})", - et.first() - )); - } - let parts: Vec<&str> = et.iter().map(String::as_str).collect(); - tags.push(Tag::parse(parts).map_err(|e| format!("invalid emoji tag: {e}"))?); - } - Ok(()) -} - /// Validate a hex pubkey is exactly 64 hex characters. fn check_pubkey(pubkey: &str) -> Result<(), String> { if pubkey.len() != 64 || !pubkey.chars().all(|c| c.is_ascii_hexdigit()) { @@ -180,7 +134,6 @@ pub fn build_leave(channel_id: Uuid) -> Result { } /// Kind 9002 — update channel name/description/visibility/ttl. -/// /// `ttl`: outer `None` leaves it unchanged; `Some(Some(secs))` sets the /// ephemeral timeout; `Some(None)` clears it (emits `["ttl", ""]`). pub fn build_update_channel( @@ -295,6 +248,7 @@ pub fn build_remove_member(channel_id: Uuid, target_pubkey: &str) -> Result], custom_emoji_tags: &[Vec], mention_ref_tags: &[Vec], + link_preview_tags: &[Vec], + sent_from_thread_tag: Option<&[String]>, + relay_base: &str, ) -> Result { build_message_with_client_tags( channel_id, @@ -312,6 +269,9 @@ pub fn build_message( media_tags, custom_emoji_tags, mention_ref_tags, + link_preview_tags, + sent_from_thread_tag, + relay_base, &[], ) } @@ -330,8 +290,14 @@ pub fn build_message_with_client_tags( media_tags: &[Vec], custom_emoji_tags: &[Vec], mention_ref_tags: &[Vec], + link_preview_tags: &[Vec], + sent_from_thread_tag: Option<&[String]>, + relay_base: &str, client_tags: &[Vec], ) -> Result { + if sent_from_thread_tag.is_some() && thread_ref.is_some() { + return Err("sent-from-thread provenance requires a top-level message".into()); + } check_content(content)?; let mut tags = vec![tag(vec!["h", &channel_id.to_string()])?]; if let Some(tr) = thread_ref { @@ -341,27 +307,12 @@ pub fn build_message_with_client_tags( imeta_tags(media_tags, &mut tags)?; emoji_tags(custom_emoji_tags, &mut tags)?; mention_reference_tags(mention_ref_tags, &mut tags)?; + crate::link_preview_tags::append(link_preview_tags, relay_base, &mut tags)?; + append_sent_from_thread_tag(sent_from_thread_tag, &mut tags)?; append_client_tags(client_tags, &mut tags)?; Ok(EventBuilder::new(Kind::Custom(9), content).tags(tags)) } -fn append_client_tags(client_tags: &[Vec], tags: &mut Vec) -> Result<(), String> { - for client_tag in client_tags { - if client_tag.first().map(String::as_str) != Some("client") { - return Err(format!( - "client tags must use 'client' prefix (got {:?})", - client_tag.first() - )); - } - if client_tag.len() < 2 { - return Err("client tag missing marker".into()); - } - let parts: Vec<&str> = client_tag.iter().map(String::as_str).collect(); - tags.push(Tag::parse(parts).map_err(|e| format!("invalid client tag: {e}"))?); - } - Ok(()) -} - /// Kind 45001 — forum post. pub fn build_forum_post( channel_id: Uuid, @@ -396,34 +347,37 @@ pub fn build_forum_comment( Ok(EventBuilder::new(Kind::Custom(45003), content).tags(tags)) } -/// Kind 40003 — edit a message. Carries the full new content AND a fresh -/// imeta tag set; the receiver overlays the imeta tags onto the original -/// event so the rendered message reflects exactly the edited state. NIP-30 -/// custom-emoji tags ride along the same way so an edited body's `:shortcode:`s -/// stay resolvable (the send path attaches these too). -/// -/// `mentions` carries the pubkeys of mentions that are *newly added* by this -/// edit (the caller diffs the edited body against the original). Only those get -/// a `p` tag so the newly-mentioned party is notified/woken, while a typo-fix -/// edit that leaves the mention set unchanged emits no `p` tags and never -/// re-wakes anyone. This mirrors the send path's `mention_tags` (dedup + -/// lowercase); the receiver overlays these onto the original event's audience. +pub struct MessageEditTags<'a> { + pub media: &'a [Vec], + pub custom_emoji: &'a [Vec], + pub mentions: &'a [&'a str], + pub mention_refs: Option<&'a [Vec]>, +} + +/// Kind 40003 — edit a message with full content, media, emoji, mentions, +/// and optional monotonic link-preview suppression. pub fn build_message_edit( channel_id: Uuid, target_event_id: EventId, content: &str, - media_tags: &[Vec], - custom_emoji_tags: &[Vec], - mentions: &[&str], + edit_tags: MessageEditTags<'_>, + suppress_link_previews: bool, ) -> Result { check_content(content)?; let mut tags = vec![ tag(vec!["h", &channel_id.to_string()])?, tag(vec!["e", &target_event_id.to_hex()])?, ]; - tags.extend(mention_tags(mentions)?); - imeta_tags(media_tags, &mut tags)?; - emoji_tags(custom_emoji_tags, &mut tags)?; + tags.extend(mention_tags(edit_tags.mentions)?); + imeta_tags(edit_tags.media, &mut tags)?; + emoji_tags(edit_tags.custom_emoji, &mut tags)?; + if let Some(mention_refs) = edit_tags.mention_refs { + mention_reference_tags(mention_refs, &mut tags)?; + tags.push(tag(vec!["buzz:mention-snapshot"])?); + } + if suppress_link_previews { + tags.push(tag(vec!["link-preview", "none"])?); + } Ok(EventBuilder::new(Kind::Custom(40003), content).tags(tags)) } @@ -802,47 +756,12 @@ pub fn build_dm_hide(channel_id: &str) -> Result { Ok(EventBuilder::new(Kind::Custom(41012), "").tags(tags)) } -/// Kind 30620 — replaceable workflow definition. -/// -/// The `d` tag carries the workflow id; `h` tag carries the channel id; the -/// content is the YAML definition. Same (pubkey, d) replaces the prior version. -pub fn build_workflow_definition( - workflow_id: &str, - channel_id: &str, - yaml_definition: &str, -) -> Result { - check_content(yaml_definition)?; - let tags = vec![tag(vec!["d", workflow_id])?, tag(vec!["h", channel_id])?]; - Ok(EventBuilder::new(Kind::Custom(30620), yaml_definition.to_string()).tags(tags)) -} - -/// Kind 5 — NIP-09 deletion targeting a kind:30620 workflow definition. -pub fn build_workflow_delete( - workflow_id: &str, - owner_pubkey_hex: &str, -) -> Result { - let coord = format!("30620:{owner_pubkey_hex}:{workflow_id}"); - let tags = vec![tag(vec!["a", &coord])?]; - Ok(EventBuilder::new(Kind::Custom(5), "").tags(tags)) -} - -/// Kind 46020 — trigger a workflow run by id. -pub fn build_workflow_trigger(workflow_id: &str) -> Result { - let tags = vec![tag(vec!["d", workflow_id])?]; - Ok(EventBuilder::new(Kind::Custom(46020), "").tags(tags)) -} - -/// Kind 46030 — grant an approval token (with optional note). -pub fn build_approval_grant(token: &str, note: Option<&str>) -> Result { - let tags = vec![tag(vec!["t", token])?]; - Ok(EventBuilder::new(Kind::Custom(46030), note.unwrap_or("")).tags(tags)) -} +mod workflows; -/// Kind 46031 — deny an approval token (with optional note). -pub fn build_approval_deny(token: &str, note: Option<&str>) -> Result { - let tags = vec![tag(vec!["t", token])?]; - Ok(EventBuilder::new(Kind::Custom(46031), note.unwrap_or("")).tags(tags)) -} +pub use workflows::{ + build_approval_deny, build_approval_grant, build_workflow_definition, build_workflow_delete, + build_workflow_trigger, +}; // ── Transport ──────────────────────────────────────────────────────────────── @@ -931,24 +850,35 @@ mod tests { assert_eq!(event.pubkey.to_hex(), TARGET_HEX); } - // ── build_message_edit `p`-tag emission (lane 8ace8eed) ────────────── - // - // The composer diffs the edited body's mentions against the original and - // hands `build_message_edit` only the *newly added* pubkeys. These tests - // pin the builder's contract given that contract: emit a `p` per added - // mention (deduped, lowercased), and none when the added set is empty - // (typo-fix edit) — so an unchanged mention set re-wakes nobody. - const CH_ID: &str = "11111111-1111-4111-8111-111111111111"; const ALICE_HEX: &str = "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"; const BOB_HEX: &str = "c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5"; fn edit_tags(mentions: &[&str]) -> Vec> { + edit_tags_with_refs(mentions, Some(&[])) + } + + fn edit_tags_with_refs( + mentions: &[&str], + mention_refs: Option<&[Vec]>, + ) -> Vec> { let channel = Uuid::parse_str(CH_ID).unwrap(); let target = EventId::from_hex("d24da132115ca0a46233cf4c2ad8338fbf914250cbcaa9181a6dd59533cb5ac1") .unwrap(); - let builder = build_message_edit(channel, target, "hi @alice", &[], &[], mentions).unwrap(); + let builder = build_message_edit( + channel, + target, + "hi @alice", + MessageEditTags { + media: &[], + custom_emoji: &[], + mentions, + mention_refs, + }, + false, + ) + .unwrap(); let secret = nostr::SecretKey::from_hex( "0000000000000000000000000000000000000000000000000000000000000003", ) @@ -962,7 +892,6 @@ mod tests { let tags = edit_tags(&[ALICE_HEX]); assert_eq!(tags[0][0], "h"); assert_eq!(tags[1][0], "e"); - // The `p` tag rides right after the `e` tag (insertion order). assert_eq!(tags[2], vec!["p".to_string(), ALICE_HEX.to_string()]); } @@ -979,6 +908,42 @@ mod tests { ); } + #[test] + fn edit_emits_full_mention_reference_snapshot() { + let tags = edit_tags_with_refs(&[], Some(&[vec!["mention".into(), ALICE_HEX.into()]])); + assert!( + tags.iter().any(|tag| tag == &["mention", ALICE_HEX]), + "stable mention reference must be present: {tags:?}" + ); + assert!( + tags.iter().any(|tag| tag == &["buzz:mention-snapshot"]), + "snapshot marker must be present: {tags:?}" + ); + } + + #[test] + fn empty_edit_mention_snapshot_is_explicit() { + let tags = edit_tags_with_refs(&[], Some(&[])); + assert!( + tags.iter().any(|tag| tag == &["buzz:mention-snapshot"]), + "empty snapshot must still clear stale references: {tags:?}" + ); + assert!(!tags + .iter() + .any(|tag| tag.first().map(String::as_str) == Some("mention"))); + } + + #[test] + fn partial_edit_omits_mention_snapshot() { + let tags = edit_tags_with_refs(&[], None); + assert!(!tags + .iter() + .any(|tag| tag.first().map(String::as_str) == Some("mention"))); + assert!(!tags + .iter() + .any(|tag| tag.first().map(String::as_str) == Some("buzz:mention-snapshot"))); + } + #[test] fn edit_mentions_are_deduped_and_lowercased() { let alice_upper = ALICE_HEX.to_ascii_uppercase(); diff --git a/desktop/src-tauri/src/events/message_tags.rs b/desktop/src-tauri/src/events/message_tags.rs new file mode 100644 index 00000000000..1d719beaa66 --- /dev/null +++ b/desktop/src-tauri/src/events/message_tags.rs @@ -0,0 +1,182 @@ +use nostr::{EventId, Tag}; + +use super::check_pubkey; + +const MAX_THREAD_ROOT_EXCERPT_CHARS: usize = 64; +const SENT_FROM_THREAD_TAG: &str = "buzz:sent-from-thread"; +const AGENT_ADDRESS_MENTION_MARKER: &str = "agent-address"; + +pub(super) fn mention_reference_tags( + mentions: &[Vec], + tags: &mut Vec, +) -> Result<(), String> { + for mention in mentions { + if mention.first().map(String::as_str) != Some("mention") { + return Err(format!( + "mention reference tags must use 'mention' prefix (got {:?})", + mention.first() + )); + } + let Some(pubkey) = mention.get(1) else { + return Err("mention reference tag missing pubkey".into()); + }; + if mention.len() > 3 + || (mention.len() == 3 + && mention.get(2).map(String::as_str) != Some(AGENT_ADDRESS_MENTION_MARKER)) + { + return Err("mention reference tag has invalid display metadata".into()); + } + check_pubkey(pubkey)?; + let normalized_pubkey = pubkey.to_ascii_lowercase(); + let mut parts = vec!["mention", normalized_pubkey.as_str()]; + if mention.len() == 3 { + parts.push(AGENT_ADDRESS_MENTION_MARKER); + } + tags.push( + Tag::parse(parts).map_err(|error| format!("invalid mention reference tag: {error}"))?, + ); + } + Ok(()) +} + +pub(super) fn append_sent_from_thread_tag( + source_tag: Option<&[String]>, + tags: &mut Vec, +) -> Result<(), String> { + let Some(source_tag) = source_tag else { + return Ok(()); + }; + if !matches!(source_tag.len(), 2 | 3) + || source_tag.first().map(String::as_str) != Some(SENT_FROM_THREAD_TAG) + { + return Err("invalid sent-from-thread tag shape".into()); + } + + EventId::from_hex(source_tag[1].trim()) + .map_err(|_| "sent-from-thread tag has invalid root event ID")?; + + if let Some(excerpt) = source_tag.get(2) { + if excerpt.trim().is_empty() + || excerpt.chars().count() > MAX_THREAD_ROOT_EXCERPT_CHARS + || excerpt.chars().any(char::is_control) + { + return Err("sent-from-thread tag has invalid root excerpt".into()); + } + } + + let parts: Vec<&str> = source_tag.iter().map(String::as_str).collect(); + tags.push(Tag::parse(parts).map_err(|e| format!("invalid sent-from-thread tag: {e}"))?); + Ok(()) +} + +/// Validate and append imeta tags. Rejects any tag whose first element is not "imeta" +/// to prevent injection of arbitrary tags (e.g., forged "h", "e", or "p" tags). +pub(super) fn imeta_tags(media_tags: &[Vec], tags: &mut Vec) -> Result<(), String> { + for media_tag in media_tags { + if media_tag.first().map(String::as_str) != Some("imeta") { + return Err(format!( + "media tags must use 'imeta' prefix (got {:?})", + media_tag.first() + )); + } + let parts: Vec<&str> = media_tag.iter().map(String::as_str).collect(); + tags.push(Tag::parse(parts).map_err(|e| format!("invalid imeta tag: {e}"))?); + } + Ok(()) +} + +/// Validate and append NIP-30 custom-emoji tags. Mirrors `imeta_tags`: rejects +/// any tag whose first element is not "emoji" so this path can't be used to +/// smuggle forged "h"/"e"/"p" tags. Each tag is `["emoji", shortcode, url]`. +pub(super) fn emoji_tags(emoji_tags: &[Vec], tags: &mut Vec) -> Result<(), String> { + for emoji_tag in emoji_tags { + if emoji_tag.first().map(String::as_str) != Some("emoji") { + return Err(format!( + "emoji tags must use 'emoji' prefix (got {:?})", + emoji_tag.first() + )); + } + let parts: Vec<&str> = emoji_tag.iter().map(String::as_str).collect(); + tags.push(Tag::parse(parts).map_err(|e| format!("invalid emoji tag: {e}"))?); + } + Ok(()) +} + +pub(super) fn append_client_tags( + client_tags: &[Vec], + tags: &mut Vec, +) -> Result<(), String> { + for client_tag in client_tags { + if client_tag.first().map(String::as_str) != Some("client") { + return Err(format!( + "client tags must use 'client' prefix (got {:?})", + client_tag.first() + )); + } + if client_tag.len() < 2 { + return Err("client tag missing marker".into()); + } + let parts: Vec<&str> = client_tag.iter().map(String::as_str).collect(); + tags.push(Tag::parse(parts).map_err(|e| format!("invalid client tag: {e}"))?); + } + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::*; + + const PUBKEY: &str = "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"; + const ROOT_HEX: &str = "d24da132115ca0a46233cf4c2ad8338fbf914250cbcaa9181a6dd59533cb5ac1"; + + #[test] + fn mention_reference_preserves_agent_address_display_metadata() { + let mut tags = Vec::new(); + mention_reference_tags( + &[vec![ + "mention".into(), + PUBKEY.to_ascii_uppercase(), + AGENT_ADDRESS_MENTION_MARKER.into(), + ]], + &mut tags, + ) + .unwrap(); + + assert_eq!( + tags[0].as_slice(), + &["mention", PUBKEY, AGENT_ADDRESS_MENTION_MARKER] + ); + } + + #[test] + fn mention_reference_rejects_unknown_display_metadata() { + let mut tags = Vec::new(); + let result = mention_reference_tags( + &[vec!["mention".into(), PUBKEY.into(), "unknown".into()]], + &mut tags, + ); + + assert!(result.is_err()); + } + + #[test] + fn message_accepts_only_valid_sent_from_thread_provenance() { + let source_tag = vec![ + SENT_FROM_THREAD_TAG.to_string(), + ROOT_HEX.to_string(), + "Root message excerpt".to_string(), + ]; + let mut tags = Vec::new(); + append_sent_from_thread_tag(Some(&source_tag), &mut tags).unwrap(); + assert_eq!(tags[0].as_slice(), source_tag); + + let forged_channel_tag = vec!["h".to_string(), "channel-id".to_string()]; + assert!(append_sent_from_thread_tag(Some(&forged_channel_tag), &mut Vec::new()).is_err()); + + let invalid_root_tag = vec![ + SENT_FROM_THREAD_TAG.to_string(), + "not-an-event-id".to_string(), + ]; + assert!(append_sent_from_thread_tag(Some(&invalid_root_tag), &mut Vec::new()).is_err()); + } +} diff --git a/desktop/src-tauri/src/events/workflows.rs b/desktop/src-tauri/src/events/workflows.rs new file mode 100644 index 00000000000..8615f73851f --- /dev/null +++ b/desktop/src-tauri/src/events/workflows.rs @@ -0,0 +1,50 @@ +use nostr::{EventBuilder, EventId, Kind}; + +use super::{check_content, tag}; + +/// Kind 30620 — replaceable workflow definition. +/// +/// The `d` tag carries the workflow id; `h` tag carries the channel id; the +/// content is the YAML definition. Same (pubkey, d) replaces the prior version. +pub fn build_workflow_definition( + workflow_id: &str, + channel_id: &str, + yaml_definition: &str, + expected_revision: Option<&str>, +) -> Result { + check_content(yaml_definition)?; + let mut tags = vec![tag(vec!["d", workflow_id])?, tag(vec!["h", channel_id])?]; + if let Some(revision) = expected_revision { + EventId::from_hex(revision).map_err(|_| "invalid workflow revision".to_string())?; + tags.push(tag(vec!["expected-revision", revision])?); + } + Ok(EventBuilder::new(Kind::Custom(30620), yaml_definition.to_string()).tags(tags)) +} + +/// Kind 5 — NIP-09 deletion targeting a kind:30620 workflow definition. +pub fn build_workflow_delete( + workflow_id: &str, + owner_pubkey_hex: &str, +) -> Result { + let coord = format!("30620:{owner_pubkey_hex}:{workflow_id}"); + let tags = vec![tag(vec!["a", &coord])?]; + Ok(EventBuilder::new(Kind::Custom(5), "").tags(tags)) +} + +/// Kind 46020 — trigger a workflow run by id. +pub fn build_workflow_trigger(workflow_id: &str) -> Result { + let tags = vec![tag(vec!["d", workflow_id])?]; + Ok(EventBuilder::new(Kind::Custom(46020), "").tags(tags)) +} + +/// Kind 46030 — grant an approval token (with optional note). +pub fn build_approval_grant(token: &str, note: Option<&str>) -> Result { + let tags = vec![tag(vec!["t", token])?]; + Ok(EventBuilder::new(Kind::Custom(46030), note.unwrap_or("")).tags(tags)) +} + +/// Kind 46031 — deny an approval token (with optional note). +pub fn build_approval_deny(token: &str, note: Option<&str>) -> Result { + let tags = vec![tag(vec!["t", token])?]; + Ok(EventBuilder::new(Kind::Custom(46031), note.unwrap_or("")).tags(tags)) +} diff --git a/desktop/src-tauri/src/huddle/agent_tts_publisher.rs b/desktop/src-tauri/src/huddle/agent_tts_publisher.rs new file mode 100644 index 00000000000..a1d42692666 --- /dev/null +++ b/desktop/src-tauri/src/huddle/agent_tts_publisher.rs @@ -0,0 +1,75 @@ +//! Establishes agent-authenticated publishers for locally synthesized speech. + +use std::sync::Arc; + +use super::{relay_api, tts}; +use crate::app_state::AppState; + +pub(super) async fn ensure( + app: &tauri::AppHandle, + state: &AppState, + pipeline: &tts::TtsPipeline, + speaker_pubkey: &str, +) -> Result { + if pipeline.has_audio_publisher(speaker_pubkey) { + return Ok(true); + } + + let app_for_load = app.clone(); + let speaker_for_load = speaker_pubkey.to_ascii_lowercase(); + let record = tokio::task::spawn_blocking(move || { + crate::managed_agents::load_managed_agents(&app_for_load).map(|agents| { + agents.into_iter().find(|agent| { + agent.pubkey.eq_ignore_ascii_case(&speaker_for_load) + && !agent.private_key_nsec.trim().is_empty() + }) + }) + }) + .await + .map_err(|error| format!("managed-agent identity task failed: {error}"))??; + let Some(record) = record else { + return Ok(false); + }; + + let keys = nostr::Keys::parse(record.private_key_nsec.trim()) + .map_err(|error| format!("managed-agent identity is unavailable: {error}"))?; + if !keys + .public_key() + .to_hex() + .eq_ignore_ascii_case(speaker_pubkey) + { + return Err("managed-agent identity does not match the Huddle speaker".to_string()); + } + let (ephemeral_channel_id, parent_channel_id, local_tts_publishers) = { + let huddle = state.huddle()?; + ( + huddle + .ephemeral_channel_id + .clone() + .ok_or("active Huddle has no backing channel")?, + huddle.parent_channel_id.clone(), + Arc::clone(&huddle.local_tts_publishers), + ) + }; + let has_bot_membership = + relay_api::fetch_channel_members_with_roles(&ephemeral_channel_id, state) + .await? + .into_iter() + .any(|(pubkey, role)| { + pubkey.eq_ignore_ascii_case(speaker_pubkey) && role.as_deref() == Some("bot") + }); + if !has_bot_membership { + return Err("agent is not an active bot member of the Huddle".to_string()); + } + let publisher = relay_api::connect_tts_audio_publisher( + &ephemeral_channel_id, + parent_channel_id.as_deref(), + state, + &keys, + record.auth_tag.as_deref(), + local_tts_publishers, + ) + .await?; + pipeline.register_audio_publisher(speaker_pubkey, publisher); + Ok(true) +} diff --git a/desktop/src-tauri/src/huddle/agent_tts_routing.rs b/desktop/src-tauri/src/huddle/agent_tts_routing.rs index 2ee3ec0d41a..87a56c0dbbc 100644 --- a/desktop/src-tauri/src/huddle/agent_tts_routing.rs +++ b/desktop/src-tauri/src/huddle/agent_tts_routing.rs @@ -25,8 +25,9 @@ pub(super) fn classify_agent_tts_runtime( } /// Maximum text length accepted for TTS synthesis. -/// ~2000 chars is 1–2 minutes of speech. Longer messages are truncated. -pub(super) const MAX_TTS_TEXT_LEN: usize = 2000; +/// This high safety cap keeps unexpectedly large events bounded while allowing +/// normal long-form huddle replies to play in full. +pub(super) const MAX_TTS_TEXT_LEN: usize = 8_096; pub(super) fn normalize_agent_tts_text(text: String) -> String { if text.chars().count() > MAX_TTS_TEXT_LEN { diff --git a/desktop/src-tauri/src/huddle/agent_tts_routing_tests.rs b/desktop/src-tauri/src/huddle/agent_tts_routing_tests.rs index cb550d7005b..c9ebabe6b62 100644 --- a/desktop/src-tauri/src/huddle/agent_tts_routing_tests.rs +++ b/desktop/src-tauri/src/huddle/agent_tts_routing_tests.rs @@ -47,6 +47,7 @@ fn disabled_is_the_only_intentional_runtime_no_op() { #[test] fn assistant_text_truncation_is_unicode_safe_before_voice_routing() { + assert_eq!(MAX_TTS_TEXT_LEN, 8_096); let input = "🦀".repeat(MAX_TTS_TEXT_LEN + 1); let output = normalize_agent_tts_text(input); assert_eq!( diff --git a/desktop/src-tauri/src/huddle/agent_voice.rs b/desktop/src-tauri/src/huddle/agent_voice.rs new file mode 100644 index 00000000000..5232287d756 --- /dev/null +++ b/desktop/src-tauri/src/huddle/agent_voice.rs @@ -0,0 +1,310 @@ +//! Per-agent text-to-speech choices for one local huddle session. + +use std::collections::{BTreeMap, HashSet}; + +use serde::{Deserialize, Serialize}; +use tauri::{AppHandle, State}; + +use crate::app_state::AppState; + +use super::{ + tts_settings::{ + pocket_voice_reference, resolve_voice_for_backend_in_registry, voice_registry, + VoiceRegistryEntry, POCKET_BACKEND_ID, + }, + HuddlePhase, HuddleState, +}; + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +pub struct AgentVoiceSettings { + pub enabled: bool, + pub voice_key: String, +} + +struct AgentVoiceCatalog { + default_voice_key: String, + voices: Vec, +} + +fn catalog(app: &AppHandle, state: &AppState) -> Result { + let registry = voice_registry(app); + let settings = state + .huddle_audio + .tts + .lock() + .map_err(|error| format!("text-to-speech settings lock poisoned: {error}"))? + .clone(); + let voices: Vec<_> = registry + .iter() + .filter(|voice| { + voice.backend == POCKET_BACKEND_ID + && matches!(voice.availability.as_str(), "bundled" | "installed") + }) + .cloned() + .collect(); + let default_voice_key = resolve_voice_for_backend_in_registry( + &settings.voice_preferences, + POCKET_BACKEND_ID, + &voices, + )? + .key; + Ok(AgentVoiceCatalog { + default_voice_key, + voices, + }) +} + +fn stable_voice_index(agent_pubkey: &str, huddle_generation: u64, len: usize) -> usize { + let hash = agent_pubkey.bytes().fold( + 0xcbf2_9ce4_8422_2325_u64 ^ huddle_generation, + |hash, byte| hash.wrapping_mul(0x0000_0100_0000_01b3) ^ u64::from(byte), + ); + (hash as usize) % len +} + +pub(crate) fn sync_agent_voice_assignments( + huddle: &mut HuddleState, + agent_pubkeys: &[String], + default_voice_key: &str, + voices: &[VoiceRegistryEntry], +) -> bool { + let previous = huddle.agent_voice_settings.clone(); + let available_keys: Vec<_> = voices.iter().map(|voice| voice.key.clone()).collect(); + let available: HashSet<_> = available_keys.iter().cloned().collect(); + let agents: HashSet<_> = agent_pubkeys.iter().cloned().collect(); + huddle.agent_voice_settings.retain(|pubkey, settings| { + agents.contains(pubkey) && available.contains(&settings.voice_key) + }); + + let mut used: HashSet<_> = huddle + .agent_voice_settings + .values() + .map(|settings| settings.voice_key.clone()) + .collect(); + for (index, pubkey) in agent_pubkeys.iter().enumerate() { + if huddle.agent_voice_settings.contains_key(pubkey) { + continue; + } + let preferred = if index == 0 && !used.contains(default_voice_key) { + Some(default_voice_key.to_owned()) + } else { + let unused_alternates: Vec<_> = available_keys + .iter() + .filter(|key| key.as_str() != default_voice_key && !used.contains(*key)) + .cloned() + .collect(); + let unused: Vec<_> = available_keys + .iter() + .filter(|key| !used.contains(*key)) + .cloned() + .collect(); + let candidates = if unused_alternates.is_empty() { + if unused.is_empty() { + &available_keys + } else { + &unused + } + } else { + &unused_alternates + }; + (!candidates.is_empty()).then(|| { + candidates[stable_voice_index(pubkey, huddle.huddle_generation, candidates.len())] + .clone() + }) + }; + if let Some(voice_key) = preferred { + used.insert(voice_key.clone()); + huddle.agent_voice_settings.insert( + pubkey.clone(), + AgentVoiceSettings { + enabled: true, + voice_key, + }, + ); + } + } + huddle.agent_voice_settings != previous +} + +fn ensure_with_catalog( + huddle: &mut HuddleState, + catalog: &AgentVoiceCatalog, + extra_agent: Option<&str>, +) -> bool { + let mut agents = huddle + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clone(); + if let Some(pubkey) = extra_agent { + if !agents.iter().any(|agent| agent == pubkey) { + agents.push(pubkey.to_owned()); + } + } + sync_agent_voice_assignments(huddle, &agents, &catalog.default_voice_key, &catalog.voices) +} + +fn require_active_huddle(huddle: &HuddleState) -> Result<(), String> { + matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) + .then_some(()) + .ok_or_else(|| "No active huddle".to_owned()) +} + +#[tauri::command] +pub fn ensure_huddle_agent_voice_settings( + app: AppHandle, + state: State<'_, AppState>, +) -> Result, String> { + let catalog = catalog(&app, &state)?; + let (changed, settings) = { + let mut huddle = state.huddle()?; + if !matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Ok(BTreeMap::new()); + } + let changed = ensure_with_catalog(&mut huddle, &catalog, None); + (changed, huddle.agent_voice_settings.clone()) + }; + if changed { + state.emit_huddle_state_changed(); + } + Ok(settings) +} + +#[tauri::command] +pub fn set_huddle_agent_tts_enabled( + agent_pubkey: String, + enabled: bool, + app: AppHandle, + state: State<'_, AppState>, +) -> Result { + let catalog = catalog(&app, &state)?; + let settings = { + let mut huddle = state.huddle()?; + require_active_huddle(&huddle)?; + ensure_with_catalog(&mut huddle, &catalog, Some(&agent_pubkey)); + let settings = huddle + .agent_voice_settings + .get_mut(&agent_pubkey) + .ok_or("Agent is not in the active huddle")?; + settings.enabled = enabled; + settings.clone() + }; + state.emit_huddle_state_changed(); + Ok(settings) +} + +#[tauri::command] +pub fn set_huddle_agent_voice( + agent_pubkey: String, + voice_key: String, + app: AppHandle, + state: State<'_, AppState>, +) -> Result { + let catalog = catalog(&app, &state)?; + if !catalog.voices.iter().any(|voice| voice.key == voice_key) { + return Err("The selected Pocket voice is not available on this device".to_owned()); + } + let settings = { + let mut huddle = state.huddle()?; + require_active_huddle(&huddle)?; + ensure_with_catalog(&mut huddle, &catalog, Some(&agent_pubkey)); + let settings = huddle + .agent_voice_settings + .get_mut(&agent_pubkey) + .ok_or("Agent is not in the active huddle")?; + settings.voice_key = voice_key; + settings.clone() + }; + state.emit_huddle_state_changed(); + Ok(settings) +} + +pub(crate) fn voice_reference_for_agent( + app: &AppHandle, + state: &AppState, + agent_pubkey: &str, +) -> Result, String> { + let catalog = catalog(app, state)?; + let (changed, settings) = { + let mut huddle = state.huddle()?; + require_active_huddle(&huddle)?; + let changed = ensure_with_catalog(&mut huddle, &catalog, Some(agent_pubkey)); + let settings = huddle.agent_voice_settings.get(agent_pubkey).cloned(); + (changed, settings) + }; + if changed { + state.emit_huddle_state_changed(); + } + let Some(settings) = settings else { + return Err("Agent is not in the active huddle".to_owned()); + }; + if !settings.enabled { + return Ok(None); + } + pocket_voice_reference(app, &[settings.voice_key]).map(Some) +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::huddle::tts_settings::bundled_voice_registry; + + #[test] + fn first_agent_uses_default_and_additional_agents_are_distinct() { + let agents = vec!["first".to_owned(), "second".to_owned(), "third".to_owned()]; + let mut huddle = HuddleState { + huddle_generation: 9, + ..HuddleState::default() + }; + + assert!(sync_agent_voice_assignments( + &mut huddle, + &agents, + "pocket:vera", + &bundled_voice_registry(), + )); + + assert_eq!( + huddle.agent_voice_settings["first"].voice_key, + "pocket:vera" + ); + let distinct: HashSet<_> = huddle + .agent_voice_settings + .values() + .map(|settings| settings.voice_key.as_str()) + .collect(); + assert_eq!(distinct.len(), 3); + } + + #[test] + fn explicit_session_choices_survive_roster_resync() { + let agents = vec!["first".to_owned(), "second".to_owned()]; + let voices = bundled_voice_registry(); + let mut huddle = HuddleState::default(); + sync_agent_voice_assignments(&mut huddle, &agents, "pocket:mary", &voices); + huddle + .agent_voice_settings + .get_mut("second") + .unwrap() + .enabled = false; + huddle + .agent_voice_settings + .get_mut("second") + .unwrap() + .voice_key = "pocket:jane".into(); + + assert!(!sync_agent_voice_assignments( + &mut huddle, + &agents, + "pocket:mary", + &voices, + )); + assert_eq!( + huddle.agent_voice_settings["second"], + AgentVoiceSettings { + enabled: false, + voice_key: "pocket:jane".into(), + } + ); + } +} diff --git a/desktop/src-tauri/src/huddle/agents.rs b/desktop/src-tauri/src/huddle/agents.rs index 2de22f99d8a..2bdf0544260 100644 --- a/desktop/src-tauri/src/huddle/agents.rs +++ b/desktop/src-tauri/src/huddle/agents.rs @@ -9,50 +9,40 @@ //! when it receives the kind:9000 membership notification. Huddle-specific //! env vars (interrupt mode, custom system prompt) are a post-MVP enhancement. +use std::collections::HashSet; + use serde::Serialize; +use tauri::State; use uuid::Uuid; use crate::{ - app_state::AppState, events, huddle::relay_api::fetch_channel_members_with_roles, + app_state::AppState, + events, + huddle::relay_api::{ + fetch_channel_members, fetch_channel_members_with_roles, validate_pubkey_hex, + MAX_HUDDLE_AGENTS, + }, relay::submit_event, }; +use super::{pipeline::start_auto_enabled_transcription, HuddlePhase}; + // ── Constants ───────────────────────────────────────────────────────────────── -/// Voice-mode guidelines posted as kind:48106 (huddle guidelines) to the -/// ephemeral channel at huddle start. Agents see them via EOSE replay. -/// Instructs agents on voice-mode etiquette: TTS constraints, brevity, -/// self-selection, and sentence-at-a-time delivery. -/// -/// Why sentence-at-a-time: the desktop speaks each agent message as it -/// arrives (queued, in order), so an agent that sends its first sentence -/// immediately — then the rest as separate messages — cuts time-to-first- -/// audio from "full reply generated" to "first sentence generated". This is -/// the prompt-level equivalent of token streaming, with no harness changes. +/// Voice-mode instructions posted as kind:48106 to the ephemeral channel at +/// huddle start. Agents load this event into the channel session system prompt. /// -/// Build voice-mode guidelines with the parent channel ID so agents know -/// where "the main channel" is. +/// Keep this deliberately short: the invariant that matters is that a directly +/// addressed user receives an immediate spoken response before any other work. pub fn voice_mode_guidelines(parent_channel_id: &str) -> String { format!( "\ -You are in a live voice huddle attached to channel {parent_channel_id}. -Your text is read aloud via TTS, message by message, in the order sent. - -Latency matters most: reply IMMEDIATELY — do not compose your full reply -before sending anything. The moment your first sentence is formed, send it -as its own `buzz messages send` tool call: it is what breaks the silence. -Then send each following sentence the same way — one sentence per separate -`buzz messages send` call. Never hold a finished sentence back to bundle it -with the next one. - -- If not addressed or relevant: do nothing. Do not respond. -- Keep the whole reply short — a few sentences at most. Start with the answer, no preamble. -- No markdown, code blocks, lists, or structured data — say it naturally. -- To share code or detailed data: say \"I'll post that in the main channel\" and do so. -- When you need a tool, say one short sentence first (e.g. \"Let me check.\"), then run it, then summarize the key finding verbally. -- If a new human message arrives mid-reply, you were interrupted: drop your unsent sentences and respond to the new message instead. -- In multi-agent huddles, identify yourself only when needed. -- Use your Buzz tools proactively when asked." +You are in a live voice huddle. Its attached main channel is {parent_channel_id}; that is not the live huddle channel. +The channel UUID in the current `[Context]` block is the live huddle channel. Only messages sent with `buzz messages send` to that current Context channel are spoken aloud, in the order sent; everything else you produce is silent. +When a user addresses you, your FIRST tool call must send a brief spoken reply to the current Context channel, before any file read, search, or other tool call. The usual rule against bare acknowledgments does not apply here; the pickup is the feedback that you heard them. +Then work, sending each useful sentence as its own message the moment it is ready—a few sentences per answer, not a monologue. +Speak plainly without markdown; post code or long detail to the attached main channel instead. +If you are not addressed, stay silent." ) } @@ -78,6 +68,21 @@ pub struct AgentAddResult { pub parent_error: Option, } +/// Result of reconciling channel agent additions into the active Huddle. +#[derive(Debug, Serialize)] +pub struct AgentHuddleSyncResult { + /// Whether `channel_id` belonged to the active Huddle. + pub matched_active_huddle: bool, + /// Agents newly enrolled in the Huddle's ephemeral channel. + pub added: Vec, +} + +// Multiple frontend mutation paths can observe the same membership addition +// (for example, the member hook and the mention send flow). Serialize native +// reconciliation so they share the first result instead of racing duplicate +// membership events through a relay read that has not caught up yet. +static AGENT_SYNC_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(()); + /// Add an agent to both the ephemeral and parent huddle channels. /// /// Returns `Err` only if the ephemeral-channel add fails (policy rejection or @@ -134,6 +139,156 @@ pub async fn add_agent_to_huddle( }) } +/// Reconcile explicitly added channel agents into the active Huddle. +/// +/// The source channel may be either the Huddle's parent or its ephemeral chat. +/// Existing ephemeral membership is hydrated first so a mention sent from the +/// Huddle chat does not publish a duplicate membership event. Missing agents +/// are added through the same parent + ephemeral path as the Add agent picker. +pub(crate) async fn sync_agents_for_active_huddle( + channel_id: &str, + agent_pubkeys: Vec, + state: &AppState, +) -> Result { + let mut seen = HashSet::new(); + let mut requested = Vec::new(); + for pubkey in agent_pubkeys { + let normalized = pubkey.to_ascii_lowercase(); + validate_pubkey_hex(&normalized)?; + if seen.insert(normalized.clone()) { + requested.push(normalized); + } + } + if requested.is_empty() { + return Ok(AgentHuddleSyncResult { + matched_active_huddle: false, + added: Vec::new(), + }); + } + let _sync_guard = AGENT_SYNC_LOCK.lock().await; + + let (ephemeral_channel_id, parent_channel_id, huddle_generation, state_agents) = { + let huddle = state.huddle()?; + if !matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Ok(AgentHuddleSyncResult { + matched_active_huddle: false, + added: Vec::new(), + }); + } + let ephemeral_channel_id = huddle + .ephemeral_channel_id + .clone() + .ok_or("no ephemeral channel")?; + let parent_channel_id = huddle + .parent_channel_id + .clone() + .ok_or("no parent channel")?; + if channel_id != ephemeral_channel_id && channel_id != parent_channel_id { + return Ok(AgentHuddleSyncResult { + matched_active_huddle: false, + added: Vec::new(), + }); + } + let state_agents = huddle + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clone(); + ( + ephemeral_channel_id, + parent_channel_id, + huddle.huddle_generation, + state_agents, + ) + }; + + // Membership reads can lag a just-accepted write, so merge the relay view + // with local state instead of allowing a stale snapshot to remove agents. + let fresh_agents = fetch_channel_members(&ephemeral_channel_id, Some("bot"), state) + .await + .unwrap_or_default(); + let mut known_agents = HashSet::new(); + let mut merged_agents = Vec::new(); + for pubkey in state_agents.into_iter().chain(fresh_agents) { + let normalized = pubkey.to_ascii_lowercase(); + if known_agents.insert(normalized.clone()) { + merged_agents.push(normalized); + } + } + let missing: Vec = requested + .into_iter() + .filter(|pubkey| !known_agents.contains(pubkey)) + .collect(); + if known_agents.len() + missing.len() > MAX_HUDDLE_AGENTS { + return Err(format!( + "agent limit reached: {} requested with {} already present (max {})", + missing.len(), + known_agents.len(), + MAX_HUDDLE_AGENTS + )); + } + + let ephemeral_uuid = Uuid::parse_str(&ephemeral_channel_id).map_err(|e| e.to_string())?; + let parent_uuid = Uuid::parse_str(&parent_channel_id).map_err(|e| e.to_string())?; + let mut added = Vec::new(); + for pubkey in missing { + add_agent_to_huddle(ephemeral_uuid, parent_uuid, &pubkey, state).await?; + merged_agents.push(pubkey.clone()); + added.push(pubkey); + } + + let (roster_changed, transcription_auto_enabled) = { + let mut huddle = state.huddle()?; + if !huddle.is_current_huddle(&ephemeral_channel_id, huddle_generation) { + return Ok(AgentHuddleSyncResult { + matched_active_huddle: true, + added, + }); + } + let mut roster_changed = false; + { + let mut current_agents = huddle + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()); + if *current_agents != merged_agents { + *current_agents = merged_agents.clone(); + roster_changed = true; + } + } + for pubkey in &merged_agents { + if !huddle.participants.contains(pubkey) { + huddle.participants.push(pubkey.clone()); + roster_changed = true; + } + } + ( + roster_changed, + huddle.maybe_auto_enable_transcription_for_agents(), + ) + }; + + if transcription_auto_enabled { + start_auto_enabled_transcription(state, &ephemeral_channel_id).await; + } else if roster_changed { + state.emit_huddle_state_changed(); + } + + Ok(AgentHuddleSyncResult { + matched_active_huddle: true, + added, + }) +} + +#[tauri::command] +pub async fn sync_agents_to_active_huddle( + channel_id: String, + agent_pubkeys: Vec, + state: State<'_, AppState>, +) -> Result { + sync_agents_for_active_huddle(&channel_id, agent_pubkeys, &state).await +} + fn contains_member(members: &[(String, Option)], pubkey: &str) -> bool { members .iter() @@ -142,7 +297,20 @@ fn contains_member(members: &[(String, Option)], pubkey: &str) -> bool { #[cfg(test)] mod tests { - use super::contains_member; + use super::{contains_member, voice_mode_guidelines}; + + #[test] + fn voice_mode_guidelines_pin_spoken_reply_as_first_tool_call() { + let guidelines = voice_mode_guidelines("parent-channel"); + assert_eq!(guidelines.lines().count(), 6); + assert!(guidelines.contains("Its attached main channel is parent-channel")); + assert!(guidelines.contains("that is not the live huddle channel")); + assert!(guidelines.contains("current `[Context]` block is the live huddle channel")); + assert!(guidelines.contains("buzz messages send` to that current Context channel")); + assert!(guidelines.contains("your FIRST tool call must send a brief spoken reply")); + assert!(guidelines.contains("before any file read, search, or other tool call")); + assert!(guidelines.contains("rule against bare acknowledgments does not apply here")); + } #[test] fn existing_parent_membership_is_preserved_regardless_of_role() { diff --git a/desktop/src-tauri/src/huddle/audio_output.rs b/desktop/src-tauri/src/huddle/audio_output.rs index 34dec53094b..383a7e8210a 100644 --- a/desktop/src-tauri/src/huddle/audio_output.rs +++ b/desktop/src-tauri/src/huddle/audio_output.rs @@ -97,3 +97,70 @@ pub(crate) fn open_output_sink_by_name( rodio::DeviceSinkBuilder::open_default_sink().map_err(|e| format!("audio output: {e}")) } + +fn device_type_is_isolated(device_type: rodio::cpal::DeviceType) -> bool { + use rodio::cpal::DeviceType; + matches!( + device_type, + DeviceType::Headphones + | DeviceType::Headset + | DeviceType::Earpiece + | DeviceType::HearingAid + ) +} + +/// Conservative route-isolation query using cpal's safe structured device +/// description. This is intentionally re-evaluated at confirmed local onset, +/// so a route change cannot leave a stale isolated capability behind. +pub(crate) fn output_route_is_isolated(preferred: Option<&str>) -> bool { + use rodio::cpal::traits::HostTrait; + use rodio::DeviceTrait; + + let host = rodio::cpal::default_host(); + let device = match preferred.filter(|name| !name.is_empty()) { + Some(name) => { + let Ok(devices) = host.output_devices() else { + return false; + }; + let mut matches = devices.filter(|device| { + device + .description() + .ok() + .map(|description| description.name().to_owned()) + == Some(name.to_owned()) + }); + let Some(device) = matches.next() else { + return false; + }; + if matches.next().is_some() { + return false; + } + device + } + None => match host.default_output_device() { + Some(device) => device, + None => return false, + }, + }; + + device + .description() + .is_ok_and(|description| device_type_is_isolated(description.device_type())) +} + +#[cfg(test)] +mod route_isolation_tests { + use super::device_type_is_isolated; + use rodio::cpal::DeviceType; + + #[test] + fn only_positive_isolated_terminal_types_are_accepted() { + assert!(device_type_is_isolated(DeviceType::Headphones)); + assert!(device_type_is_isolated(DeviceType::Headset)); + assert!(device_type_is_isolated(DeviceType::Earpiece)); + assert!(device_type_is_isolated(DeviceType::HearingAid)); + assert!(!device_type_is_isolated(DeviceType::Speaker)); + assert!(!device_type_is_isolated(DeviceType::Virtual)); + assert!(!device_type_is_isolated(DeviceType::Unknown)); + } +} diff --git a/desktop/src-tauri/src/huddle/commands.rs b/desktop/src-tauri/src/huddle/commands.rs new file mode 100644 index 00000000000..e4f25a93fcb --- /dev/null +++ b/desktop/src-tauri/src/huddle/commands.rs @@ -0,0 +1,216 @@ +//! Small Huddle controls that mutate an active session. + +use std::sync::{atomic::Ordering, Arc}; + +use tauri::State; +use uuid::Uuid; + +use crate::{app_state::AppState, events, relay::submit_event}; + +use super::pipeline::start_auto_enabled_transcription; +use super::relay_api::MAX_HUDDLE_AGENTS; +use super::{agents, relay_api::validate_pubkey_hex, HuddlePhase}; + +/// Update the clickable microphone control independently from the PTT shortcut. +#[tauri::command] +pub fn set_huddle_manual_mic_unmuted( + enabled: bool, + state: State<'_, AppState>, +) -> Result<(), String> { + let huddle = state.huddle()?; + if !matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Err("no active huddle".to_string()); + } + huddle.manual_mic_unmuted.store(enabled, Ordering::Release); + Ok(()) +} + +/// Immediately interrupt the agent utterance that is currently speaking. +#[tauri::command] +pub fn interrupt_huddle_speech( + agent_pubkey: String, + state: State<'_, AppState>, +) -> Result<(), String> { + validate_pubkey_hex(&agent_pubkey)?; + let tts_pipeline = { + let huddle = state.huddle()?; + if !matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Err("no active huddle".to_string()); + } + huddle.tts_pipeline.as_ref().map(Arc::clone) + }; + if let Some(tts_pipeline) = tts_pipeline { + tts_pipeline.cancel_active_speaker(&agent_pubkey); + } + Ok(()) +} + +/// Remove an agent from the active huddle without removing its parent-channel +/// membership. Keeping the parent membership intact means it remains available +/// to rejoin this huddle from the agent picker. +#[tauri::command] +pub async fn remove_agent_from_huddle( + agent_pubkey: String, + state: State<'_, AppState>, +) -> Result<(), String> { + validate_pubkey_hex(&agent_pubkey)?; + + let (ephemeral_channel_id, huddle_generation) = { + let huddle = state.huddle()?; + if !matches!(huddle.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Err("no active huddle".to_string()); + } + + let is_huddle_agent = huddle + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()) + .iter() + .any(|pubkey| pubkey.eq_ignore_ascii_case(&agent_pubkey)); + if !is_huddle_agent { + return Err("agent is not in this huddle".to_string()); + } + + ( + huddle + .ephemeral_channel_id + .clone() + .ok_or("no ephemeral channel")?, + huddle.huddle_generation, + ) + }; + + let ephemeral_channel_uuid = + Uuid::parse_str(&ephemeral_channel_id).map_err(|error| error.to_string())?; + submit_event( + events::build_remove_member(ephemeral_channel_uuid, &agent_pubkey)?, + &state, + ) + .await?; + + let (roster_changed, tts_pipeline) = { + let mut huddle = state.huddle()?; + if !huddle.is_current_huddle(&ephemeral_channel_id, huddle_generation) { + (false, None) + } else { + let mut agent_pubkeys = huddle + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()); + let initial_count = agent_pubkeys.len(); + agent_pubkeys.retain(|pubkey| !pubkey.eq_ignore_ascii_case(&agent_pubkey)); + let changed = agent_pubkeys.len() != initial_count; + drop(agent_pubkeys); + + if changed { + huddle + .participants + .retain(|pubkey| !pubkey.eq_ignore_ascii_case(&agent_pubkey)); + if let Some(settings_pubkey) = huddle + .agent_voice_settings + .keys() + .find(|pubkey| pubkey.eq_ignore_ascii_case(&agent_pubkey)) + .cloned() + { + huddle.agent_voice_settings.remove(&settings_pubkey); + } + } + let tts_pipeline = changed + .then_some(huddle.tts_pipeline.as_ref()) + .flatten() + .map(Arc::clone); + (changed, tts_pipeline) + } + }; + + if let Some(tts_pipeline) = tts_pipeline { + tts_pipeline.cancel_speaker(&agent_pubkey); + } + if roster_changed { + state.emit_huddle_state_changed(); + } + + Ok(()) +} + +/// Add an agent to the active huddle. +/// +/// Steps: +/// 1. Validates the huddle is in the Connected or Active phase. +/// 2. Adds the agent to both the ephemeral and parent channels (kind:9000). +/// 3. Only appends the agent pubkey to `agent_pubkeys` if the ephemeral add +/// succeeded — failed adds (policy rejection) are NOT p-tagged. +/// +/// Returns a structured `AgentAddResult` so the frontend can surface +/// parent-channel errors without treating them as hard failures. +/// +/// The running ACP process for this agent auto-subscribes when it receives +/// the kind:9000 membership notification — no separate process spawn needed. +#[tauri::command] +pub async fn add_agent_to_huddle( + agent_pubkey: String, + state: State<'_, AppState>, +) -> Result { + validate_pubkey_hex(&agent_pubkey)?; + + let (eph_id, parent_id, huddle_generation) = { + let hs = state.huddle()?; + if !matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active) { + return Err("no active huddle".to_string()); + } + + // Enforce agent cap on incremental adds too. + let current_agent_count = hs + .agent_pubkeys + .lock() + .unwrap_or_else(|e| e.into_inner()) + .len(); + if current_agent_count >= MAX_HUDDLE_AGENTS { + return Err(format!( + "agent limit reached: {} (max {})", + current_agent_count, MAX_HUDDLE_AGENTS + )); + } + + let eph = hs + .ephemeral_channel_id + .clone() + .ok_or("no ephemeral channel")?; + let parent = hs.parent_channel_id.clone().ok_or("no parent channel")?; + (eph, parent, hs.huddle_generation) + }; + + let eph_uuid = Uuid::parse_str(&eph_id).map_err(|e| e.to_string())?; + let parent_uuid = Uuid::parse_str(&parent_id).map_err(|e| e.to_string())?; + + // Returns Err only if the ephemeral add fails — parent failure is in the result. + let result = agents::add_agent_to_huddle(eph_uuid, parent_uuid, &agent_pubkey, &state).await?; + + // Ephemeral add succeeded — register it only if this is still the huddle + // that initiated the relay operation. + let transcription_auto_enabled = { + let mut hs = state.huddle()?; + if !hs.is_current_huddle(&eph_id, huddle_generation) { + return Ok(result); + } + let mut pubkeys = hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()); + if !pubkeys.contains(&agent_pubkey) { + pubkeys.push(agent_pubkey.clone()); + } + drop(pubkeys); + if !hs.participants.contains(&agent_pubkey) { + hs.participants.push(agent_pubkey.clone()); + } + hs.maybe_auto_enable_transcription_for_agents() + }; + + // No guidelines re-post needed — the agent sees the original kind:48106 + // guidelines via EOSE replay when it subscribes to the ephemeral channel. + if transcription_auto_enabled { + start_auto_enabled_transcription(&state, &eph_id).await; + } else { + state.emit_huddle_state_changed(); + } + + Ok(result) +} diff --git a/desktop/src-tauri/src/huddle/human_floor.rs b/desktop/src-tauri/src/huddle/human_floor.rs new file mode 100644 index 00000000000..1643880c42c --- /dev/null +++ b/desktop/src-tauri/src/huddle/human_floor.rs @@ -0,0 +1,73 @@ +//! Shared human-floor handle backed by the TTS playback coordinator. + +use std::sync::Arc; + +use super::tts_playback::{HumanFloorAuthorization, PlaybackCoordinator}; + +#[derive(Clone)] +pub(crate) struct HumanFloor { + playback: Arc, +} + +impl std::fmt::Debug for HumanFloor { + fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + formatter.debug_struct("HumanFloor").finish_non_exhaustive() + } +} + +impl Default for HumanFloor { + fn default() -> Self { + Self::new() + } +} + +impl HumanFloor { + pub(crate) fn new() -> Self { + Self { + playback: Arc::new(PlaybackCoordinator::unbound()), + } + } + + pub(super) fn playback(&self) -> Arc { + Arc::clone(&self.playback) + } + + #[cfg(test)] + pub(crate) fn is_blocked(&self) -> bool { + self.playback.human_floor_blocked() + } + + pub(crate) fn epoch(&self) -> u64 { + self.playback.human_floor_epoch() + } + + pub(super) fn authorization(&self, epoch: u64) -> HumanFloorAuthorization { + self.playback.human_floor_authorization(epoch) + } + + #[cfg(test)] + pub(crate) fn permits(&self, epoch: u64) -> bool { + self.authorization(epoch) == HumanFloorAuthorization::Permitted + } + + pub(crate) fn enter_local(&self, route_isolated: bool, sustained_coupled_speech: bool) -> bool { + self.playback + .enter_local_human_floor(route_isolated, sustained_coupled_speech) + } + + pub(crate) fn leave_local(&self) { + self.playback.leave_local_human_floor(); + } + + pub(crate) fn enter_remote(&self, peer: u8) { + self.playback.enter_remote_human_floor(peer); + } + + pub(crate) fn leave_remote(&self, peer: u8) { + self.playback.leave_remote_human_floor(peer); + } + + pub(crate) fn clear_remote(&self) { + self.playback.clear_remote_human_floor(); + } +} diff --git a/desktop/src-tauri/src/huddle/latency_bench.rs b/desktop/src-tauri/src/huddle/latency_bench.rs new file mode 100644 index 00000000000..f928ddbce0f --- /dev/null +++ b/desktop/src-tauri/src/huddle/latency_bench.rs @@ -0,0 +1,332 @@ +//! Ad-hoc baseline latency bench for the STT -> fake LLM -> TTS pipeline. +//! +//! Drives the REAL production machinery: +//! - `SttPipeline::new` (rubato 48k->16k, earshot VAD, 300 ms silence flush, +//! Parakeet TDT-CTC 110M int8 via sherpa-onnx, 1 thread) +//! - `TtsPipeline::new_with_voice` (warmup synth, chunker, synth_chunk, +//! rodio persistent Player, 20 ms lead-in) +//! +//! with a fake LLM in place of the relay/agent leg. +//! +//! Audio is fed in real-time 100 ms batches (mirroring the AudioWorklet +//! cadence) so VAD endpointing behaves exactly like production. +//! +//! Timestamps captured per turn: +//! t_speech_end last voiced sample delivered to push_audio (wall clock, +//! derived from the WAV's last voiced sample + feed pacing) +//! t_transcript text_rx yields the transcript +//! t_speak fake-LLM reply handed to TtsPipeline::speak +//! t_first_audio tts_active rising edge = first player.append accepted +//! +//! Run: +//! BUZZ_BENCH_WAV=<48k f32 mono wav> cargo test --release -p buzz-desktop \ +//! --lib huddle::latency_bench -- --ignored --nocapture + +use std::sync::{ + atomic::{AtomicBool, Ordering}, + Arc, +}; +use std::time::{Duration, Instant}; + +use super::stt::SttPipeline; +use super::tts::TtsPipeline; + +/// Read a mono 32-bit-float WAV (as produced by `afconvert -d LEF32@48000`). +/// Minimal parser: walks RIFF chunks, asserts fmt = IEEE float mono 48 kHz. +fn read_wav_f32_48k(path: &str) -> Vec { + let bytes = std::fs::read(path).expect("read wav"); + assert_eq!(&bytes[0..4], b"RIFF"); + assert_eq!(&bytes[8..12], b"WAVE"); + let mut pos = 12usize; + let mut fmt_ok = false; + let mut data: Option<(usize, usize)> = None; + while pos + 8 <= bytes.len() { + let id = &bytes[pos..pos + 4]; + let len = u32::from_le_bytes(bytes[pos + 4..pos + 8].try_into().unwrap()) as usize; + let body = pos + 8; + match id { + b"fmt " => { + let format = u16::from_le_bytes(bytes[body..body + 2].try_into().unwrap()); + let channels = u16::from_le_bytes(bytes[body + 2..body + 4].try_into().unwrap()); + let rate = u32::from_le_bytes(bytes[body + 4..body + 8].try_into().unwrap()); + let bits = u16::from_le_bytes(bytes[body + 14..body + 16].try_into().unwrap()); + assert_eq!(format, 3, "expected IEEE float wav"); + assert_eq!(channels, 1, "expected mono"); + assert_eq!(rate, 48_000, "expected 48 kHz"); + assert_eq!(bits, 32); + fmt_ok = true; + } + b"data" => data = Some((body, len)), + _ => {} + } + pos = body + len + (len & 1); + } + assert!(fmt_ok, "fmt chunk missing"); + let (off, len) = data.expect("data chunk missing"); + bytes[off..off + len] + .chunks_exact(4) + .map(|b| f32::from_le_bytes([b[0], b[1], b[2], b[3]])) + .collect() +} + +/// Index (in samples) one past the last sample whose |amplitude| exceeds the +/// threshold — "when the user stopped speaking" on the feed timeline. +fn last_voiced_sample(samples: &[f32], threshold: f32) -> usize { + samples + .iter() + .rposition(|s| s.abs() > threshold) + .map(|i| i + 1) + .unwrap_or(0) +} + +/// Poll a tokio mpsc receiver from sync context for up to `timeout`. +/// 1 ms poll keeps timestamp error negligible against ~100 ms scales. +fn tokio_recv_with_timeout( + rx: &mut tokio::sync::mpsc::Receiver, + timeout: Duration, +) -> Option { + let deadline = Instant::now() + timeout; + loop { + if let Ok(t) = rx.try_recv() { + return Some(t); + } + if Instant::now() >= deadline { + return None; + } + std::thread::sleep(Duration::from_millis(1)); + } +} + +struct TurnResult { + label: &'static str, + transcript: String, + stt_ms: f64, + llm_ms: f64, + tts_ms: f64, + e2e_ms: f64, +} + +#[test] +#[ignore = "ad-hoc latency baseline; needs models in ~/.buzz/models and an audio output device"] +fn baseline_stt_fake_llm_tts_first_audio() { + let home = dirs::home_dir().expect("home"); + let stt_dir = home.join(".buzz/models/parakeet-tdt-ctc-110m-en"); + let tts_dir = home.join(".buzz/models/pocket-tts"); + assert!( + stt_dir.join("model.int8.onnx").exists(), + "parakeet model missing" + ); + assert!(tts_dir.join("bundle.json").exists(), "pocket model missing"); + + let wav_path = std::env::var("BUZZ_BENCH_WAV").expect("set BUZZ_BENCH_WAV"); + let samples_48k = read_wav_f32_48k(&wav_path); + let speech_end_sample = last_voiced_sample(&samples_48k, 0.015); + let audio_dur_s = samples_48k.len() as f64 / 48_000.0; + let speech_end_s = speech_end_sample as f64 / 48_000.0; + eprintln!( + "bench: utterance {wav_path}: {audio_dur_s:.2} s total, speech ends at {speech_end_s:.2} s" + ); + + let llm_delay_ms: u64 = std::env::var("BUZZ_BENCH_LLM_MS") + .ok() + .and_then(|v| v.parse().ok()) + .unwrap_or(0); + + // ── Bring up the real pipelines, exactly as maybe_start_* do ──────────── + let tts_active = Arc::new(AtomicBool::new(false)); + let tts_cancel = Arc::new(AtomicBool::new(false)); + + let t = Instant::now(); + let tts = TtsPipeline::new_with_voice( + tts_dir, + Arc::clone(&tts_active), + Arc::clone(&tts_cancel), + super::human_floor::HumanFloor::new(), + "eve", + None, // default output device + None, // no Tauri app handle + ) + .expect("tts pipeline"); + eprintln!( + "bench: TTS pipeline ready (engine load + warmup + audio prime) in {:.0} ms", + t.elapsed().as_secs_f64() * 1e3 + ); + + let t = Instant::now(); + let (stt, mut text_rx) = SttPipeline::new( + stt_dir, + None, + None, + super::human_floor::HumanFloor::new(), + None, + ) + .expect("stt pipeline"); + // Recognizer loads inside the worker thread; give it time, then verify + // liveness via a first throwaway feed below. + std::thread::sleep(Duration::from_secs(2)); + assert!(!stt.is_finished(), "stt worker died during init"); + eprintln!( + "bench: STT pipeline spawned ({:.0} ms incl. settle sleep)", + t.elapsed().as_secs_f64() * 1e3 + ); + + // Fake LLM replies: short / medium / long, cycled across turns. + let replies: [(&'static str, &'static str); 3] = [ + ("reply_short", "Let me check."), + ("reply_medium", "Got it. The relay deploy finished about two minutes ago and all checks passed."), + ("reply_long", "Here's where things stand. The relay deploy finished cleanly and every health check is green. Two pods restarted during rollout, which is expected, and message latency is back to normal."), + ]; + let turns: usize = std::env::var("BUZZ_BENCH_TURNS") + .ok() + .and_then(|v| v.parse().ok()) + .unwrap_or(6); + + // 100 ms batches at 48 kHz, matching the AudioWorklet push cadence. + const BATCH: usize = 4_800; + let mut results: Vec = Vec::new(); + + let stt = Arc::new(stt); + for turn in 0..turns { + let (label, reply) = replies[turn % replies.len()]; + + // Feed the utterance in real time from a separate thread (the + // AudioWorklet role), then trailing silence so the 300 ms VAD flush + // fires. The main thread meanwhile timestamps transcript arrival — + // recv must NOT be serialized behind the silence feed, or the + // measurement floor becomes the feed loop instead of the STT path. + let feeder_stt = Arc::clone(&stt); + let feeder_samples = samples_48k.clone(); + let feed_start = Instant::now(); + let feeder = std::thread::spawn(move || { + let mut cursor = 0usize; + while cursor < feeder_samples.len() { + let end = (cursor + BATCH).min(feeder_samples.len()); + let bytes: Vec = feeder_samples[cursor..end] + .iter() + .flat_map(|s| s.to_le_bytes()) + .collect(); + feeder_stt.push_audio(bytes).expect("push"); + cursor = end; + // Pace to real time. + let target = feed_start + Duration::from_millis((cursor / 48) as u64); + let now = Instant::now(); + if target > now { + std::thread::sleep(target - now); + } + } + // Trailing silence: 1 s guarantees the 300 ms flush window closes. + let silence = vec![0u8; BATCH * 4]; + for _ in 0..10 { + feeder_stt + .push_audio(silence.clone()) + .expect("push silence"); + std::thread::sleep(Duration::from_millis(100)); + } + }); + let t_speech_end = feed_start + Duration::from_secs_f64(speech_end_s); + + // Transcript arrival. An utterance with an intra-sentence pause can + // VAD-split into multiple segments; keep the LAST one delivered so the + // turn aligns with the true end of speech. The extra "is another + // segment coming?" wait below is a HARNESS artifact (prod forwards + // every segment immediately) and is excluded from all timings. + let mut transcript = text_rx + .blocking_recv() + .expect("stt channel closed before transcript"); + let mut t_transcript = Instant::now(); + let mut segments = 1usize; + loop { + match text_rx.try_recv() { + Ok(t) => { + transcript = t; + t_transcript = Instant::now(); + segments += 1; + } + Err(_) => { + if feeder.is_finished() { + // Feed done (incl. 1 s trailing silence): any final + // segment has already flushed and decoded. One short + // grace poll covers a decode still in flight. + match tokio_recv_with_timeout(&mut text_rx, Duration::from_millis(500)) { + Some(t) => { + transcript = t; + t_transcript = Instant::now(); + segments += 1; + } + None => break, + } + } else { + // Feeder still delivering audio — a later segment may + // arrive any time until the feed (plus flush window) + // completes. Keep waiting; do NOT break early or the + // tail segment leaks into the next turn. + if let Some(t) = + tokio_recv_with_timeout(&mut text_rx, Duration::from_millis(100)) + { + transcript = t; + t_transcript = Instant::now(); + segments += 1; + } + } + } + } + } + feeder.join().expect("feeder"); + + // Fake LLM. Applied AFTER the harness-only segment wait; llm_ms is the + // configured delay, so the harness wait never leaks into any timing. + if llm_delay_ms > 0 { + std::thread::sleep(Duration::from_millis(llm_delay_ms)); + } + let t_speak = Instant::now(); + tts.speak(reply.to_string()).expect("speak"); + + // First audio: tts_active rising edge == first accepted player append. + let deadline = Instant::now() + Duration::from_secs(30); + while !tts_active.load(Ordering::Acquire) { + assert!(Instant::now() < deadline, "no first audio within 30 s"); + std::thread::sleep(Duration::from_micros(500)); + } + let t_first_audio = Instant::now(); + + let stt_ms = (t_transcript - t_speech_end).as_secs_f64() * 1e3; + // llm_ms is exactly the configured fake-LLM delay; tts is measured + // from speak() to first accepted append. e2e composes the three real + // legs so the harness-only segment wait (between t_transcript and the + // fake-LLM sleep) never inflates the pipeline number. + let llm_ms = llm_delay_ms as f64; + let tts_ms = (t_first_audio - t_speak).as_secs_f64() * 1e3; + let e2e_ms = stt_ms + llm_ms + tts_ms; + eprintln!( + "bench turn {turn} [{label}]: stt={stt_ms:.0}ms llm={llm_ms:.0}ms tts_first_audio={tts_ms:.0}ms e2e={e2e_ms:.0}ms segments={segments} transcript={transcript:?}" + ); + results.push(TurnResult { + label, + transcript, + stt_ms, + llm_ms, + tts_ms, + e2e_ms, + }); + + // Wait for playback to drain + prod cooldown before the next turn. + while tts_active.load(Ordering::Acquire) { + std::thread::sleep(Duration::from_millis(20)); + } + std::thread::sleep(Duration::from_millis(500)); + } + + // Summary JSON for the write-up. + println!("["); + for (i, r) in results.iter().enumerate() { + let comma = if i + 1 < results.len() { "," } else { "" }; + println!( + " {{\"turn\":{i},\"label\":\"{}\",\"stt_ms\":{:.1},\"llm_ms\":{:.1},\"tts_first_audio_ms\":{:.1},\"e2e_ms\":{:.1},\"transcript\":{:?}}}{comma}", + r.label, r.stt_ms, r.llm_ms, r.tts_ms, r.e2e_ms, r.transcript + ); + } + println!("]"); + + stt.shutdown(); + tts.shutdown(); +} diff --git a/desktop/src-tauri/src/huddle/local_barge_in.rs b/desktop/src-tauri/src/huddle/local_barge_in.rs new file mode 100644 index 00000000000..ac57c685ad6 --- /dev/null +++ b/desktop/src-tauri/src/huddle/local_barge_in.rs @@ -0,0 +1,151 @@ +//! Local VAD barge-in policy and coupled-output debounce. + +use super::human_floor::HumanFloor; + +/// Whether local audio should use VAD barge-in for this frame. +/// +/// This currently matches STT's `vad_flush_allowed`, but the two decisions are +/// kept separate deliberately: one assigns cancellation ownership and the +/// other controls utterance endpointing. +pub(super) fn enabled(ptt_mode: bool, manually_open: bool, ptt_held: bool) -> bool { + !ptt_mode || (manually_open && !ptt_held) +} + +/// Consecutive 16 ms VAD-positive frames required to restore local barge-in +/// on acoustically coupled output. The prior implementation shipped 20 frames +/// after 5 frames caused speaker-bleed self-cancellation (`b29c8cdaa^`). +const COUPLED_BARGE_IN_FRAMES: usize = 20; + +#[derive(Debug, Default)] +pub(super) struct LocalBargeIn { + acquired_floor: bool, + coupled_positive_frames: usize, +} + +impl LocalBargeIn { + pub(super) fn observe( + &mut self, + probability: f32, + confirmed_onset: bool, + human_floor: &HumanFloor, + output_device: Option<&str>, + onset_threshold: f32, + ) { + if self.acquired_floor { + return; + } + let sustained_coupled = self.track_sustained_coupled(probability, onset_threshold); + if !confirmed_onset && !sustained_coupled { + return; + } + let route_isolated = super::audio_output::output_route_is_isolated(output_device); + self.acquire(human_floor, route_isolated, sustained_coupled); + } + + pub(super) fn acquire( + &mut self, + human_floor: &HumanFloor, + route_isolated: bool, + sustained_coupled: bool, + ) { + self.acquired_floor = human_floor.enter_local(route_isolated, sustained_coupled); + } + + fn track_sustained_coupled(&mut self, probability: f32, onset_threshold: f32) -> bool { + if probability > onset_threshold { + self.coupled_positive_frames = self.coupled_positive_frames.saturating_add(1); + } else { + self.coupled_positive_frames = 0; + } + self.coupled_positive_frames >= COUPLED_BARGE_IN_FRAMES + } + + pub(super) fn release(&mut self, human_floor: &HumanFloor) { + if self.acquired_floor { + human_floor.leave_local(); + } + *self = Self::default(); + } +} + +#[derive(Debug)] +pub(super) struct WorkerLocalBargeIn { + state: LocalBargeIn, + human_floor: HumanFloor, +} + +impl WorkerLocalBargeIn { + pub(super) fn new(human_floor: HumanFloor) -> Self { + Self { + state: LocalBargeIn::default(), + human_floor, + } + } +} + +impl std::ops::Deref for WorkerLocalBargeIn { + type Target = LocalBargeIn; + + fn deref(&self) -> &Self::Target { + &self.state + } +} + +impl std::ops::DerefMut for WorkerLocalBargeIn { + fn deref_mut(&mut self) -> &mut Self::Target { + &mut self.state + } +} + +impl Drop for WorkerLocalBargeIn { + fn drop(&mut self) { + self.state.release(&self.human_floor); + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn manual_open_mic_enables_vad_barge_in_in_ptt_mode() { + assert!(enabled(true, true, false)); + assert!(!enabled(true, false, false)); + assert!(!enabled(true, true, true)); + assert!(enabled(false, false, false)); + } + + #[test] + fn manual_open_ptt_sustained_speech_acquires_coupled_floor() { + assert!(enabled(true, true, false)); + let human_floor = HumanFloor::new(); + let mut barge_in = LocalBargeIn::default(); + for _ in 0..COUPLED_BARGE_IN_FRAMES { + let sustained = barge_in.track_sustained_coupled(0.9, 0.5); + if sustained { + barge_in.acquire(&human_floor, false, true); + } + } + assert!(barge_in.acquired_floor); + assert!(human_floor.is_blocked()); + } + + #[test] + fn coupled_barge_in_requires_twenty_consecutive_positive_frames() { + let mut barge_in = LocalBargeIn::default(); + for _ in 0..COUPLED_BARGE_IN_FRAMES - 1 { + assert!(!barge_in.track_sustained_coupled(0.9, 0.5)); + } + assert!(barge_in.track_sustained_coupled(0.9, 0.5)); + } + + #[test] + fn coupled_barge_in_debounce_resets_on_a_non_speech_frame() { + let mut barge_in = LocalBargeIn::default(); + for _ in 0..COUPLED_BARGE_IN_FRAMES - 1 { + assert!(!barge_in.track_sustained_coupled(0.9, 0.5)); + } + assert!(!barge_in.track_sustained_coupled(0.1, 0.5)); + assert!(!barge_in.track_sustained_coupled(0.9, 0.5)); + } +} diff --git a/desktop/src-tauri/src/huddle/mod.rs b/desktop/src-tauri/src/huddle/mod.rs index 03264f80f4c..e219b2f75fa 100644 --- a/desktop/src-tauri/src/huddle/mod.rs +++ b/desktop/src-tauri/src/huddle/mod.rs @@ -23,10 +23,17 @@ //! takes `stt_pipeline`/`tts_pipeline` out of the lock, then calls `shutdown()` //! and drops them outside the lock (thread joins can block ~200ms). +mod agent_tts_publisher; mod agent_tts_routing; +pub mod agent_voice; pub mod agents; pub mod audio_output; +mod commands; +mod human_floor; pub mod jitter; +#[cfg(test)] +mod latency_bench; +mod local_barge_in; pub mod models; pub mod pipeline; pub mod playout; @@ -38,9 +45,12 @@ pub mod state; pub mod stt; pub mod transcription; pub mod tts; +#[path = "tts_playback.rs"] +mod tts_playback; pub mod tts_settings; mod tts_voice_import; mod tts_voice_registry; +mod window; pub mod wire; // ── Shared utilities ────────────────────────────────────────────────────────── @@ -65,13 +75,18 @@ pub(super) fn drain_until_shutdown( // ── Re-exports ──────────────────────────────────────────────────────────────── +pub use commands::{ + add_agent_to_huddle, interrupt_huddle_speech, remove_agent_from_huddle, + set_huddle_manual_mic_unmuted, +}; pub use state::{HuddleJoinInfo, HuddlePhase, HuddleState, VoiceInputMode}; pub use transcription::{set_huddle_transcription_enabled, start_stt_pipeline}; pub use tts_settings::set_tts_enabled; +pub use window::{close_huddle_companion, open_huddle_window}; // ── Imports ─────────────────────────────────────────────────────────────────── -use std::sync::atomic::Ordering; +use std::sync::{atomic::Ordering, Arc}; use tauri::State; use uuid::Uuid; @@ -84,12 +99,13 @@ use agent_tts_routing::{ pub use pipeline::check_pipeline_hotstart; use pipeline::{ await_inflight_tts_start, maybe_start_stt_pipeline, maybe_start_tts_pipeline, - post_connect_setup, start_auto_enabled_transcription, PostConnectOutcome, + post_connect_setup, PostConnectOutcome, }; use relay_api::{ count_human_members, fetch_channel_members, parse_channel_uuid, validate_pubkey_hex, MAX_HUDDLE_AGENTS, }; +use window::close_huddle_window; fn normalize_huddle_channel_name(candidate: Option, fallback: &str) -> String { let normalized = candidate @@ -175,6 +191,7 @@ pub async fn start_huddle( parent_channel_id: String, member_pubkeys: Vec, channel_name: Option, + app: tauri::AppHandle, state: State<'_, AppState>, ) -> Result { // Validate inputs at the Tauri boundary. @@ -198,6 +215,15 @@ pub async fn start_huddle( deduped }; + // Allocate the backing channel ID before the relay work starts. Publishing + // it with the Creating state lets the main webview open an immediate + // companion window while the channel and audio session are being prepared. + let ephemeral_uuid = Uuid::new_v4(); + let ephemeral_channel_id = ephemeral_uuid.to_string(); + let short_id = &ephemeral_channel_id[..8]; + let fallback_channel_name = format!("huddle-{short_id}"); + let channel_name = normalize_huddle_channel_name(channel_name, &fallback_channel_name); + // Transition to Creating. let huddle_generation = { let mut hs = state.huddle()?; @@ -210,20 +236,16 @@ pub async fn start_huddle( let generation = hs.begin_huddle_lifetime(); hs.phase = HuddlePhase::Creating; hs.parent_channel_id = Some(parent_channel_id.clone()); + hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); generation }; - - let ephemeral_uuid = Uuid::new_v4(); - let ephemeral_channel_id = ephemeral_uuid.to_string(); - let short_id = &ephemeral_channel_id[..8]; - let fallback_channel_name = format!("huddle-{short_id}"); - let channel_name = normalize_huddle_channel_name(channel_name, &fallback_channel_name); + state.emit_huddle_state_changed(); // All steps wrapped so we can roll back on ANY failure, including step 1. // channel_was_created tracks whether we need to archive on rollback. let mut channel_was_created = false; - let result: Result, String> = async { + let result: Result<(Vec, String), String> = async { // 1. Create ephemeral channel. let create_builder = events::build_create_channel( ephemeral_uuid, @@ -265,14 +287,14 @@ pub async fn start_huddle( // 4. Emit HUDDLE_STARTED to parent channel. let started_builder = events::build_huddle_started(&parent_channel_id, &ephemeral_channel_id)?; - submit_event(started_builder, &state).await?; + let started_event = submit_event(started_builder, &state).await?; - Ok(successful_agents) + Ok((successful_agents, started_event.event_id)) } .await; match result { - Ok(successful_agents) => { + Ok((successful_agents, huddle_thread_event_id)) => { // 5. Store active state. let committed = { let mut hs = state.huddle()?; @@ -282,6 +304,7 @@ pub async fn start_huddle( hs.phase = HuddlePhase::Connected; hs.is_creator = true; hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); + hs.huddle_thread_event_id = Some(huddle_thread_event_id); *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = successful_agents.clone(); hs.maybe_auto_enable_transcription_for_agents(); @@ -300,6 +323,7 @@ pub async fn start_huddle( }; if !committed { emit_end_and_archive(&parent_channel_id, &ephemeral_channel_id, &state).await; + close_huddle_window(&app, &ephemeral_channel_id); return Err("huddle start was superseded".to_owned()); } @@ -311,6 +335,7 @@ pub async fn start_huddle( match post_connect_setup(&state, &ephemeral_channel_id, huddle_generation).await { Ok(PostConnectOutcome::Ready) => {} Ok(PostConnectOutcome::Stale) => { + close_huddle_window(&app, &ephemeral_channel_id); return Err("huddle start was superseded".to_owned()); } Err(e) => { @@ -330,6 +355,7 @@ pub async fn start_huddle( } state.emit_huddle_state_changed(); } + close_huddle_window(&app, &ephemeral_channel_id); return Err(e); } } @@ -350,10 +376,19 @@ pub async fn start_huddle( } } // Reset only if this failed attempt still owns the Creating state. - if let Ok(mut hs) = state.huddle_state.lock() { + let reset = if let Ok(mut hs) = state.huddle_state.lock() { if hs.owns_huddle_lifetime(huddle_generation, HuddlePhase::Creating) { hs.reset_preserving_generation(); + true + } else { + false } + } else { + false + }; + if reset { + state.emit_huddle_state_changed(); + close_huddle_window(&app, &ephemeral_channel_id); } Err(e) } @@ -372,6 +407,7 @@ pub async fn start_huddle( pub async fn join_huddle( parent_channel_id: String, ephemeral_channel_id: String, + huddle_thread_event_id: Option, state: State<'_, AppState>, ) -> Result { // Transition to Connecting. @@ -387,6 +423,7 @@ pub async fn join_huddle( hs.phase = HuddlePhase::Connecting; hs.parent_channel_id = Some(parent_channel_id.clone()); hs.ephemeral_channel_id = Some(ephemeral_channel_id.clone()); + hs.huddle_thread_event_id = huddle_thread_event_id; generation }; @@ -457,7 +494,7 @@ fn teardown_huddle(state: &AppState) -> Result<(), String> { // Increment generation first — this immediately invalidates any // in-flight transcription task, even before pipelines shut down. hs.session_generation.fetch_add(1, Ordering::Release); - let stt = hs.stt_pipeline.take(); + let stt = hs.take_stt_pipeline(); let tts = hs.tts_pipeline.take(); let cancel = hs.audio_ws_cancel.take(); // Cancel the relay token BEFORE dropping the sender. If we drop @@ -557,7 +594,7 @@ async fn remove_huddle_agents(ephemeral_channel_id: &str, state: &AppState) { /// /// The relay emits kind:48102 (participant left) when the audio WS disconnects. #[tauri::command] -pub async fn leave_huddle(state: State<'_, AppState>) -> Result<(), String> { +pub async fn leave_huddle(app: tauri::AppHandle, state: State<'_, AppState>) -> Result<(), String> { let (parent_channel_id, ephemeral_channel_id) = { let mut hs = state.huddle()?; if hs.phase == HuddlePhase::Idle { @@ -606,6 +643,7 @@ pub async fn leave_huddle(state: State<'_, AppState>) -> Result<(), String> { } teardown_huddle(&state)?; + close_huddle_window(&app, &ephemeral_channel_id); Ok(()) } @@ -618,7 +656,11 @@ pub async fn leave_huddle(state: State<'_, AppState>) -> Result<(), String> { /// 3. Shut down the STT pipeline (Fix 5). /// 4. Clear local huddle state. #[tauri::command] -pub async fn end_huddle(force: Option, state: State<'_, AppState>) -> Result<(), String> { +pub async fn end_huddle( + force: Option, + app: tauri::AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { let (parent_channel_id, ephemeral_channel_id) = { let mut hs = state.huddle()?; if hs.phase == HuddlePhase::Idle { @@ -641,6 +683,7 @@ pub async fn end_huddle(force: Option, state: State<'_, AppState>) -> Resu emit_end_and_archive(&parent_channel_id, &ephemeral_channel_id, &state).await; teardown_huddle(&state)?; + close_huddle_window(&app, &ephemeral_channel_id); Ok(()) } @@ -767,6 +810,8 @@ pub fn get_model_status(_state: State<'_, AppState>) -> Result, ) -> Result<(), String> { eprintln!("buzz-desktop: tts stage=invoke status=started route_id={route_id}"); @@ -774,6 +819,22 @@ pub async fn speak_agent_message( // Use char count (not byte length) to avoid panicking on multi-byte UTF-8. let text = normalize_agent_tts_text(text); + if !state.huddle()?.tts_enabled { + eprintln!( + "buzz-desktop: tts stage=invoke status=no_op reason=disabled route_id={route_id}" + ); + return Ok(()); + } + + let Some(voice_reference) = + agent_voice::voice_reference_for_agent(&app, &state, &speaker_pubkey)? + else { + eprintln!( + "buzz-desktop: tts stage=invoke status=no_op reason=agent_disabled route_id={route_id}" + ); + return Ok(()); + }; + let needs_pipeline = { let mut hs = state.huddle()?; if hs @@ -817,21 +878,50 @@ pub async fn speak_agent_message( })?; } - let sender = { + let pipeline = { let hs = state.huddle()?; - hs.tts_pipeline - .as_ref() - .map(|pipeline| pipeline.text_sender()) + let agent_is_present = hs + .agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()) + .iter() + .any(|pubkey| pubkey.eq_ignore_ascii_case(&speaker_pubkey)); + if !agent_is_present { + eprintln!( + "buzz-desktop: tts stage=queue status=dropped reason=speaker_removed route_id={route_id}" + ); + return Ok(()); + } + hs.tts_pipeline.as_ref().map(Arc::clone) }; - let Some(sender) = sender else { + let Some(pipeline) = pipeline else { eprintln!( "buzz-desktop: tts stage=invoke status=failed reason=unavailable route_id={route_id}" ); return Err("Agent text to speech is enabled but its audio pipeline is unavailable".into()); }; + match agent_tts_publisher::ensure(&app, &state, &pipeline, &speaker_pubkey).await { + Ok(true) => eprintln!( + "buzz-desktop: tts broadcast status=ready route_id={route_id}" + ), + Ok(false) => eprintln!( + "buzz-desktop: tts broadcast status=unavailable reason=agent_identity_not_local route_id={route_id}" + ), + Err(error) => eprintln!( + "buzz-desktop: tts broadcast status=unavailable reason=publisher_setup_failed route_id={route_id} error={error}" + ), + } + let sender = pipeline.text_sender(); + let speaker_generation = sender.speaker_generation(&speaker_pubkey); enqueue_agent_tts_text(route_id, text, move |route_id, text| { sender - .send(route_id, text) + .send( + route_id, + speaker_pubkey, + speaker_generation, + voice_reference, + text, + ) .map_err(|error| format!("TTS queue closed while waiting to enqueue: {error}")) }) .await @@ -840,85 +930,3 @@ pub async fn speak_agent_message( eprintln!("buzz-desktop: tts stage=queue status=failed reason=closed route_id={route_id}") }) } - -/// Add an agent to the active huddle. -/// -/// Steps: -/// 1. Validates the huddle is in the Connected or Active phase. -/// 2. Adds the agent to both the ephemeral and parent channels (kind:9000). -/// 3. Only appends the agent pubkey to `agent_pubkeys` if the ephemeral add -/// succeeded — failed adds (policy rejection) are NOT p-tagged. -/// -/// Returns a structured `AgentAddResult` so the frontend can surface -/// parent-channel errors without treating them as hard failures. -/// -/// The running ACP process for this agent auto-subscribes when it receives -/// the kind:9000 membership notification — no separate process spawn needed. -#[tauri::command] -pub async fn add_agent_to_huddle( - agent_pubkey: String, - state: State<'_, AppState>, -) -> Result { - validate_pubkey_hex(&agent_pubkey)?; - - let (eph_id, parent_id, huddle_generation) = { - let hs = state.huddle()?; - if !matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active) { - return Err("no active huddle".to_string()); - } - - // Enforce agent cap on incremental adds too. - let current_agent_count = hs - .agent_pubkeys - .lock() - .unwrap_or_else(|e| e.into_inner()) - .len(); - if current_agent_count >= MAX_HUDDLE_AGENTS { - return Err(format!( - "agent limit reached: {} (max {})", - current_agent_count, MAX_HUDDLE_AGENTS - )); - } - - let eph = hs - .ephemeral_channel_id - .clone() - .ok_or("no ephemeral channel")?; - let parent = hs.parent_channel_id.clone().ok_or("no parent channel")?; - (eph, parent, hs.huddle_generation) - }; - - let eph_uuid = Uuid::parse_str(&eph_id).map_err(|e| e.to_string())?; - let parent_uuid = Uuid::parse_str(&parent_id).map_err(|e| e.to_string())?; - - // Returns Err only if the ephemeral add fails — parent failure is in the result. - let result = agents::add_agent_to_huddle(eph_uuid, parent_uuid, &agent_pubkey, &state).await?; - - // Ephemeral add succeeded — register it only if this is still the huddle - // that initiated the relay operation. - let transcription_auto_enabled = { - let mut hs = state.huddle()?; - if !hs.is_current_huddle(&eph_id, huddle_generation) { - return Ok(result); - } - let mut pubkeys = hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()); - if !pubkeys.contains(&agent_pubkey) { - pubkeys.push(agent_pubkey.clone()); - } - drop(pubkeys); - if !hs.participants.contains(&agent_pubkey) { - hs.participants.push(agent_pubkey.clone()); - } - hs.maybe_auto_enable_transcription_for_agents() - }; - - // No guidelines re-post needed — the agent sees the original kind:48106 - // guidelines via EOSE replay when it subscribes to the ephemeral channel. - if transcription_auto_enabled { - start_auto_enabled_transcription(&state, &eph_id).await; - } else { - state.emit_huddle_state_changed(); - } - - Ok(result) -} diff --git a/desktop/src-tauri/src/huddle/pipeline.rs b/desktop/src-tauri/src/huddle/pipeline.rs index fba5464a69f..47d4aeb43d1 100644 --- a/desktop/src-tauri/src/huddle/pipeline.rs +++ b/desktop/src-tauri/src/huddle/pipeline.rs @@ -55,7 +55,7 @@ pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), S let mut hs = state.huddle()?; if let Some(ref p) = hs.stt_pipeline { if p.is_finished() { - hs.stt_pipeline = None; + hs.take_stt_pipeline(); } } if let Some(ref p) = hs.tts_pipeline { @@ -82,7 +82,7 @@ pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), S .map(|m| m.take_tts_ready()) .unwrap_or(false); - // Start TTS first (so STT can capture tts_cancel). + // Start TTS first so STT can observe its active-playback gate. if !has_tts && (tts_ready || models::is_tts_ready()) { if let Err(e) = maybe_start_tts_pipeline(&state).await { eprintln!("buzz-desktop: TTS hotstart failed: {e}"); @@ -130,25 +130,45 @@ pub async fn check_pipeline_hotstart(state: State<'_, AppState>) -> Result<(), S .await .ok(); let fresh_members = fetch_channel_members(eph_id, None, &state).await.ok(); - let transcription_auto_enabled = if fresh_agents.is_some() || fresh_members.is_some() { - let mut hs = state.huddle()?; - if !hs.is_current_huddle(eph_id, huddle_generation) { - return Ok(()); - } - if let Some(agents) = fresh_agents { - *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; - } - if let Some(members) = fresh_members { - hs.participants = members; - } - hs.last_agent_refresh = Some(std::time::Instant::now()); - hs.maybe_auto_enable_transcription_for_agents() - } else { - false - }; + let (roster_changed, transcription_auto_enabled) = + if fresh_agents.is_some() || fresh_members.is_some() { + let mut hs = state.huddle()?; + if !hs.is_current_huddle(eph_id, huddle_generation) { + return Ok(()); + } + let mut roster_changed = false; + if let Some(agents) = fresh_agents { + let mut current_agents = + hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()); + if *current_agents != agents { + *current_agents = agents; + roster_changed = true; + } + } + if let Some(members) = fresh_members { + if hs.participants != members { + hs.participants = members; + roster_changed = true; + } + } + hs.last_agent_refresh = Some(std::time::Instant::now()); + ( + roster_changed, + hs.maybe_auto_enable_transcription_for_agents(), + ) + } else { + (false, false) + }; if transcription_auto_enabled { start_auto_enabled_transcription(&state, eph_id).await; } + // Audio authentication auto-adds a joining human to the ephemeral + // channel. Emit whenever that authoritative roster changes so the + // desktop participant strip updates immediately instead of waiting + // for its slow fallback IPC read. + if roster_changed || transcription_auto_enabled { + state.emit_huddle_state_changed(); + } } } @@ -173,23 +193,32 @@ pub(crate) async fn post_connect_setup( fetch_channel_members(ephemeral_channel_id, Some("bot"), state), fetch_channel_members(ephemeral_channel_id, None, state), ); - let transcription_auto_enabled = { + let (roster_changed, transcription_auto_enabled) = { let mut hs = state.huddle()?; if !hs.is_current_huddle(ephemeral_channel_id, huddle_generation) { return Ok(PostConnectOutcome::Stale); } + let mut roster_changed = false; if let Ok(agents) = agents_result { - *hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()) = agents; + let mut current_agents = hs.agent_pubkeys.lock().unwrap_or_else(|e| e.into_inner()); + if *current_agents != agents { + *current_agents = agents; + roster_changed = true; + } } if let Ok(all_members) = all_members_result { - if !all_members.is_empty() { + if !all_members.is_empty() && hs.participants != all_members { hs.participants = all_members; + roster_changed = true; } } - hs.maybe_auto_enable_transcription_for_agents() + ( + roster_changed, + hs.maybe_auto_enable_transcription_for_agents(), + ) }; - if transcription_auto_enabled { + if roster_changed || transcription_auto_enabled { state.emit_huddle_state_changed(); } @@ -248,10 +277,6 @@ pub(crate) async fn post_connect_setup( /// /// Returns `Ok(true)` if the pipeline was started, `Ok(false)` if models are /// not ready (voice-only mode), or `Err` on a real failure. -/// -/// Creates the shared `tts_active` flag and passes it to the STT pipeline -/// for barge-in / echo gating. The same flag is later passed to the TTS -/// pipeline so it can signal when audio is playing. pub(crate) async fn maybe_start_stt_pipeline( state: &AppState, ephemeral_channel_id: &str, @@ -280,13 +305,14 @@ pub(crate) async fn maybe_start_stt_pipeline( // Take the old pipeline OUT of the lock before dropping — Drop joins // the worker thread (~200ms) and must not block under the mutex. let ( - tts_active, - tts_cancel, agent_pubkeys_arc, session_gen, expected_generation, stt_starting, ptt_active_for_stt, + manual_mic_unmuted_for_stt, + human_floor, + output_device, old_stt, ) = { let mut hs = state.huddle()?; @@ -301,7 +327,7 @@ pub(crate) async fn maybe_start_stt_pipeline( if hs.stt_pipeline.is_some() { hs.session_generation.fetch_add(1, Ordering::Release); } - let old = hs.stt_pipeline.take(); + let old = hs.take_stt_pipeline(); if let Some(ref p) = old { p.shutdown(); } @@ -310,14 +336,25 @@ pub(crate) async fn maybe_start_stt_pipeline( } else { None }; + let manual_mic_unmuted = if hs.voice_input_mode == VoiceInputMode::PushToTalk { + Some(Arc::clone(&hs.manual_mic_unmuted)) + } else { + None + }; ( - Arc::clone(&hs.tts_active), - Some(Arc::clone(&hs.tts_cancel)), Arc::clone(&hs.agent_pubkeys), Arc::clone(&hs.session_generation), hs.session_generation.load(Ordering::Acquire), stt_starting, ptt, + manual_mic_unmuted, + hs.human_floor.clone(), + state + .huddle_audio + .output_device + .lock() + .unwrap_or_else(|e| e.into_inner()) + .clone(), old, ) }; @@ -325,7 +362,13 @@ pub(crate) async fn maybe_start_stt_pipeline( drop(old_stt); let constructed = tokio::task::spawn_blocking(move || { - stt::SttPipeline::new(model_dir, tts_active, tts_cancel, ptt_active_for_stt) + stt::SttPipeline::new( + model_dir, + ptt_active_for_stt, + manual_mic_unmuted_for_stt, + human_floor, + output_device, + ) }) .await; let (pipeline, text_rx) = match constructed { @@ -354,7 +397,7 @@ pub(crate) async fn maybe_start_stt_pipeline( { return Ok(false); } - hs.stt_pipeline = Some(Arc::clone(&pipeline)); + hs.set_stt_pipeline(Arc::clone(&pipeline)); } spawn_transcription_task(text_rx, channel_uuid, agent_pubkeys_arc, session_gen, state); @@ -421,15 +464,15 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result super::tts_settings::pocket_voice_reference(&app, &voice_preferences)?, + let initial_voice = match app.as_ref() { + Some(app) => super::tts_settings::pocket_voice_reference(app, &voice_preferences)?, None => super::tts_settings::bundled_pocket_voice_reference(&voice_preferences), }; // Atomically check preconditions and claim the construction slot. // The sentinel prevents a second caller from starting construction // while we're building outside the lock. - let (tts_active, tts_cancel, tts_starting) = { + let (tts_active, tts_cancel, human_floor, tts_starting) = { let hs = state.huddle()?; if hs.tts_pipeline.is_some() { return Ok(false); @@ -443,6 +486,7 @@ pub(crate) async fn maybe_start_tts_pipeline(state: &AppState) -> Result Result = agent_pubkeys.iter().map(|s| s.as_str()).collect(); - let builder = - match events::build_message(channel_uuid, &t, None, &p_tags, &[], &[], &[]) { - Ok(b) => b, - Err(e) => { - eprintln!("buzz-desktop: STT build_message: {e}"); - continue; - } - }; + let builder = match events::build_message( + channel_uuid, + &t, + None, + &p_tags, + &[], + &[], + &[], + &[], + None, + &crate::relay::relay_api_base_url(), + ) { + Ok(b) => b, + Err(e) => { + eprintln!("buzz-desktop: STT build_message: {e}"); + continue; + } + }; // Wait before signing: the relay enforces NIP-98 freshness (±60s) // and the gate may hold for up to MAX_HINT_SECONDS (300s). Sign // the kind event and build NIP-98 auth after the wait so both diff --git a/desktop/src-tauri/src/huddle/playout.rs b/desktop/src-tauri/src/huddle/playout.rs index bf5d4a23906..66c80f5d6c6 100644 --- a/desktop/src-tauri/src/huddle/playout.rs +++ b/desktop/src-tauri/src/huddle/playout.rs @@ -30,16 +30,23 @@ use futures_util::{SinkExt, StreamExt}; use tokio_tungstenite::tungstenite::Message as WsMsg; use tokio_util::sync::CancellationToken; +use super::human_floor::HumanFloor; use super::jitter::{PeerJitterBuffer, SAMPLE_RATE_HZ}; use super::relay_api::{WsStream, REMOTE_SPEECH_THRESHOLD}; -use super::wire::{FrameHeader, FLAG_DTX, V2_HEADER_LEN}; +use super::wire::{parse_relay_frame, FLAG_DTX}; /// Speaker-tick window for emitting `huddle-active-speakers`. Active set is /// cleared each tick — peers that didn't send a frame in the last window are /// considered silent. const SPEAKER_TICK_MS: u64 = 500; +/// UI cadence for per-speaker waveform levels. +const SPEAKER_LEVEL_TICK_MS: u64 = 50; /// Per-peer arrival window for the TTS interrupt frame counter. const FRAME_WINDOW: std::time::Duration = std::time::Duration::from_millis(500); +const REMOTE_RELEASE_DEBOUNCE: std::time::Duration = std::time::Duration::from_millis(500); +/// Match Mobile's speaking treatment: an open microphone can emit continuous +/// non-DTX Opus for room tone, so packet type alone is not evidence of speech. +const REMOTE_SPEECH_LEVEL_DBOV: i8 = -55; /// Playout clock: NetEq emits 10 ms frames, so we tick at 10 ms. const PLAYOUT_TICK_MS: u64 = 10; @@ -52,7 +59,7 @@ const PLAYOUT_TICK_MS: u64 = 10; /// NetEq's PLC/expand path normally. const IDLE_PEER_GRACE: std::time::Duration = std::time::Duration::from_millis(500); -/// Drift bound on per-peer rodio `Player` queue depth. +/// Queue-depth thresholds for smooth producer/device clock-drift recovery. /// /// The playout pipeline has two clocks: the producer is a `tokio` 10 ms /// interval (this loop) that pulls from NetEq and appends to each peer's @@ -67,18 +74,137 @@ const IDLE_PEER_GRACE: std::time::Duration = std::time::Duration::from_millis(50 /// that drift would accumulate as monotonic added latency (and eventually /// memory). /// -/// We bound it explicitly: before each append, if the queue is already -/// at or above this threshold, drop the oldest queued frame with -/// `Player::skip_one()` so the new frame replaces it. 4 frames × 10 ms -/// = 40 ms, far below NetEq's `max_delay_ms = 200 ms`, so the audible -/// effect is negligible while the worst-case latency stays bounded. -const PLAYOUT_QUEUE_HIGH_WATER: usize = 4; +/// Dropping a whole 10 ms buffer at a shallow queue depth creates a waveform +/// discontinuity that is audible as a click or static. Once the queue grows +/// beyond the recovery threshold, play it 2% faster until it returns to the +/// target. A hard drop remains only as an emergency bound at 300 ms. +const PLAYOUT_QUEUE_RECOVERY_START: usize = 10; +const PLAYOUT_QUEUE_RECOVERY_END: usize = 4; +const PLAYOUT_QUEUE_EMERGENCY_HIGH_WATER: usize = 30; +const PLAYOUT_RECOVERY_SPEED: f32 = 1.02; + +/// Map sender-authored dBov into a useful UI range. Normal conversational +/// speech generally sits between roughly -60 dBov and -12 dBov. +fn normalized_speaker_level(level_dbov: i8) -> f32 { + ((f32::from(level_dbov) + 60.0) / 48.0).clamp(0.0, 1.0) +} + +fn is_remote_speech_frame(is_dtx: bool, level_dbov: i8) -> bool { + !is_dtx && level_dbov >= REMOTE_SPEECH_LEVEL_DBOV +} + +fn update_remote_release_deadline( + peer: u8, + is_speech: bool, + remote_floor_owners: &std::collections::HashSet, + deadlines: &mut std::collections::HashMap, + now: tokio::time::Instant, +) { + if remote_floor_owners.contains(&peer) { + if is_speech { + // Refresh from audible speech itself. Some mobile capture paths + // stop producing packets once speech ends, so waiting for a DTX + // or quiet packet can otherwise hold the human floor forever. + deadlines.insert(peer, now + REMOTE_RELEASE_DEBOUNCE); + } else { + // Preserve the deadline from the last audible frame. Continuous + // room-tone packets must not keep extending the human floor. + deadlines + .entry(peer) + .or_insert(now + REMOTE_RELEASE_DEBOUNCE); + } + } +} + +fn release_expired_remote_floors( + now: tokio::time::Instant, + owners: &mut std::collections::HashSet, + deadlines: &mut std::collections::HashMap, + human_floor: &HumanFloor, +) { + let released: Vec = deadlines + .iter() + .filter_map(|(peer, deadline)| (*deadline <= now).then_some(*peer)) + .collect(); + for peer in released { + deadlines.remove(&peer); + owners.remove(&peer); + human_floor.leave_remote(peer); + } +} + +fn should_recover_playout(depth: usize, currently_recovering: bool) -> bool { + if currently_recovering { + depth > PLAYOUT_QUEUE_RECOVERY_END + } else { + depth >= PLAYOUT_QUEUE_RECOVERY_START + } +} + +fn is_locally_synthesized_peer( + peer_idx: u8, + local_tts_publishers: &super::tts::LocalTtsPublishers, +) -> bool { + local_tts_publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .contains_key(&peer_idx) +} + +fn is_agent_peer( + peer_idx: u8, + index_to_pubkey: &std::collections::HashMap, + agent_pubkeys: &[String], +) -> bool { + index_to_pubkey.get(&peer_idx).is_some_and(|pubkey| { + agent_pubkeys + .iter() + .any(|agent| agent.eq_ignore_ascii_case(pubkey)) + }) +} + +/// Whether `peer_idx` is currently occupied per the authoritative roster. +/// Protocol v2 media carries only the peer index, so roster presence is the +/// strongest routing boundary available until the relay supports v3 epochs. +fn is_current_occupant(peer_idx: u8, index_to_epoch: &std::collections::HashMap) -> bool { + index_to_epoch.contains_key(&peer_idx) +} + +fn same_occupancy( + peer_idx: u8, + pubkey: &str, + epoch: u8, + index_to_pubkey: &std::collections::HashMap, + index_to_epoch: &std::collections::HashMap, +) -> bool { + index_to_pubkey + .get(&peer_idx) + .is_some_and(|current| current == pubkey) + && index_to_epoch.get(&peer_idx) == Some(&epoch) +} + +fn mix_remote_stt_samples(mix: &mut Vec, samples: &[f32]) { + if mix.len() < samples.len() { + mix.resize(samples.len(), 0.0); + } + for (mixed, sample) in mix.iter_mut().zip(samples) { + *mixed = (*mixed + *sample).clamp(-1.0, 1.0); + } +} + +fn f32_samples_to_le_bytes(samples: &[f32]) -> Vec { + let mut bytes = Vec::with_capacity(std::mem::size_of_val(samples)); + for sample in samples { + bytes.extend_from_slice(&sample.to_le_bytes()); + } + bytes +} /// One remote peer's slot: jitter buffer + dedicated rodio Player. /// /// Per-frame seq/timestamp come from the v2 wire header (sender-authored). -/// The relay forwards `peer_index | header | opus_bytes` opaquely; we parse -/// the header here and pass the sender's own monotonic seq + 48 kHz media +/// The relay forwards `peer_index | header | opus_bytes` opaquely; we +/// parse the header here and pass the sender's own monotonic seq + 48 kHz media /// timestamp into NetEq. struct PeerSlot { jitter: PeerJitterBuffer, @@ -87,6 +213,7 @@ struct PeerSlot { /// by the playout tick to decide whether to keep draining NetEq into the /// Player. Updated on every successful `insert_packet`. last_packet_at: tokio::time::Instant, + recovering_playout: bool, } impl PeerSlot { @@ -96,6 +223,7 @@ impl PeerSlot { jitter, player: rodio::Player::connect_new(sink_mixer), last_packet_at: tokio::time::Instant::now(), + recovering_playout: false, }), Err(e) => { eprintln!("buzz-desktop: jitter buffer init peer {peer_idx}: {e}"); @@ -121,6 +249,19 @@ impl PeerSlot { fn is_active(&self) -> bool { self.last_packet_at.elapsed() < IDLE_PEER_GRACE || !self.jitter.is_empty() } + + fn update_playout_recovery(&mut self) { + let should_recover = should_recover_playout(self.player.len(), self.recovering_playout); + if should_recover == self.recovering_playout { + return; + } + self.recovering_playout = should_recover; + self.player.set_speed(if should_recover { + PLAYOUT_RECOVERY_SPEED + } else { + 1.0 + }); + } } /// Drive the receive loop until cancelled or the WS closes. @@ -135,9 +276,13 @@ pub(crate) async fn run_playout_recv_loop( sink_handle: rodio::MixerDeviceSink, cancel: CancellationToken, app_handle: Option, - initial_peers: Vec<(u8, String)>, + initial_peers: Vec<(u8, String, u8)>, tts_active: Arc, tts_cancel: Arc, + local_tts_publishers: super::tts::LocalTtsPublishers, + remote_stt_pipeline: Arc>>>, + agent_pubkeys: Arc>>, + human_floor: HumanFloor, ) { use rodio::buffer::SamplesBuffer; use std::num::NonZero; @@ -147,14 +292,29 @@ pub(crate) async fn run_playout_recv_loop( let rate = NonZero::new(SAMPLE_RATE_HZ).expect("48k is non-zero"); let mut index_to_pubkey: std::collections::HashMap = - initial_peers.into_iter().collect(); + std::collections::HashMap::new(); + // Occupancy epoch per index, mirroring the authoritative roster. Advances + // each time a slot is reused by a new occupant, so a frame authored by a + // departed occupant that arrives after its index is reassigned carries the + // old epoch and is fenced rather than mis-attributed to the new occupant. + let mut index_to_epoch: std::collections::HashMap = std::collections::HashMap::new(); + for (idx, pubkey, epoch) in initial_peers { + index_to_pubkey.insert(idx, pubkey); + index_to_epoch.insert(idx, epoch); + } let mut active_indices: std::collections::HashSet = std::collections::HashSet::new(); + let mut speaker_levels: std::collections::HashMap = std::collections::HashMap::new(); + let mut remote_release_deadlines: std::collections::HashMap = + std::collections::HashMap::new(); + let mut remote_floor_owners: std::collections::HashSet = std::collections::HashSet::new(); let mut frame_counts: std::collections::HashMap = std::collections::HashMap::new(); let mut last_frame_reset = tokio::time::Instant::now(); - let mut tts_was_active = false; let mut speaker_tick = tokio::time::interval(std::time::Duration::from_millis(SPEAKER_TICK_MS)); speaker_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip); + let mut speaker_level_tick = + tokio::time::interval(std::time::Duration::from_millis(SPEAKER_LEVEL_TICK_MS)); + speaker_level_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip); let mut playout_tick = tokio::time::interval(std::time::Duration::from_millis(PLAYOUT_TICK_MS)); // `Delay` (not `Skip`) so a brief stall in another select arm — e.g. the // ws_tx_for_pongs mutex contending with the encode-side task on a Ping — @@ -178,6 +338,7 @@ pub(crate) async fn run_playout_recv_loop( // per idle peer into rodio forever. `is_active` is a 500 ms // grace past the last received packet, far longer than typical // DTX comfort-noise cadence. + let mut remote_stt_mix = Vec::new(); for (peer_idx, slot) in peers.iter_mut() { if !slot.is_active() { // Still drain the frame to keep NetEq's internal clock @@ -187,19 +348,29 @@ pub(crate) async fn run_playout_recv_loop( } match slot.jitter.get_audio() { Ok((samples, _vad)) => { - // Bound producer-vs-device-clock drift. If our - // tokio tick has gotten ahead of the audio - // callback's actual consumption rate, drop the - // oldest queued frame rather than letting the - // queue grow without bound. - if slot.player.len() >= PLAYOUT_QUEUE_HIGH_WATER { + // Smooth out producer-vs-device clock drift. A + // shallow hard drop used to remove entire 10 ms + // chunks and create audible discontinuities. + slot.update_playout_recovery(); + if slot.player.len() >= PLAYOUT_QUEUE_EMERGENCY_HIGH_WATER { eprintln!( - "buzz-desktop: playout queue high-water for peer {peer_idx} \ - (depth={}) — dropping oldest frame", + "buzz-desktop: playout queue emergency high-water for peer \ + {peer_idx} (depth={}) — dropping oldest frame", slot.player.len(), ); slot.player.skip_one(); } + if !is_locally_synthesized_peer(*peer_idx, &local_tts_publishers) { + let remote_agent = { + let agents = agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()); + is_agent_peer(*peer_idx, &index_to_pubkey, &agents) + }; + if !remote_agent { + mix_remote_stt_samples(&mut remote_stt_mix, &samples); + } + } slot.player.append(SamplesBuffer::new(channels, rate, samples)); } Err(e) => { @@ -209,8 +380,26 @@ pub(crate) async fn run_playout_recv_loop( } } } + if !remote_stt_mix.is_empty() { + let pipeline = remote_stt_pipeline + .lock() + .unwrap_or_else(|error| error.into_inner()) + .as_ref() + .and_then(std::sync::Weak::upgrade); + if let Some(pipeline) = pipeline { + let _ = pipeline.push_remote_audio(f32_samples_to_le_bytes( + &remote_stt_mix, + )); + } + } } _ = speaker_tick.tick() => { + release_expired_remote_floors( + tokio::time::Instant::now(), + &mut remote_floor_owners, + &mut remote_release_deadlines, + &human_floor, + ); if let Some(ref app) = app_handle { use tauri::Emitter; let pubkeys: Vec = active_indices @@ -221,48 +410,72 @@ pub(crate) async fn run_playout_recv_loop( } active_indices.clear(); } + _ = speaker_level_tick.tick() => { + if let Some(ref app) = app_handle { + use tauri::Emitter; + let levels: std::collections::HashMap = speaker_levels + .iter() + .filter_map(|(idx, level)| { + index_to_pubkey.get(idx).cloned().map(|pubkey| (pubkey, *level)) + }) + .collect(); + let _ = app.emit("huddle-speaker-levels", &levels); + } + for level in speaker_levels.values_mut() { + *level *= 0.55; + } + speaker_levels.retain(|_, level| *level > 0.015); + } msg = ws_rx.next() => { match msg { Some(Ok(WsMsg::Binary(data))) => { // Wire shape (v2): [peer_index: u8][header: 8 bytes][opus payload...] - // The minimum size is 1 (peer_index) + 8 (header) + ≥1 Opus byte. - if data.len() <= 1 + V2_HEADER_LEN { - continue; - } - let peer_idx = data[0]; - let after_idx = &data[1..]; - let Some((header, opus_bytes)) = FrameHeader::parse(after_idx) - else { - // Malformed v2 frame: header parse only fails when - // the slice is too short, which `if data.len() <= ...` - // already guards. Defensive log + drop. + // The minimum size is 1 (peer index) + 8 (header) + ≥1 Opus byte. + let Some((peer_idx, header, opus_bytes)) = parse_relay_frame(&data) else { eprintln!( - "buzz-desktop: dropping malformed audio frame from peer {peer_idx} ({} bytes)", + "buzz-desktop: dropping malformed v2 audio relay frame ({} bytes)", data.len(), ); continue; }; - if opus_bytes.is_empty() { + // Protocol v2 has no media epoch. Drop frames for slots + // absent from the control roster; delayed frames after + // an index is reassigned cannot be fenced until v3. + if !is_current_occupant(peer_idx, &index_to_epoch) { + continue; + } + // Suppress only an agent stream synthesized and + // published by this desktop. Other bot-role peers may + // publish their own legitimate audio and must play. + if is_locally_synthesized_peer(peer_idx, &local_tts_publishers) { continue; } let is_dtx = (header.flags & FLAG_DTX) != 0; - // Only count non-DTX arrivals toward the UI's - // active-speaker set. DTX/comfort packets are emitted - // by an idle peer to keep the codec alive — they - // don't mean the peer is speaking, and shouldn't - // make their tile flash for the 500 ms speaker tick. - if !is_dtx { + let is_remote_speech = + is_remote_speech_frame(is_dtx, header.level_dbov); + // Only count audible arrivals toward the UI's + // active-speaker set. An open mobile microphone can + // continuously emit non-DTX room tone, so require an + // audible level before treating a packet as speech. + update_remote_release_deadline( + peer_idx, + is_remote_speech, + &remote_floor_owners, + &mut remote_release_deadlines, + tokio::time::Instant::now(), + ); + if is_remote_speech { active_indices.insert(peer_idx); + let level = normalized_speaker_level(header.level_dbov); + speaker_levels + .entry(peer_idx) + .and_modify(|current| *current = current.max(level)) + .or_insert(level); } - // TTS interrupt frame counter — reset on TTS rising edge. - let tts_now = tts_active.load(Ordering::Acquire); - if tts_now && !tts_was_active { - frame_counts.clear(); - last_frame_reset = tokio::time::Instant::now(); - } - tts_was_active = tts_now; - + // Track remote speech independently of TTS liveness so a + // human who starts while output is idle still owns the + // floor and rejects delayed synthesis. let slot = match peers.entry(peer_idx) { std::collections::hash_map::Entry::Occupied(e) => e.into_mut(), std::collections::hash_map::Entry::Vacant(e) => { @@ -290,11 +503,16 @@ pub(crate) async fn run_playout_recv_loop( slot.last_packet_at = tokio::time::Instant::now(); } - // Count remote-speech frame arrivals for the TTS - // interrupt. DTX/comfort frames don't count — they - // mean the peer is silent, just keeping the codec - // state alive. - if tts_now && !is_dtx { + let remote_human = { + let agents = agent_pubkeys + .lock() + .unwrap_or_else(|error| error.into_inner()); + !is_agent_peer(peer_idx, &index_to_pubkey, &agents) + }; + // Count only remote-human speech toward floor onset. + // Agent audio still plays, but it must not acquire the + // human floor or suppress another agent's response. + if is_remote_speech && remote_human { if last_frame_reset.elapsed() >= FRAME_WINDOW { frame_counts.clear(); last_frame_reset = tokio::time::Instant::now(); @@ -302,7 +520,19 @@ pub(crate) async fn run_playout_recv_loop( let count = frame_counts.entry(peer_idx).or_insert(0); *count = count.saturating_add(1); if *count >= REMOTE_SPEECH_THRESHOLD { - tts_cancel.store(true, Ordering::Release); + human_floor.enter_remote(peer_idx); + remote_floor_owners.insert(peer_idx); + // The threshold-crossing frame is processed + // before this peer becomes an owner. Arm its + // release here so silence need not arrive in a + // later packet to let queued TTS continue. + remote_release_deadlines.insert( + peer_idx, + tokio::time::Instant::now() + REMOTE_RELEASE_DEBOUNCE, + ); + if tts_active.load(Ordering::Acquire) { + tts_cancel.store(true, Ordering::Release); + } } } } @@ -317,19 +547,30 @@ pub(crate) async fn run_playout_recv_loop( p["peer_index"].as_u64(), ) { let key = idx as u8; - // peer_index reuse with a new pubkey: + // Absent `epoch` (legacy relay) degrades to + // 0 so the fence stays a no-op. + let epoch = + p["epoch"].as_u64().unwrap_or(0) as u8; + // Any new occupancy (pubkey or epoch) must // flush the old peer's NetEq + Player so // the next frame starts clean. - if index_to_pubkey - .get(&key) - .map(|s| s.as_str()) - != Some(pk) - { + if !same_occupancy( + key, + pk, + epoch, + &index_to_pubkey, + &index_to_epoch, + ) { peers.remove(&key); frame_counts.remove(&key); + remote_release_deadlines.remove(&key); + remote_floor_owners.remove(&key); + human_floor.leave_remote(key); active_indices.remove(&key); + speaker_levels.remove(&key); } index_to_pubkey.insert(key, pk.to_string()); + index_to_epoch.insert(key, epoch); } } } @@ -337,28 +578,62 @@ pub(crate) async fn run_playout_recv_loop( Some("roster") => { if let Some(peer_list) = v["peers"].as_array() { let mut replacement = std::collections::HashMap::new(); + let mut replacement_epochs = + std::collections::HashMap::new(); for p in peer_list { if let (Some(pk), Some(idx)) = ( p["pubkey"].as_str(), p["peer_index"].as_u64(), ) { - replacement.insert(idx as u8, pk.to_string()); + let key = idx as u8; + let epoch = + p["epoch"].as_u64().unwrap_or(0) as u8; + replacement.insert(key, pk.to_string()); + replacement_epochs.insert(key, epoch); } } let identity_unchanged = |idx: &u8| { - replacement.get(idx) == index_to_pubkey.get(idx) + replacement.get(idx).is_some_and(|pubkey| { + replacement_epochs.get(idx).is_some_and(|epoch| { + same_occupancy( + *idx, + pubkey, + *epoch, + &index_to_pubkey, + &index_to_epoch, + ) + }) + }) }; peers.retain(|idx, _| identity_unchanged(idx)); + for idx in index_to_pubkey + .keys() + .filter(|idx| !identity_unchanged(idx)) + .copied() + .collect::>() + { + human_floor.leave_remote(idx); + remote_release_deadlines.remove(&idx); + remote_floor_owners.remove(&idx); + } frame_counts.retain(|idx, _| identity_unchanged(idx)); active_indices.retain(identity_unchanged); + speaker_levels.retain(|idx, _| identity_unchanged(idx)); index_to_pubkey = replacement; + index_to_epoch = replacement_epochs; } } Some("left") => { if let Some(idx) = v["peer_index"].as_u64() { let key = idx as u8; index_to_pubkey.remove(&key); + index_to_epoch.remove(&key); frame_counts.remove(&key); + remote_release_deadlines.remove(&key); + remote_floor_owners.remove(&key); + human_floor.leave_remote(key); + active_indices.remove(&key); + speaker_levels.remove(&key); // Dropping Player detaches its queue from the // device mixer, freeing the per-peer slot. peers.remove(&key); @@ -379,4 +654,174 @@ pub(crate) async fn run_playout_recv_loop( } } } + + human_floor.clear_remote(); + if let Some(ref app) = app_handle { + use tauri::Emitter; + let _ = app.emit( + "huddle-speaker-levels", + &std::collections::HashMap::::new(), + ); + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn continuous_silence_does_not_extend_remote_floor_deadline() { + let peer = 7; + let started = tokio::time::Instant::now(); + let owners = std::collections::HashSet::from([peer]); + let mut deadlines = std::collections::HashMap::new(); + + update_remote_release_deadline(peer, false, &owners, &mut deadlines, started); + let armed = deadlines[&peer]; + for elapsed_ms in [100, 200, 300, 400] { + update_remote_release_deadline( + peer, + false, + &owners, + &mut deadlines, + started + std::time::Duration::from_millis(elapsed_ms), + ); + } + + assert_eq!(deadlines[&peer], armed); + assert!(armed <= started + REMOTE_RELEASE_DEBOUNCE); + + let human_floor = HumanFloor::new(); + human_floor.enter_remote(peer); + let mut owners = owners; + release_expired_remote_floors(armed, &mut owners, &mut deadlines, &human_floor); + assert!(!human_floor.is_blocked()); + assert!(owners.is_empty()); + assert!(deadlines.is_empty()); + } + + #[test] + fn last_speech_frame_arms_remote_floor_release_without_follow_up_audio() { + let peer = 7; + let started = tokio::time::Instant::now(); + let owners = std::collections::HashSet::from([peer]); + let mut deadlines = std::collections::HashMap::new(); + + update_remote_release_deadline(peer, true, &owners, &mut deadlines, started); + let armed = started + REMOTE_RELEASE_DEBOUNCE; + assert_eq!(deadlines[&peer], armed); + + let human_floor = HumanFloor::new(); + human_floor.enter_remote(peer); + let mut owners = owners; + release_expired_remote_floors(armed, &mut owners, &mut deadlines, &human_floor); + + assert!(!human_floor.is_blocked()); + assert!(owners.is_empty()); + assert!(deadlines.is_empty()); + } + + #[test] + fn silence_from_non_owner_does_not_arm_remote_floor_deadline() { + let mut deadlines = std::collections::HashMap::new(); + update_remote_release_deadline( + 7, + false, + &std::collections::HashSet::new(), + &mut deadlines, + tokio::time::Instant::now(), + ); + assert!(deadlines.is_empty()); + } + + #[test] + fn remote_speech_requires_non_dtx_audio_above_the_activity_floor() { + assert!(!is_remote_speech_frame(true, 0)); + assert!(!is_remote_speech_frame(false, -127)); + assert!(!is_remote_speech_frame(false, -56)); + assert!(is_remote_speech_frame(false, -55)); + assert!(is_remote_speech_frame(false, -12)); + } + + #[test] + fn speaker_level_maps_conversational_range() { + assert_eq!(normalized_speaker_level(-127), 0.0); + assert_eq!(normalized_speaker_level(-60), 0.0); + assert!((normalized_speaker_level(-36) - 0.5).abs() < f32::EPSILON); + assert_eq!(normalized_speaker_level(-12), 1.0); + assert_eq!(normalized_speaker_level(0), 1.0); + } + + #[test] + fn playout_recovery_uses_hysteresis() { + assert!(!should_recover_playout(9, false)); + assert!(should_recover_playout(10, false)); + assert!(should_recover_playout(5, true)); + assert!(!should_recover_playout(4, true)); + } + + #[test] + fn only_the_local_socket_is_suppressed_for_a_shared_agent_identity() { + let local_publishers = super::super::tts::LocalTtsPublishers::default(); + local_publishers + .lock() + .expect("local publishers") + .insert(3, 1); + + assert!(is_locally_synthesized_peer(3, &local_publishers)); + assert!( + !is_locally_synthesized_peer(4, &local_publishers), + "a second socket for the same agent remains audible" + ); + assert!(!is_locally_synthesized_peer(9, &local_publishers)); + } + + #[test] + fn remote_agent_identity_is_excluded_from_human_stt() { + let peers = + std::collections::HashMap::from([(3, "human".to_owned()), (4, "AGENT".to_owned())]); + let agents = vec!["agent".to_owned()]; + + assert!(!is_agent_peer(3, &peers, &agents)); + assert!(is_agent_peer(4, &peers, &agents)); + assert!(!is_agent_peer(9, &peers, &agents)); + } + + #[test] + fn occupancy_identity_includes_epoch_for_same_pubkey_rejoin() { + let pubkeys = std::collections::HashMap::from([(3_u8, "alice".to_owned())]); + let epochs = std::collections::HashMap::from([(3_u8, 4_u8)]); + + assert!(same_occupancy(3, "alice", 4, &pubkeys, &epochs)); + assert!( + !same_occupancy(3, "alice", 5, &pubkeys, &epochs), + "same pubkey with a new epoch must reset decoder and playout state" + ); + } + + #[test] + fn v2_media_is_routed_only_for_current_roster_indices() { + let mut index_to_epoch = std::collections::HashMap::new(); + index_to_epoch.insert(3_u8, 0_u8); + assert!( + is_current_occupant(3, &index_to_epoch), + "current occupant's frame is delivered" + ); + assert!( + !is_current_occupant(9, &index_to_epoch), + "frame for an unoccupied index is dropped" + ); + } + + #[test] + fn remote_human_stt_mix_sums_and_clamps_concurrent_speakers() { + let mut mix = Vec::new(); + mix_remote_stt_samples(&mut mix, &[0.4, -0.7, 0.2]); + mix_remote_stt_samples(&mut mix, &[0.8, -0.6, -0.1]); + + assert_eq!(mix, vec![1.0, -1.0, 0.1]); + let bytes = f32_samples_to_le_bytes(&mix); + assert_eq!(bytes.len(), std::mem::size_of_val(mix.as_slice())); + assert_eq!(f32::from_le_bytes(bytes[0..4].try_into().unwrap()), 1.0); + } } diff --git a/desktop/src-tauri/src/huddle/preprocessing.rs b/desktop/src-tauri/src/huddle/preprocessing.rs index ce85e3145e3..8eeddc2bea0 100644 --- a/desktop/src-tauri/src/huddle/preprocessing.rs +++ b/desktop/src-tauri/src/huddle/preprocessing.rs @@ -12,87 +12,6 @@ //! → numbers → words → "forty two" //! → collapse whitespace → clean string //! ``` -//! -//! Also provides `split_sentences` — the single sentence-boundary splitter used -//! by both the TTS batching pipeline and the Supertonic text chunker. - -use regex::Regex; -use std::sync::LazyLock; - -// ── Sentence splitting ──────────────────────────────────────────────────────── - -/// Regex: a sentence-ending punctuation mark followed by whitespace. -static RE_SENTENCE_BOUNDARY: LazyLock = LazyLock::new(|| Regex::new(r"([.!?])\s+").unwrap()); - -/// Common abbreviations that end with a period but are NOT sentence boundaries. -const ABBREVIATIONS: &[&str] = &[ - "Dr.", "Mr.", "Mrs.", "Ms.", "Prof.", "Sr.", "Jr.", "St.", "Ave.", "Rd.", "Blvd.", "Dept.", - "Inc.", "Ltd.", "Co.", "Corp.", "etc.", "vs.", "i.e.", "e.g.", "Ph.D.", -]; - -/// Split text into sentence-sized chunks. -/// -/// Combines regex-based boundary detection with: -/// - Abbreviation awareness (`Dr.`, `Mr.`, etc. don't split) -/// - Digit-before-period check (avoids splitting `1.` `2.` numbered lists) -/// - `\n` and `—` treated as sentence breaks -/// -/// Returns non-empty, trimmed strings. -pub fn split_sentences(text: &str) -> Vec { - // First, split on newlines and em-dashes to get coarse segments. - let coarse: Vec<&str> = text.split(['\n', '—']).collect(); - - let mut sentences = Vec::new(); - - for segment in coarse { - let segment = segment.trim(); - if segment.is_empty() { - continue; - } - // Within each segment, split on sentence-ending punctuation. - let matches: Vec<_> = RE_SENTENCE_BOUNDARY.find_iter(segment).collect(); - if matches.is_empty() { - sentences.push(segment.to_string()); - continue; - } - - let mut last_end = 0usize; - for m in &matches { - let before = &segment[last_end..m.start()]; - let punc_char = &segment[m.start()..m.start() + 1]; - - // Skip if this looks like an abbreviation. - let combined = format!("{}{}", before.trim(), punc_char); - let is_abbrev = ABBREVIATIONS.iter().any(|a| combined.ends_with(a)); - - // Skip if the character before the period is a digit (numbered list). - let is_digit_period = punc_char == "." - && !before.is_empty() - && before.ends_with(|c: char| c.is_ascii_digit()); - - if !is_abbrev && !is_digit_period { - let piece = segment[last_end..m.end()].trim(); - if !piece.is_empty() { - sentences.push(piece.to_string()); - } - last_end = m.end(); - } - } - - if last_end < segment.len() { - let tail = segment[last_end..].trim(); - if !tail.is_empty() { - sentences.push(tail.to_string()); - } - } - } - - if sentences.is_empty() { - vec![text.to_string()] - } else { - sentences - } -} // ── Public API ──────────────────────────────────────────────────────────────── @@ -602,49 +521,6 @@ mod tests { assert_eq!(out, "hello world"); } - #[test] - fn split_sentences_basic() { - let result = split_sentences("Hello world. How are you? I'm fine!"); - assert_eq!(result, vec!["Hello world.", "How are you?", "I'm fine!"]); - } - - #[test] - fn split_sentences_newline_break() { - let result = split_sentences("First line.\nSecond line."); - assert_eq!(result, vec!["First line.", "Second line."]); - } - - #[test] - fn split_sentences_em_dash_break() { - let result = split_sentences("Start here—then continue."); - assert_eq!(result, vec!["Start here", "then continue."]); - } - - #[test] - fn split_sentences_abbreviations() { - let result = split_sentences("Dr. Smith went home. He was tired."); - assert_eq!(result, vec!["Dr. Smith went home.", "He was tired."]); - } - - #[test] - fn split_sentences_numbered_list() { - let result = split_sentences("1. First item. 2. Second item."); - // "1." and "2." should NOT cause a split (digit before period). - assert_eq!(result, vec!["1. First item.", "2. Second item."]); - } - - #[test] - fn split_sentences_single() { - let result = split_sentences("Just one sentence"); - assert_eq!(result, vec!["Just one sentence"]); - } - - #[test] - fn split_sentences_empty() { - let result = split_sentences(""); - assert_eq!(result, vec![""]); - } - #[test] fn filters_trivial_responses() { assert_eq!(preprocess_for_tts("."), ""); diff --git a/desktop/src-tauri/src/huddle/relay_api.rs b/desktop/src-tauri/src/huddle/relay_api.rs index 3f2aa76a560..190397aa054 100644 --- a/desktop/src-tauri/src/huddle/relay_api.rs +++ b/desktop/src-tauri/src/huddle/relay_api.rs @@ -41,30 +41,44 @@ pub(crate) fn parse_channel_uuid(channel_id: &str) -> Result { /// Handshake timeout — matches the server's AUTH_TIMEOUT (5 s). const HANDSHAKE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5); -/// Connect to the relay's audio WebSocket and run the Opus encode/decode pipeline. -/// -/// Returns `(cancel_token, pcm_sender)` — caller stores both in `HuddleState`. -/// Dropping the sender or calling `cancel.cancel()` shuts down the relay task. -pub(crate) async fn connect_audio_relay( +fn build_audio_auth_event( + keys: &nostr::Keys, + relay_url: &str, + challenge: &str, + auth_tag_json: Option<&str>, +) -> Result { + let mut tags = vec![ + nostr::Tag::parse(["relay", relay_url]).map_err(|e| format!("tag relay: {e}"))?, + nostr::Tag::parse(["challenge", challenge]).map_err(|e| format!("tag challenge: {e}"))?, + ]; + if let Some(auth_tag_json) = auth_tag_json { + let compat_pubkey = nostr::PublicKey::from_hex(&keys.public_key().to_hex()) + .map_err(|e| format!("agent pubkey conversion failed: {e}"))?; + buzz_sdk_pkg::nip_oa::verify_auth_tag(auth_tag_json, &compat_pubkey) + .map_err(|e| format!("agent auth tag verification failed: {e}"))?; + let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(auth_tag_json) + .map_err(|e| format!("agent auth tag parse failed: {e}"))?; + tags.push( + nostr::Tag::parse(compat_tag.as_slice()) + .map_err(|e| format!("agent auth tag conversion failed: {e}"))?, + ); + } + nostr::EventBuilder::new(nostr::Kind::Custom(22242), "") + .tags(tags) + .sign_with_keys(keys) + .map_err(|e| format!("sign: {e}")) +} + +async fn connect_authenticated_audio_socket( channel_id: &str, parent_channel_id: Option<&str>, - state: &AppState, -) -> Result<(CancellationToken, tokio::sync::mpsc::Sender>), String> { + relay_url: &str, + keys: &nostr::Keys, + auth_tag_json: Option<&str>, +) -> Result<(WsSink, WsReceiver, u8, Vec<(u8, String, u8)>), String> { use nostr::JsonUtil; - let relay_url = crate::relay::relay_ws_url_with_override(state); let ws_url = format!("{relay_url}/huddle/{channel_id}/audio"); - - let keys = state.keys.lock().map_err(|e| e.to_string())?.clone(); - - // TTS interrupt flags — recv task cancels TTS when remote humans speak. - let (tts_cancel, tts_active) = { - let hs = state.huddle()?; - (Arc::clone(&hs.tts_cancel), Arc::clone(&hs.tts_active)) - }; - - let app_handle = state.app_handle.lock().ok().and_then(|g| g.clone()); - let (ws_stream, _) = connect_async(&ws_url) .await .map_err(|e| format!("audio WS connect failed: {e}"))?; @@ -74,13 +88,13 @@ pub(crate) async fn connect_audio_relay( loop { match ws_rx.next().await { Some(Ok(WsMsg::Text(text))) => { - let v: serde_json::Value = serde_json::from_str(&text) + let value: serde_json::Value = serde_json::from_str(&text) .map_err(|e| format!("bad challenge JSON: {e}"))?; - if v["type"] == "challenge" { - break v["challenge"] + if value["type"] == "challenge" { + break value["challenge"] .as_str() .ok_or_else(|| "missing challenge string".to_string()) - .map(|s| s.to_string()); + .map(str::to_string); } } Some(Ok(WsMsg::Close(_))) | None => { @@ -91,29 +105,18 @@ pub(crate) async fn connect_audio_relay( } }) .await - .map_err(|_| "timeout waiting for challenge from relay".to_string())? - .map_err(|e: String| e)?; - - let tags = vec![ - nostr::Tag::parse(["relay", &relay_url]).map_err(|e| format!("tag relay: {e}"))?, - nostr::Tag::parse(["challenge", &challenge]).map_err(|e| format!("tag challenge: {e}"))?, - ]; - let event = nostr::EventBuilder::new(nostr::Kind::Custom(22242), "") - .tags(tags) - .sign_with_keys(&keys) - .map_err(|e| format!("sign: {e}"))?; + .map_err(|_| "timeout waiting for challenge from relay".to_string())??; + let event = build_audio_auth_event(keys, relay_url, &challenge, auth_tag_json)?; let event_json: serde_json::Value = serde_json::from_str(&event.as_json()) .map_err(|e| format!("failed to serialize auth event: {e}"))?; let auth_msg = serde_json::json!({ "type": "auth", "event": event_json, "parent_channel_id": parent_channel_id, - // Negotiate huddle audio protocol v2 (8-byte sender-authored header - // per Opus frame: seq | ts_48k | level_dbov | flags). See - // huddle::wire for the layout. The relay pins the first joiner's - // version per-room and rejects mismatched joiners with - // `upgrade_required`. + // Use the released v2 contract while deployed relays remain capped at + // v2. Relay-to-client media therefore has a one-byte peer-index prefix; + // see huddle::wire for the compatibility tradeoff. "protocol_version": super::wire::PROTOCOL_VERSION, }); ws_tx @@ -121,30 +124,39 @@ pub(crate) async fn connect_audio_relay( .await .map_err(|e| format!("send auth: {e}"))?; - let initial_peers: Vec<(u8, String)> = tokio::time::timeout(HANDSHAKE_TIMEOUT, async { + let (peer_index, initial_peers) = tokio::time::timeout(HANDSHAKE_TIMEOUT, async { loop { match ws_rx.next().await { Some(Ok(WsMsg::Text(text))) => { - let v: serde_json::Value = serde_json::from_str(&text).unwrap_or_default(); - match v["type"].as_str() { + let value: serde_json::Value = serde_json::from_str(&text).unwrap_or_default(); + match value["type"].as_str() { Some("joined") => { - let peers = v["peers"] + let peers = value["peers"] .as_array() - .map(|arr| { - arr.iter() - .filter_map(|p| { + .map(|peers| { + peers + .iter() + .filter_map(|peer| { Some(( - p["peer_index"].as_u64()? as u8, - p["pubkey"].as_str()?.to_string(), + peer["peer_index"].as_u64()? as u8, + peer["pubkey"].as_str()?.to_string(), + // Absent `epoch` (legacy relay) degrades + // to 0 so the fence becomes a no-op rather + // than rejecting every frame. + peer["epoch"].as_u64().unwrap_or(0) as u8, )) }) - .collect::>() + .collect() }) .unwrap_or_default(); - break Ok(peers); + let peer_index = value["peer_index"] + .as_u64() + .and_then(|index| u8::try_from(index).ok()) + .ok_or_else(|| "joined message missing peer index".to_string())?; + break Ok((peer_index, peers)); } Some("error") => { - break Err(format!("audio relay auth error: {}", v["message"])); + break Err(format!("audio relay auth error: {}", value["message"])); } _ => continue, } @@ -157,8 +169,48 @@ pub(crate) async fn connect_audio_relay( } }) .await - .map_err(|_| "timeout waiting for joined from relay".to_string())? - .map_err(|e: String| e)?; + .map_err(|_| "timeout waiting for joined from relay".to_string())??; + + Ok((ws_tx, ws_rx, peer_index, initial_peers)) +} + +/// Connect to the relay's audio WebSocket and run the Opus encode/decode pipeline. +/// +/// Returns `(cancel_token, pcm_sender)` — caller stores both in `HuddleState`. +/// Dropping the sender or calling `cancel.cancel()` shuts down the relay task. +pub(crate) async fn connect_audio_relay( + channel_id: &str, + parent_channel_id: Option<&str>, + state: &AppState, +) -> Result<(CancellationToken, tokio::sync::mpsc::Sender>), String> { + let relay_url = crate::relay::relay_ws_url_with_override(state); + let keys = state.keys.lock().map_err(|e| e.to_string())?.clone(); + + // TTS interrupt flags — recv task cancels TTS when remote humans speak. + let ( + tts_cancel, + tts_active, + local_tts_publishers, + remote_stt_pipeline, + agent_pubkeys, + human_floor, + ) = { + let hs = state.huddle()?; + ( + Arc::clone(&hs.tts_cancel), + Arc::clone(&hs.tts_active), + Arc::clone(&hs.local_tts_publishers), + Arc::clone(&hs.remote_stt_pipeline), + Arc::clone(&hs.agent_pubkeys), + hs.human_floor.clone(), + ) + }; + + let app_handle = state.app_handle.lock().ok().and_then(|g| g.clone()); + + let (ws_tx, ws_rx, _peer_index, initial_peers) = + connect_authenticated_audio_socket(channel_id, parent_channel_id, &relay_url, &keys, None) + .await?; let cancel = CancellationToken::new(); let cancel_clone = cancel.clone(); @@ -180,6 +232,10 @@ pub(crate) async fn connect_audio_relay( initial_peers, tts_cancel, tts_active, + local_tts_publishers, + remote_stt_pipeline, + agent_pubkeys, + human_floor, output_device_name, }) .await @@ -204,6 +260,193 @@ pub(crate) async fn connect_audio_relay( /// Background Opus encode/decode pipeline spawned by `connect_audio_relay`. pub(crate) type WsStream = tokio_tungstenite::WebSocketStream>; +type WsSink = futures_util::stream::SplitSink; +type WsReceiver = futures_util::stream::SplitStream; + +const TTS_BROADCAST_QUEUE_DEPTH: usize = 8; +const TTS_BROADCAST_MAX_FRAMES: usize = 1_500; // 30 seconds at 20 ms/frame. + +struct QueuedTtsFrame { + epoch: u64, + speaker_generation: u64, + samples_48k: Vec, +} + +fn upsample_tts_24k_to_48k(samples_24k: &[f32]) -> Vec { + let mut samples_48k = Vec::with_capacity(samples_24k.len().saturating_mul(2)); + for (index, sample) in samples_24k.iter().copied().enumerate() { + let next = samples_24k.get(index + 1).copied().unwrap_or(sample); + samples_48k.push(sample); + samples_48k.push((sample + next) * 0.5); + } + samples_48k +} + +fn queue_tts_broadcast_packet( + queue: &mut std::collections::VecDeque, + packet: super::tts::TtsBroadcastPacket, + current_epoch: u64, + current_speaker_generation: u64, +) { + if packet.epoch != current_epoch + || packet.speaker_generation != current_speaker_generation + || packet.samples_24k.is_empty() + { + return; + } + let samples_48k = upsample_tts_24k_to_48k(&packet.samples_24k); + for chunk in samples_48k.chunks(960) { + if queue.len() >= TTS_BROADCAST_MAX_FRAMES { + eprintln!("buzz-desktop: tts broadcast status=dropped reason=queue_duration_limit"); + break; + } + let mut frame = chunk.to_vec(); + frame.resize(960, 0.0); + queue.push_back(QueuedTtsFrame { + epoch: packet.epoch, + speaker_generation: packet.speaker_generation, + samples_48k: frame, + }); + } +} + +/// Open a send-only v2 Huddle audio peer authenticated as a locally managed +/// agent. The relay therefore assigns the synthesized stream to that agent's +/// existing pubkey; no backend or wire-protocol extension is required. +pub(crate) async fn connect_tts_audio_publisher( + channel_id: &str, + parent_channel_id: Option<&str>, + state: &AppState, + keys: &nostr::Keys, + auth_tag_json: Option<&str>, + local_tts_publishers: super::tts::LocalTtsPublishers, +) -> Result { + let relay_url = crate::relay::relay_ws_url_with_override(state); + let (ws_tx, ws_rx, peer_index, _) = connect_authenticated_audio_socket( + channel_id, + parent_channel_id, + &relay_url, + keys, + auth_tag_json, + ) + .await?; + + let cancel = CancellationToken::new(); + let publisher_cancel = cancel.clone(); + let (tx, rx) = tokio::sync::mpsc::channel(TTS_BROADCAST_QUEUE_DEPTH); + let publisher = super::tts::TtsAudioPublisher::new(tx, cancel); + let (epoch, speaker_generation) = publisher.version_state(); + let local_publisher = super::tts::LocalTtsPublisherLease::new(peer_index, local_tts_publishers); + tokio::spawn(async move { + let _local_publisher = local_publisher; + if let Err(error) = run_tts_audio_publisher( + ws_tx, + ws_rx, + rx, + publisher_cancel.clone(), + epoch, + speaker_generation, + ) + .await + { + eprintln!("buzz-desktop: tts broadcast status=disconnected error={error}"); + } + publisher_cancel.cancel(); + }); + Ok(publisher) +} + +async fn run_tts_audio_publisher( + mut ws_tx: WsSink, + mut ws_rx: WsReceiver, + mut audio_rx: tokio::sync::mpsc::Receiver, + cancel: CancellationToken, + epoch: Arc, + speaker_generation: Arc, +) -> Result<(), String> { + use super::wire::{audio_level_dbov, FrameHeader, V2_HEADER_LEN}; + use std::sync::atomic::Ordering; + + let mut encoder = opus::Encoder::new(48_000, opus::Channels::Mono, opus::Application::Voip) + .map_err(|error| format!("tts opus encoder: {error}"))?; + encoder + .set_bitrate(opus::Bitrate::Bits(32_000)) + .map_err(|error| format!("tts opus bitrate: {error}"))?; + encoder + .set_dtx(true) + .map_err(|error| format!("tts opus dtx: {error}"))?; + + let mut sequence = 0_u16; + let mut timestamp_48k = 0_u32; + let mut encoded = vec![0_u8; 4_000]; + let mut queue = std::collections::VecDeque::::new(); + let mut send_tick = tokio::time::interval(std::time::Duration::from_millis(20)); + send_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip); + + loop { + tokio::select! { + biased; + _ = cancel.cancelled() => break, + _ = send_tick.tick() => { + let current_epoch = epoch.load(Ordering::Acquire); + let current_generation = speaker_generation.load(Ordering::Acquire); + while queue.front().is_some_and(|frame| { + frame.epoch != current_epoch + || frame.speaker_generation != current_generation + }) { + queue.pop_front(); + } + let Some(frame) = queue.pop_front() else { continue }; + let level = audio_level_dbov(&frame.samples_48k); + let encoded_len = encoder + .encode_float(&frame.samples_48k, &mut encoded) + .map_err(|error| format!("tts opus encode: {error}"))?; + if encoded_len == 0 { + continue; + } + let flags = if encoded_len <= 2 { super::wire::FLAG_DTX } else { 0 }; + let header = FrameHeader { + seq: sequence, + ts_48k: timestamp_48k, + level_dbov: level, + flags, + } + .encode(); + let mut payload = Vec::with_capacity(V2_HEADER_LEN + encoded_len); + payload.extend_from_slice(&header); + payload.extend_from_slice(&encoded[..encoded_len]); + ws_tx + .send(WsMsg::Binary(payload.into())) + .await + .map_err(|error| format!("tts audio send: {error}"))?; + sequence = sequence.wrapping_add(1); + timestamp_48k = timestamp_48k.wrapping_add(super::jitter::FRAME_TIMESTAMP_DELTA); + } + message = ws_rx.next() => { + match message { + Some(Ok(WsMsg::Ping(data))) => { + ws_tx.send(WsMsg::Pong(data)).await + .map_err(|error| format!("tts audio pong: {error}"))?; + } + Some(Ok(WsMsg::Close(_))) | None => break, + Some(Err(error)) => return Err(format!("tts audio receive: {error}")), + Some(Ok(_)) => {} + } + } + packet = audio_rx.recv() => { + let Some(packet) = packet else { break }; + queue_tts_broadcast_packet( + &mut queue, + packet, + epoch.load(Ordering::Acquire), + speaker_generation.load(Ordering::Acquire), + ); + } + } + } + let _ = ws_tx.send(WsMsg::Close(None)).await; + Ok(()) +} struct AudioRelayPipelineArgs { ws_tx: futures_util::stream::SplitSink, @@ -211,9 +454,13 @@ struct AudioRelayPipelineArgs { pcm_rx: tokio::sync::mpsc::Receiver>, cancel: CancellationToken, app_handle: Option, - initial_peers: Vec<(u8, String)>, + initial_peers: Vec<(u8, String, u8)>, tts_cancel: Arc, tts_active: Arc, + local_tts_publishers: super::tts::LocalTtsPublishers, + remote_stt_pipeline: Arc>>>, + agent_pubkeys: Arc>>, + human_floor: super::human_floor::HumanFloor, output_device_name: Option, } @@ -227,6 +474,10 @@ async fn audio_relay_pipeline(args: AudioRelayPipelineArgs) -> Result<(), String initial_peers, tts_cancel, tts_active, + local_tts_publishers, + remote_stt_pipeline, + agent_pubkeys, + human_floor, output_device_name, } = args; @@ -336,6 +587,10 @@ async fn audio_relay_pipeline(args: AudioRelayPipelineArgs) -> Result<(), String initial_peers, tts_active, tts_cancel, + local_tts_publishers, + remote_stt_pipeline, + agent_pubkeys, + human_floor, )); // Wait for either task to finish, then abort the survivor. @@ -414,3 +669,45 @@ pub(crate) async fn count_human_members( .filter(|(_, role)| role.as_deref() != Some("bot")) .count()) } + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn tts_upsampling_doubles_rate_with_linear_midpoints() { + assert_eq!( + upsample_tts_24k_to_48k(&[0.0, 1.0, -1.0]), + vec![0.0, 0.5, 1.0, 0.0, -1.0, -1.0] + ); + } + + #[test] + fn tts_queue_rejects_cancelled_versions_and_pads_twenty_ms_frames() { + let mut queue = std::collections::VecDeque::new(); + queue_tts_broadcast_packet( + &mut queue, + super::super::tts::TtsBroadcastPacket { + epoch: 1, + speaker_generation: 7, + samples_24k: vec![0.25; 480], + }, + 1, + 7, + ); + assert_eq!(queue.len(), 1); + assert_eq!(queue[0].samples_48k.len(), 960); + + queue_tts_broadcast_packet( + &mut queue, + super::super::tts::TtsBroadcastPacket { + epoch: 1, + speaker_generation: 7, + samples_24k: vec![0.5; 480], + }, + 2, + 7, + ); + assert_eq!(queue.len(), 1, "cancelled epoch must not enqueue"); + } +} diff --git a/desktop/src-tauri/src/huddle/state.rs b/desktop/src-tauri/src/huddle/state.rs index 37eb3533f6b..c7aff1bf7e2 100644 --- a/desktop/src-tauri/src/huddle/state.rs +++ b/desktop/src-tauri/src/huddle/state.rs @@ -4,27 +4,31 @@ //! phase enum, voice input mode, and response types. use serde::{Deserialize, Serialize}; +use std::collections::BTreeMap; use std::sync::{ atomic::{AtomicBool, AtomicU64, Ordering}, - Arc, Mutex, + Arc, Mutex, Weak, }; +use super::agent_voice::AgentVoiceSettings; +use super::human_floor::HumanFloor; use super::{stt, tts}; /// Voice input mode: push-to-talk (PTT) or voice-activity detection (VAD). /// -/// PTT: mic is gated by a global shortcut (Ctrl+Space). Pressing the key sets +/// PTT (the default): mic is gated by a global shortcut (Ctrl+Space). Pressing the key sets /// `ptt_active` and immediately cancels any playing TTS. Releasing the key /// (after a 200 ms delay) stops mic capture and flushes the utterance. /// /// VAD (default): the earshot VAD runs continuously and speech is accumulated -/// whenever the probability exceeds the threshold. Barge-in is enabled in this -/// mode. +/// whenever the probability exceeds the threshold. While local TTS is playing, +/// mic frames are discarded because VAD has no echo reference with which to +/// distinguish the app's own playback from a human interruption. #[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)] #[serde(rename_all = "snake_case")] pub enum VoiceInputMode { - PushToTalk, #[default] + PushToTalk, VoiceActivity, } @@ -44,6 +48,9 @@ pub struct HuddleState { pub phase: HuddlePhase, pub parent_channel_id: Option, pub ephemeral_channel_id: Option, + /// Root event for the huddle's visible parent-channel thread. Transcript + /// messages reply here while audio coordination stays ephemeral. + pub huddle_thread_event_id: Option, /// Cancellation token for the audio relay WS task. #[serde(skip)] pub audio_ws_cancel: Option, @@ -67,12 +74,25 @@ pub struct HuddleState { deserialize_with = "deserialize_agent_pubkeys" )] pub agent_pubkeys: Arc>>, + /// Local, huddle-scoped playback choices for each participating agent. + pub agent_voice_settings: BTreeMap, /// Active STT pipeline — not serialized, not cloned. #[serde(skip)] pub stt_pipeline: Option>, + /// Weak STT handle shared with the audio receive loop so remote human + /// speech can reach transcription even when the pipeline hot-starts after + /// the Huddle audio socket was connected. The state-owned strong handle + /// above remains the sole owner and teardown clears both atomically. + #[serde(skip)] + pub remote_stt_pipeline: Arc>>>, /// Active TTS pipeline — not serialized, not cloned. #[serde(skip)] pub tts_pipeline: Option>, + /// Peer indices currently publishing locally synthesized TTS sockets. The + /// receive loop uses this live registry to suppress only this desktop's + /// echo, never another socket authenticated as the same bot. + #[serde(skip)] + pub local_tts_publishers: tts::LocalTtsPublishers, /// Whether this client created the huddle (vs. joined it). /// Used to enforce that only the creator can end/archive the huddle. pub is_creator: bool, @@ -98,6 +118,10 @@ pub struct HuddleState { /// restarts — both STT and TTS reference the same flag for the entire huddle. #[serde(skip)] pub tts_cancel: Arc, + /// Shared human-floor state. Confirmed local or remote human speech hard + /// cancels TTS and blocks stale/new playback until every source releases. + #[serde(skip)] + pub human_floor: HumanFloor, /// Sentinel: true while a TTS pipeline is being constructed (outside the lock). /// Prevents TOCTOU races where two concurrent callers both pass the `is_some()` /// check and both spawn TTS worker threads — the loser's thread would leak. @@ -127,6 +151,12 @@ pub struct HuddleState { /// Shared with the STT pipeline for mic gating. #[serde(skip)] pub ptt_active: Arc, + /// True while the clickable microphone control is manually unmuted. + /// In PTT mode, either this flag or `ptt_active` opens the STT gate. + /// Defaults to muted so push-to-talk actually gates the microphone + /// until the user explicitly opens it. + #[serde(skip)] + pub manual_mic_unmuted: Arc, } fn serialize_agent_pubkeys(v: &Arc>>, s: S) -> Result @@ -161,18 +191,23 @@ impl Clone for HuddleState { phase: self.phase.clone(), parent_channel_id: self.parent_channel_id.clone(), ephemeral_channel_id: self.ephemeral_channel_id.clone(), + huddle_thread_event_id: self.huddle_thread_event_id.clone(), audio_ws_cancel: None, // Never clone handles. audio_relay_pcm_tx: None, // Never clone handles. participants: self.participants.clone(), agent_pubkeys: Arc::new(Mutex::new(agent_pubkeys_snapshot)), + agent_voice_settings: self.agent_voice_settings.clone(), stt_pipeline: None, // Never clone the pipeline handle. + remote_stt_pipeline: Arc::new(Mutex::new(None)), tts_pipeline: None, // Never clone the pipeline handle. + local_tts_publishers: Arc::clone(&self.local_tts_publishers), is_creator: self.is_creator, tts_enabled: self.tts_enabled, transcription_enabled: self.transcription_enabled, transcription_user_controlled: self.transcription_user_controlled, tts_active: Arc::clone(&self.tts_active), tts_cancel: Arc::clone(&self.tts_cancel), + human_floor: self.human_floor.clone(), tts_starting: Arc::clone(&self.tts_starting), stt_starting: Arc::clone(&self.stt_starting), last_agent_refresh: self.last_agent_refresh, @@ -180,28 +215,36 @@ impl Clone for HuddleState { session_generation: Arc::clone(&self.session_generation), voice_input_mode: self.voice_input_mode.clone(), ptt_active: Arc::clone(&self.ptt_active), + manual_mic_unmuted: Arc::clone(&self.manual_mic_unmuted), } } } impl Default for HuddleState { fn default() -> Self { + let tts_cancel = Arc::new(AtomicBool::new(false)); + let human_floor = HumanFloor::new(); Self { phase: HuddlePhase::Idle, parent_channel_id: None, ephemeral_channel_id: None, + huddle_thread_event_id: None, audio_ws_cancel: None, audio_relay_pcm_tx: None, participants: Vec::new(), agent_pubkeys: Arc::new(Mutex::new(Vec::new())), + agent_voice_settings: BTreeMap::new(), stt_pipeline: None, + remote_stt_pipeline: Arc::new(Mutex::new(None)), tts_pipeline: None, + local_tts_publishers: tts::LocalTtsPublishers::default(), is_creator: false, tts_enabled: true, transcription_enabled: false, transcription_user_controlled: false, tts_active: Arc::new(AtomicBool::new(false)), - tts_cancel: Arc::new(AtomicBool::new(false)), + tts_cancel, + human_floor, tts_starting: Arc::new(AtomicBool::new(false)), stt_starting: Arc::new(AtomicBool::new(false)), last_agent_refresh: None, @@ -209,11 +252,28 @@ impl Default for HuddleState { session_generation: Arc::new(AtomicU64::new(0)), voice_input_mode: VoiceInputMode::default(), ptt_active: Arc::new(AtomicBool::new(false)), + manual_mic_unmuted: Arc::new(AtomicBool::new(false)), } } } impl HuddleState { + pub(crate) fn set_stt_pipeline(&mut self, pipeline: Arc) { + *self + .remote_stt_pipeline + .lock() + .unwrap_or_else(|error| error.into_inner()) = Some(Arc::downgrade(&pipeline)); + self.stt_pipeline = Some(pipeline); + } + + pub(crate) fn take_stt_pipeline(&mut self) -> Option> { + self.remote_stt_pipeline + .lock() + .unwrap_or_else(|error| error.into_inner()) + .take(); + self.stt_pipeline.take() + } + /// Begin a new local huddle lifetime and return its identity. pub(crate) fn begin_huddle_lifetime(&mut self) -> u64 { self.huddle_generation = self.huddle_generation.wrapping_add(1); @@ -320,6 +380,13 @@ mod tests { assert!(!state.maybe_auto_enable_transcription_for_agents()); } + #[test] + fn defaults_to_push_to_talk_with_a_muted_microphone() { + let state = HuddleState::default(); + assert_eq!(state.voice_input_mode, super::VoiceInputMode::PushToTalk); + assert!(!state.manual_mic_unmuted.load(Ordering::Acquire)); + } + #[test] fn explicit_user_disable_is_not_undone_by_agent_presence() { let mut state = HuddleState::default(); diff --git a/desktop/src-tauri/src/huddle/stt.rs b/desktop/src-tauri/src/huddle/stt.rs index 6f502ca72cb..c27bf38b649 100644 --- a/desktop/src-tauri/src/huddle/stt.rs +++ b/desktop/src-tauri/src/huddle/stt.rs @@ -19,6 +19,7 @@ //! sherpa-onnx is CPU-bound and not Send-safe across await points. use std::{ + collections::VecDeque, path::PathBuf, sync::{ atomic::{AtomicBool, Ordering}, @@ -31,6 +32,8 @@ use std::{ use tokio::sync::mpsc as tokio_mpsc; +use super::{human_floor::HumanFloor, local_barge_in}; + // ── Public pipeline handle ──────────────────────────────────────────────────── /// Bounded audio queue capacity. @@ -51,29 +54,38 @@ const MAX_SPEECH_SAMPLES: usize = 16_000 * 30; #[derive(Debug)] pub struct SttPipeline { /// Send raw PCM bytes (f32 LE, 48 kHz mono) into the pipeline. - audio_tx: SyncSender>, + audio_tx: SyncSender, /// Signals the worker thread to stop. shutdown: Arc, /// Worker thread handle — taken on drop to join cleanly. thread: Option>, } +#[derive(Debug)] +struct SttAudioInput { + pcm_bytes: Vec, + origin: SttAudioOrigin, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +enum SttAudioOrigin { + Local, + RemoteHuman, +} + impl SttPipeline { /// Spawn the pipeline thread. /// - /// `tts_active` is a shared flag set by the TTS pipeline while audio is - /// playing. The STT worker uses it to: - /// - discard accumulated speech (echo prevention / barge-in gating) - /// - apply a 200 ms cooldown after TTS stops before re-enabling STT - /// - detect barge-in: speech onset during TTS → set `tts_cancel` - /// - /// `tts_cancel` (optional) is the TTS pipeline's cancel flag. When the STT - /// worker detects speech onset while TTS is active, it sets this flag to - /// stop playback immediately (barge-in). Pass `None` if TTS is unavailable. + /// Mic input is transcribed even while agent TTS is playing. In open-mic + /// VAD mode, confirmed speech acquires the shared human floor: immediately + /// on an isolated output route, or after the restored 320 ms sustained- + /// speech debounce on an acoustically coupled route. Push-to-talk retains + /// its explicit shortcut cancellation path. /// - /// `ptt_active` (optional) is the push-to-talk flag. When `Some`, the STT - /// pipeline only accumulates speech while the flag is true (key held). - /// When `None`, the pipeline runs in continuous VAD mode. + /// `ptt_active` and `manual_mic_unmuted` are present when the PTT shortcut + /// is enabled. The pipeline accepts speech while either input path is open; + /// manual unmute uses normal VAD flushing while a shortcut hold is grouped + /// into one utterance. /// /// Returns `Err` only if the thread cannot be spawned (OS error). /// If model files are missing, the worker logs and exits cleanly — @@ -85,17 +97,18 @@ impl SttPipeline { /// thread on every `recv_timeout` call). pub fn new( model_dir: PathBuf, - tts_active: Arc, - tts_cancel: Option>, ptt_active: Option>, + manual_mic_unmuted: Option>, + human_floor: HumanFloor, + output_device: Option, ) -> Result<(Self, tokio_mpsc::Receiver), String> { - let (audio_tx, audio_rx) = mpsc::sync_channel::>(AUDIO_QUEUE_DEPTH); + let (audio_tx, audio_rx) = mpsc::sync_channel::(AUDIO_QUEUE_DEPTH); let (text_tx, text_rx) = tokio_mpsc::channel::(64); let shutdown = Arc::new(AtomicBool::new(false)); let shutdown_worker = Arc::clone(&shutdown); - let tts_cancel_worker = tts_cancel.as_ref().map(Arc::clone); let ptt_active_worker = ptt_active.as_ref().map(Arc::clone); + let manual_mic_unmuted_worker = manual_mic_unmuted.as_ref().map(Arc::clone); let handle = thread::Builder::new() .name("stt-worker".into()) .spawn(move || { @@ -104,9 +117,10 @@ impl SttPipeline { audio_rx, text_tx, shutdown_worker, - tts_active, - tts_cancel_worker, ptt_active_worker, + manual_mic_unmuted_worker, + human_floor, + output_device, ) }) .map_err(|e| format!("failed to spawn stt-worker thread: {e}"))?; @@ -135,6 +149,18 @@ impl SttPipeline { /// Non-blocking. Drops audio silently if the pipeline can't keep up — /// better to lose frames than to stall the UI thread. pub fn push_audio(&self, pcm_bytes: Vec) -> Result<(), String> { + self.push_audio_from(pcm_bytes, SttAudioOrigin::Local) + } + + /// Feed decoded remote-human PCM into transcription. Unlike the desktop + /// microphone path, this is not gated by the desktop PTT or mute state: the + /// remote participant already made their transmission choice on their own + /// device before the relay delivered these samples. + pub fn push_remote_audio(&self, pcm_bytes: Vec) -> Result<(), String> { + self.push_audio_from(pcm_bytes, SttAudioOrigin::RemoteHuman) + } + + fn push_audio_from(&self, pcm_bytes: Vec, origin: SttAudioOrigin) -> Result<(), String> { // Reject non-4-byte-aligned input — would silently truncate in bytes_to_f32. if !pcm_bytes.len().is_multiple_of(4) { return Err(format!( @@ -143,7 +169,7 @@ impl SttPipeline { )); } // Drop audio if the pipeline can't keep up — better than blocking the UI. - let _ = self.audio_tx.try_send(pcm_bytes); + let _ = self.audio_tx.try_send(SttAudioInput { pcm_bytes, origin }); Ok(()) } } @@ -163,33 +189,159 @@ impl Drop for SttPipeline { // ── Worker thread ───────────────────────────────────────────────────────────── /// How many 16 kHz samples of silence before we flush to STT. -/// 300 ms × 16 000 Hz / 256 samples-per-frame ≈ 19 frames. -/// Previous value (28 frames / 450 ms) felt sluggish in conversation. -const SILENCE_FLUSH_FRAMES: usize = 19; - -/// Consecutive VAD speech frames required before triggering barge-in during TTS. -/// 20 frames × 256 samples / 16 kHz ≈ 320 ms — must be long enough to filter -/// speaker-to-mic feedback (TTS audio bleeding through the mic) while still -/// catching real human interruptions. 80 ms (previous: 5 frames) was too -/// aggressive — laptop speakers without headphones triggered false barge-in -/// within the first word of TTS playback. -const BARGE_IN_DEBOUNCE_FRAMES: usize = 20; +/// 500 ms × 16 000 Hz / 256 samples-per-frame ≈ 31 frames. +/// This favors natural conversational pauses over the lower latency of the +/// previous 19-frame / 304 ms window. +/// +/// This window is a turn-taking quality knob, not a latency lever: an earlier +/// env override (`BUZZ_STT_FLUSH_MS`) let it be lowered to 150 ms, which split +/// natural mid-sentence pauses into separate messages and confused the +/// listening agents. Reverted — the window is fixed at the production value. +const SILENCE_FLUSH_FRAMES: usize = 31; /// earshot requires exactly 256 samples per frame at 16 kHz. const VAD_FRAME_SAMPLES: usize = 256; -/// VAD probability threshold — above this is considered speech. -const VAD_THRESHOLD: f32 = 0.5; +/// Earshot 1.1.0 onset operating point. Any Earshot model/version change +/// invalidates this and `VAD_OFFSET_THRESHOLD`; re-run the matched-corpus +/// threshold harness before updating either constant. +const VAD_ONSET_THRESHOLD: f32 = 0.55; + +/// Earshot 1.1.0 offset operating point. The lower threshold keeps borderline +/// speech inside the active utterance without changing the onset sensitivity. +const VAD_OFFSET_THRESHOLD: f32 = 0.35; + +/// Consecutive onset frames required before an utterance begins. +const VAD_ONSET_FRAMES: usize = 3; + +/// Audio retained before confirmed onset so initial phonemes are not clipped. +/// A rolling pre-roll that survived a hard boundary would leak segment N into +/// segment N+1 when the next confirmed onset occurs within +/// `VAD_PRE_ROLL_FRAMES - VAD_ONSET_FRAMES` frames (13 frames, or 208 ms, at +/// the shipped values) of the previous flush. Hangover and the silence flush +/// window do not enter this bound; `reset_segment` keeps them independent by +/// clearing pre-roll. +const VAD_PRE_ROLL_FRAMES: usize = 16; + +/// Trailing silence retained in the transcript buffer (about 100 ms). +const VAD_HANGOVER_FRAMES: usize = 6; + +/// Minimum voiced audio needed before an utterance may be decoded. +/// One earshot false-positive frame is only 16 ms; requiring 192 ms prevents +/// silence/room-noise blips from reaching Parakeet and becoming hallucinated +/// transcript text while still preserving short replies such as "yes". +const MIN_VOICED_FRAMES: usize = 12; + +#[derive(Debug, PartialEq, Eq)] +enum VadFrameAction { + None, + ConfirmedOnset, + Speech, + FirstSilence, + Flush, +} + +struct VadEndpoint { + pre_roll: VecDeque>, + speech_buf: Vec, + onset_frames: usize, + silence_frames: usize, + voiced_frames: usize, + in_speech: bool, +} + +impl VadEndpoint { + fn new() -> Self { + Self { + pre_roll: VecDeque::with_capacity(VAD_PRE_ROLL_FRAMES), + speech_buf: Vec::new(), + onset_frames: 0, + silence_frames: 0, + voiced_frames: 0, + in_speech: false, + } + } + + fn process_frame( + &mut self, + frame: Vec, + probability: f32, + accepts_audio: bool, + flush_allowed: bool, + flush_frames: usize, + ) -> VadFrameAction { + if !accepts_audio { + self.pre_roll.clear(); + self.onset_frames = 0; + return VadFrameAction::None; + } + + if !self.in_speech { + self.pre_roll.push_back(frame); + if self.pre_roll.len() > VAD_PRE_ROLL_FRAMES { + self.pre_roll.pop_front(); + } + + if probability > VAD_ONSET_THRESHOLD { + self.onset_frames += 1; + } else { + self.onset_frames = 0; + } + + if self.onset_frames < VAD_ONSET_FRAMES { + return VadFrameAction::None; + } + + self.in_speech = true; + self.silence_frames = 0; + self.voiced_frames = self.onset_frames; + self.onset_frames = 0; + for buffered in self.pre_roll.drain(..) { + self.speech_buf.extend_from_slice(&buffered); + } + return VadFrameAction::ConfirmedOnset; + } + + if probability > VAD_OFFSET_THRESHOLD { + self.silence_frames = 0; + self.voiced_frames += 1; + self.speech_buf.extend_from_slice(&frame); + return VadFrameAction::Speech; + } + + self.silence_frames += 1; + self.speech_buf.extend_from_slice(&frame); + if flush_allowed && self.silence_frames >= flush_frames { + let excess_silence = self.silence_frames.saturating_sub(VAD_HANGOVER_FRAMES); + let retained_samples = self + .speech_buf + .len() + .saturating_sub(excess_silence * VAD_FRAME_SAMPLES); + self.speech_buf.truncate(retained_samples); + VadFrameAction::Flush + } else if self.silence_frames == 1 { + VadFrameAction::FirstSilence + } else { + VadFrameAction::None + } + } + + fn reset_segment(&mut self) { + self.speech_buf.clear(); + // A hard message boundary also clears pre-roll: fast follow-up turns + // may receive less than the full window, but no frame can be decoded + // into both adjacent transcript messages. + self.pre_roll.clear(); + self.onset_frames = 0; + self.silence_frames = 0; + self.voiced_frames = 0; + self.in_speech = false; + } +} /// How long the worker waits on the audio channel before checking the shutdown flag. const RECV_TIMEOUT: Duration = Duration::from_millis(50); -/// 50 ms cooldown after TTS stops before STT re-enables. -/// Prevents the tail of TTS audio from being transcribed as speech. -/// Previous value (200 ms) was eating the first word when the user spoke -/// immediately after the agent finished. -const TTS_COOLDOWN: Duration = Duration::from_millis(50); - /// Number of ONNX Runtime intra-op threads used by the offline recognizer. /// /// Held at 1 (conservative) until we have a local A/B on real huddle audio. @@ -201,32 +353,105 @@ const TTS_COOLDOWN: Duration = Duration::from_millis(50); /// shows it's safe on the minimum-spec target. const STT_NUM_THREADS: i32 = 1; +/// EXPERIMENTAL (latency bench): override recognizer intra-op threads via +/// `BUZZ_STT_THREADS`. Default preserves the production single thread. +fn stt_num_threads() -> i32 { + std::env::var("BUZZ_STT_THREADS") + .ok() + .and_then(|v| v.parse::().ok()) + .filter(|&n| n >= 1) + .unwrap_or(STT_NUM_THREADS) +} + +/// EXPERIMENTAL (latency bench): `BUZZ_STT_SPECULATIVE=1` starts the Parakeet +/// decode at the FIRST silent VAD frame instead of after the full flush +/// window, overlapping the ~150-250 ms decode with the silence wait. If +/// speech resumes, the speculative result is discarded. When silence holds +/// to the flush threshold the transcript is emitted immediately, so the STT +/// leg collapses to ~max(flush window, decode time). +fn stt_speculative_decode() -> bool { + std::env::var("BUZZ_STT_SPECULATIVE").is_ok_and(|v| v == "1") +} + +struct SttStreamState { + resampler: rubato::Fft, + chunk_in: usize, + input_buf_48k: Vec, + leftover_16k: Vec, + vad: earshot::Detector, + endpoint: VadEndpoint, + speculative: Option<(String, usize)>, +} + +impl SttStreamState { + fn new() -> Result { + use rubato::{FixedSync, Resampler}; + + let resampler = rubato::Fft::::new(48_000, 16_000, 1024, 2, 1, FixedSync::Input) + .map_err(|error| format!("STT resampler init failed: {error}"))?; + let chunk_in = resampler.input_frames_next(); + Ok(Self { + resampler, + chunk_in, + input_buf_48k: Vec::with_capacity(chunk_in * 2), + leftover_16k: Vec::new(), + vad: earshot::Detector::new(earshot::DefaultPredictor::new()), + endpoint: VadEndpoint::new(), + speculative: None, + }) + } +} + +#[derive(Debug)] +enum SttLoopInput { + Tick, + Batch(Vec), +} + +fn run_stt_receive_loop( + audio_rx: Receiver, + shutdown: &AtomicBool, + human_floor: HumanFloor, + mut process: impl FnMut(SttLoopInput, &mut local_barge_in::LocalBargeIn), +) { + let mut local_barge_in_state = local_barge_in::WorkerLocalBargeIn::new(human_floor); + + loop { + // Check shutdown flag before blocking. + if shutdown.load(Ordering::Acquire) { + break; + } + + process(SttLoopInput::Tick, &mut local_barge_in_state); + + // Use recv_timeout so we can periodically check the shutdown flag. + let input = match audio_rx.recv_timeout(RECV_TIMEOUT) { + Ok(input) => input, + Err(mpsc::RecvTimeoutError::Timeout) => continue, + Err(mpsc::RecvTimeoutError::Disconnected) => break, // Sender dropped. + }; + + // Drain any additional pending messages to batch-process. + let mut batch = vec![input]; + while let Ok(input) = audio_rx.try_recv() { + batch.push(input); + } + process(SttLoopInput::Batch(batch), &mut local_barge_in_state); + } +} + +#[allow(clippy::too_many_arguments)] fn stt_worker( model_dir: PathBuf, - audio_rx: Receiver>, + audio_rx: Receiver, text_tx: tokio_mpsc::Sender, shutdown: Arc, - tts_active: Arc, - tts_cancel: Option>, ptt_active: Option>, + manual_mic_unmuted: Option>, + human_floor: HumanFloor, + output_device: Option, ) { - // ── 1. Initialise rubato resampler (48 kHz → 16 kHz, mono) ─────────────── - use rubato::{Fft, FixedSync, Resampler}; - - let mut resampler = match Fft::::new(48_000, 16_000, 1024, 2, 1, FixedSync::Input) { - Ok(r) => r, - Err(e) => { - eprintln!("buzz-desktop: STT resampler init failed: {e}"); - return; - } - }; - let chunk_in = resampler.input_frames_next(); - - // ── 2. Initialise earshot VAD ───────────────────────────────────────────── - use earshot::{DefaultPredictor, Detector}; - let mut vad = Detector::new(DefaultPredictor::new()); - - // ── 3. Initialise sherpa-onnx recognizer ───────────────────────────────── + // ── 1. Initialise sherpa-onnx recognizer ───────────────────────────────── // // Parakeet TDT-CTC 110M ships as a single `model.int8.onnx` (CTC head) plus // `tokens.txt`. sherpa-onnx infers the model family from which inner config @@ -249,7 +474,7 @@ fn stt_worker( let mut cfg = OfflineRecognizerConfig::default(); cfg.model_config.nemo_ctc.model = Some(model_path.to_string_lossy().into_owned()); cfg.model_config.tokens = Some(tokens_path.to_string_lossy().into_owned()); - cfg.model_config.num_threads = STT_NUM_THREADS; + cfg.model_config.num_threads = stt_num_threads(); // Explicit — defaults are not part of the API contract, and noisy debug // logging in release builds would be expensive on every VAD chunk. cfg.model_config.debug = false; @@ -263,102 +488,137 @@ fn stt_worker( } }; - // ── 4. Processing state ─────────────────────────────────────────────────── - // Leftover 48 kHz samples that didn't fill a full resampler chunk. - let mut input_buf_48k: Vec = Vec::with_capacity(chunk_in * 2); - // Leftover 16 kHz samples that didn't fill a full VAD frame. - let mut leftover_16k: Vec = Vec::new(); - // Accumulated speech frames (16 kHz). - let mut speech_buf: Vec = Vec::new(); - // Consecutive silence frame count. - let mut silence_frames: usize = 0; - // Whether we're currently in a speech segment. - let mut in_speech = false; - // Consecutive speech frames seen during TTS — used for barge-in debounce. - let mut barge_in_frames: usize = 0; - // Timestamp when TTS last stopped — used for the 200 ms cooldown. - let mut tts_stopped_at: Option = None; - - // ── 5. Main loop ────────────────────────────────────────────────────────── - let mut tts_was_active = false; - let mut ptt_was_active = ptt_active - .as_ref() - .is_some_and(|p| p.load(Ordering::Acquire)); - loop { - // Check shutdown flag before blocking. - if shutdown.load(Ordering::Acquire) { - break; + // ── 2. Independent local and remote processing state ───────────────────── + // Separate resampler/VAD state prevents simultaneous desktop and remote + // speech from being serialized into one artificial utterance. + let mut local_stream = match SttStreamState::new() { + Ok(stream) => stream, + Err(error) => { + eprintln!("buzz-desktop: {error}"); + return; } - - // Track TTS transitions to set the cooldown timer. - let tts_now = tts_active.load(Ordering::Acquire); - if tts_was_active && !tts_now { - // TTS just stopped — record the timestamp for the cooldown window. - tts_stopped_at = Some(std::time::Instant::now()); + }; + let mut remote_stream = match SttStreamState::new() { + Ok(stream) => stream, + Err(error) => { + eprintln!("buzz-desktop: {error}"); + return; } - tts_was_active = tts_now; - - // Track PTT transitions — flush accumulated speech when key is released. - // The worklet stops sending frames when PTT is inactive, so the normal - // silence-accumulation flush path never runs. We must flush here on the - // active→inactive edge to avoid buffering speech across PTT presses. - if let Some(ref ptt) = ptt_active { - let ptt_now = ptt.load(Ordering::Acquire); - if ptt_was_active && !ptt_now && in_speech && !speech_buf.is_empty() { - flush_to_stt(&speech_buf, &recognizer, &text_tx); - speech_buf.clear(); - silence_frames = 0; - in_speech = false; + }; + let speculative_enabled = stt_speculative_decode(); + let mut transmit_was_active = ptt_active + .as_ref() + .is_some_and(|ptt| ptt.load(Ordering::Acquire)) + || manual_mic_unmuted + .as_ref() + .is_some_and(|manual| manual.load(Ordering::Acquire)); + + run_stt_receive_loop( + audio_rx, + &shutdown, + human_floor.clone(), + |input, local_barge_in_state| match input { + SttLoopInput::Tick => { + // The worklet stops sending frames when both local transmit + // paths close, so flush on that edge instead of waiting for + // silence that will never arrive. + if let Some(ref ptt) = ptt_active { + let transmit_now = ptt.load(Ordering::Acquire) + || manual_mic_unmuted + .as_ref() + .is_some_and(|manual| manual.load(Ordering::Acquire)); + if transmit_was_active + && !transmit_now + && local_stream.endpoint.in_speech + && !local_stream.endpoint.speech_buf.is_empty() + { + flush_to_stt( + &local_stream.endpoint.speech_buf, + local_stream.endpoint.voiced_frames, + &recognizer, + &text_tx, + ); + local_stream.endpoint.reset_segment(); + local_stream.speculative.take(); + local_barge_in_state.release(&human_floor); + } + transmit_was_active = transmit_now; + } } - ptt_was_active = ptt_now; - } - - // Use recv_timeout so we can periodically check the shutdown flag. - let bytes = match audio_rx.recv_timeout(RECV_TIMEOUT) { - Ok(b) => b, - Err(mpsc::RecvTimeoutError::Timeout) => continue, - Err(mpsc::RecvTimeoutError::Disconnected) => break, // Sender dropped. - }; - - // Drain any additional pending messages to batch-process. - let mut batch = vec![bytes]; - while let Ok(b) = audio_rx.try_recv() { - batch.push(b); - } - - for bytes in batch { - // Convert raw bytes to f32 samples (little-endian). - let samples_48k = bytes_to_f32(&bytes); - input_buf_48k.extend_from_slice(&samples_48k); - - // Resample in chunk_in-sized blocks. - while input_buf_48k.len() >= chunk_in { - let chunk: Vec = input_buf_48k.drain(..chunk_in).collect(); - let resampled = resample_chunk(&mut resampler, &chunk); - process_16k_samples( - &resampled, - &mut leftover_16k, - &mut vad, - &mut speech_buf, - &mut silence_frames, - &mut in_speech, - &mut barge_in_frames, - &recognizer, - &text_tx, - &tts_active, - tts_cancel.as_deref(), - &mut tts_stopped_at, - ptt_active.as_ref(), - ); + SttLoopInput::Batch(batch) => { + for input in batch { + let (stream, ptt_gate, manual_gate, track_local_floor) = match input.origin { + SttAudioOrigin::Local => ( + &mut local_stream, + ptt_active.as_ref(), + manual_mic_unmuted.as_ref(), + true, + ), + SttAudioOrigin::RemoteHuman => (&mut remote_stream, None, None, false), + }; + process_stt_input( + stream, + &input.pcm_bytes, + speculative_enabled, + &recognizer, + &text_tx, + ptt_gate, + manual_gate, + &human_floor, + local_barge_in_state, + output_device.as_deref(), + track_local_floor, + ); + } } - } - } + }, + ); // No final flush — leave_huddle/end_huddle emit lifecycle events before // the STT worker exits, so a final flush would post a kind:9 message AFTER // the user has "left." Losing the last partial utterance is acceptable. } +#[allow(clippy::too_many_arguments)] +fn process_stt_input( + stream: &mut SttStreamState, + pcm_bytes: &[u8], + speculative_enabled: bool, + recognizer: &sherpa_onnx::OfflineRecognizer, + text_tx: &tokio_mpsc::Sender, + ptt_active: Option<&Arc>, + manual_mic_unmuted: Option<&Arc>, + human_floor: &HumanFloor, + local_barge_in_state: &mut local_barge_in::LocalBargeIn, + output_device: Option<&str>, + track_local_floor: bool, +) { + stream + .input_buf_48k + .extend_from_slice(&bytes_to_f32(pcm_bytes)); + + while stream.input_buf_48k.len() >= stream.chunk_in { + let chunk: Vec = stream.input_buf_48k.drain(..stream.chunk_in).collect(); + let resampled = resample_chunk(&mut stream.resampler, &chunk); + process_16k_samples( + &resampled, + &mut stream.leftover_16k, + &mut stream.vad, + &mut stream.endpoint, + SILENCE_FLUSH_FRAMES, + (speculative_enabled, &mut stream.speculative), + recognizer, + text_tx, + ptt_active, + manual_mic_unmuted, + human_floor, + local_barge_in_state, + output_device, + track_local_floor, + ); + } +} + /// Resample a mono 48 kHz chunk to 16 kHz using rubato. /// Returns the resampled samples (may be empty on error). fn resample_chunk(resampler: &mut rubato::Fft, chunk_48k: &[f32]) -> Vec { @@ -386,138 +646,124 @@ fn resample_chunk(resampler: &mut rubato::Fft, chunk_48k: &[f32]) -> Vec, vad: &mut earshot::Detector, - speech_buf: &mut Vec, - silence_frames: &mut usize, - in_speech: &mut bool, - barge_in_frames: &mut usize, + endpoint: &mut VadEndpoint, + flush_frames: usize, + speculative: (bool, &mut Option<(String, usize)>), recognizer: &sherpa_onnx::OfflineRecognizer, text_tx: &tokio_mpsc::Sender, - tts_active: &Arc, - tts_cancel: Option<&AtomicBool>, - tts_stopped_at: &mut Option, ptt_active: Option<&Arc>, + manual_mic_unmuted: Option<&Arc>, + human_floor: &HumanFloor, + local_barge_in_state: &mut local_barge_in::LocalBargeIn, + output_device: Option<&str>, + track_local_floor: bool, ) { + let (speculative_enabled, speculative) = speculative; leftover.extend_from_slice(samples); while leftover.len() >= VAD_FRAME_SAMPLES { let frame: Vec = leftover.drain(..VAD_FRAME_SAMPLES).collect(); let clamped: Vec = frame.iter().map(|&s| s.clamp(-1.0, 1.0)).collect(); let prob = vad.predict_f32(&clamped); - let is_speech = prob > VAD_THRESHOLD; - - // PTT gating: when PTT key is not held, treat as silence. - // This causes natural flush when the key is released — silence_frames - // accumulates and the existing flush logic kicks in after - // SILENCE_FLUSH_FRAMES. The 200 ms release delay + ~300 ms silence - // flush gives a natural utterance tail. - let is_speech = if let Some(ptt) = ptt_active { - is_speech && ptt.load(Ordering::Acquire) - } else { - is_speech - }; - - let tts_playing = tts_active.load(Ordering::Acquire); - - // While TTS is playing: skip accumulation (echo prevention). - if tts_playing { - if ptt_active.is_some() { - // PTT mode — PTT press handles TTS cancellation directly - // (via the global shortcut handler). Just skip accumulation. - *in_speech = false; - *barge_in_frames = 0; - speech_buf.clear(); - *silence_frames = 0; - continue; - } - - // VAD mode — barge-in detection. - // Without acoustic echo cancellation, this requires a longer - // debounce (BARGE_IN_DEBOUNCE_FRAMES ≈ 320 ms) to filter - // speaker-to-mic feedback. - if is_speech { - *barge_in_frames += 1; - if *barge_in_frames >= BARGE_IN_DEBOUNCE_FRAMES { - // Real speech detected during TTS — trigger barge-in. - if let Some(cancel) = tts_cancel { - cancel.store(true, Ordering::Release); - } - *barge_in_frames = 0; - } + let manually_open = manual_mic_unmuted.is_some_and(|manual| manual.load(Ordering::Acquire)); + let ptt_held = ptt_active.is_some_and(|ptt| ptt.load(Ordering::Acquire)); + let accepts_audio = ptt_active.is_none() || ptt_held || manually_open; + // A held shortcut means "I am not done talking": silence never ends + // the utterance while it is held. VAD pause flushing applies in pure + // VAD mode, or with a manually open mic once the shortcut is up. + let flush_allowed = vad_flush_allowed(ptt_active.is_some(), manually_open, ptt_held); + + let action = + endpoint.process_frame(frame, prob, accepts_audio, flush_allowed, flush_frames); + // Open-mic VAD semantics also apply when a PTT-mode user manually + // opens the mic. A held shortcut keeps its explicit key-down cancel. + let local_barge_in = track_local_floor + && local_barge_in::enabled(ptt_active.is_some(), manually_open, ptt_held); + if track_local_floor { + if local_barge_in { + local_barge_in_state.observe( + prob, + action == VadFrameAction::ConfirmedOnset, + human_floor, + output_device, + VAD_ONSET_THRESHOLD, + ); } else { - *barge_in_frames = 0; + local_barge_in_state.release(human_floor); } - // Don't accumulate speech during TTS (echo prevention). - *in_speech = false; - speech_buf.clear(); - *silence_frames = 0; - continue; } - // TTS not playing — check cooldown window. - if let Some(stopped) = *tts_stopped_at { - if stopped.elapsed() < TTS_COOLDOWN { - // Still in cooldown — discard but keep tracking speech state. - if !is_speech { - *in_speech = false; + match action { + VadFrameAction::ConfirmedOnset => { + speculative.take(); + } + VadFrameAction::Speech => { + // New voiced audio invalidates any speculative decode. + speculative.take(); + } + VadFrameAction::FirstSilence => { + // Start speculative decode at the first silent frame. Any + // resumed speech invalidates this result in the arm above. + if speculative_enabled + && speculative.is_none() + && flush_allowed + && has_enough_voiced_audio(endpoint.voiced_frames) + { + speculative.replace(( + decode_speech(recognizer, &endpoint.speech_buf), + endpoint.voiced_frames, + )); } - speech_buf.clear(); - *silence_frames = 0; - *barge_in_frames = 0; - continue; - } else { - // Cooldown expired — clear the timer and reset all segment state. - *tts_stopped_at = None; - *in_speech = false; - *silence_frames = 0; - *barge_in_frames = 0; } + VadFrameAction::Flush => { + match speculative.take() { + Some((text, decoded_at)) if decoded_at == endpoint.voiced_frames => { + send_transcript(text, text_tx); + } + _ => flush_to_stt( + &endpoint.speech_buf, + endpoint.voiced_frames, + recognizer, + text_tx, + ), + } + endpoint.reset_segment(); + if local_barge_in { + local_barge_in_state.release(human_floor); + } + } + VadFrameAction::None => {} } - if is_speech { - *silence_frames = 0; - *in_speech = true; - speech_buf.extend_from_slice(&frame); - - // OOM guard: flush and reset if the buffer exceeds 30 s of audio. - if speech_buf.len() >= MAX_SPEECH_SAMPLES { - flush_to_stt(speech_buf, recognizer, text_tx); - speech_buf.clear(); - *silence_frames = 0; - *in_speech = false; - } - } else if *in_speech { - // Still accumulate during brief silence gaps. - speech_buf.extend_from_slice(&frame); - *silence_frames += 1; - - // In PTT mode, don't flush on silence — accumulate the entire - // key-hold as one utterance. The PTT release edge in the main - // loop handles the flush. In VAD mode, flush after the silence - // threshold so each natural pause becomes a separate message. - if ptt_active.is_none() && *silence_frames >= SILENCE_FLUSH_FRAMES { - // End of utterance — transcribe. - flush_to_stt(speech_buf, recognizer, text_tx); - speech_buf.clear(); - *silence_frames = 0; - *in_speech = false; + // Preserve the 30 s guard even while PTT suppresses silence flushing. + if endpoint.speech_buf.len() >= MAX_SPEECH_SAMPLES { + flush_to_stt( + &endpoint.speech_buf, + endpoint.voiced_frames, + recognizer, + text_tx, + ); + endpoint.reset_segment(); + if local_barge_in { + local_barge_in_state.release(human_floor); } + speculative.take(); } - // If not in speech and not accumulating, just discard the frame. } } @@ -527,22 +773,35 @@ fn process_16k_samples( /// The tokio channel's `blocking_send` is safe to call from sync contexts. fn flush_to_stt( speech_buf: &[f32], + voiced_frames: usize, recognizer: &sherpa_onnx::OfflineRecognizer, text_tx: &tokio_mpsc::Sender, ) { if speech_buf.is_empty() { return; } + if !has_enough_voiced_audio(voiced_frames) { + eprintln!( + "buzz-desktop: STT dropped short VAD segment ({voiced_frames}/{MIN_VOICED_FRAMES} voiced frames)" + ); + return; + } + send_transcript(decode_speech(recognizer, speech_buf), text_tx); +} +/// Run the Parakeet decode on a speech buffer and return the trimmed text. +fn decode_speech(recognizer: &sherpa_onnx::OfflineRecognizer, speech_buf: &[f32]) -> String { let stream = recognizer.create_stream(); stream.accept_waveform(16_000, speech_buf); recognizer.decode(&stream); - let text = stream + stream .get_result() .map(|r| r.text.trim().to_string()) - .unwrap_or_default(); + .unwrap_or_default() +} +fn send_transcript(text: String, text_tx: &tokio_mpsc::Sender) { if !text.is_empty() { if let Err(e) = text_tx.blocking_send(text) { eprintln!("buzz-desktop: STT text channel closed: {e}"); @@ -550,6 +809,21 @@ fn flush_to_stt( } } +fn has_enough_voiced_audio(voiced_frames: usize) -> bool { + voiced_frames >= MIN_VOICED_FRAMES +} + +/// Whether a silence run may end the current utterance and flush it to STT. +/// +/// Pure VAD mode (no shortcut configured) always allows pause flushing. When +/// the push-to-talk shortcut is configured, a held shortcut is an explicit +/// "I am not done talking" signal, so silence never flushes while it is held +/// — even if the microphone is also manually open. A manually open mic with +/// the shortcut up behaves like normal VAD. +fn vad_flush_allowed(ptt_mode: bool, manually_open: bool, ptt_held: bool) -> bool { + !ptt_mode || (manually_open && !ptt_held) +} + /// Convert raw bytes (f32 LE) to f32 samples. /// Caller should ensure `bytes.len() % 4 == 0`; extra bytes are silently truncated. /// @@ -565,3 +839,7 @@ fn bytes_to_f32(bytes: &[u8]) -> Vec { // drain_until_shutdown lives in super (huddle/mod.rs) — shared with tts.rs. use super::drain_until_shutdown; + +#[cfg(test)] +#[path = "stt_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/huddle/stt_tests.rs b/desktop/src-tauri/src/huddle/stt_tests.rs new file mode 100644 index 00000000000..d7425970ced --- /dev/null +++ b/desktop/src-tauri/src/huddle/stt_tests.rs @@ -0,0 +1,260 @@ +use std::sync::{atomic::AtomicBool, mpsc, Arc, Barrier}; + +use super::{ + has_enough_voiced_audio, run_stt_receive_loop, vad_flush_allowed, HumanFloor, SttAudioInput, + SttAudioOrigin, SttLoopInput, VadEndpoint, VadFrameAction, MIN_VOICED_FRAMES, + SILENCE_FLUSH_FRAMES, VAD_FRAME_SAMPLES, VAD_ONSET_FRAMES, VAD_PRE_ROLL_FRAMES, +}; + +#[derive(Clone, Copy)] +enum WorkerExit { + Shutdown, + SenderDisconnect, +} + +fn assert_worker_exit_releases_floor(exit: WorkerExit) { + let human_floor = HumanFloor::new(); + let shutdown = Arc::new(AtomicBool::new(false)); + let (audio_tx, audio_rx) = mpsc::channel(); + let acquired = Arc::new(Barrier::new(2)); + let worker_floor = human_floor.clone(); + let worker_shutdown = Arc::clone(&shutdown); + let worker_acquired = Arc::clone(&acquired); + let worker = std::thread::spawn(move || { + run_stt_receive_loop( + audio_rx, + &worker_shutdown, + worker_floor.clone(), + |input, local_barge_in_state| { + if matches!(input, SttLoopInput::Batch(_)) && !worker_floor.is_blocked() { + local_barge_in_state.acquire(&worker_floor, true, false); + worker_acquired.wait(); + } + }, + ); + }); + + audio_tx + .send(SttAudioInput { + pcm_bytes: Vec::new(), + origin: SttAudioOrigin::Local, + }) + .expect("worker receiver is open"); + acquired.wait(); + assert!(human_floor.is_blocked()); + match exit { + WorkerExit::Shutdown => { + shutdown.store(true, std::sync::atomic::Ordering::Release); + } + WorkerExit::SenderDisconnect => drop(audio_tx), + } + worker.join().expect("worker exits cleanly"); + + let replacement_epoch = human_floor.epoch(); + assert!( + human_floor.permits(replacement_epoch), + "fresh TTS authorization must proceed after worker exit" + ); + assert!(human_floor.enter_local(true, false)); +} + +#[test] +fn worker_shutdown_releases_local_floor_for_replacement() { + assert_worker_exit_releases_floor(WorkerExit::Shutdown); +} + +#[test] +fn worker_channel_disconnect_releases_local_floor_for_replacement() { + assert_worker_exit_releases_floor(WorkerExit::SenderDisconnect); +} + +fn frame(value: f32) -> Vec { + vec![value; VAD_FRAME_SAMPLES] +} + +#[test] +fn short_vad_blips_do_not_reach_the_recognizer() { + assert!(!has_enough_voiced_audio(1)); + assert!(!has_enough_voiced_audio(MIN_VOICED_FRAMES - 1)); + assert!(has_enough_voiced_audio(MIN_VOICED_FRAMES)); +} + +#[test] +fn confirmed_onset_prepends_pre_roll_once() { + let mut endpoint = VadEndpoint::new(); + for value in 0..VAD_PRE_ROLL_FRAMES - VAD_ONSET_FRAMES { + assert_eq!( + endpoint.process_frame(frame(value as f32), 0.0, true, true, SILENCE_FLUSH_FRAMES), + VadFrameAction::None + ); + } + for value in 0..VAD_ONSET_FRAMES { + let action = endpoint.process_frame( + frame(100.0 + value as f32), + 0.9, + true, + true, + SILENCE_FLUSH_FRAMES, + ); + if value + 1 == VAD_ONSET_FRAMES { + assert_eq!(action, VadFrameAction::ConfirmedOnset); + } else { + assert_eq!(action, VadFrameAction::None); + } + } + + assert_eq!( + endpoint.speech_buf.len(), + VAD_PRE_ROLL_FRAMES * VAD_FRAME_SAMPLES + ); + assert_eq!(endpoint.speech_buf[0], 0.0); + assert_eq!(endpoint.speech_buf[VAD_FRAME_SAMPLES], 1.0); + assert_eq!(endpoint.pre_roll.len(), 0); + endpoint.process_frame(frame(200.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + assert_eq!( + endpoint.speech_buf.len(), + (VAD_PRE_ROLL_FRAMES + 1) * VAD_FRAME_SAMPLES + ); +} + +#[test] +fn onset_requires_consecutive_high_frames() { + let mut endpoint = VadEndpoint::new(); + for probability in [0.9, 0.9, 0.2, 0.9, 0.9] { + assert_eq!( + endpoint.process_frame(frame(1.0), probability, true, true, SILENCE_FLUSH_FRAMES), + VadFrameAction::None + ); + } + assert_eq!( + endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES), + VadFrameAction::ConfirmedOnset + ); +} + +#[test] +fn offset_hysteresis_preserves_borderline_speech() { + let mut endpoint = VadEndpoint::new(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + assert_eq!( + endpoint.process_frame(frame(2.0), 0.4, true, true, SILENCE_FLUSH_FRAMES), + VadFrameAction::Speech + ); + assert_eq!(endpoint.silence_frames, 0); +} + +#[test] +fn below_offset_threshold_starts_silence() { + let mut endpoint = VadEndpoint::new(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + assert_eq!( + endpoint.process_frame(frame(0.0), 0.3, true, true, SILENCE_FLUSH_FRAMES), + VadFrameAction::FirstSilence + ); + assert_eq!(endpoint.silence_frames, 1); +} + +#[test] +fn short_segment_reaches_the_visible_drop_path() { + let mut endpoint = VadEndpoint::new(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + let mut action = VadFrameAction::None; + for _ in 0..SILENCE_FLUSH_FRAMES { + action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES); + } + assert_eq!(action, VadFrameAction::Flush); + assert!(!has_enough_voiced_audio(endpoint.voiced_frames)); + assert!(!endpoint.speech_buf.is_empty()); +} + +#[test] +fn silence_flush_retains_only_hangover_audio() { + let mut endpoint = VadEndpoint::new(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(1.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + let speech_len = endpoint.speech_buf.len(); + for index in 1..=SILENCE_FLUSH_FRAMES { + let action = endpoint.process_frame(frame(0.0), 0.0, true, true, SILENCE_FLUSH_FRAMES); + if index == SILENCE_FLUSH_FRAMES { + assert_eq!(action, VadFrameAction::Flush); + } + } + assert_eq!( + endpoint.speech_buf.len(), + speech_len + 6 * VAD_FRAME_SAMPLES + ); +} + +#[test] +fn flush_boundary_never_double_includes_audio() { + const SEGMENT_N_MARKER: f32 = 777.0; + let mut endpoint = VadEndpoint::new(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame( + frame(SEGMENT_N_MARKER), + 0.9, + true, + true, + SILENCE_FLUSH_FRAMES, + ); + } + for _ in 0..SILENCE_FLUSH_FRAMES { + endpoint.process_frame( + frame(SEGMENT_N_MARKER), + 0.0, + true, + true, + SILENCE_FLUSH_FRAMES, + ); + } + endpoint.reset_segment(); + + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + let leaked = endpoint + .speech_buf + .iter() + .filter(|sample| **sample == SEGMENT_N_MARKER) + .count(); + assert_eq!(leaked, 0, "segment N audio leaked into segment N+1"); +} + +#[test] +fn reset_prevents_pre_roll_from_leaking_between_segments() { + const SEGMENT_N_MARKER: f32 = 777.0; + let mut endpoint = VadEndpoint::new(); + endpoint.pre_roll.push_back(frame(SEGMENT_N_MARKER)); + endpoint.reset_segment(); + for _ in 0..VAD_ONSET_FRAMES { + endpoint.process_frame(frame(2.0), 0.9, true, true, SILENCE_FLUSH_FRAMES); + } + let leaked = endpoint + .speech_buf + .iter() + .filter(|sample| **sample == SEGMENT_N_MARKER) + .count(); + assert_eq!(leaked, 0, "segment N pre-roll leaked into segment N+1"); +} + +#[test] +fn held_push_to_talk_never_silence_flushes() { + // Pure VAD mode: silence always ends the utterance. + assert!(vad_flush_allowed(false, false, false)); + // Shortcut configured, nothing transmitting: nothing to flush anyway, + // but the pause path stays closed. + assert!(!vad_flush_allowed(true, false, false)); + // Shortcut held: "I am not done talking" — never flush on silence, + // regardless of the manual mic state. + assert!(!vad_flush_allowed(true, false, true)); + assert!(!vad_flush_allowed(true, true, true)); + // Manually open mic with the shortcut up: normal VAD behavior. + assert!(vad_flush_allowed(true, true, false)); +} diff --git a/desktop/src-tauri/src/huddle/transcription.rs b/desktop/src-tauri/src/huddle/transcription.rs index 5962f57cf43..4825d4b8fbd 100644 --- a/desktop/src-tauri/src/huddle/transcription.rs +++ b/desktop/src-tauri/src/huddle/transcription.rs @@ -51,7 +51,7 @@ pub async fn set_huddle_transcription_enabled( (ephemeral_channel_id, None) } else { hs.invalidate_transcription_pipeline(); - (ephemeral_channel_id, hs.stt_pipeline.take()) + (ephemeral_channel_id, hs.take_stt_pipeline()) } }; diff --git a/desktop/src-tauri/src/huddle/tts.rs b/desktop/src-tauri/src/huddle/tts.rs index c03589f9fe4..3f12f883ba7 100644 --- a/desktop/src-tauri/src/huddle/tts.rs +++ b/desktop/src-tauri/src/huddle/tts.rs @@ -7,9 +7,9 @@ //! → bounded sync_channel (TEXT_QUEUE_DEPTH = 8) //! → tts_worker thread (owns 1 Pocket TTS engine + 1 persistent Player) //! 1. Preprocess text -//! 2. Split into sentences -//! 3. Synthesize each sentence individually → f32 PCM -//! 4. Clamp to full scale + fade out each sentence +//! 2. Split into tokenizer-safe natural units, prioritizing sentence one +//! 3. Synthesize each unit → f32 PCM +//! 4. Clamp to full scale + fade out each unit //! 5. Append each buffer to the persistent rodio Player (gapless) //! 6. While audio is draining, keep pulling queued text items and //! synthesizing ahead — playback of item N overlaps synthesis of @@ -18,10 +18,9 @@ //! → cancel flag: a 10 ms barge-in monitor thread silences the player and //! releases tts_active on the flag's rising edge (~15 ms flag-to-silence, //! even mid-sentence while the worker is blocked in synth_chunk); the -//! worker then consumes the flag — drain queue + clear + play (un-pause). -//! Monitor clears and worker player mutations are serialized through the -//! `player_ops` mutex, with the flag re-checked under the lock — see the -//! monitor block in `tts_worker` for the race this closes. +//! worker then consumes the flag and drains stale text. Every Player +//! operation is serialized by `PlaybackCoordinator`; cancellation swaps in +//! a fresh queue and drops the old Player after releasing the coordinator. //! ``` //! //! Lookahead pipelining spans *items*, not just sentences within one item: @@ -35,25 +34,30 @@ //! can gate microphone input while the agent is speaking. use std::{ - collections::VecDeque, + collections::{HashMap, VecDeque}, num::NonZero, path::PathBuf, sync::{ atomic::{AtomicBool, AtomicU64, Ordering}, mpsc::{self, SyncSender}, - Arc, Mutex, MutexGuard, PoisonError, + Arc, Mutex, }, thread, - time::Duration, + time::{Duration, Instant}, }; +use super::human_floor::HumanFloor; use super::pocket::{ load_text_to_speech, load_voice_style, DEFAULT_VOICE, SAMPLE_RATE, VOICE_FILE_EXT, }; -use super::preprocessing::{preprocess_for_tts, split_sentences}; +use super::preprocessing::preprocess_for_tts; #[path = "tts_voice_transition.rs"] mod voice_transition; +use super::tts_playback::*; +#[path = "tts_append.rs"] +mod append; +use append::*; use voice_transition::*; #[path = "tts_startup.rs"] mod startup; @@ -61,6 +65,23 @@ use startup::await_worker_startup; #[path = "tts_audio.rs"] mod audio; use audio::*; +#[path = "tts_activity.rs"] +mod activity; +use activity::*; +#[path = "tts_pipeline_controls.rs"] +mod pipeline_controls; +#[path = "tts_speaker_cancellation.rs"] +mod speaker_cancellation; +use speaker_cancellation::*; +#[path = "tts_streaming.rs"] +mod streaming; +use streaming::*; +#[path = "tts_broadcast.rs"] +mod broadcast; +use broadcast::TtsBroadcasters; +pub(crate) use broadcast::{ + LocalTtsPublisherLease, LocalTtsPublishers, TtsAudioPublisher, TtsBroadcastPacket, +}; // ── Constants ───────────────────────────────────────────────────────────────── @@ -77,6 +98,7 @@ const RECV_TIMEOUT: Duration = Duration::from_millis(100); /// ~5 ms — so playing audio dies ~15 ms after the flag is set, even while /// the worker is blocked inside `synth_chunk`. const MONITOR_TICK: Duration = Duration::from_millis(10); +const SPEAKER_ACTIVITY_TICK: Duration = Duration::from_millis(50); const AUDIO_PRIME_TIMEOUT: Duration = Duration::from_secs(2); /// Pocket TTS is a one-step consistency model, not diffusion. Kept for API compat. @@ -90,39 +112,37 @@ const SYNTH_STEPS: usize = 1; /// the leading waveform is important. const FADE_OUT_SAMPLES: usize = (SAMPLE_RATE as f64 * 0.008) as usize; -/// Length of the zero-sample cushion prepended before each synthesized -/// sentence chunk, so the OS audio device / rodio mixer has a fully-quiet -/// ramp-up window before the real onset hits. -/// -/// This used to be applied only before the first sentence of a whole response. -/// That still left later sentence chunks vulnerable to first-syllable clipping -/// when their first phoneme was soft (notably `I'm` / `I've`) and rodio crossed -/// from an explicit silence buffer straight into non-zero speech. 20 ms ≈ 480 -/// samples is enough to cover a CoreAudio buffer turnover without being audible -/// as latency. At sentence boundaries this lead-in is budgeted out of the -/// existing inter-sentence pause, so it does not lengthen multi-sentence gaps. -const SENTENCE_LEAD_IN_SAMPLES: usize = (SAMPLE_RATE as f64 * 0.020) as usize; - -/// Approximate character budget for one synthesis chunk. -/// -/// Upstream pocket-tts groups sentences into chunks of up to -/// `MAX_TOKEN_PER_CHUNK = 50` tokenizer tokens (`default_parameters.py`) — -/// typically multi-sentence chunks — because every `generate()` call is an -/// independent generation with a cold FlowLM start, and each chunk boundary -/// is an exposed prosody seam (kyutai-labs/pocket-tts #151; the Kyutai team -/// names chunk stitching as the reliability lever). Our previous -/// sentence-per-call path created ~2–4× more seams than upstream. -/// -/// This character budget performs only coarse sentence packing. The April -/// engine applies its SentencePiece tokenizer afterward and refines every -/// result at the bundle's exact 50-token boundary. -const MAX_CHUNK_CHARS: usize = 200; - -/// Silence inserted between sentences by the TTS pipeline (seconds). -/// Injected as a silent buffer between each synthesized sentence chunk. -const INTER_SENTENCE_SILENCE: f32 = 0.1; +/// rodio 0.22.2 bootstraps `UniformSourceIterator` when a source is added to +/// the mixer (`conversions/uniform.rs:49-66`). Its empty queue's 512-sample +/// span (`queue.rs::SourcesQueueInput::new`) can therefore retain placeholder +/// format metadata until the next span. The lead-in covers that whole span, +/// rounded up to the next millisecond, while preserving the product's existing +/// 20 ms quiet ramp-up. Continuously queued chunks receive no synthetic padding. +const SAMPLES_PER_MS: usize = SAMPLE_RATE as usize / 1_000; +const PRODUCT_RAMP_UP_MS: usize = 20; +const PRODUCT_RAMP_UP_SAMPLES: usize = PRODUCT_RAMP_UP_MS * SAMPLES_PER_MS; +const RODIO_ADD_BOOTSTRAP_SPAN_SAMPLES: usize = 512; +const RODIO_ADD_BOOTSTRAP_CUSHION_MS: usize = + RODIO_ADD_BOOTSTRAP_SPAN_SAMPLES.div_ceil(SAMPLES_PER_MS); +const SENTENCE_LEAD_IN_SAMPLES: usize = { + let bootstrap_cushion = RODIO_ADD_BOOTSTRAP_CUSHION_MS * SAMPLES_PER_MS; + if PRODUCT_RAMP_UP_SAMPLES > bootstrap_cushion { + PRODUCT_RAMP_UP_SAMPLES + } else { + bootstrap_cushion + } +}; -type WorkerControlState = (Arc, Arc, WorkerCancelSignals); +type WorkerControlState = ( + Arc, + Arc, + WorkerCancelSignals, + SpeakerGenerations, + ActiveSpeaker, + SpeakerCancellation, + PlaybackProbe, + TtsBroadcasters, +); // ── Public pipeline handle ──────────────────────────────────────────────────── @@ -142,6 +162,7 @@ pub struct TtsPipeline { /// Kept alive here so the Arc isn't dropped — the worker holds a clone. #[allow(dead_code)] cancel: Arc, + human_floor: HumanFloor, /// Internal cancellation used only for voice changes. Kept separate so a /// concurrent human barge-in always clears every queued message. voice_cancel: Arc, @@ -150,8 +171,20 @@ pub struct TtsPipeline { voice: Arc>, /// Tags messages so a voice change drops only pre-change queue entries. voice_generation: Arc, + /// Per-agent generations let removal invalidate that agent's queued and + /// in-flight text without poisoning speech queued after the agent rejoins. + speaker_generations: SpeakerGenerations, + /// Speaker whose audio currently owns the shared player queue. + active_speaker: ActiveSpeaker, + /// Targeted cancellation used when an agent leaves the huddle. + speaker_cancel: SpeakerCancellation, + /// Shared player handle used to reject Stop clicks after playback drains. + playback_probe: PlaybackProbe, /// Completed after the worker drains pre-change text and installs the new style. voice_change_ack: VoiceChangeAck, + /// Agent-authenticated Huddle publishers used to carry synthesized speech + /// to remote clients without impersonating the hosting human. + broadcasters: TtsBroadcasters, /// Worker thread handle — taken on drop to join cleanly. thread: Option>, } @@ -165,15 +198,19 @@ impl TtsPipeline { model_dir: PathBuf, tts_active: Arc, cancel: Arc, + human_floor: HumanFloor, voice: &str, output_device: Option, + activity_app: Option, ) -> Result { let (text_tx, text_rx) = mpsc::sync_channel::(TEXT_QUEUE_DEPTH); let shutdown = Arc::new(AtomicBool::new(false)); - // cancel is passed in from HuddleState.tts_cancel — shared with STT for barge-in. + // cancel is passed in from HuddleState.tts_cancel — shared with remote + // participant interruption and the push-to-talk shortcut. let shutdown_worker = Arc::clone(&shutdown); let cancel_worker = Arc::clone(&cancel); + let worker_human_floor = human_floor.clone(); let voice_cancel = Arc::new(AtomicBool::new(false)); let worker_voice_cancel = Arc::clone(&voice_cancel); let tts_active_worker = Arc::clone(&tts_active); @@ -181,8 +218,18 @@ impl TtsPipeline { let voice_worker = Arc::clone(&voice); let voice_generation = Arc::new(AtomicU64::new(1)); let worker_voice_generation = Arc::clone(&voice_generation); + let speaker_generations = Arc::new(Mutex::new(HashMap::new())); + let worker_speaker_generations = Arc::clone(&speaker_generations); + let active_speaker = Arc::new(Mutex::new(None)); + let worker_active_speaker = Arc::clone(&active_speaker); + let speaker_cancel = Arc::new(Mutex::new(None)); + let worker_speaker_cancel = Arc::clone(&speaker_cancel); + let playback_probe = PlaybackProbe::new(); + let worker_playback_probe = playback_probe.clone(); let voice_change_ack = Arc::new(Mutex::new(None)); let worker_voice_change_ack = Arc::clone(&voice_change_ack); + let broadcasters = TtsBroadcasters::default(); + let worker_broadcasters = broadcasters.clone(); let model_dir_worker = model_dir.clone(); let (startup_tx, startup_rx) = mpsc::sync_channel(1); @@ -197,12 +244,19 @@ impl TtsPipeline { worker_voice_change_ack, ), text_rx, + worker_human_floor, ( tts_active_worker, shutdown_worker, (cancel_worker, worker_voice_cancel), + worker_speaker_generations, + worker_active_speaker, + worker_speaker_cancel, + worker_playback_probe, + worker_broadcasters, ), output_device, + activity_app, startup_tx, ) }) @@ -214,85 +268,25 @@ impl TtsPipeline { tts_active, shutdown, cancel, + human_floor, voice_cancel, voice, voice_generation, + speaker_generations, + active_speaker, + speaker_cancel, + playback_probe, voice_change_ack, + broadcasters, thread: Some(handle), }) } - - /// Queue `text` for TTS synthesis and playback. - /// - /// Non-blocking. Returns `Err` if the queue is full (bounded at - /// `TEXT_QUEUE_DEPTH`) — caller may log and discard. - pub fn speak(&self, text: String) -> Result<(), String> { - self.text_tx - .try_send(QueuedText { - generation: self.voice_generation.load(Ordering::Acquire), - route_id: 0, - text, - }) - .map_err(|e| { - eprintln!("buzz-desktop: TTS queue saturated, dropping message: {e}"); - format!("TTS queue full, dropping: {e}") - }) - } - - /// Clone the bounded queue sender so callers can apply backpressure without - /// holding the huddle mutex. Disabling TTS drops the receiver and unblocks - /// any waiting sender while the shared cancellation flag stops playback. - pub(crate) fn text_sender(&self) -> TtsTextSender { - TtsTextSender { - text_tx: self.text_tx.clone(), - generation: self.voice_generation.load(Ordering::Acquire), - } - } - - /// Select a bundled Pocket voice for subsequent speech. - /// - /// Current playback and queued text are cancelled immediately so content - /// cannot continue in the old voice. The worker keeps its warmed inference - /// engine and reloads only the reference style before the next utterance. - pub fn select_voice(&self, voice: &str) -> Option> { - let acknowledged = begin_voice_change( - &self.voice, - &self.voice_generation, - &self.voice_cancel, - &self.voice_change_ack, - voice, - ); - if acknowledged.is_some() { - eprintln!("buzz-desktop: tts stage=cancellation reason=voice_switch route_id=0"); - } - acknowledged - } - - /// Reconcile the voice of a pipeline that has not been published yet. - /// - /// No caller can enqueue text before publication, so raising the shared - /// cancellation flag here would create a race that could discard the first - /// message queued immediately after installation. - pub(crate) fn select_voice_before_publish(&self, voice: &str) { - *self.voice.lock().unwrap_or_else(|error| error.into_inner()) = voice.to_string(); - } - - /// Signal the worker thread to stop. - pub fn shutdown(&self) { - eprintln!("buzz-desktop: tts stage=cancellation reason=shutdown route_id=0"); - self.shutdown.store(true, Ordering::Release); - } - - /// Returns `true` if the worker thread has exited (init failure, crash, or normal exit). - /// Used by hot-start to detect dead pipelines and clear them for retry. - pub fn is_finished(&self) -> bool { - self.thread.as_ref().is_none_or(|h| h.is_finished()) - } } impl Drop for TtsPipeline { fn drop(&mut self) { self.shutdown.store(true, Ordering::Release); + self.broadcasters.shutdown(); // Dropping `text_tx` unblocks the worker's recv_timeout loop. // Join to ensure the audio thread exits cleanly. if let Some(thread) = self.thread.take() { @@ -303,16 +297,49 @@ impl Drop for TtsPipeline { // ── Worker thread ───────────────────────────────────────────────────────────── +fn authorize_or_defer_queued_text( + human_floor: &HumanFloor, + deferred_text: &mut VecDeque, + queued_text: QueuedText, +) -> Result { + match human_floor.authorization(queued_text.floor_epoch) { + HumanFloorAuthorization::Blocked => { + deferred_text.push_front(queued_text); + Err(HumanFloorAuthorization::Blocked) + } + HumanFloorAuthorization::Stale => { + eprintln!( + "buzz-desktop: tts stage=queue status=dropped reason=barge_in route_id={}", + queued_text.route_id + ); + Err(HumanFloorAuthorization::Stale) + } + HumanFloorAuthorization::Permitted => Ok(queued_text), + } +} + +#[allow(clippy::too_many_arguments)] fn tts_worker( model_dir: PathBuf, voice_state: WorkerVoiceState, text_rx: mpsc::Receiver, + human_floor: HumanFloor, control_state: WorkerControlState, output_device: Option, + activity_app: Option, startup_tx: mpsc::SyncSender>, ) { let (selected_voice, voice_generation, voice_change_ack) = voice_state; - let (tts_active, shutdown, cancel_signals) = control_state; + let ( + tts_active, + shutdown, + cancel_signals, + speaker_generations, + active_speaker, + speaker_cancel, + playback_probe, + broadcasters, + ) = control_state; let (cancel, voice_cancel) = cancel_signals; // ── 1. Initialise TTS engine ────────────────────────────────────────────── let model_dir_str = model_dir.to_string_lossy().to_string(); @@ -351,6 +378,7 @@ fn tts_worker( )); return; } + let mut style_cache = HashMap::from([(voice_name.clone(), style.clone())]); // ── 2b. Warmup inference ───────────────────────────────────────────────── // The first ONNX inference on any session is significantly slower than @@ -368,7 +396,6 @@ fn tts_worker( // ── 3. Initialise rodio output device ───────────────────────────────────── use rodio::buffer::SamplesBuffer; - use rodio::Player; let sink_handle = match super::audio_output::open_output_sink_by_name(output_device.as_deref()) { @@ -396,27 +423,25 @@ fn tts_worker( } }; - // Single persistent Player for the lifetime of the worker — all sentence - // buffers from all text items append here, and rodio plays them gaplessly. - // Persistence is what enables cross-item pipelining: the worker never - // waits for one item to drain before synthesizing the next. - // - // Shared (Arc) with the barge-in monitor thread below, which needs to - // silence it while this thread is blocked inside `synth_chunk`. - let player = Arc::new(Player::connect_new(sink_handle.mixer())); + // One coordinator owns the current Player, floor state, and every operation. + // It was allocated with the huddle state so onset and playback share the + // same serialization boundary even before the TTS worker starts. + let playback = human_floor.playback(); + playback.bind_mixer(sink_handle.mixer()); + playback_probe.install(Arc::clone(&playback)); // Prime the audio output stream with a short silent buffer. // On macOS, CoreAudio initializes the output device lazily on first use. // Without this, the first real append races against device startup and - // player.empty() returns true before audio has started draining — causing + // playback.empty() returns true before audio has started draining — causing // the first TTS message to be truncated after a few words. { let silence = vec![0.0f32; SAMPLE_RATE as usize / 10]; // 100ms of silence - player.append(SamplesBuffer::new(channels, rate, silence)); + playback.append_untracked(SamplesBuffer::new(channels, rate, silence)); // Wait for the silent buffer to drain — this ensures the output stream // is fully initialized before the first real utterance. let deadline = std::time::Instant::now() + AUDIO_PRIME_TIMEOUT; - while !player.empty() { + while !playback.empty() { if std::time::Instant::now() >= deadline { eprintln!("buzz-desktop: tts stage=startup status=failed reason=output_prime"); let _ = startup_tx.send(Err( @@ -432,59 +457,20 @@ fn tts_worker( } eprintln!("buzz-desktop: tts stage=startup status=ready"); - // ── 3b. Barge-in monitor thread ─────────────────────────────────────────── - // - // The worker loop only observes `cancel` between sentences — while it is - // blocked inside `synth_chunk` (hundreds of ms for a long sentence), - // nothing would silence the audio that is already playing. The monitor - // closes that gap: every MONITOR_TICK it checks the flag and, while set, - // silences the player and releases the mic gate. It does NOT consume the - // flag — the worker still owns that (drain queue, reset lead-in), so the - // monitor keeps re-clearing until the worker catches up, which also - // covers a sentence appended in the race window after the worker's own - // post-synthesis cancel check. - // - // `player_ops` closes the converse race (found in review): the monitor - // loads `cancel == true`, is preempted, the worker consumes the cancel - // and appends a fresh post-cancel utterance, then the monitor resumes - // from its stale branch and deletes audio that was meant to play. All - // worker player mutations (appends and cancel/shutdown clears) hold this - // lock, and the monitor re-checks `cancel` *while holding it* — so its - // clear either runs before fresh audio can be appended, or observes - // `cancel == false` and no-ops. The lock is uncontended except during an - // actual barge-in, so the hot path is unaffected. - let player_ops = Arc::new(Mutex::new(())); + let activity_frames = Arc::new(Mutex::new(VecDeque::::new())); let monitor_stop = Arc::new(AtomicBool::new(false)); - let monitor = { - let player = Arc::clone(&player); - let cancel = Arc::clone(&cancel); - let voice_cancel = Arc::clone(&voice_cancel); - let tts_active = Arc::clone(&tts_active); - let stop = Arc::clone(&monitor_stop); - let player_ops = Arc::clone(&player_ops); - thread::Builder::new() - .name("tts-barge-in-monitor".into()) - .spawn(move || { - while !stop.load(Ordering::Acquire) { - if cancel.load(Ordering::Acquire) || voice_cancel.load(Ordering::Acquire) { - let _ops = lock_player_ops(&player_ops); - // Re-check under the lock: the worker may have - // consumed this cancel (and appended fresh audio) - // between the load above and the lock acquisition. - if cancel.load(Ordering::Acquire) || voice_cancel.load(Ordering::Acquire) { - // clear() pauses the persistent player; play() - // un-pauses (see handle_cancel_or_shutdown). - // Idempotent — safe to repeat every tick until - // the worker consumes the flag. - player.clear(); - player.play(); - tts_active.store(false, Ordering::Release); - } - } - thread::sleep(MONITOR_TICK); - } - }) - }; + let monitor = spawn_tts_monitor(TtsMonitorState { + playback: Arc::clone(&playback), + cancel: Arc::clone(&cancel), + voice_cancel: Arc::clone(&voice_cancel), + tts_active: Arc::clone(&tts_active), + stop: Arc::clone(&monitor_stop), + activity_frames: Arc::clone(&activity_frames), + active_speaker: Arc::clone(&active_speaker), + speaker_cancel: Arc::clone(&speaker_cancel), + broadcasters: broadcasters.clone(), + activity_app, + }); if let Err(ref e) = monitor { // Degraded but functional: barge-in still works between sentences // via the worker's own checks, just not mid-synthesis. @@ -499,44 +485,65 @@ fn tts_worker( // `tts_active` lifecycle: set on the first append while idle, cleared // whenever the player has fully drained — either in the idle timeout // arm or on item receipt before synthesis begins. - let silence_buf_len = (INTER_SENTENCE_SILENCE * SAMPLE_RATE as f32) as usize; - // `first_append` = "no audio queued since the player last went idle". - // Flipped by `build_sentence_append_buffer` on the first real append; the - // idle branch below uses it to decide when to drop `tts_active` and to - // arm a fresh lead-in cushion for the next utterance. - let mut first_append = true; + // EXPERIMENTAL (latency bench): `Some(emit_frames)` = stream PCM deltas + // out of Pocket as they are generated (see tts_streaming.rs). + let tts_streaming = streaming_emit_frames(); let mut last_route_id = 0; let mut deferred_text = VecDeque::new(); - let append_audio = |prepared: PreparedModelAudio, route_id: u64| { - let _ops = lock_player_ops(&player_ops); + let append_context = TtsAppendContext { + playback: &playback, + #[cfg(test)] + human_floor: &human_floor, + cancel: &cancel, + voice_cancel: &voice_cancel, + shutdown: &shutdown, + tts_active: &tts_active, + speaker_generations: &speaker_generations, + active_speaker: &active_speaker, + activity_frames: &activity_frames, + broadcasters: &broadcasters, + channels, + rate, + }; + let append_audio = |prepared: PreparedModelAudio, + route_id: u64, + speaker_pubkey: Option<&str>, + speaker_generation: u64, + floor_epoch: u64| { + let broadcast_samples = speaker_pubkey.map(|_| prepared.buffer.clone()); + append_worker_audio( + &append_context, + prepared, + route_id, + speaker_pubkey, + speaker_generation, + floor_epoch, + || { + if let (Some(pubkey), Some(samples)) = (speaker_pubkey, broadcast_samples) { + broadcasters.publish(pubkey, speaker_generation, samples); + } + }, + ) + }; + + loop { + let mut no_current_text = None; + if consume_speaker_cancel( + &speaker_cancel, + &active_speaker, + &speaker_generations, + &tts_active, + (&text_rx, &mut deferred_text, &mut no_current_text), + Some(&playback), + ) { + continue; + } if cancel.load(Ordering::Acquire) || voice_cancel.load(Ordering::Acquire) || shutdown.load(Ordering::Acquire) { - let reason = if shutdown.load(Ordering::Acquire) { - "shutdown" - } else if cancel.load(Ordering::Acquire) { - "barge_in" - } else { - "voice_switch" - }; - eprintln!( - "buzz-desktop: tts stage=synthesis status=cancelled reason={reason} route_id={route_id}" - ); - return false; + broadcasters.cancel_all(); } - player.append(SamplesBuffer::new(channels, rate, prepared.buffer)); - eprintln!( - "buzz-desktop: tts stage=player status=append_accepted route_id={route_id} chunk_index={} sample_count={}", - prepared.chunk_index, prepared.sample_count - ); - // Set this only after append so STT remains open during synthesis. - tts_active.store(true, Ordering::Release); - true - }; - - loop { - let mut no_current_text = None; if handle_cancel_or_shutdown( (&cancel, &voice_cancel), &shutdown, @@ -544,25 +551,29 @@ fn tts_worker( (&text_rx, &mut deferred_text, &mut no_current_text), &voice_change_ack, None, - Some((&player, &player_ops)), + Some(&playback), ) { if shutdown.load(Ordering::Acquire) { break; } // Cancel consumed: queued audio cleared, queue drained. The next // append starts a new utterance and needs its own lead-in cushion. - first_append = true; continue; } - // Voice changes cancel the old utterance/queue and are observed here, - // before receiving subsequent text. A bad bundled asset falls back to - // Mary without discarding the already-warmed Pocket engine. - let voice_ready = - reconcile_selected_voice(&model_dir, &selected_voice, &mut voice_name, &mut style); - acknowledge_voice_change(&voice_change_ack, &voice_cancel); - if !voice_ready { - continue; + // A global Settings voice change cancels the old utterance and is + // acknowledged before receiving subsequent text. Per-agent voice + // changes are carried by each queue item and never drain other agents. + if has_pending_voice_change(&voice_change_ack) { + let voice_ready = + reconcile_selected_voice(&model_dir, &selected_voice, &mut voice_name, &mut style); + if voice_ready { + style_cache.insert(voice_name.clone(), style.clone()); + } + acknowledge_voice_change(&voice_change_ack, &voice_cancel); + if !voice_ready { + continue; + } } let mut queued_text = Some(match deferred_text.pop_front() { @@ -573,13 +584,16 @@ fn tts_worker( // Nothing queued. If playback has also finished, the agent // has gone quiet — release the mic gate and reset the // lead-in so the next utterance gets a fresh cushion. - if player.empty() && !first_append { + playback.release_if_drained(|| { tts_active.store(false, Ordering::Release); + active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()) + .take(); eprintln!( "buzz-desktop: tts stage=player status=drained route_id={last_route_id}" ); - first_append = true; - } + }); continue; } Err(mpsc::RecvTimeoutError::Disconnected) => break, @@ -589,6 +603,12 @@ fn tts_worker( // Check cancel again after unblocking — a cancel may have arrived // while we were waiting. let pending_route_id = queued_text.as_ref().map(|queued| queued.route_id); + if cancel.load(Ordering::Acquire) + || voice_cancel.load(Ordering::Acquire) + || shutdown.load(Ordering::Acquire) + { + broadcasters.cancel_all(); + } if handle_cancel_or_shutdown( (&cancel, &voice_cancel), &shutdown, @@ -596,17 +616,23 @@ fn tts_worker( (&text_rx, &mut deferred_text, &mut queued_text), &voice_change_ack, pending_route_id, - Some((&player, &player_ops)), + Some(&playback), ) { if shutdown.load(Ordering::Acquire) { break; } - first_append = true; continue; } let Some(queued_text) = queued_text else { continue; }; + if !queued_speaker_is_current(&speaker_generations, &queued_text) { + eprintln!( + "buzz-desktop: tts stage=queue status=dropped reason=speaker_removed route_id={}", + queued_text.route_id + ); + continue; + } if queued_text.generation < voice_generation.load(Ordering::Acquire) { eprintln!( "buzz-desktop: tts stage=queue status=dropped reason=voice_switch route_id={}", @@ -614,35 +640,82 @@ fn tts_worker( ); continue; } + if !playback.empty() + && queued_text + .speaker_pubkey + .as_deref() + .is_some_and(|speaker| { + active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()) + .as_deref() + .is_some_and(|active| !active.eq_ignore_ascii_case(speaker)) + }) + { + deferred_text.push_front(queued_text); + thread::sleep(RECV_TIMEOUT); + continue; + } + let mut queued_text = + match authorize_or_defer_queued_text(&human_floor, &mut deferred_text, queued_text) { + Ok(queued_text) => queued_text, + Err(HumanFloorAuthorization::Blocked) => { + thread::sleep(RECV_TIMEOUT); + continue; + } + Err(HumanFloorAuthorization::Stale) => continue, + Err(HumanFloorAuthorization::Permitted) => { + unreachable!("permitted text is returned") + } + }; + let requested_voice = queued_text.voice_reference.take().unwrap_or_else(|| { + selected_voice + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clone() + }); let raw_text = queued_text.text; + let speaker_pubkey = queued_text.speaker_pubkey; + let speaker_generation = queued_text.speaker_generation; + let floor_epoch = queued_text.floor_epoch; let route_id = queued_text.route_id; eprintln!("buzz-desktop: tts stage=synthesis status=started route_id={route_id}"); - // The selected voice can change while this worker is blocked in - // recv_timeout. Reconcile again after receipt so the first message - // queued after an unpublished pipeline is installed cannot use the - // voice captured when construction began. - if !reconcile_selected_voice(&model_dir, &selected_voice, &mut voice_name, &mut style) { + // If playback already drained while we were waiting for this item, + // release stale ownership before doing any potentially slow voice or + // synthesis work. Serialize the drain decision with Stop and append so + // those paths observe one coherent utterance boundary. + playback.release_if_drained(|| { + tts_active.store(false, Ordering::Release); + active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()) + .take(); + eprintln!("buzz-desktop: tts stage=player status=drained route_id={last_route_id}"); + }); + + // From this point until the item finishes, an empty player can mean a + // voice-preparation or synthesis gap rather than a drained utterance. + // Stop must remain able to invalidate the in-flight speaker generation. + let _synthesis_flight = playback_probe.begin_synthesis(); + + // The selected per-agent voice travels with the queue item, preserving + // message order while allowing one warmed Pocket engine to alternate + // between cached reference styles. + if !reconcile_queued_voice( + &model_dir, + &requested_voice, + &selected_voice, + &mut voice_name, + &mut style, + &mut style_cache, + ) { eprintln!( "buzz-desktop: tts stage=synthesis status=failed reason=voice_unavailable route_id={route_id}" ); continue; } - // If playback already drained while we were waiting for this item, - // the agent is silent — release the mic gate BEFORE preprocessing/ - // synthesis. Without this, an item arriving inside the recv timeout - // window would run the whole synthesis pass with `tts_active` stuck - // true and nothing playing, making STT discard human speech as - // "echo" during a silent window. (Pipelining is unaffected: when - // audio is still draining, `player.empty()` is false and the flag - // stays set across items.) - if player.empty() && !first_append { - tts_active.store(false, Ordering::Release); - eprintln!("buzz-desktop: tts stage=player status=drained route_id={last_route_id}"); - first_append = true; - } - // Preprocess text. let text = preprocess_for_tts(&raw_text); if text.is_empty() { @@ -652,17 +725,20 @@ fn tts_worker( continue; } - // Split into sentences, then group into synthesis chunks: the first - // sentence stays alone (fast time-to-first-audio), the rest pack - // greedily up to MAX_CHUNK_CHARS. Playback of each model unit overlaps - // synthesis of the next one. The Pocket engine applies its exact - // 50-token split; keeping those units within one playback chunk avoids - // adding fades and pauses at token-only boundaries. - let sentences: Vec = split_sentences(&text) - .into_iter() - .filter(|s| !s.trim().is_empty()) - .collect(); - let chunks = group_sentences_into_chunks(&sentences, MAX_CHUNK_CHARS); + // Let Pocket's tokenizer-aware splitter isolate the first sentence for + // minimum time-to-first-audio, then pack later sentences into the + // largest natural units within the model's exact 50-token limit. Once + // each unit is appended, generation of the next proceeds while rodio + // plays the already-queued audio. + let chunks = match engine.split_text_for_playback(&text) { + Ok(chunks) => chunks, + Err(_) => { + eprintln!( + "buzz-desktop: tts stage=synthesis status=failed reason=chunking route_id={route_id}" + ); + continue; + } + }; if chunks.is_empty() { eprintln!( "buzz-desktop: tts stage=synthesis status=empty reason=no_chunks route_id={route_id}" @@ -675,6 +751,12 @@ fn tts_worker( let mut model_unit_index = 0_usize; 'playback_chunks: for chunk in &chunks { let mut no_current_text = None; + if cancel.load(Ordering::Acquire) + || voice_cancel.load(Ordering::Acquire) + || shutdown.load(Ordering::Acquire) + { + broadcasters.cancel_all(); + } if handle_cancel_or_shutdown( (&cancel, &voice_cancel), &shutdown, @@ -682,9 +764,8 @@ fn tts_worker( (&text_rx, &mut deferred_text, &mut no_current_text), &voice_change_ack, Some(route_id), - Some((&player, &player_ops)), + Some(&playback), ) { - first_append = true; synthesis_outcome = "cancelled"; break; } @@ -694,6 +775,41 @@ fn tts_worker( continue; } + // EXPERIMENTAL (latency bench): streaming synthesis path — see + // tts_streaming.rs for the mechanics and exactness constraints. + if let Some(emit_frames) = tts_streaming { + let outcome = synthesize_streaming( + &engine, + text, + &style, + emit_frames, + (&cancel, &voice_cancel, &shutdown), + StreamingPlayback { + playback: &playback, + route_id, + }, + &mut |prepared| { + if !append_audio( + prepared, + route_id, + speaker_pubkey.as_deref(), + speaker_generation, + floor_epoch, + ) { + return false; + } + appended_audio = true; + last_route_id = route_id; + true + }, + ); + if let Some(outcome) = outcome { + synthesis_outcome = outcome; + break 'playback_chunks; + } + continue; + } + let model_chunks = match engine.split_text_into_chunks(text) { Ok(model_chunks) => model_chunks, Err(_) => { @@ -715,6 +831,12 @@ fn tts_worker( let chunk_index = model_unit_index; model_unit_index += 1; let mut no_current_text = None; + if cancel.load(Ordering::Acquire) + || voice_cancel.load(Ordering::Acquire) + || shutdown.load(Ordering::Acquire) + { + broadcasters.cancel_all(); + } if handle_cancel_or_shutdown( (&cancel, &voice_cancel), &shutdown, @@ -722,9 +844,8 @@ fn tts_worker( (&text_rx, &mut deferred_text, &mut no_current_text), &voice_change_ack, Some(route_id), - Some((&player, &player_ops)), + Some(&playback), ) { - first_append = true; synthesis_outcome = "cancelled"; break 'playback_chunks; } @@ -748,21 +869,21 @@ fn tts_worker( // synthesis that completed after cancellation so stale audio // never reaches the player, while keeping buzz-voice's // extracted April engine API unchanged. - first_append = true; synthesis_outcome = "cancelled"; break 'playback_chunks; } match synthesis { Ok(samples) if !samples.is_empty() => { - if let Some(prepared) = playback_audio.push( - samples, - chunk_index, - &mut first_append, - silence_buf_len, - player.empty(), - ) { - if !append_audio(prepared, route_id) { - first_append = true; + if let Some(prepared) = playback + .prepare_audio(|empty| playback_audio.push(samples, chunk_index, empty)) + { + if !append_audio( + prepared, + route_id, + speaker_pubkey.as_deref(), + speaker_generation, + floor_epoch, + ) { synthesis_outcome = "cancelled"; break 'playback_chunks; } @@ -784,11 +905,14 @@ fn tts_worker( } } } - if let Some(prepared) = - playback_audio.finish(&mut first_append, silence_buf_len, player.empty()) - { - if !append_audio(prepared, route_id) { - first_append = true; + if let Some(prepared) = playback.prepare_audio(|empty| playback_audio.finish(empty)) { + if !append_audio( + prepared, + route_id, + speaker_pubkey.as_deref(), + speaker_generation, + floor_epoch, + ) { synthesis_outcome = "cancelled"; break 'playback_chunks; } @@ -808,8 +932,8 @@ fn tts_worker( } } - // Stop the barge-in monitor before exiting — it holds a Player clone, - // and an orphaned monitor would keep ticking against a dead pipeline. + // Stop the barge-in monitor before exiting so an orphaned monitor cannot + // keep ticking against a dead pipeline. monitor_stop.store(true, Ordering::Release); if let Ok(handle) = monitor { let _ = handle.join(); @@ -819,90 +943,6 @@ fn tts_worker( tts_active.store(false, Ordering::Release); } -// ── Helpers ─────────────────────────────────────────────────────────────────── - -/// Check for cancel or shutdown. Returns `true` if the caller should break/continue. -/// On cancel: drains the text queue and clears the cancel flag. -/// -/// `player` pairs the Player with the `player_ops` mutex shared with the -/// barge-in monitor thread; the cancel/shutdown clear runs under that lock so -/// it is serialized with the monitor's stale-branch re-check (see the monitor -/// block in `tts_worker`). -fn handle_cancel_or_shutdown( - cancel_signals: CancelSignals<'_>, - shutdown: &AtomicBool, - tts_active: &AtomicBool, - text_state: CancelTextState<'_>, - voice_change_ack: &VoiceChangeAck, - active_route_id: Option, - player: Option<(&rodio::Player, &Mutex<()>)>, -) -> bool { - let (cancel, voice_cancel) = cancel_signals; - let (text_rx, deferred_text, current_text) = text_state; - if shutdown.load(Ordering::Acquire) { - eprintln!( - "buzz-desktop: tts stage=cancellation reason=shutdown route_id={}", - active_route_id.unwrap_or(0) - ); - if let Some((p, ops)) = player { - let _ops = lock_player_ops(ops); - p.clear(); - } - tts_active.store(false, Ordering::Release); - return true; - } - if cancel.load(Ordering::Acquire) || voice_cancel.load(Ordering::Acquire) { - // Serialize with begin_voice_change so the generation boundary and - // cancel consumption are observed as one transition. - let pending_voice_change = voice_change_ack - .lock() - .unwrap_or_else(|error| error.into_inner()); - // Consume at the serialization point. A later barge-in remains true - // for the next pass instead of being overwritten after queue cleanup. - let barge_in = cancel.swap(false, Ordering::AcqRel); - voice_cancel.store(false, Ordering::Release); - eprintln!( - "buzz-desktop: tts stage=cancellation reason={} route_id={}", - if barge_in { "barge_in" } else { "voice_switch" }, - active_route_id.unwrap_or(0) - ); - let preserve_generation = (!barge_in) - .then(|| { - pending_voice_change - .as_ref() - .map(|pending| pending.generation) - }) - .flatten(); - retain_cancelled_text(deferred_text, current_text, text_rx, preserve_generation); - if let Some((p, ops)) = player { - let _ops = lock_player_ops(ops); - // `Player::clear()` removes queued sources AND pauses the player - // (rodio 0.22 `clear()` ends with `self.pause()`). With one - // persistent Player for the worker's lifetime, the un-pause is - // mandatory: without `play()`, every append after a barge-in - // would queue silently forever. - p.clear(); - p.play(); - // Consume the flag under the lock: once released with - // `cancel == false`, the monitor's stale branch no-ops instead - // of clearing the fresh post-cancel utterance. - } - tts_active.store(false, Ordering::Release); - return true; - } - false -} - -/// Acquire the `player_ops` lock, recovering from poison. -/// -/// The data under the mutex is `()` — it only serializes Player mutations — -/// so a panicked holder leaves nothing inconsistent to observe and recovery -/// is always safe. Without this, a worker panic would wedge the monitor (or -/// vice versa) on `unwrap()`. -fn lock_player_ops(ops: &Mutex<()>) -> MutexGuard<'_, ()> { - ops.lock().unwrap_or_else(PoisonError::into_inner) -} - // ── Tests ───────────────────────────────────────────────────────────────────── #[cfg(test)] diff --git a/desktop/src-tauri/src/huddle/tts_activity.rs b/desktop/src-tauri/src/huddle/tts_activity.rs new file mode 100644 index 00000000000..8e69609186c --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_activity.rs @@ -0,0 +1,45 @@ +//! Agent TTS activity envelope shared with the participant film strip. + +#[derive(Clone, serde::Serialize)] +pub(super) struct TtsSpeakerActivityPayload { + pub(super) pubkey: Option, + pub(super) level: f32, +} + +pub(super) struct TtsSpeakerActivityFrame { + pub(super) pubkey: String, + pub(super) level: f32, +} + +/// Build a 50 ms RMS envelope from the exact audio queued for playback. +/// The UI consumes these frames at the same cadence as remote speaker levels, +/// so an agent uses the normal participant ring rather than a generic pulse. +pub(super) fn build_tts_speaker_activity_frames( + samples: &[f32], + pubkey: &str, + sample_rate: usize, +) -> Vec { + let samples_per_frame = (sample_rate / 20).max(1); + samples + .chunks(samples_per_frame) + .map(|frame| { + let mean_square = frame + .iter() + .map(|sample| f64::from(*sample) * f64::from(*sample)) + .sum::() + / frame.len().max(1) as f64; + let rms = mean_square.sqrt() as f32; + let level = if rms <= 0.000_5 { + 0.0 + } else { + // Map roughly -60 dB..-12 dB into the same normalized range + // used by remote Opus speaker levels. + ((20.0 * rms.log10() + 60.0) / 48.0).clamp(0.12, 1.0) + }; + TtsSpeakerActivityFrame { + pubkey: pubkey.to_string(), + level, + } + }) + .collect() +} diff --git a/desktop/src-tauri/src/huddle/tts_append.rs b/desktop/src-tauri/src/huddle/tts_append.rs new file mode 100644 index 00000000000..274c806c95e --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_append.rs @@ -0,0 +1,107 @@ +//! Commits synthesized audio to local playback and remote broadcast atomically. + +use super::*; + +pub(super) struct TtsAppendContext<'a> { + pub(super) playback: &'a PlaybackCoordinator, + #[cfg(test)] + pub(super) human_floor: &'a HumanFloor, + pub(super) cancel: &'a AtomicBool, + pub(super) voice_cancel: &'a AtomicBool, + pub(super) shutdown: &'a AtomicBool, + pub(super) tts_active: &'a AtomicBool, + pub(super) speaker_generations: &'a SpeakerGenerations, + pub(super) active_speaker: &'a ActiveSpeaker, + pub(super) activity_frames: &'a Mutex>, + pub(super) broadcasters: &'a TtsBroadcasters, + pub(super) channels: NonZero, + pub(super) rate: NonZero, +} + +pub(super) fn append_worker_audio( + context: &TtsAppendContext<'_>, + prepared: PreparedModelAudio, + route_id: u64, + speaker_pubkey: Option<&str>, + speaker_generation: u64, + floor_epoch: u64, + publish_broadcast: impl FnOnce(), +) -> bool { + // Keep the shared floor in this context so the regression can mutation-check + // that authorization never moves back inside the coordinator callback. + #[cfg(test)] + let _ = context.human_floor; + let sample_count = prepared.sample_count; + let chunk_index = prepared.chunk_index; + let activity = speaker_pubkey.map(|pubkey| { + build_tts_speaker_activity_frames(&prepared.buffer, pubkey, SAMPLE_RATE as usize) + }); + let floor_authorization = context.playback.append_if_human_floor_permits( + rodio::buffer::SamplesBuffer::new(context.channels, context.rate, prepared.buffer), + floor_epoch, + |player_empty| { + if context.cancel.load(Ordering::Acquire) + || context.voice_cancel.load(Ordering::Acquire) + || context.shutdown.load(Ordering::Acquire) + { + context.broadcasters.cancel_all(); + let reason = if context.shutdown.load(Ordering::Acquire) { + "shutdown" + } else if context.cancel.load(Ordering::Acquire) { + "barge_in" + } else { + "voice_switch" + }; + eprintln!( + "buzz-desktop: tts stage=synthesis status=cancelled reason={reason} route_id={route_id}" + ); + return false; + } + if speaker_pubkey.is_some_and(|pubkey| { + current_speaker_generation(context.speaker_generations, pubkey) + != speaker_generation + }) { + eprintln!( + "buzz-desktop: tts stage=synthesis status=cancelled reason=speaker_removed route_id={route_id}" + ); + return false; + } + if let Some(pubkey) = speaker_pubkey { + let mut active = context + .active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()); + if player_empty { + active.take(); + } + if active + .as_deref() + .is_some_and(|current| !current.eq_ignore_ascii_case(pubkey)) + { + return false; + } + active.get_or_insert_with(|| pubkey.to_ascii_lowercase()); + context + .activity_frames + .lock() + .unwrap_or_else(|error| error.into_inner()) + .extend(activity.unwrap_or_default()); + } + true + }, + // Commit local and published activity under the same playback lock. + // A concurrent floor onset/cancel therefore cannot invalidate the + // player and then let this remote packet escape afterward. + || { + publish_broadcast(); + context.tts_active.store(true, Ordering::Release); + }, + ); + if floor_authorization != HumanFloorAuthorization::Permitted { + return false; + } + eprintln!( + "buzz-desktop: tts stage=player status=append_accepted route_id={route_id} chunk_index={chunk_index} sample_count={sample_count}" + ); + true +} diff --git a/desktop/src-tauri/src/huddle/tts_audio.rs b/desktop/src-tauri/src/huddle/tts_audio.rs index 58300b7497e..993ce11298f 100644 --- a/desktop/src-tauri/src/huddle/tts_audio.rs +++ b/desktop/src-tauri/src/huddle/tts_audio.rs @@ -10,61 +10,35 @@ pub(super) struct PreparedModelAudio { /// on the first and last unit that actually produced audio. pub(super) struct PlaybackChunkAudio { pending: Option<(Vec, usize)>, - appended: bool, } impl PlaybackChunkAudio { pub(super) fn new() -> Self { - Self { - pending: None, - appended: false, - } + Self { pending: None } } pub(super) fn push( &mut self, samples: Vec, chunk_index: usize, - first_append: &mut bool, - silence_buf_len: usize, playback_idle: bool, ) -> Option { if samples.is_empty() { return None; } let previous = self.pending.replace((samples, chunk_index))?; - let prepared = prepare_model_audio( - previous, - first_append, - silence_buf_len, - !self.appended || playback_idle, - false, - ); - self.appended = true; + let prepared = prepare_model_audio(previous, playback_idle, false); Some(prepared) } - pub(super) fn finish( - &mut self, - first_append: &mut bool, - silence_buf_len: usize, - playback_idle: bool, - ) -> Option { + pub(super) fn finish(&mut self, playback_idle: bool) -> Option { let pending = self.pending.take()?; - Some(prepare_model_audio( - pending, - first_append, - silence_buf_len, - !self.appended || playback_idle, - true, - )) + Some(prepare_model_audio(pending, playback_idle, true)) } } fn prepare_model_audio( (samples, chunk_index): (Vec, usize), - first_append: &mut bool, - silence_buf_len: usize, starts_playback_chunk: bool, ends_playback_chunk: bool, ) -> PreparedModelAudio { @@ -74,13 +48,7 @@ fn prepare_model_audio( apply_fade_out(&mut audio); } PreparedModelAudio { - buffer: build_sentence_append_buffer( - first_append, - audio, - silence_buf_len, - starts_playback_chunk, - ends_playback_chunk, - ), + buffer: build_sentence_append_buffer(audio, starts_playback_chunk), sample_count, chunk_index, } @@ -101,132 +69,64 @@ pub(super) fn apply_fade_out(samples: &mut [f32]) { } pub(super) fn build_sentence_append_buffer( - first_append: &mut bool, audio: Vec, - silence_buf_len: usize, starts_playback_chunk: bool, - ends_playback_chunk: bool, ) -> Vec { - if *first_append { - *first_append = false; - } - let lead_in_len = if starts_playback_chunk { SENTENCE_LEAD_IN_SAMPLES } else { 0 }; - let trailing_silence_len = if ends_playback_chunk { - silence_buf_len.saturating_sub(SENTENCE_LEAD_IN_SAMPLES) - } else { - 0 - }; - let mut buffer = Vec::with_capacity(lead_in_len + audio.len() + trailing_silence_len); + let mut buffer = Vec::with_capacity(lead_in_len + audio.len()); buffer.extend(std::iter::repeat_n(0.0_f32, lead_in_len)); buffer.extend(audio); - buffer.extend(std::iter::repeat_n(0.0_f32, trailing_silence_len)); buffer } -pub(super) fn group_sentences_into_chunks(sentences: &[String], max_chars: usize) -> Vec { - let mut chunks: Vec = Vec::new(); - for (index, sentence) in sentences.iter().enumerate() { - let sentence = sentence.trim(); - if sentence.is_empty() { - continue; - } - if index == 0 || chunks.is_empty() { - chunks.push(sentence.to_string()); - continue; - } - let can_merge = chunks.len() > 1 - && chunks - .last() - .is_some_and(|chunk| chunk.len() + 1 + sentence.len() <= max_chars); - if can_merge { - if let Some(last) = chunks.last_mut() { - last.push(' '); - last.push_str(sentence); - } - } else { - chunks.push(sentence.to_string()); - } - } - chunks -} - #[cfg(test)] mod tests { use super::*; #[test] - fn multi_unit_audio_decorates_only_outer_playback_boundaries() { + fn model_units_are_queued_contiguously_without_injected_silence() { let mut chunk = PlaybackChunkAudio::new(); - let mut first_append = true; - let silence = SENTENCE_LEAD_IN_SAMPLES + 100; - assert!(chunk - .push(vec![0.4; 16], 0, &mut first_append, silence, false) - .is_none()); + assert!(chunk.push(vec![0.4; 16], 0, false).is_none()); let first = chunk - .push(vec![0.5; 16], 1, &mut first_append, silence, false) + .push(vec![0.5; 16], 1, false) .expect("first ready model unit"); - assert_eq!(first.buffer.len(), SENTENCE_LEAD_IN_SAMPLES + 16); - assert!(first.buffer[..SENTENCE_LEAD_IN_SAMPLES] - .iter() - .all(|sample| *sample == 0.0)); - assert_eq!(first.buffer[SENTENCE_LEAD_IN_SAMPLES], 0.4); + assert_eq!(first.buffer, vec![0.4; 16]); - let last = chunk - .finish(&mut first_append, silence, false) - .expect("last ready model unit"); - assert_eq!(last.buffer.len(), 16 + 100); - assert_eq!(last.buffer.last(), Some(&0.0)); + let last = chunk.finish(false).expect("last ready model unit"); + assert_eq!(last.buffer.len(), 16); + assert_eq!(last.sample_count, 16); } #[test] - fn empty_edge_units_do_not_steal_lead_in_or_trailing_boundary() { + fn empty_edge_units_do_not_steal_audio_boundaries() { let mut chunk = PlaybackChunkAudio::new(); - let mut first_append = true; - let silence = SENTENCE_LEAD_IN_SAMPLES + 100; - - assert!(chunk - .push(Vec::new(), 0, &mut first_append, silence, false) - .is_none()); - assert!(chunk - .push(vec![0.5; 16], 1, &mut first_append, silence, false) - .is_none()); - assert!(chunk - .push(Vec::new(), 2, &mut first_append, silence, false) - .is_none()); - - let only = chunk - .finish(&mut first_append, silence, false) - .expect("only audible model unit"); - assert_eq!(only.buffer.len(), SENTENCE_LEAD_IN_SAMPLES + 16 + 100); - assert!(only.buffer[..SENTENCE_LEAD_IN_SAMPLES] - .iter() - .all(|sample| *sample == 0.0)); - assert_eq!(only.buffer.last(), Some(&0.0)); + + assert!(chunk.push(Vec::new(), 0, false).is_none()); + assert!(chunk.push(vec![0.5; 16], 1, false).is_none()); + assert!(chunk.push(Vec::new(), 2, false).is_none()); + + let only = chunk.finish(false).expect("only audible model unit"); + assert_eq!(only.buffer.len(), 16); } #[test] fn playback_underrun_rearms_the_onset_cushion() { let mut chunk = PlaybackChunkAudio::new(); - let mut first_append = true; - let silence = SENTENCE_LEAD_IN_SAMPLES + 100; - assert!(chunk - .push(vec![0.4; 16], 0, &mut first_append, silence, false) - .is_none()); + assert!(chunk.push(vec![0.4; 16], 0, false).is_none()); let first = chunk - .push(vec![0.5; 16], 1, &mut first_append, silence, false) - .expect("first model unit"); - assert_eq!(first.buffer.len(), SENTENCE_LEAD_IN_SAMPLES + 16); + .push(vec![0.5; 16], 1, false) + .expect("first ready model unit"); + assert_eq!(first.buffer.len(), 16); let after_underrun = chunk - .push(vec![0.6; 16], 2, &mut first_append, silence, true) - .expect("model unit after underrun"); + .push(vec![0.6; 16], 2, true) + .expect("second ready model unit"); assert_eq!(after_underrun.buffer.len(), SENTENCE_LEAD_IN_SAMPLES + 16); assert!(after_underrun.buffer[..SENTENCE_LEAD_IN_SAMPLES] .iter() diff --git a/desktop/src-tauri/src/huddle/tts_broadcast.rs b/desktop/src-tauri/src/huddle/tts_broadcast.rs new file mode 100644 index 00000000000..ea8507d4b65 --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_broadcast.rs @@ -0,0 +1,270 @@ +//! Huddle-audio publishing handles for locally synthesized agent speech. +//! +//! The relay socket itself lives in `relay_api`; this module owns the small, +//! synchronous seam the TTS worker needs. Each publisher is authenticated as +//! the agent whose speech it carries, so the existing peer-index roster keeps +//! remote playback attributed to the agent instead of the hosting human. + +use std::collections::HashMap; +use std::sync::{ + atomic::{AtomicU64, Ordering}, + Arc, Mutex, +}; + +use tokio::sync::mpsc; +use tokio_util::sync::CancellationToken; + +/// One prepared Pocket-TTS buffer, still at the model's native 24 kHz rate. +#[derive(Debug)] +pub(crate) struct TtsBroadcastPacket { + pub(crate) epoch: u64, + pub(crate) speaker_generation: u64, + pub(crate) samples_24k: Vec, +} + +/// `peer_index -> active local publisher count` for sockets publishing Pocket +/// TTS synthesized by this desktop. +pub(crate) type LocalTtsPublishers = Arc>>; + +/// A live registration for one locally synthesized publisher socket. The lease +/// is owned by the socket task, so receive-side suppression ends immediately +/// when that socket exits even if its command handle has not been replaced yet. +pub(crate) struct LocalTtsPublisherLease { + peer_index: u8, + local_publishers: LocalTtsPublishers, +} + +impl LocalTtsPublisherLease { + pub(crate) fn new(peer_index: u8, local_publishers: LocalTtsPublishers) -> Self { + *local_publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .entry(peer_index) + .or_default() += 1; + Self { + peer_index, + local_publishers, + } + } +} + +impl Drop for LocalTtsPublisherLease { + fn drop(&mut self) { + let mut local_publishers = self + .local_publishers + .lock() + .unwrap_or_else(|error| error.into_inner()); + let Some(count) = local_publishers.get_mut(&self.peer_index) else { + return; + }; + *count -= 1; + if *count == 0 { + local_publishers.remove(&self.peer_index); + } + } +} + +/// A live, agent-authenticated audio publisher. +#[derive(Debug)] +pub(crate) struct TtsAudioPublisher { + tx: mpsc::Sender, + cancel: CancellationToken, + epoch: Arc, + speaker_generation: Arc, +} + +impl TtsAudioPublisher { + pub(crate) fn new(tx: mpsc::Sender, cancel: CancellationToken) -> Self { + Self { + tx, + cancel, + epoch: Arc::new(AtomicU64::new(0)), + speaker_generation: Arc::new(AtomicU64::new(0)), + } + } + + pub(crate) fn version_state(&self) -> (Arc, Arc) { + ( + Arc::clone(&self.epoch), + Arc::clone(&self.speaker_generation), + ) + } + + fn set_speaker_generation(&self, generation: u64) { + self.speaker_generation.store(generation, Ordering::Release); + } + + fn is_closed(&self) -> bool { + self.cancel.is_cancelled() || self.tx.is_closed() + } + + fn publish(&self, speaker_generation: u64, samples_24k: Vec) { + if speaker_generation != self.speaker_generation.load(Ordering::Acquire) { + return; + } + let packet = TtsBroadcastPacket { + epoch: self.epoch.load(Ordering::Acquire), + speaker_generation, + samples_24k, + }; + if let Err(error) = self.tx.try_send(packet) { + eprintln!( + "buzz-desktop: tts broadcast status=dropped reason=publisher_backpressure error={error}" + ); + } + } + + fn cancel_pending(&self) { + self.epoch.fetch_add(1, Ordering::AcqRel); + } + + fn shutdown(&self) { + self.cancel.cancel(); + } +} + +/// Thread-safe registry shared by the TTS worker, cancellation monitor, and +/// async command path that establishes publishers before speech is queued. +#[derive(Clone, Debug, Default)] +pub(super) struct TtsBroadcasters { + publishers: Arc>>, +} + +impl TtsBroadcasters { + pub(super) fn contains(&self, speaker_pubkey: &str) -> bool { + self.publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .get(&speaker_pubkey.to_ascii_lowercase()) + .is_some_and(|publisher| !publisher.is_closed()) + } + + pub(super) fn register( + &self, + speaker_pubkey: &str, + publisher: TtsAudioPublisher, + speaker_generation: u64, + ) { + publisher.set_speaker_generation(speaker_generation); + let replaced = self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .insert(speaker_pubkey.to_ascii_lowercase(), publisher); + if let Some(replaced) = replaced { + replaced.shutdown(); + } + } + + pub(super) fn publish( + &self, + speaker_pubkey: &str, + speaker_generation: u64, + samples_24k: Vec, + ) { + let publishers = self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()); + if let Some(publisher) = publishers.get(&speaker_pubkey.to_ascii_lowercase()) { + publisher.publish(speaker_generation, samples_24k); + } + } + + pub(super) fn cancel_speaker(&self, speaker_pubkey: &str, speaker_generation: u64) { + let publishers = self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()); + if let Some(publisher) = publishers.get(&speaker_pubkey.to_ascii_lowercase()) { + publisher.set_speaker_generation(speaker_generation); + publisher.cancel_pending(); + } + } + + pub(super) fn remove_speaker(&self, speaker_pubkey: &str) { + let removed = self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .remove(&speaker_pubkey.to_ascii_lowercase()); + if let Some(removed) = removed { + removed.shutdown(); + } + } + + pub(super) fn cancel_all(&self) { + for publisher in self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()) + .values() + { + publisher.cancel_pending(); + } + } + + pub(super) fn shutdown(&self) { + let mut publishers = self + .publishers + .lock() + .unwrap_or_else(|error| error.into_inner()); + for publisher in publishers.values() { + publisher.shutdown(); + } + publishers.clear(); + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn publisher_lifetime_tracks_local_synthesis_without_replacement_gaps() { + let local_publishers = LocalTtsPublishers::default(); + let first = LocalTtsPublisherLease::new(3, Arc::clone(&local_publishers)); + assert_eq!( + local_publishers.lock().expect("local publishers").get(&3), + Some(&1) + ); + + let replacement = LocalTtsPublisherLease::new(3, Arc::clone(&local_publishers)); + drop(first); + assert_eq!( + local_publishers.lock().expect("local publishers").get(&3), + Some(&1), + "dropping a replaced socket must not expose its live replacement" + ); + + drop(replacement); + assert!(local_publishers + .lock() + .expect("local publishers") + .is_empty()); + } + + #[test] + fn cancellation_invalidates_queued_packet_versions() { + let (tx, mut rx) = mpsc::channel(2); + let publisher = TtsAudioPublisher::new(tx, CancellationToken::new()); + let (epoch, generation) = publisher.version_state(); + publisher.set_speaker_generation(4); + + publisher.publish(4, vec![0.25]); + let queued = rx.try_recv().expect("queued audio"); + assert_eq!(queued.epoch, 0); + assert_eq!(queued.speaker_generation, 4); + + publisher.cancel_pending(); + assert_ne!(queued.epoch, epoch.load(Ordering::Acquire)); + + publisher.set_speaker_generation(5); + publisher.publish(4, vec![0.5]); + assert!( + rx.try_recv().is_err(), + "stale speaker audio must be dropped" + ); + assert_eq!(generation.load(Ordering::Acquire), 5); + } +} diff --git a/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs b/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs new file mode 100644 index 00000000000..2737de94959 --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_pipeline_controls.rs @@ -0,0 +1,129 @@ +use super::*; + +impl TtsPipeline { + pub(crate) fn has_audio_publisher(&self, speaker_pubkey: &str) -> bool { + self.broadcasters.contains(speaker_pubkey) + } + + pub(crate) fn register_audio_publisher( + &self, + speaker_pubkey: &str, + publisher: TtsAudioPublisher, + ) { + self.broadcasters.register( + speaker_pubkey, + publisher, + current_speaker_generation(&self.speaker_generations, speaker_pubkey), + ); + } + + /// Queue `text` for TTS synthesis and playback. + /// + /// Non-blocking. Returns `Err` if the queue is full (bounded at + /// `TEXT_QUEUE_DEPTH`) — caller may log and discard. + pub fn speak(&self, text: String) -> Result<(), String> { + let floor_epoch = self.human_floor.epoch(); + self.text_tx + .try_send(QueuedText { + generation: self.voice_generation.load(Ordering::Acquire), + floor_epoch, + route_id: 0, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, + text, + }) + .map_err(|e| { + eprintln!("buzz-desktop: TTS queue saturated, dropping message: {e}"); + format!("TTS queue full, dropping: {e}") + }) + } + + /// Clone the bounded queue sender so callers can apply backpressure without + /// holding the huddle mutex. Disabling TTS drops the receiver and unblocks + /// any waiting sender while the shared cancellation flag stops playback. + pub(crate) fn text_sender(&self) -> TtsTextSender { + TtsTextSender { + text_tx: self.text_tx.clone(), + generation: self.voice_generation.load(Ordering::Acquire), + human_floor: self.human_floor.clone(), + speaker_generations: Arc::clone(&self.speaker_generations), + } + } + + /// Invalidate speech queued for one agent and cancel the player only when + /// that same agent currently owns it. + pub(crate) fn cancel_speaker(&self, speaker_pubkey: &str) { + request_speaker_cancel( + &self.speaker_generations, + &self.active_speaker, + &self.speaker_cancel, + speaker_pubkey, + ); + self.broadcasters.remove_speaker(speaker_pubkey); + } + + /// Cancel exactly the speaker utterance currently owning playback. + /// + /// The speaker generation is advanced while ownership is locked, so a + /// stale Stop click cannot cancel a later utterance that starts after the + /// observed one drains. + pub(crate) fn cancel_active_speaker(&self, expected_speaker_pubkey: &str) -> bool { + let cancelled = request_active_speaker_cancel( + &self.speaker_generations, + &self.active_speaker, + &self.speaker_cancel, + &self.playback_probe, + expected_speaker_pubkey, + ); + if cancelled { + self.broadcasters.cancel_speaker( + expected_speaker_pubkey, + current_speaker_generation(&self.speaker_generations, expected_speaker_pubkey), + ); + } + cancelled + } + + /// Select a bundled Pocket voice for subsequent speech. + /// + /// Current playback and queued text are cancelled immediately so content + /// cannot continue in the old voice. The worker keeps its warmed inference + /// engine and reloads only the reference style before the next utterance. + pub fn select_voice(&self, voice: &str) -> Option> { + let acknowledged = begin_voice_change( + &self.voice, + &self.voice_generation, + &self.voice_cancel, + &self.voice_change_ack, + voice, + ); + if acknowledged.is_some() { + self.broadcasters.cancel_all(); + eprintln!("buzz-desktop: tts stage=cancellation reason=voice_switch route_id=0"); + } + acknowledged + } + + /// Reconcile the voice of a pipeline that has not been published yet. + /// + /// No caller can enqueue text before publication, so raising the shared + /// cancellation flag here would create a race that could discard the first + /// message queued immediately after installation. + pub(crate) fn select_voice_before_publish(&self, voice: &str) { + *self.voice.lock().unwrap_or_else(|error| error.into_inner()) = voice.to_string(); + } + + /// Signal the worker thread to stop. + pub fn shutdown(&self) { + eprintln!("buzz-desktop: tts stage=cancellation reason=shutdown route_id=0"); + self.broadcasters.shutdown(); + self.shutdown.store(true, Ordering::Release); + } + + /// Returns `true` if the worker thread has exited (init failure, crash, or normal exit). + /// Used by hot-start to detect dead pipelines and clear them for retry. + pub fn is_finished(&self) -> bool { + self.thread.as_ref().is_none_or(|h| h.is_finished()) + } +} diff --git a/desktop/src-tauri/src/huddle/tts_playback.rs b/desktop/src-tauri/src/huddle/tts_playback.rs new file mode 100644 index 00000000000..8a90c018994 --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_playback.rs @@ -0,0 +1,884 @@ +use std::{ + collections::HashSet, + sync::{Arc, Mutex, MutexGuard, PoisonError}, + time::{Duration, Instant}, +}; + +use rodio::{mixer::Mixer, Player, Source}; + +/// Conservative guard after rodio reports drained. Max measured about 12 ms +/// of cancellation tail on current-main CoreAudio and about 1 ms after player +/// replacement; 100 ms safely bounds those observed paths while the phase-1 +/// route matrix determines whether this can be narrowed. +const OUTPUT_TAIL_HANGOVER: Duration = Duration::from_millis(100); + +/// Serializes every operation on the TTS player and owns the utterance-boundary +/// bookkeeping that must change atomically when playback is replaced. +/// +/// Poison recovery is sound because `PlaybackState` has no partially-valid +/// representation: `Player` replacement is a single assignment, booleans are +/// independently valid at either value, and no mutable reference to the state +/// leaves the locked operation that created it. +pub(super) struct PlaybackCoordinator { + mixer: Mutex>, + state: Mutex, +} + +struct PlaybackState { + player: Option, + /// `true` while no append has been committed since the last utterance + /// boundary. Only `append_if` clears it, so it records appends that were + /// actually queued — never one the authorization refused. + first_append: bool, + synthesis_in_flight: bool, + synthesis_generation: u64, + output_lease: OutputLease, + human_floor: HumanFloorState, +} + +#[derive(Default)] +enum OutputLease { + #[default] + Inactive, + Active, + HangoverUntil(Instant), +} + +impl OutputLease { + fn is_live_at(&mut self, now: Instant) -> bool { + match self { + Self::Inactive => false, + Self::Active => true, + Self::HangoverUntil(deadline) if now < *deadline => true, + Self::HangoverUntil(_) => { + *self = Self::Inactive; + false + } + } + } + + fn begin_hangover(&mut self, now: Instant) { + if !matches!(self, Self::Inactive) { + *self = Self::HangoverUntil(now + OUTPUT_TAIL_HANGOVER); + } + } +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub(super) enum HumanFloorAuthorization { + Permitted, + Blocked, + Stale, +} + +#[derive(Default)] +struct HumanFloorState { + epoch: u64, + local: bool, + remote: HashSet, +} + +pub(super) struct SynthesisFlightGuard { + playback: Arc, + generation: u64, +} + +impl Drop for SynthesisFlightGuard { + fn drop(&mut self) { + let mut state = self.playback.lock(); + if state.synthesis_generation == self.generation { + state.synthesis_in_flight = false; + } + } +} + +impl PlaybackCoordinator { + #[cfg(test)] + pub(super) fn new(mixer: &Mixer) -> Self { + let coordinator = Self::unbound(); + coordinator.bind_mixer(mixer); + coordinator + } + + pub(super) fn unbound() -> Self { + Self { + mixer: Mutex::new(None), + state: Mutex::new(PlaybackState { + player: None, + first_append: true, + synthesis_in_flight: false, + synthesis_generation: 0, + output_lease: OutputLease::Inactive, + human_floor: HumanFloorState::default(), + }), + } + } + + pub(super) fn bind_mixer(&self, mixer: &Mixer) { + *self.mixer.lock().unwrap_or_else(PoisonError::into_inner) = Some(mixer.clone()); + let mut state = self.lock(); + if state.player.is_none() { + state.player = Some(Player::connect_new(mixer)); + } + } + + fn lock(&self) -> MutexGuard<'_, PlaybackState> { + self.state.lock().unwrap_or_else(PoisonError::into_inner) + } + + /// Queue `source` when `authorize` accepts, then publish the append with + /// `commit` before releasing the coordinator. `commit` runs under the lock + /// so an append and the activity state it implies are one transition: a + /// concurrent cancellation either replaces the queue before this append is + /// authorized, or observes the committed state after it — never lands its + /// own release between the two and gets overwritten. + #[cfg(test)] + pub(super) fn append_if( + &self, + source: S, + authorize: impl FnOnce(bool) -> bool, + commit: impl FnOnce(), + ) -> bool + where + S: Source + Send + 'static, + { + let mut state = self.lock(); + if !authorize(state.player.as_ref().is_none_or(Player::empty)) { + return false; + } + let Some(player) = state.player.as_ref() else { + return false; + }; + player.append(source); + state.first_append = false; + state.output_lease = OutputLease::Active; + commit(); + true + } + + pub(super) fn append_untracked(&self, source: S) + where + S: Source + Send + 'static, + { + if let Some(player) = self.lock().player.as_ref() { + player.append(source); + } + } + + pub(super) fn empty(&self) -> bool { + self.lock().player.as_ref().is_none_or(Player::empty) + } + + /// Observe playback emptiness under the coordinator so the onset decision + /// for the audio being built is serialized with append and cancellation. + pub(super) fn prepare_audio(&self, prepare: impl FnOnce(bool) -> R) -> R { + let state = self.lock(); + let empty = state.player.as_ref().is_none_or(Player::empty); + prepare(empty) + } + + pub(super) fn release_if_drained(&self, release: impl FnOnce()) -> bool { + let mut state = self.lock(); + if !state.player.as_ref().is_none_or(Player::empty) || state.first_append { + return false; + } + release(); + state.first_append = true; + state.output_lease.begin_hangover(Instant::now()); + true + } + + pub(super) fn begin_synthesis(self: &Arc) -> SynthesisFlightGuard { + let generation = { + let mut state = self.lock(); + state.synthesis_generation = state.synthesis_generation.wrapping_add(1); + state.synthesis_in_flight = true; + state.synthesis_generation + }; + SynthesisFlightGuard { + playback: Arc::clone(self), + generation, + } + } + + pub(super) fn with_playback_live(&self, observe: impl FnOnce(bool) -> R) -> R { + let state = self.lock(); + observe(!state.player.as_ref().is_none_or(Player::empty) || state.synthesis_in_flight) + } + + /// Replace live playback with a fresh queue, publishing the replacement + /// with `commit` before releasing the coordinator. The old player is + /// dropped after releasing, so rodio's teardown cannot extend the critical + /// section. Concurrent cancel observers elect exactly one replacement + /// because replacement resets both liveness signals. + /// + /// `commit` is the mirror of `append_if`'s: a replacement and the activity + /// state it implies are one transition, so an append that wins the lock + /// handoff after this cancellation cannot have its own publication + /// overwritten by a `false` landing late. + pub(super) fn cancel_if_live( + &self, + authorize: impl FnOnce() -> bool, + commit: impl FnOnce(), + ) -> bool { + let replacement = self + .mixer + .lock() + .unwrap_or_else(PoisonError::into_inner) + .as_ref() + .map(Player::connect_new); + let old_player = { + let mut state = self.lock(); + if (state.player.as_ref().is_none_or(Player::empty) && !state.synthesis_in_flight) + || !authorize() + { + return false; + } + state.first_append = true; + state.synthesis_in_flight = false; + state.synthesis_generation = state.synthesis_generation.wrapping_add(1); + state.output_lease.begin_hangover(Instant::now()); + let old_player = std::mem::replace(&mut state.player, replacement); + commit(); + old_player + }; + drop(old_player); + true + } + + #[cfg(test)] + pub(super) fn human_floor_blocked(&self) -> bool { + let state = self.lock(); + state.human_floor.local || !state.human_floor.remote.is_empty() + } + + pub(super) fn human_floor_epoch(&self) -> u64 { + self.lock().human_floor.epoch + } + + pub(super) fn human_floor_authorization(&self, epoch: u64) -> HumanFloorAuthorization { + Self::human_floor_authorization_locked(&self.lock(), epoch) + } + + fn human_floor_authorization_locked( + state: &PlaybackState, + epoch: u64, + ) -> HumanFloorAuthorization { + if state.human_floor.local || !state.human_floor.remote.is_empty() { + HumanFloorAuthorization::Blocked + } else if state.human_floor.epoch != epoch { + HumanFloorAuthorization::Stale + } else { + HumanFloorAuthorization::Permitted + } + } + + #[cfg(test)] + pub(super) fn human_floor_permits(&self, epoch: u64) -> bool { + self.human_floor_authorization(epoch) == HumanFloorAuthorization::Permitted + } + + pub(super) fn append_if_human_floor_permits( + &self, + source: S, + epoch: u64, + authorize: impl FnOnce(bool) -> bool, + commit: impl FnOnce(), + ) -> HumanFloorAuthorization + where + S: Source + Send + 'static, + { + let mut state = self.lock(); + let floor_authorization = Self::human_floor_authorization_locked(&state, epoch); + if floor_authorization != HumanFloorAuthorization::Permitted { + return floor_authorization; + } + if !authorize(state.player.as_ref().is_none_or(Player::empty)) { + return HumanFloorAuthorization::Stale; + } + let Some(player) = state.player.as_ref() else { + return HumanFloorAuthorization::Stale; + }; + player.append(source); + state.first_append = false; + state.output_lease = OutputLease::Active; + commit(); + HumanFloorAuthorization::Permitted + } + + pub(super) fn enter_local_human_floor( + &self, + route_isolated: bool, + sustained_coupled_speech: bool, + ) -> bool { + let replacement = self + .mixer + .lock() + .unwrap_or_else(PoisonError::into_inner) + .as_ref() + .map(Player::connect_new); + let old_player = { + let mut state = self.lock(); + let output_live = + state.synthesis_in_flight || state.output_lease.is_live_at(Instant::now()); + if state.human_floor.local + || (output_live && !route_isolated && !sustained_coupled_speech) + { + return false; + } + state.human_floor.local = true; + Self::commit_human_floor_onset(&mut state, replacement) + }; + drop(old_player); + true + } + + pub(super) fn leave_local_human_floor(&self) { + self.lock().human_floor.local = false; + } + + pub(super) fn enter_remote_human_floor(&self, peer: u8) { + self.enter_human_floor(|floor| floor.remote.insert(peer)); + } + + pub(super) fn leave_remote_human_floor(&self, peer: u8) { + self.lock().human_floor.remote.remove(&peer); + } + + pub(super) fn clear_remote_human_floor(&self) { + self.lock().human_floor.remote.clear(); + } + + fn enter_human_floor(&self, enter: impl FnOnce(&mut HumanFloorState) -> bool) { + let replacement = self + .mixer + .lock() + .unwrap_or_else(PoisonError::into_inner) + .as_ref() + .map(Player::connect_new); + let old_player = { + let mut state = self.lock(); + if !enter(&mut state.human_floor) { + return; + } + Self::commit_human_floor_onset(&mut state, replacement) + }; + drop(old_player); + } + + fn commit_human_floor_onset( + state: &mut PlaybackState, + replacement: Option, + ) -> Option { + state.human_floor.epoch = state.human_floor.epoch.wrapping_add(1); + state.first_append = true; + state.synthesis_in_flight = false; + state.synthesis_generation = state.synthesis_generation.wrapping_add(1); + state.output_lease.begin_hangover(Instant::now()); + std::mem::replace(&mut state.player, replacement) + } +} + +#[cfg(test)] +mod tests { + use std::{ + num::NonZero, + sync::{ + atomic::{AtomicBool, AtomicUsize, Ordering}, + Arc, Barrier, + }, + thread, + time::{Duration, Instant}, + }; + + use rodio::buffer::SamplesBuffer; + + use super::*; + + fn coordinator() -> (Arc, rodio::mixer::MixerSource) { + let channels = NonZero::new(1).expect("nonzero channels"); + let rate = NonZero::new(24_000).expect("nonzero rate"); + let (mixer, source) = rodio::mixer::mixer(channels, rate); + (Arc::new(PlaybackCoordinator::new(&mixer)), source) + } + + fn append_second(playback: &PlaybackCoordinator) { + playback.append_if( + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.25; 24_000], + ), + |_| true, + || {}, + ); + } + + fn one_second_source() -> SamplesBuffer { + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.25; 24_000], + ) + } + + #[test] + fn floor_authorized_append_does_not_reenter_the_coordinator_lock() { + let (playback, _unpulled_source) = coordinator(); + let epoch = playback.human_floor_epoch(); + let (completed_tx, completed_rx) = std::sync::mpsc::sync_channel(1); + let worker = thread::spawn(move || { + let authorization = + playback.append_if_human_floor_permits(one_second_source(), epoch, |_| true, || {}); + completed_tx + .send(authorization) + .expect("completion receiver"); + }); + + assert_eq!( + completed_rx + .recv_timeout(Duration::from_secs(1)) + .expect("floor-authorized append must not deadlock"), + HumanFloorAuthorization::Permitted + ); + worker.join().expect("append worker"); + } + + #[test] + fn text_queued_during_a_held_floor_is_permitted_after_release() { + let (playback, _unpulled_source) = coordinator(); + assert!(playback.enter_local_human_floor(true, false)); + let queued_epoch = playback.human_floor_epoch(); + + assert_eq!( + playback.human_floor_authorization(queued_epoch), + HumanFloorAuthorization::Blocked + ); + playback.leave_local_human_floor(); + assert_eq!( + playback.human_floor_authorization(queued_epoch), + HumanFloorAuthorization::Permitted + ); + assert_eq!( + playback.append_if_human_floor_permits( + one_second_source(), + queued_epoch, + |_| true, + || {}, + ), + HumanFloorAuthorization::Permitted + ); + } + + #[test] + fn human_onset_replaces_playback_and_invalidates_late_append() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let stale_epoch = playback.human_floor_epoch(); + + assert!(playback.enter_local_human_floor(true, false)); + + assert!(playback.empty()); + assert!(playback.human_floor_blocked()); + assert!(!playback.human_floor_permits(stale_epoch)); + playback.leave_local_human_floor(); + assert!(!playback.human_floor_blocked()); + assert!(!playback.human_floor_permits(stale_epoch)); + } + + #[test] + fn coupled_local_onset_while_idle_blocks_delayed_tts() { + let (playback, _unpulled_source) = coordinator(); + let delayed_tts_epoch = playback.human_floor_epoch(); + + assert!(playback.enter_local_human_floor(false, false)); + + assert!(playback.human_floor_blocked()); + assert!(!playback.human_floor_permits(delayed_tts_epoch)); + } + + #[test] + fn coupled_local_onset_during_output_is_rejected_as_ambiguous_echo() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let epoch = playback.human_floor_epoch(); + + assert!(!playback.enter_local_human_floor(false, false)); + + assert!(!playback.human_floor_blocked()); + assert!(playback.human_floor_permits(epoch)); + assert!(!playback.empty()); + } + + #[test] + fn sustained_coupled_speech_overrides_live_output_suppression() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let stale_epoch = playback.human_floor_epoch(); + + assert!(playback.enter_local_human_floor(false, true)); + + assert!(playback.empty()); + assert!(playback.human_floor_blocked()); + assert!(!playback.human_floor_permits(stale_epoch)); + } + + #[test] + fn coupled_local_onset_during_output_tail_hangover_is_rejected() { + let (playback, mut source) = coordinator(); + append_second(&playback); + while !playback.empty() { + assert!( + source.next().is_some(), + "the mixer source outlives the queue" + ); + } + assert!(playback.release_if_drained(|| {})); + + assert!(!playback.enter_local_human_floor(false, false)); + assert!(!playback.human_floor_blocked()); + } + + #[test] + fn coupled_local_onset_after_output_tail_hangover_is_accepted() { + let (playback, mut source) = coordinator(); + append_second(&playback); + while !playback.empty() { + assert!( + source.next().is_some(), + "the mixer source outlives the queue" + ); + } + assert!(playback.release_if_drained(|| {})); + playback.lock().output_lease = + OutputLease::HangoverUntil(Instant::now() - Duration::from_millis(1)); + + assert!(playback.enter_local_human_floor(false, false)); + assert!(playback.human_floor_blocked()); + } + + #[test] + fn accepted_append_renews_an_expiring_output_lease() { + let (playback, _unpulled_source) = coordinator(); + playback.lock().output_lease = + OutputLease::HangoverUntil(Instant::now() + Duration::from_millis(1)); + + append_second(&playback); + + assert!(matches!(playback.lock().output_lease, OutputLease::Active)); + } + + #[test] + fn remote_onset_while_idle_blocks_delayed_tts() { + let (playback, _unpulled_source) = coordinator(); + let delayed_tts_epoch = playback.human_floor_epoch(); + + playback.enter_remote_human_floor(7); + + assert!(playback.human_floor_blocked()); + assert!(!playback.human_floor_permits(delayed_tts_epoch)); + } + + #[test] + fn local_and_remote_sources_hold_the_same_floor_until_each_releases() { + let (playback, _unpulled_source) = coordinator(); + assert!(playback.enter_local_human_floor(true, false)); + let local_epoch = playback.human_floor_epoch(); + playback.enter_remote_human_floor(7); + assert_ne!(playback.human_floor_epoch(), local_epoch); + + playback.leave_local_human_floor(); + assert!(playback.human_floor_blocked()); + playback.leave_remote_human_floor(7); + assert!(!playback.human_floor_blocked()); + } + + #[test] + fn cancel_replaces_playback_without_waiting_for_the_mixer() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + + let started = Instant::now(); + assert!(playback.cancel_if_live(|| true, || {})); + + assert!(started.elapsed() < Duration::from_millis(50)); + assert!(playback.empty()); + } + + #[test] + fn concurrent_cancel_observers_elect_exactly_one_replacement() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let barrier = Arc::new(Barrier::new(3)); + let replacements = Arc::new(AtomicUsize::new(0)); + let mut threads = Vec::new(); + for _ in 0..2 { + let playback = Arc::clone(&playback); + let barrier = Arc::clone(&barrier); + let replacements = Arc::clone(&replacements); + threads.push(thread::spawn(move || { + barrier.wait(); + if playback.cancel_if_live(|| true, || {}) { + replacements.fetch_add(1, Ordering::Relaxed); + } + })); + } + barrier.wait(); + for thread in threads { + thread.join().expect("cancel observer"); + } + + assert_eq!(replacements.load(Ordering::Relaxed), 1); + } + + #[test] + fn append_and_cancel_are_one_serialized_public_operation() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let append_authorized = Arc::new(Barrier::new(2)); + let release_append = Arc::new(Barrier::new(2)); + let append_thread = { + let playback = Arc::clone(&playback); + let append_authorized = Arc::clone(&append_authorized); + let release_append = Arc::clone(&release_append); + thread::spawn(move || { + playback.append_if( + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.5; 24_000], + ), + |_| { + append_authorized.wait(); + release_append.wait(); + true + }, + || {}, + ) + }) + }; + append_authorized.wait(); + let cancel_thread = { + let playback = Arc::clone(&playback); + thread::spawn(move || playback.cancel_if_live(|| true, || {})) + }; + release_append.wait(); + + assert!(append_thread.join().expect("append")); + assert!(cancel_thread.join().expect("cancel")); + assert!( + playback.empty(), + "cancel must replace the queue after append" + ); + } + + #[test] + fn an_accepted_append_publishes_its_activity_inside_the_append_transition() { + let (playback, _unpulled_source) = coordinator(); + let committed = Arc::new(AtomicBool::new(false)); + + let appended = playback.append_if( + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.25; 24_000], + ), + |_| true, + || { + // The coordinator is still held, so no cancellation can land a + // release between queueing this audio and publishing it. + assert!( + playback.state.try_lock().is_err(), + "commit must run inside the append's critical section" + ); + committed.store(true, Ordering::Release); + }, + ); + + assert!(appended); + assert!( + committed.load(Ordering::Acquire), + "an accepted append must publish" + ); + assert!( + playback.state.try_lock().is_ok(), + "the coordinator is released once the append returns" + ); + } + + #[test] + fn a_refused_append_publishes_nothing_and_leaves_the_onset_armed() { + let (playback, _unpulled_source) = coordinator(); + + // The worker builds its buffer under the coordinator, then the append + // is refused — cancelled, or owned by another speaker. + playback.prepare_audio(|starts_playback_chunk| { + assert!(starts_playback_chunk, "a fresh coordinator is idle"); + }); + let appended = playback.append_if( + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.25; 24_000], + ), + |_| false, + || panic!("a refused append must publish nothing"), + ); + + assert!(!appended); + // Nothing was queued, so this is not a drained utterance: releasing + // here would drop the mic gate and log a drain for audio that never + // played, and cost the next append its onset cushion. + assert!( + !playback.release_if_drained(|| panic!("a refused append is not a drain")), + "a refused append must not present as a drained utterance" + ); + } + + #[test] + fn an_appended_utterance_still_releases_exactly_once_when_it_drains() { + let (playback, mut source) = coordinator(); + append_second(&playback); + + assert!( + !playback.release_if_drained(|| panic!("queued audio is not drained")), + "queued audio must not release" + ); + while !playback.empty() { + assert!( + source.next().is_some(), + "the mixer source outlives the queue" + ); + } + + let releases = Arc::new(AtomicUsize::new(0)); + for _ in 0..2 { + let releases = Arc::clone(&releases); + playback.release_if_drained(move || { + releases.fetch_add(1, Ordering::Relaxed); + }); + } + + assert_eq!( + releases.load(Ordering::Relaxed), + 1, + "a drained utterance releases once and rearms the onset" + ); + } + + /// The reverse direction of the same barrier: a cancellation must publish + /// its release *inside* the replacement. The cancelling thread is + /// otherwise past its replacement and about to release the mic gate, while + /// an append that wins the coordinator handoff has already published its + /// own `true` — a `false` landing outside the replacement would ungate the + /// mic for audio that is actually playing, and VAD would hear our own TTS + /// and barge in on it. + #[test] + fn a_replacement_publishes_its_release_inside_the_cancel_transition() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + let committed = Arc::new(AtomicBool::new(false)); + + let replaced = playback.cancel_if_live( + || true, + || { + // Still held: no append can commit its own activity between + // this replacement and the release it implies. + assert!( + playback.state.try_lock().is_err(), + "commit must run inside the cancellation's critical section" + ); + committed.store(true, Ordering::Release); + }, + ); + + assert!(replaced, "live playback must be replaced"); + assert!( + committed.load(Ordering::Acquire), + "a replacement must publish" + ); + assert!( + playback.state.try_lock().is_ok(), + "the coordinator is released once the cancellation returns" + ); + } + + /// A cancellation that replaces nothing publishes nothing: the caller + /// still owns releasing the gate, and a replacement that never happened + /// must not present as one. + #[test] + fn a_cancellation_with_nothing_live_publishes_nothing() { + let (playback, _unpulled_source) = coordinator(); + + assert!(!playback.cancel_if_live(|| true, || panic!("nothing was replaced"))); + assert!(!playback.cancel_if_live(|| false, || panic!("cancellation was refused"))); + } + + /// Both publication directions under real contention: whichever + /// transition takes the coordinator last decides, and the activity flag + /// must describe the player that survived. + #[test] + fn a_cancellation_and_an_append_never_disagree_about_the_mic_gate() { + for _ in 0..256 { + let (playback, _unpulled_source) = coordinator(); + let tts_active = Arc::new(AtomicBool::new(true)); + append_second(&playback); + let barrier = Arc::new(Barrier::new(2)); + + let canceller = { + let playback = Arc::clone(&playback); + let tts_active = Arc::clone(&tts_active); + let barrier = Arc::clone(&barrier); + thread::spawn(move || { + barrier.wait(); + playback.cancel_if_live(|| true, || tts_active.store(false, Ordering::Release)) + }) + }; + let appender = { + let playback = Arc::clone(&playback); + let tts_active = Arc::clone(&tts_active); + let barrier = Arc::clone(&barrier); + thread::spawn(move || { + barrier.wait(); + playback.append_if( + SamplesBuffer::new( + NonZero::new(1).expect("nonzero channels"), + NonZero::new(24_000).expect("nonzero rate"), + vec![0.5; 24_000], + ), + |_| true, + || tts_active.store(true, Ordering::Release), + ) + }) + }; + + let replaced = canceller.join().expect("canceller"); + let appended = appender.join().expect("appender"); + assert!(replaced, "live playback must be replaced"); + assert!(appended, "the append is authorized either way"); + + assert_eq!( + tts_active.load(Ordering::Acquire), + !playback.empty(), + "the mic gate must agree with the player that survived" + ); + } + } + + #[test] + fn cancellation_rearms_first_append_and_releases_activity_once() { + let (playback, _unpulled_source) = coordinator(); + append_second(&playback); + assert!(playback.cancel_if_live(|| true, || {})); + assert!(!playback.release_if_drained(|| panic!("fresh replacement is not a drain"))); + playback.prepare_audio(|starts_playback_chunk| { + assert!( + starts_playback_chunk, + "the first append after replacement must carry the onset cushion" + ); + }); + + append_second(&playback); + assert!(!playback.release_if_drained(|| panic!("queued audio is not drained"))); + } +} diff --git a/desktop/src-tauri/src/huddle/tts_settings.rs b/desktop/src-tauri/src/huddle/tts_settings.rs index 1b378af8237..75cfef26e55 100644 --- a/desktop/src-tauri/src/huddle/tts_settings.rs +++ b/desktop/src-tauri/src/huddle/tts_settings.rs @@ -175,7 +175,7 @@ pub fn resolve_voice_for_backend( resolve_voice_for_backend_in_registry(preferences, backend, &bundled_voice_registry()) } -fn resolve_voice_for_backend_in_registry( +pub(crate) fn resolve_voice_for_backend_in_registry( preferences: &[String], backend: &str, registry: &[VoiceRegistryEntry], @@ -622,8 +622,10 @@ pub async fn preview_pocket_voice( model_dir, active.clone(), cancel, + super::human_floor::HumanFloor::new(), &voice_name, output_device, + None, )?; pipeline.speak("Hello! This is how I’ll read agent responses.".to_string())?; let started = std::time::Instant::now(); diff --git a/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs b/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs new file mode 100644 index 00000000000..98bc66824c6 --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_speaker_cancellation.rs @@ -0,0 +1,327 @@ +use super::*; + +pub(super) struct TtsMonitorState { + pub(super) playback: Arc, + pub(super) cancel: Arc, + pub(super) voice_cancel: Arc, + pub(super) tts_active: Arc, + pub(super) stop: Arc, + pub(super) activity_frames: Arc>>, + pub(super) active_speaker: ActiveSpeaker, + pub(super) speaker_cancel: SpeakerCancellation, + pub(super) broadcasters: TtsBroadcasters, + pub(super) activity_app: Option, +} + +pub(super) fn spawn_tts_monitor(state: TtsMonitorState) -> std::io::Result> { + thread::Builder::new() + .name("tts-barge-in-monitor".into()) + .spawn(move || { + let mut last_activity_pubkey: Option = None; + let mut next_activity_tick = Instant::now(); + while !state.stop.load(Ordering::Acquire) { + if state.cancel.load(Ordering::Acquire) + || state.voice_cancel.load(Ordering::Acquire) + { + state.playback.cancel_if_live( + || { + state.cancel.load(Ordering::Acquire) + || state.voice_cancel.load(Ordering::Acquire) + }, + // Publish the release inside the replacement so an + // append winning the lock handoff cannot have its own + // activity publication overwritten by this `false`. + || { + state.broadcasters.cancel_all(); + state + .active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()) + .take(); + state.tts_active.store(false, Ordering::Release); + }, + ); + } + silence_cancelled_speaker( + &state.speaker_cancel, + &state.active_speaker, + &state.playback, + &state.tts_active, + ); + if let Some(ref app) = state.activity_app { + if state.tts_active.load(Ordering::Acquire) { + let now = Instant::now(); + if now >= next_activity_tick { + let frame = state + .activity_frames + .lock() + .unwrap_or_else(|error| error.into_inner()) + .pop_front(); + if let Some(frame) = frame { + use tauri::Emitter; + let _ = app.emit( + "huddle-tts-speaker-level", + TtsSpeakerActivityPayload { + pubkey: Some(frame.pubkey.clone()), + level: frame.level, + }, + ); + last_activity_pubkey = Some(frame.pubkey); + } + next_activity_tick = now + SPEAKER_ACTIVITY_TICK; + } + } else { + let had_activity = last_activity_pubkey.take().is_some(); + state + .activity_frames + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clear(); + if had_activity { + use tauri::Emitter; + let _ = app.emit( + "huddle-tts-speaker-level", + TtsSpeakerActivityPayload { + pubkey: None, + level: 0.0, + }, + ); + } + next_activity_tick = Instant::now(); + } + } + thread::sleep(MONITOR_TICK); + } + }) +} + +pub(super) fn silence_cancelled_speaker( + cancellation: &SpeakerCancellation, + active_speaker: &ActiveSpeaker, + playback: &PlaybackCoordinator, + tts_active: &AtomicBool, +) { + let Some(cancelled) = cancellation + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clone() + else { + return; + }; + playback.cancel_if_live( + || take_cancelled_active_speaker(&cancelled, active_speaker), + || tts_active.store(false, Ordering::Release), + ); +} + +fn take_cancelled_active_speaker(cancelled: &str, active_speaker: &ActiveSpeaker) -> bool { + let mut active = active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()); + if !active + .as_deref() + .is_some_and(|speaker| speaker.eq_ignore_ascii_case(cancelled)) + { + return false; + } + active.take(); + true +} + +pub(super) fn consume_speaker_cancel( + cancellation: &SpeakerCancellation, + active_speaker: &ActiveSpeaker, + generations: &SpeakerGenerations, + tts_active: &AtomicBool, + text_state: CancelTextState<'_>, + playback: Option<&PlaybackCoordinator>, +) -> bool { + let Some(cancelled) = cancellation + .lock() + .unwrap_or_else(|error| error.into_inner()) + .take() + else { + return false; + }; + let (text_rx, deferred_text, current_text) = text_state; + retain_current_speaker_text(generations, deferred_text, current_text, text_rx); + let mut cleared_player = false; + if let Some(playback) = playback { + if playback.cancel_if_live( + || take_cancelled_active_speaker(&cancelled, active_speaker), + || tts_active.store(false, Ordering::Release), + ) { + cleared_player = true; + } + } + // The monitor may already have cleared the cancelled speaker while the + // worker was blocked. If another speaker has since claimed the player, + // preserve that speaker's activity flag and lead-in state. + cleared_player +} + +#[cfg(test)] +mod tests { + use super::*; + + use std::sync::Barrier; + + use rodio::buffer::SamplesBuffer; + + /// Headless coordinator: a real mixer with its source held unpulled, so + /// the queue never drains and no output device is opened. + fn coordinator() -> (Arc, rodio::mixer::MixerSource) { + let channels = std::num::NonZero::new(1).expect("nonzero channels"); + let rate = std::num::NonZero::new(24_000).expect("nonzero rate"); + let (mixer, source) = rodio::mixer::mixer(channels, rate); + (Arc::new(PlaybackCoordinator::new(&mixer)), source) + } + + /// Append as `speaker` the way the worker does: activity is published + /// inside the append transition. + fn speak(playback: &PlaybackCoordinator, tts_active: &AtomicBool) { + let channels = std::num::NonZero::new(1).expect("nonzero channels"); + let rate = std::num::NonZero::new(24_000).expect("nonzero rate"); + assert!(playback.append_if( + SamplesBuffer::new(channels, rate, vec![0.25; 24_000]), + |_| true, + || tts_active.store(true, Ordering::Release), + )); + } + + #[test] + fn stale_targeted_cancel_does_not_release_the_next_speaker() { + let active_speaker = Arc::new(Mutex::new(Some("bob".to_string()))); + + assert!(!take_cancelled_active_speaker("alice", &active_speaker)); + assert_eq!( + active_speaker.lock().expect("active speaker").as_deref(), + Some("bob") + ); + } + + /// The wedge Mari found: the monitor silences the cancelled speaker while + /// the worker is mid-append. The monitor takes `active_speaker`, so the + /// worker's later `consume_speaker_cancel` fails authorization and never + /// clears `tts_active` — if the worker's `true` could land after the + /// monitor's `false`, mic gating stays active with nothing playing. + #[test] + fn a_targeted_cancel_racing_an_append_leaves_the_mic_gate_released() { + for _ in 0..64 { + let (playback, _unpulled_source) = coordinator(); + let tts_active = Arc::new(AtomicBool::new(false)); + let active_speaker: ActiveSpeaker = Arc::new(Mutex::new(None)); + let speaker_cancel: SpeakerCancellation = Arc::new(Mutex::new(None)); + + speak(&playback, &tts_active); + active_speaker + .lock() + .expect("active speaker") + .replace("alice".to_string()); + speaker_cancel + .lock() + .expect("speaker cancel") + .replace("alice".to_string()); + + let barrier = Arc::new(Barrier::new(2)); + let monitor = { + let playback = Arc::clone(&playback); + let tts_active = Arc::clone(&tts_active); + let active_speaker = Arc::clone(&active_speaker); + let speaker_cancel = Arc::clone(&speaker_cancel); + let barrier = Arc::clone(&barrier); + thread::spawn(move || { + barrier.wait(); + silence_cancelled_speaker( + &speaker_cancel, + &active_speaker, + &playback, + &tts_active, + ); + }) + }; + let worker = { + let playback = Arc::clone(&playback); + let tts_active = Arc::clone(&tts_active); + let barrier = Arc::clone(&barrier); + thread::spawn(move || { + barrier.wait(); + // The worker appends the next chunk of the utterance the + // monitor is cancelling. + playback.append_if( + SamplesBuffer::new( + std::num::NonZero::new(1).expect("nonzero channels"), + std::num::NonZero::new(24_000).expect("nonzero rate"), + vec![0.25; 24_000], + ), + |_| true, + || tts_active.store(true, Ordering::Release), + ) + }) + }; + + let appended = worker.join().expect("worker"); + monitor.join().expect("monitor"); + + // Whichever order the two took the coordinator, the surviving + // activity flag must describe the surviving player. + assert_eq!( + tts_active.load(Ordering::Acquire), + !playback.empty(), + "the mic gate must agree with the player that survived \ + (appended={appended})" + ); + } + } + + /// The worker arm of the same race: the monitor already took the speaker, + /// so `consume_speaker_cancel` is not authorized to clear anything. It + /// must not report a clear it did not perform, and it must not disturb the + /// activity flag the monitor already published. + #[test] + fn consuming_a_cancel_the_monitor_already_handled_preserves_the_released_gate() { + let (playback, _unpulled_source) = coordinator(); + let tts_active = Arc::new(AtomicBool::new(false)); + let active_speaker: ActiveSpeaker = Arc::new(Mutex::new(None)); + let speaker_cancel: SpeakerCancellation = Arc::new(Mutex::new(None)); + let generations: SpeakerGenerations = Arc::new(Mutex::new(HashMap::new())); + let (_text_tx, text_rx) = mpsc::channel::(); + let mut deferred_text = VecDeque::new(); + let mut current_text = None; + + speak(&playback, &tts_active); + active_speaker + .lock() + .expect("active speaker") + .replace("alice".to_string()); + speaker_cancel + .lock() + .expect("speaker cancel") + .replace("alice".to_string()); + + silence_cancelled_speaker(&speaker_cancel, &active_speaker, &playback, &tts_active); + assert!( + !tts_active.load(Ordering::Acquire), + "the monitor releases the mic gate it cancelled" + ); + + let cleared = consume_speaker_cancel( + &speaker_cancel, + &active_speaker, + &generations, + &tts_active, + (&text_rx, &mut deferred_text, &mut current_text), + Some(&playback), + ); + + assert!( + !cleared, + "the worker must not claim a clear the monitor already performed" + ); + assert!( + !tts_active.load(Ordering::Acquire), + "the released mic gate must survive the worker's pass" + ); + assert!(playback.empty(), "the cancelled utterance stays silenced"); + } +} diff --git a/desktop/src-tauri/src/huddle/tts_streaming.rs b/desktop/src-tauri/src/huddle/tts_streaming.rs new file mode 100644 index 00000000000..cf618f8be69 --- /dev/null +++ b/desktop/src-tauri/src/huddle/tts_streaming.rs @@ -0,0 +1,97 @@ +//! EXPERIMENTAL (latency bench): streaming synthesis path for the TTS worker. +//! +//! `BUZZ_TTS_STREAMING=1` streams PCM deltas out of Pocket as they are +//! generated instead of waiting for the full first-chunk synthesis. +//! `BUZZ_TTS_EMIT_FRAMES` tunes the delta size in Flow LM frames (80 ms of +//! audio each). Default 12 = the Mimi decoder's native chunk, which keeps +//! streamed audio bit-identical to the batch path; smaller deltas are faster +//! to first audio but diverge (~23 dB SNR vs batch — decoder intra-chunk +//! lookahead). + +use super::*; + +use crate::huddle::pocket::{PocketTts, VoiceStyle}; + +/// Read the streaming env overrides once per worker: `Some(emit_frames)` +/// when `BUZZ_TTS_STREAMING=1`, `None` for the production batch path. +pub(super) fn streaming_emit_frames() -> Option { + std::env::var("BUZZ_TTS_STREAMING") + .is_ok_and(|v| v == "1") + .then(|| { + std::env::var("BUZZ_TTS_EMIT_FRAMES") + .ok() + .and_then(|v| v.parse().ok()) + .unwrap_or(12) + }) +} + +/// Playback context threaded through one streamed chunk. +pub(super) struct StreamingPlayback<'a> { + pub(super) playback: &'a PlaybackCoordinator, + pub(super) route_id: u64, +} + +/// Synthesize one text chunk through `synth_chunk_streaming`, appending PCM +/// deltas to the player as they are generated so first audio lands after +/// ~`emit_frames` of generation instead of after the whole first-chunk +/// synthesis. Delta boundary decoration reuses `PlaybackChunkAudio`: lead-in +/// on the first delta, fade-out only on the final one. +/// +/// `signals` = (cancel, voice_cancel, shutdown); `append_audio` returns +/// `false` to abort (its own cancellation checks and logging apply). Returns +/// `None` on success or `Some(outcome)` — the worker's `synthesis_outcome` +/// label — when the chunk was cancelled or failed. +pub(super) fn synthesize_streaming( + engine: &PocketTts, + text: &str, + style: &VoiceStyle, + emit_frames: usize, + signals: (&AtomicBool, &AtomicBool, &AtomicBool), + playback: StreamingPlayback<'_>, + append_audio: &mut dyn FnMut(PreparedModelAudio) -> bool, +) -> Option<&'static str> { + let (cancel, voice_cancel, shutdown) = signals; + let StreamingPlayback { playback, route_id } = playback; + let mut playback_audio = PlaybackChunkAudio::new(); + let mut delta_index = 0usize; + let stream_result = engine.synth_chunk_streaming(text, style, emit_frames, &mut |samples| { + if cancel.load(Ordering::Acquire) + || voice_cancel.load(Ordering::Acquire) + || shutdown.load(Ordering::Acquire) + { + return false; + } + let chunk_index = delta_index; + delta_index += 1; + if let Some(prepared) = + playback.prepare_audio(|empty| playback_audio.push(samples, chunk_index, empty)) + { + if !append_audio(prepared) { + return false; + } + } + true + }); + match stream_result { + Ok(true) => { + if let Some(prepared) = playback.prepare_audio(|empty| playback_audio.finish(empty)) { + if !append_audio(prepared) { + return Some("cancelled"); + } + } + None + } + Ok(false) => { + eprintln!( + "buzz-desktop: tts stage=synthesis status=cancelled reason=stream_callback route_id={route_id}" + ); + Some("cancelled") + } + Err(_) => { + eprintln!( + "buzz-desktop: tts stage=synthesis status=failed reason=inference route_id={route_id}" + ); + Some("failed") + } + } +} diff --git a/desktop/src-tauri/src/huddle/tts_tests.rs b/desktop/src-tauri/src/huddle/tts_tests.rs index 1908b096b18..3e94aa43e1f 100644 --- a/desktop/src-tauri/src/huddle/tts_tests.rs +++ b/desktop/src-tauri/src/huddle/tts_tests.rs @@ -12,6 +12,117 @@ use std::sync::{Arc, Mutex}; #[path = "tts_tests/token_split.rs"] mod token_split; +// ── Human-floor queue authorization ─────────────────────────────────────── + +fn queued_text(route_id: u64, floor_epoch: u64) -> QueuedText { + QueuedText { + generation: 1, + floor_epoch, + route_id, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, + text: "queued while a human is speaking".to_string(), + } +} + +#[test] +fn production_worker_append_authorization_completes() { + let (completed_tx, completed_rx) = mpsc::sync_channel(1); + let worker = std::thread::spawn(move || { + let human_floor = HumanFloor::new(); + let playback = human_floor.playback(); + let channels = NonZero::new(1).expect("nonzero channels"); + let rate = NonZero::new(SAMPLE_RATE).expect("nonzero rate"); + let (mixer, _unpulled_source) = rodio::mixer::mixer(channels, rate); + playback.bind_mixer(&mixer); + let floor_epoch = human_floor.epoch(); + let cancel = AtomicBool::new(false); + let voice_cancel = AtomicBool::new(false); + let shutdown = AtomicBool::new(false); + let tts_active = AtomicBool::new(false); + let speaker_generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(None)); + let activity_frames = Mutex::new(VecDeque::new()); + let context = TtsAppendContext { + playback: &playback, + human_floor: &human_floor, + cancel: &cancel, + voice_cancel: &voice_cancel, + shutdown: &shutdown, + tts_active: &tts_active, + speaker_generations: &speaker_generations, + active_speaker: &active_speaker, + activity_frames: &activity_frames, + broadcasters: &TtsBroadcasters::default(), + channels, + rate, + }; + + let accepted = append_worker_audio( + &context, + PreparedModelAudio { + buffer: vec![0.25; SAMPLE_RATE as usize], + sample_count: SAMPLE_RATE as usize, + chunk_index: 0, + }, + 40, + None, + 0, + floor_epoch, + || {}, + ); + completed_tx + .send((accepted, tts_active.load(Ordering::Acquire))) + .expect("completion receiver"); + }); + + assert_eq!( + completed_rx + .recv_timeout(std::time::Duration::from_secs(1)) + .expect("production worker append authorization must not deadlock"), + (true, true) + ); + worker.join().expect("append worker"); +} + +#[test] +fn worker_queue_defers_text_while_floor_is_held_then_releases_it() { + let human_floor = HumanFloor::new(); + assert!(human_floor.enter_local(true, false)); + let floor_epoch = human_floor.epoch(); + let mut deferred = VecDeque::new(); + + assert!(matches!( + authorize_or_defer_queued_text(&human_floor, &mut deferred, queued_text(41, floor_epoch),), + Err(HumanFloorAuthorization::Blocked) + )); + assert_eq!(deferred.len(), 1, "held-floor text must stay queued"); + + human_floor.leave_local(); + let queued = deferred.pop_front().expect("deferred text"); + let released = authorize_or_defer_queued_text(&human_floor, &mut deferred, queued) + .expect("the same queue item is eligible after floor release"); + + assert_eq!(released.route_id, 41); + assert!(deferred.is_empty()); +} + +#[test] +fn worker_queue_drops_text_from_before_human_onset() { + let human_floor = HumanFloor::new(); + let stale_epoch = human_floor.epoch(); + assert!(human_floor.enter_local(true, false)); + human_floor.leave_local(); + let mut deferred = VecDeque::new(); + + assert!(matches!( + authorize_or_defer_queued_text(&human_floor, &mut deferred, queued_text(42, stale_epoch),), + Err(HumanFloorAuthorization::Stale) + )); + assert!(deferred.is_empty(), "pre-barge-in text must not replay"); +} + // ── Remote interrupt tracker ────────────────────────────────────────────── // // Models the per-peer frame counting logic in the recv task of @@ -32,6 +143,19 @@ mod token_split; // - Counters reset on the 500ms window (Instant-based in production, // on_tick() in tests — logically equivalent). // - Uses Acquire for tts_active reads, Release for tts_cancel writes. + +#[test] +fn tts_speaker_activity_uses_the_playback_waveform() { + let mut samples = vec![0.0; 1_200]; + samples.extend(vec![0.25; 1_200]); + + let frames = build_tts_speaker_activity_frames(&samples, "agent-pubkey", 24_000); + + assert_eq!(frames.len(), 2); + assert_eq!(frames[0].pubkey, "agent-pubkey"); + assert_eq!(frames[0].level, 0.0); + assert!(frames[1].level > 0.5); +} // use crate::huddle::relay_api::REMOTE_SPEECH_THRESHOLD; @@ -287,24 +411,6 @@ fn cancel_already_true_is_harmless() { ); } -// ── Regression: local-only interrupt still works ────────────────────────── - -/// The existing local barge-in path (STT detects speech → sets tts_cancel) -/// must continue to work independently of remote frame counting. -#[test] -fn local_barge_in_still_works_without_remote_frames() { - let _tts_active = AtomicBool::new(true); - let tts_cancel = AtomicBool::new(false); - - // Simulate local STT barge-in (stt.rs after BARGE_IN_DEBOUNCE_FRAMES). - tts_cancel.store(true, Ordering::Release); - - assert!( - tts_cancel.load(Ordering::Acquire), - "local barge-in should set tts_cancel", - ); -} - // ── Cancel consumption tests (TTS worker side) ──────────────────────────── /// TTS worker correctly resets both tts_cancel and tts_active after cancel. @@ -790,98 +896,52 @@ fn apply_fade_out_single_sample() { // ── build_sentence_append_buffer tests ─────────────────────────────────── -/// REGRESSION: every chunk needs an onset cushion; synthesized chunks -/// can start with speech energy within the first millisecond. +/// Playback chunks are contiguous: Pocket's generated pause is not extended +/// with a fixed inter-sentence silence budget. #[test] -fn lead_in_pad_is_present_for_every_sentence_chunk() { - const SENTENCE_AUDIO_LEN: usize = 1000; - const SILENCE_BUF_LEN: usize = 2400; // 100 ms at 24 kHz, like production - const N_SENTENCES: usize = 5; +fn sentence_append_buffer_does_not_inject_silence() { + let first_buf = build_sentence_append_buffer(vec![0.5; 100], false); + let second_buf = build_sentence_append_buffer(vec![0.25; 100], false); - let mut first = true; - - for _ in 0..N_SENTENCES { - let buf = build_sentence_append_buffer( - &mut first, - vec![0.5_f32; SENTENCE_AUDIO_LEN], - SILENCE_BUF_LEN, - true, - true, - ); - - assert_eq!(buf.len(), SENTENCE_AUDIO_LEN + SILENCE_BUF_LEN); - assert!( - buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0), - "lead-in pad must be pure silence" - ); - assert!( - buf[SENTENCE_LEAD_IN_SAMPLES..SENTENCE_LEAD_IN_SAMPLES + SENTENCE_AUDIO_LEN] - .iter() - .all(|&s| s == 0.5), - "sentence audio must immediately follow the lead-in" - ); - assert!( - buf[SENTENCE_LEAD_IN_SAMPLES + SENTENCE_AUDIO_LEN..] - .iter() - .all(|&s| s == 0.0), - "trailing gap must be pure silence" - ); - } - - assert!(!first, "first_append flag must be cleared after first call"); + assert_eq!(first_buf, vec![0.5; 100]); + assert_eq!(second_buf, vec![0.25; 100]); } -/// `first_append` still flips on the first call for `tts_active` gating. +/// If generation falls behind playback, retain the onset cushion that protects +/// the first phoneme while the output path wakes back up. #[test] -fn build_sentence_append_buffer_flips_first_append() { - let mut first = true; - let _ = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); - assert!(!first, "first call must flip the flag"); - - // Subsequent call: still has a per-sentence lead-in, flag stays false. - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); - assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); - assert!(!first); -} +fn idle_playback_gets_an_onset_cushion() { + let buf = build_sentence_append_buffer(vec![0.5; 100], true); -/// Leading silence is exactly the lead-in; no pre-audio gap is double-counted. -#[test] -fn first_sentence_leading_silence_is_exactly_lead_in() { - let mut first = true; - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); + assert_eq!(buf.len(), SENTENCE_LEAD_IN_SAMPLES + 100); assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); assert_eq!(buf[SENTENCE_LEAD_IN_SAMPLES], 0.5); } -/// Tail silence plus the next lead-in preserves the 100 ms sentence gap. #[test] -fn sentence_gap_budget_is_preserved() { - let mut first = true; - let silence_buf_len = 2400; - let first_buf = - build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, true); - let second_buf = - build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, true); - - let first_tail = &first_buf[SENTENCE_LEAD_IN_SAMPLES + 100..]; - let second_lead = &second_buf[..SENTENCE_LEAD_IN_SAMPLES]; - assert_eq!(first_tail.len(), silence_buf_len - SENTENCE_LEAD_IN_SAMPLES); - assert_eq!(second_lead.len(), SENTENCE_LEAD_IN_SAMPLES); - assert_eq!(first_tail.len() + second_lead.len(), silence_buf_len); -} +fn tts_worker_uses_distinct_playback_and_model_splitters() { + let source = include_str!("tts.rs"); + let playback_calls = source.matches("engine.split_text_for_playback(").count(); + let model_calls = source.matches("engine.split_text_into_chunks(").count(); -/// Regression guard: one contiguous rodio source per synthesized sentence. -#[test] -fn sentence_append_buffer_is_one_contiguous_source() { - let mut first = true; - let buf = build_sentence_append_buffer(&mut first, vec![0.5; 100], 2400, true, true); - - assert_eq!(buf.len(), 2400 + 100); - assert!(buf[..SENTENCE_LEAD_IN_SAMPLES].iter().all(|&s| s == 0.0)); + assert_eq!( + (playback_calls, model_calls), + (1, 1), + "the worker must isolate sentence one only in the outer playback split" + ); + + // Counts alone are order-blind: swapping the two call sites keeps them at + // (1, 1) while the outer split stops isolating sentence one, which delays + // first audio by a whole generation. Pin the ORDER too. + let playback_at = source + .find("engine.split_text_for_playback(") + .expect("outer playback split exists"); + let model_at = source + .find("engine.split_text_into_chunks(") + .expect("inner model split exists"); assert!( - buf[SENTENCE_LEAD_IN_SAMPLES..SENTENCE_LEAD_IN_SAMPLES + 100] - .iter() - .all(|&s| s == 0.5) + playback_at < model_at, + "the playback split must be the OUTER pass; swapping the two delays first audio" ); } @@ -912,79 +972,3 @@ fn clamp_to_full_scale_empty_buffer() { let out = clamp_to_full_scale(Vec::new()); assert!(out.is_empty()); } - -// ── group_sentences_into_chunks tests ───────────────────────────────────── - -fn s(v: &[&str]) -> Vec { - v.iter().map(|x| x.to_string()).collect() -} - -/// The first sentence always stands alone — it bounds time-to-first-audio. -/// Even when the whole message would fit in one chunk, sentence one must -/// not wait on synthesis of the rest. -#[test] -fn chunk_grouping_first_sentence_is_always_alone() { - let chunks = group_sentences_into_chunks(&s(&["Hi there.", "Short.", "Tiny."]), 200); - assert_eq!(chunks[0], "Hi there."); - assert_eq!(chunks.len(), 2); - assert_eq!(chunks[1], "Short. Tiny."); -} - -/// Sentences after the first pack greedily up to the char budget, then -/// spill into a new chunk. Fewer generate() calls = fewer prosody seams. -#[test] -fn chunk_grouping_packs_up_to_budget_then_spills() { - let a = "A".repeat(50) + "."; - let b = "B".repeat(50) + "."; - let c = "C".repeat(50) + "."; - let d = "D".repeat(50) + "."; - // Budget of 110: b+c fits (51+1+51 = 103), adding d (103+1+51) does not. - let chunks = group_sentences_into_chunks(&s(&[&a, &b, &c, &d]), 110); - assert_eq!(chunks.len(), 3, "chunks: {chunks:?}"); - assert_eq!(chunks[0], a); - assert_eq!(chunks[1], format!("{b} {c}")); - assert_eq!(chunks[2], d); -} - -/// A single sentence longer than the coarse budget is passed through here; -/// the loaded April engine subsequently enforces its exact 50-token limit. -#[test] -fn chunk_grouping_oversized_sentence_passes_through() { - let long = "word ".repeat(60).trim_end().to_string() + "."; - assert!(long.len() > 200); - let chunks = group_sentences_into_chunks(&s(&["First.", &long]), 200); - assert_eq!(chunks, vec!["First.".to_string(), long]); -} - -/// Single-sentence messages — the common huddle case, since agents are -/// prompted to send one sentence per message — are unaffected by grouping. -#[test] -fn chunk_grouping_single_sentence_unchanged() { - let chunks = group_sentences_into_chunks(&s(&["Just one sentence here."]), 200); - assert_eq!(chunks, vec!["Just one sentence here.".to_string()]); -} - -/// Empty and whitespace-only entries are dropped, and never produce -/// empty chunks (which would synthesize as garbage). -#[test] -fn chunk_grouping_skips_blank_sentences() { - let chunks = group_sentences_into_chunks(&s(&["", " ", "Real sentence.", " ", "Two."]), 200); - assert_eq!(chunks[0], "Real sentence."); - assert_eq!(chunks.len(), 2); - assert_eq!(chunks[1], "Two."); -} - -/// Empty input produces no chunks (the worker loop then synthesizes nothing). -#[test] -fn chunk_grouping_empty_input() { - assert!(group_sentences_into_chunks(&[], 200).is_empty()); -} - -/// Chunks joined with a single space preserve each sentence's terminal -/// punctuation — the model sees natural multi-sentence prose, matching the -/// shape upstream's ~50-token chunker produces. -#[test] -fn chunk_grouping_preserves_punctuation_at_joins() { - let chunks = group_sentences_into_chunks(&s(&["Lead.", "Really?", "Yes!", "Good."]), 200); - assert_eq!(chunks[1], "Really? Yes! Good."); -} diff --git a/desktop/src-tauri/src/huddle/tts_tests/token_split.rs b/desktop/src-tauri/src/huddle/tts_tests/token_split.rs index b9249c9afc4..bd9d85215ef 100644 --- a/desktop/src-tauri/src/huddle/tts_tests/token_split.rs +++ b/desktop/src-tauri/src/huddle/tts_tests/token_split.rs @@ -1,24 +1,22 @@ use super::*; -/// The onset cushion covers 20 ms at the production sample rate. +/// The onset cushion rounds rodio's 512-sample bootstrap span up to 22 ms at +/// the 24 kHz production sample rate (528 samples). #[test] -fn sentence_lead_in_is_sane() { - assert_eq!(SENTENCE_LEAD_IN_SAMPLES, 480, "20 ms × 24 kHz"); +fn chunk_lead_in_is_sane() { + assert_eq!(RODIO_ADD_BOOTSTRAP_SPAN_SAMPLES, 512); + assert_eq!(SENTENCE_LEAD_IN_SAMPLES, 528, "22 ms × 24 kHz"); } /// Model-token splits remain contiguous: only the playback chunk as a whole /// receives its onset cushion and trailing sentence gap. #[test] fn token_split_units_do_not_add_sentence_boundary_padding() { - let mut first = true; - let silence_buf_len = 2400; - let first_unit = - build_sentence_append_buffer(&mut first, vec![0.5; 100], silence_buf_len, true, false); - let last_unit = - build_sentence_append_buffer(&mut first, vec![0.25; 100], silence_buf_len, false, true); + let first_unit = build_sentence_append_buffer(vec![0.5; 100], false); + let last_unit = build_sentence_append_buffer(vec![0.25; 100], false); - assert_eq!(first_unit.len(), SENTENCE_LEAD_IN_SAMPLES + 100); + assert_eq!(first_unit.len(), 100); assert_eq!(first_unit.last(), Some(&0.5)); assert_eq!(last_unit.first(), Some(&0.25)); - assert_eq!(first_unit.len() + last_unit.len(), 200 + silence_buf_len); + assert_eq!(first_unit.len() + last_unit.len(), 200); } diff --git a/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs b/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs index 45662c99212..260239521e3 100644 --- a/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs +++ b/desktop/src-tauri/src/huddle/tts_voice_selection_tests.rs @@ -16,10 +16,16 @@ fn inert_pipeline(cancel: Arc) -> TtsPipeline { tts_active: Arc::new(AtomicBool::new(false)), shutdown, cancel, + human_floor: HumanFloor::new(), voice_cancel: Arc::new(AtomicBool::new(false)), voice: Arc::new(std::sync::Mutex::new("reference_sample".to_string())), voice_generation: Arc::new(AtomicU64::new(1)), + speaker_generations: Arc::new(std::sync::Mutex::new(HashMap::new())), + active_speaker: Arc::new(std::sync::Mutex::new(None)), + speaker_cancel: Arc::new(std::sync::Mutex::new(None)), + playback_probe: PlaybackProbe::new(), voice_change_ack: Arc::new(std::sync::Mutex::new(None)), + broadcasters: TtsBroadcasters::default(), thread: Some(thread), } } @@ -165,8 +171,12 @@ fn an_in_hand_post_change_message_survives_cancellation() { )); text_tx .send(QueuedText { + floor_epoch: 0, generation: voice_generation.load(Ordering::Acquire), route_id: 1, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "new message".to_string(), }) .expect("new message"); @@ -176,13 +186,21 @@ fn an_in_hand_post_change_message_survives_cancellation() { let active = AtomicBool::new(true); let mut deferred_text = VecDeque::from([ QueuedText { + floor_epoch: 0, generation: 1, route_id: 2, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "old message".to_string(), }, QueuedText { + floor_epoch: 0, generation: voice_generation.load(Ordering::Acquire), route_id: 3, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "later new message".to_string(), }, ]); @@ -237,8 +255,12 @@ fn superseding_voice_change_removes_earlier_deferred_messages() { ) .expect("first voice change"); deferred_text.push_back(QueuedText { + floor_epoch: 0, generation: voice_generation.load(Ordering::Acquire), route_id: 4, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "message for Eve".to_string(), }); assert!(handle_cancel_or_shutdown( @@ -283,8 +305,12 @@ fn barge_in_clears_deferred_voice_change_messages() { let voice_change_ack = Arc::new(std::sync::Mutex::new(None)); let (_text_tx, text_rx) = std::sync::mpsc::channel(); let mut deferred_text = VecDeque::from([QueuedText { + floor_epoch: 0, generation: 2, route_id: 5, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "deferred message".to_string(), }]); let mut current_text = None; @@ -324,8 +350,12 @@ fn barge_in_during_a_voice_change_clears_post_change_messages() { ) .expect("voice change"); deferred_text.push_back(QueuedText { + floor_epoch: 0, generation: voice_generation.load(Ordering::Acquire), route_id: 6, + speaker_pubkey: None, + speaker_generation: 0, + voice_reference: None, text: "post-change message".to_string(), }); barge_in.store(true, Ordering::Release); @@ -353,6 +383,8 @@ fn a_sender_captured_before_voice_change_is_stale_even_if_it_sends_after_drain() let old_sender = TtsTextSender { text_tx, generation: voice_generation.load(Ordering::Acquire), + human_floor: HumanFloor::new(), + speaker_generations: Arc::new(std::sync::Mutex::new(HashMap::new())), }; let shutdown = AtomicBool::new(false); let active = AtomicBool::new(true); @@ -377,9 +409,16 @@ fn a_sender_captured_before_voice_change_is_stale_even_if_it_sends_after_drain() None, )); old_sender - .send(7, "late old message".to_string()) + .send( + 7, + "agent".to_string(), + 0, + "reference_sample".to_string(), + "late old message".to_string(), + ) .expect("late send"); let late = text_rx.recv().expect("late queued text"); assert!(late.generation < voice_generation.load(Ordering::Acquire)); + assert_eq!(late.voice_reference.as_deref(), Some("reference_sample")); } diff --git a/desktop/src-tauri/src/huddle/tts_voice_transition.rs b/desktop/src-tauri/src/huddle/tts_voice_transition.rs index 81b33672d34..11f3acd2e4c 100644 --- a/desktop/src-tauri/src/huddle/tts_voice_transition.rs +++ b/desktop/src-tauri/src/huddle/tts_voice_transition.rs @@ -1,5 +1,6 @@ use std::{ - collections::VecDeque, + collections::{HashMap, VecDeque}, + fmt, path::Path, sync::{ atomic::{AtomicBool, AtomicU64, Ordering}, @@ -8,6 +9,8 @@ use std::{ }, }; +use super::{HumanFloor, PlaybackCoordinator, SynthesisFlightGuard}; + use crate::huddle::pocket::{load_voice_style, VoiceStyle, DEFAULT_VOICE, VOICE_FILE_EXT}; #[derive(Debug)] @@ -19,6 +22,9 @@ pub(super) struct PendingVoiceChange { pub(super) type VoiceChangeAck = Arc>>; pub(super) type WorkerVoiceState = (Arc>, Arc, VoiceChangeAck); pub(super) type WorkerCancelSignals = (Arc, Arc); +pub(super) type SpeakerGenerations = Arc>>; +pub(super) type ActiveSpeaker = Arc>>; +pub(super) type SpeakerCancellation = Arc>>; pub(super) type CancelTextState<'a> = ( &'a mpsc::Receiver, &'a mut VecDeque, @@ -26,10 +32,53 @@ pub(super) type CancelTextState<'a> = ( ); pub(super) type CancelSignals<'a> = (&'a AtomicBool, &'a AtomicBool); +#[derive(Clone)] +pub(super) struct PlaybackProbe { + playback: Arc>>>, +} + +impl PlaybackProbe { + pub(super) fn new() -> Self { + Self { + playback: Arc::new(Mutex::new(None)), + } + } + + pub(super) fn install(&self, playback: Arc) { + self.playback + .lock() + .unwrap_or_else(|error| error.into_inner()) + .replace(playback); + } + + pub(super) fn begin_synthesis(&self) -> Option { + self.playback().map(|playback| playback.begin_synthesis()) + } + + pub(super) fn playback(&self) -> Option> { + self.playback + .lock() + .unwrap_or_else(|error| error.into_inner()) + .clone() + } +} + +impl fmt::Debug for PlaybackProbe { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("PlaybackProbe") + .finish_non_exhaustive() + } +} + #[derive(Debug)] pub(super) struct QueuedText { pub(super) generation: u64, + pub(super) floor_epoch: u64, pub(super) route_id: u64, + pub(super) speaker_pubkey: Option, + pub(super) speaker_generation: u64, + pub(super) voice_reference: Option, pub(super) text: String, } @@ -37,18 +86,182 @@ pub(super) struct QueuedText { pub(crate) struct TtsTextSender { pub(super) text_tx: SyncSender, pub(super) generation: u64, + pub(super) human_floor: HumanFloor, + pub(super) speaker_generations: SpeakerGenerations, } impl TtsTextSender { - pub(crate) fn send(&self, route_id: u64, text: String) -> Result<(), String> { + pub(crate) fn send( + &self, + route_id: u64, + speaker_pubkey: String, + speaker_generation: u64, + voice_reference: String, + text: String, + ) -> Result<(), String> { + let floor_epoch = self.human_floor.epoch(); self.text_tx .send(QueuedText { generation: self.generation, + floor_epoch, route_id, + speaker_pubkey: Some(speaker_pubkey), + speaker_generation, + voice_reference: Some(voice_reference), text, }) .map_err(|error| error.to_string()) } + + pub(crate) fn speaker_generation(&self, speaker_pubkey: &str) -> u64 { + current_speaker_generation(&self.speaker_generations, speaker_pubkey) + } +} + +pub(super) fn current_speaker_generation( + generations: &SpeakerGenerations, + speaker_pubkey: &str, +) -> u64 { + generations + .lock() + .unwrap_or_else(|error| error.into_inner()) + .get(&speaker_pubkey.to_ascii_lowercase()) + .copied() + .unwrap_or(0) +} + +pub(super) fn advance_speaker_generation( + generations: &SpeakerGenerations, + speaker_pubkey: &str, +) -> u64 { + let mut generations = generations + .lock() + .unwrap_or_else(|error| error.into_inner()); + let generation = generations + .entry(speaker_pubkey.to_ascii_lowercase()) + .or_default(); + *generation = generation.saturating_add(1); + *generation +} + +pub(super) fn queued_speaker_is_current( + generations: &SpeakerGenerations, + queued: &QueuedText, +) -> bool { + queued + .speaker_pubkey + .as_deref() + .is_none_or(|speaker_pubkey| { + current_speaker_generation(generations, speaker_pubkey) == queued.speaker_generation + }) +} + +pub(super) fn request_speaker_cancel( + generations: &SpeakerGenerations, + active_speaker: &ActiveSpeaker, + cancellation: &SpeakerCancellation, + speaker_pubkey: &str, +) { + advance_speaker_generation(generations, speaker_pubkey); + let owns_player = active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()) + .as_deref() + .is_some_and(|active| active.eq_ignore_ascii_case(speaker_pubkey)); + if owns_player { + cancellation + .lock() + .unwrap_or_else(|error| error.into_inner()) + .replace(speaker_pubkey.to_ascii_lowercase()); + } +} + +pub(super) fn request_active_speaker_cancel( + generations: &SpeakerGenerations, + active_speaker: &ActiveSpeaker, + cancellation: &SpeakerCancellation, + playback_probe: &PlaybackProbe, + expected_speaker_pubkey: &str, +) -> bool { + let Some(playback) = playback_probe.playback() else { + return false; + }; + playback.with_playback_live(|playback_live| { + request_active_speaker_cancel_while_locked( + generations, + active_speaker, + cancellation, + playback_live, + expected_speaker_pubkey, + ) + }) +} + +fn request_active_speaker_cancel_while_locked( + generations: &SpeakerGenerations, + active_speaker: &ActiveSpeaker, + cancellation: &SpeakerCancellation, + playback_live: bool, + expected_speaker_pubkey: &str, +) -> bool { + if !playback_live { + return false; + } + let active = active_speaker + .lock() + .unwrap_or_else(|error| error.into_inner()); + let Some(speaker_pubkey) = active.as_deref() else { + return false; + }; + if !speaker_pubkey.eq_ignore_ascii_case(expected_speaker_pubkey) { + return false; + } + + // Keep ownership locked until the generation and cancellation request are + // committed. The drain path takes the same lock, so the request is bound + // to the utterance the Stop action actually observed. + let mut cancellation = cancellation + .lock() + .unwrap_or_else(|error| error.into_inner()); + if cancellation + .as_deref() + .is_some_and(|pending| pending.eq_ignore_ascii_case(speaker_pubkey)) + { + return false; + } + advance_speaker_generation(generations, speaker_pubkey); + cancellation.replace(speaker_pubkey.to_ascii_lowercase()); + true +} + +pub(super) fn retain_current_speaker_text( + generations: &SpeakerGenerations, + deferred_text: &mut VecDeque, + current_text: &mut Option, + text_rx: &mpsc::Receiver, +) { + deferred_text.retain(|text| queued_speaker_is_current(generations, text)); + if let Some(text) = current_text.take() { + if queued_speaker_is_current(generations, &text) { + deferred_text.push_front(text); + } else { + log_cancelled_route(text.route_id, "speaker_removed"); + } + } + while let Ok(text) = text_rx.try_recv() { + if queued_speaker_is_current(generations, &text) { + deferred_text.push_back(text); + } else { + log_cancelled_route(text.route_id, "speaker_removed"); + } + } +} + +pub(super) fn has_pending_voice_change(voice_change_ack: &VoiceChangeAck) -> bool { + voice_change_ack + .lock() + .unwrap_or_else(|error| error.into_inner()) + .is_some() } pub(super) fn begin_voice_change( @@ -151,6 +364,43 @@ pub(super) fn reconcile_selected_voice( } } +pub(super) fn reconcile_queued_voice( + model_dir: &Path, + requested_voice: &str, + selected_voice: &Mutex, + voice_name: &mut String, + style: &mut VoiceStyle, + style_cache: &mut HashMap, +) -> bool { + if requested_voice == voice_name.as_str() { + return true; + } + if let Some(cached) = style_cache.get(requested_voice) { + *style = cached.clone(); + *voice_name = requested_voice.to_owned(); + return true; + } + + match load_voice_style(&voice_path(model_dir, requested_voice)) { + Ok(requested_style) => { + style_cache.insert(requested_voice.to_owned(), requested_style.clone()); + *style = requested_style; + *voice_name = requested_voice.to_owned(); + true + } + Err(_) => { + eprintln!( + "buzz-desktop: tts stage=agent_voice_switch status=fallback reason=voice_style" + ); + let ready = reconcile_selected_voice(model_dir, selected_voice, voice_name, style); + if ready { + style_cache.insert(voice_name.clone(), style.clone()); + } + ready + } + } +} + pub(super) fn voice_path(model_dir: &Path, voice: &str) -> std::path::PathBuf { let path = Path::new(voice); if path.is_absolute() { @@ -204,3 +454,335 @@ pub(super) fn retain_cancelled_text( fn log_cancelled_route(route_id: u64, reason: &str) { eprintln!("buzz-desktop: tts stage=queue status=dropped reason={reason} route_id={route_id}"); } + +/// Check for cancel or shutdown. Returns `true` if the caller should break/continue. +/// On cancel: drains the text queue and clears the cancel flag. +/// +/// `playback` is the coordinator shared with the barge-in monitor; replacing +/// playback is serialized with append and with the monitor's stale observation. +pub(super) fn handle_cancel_or_shutdown( + cancel_signals: CancelSignals<'_>, + shutdown: &AtomicBool, + tts_active: &AtomicBool, + text_state: CancelTextState<'_>, + voice_change_ack: &VoiceChangeAck, + active_route_id: Option, + playback: Option<&PlaybackCoordinator>, +) -> bool { + let (cancel, voice_cancel) = cancel_signals; + let (text_rx, deferred_text, current_text) = text_state; + if shutdown.load(Ordering::Acquire) { + eprintln!( + "buzz-desktop: tts stage=cancellation reason=shutdown route_id={}", + active_route_id.unwrap_or(0) + ); + release_playback(playback, tts_active); + return true; + } + if cancel.load(Ordering::Acquire) || voice_cancel.load(Ordering::Acquire) { + // Serialize with begin_voice_change so the generation boundary and + // cancel consumption are observed as one transition. + let pending_voice_change = voice_change_ack + .lock() + .unwrap_or_else(|error| error.into_inner()); + // Consume at the serialization point. A later barge-in remains true + // for the next pass instead of being overwritten after queue cleanup. + let barge_in = cancel.swap(false, Ordering::AcqRel); + voice_cancel.store(false, Ordering::Release); + eprintln!( + "buzz-desktop: tts stage=cancellation reason={} route_id={}", + if barge_in { "barge_in" } else { "voice_switch" }, + active_route_id.unwrap_or(0) + ); + let preserve_generation = (!barge_in) + .then(|| { + pending_voice_change + .as_ref() + .map(|pending| pending.generation) + }) + .flatten(); + retain_cancelled_text(deferred_text, current_text, text_rx, preserve_generation); + // Consume the flag at the coordinator serialization point: once + // released with `cancel == false`, a stale monitor observation cannot + // replace fresh post-cancel playback. + release_playback(playback, tts_active); + return true; + } + false +} + +/// Silence playback and release the mic gate as one transition. When a player +/// is live the release is published inside the replacement, so an append that +/// wins the coordinator handoff cannot have its own activity publication +/// overwritten by this `false`. With nothing live there is no transition to +/// join and the gate is released directly. +fn release_playback(playback: Option<&PlaybackCoordinator>, tts_active: &AtomicBool) { + let released = playback.is_some_and(|playback| { + playback.cancel_if_live(|| true, || tts_active.store(false, Ordering::Release)) + }); + if !released { + tts_active.store(false, Ordering::Release); + } +} + +#[cfg(test)] +mod speaker_generation_tests { + use super::*; + + fn playback_probe(playback_live: bool) -> PlaybackProbe { + let channels = std::num::NonZero::new(1).expect("non-zero channels"); + let sample_rate = std::num::NonZero::new(24_000).expect("non-zero sample rate"); + let (mixer, _mixer_source) = rodio::mixer::mixer(channels, sample_rate); + let playback = Arc::new(PlaybackCoordinator::new(&mixer)); + if playback_live { + playback.append_if( + rodio::buffer::SamplesBuffer::new(channels, sample_rate, vec![0.0; 24_000]), + |_| true, + || {}, + ); + } + let probe = PlaybackProbe::new(); + probe.install(playback); + probe + } + + fn queued_speech(speaker_pubkey: &str, speaker_generation: u64) -> QueuedText { + QueuedText { + floor_epoch: 0, + generation: 1, + route_id: 1, + speaker_pubkey: Some(speaker_pubkey.to_string()), + speaker_generation, + voice_reference: Some("pocket:mary".to_string()), + text: "Hello".to_string(), + } + } + + /// A cancellation releases the mic gate whether or not there was audio to + /// silence. With a live player the release rides inside the replacement; + /// with nothing live there is no transition to join, and skipping the + /// release would strand the gate open with the worker already past the + /// utterance. + #[test] + fn cancellation_releases_the_mic_gate_with_or_without_live_playback() { + for playback_live in [false, true] { + let probe = playback_probe(playback_live); + let playback = probe.playback().expect("installed coordinator"); + let cancel = AtomicBool::new(true); + let voice_cancel = AtomicBool::new(false); + let shutdown = AtomicBool::new(false); + let tts_active = AtomicBool::new(true); + let voice_change_ack = Arc::new(Mutex::new(None)); + let (_text_tx, text_rx) = mpsc::channel(); + let mut deferred_text = VecDeque::new(); + let mut current_text = None; + + assert!(handle_cancel_or_shutdown( + (&cancel, &voice_cancel), + &shutdown, + &tts_active, + (&text_rx, &mut deferred_text, &mut current_text), + &voice_change_ack, + None, + Some(&playback), + )); + + assert!( + !tts_active.load(Ordering::Acquire), + "cancellation must release the mic gate (playback_live={playback_live})" + ); + assert!(playback.empty(), "cancellation silences any queued audio"); + } + } + + #[test] + fn removing_a_speaker_invalidates_only_that_speakers_queued_text() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let alice = queued_speech("ALICE", current_speaker_generation(&generations, "alice")); + let bob = queued_speech("bob", current_speaker_generation(&generations, "bob")); + + advance_speaker_generation(&generations, "alice"); + + assert!(!queued_speaker_is_current(&generations, &alice)); + assert!(queued_speaker_is_current(&generations, &bob)); + + let rejoined_alice = + queued_speech("alice", current_speaker_generation(&generations, "alice")); + assert!(queued_speaker_is_current(&generations, &rejoined_alice)); + } + + #[test] + fn removing_a_silent_speaker_does_not_cancel_the_active_speaker() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + + request_speaker_cancel(&generations, &active_speaker, &cancellation, "bob"); + + assert!(cancellation.lock().expect("cancellation").is_none()); + assert_eq!( + active_speaker.lock().expect("active speaker").as_deref(), + Some("alice") + ); + } + + #[test] + fn targeted_cancellation_preserves_other_speakers_queue_entries() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + let alice = queued_speech("alice", 0); + let bob = queued_speech("bob", 0); + let (_text_tx, text_rx) = mpsc::sync_channel(1); + let mut deferred = VecDeque::from([alice, bob]); + let mut current = None; + + request_speaker_cancel(&generations, &active_speaker, &cancellation, "alice"); + retain_current_speaker_text(&generations, &mut deferred, &mut current, &text_rx); + + assert_eq!(deferred.len(), 1); + assert_eq!(deferred[0].speaker_pubkey.as_deref(), Some("bob")); + } + + #[test] + fn stop_request_is_bound_to_the_observed_speaker_generation() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + + assert!(request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &playback_probe(true), + "alice", + )); + assert_eq!(current_speaker_generation(&generations, "alice"), 1); + assert_eq!( + cancellation.lock().expect("cancellation").as_deref(), + Some("alice") + ); + + active_speaker.lock().expect("active speaker").take(); + cancellation.lock().expect("cancellation").take(); + assert!(!request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &playback_probe(true), + "alice", + )); + + let next_utterance = + queued_speech("alice", current_speaker_generation(&generations, "alice")); + assert!(queued_speaker_is_current(&generations, &next_utterance)); + assert!(cancellation.lock().expect("cancellation").is_none()); + } + + #[test] + fn stop_request_does_not_cancel_a_different_active_speaker() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("bob".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + + assert!(!request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &playback_probe(true), + "alice", + )); + assert_eq!(current_speaker_generation(&generations, "alice"), 0); + assert_eq!(current_speaker_generation(&generations, "bob"), 0); + assert!(cancellation.lock().expect("cancellation").is_none()); + assert_eq!( + active_speaker.lock().expect("active speaker").as_deref(), + Some("bob"), + ); + } + + #[test] + fn stop_request_during_empty_synthesis_gap_cancels_in_flight_speech() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + let next_chunk = queued_speech("alice", 0); + let probe = playback_probe(false); + let _synthesis_flight = probe.begin_synthesis(); + + assert!(request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &probe, + "alice", + )); + + assert_eq!(current_speaker_generation(&generations, "alice"), 1); + assert!(!queued_speaker_is_current(&generations, &next_chunk)); + assert_eq!( + cancellation.lock().expect("cancellation").as_deref(), + Some("alice"), + ); + } + + #[test] + fn repeated_stop_for_same_in_flight_utterance_is_idempotent() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + let probe = playback_probe(false); + let _synthesis_flight = probe.begin_synthesis(); + + assert!(request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &probe, + "alice", + )); + let speech_queued_after_first_stop = queued_speech("alice", 1); + + assert!(!request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &probe, + "alice", + )); + + assert_eq!(current_speaker_generation(&generations, "alice"), 1); + assert!(queued_speaker_is_current( + &generations, + &speech_queued_after_first_stop, + )); + assert_eq!( + cancellation.lock().expect("cancellation").as_deref(), + Some("alice"), + ); + } + + #[test] + fn stop_request_after_playback_drains_preserves_queued_speech() { + let generations = Arc::new(Mutex::new(HashMap::new())); + let active_speaker = Arc::new(Mutex::new(Some("alice".to_string()))); + let cancellation = Arc::new(Mutex::new(None)); + let next_utterance = queued_speech("alice", 0); + + assert!(!request_active_speaker_cancel( + &generations, + &active_speaker, + &cancellation, + &playback_probe(false), + "alice", + )); + + assert_eq!(current_speaker_generation(&generations, "alice"), 0); + assert!(queued_speaker_is_current(&generations, &next_utterance)); + assert!(cancellation.lock().expect("cancellation").is_none()); + assert_eq!( + active_speaker.lock().expect("active speaker").as_deref(), + Some("alice"), + ); + } +} diff --git a/desktop/src-tauri/src/huddle/window.rs b/desktop/src-tauri/src/huddle/window.rs new file mode 100644 index 00000000000..cb3cfc8bfd8 --- /dev/null +++ b/desktop/src-tauri/src/huddle/window.rs @@ -0,0 +1,67 @@ +//! Native companion-window lifecycle for an active Huddle. + +use tauri::{Emitter, Manager, State, WebviewUrl, WebviewWindowBuilder}; + +use crate::app_state::AppState; + +/// Close the companion belonging to an ended huddle. The native lifecycle is +/// authoritative here because a webview can be suspended while it is closing. +pub(super) fn close_huddle_window(app: &tauri::AppHandle, ephemeral_channel_id: &str) { + if ephemeral_channel_id.is_empty() { + return; + } + let label = format!("huddle-{ephemeral_channel_id}"); + if let Some(window) = app.get_webview_window(&label) { + if let Err(error) = window.close() { + eprintln!("buzz-desktop: failed to close huddle companion: {error}"); + } + } +} + +/// Close the active companion without leaving the huddle. The main window uses +/// this to restore its drawer presentation while retaining the audio session. +#[tauri::command] +pub fn close_huddle_companion( + app: tauri::AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + let ephemeral_channel_id = state + .huddle()? + .ephemeral_channel_id + .clone() + .ok_or("no active huddle")?; + close_huddle_window(&app, &ephemeral_channel_id); + app.emit("huddle-companion-returned", ()) + .map_err(|error| error.to_string())?; + Ok(()) +} + +/// Open the active huddle's ephemeral channel in a focused companion window. +/// The main window remains the owner of microphone capture; closing this room +/// must never leave the shared huddle session. +#[tauri::command] +pub async fn open_huddle_window( + app: tauri::AppHandle, + state: State<'_, AppState>, +) -> Result<(), String> { + let ephemeral_channel_id = state + .huddle()? + .ephemeral_channel_id + .clone() + .ok_or("no active huddle")?; + let label = format!("huddle-{ephemeral_channel_id}"); + + if let Some(window) = app.get_webview_window(&label) { + window.show().map_err(|error| error.to_string())?; + window.set_focus().map_err(|error| error.to_string())?; + return Ok(()); + } + + WebviewWindowBuilder::new(&app, label, WebviewUrl::App("index.html".into())) + .title("Huddle") + .inner_size(960.0, 720.0) + .min_inner_size(720.0, 520.0) + .build() + .map_err(|error| error.to_string())?; + Ok(()) +} diff --git a/desktop/src-tauri/src/huddle/wire.rs b/desktop/src-tauri/src/huddle/wire.rs index d315dd7f238..bcf9c007c2d 100644 --- a/desktop/src-tauri/src/huddle/wire.rs +++ b/desktop/src-tauri/src/huddle/wire.rs @@ -7,13 +7,19 @@ //! //! No per-frame metadata; receiver synthesizes sequence/timestamp on arrival. //! Kept for backward compatibility — relay still admits v1 clients into -//! v1-pinned rooms — but new clients always speak v2. +//! v1-pinned rooms — but new clients speak v2 while deployed relays remain +//! capped at the released v2 contract. //! -//! ## v2 (this commit) +//! ## v2 (compatibility contract) //! //! Client → relay: `` //! Relay → client: `` //! +//! Protocol v2 does not carry v3's occupancy epoch in media frames. The +//! control-plane roster still resets decoder and playout state when an index is +//! reassigned, but v2 cannot fence a delayed packet from the previous occupant +//! after that reassignment. +//! //! Header layout (8 bytes, network byte order, big-endian): //! //! ```text @@ -122,6 +128,19 @@ impl FrameHeader { } } +/// Parse a complete relay-to-client v2 frame. +/// +/// The released v2 contract has exactly one relay-authored prefix byte: the +/// sender's peer index. A non-empty Opus payload must follow the fixed header. +pub fn parse_relay_frame(bytes: &[u8]) -> Option<(u8, FrameHeader, &[u8])> { + let (&peer_index, framed_audio) = bytes.split_first()?; + let (header, opus_payload) = FrameHeader::parse(framed_audio)?; + if opus_payload.is_empty() { + return None; + } + Some((peer_index, header, opus_payload)) +} + /// Compute a dBov audio level for a normalized f32 PCM frame. /// /// "dBov" is RMS expressed in dB relative to full scale (where full scale = @@ -205,6 +224,41 @@ mod tests { assert_eq!(tail, b"opus-bytes"); } + #[test] + fn relay_frame_uses_the_v2_one_byte_peer_prefix() { + let header = FrameHeader { + seq: 0x0102, + ts_48k: 960, + level_dbov: -20, + flags: 0, + }; + let mut frame = vec![7]; + frame.extend_from_slice(&header.encode()); + frame.extend_from_slice(b"opus"); + + let (peer_index, parsed_header, opus_payload) = + parse_relay_frame(&frame).expect("valid v2 relay frame"); + assert_eq!(peer_index, 7); + assert_eq!(parsed_header, header); + assert_eq!(opus_payload, b"opus"); + } + + #[test] + fn relay_frame_rejects_a_missing_opus_payload() { + let mut frame = vec![7]; + frame.extend_from_slice( + &FrameHeader { + seq: 1, + ts_48k: 960, + level_dbov: -20, + flags: 0, + } + .encode(), + ); + + assert!(parse_relay_frame(&frame).is_none()); + } + /// Bytes in big-endian network order, matching Max's spec. This pins /// the byte layout against accidental endianness changes. #[test] diff --git a/desktop/src-tauri/src/initial_window.rs b/desktop/src-tauri/src/initial_window.rs new file mode 100644 index 00000000000..f6d88259b2e --- /dev/null +++ b/desktop/src-tauri/src/initial_window.rs @@ -0,0 +1,78 @@ +//! First-frame window reveal helpers. + +#[cfg(target_os = "macos")] +pub(crate) const INITIAL_RENDER_READY_EVENT: &str = "initial-render-ready"; + +pub(crate) fn reveal_initial_window(window: &tauri::Window) { + if let Err(error) = window.show() { + eprintln!("buzz-desktop: failed to reveal main window: {error}"); + return; + } + if let Err(error) = window.set_focus() { + eprintln!("buzz-desktop: failed to focus main window: {error}"); + } +} + +#[cfg(target_os = "macos")] +pub(crate) fn set_initial_window_backing(window: &tauri::Window) { + // Both this write and the deferred clear target the Window (NSWindow) + // backing color only; they never touch the webview canvas or the + // NSVisualEffectView, so they are not load-bearing for glass. Glass state + // — the effect view and webview-canvas transparency — is managed entirely + // by `set_window_vibrancy`, which the ThemeProvider calls after mount. The + // 250ms-delayed clear cannot clobber a persisted-glass-on cold boot + // regardless of ordering with that call. + // + // Write an opaque dark backing so the previous app cannot show through + // before WebKit submits its first composited surface. + if let Err(error) = window.set_background_color(Some(tauri::window::Color(17, 21, 24, 255))) { + eprintln!("buzz-desktop: failed to set initial window backing: {error}"); + } +} + +#[cfg(target_os = "macos")] +pub(crate) async fn clear_initial_window_backing(window: &tauri::Window) { + tokio::time::sleep(std::time::Duration::from_millis(250)).await; + // Restore the default system window background so fast-resize gutter + // flashes match the platform theme rather than the hardcoded dark color + // written at reveal. Targets the Window (NSWindow) layer only; webview + // canvas and glass state are unaffected. + if let Err(error) = window.set_background_color(None) { + eprintln!("buzz-desktop: failed to clear initial window backing: {error}"); + } +} + +#[cfg(target_os = "macos")] +pub(crate) async fn wait_for_stable_initial_window_geometry( + window: &tauri::Window, +) { + const MAX_POLLS: usize = 120; + const REQUIRED_STABLE_POLLS: usize = 4; + + let mut previous_bounds = None; + let mut stable_polls = 0; + + for _ in 0..MAX_POLLS { + // Accept whatever geometry the window-state plugin restores — maximized + // or a normal saved size. macOS applies the restore asynchronously, so + // consecutive identical outer bounds are enough to know it settled. + let bounds = match (window.outer_position(), window.outer_size()) { + (Ok(position), Ok(size)) => Some((position.x, position.y, size.width, size.height)), + _ => None, + }; + + if bounds.is_some() && bounds == previous_bounds { + stable_polls += 1; + if stable_polls >= REQUIRED_STABLE_POLLS { + return; + } + } else { + stable_polls = 0; + } + previous_bounds = bounds; + + tokio::time::sleep(std::time::Duration::from_millis(16)).await; + } + + eprintln!("buzz-desktop: initial window geometry did not settle before reveal timeout"); +} diff --git a/desktop/src-tauri/src/key_backup.rs b/desktop/src-tauri/src/key_backup.rs index f97bf95a676..e8fcc8abe42 100644 --- a/desktop/src-tauri/src/key_backup.rs +++ b/desktop/src-tauri/src/key_backup.rs @@ -133,9 +133,14 @@ pub fn backup_file_path(data_dir: &std::path::Path) -> std::path::PathBuf { data_dir.join(BACKUP_FILE_NAME) } -/// Atomically write `ncryptsec` to `path` with owner-only permissions, then -/// reread and byte-compare. Same crash-safety pattern as +/// Atomically write the app-managed `ncryptsec` backup with owner-only +/// permissions, then reread and byte-compare. Same crash-safety pattern as /// `app_state::save_key_file`. +/// +/// Portable exports selected through a native save panel must use +/// [`write_portable_backup_file`] instead: sandboxed macOS grants access to the +/// selected path, but not to the sibling temporary file this writer needs. +#[allow(dead_code)] // Retained for durable app-managed backups; portable exports must not use it. pub fn write_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), String> { use atomic_write_file::AtomicWriteFile; use std::io::Write; @@ -155,6 +160,56 @@ pub fn write_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), file.commit() .map_err(|e| format!("commit backup file: {e}"))?; + verify_backup_file(path, ncryptsec) +} + +/// Write a user-selected portable backup without creating a sibling file. +/// +/// Native macOS save panels authorize the exact selected path in protected +/// folders such as Downloads, not an atomic writer's hidden sibling. Opening +/// with `create_new` uses only that authorized path and also guarantees an +/// existing backup is never truncated: users must choose a new filename when +/// the destination already exists. After writing, the file is synced and its +/// persisted bytes are reread before success is reported. +pub fn write_portable_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), String> { + use std::io::Write; + + let mut options = std::fs::OpenOptions::new(); + options.write(true).create_new(true); + #[cfg(unix)] + { + use std::os::unix::fs::OpenOptionsExt; + options.mode(0o600); + } + + let mut file = options.open(path).map_err(|error| { + if error.kind() == std::io::ErrorKind::AlreadyExists { + "backup file already exists; choose a new filename so the existing backup stays safe" + .to_string() + } else { + format!("create portable backup file: {error}") + } + })?; + + let write_result = file + .write_all(ncryptsec.as_bytes()) + .map_err(|e| format!("write portable backup file: {e}")) + .and_then(|()| { + file.sync_all() + .map_err(|e| format!("sync portable backup file: {e}")) + }); + drop(file); + + let result = write_result.and_then(|()| verify_backup_file(path, ncryptsec)); + if result.is_err() { + // This function created the destination exclusively, so cleanup cannot + // clobber a backup that existed before the save attempt. + let _ = std::fs::remove_file(path); + } + result +} + +fn verify_backup_file(path: &std::path::Path, ncryptsec: &str) -> Result<(), String> { // Reread and byte-compare: only report success for bytes that are // actually on disk. let on_disk = std::fs::read_to_string(path).map_err(|e| format!("reread backup file: {e}"))?; diff --git a/desktop/src-tauri/src/key_backup_tests.rs b/desktop/src-tauri/src/key_backup_tests.rs index b9713201e17..7f46ff2a7d4 100644 --- a/desktop/src-tauri/src/key_backup_tests.rs +++ b/desktop/src-tauri/src/key_backup_tests.rs @@ -160,6 +160,45 @@ fn write_backup_file_overwrites_atomically() { assert_eq!(entries, vec![std::ffi::OsString::from(BACKUP_FILE_NAME)]); } +#[test] +fn write_portable_backup_file_persists_0600_without_a_sibling() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("portable.ncryptsec"); + write_portable_backup_file(&path, SPEC_NCRYPTSEC).unwrap(); + + assert_eq!(std::fs::read_to_string(&path).unwrap(), SPEC_NCRYPTSEC); + let entries: Vec<_> = std::fs::read_dir(dir.path()) + .unwrap() + .map(|entry| entry.unwrap().file_name()) + .collect(); + assert_eq!( + entries, + vec![std::ffi::OsString::from("portable.ncryptsec")] + ); + + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + let mode = std::fs::metadata(&path).unwrap().permissions().mode(); + assert_eq!(mode & 0o777, 0o600, "portable backup must be owner-only"); + } +} + +#[test] +fn write_portable_backup_file_preserves_an_existing_backup() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("portable.ncryptsec"); + std::fs::write(&path, "ncryptsec1existing").unwrap(); + + let error = write_portable_backup_file(&path, SPEC_NCRYPTSEC).unwrap_err(); + + assert!(error.contains("already exists"), "{error}"); + assert_eq!( + std::fs::read_to_string(&path).unwrap(), + "ncryptsec1existing" + ); +} + #[test] fn delete_backup_file_is_idempotent() { let dir = tempfile::tempdir().unwrap(); @@ -194,7 +233,10 @@ fn generated_passphrase_respects_word_count_and_separator() { WORDLIST.lines().filter(|l| !l.is_empty()).collect(); assert_eq!(words.len(), 1296, "EFF short wordlist 2.0 has 1296 words"); - for (count, separator) in [(3, "-"), (4, "-"), (6, " "), (5, "."), (10, "")] { + // Use separators that cannot appear in the EFF wordlist so a generated + // word such as "yo-yo" cannot be mistaken for two words (see the same + // guard in generated_passphrase_clamps_word_count and issue #6249). + for (count, separator) in [(3, "|"), (4, "|"), (6, " "), (5, "."), (10, "")] { let phrase = generate_passphrase(count, separator).unwrap(); if separator.is_empty() { // No separator to split on; length gate below still applies. @@ -211,12 +253,16 @@ fn generated_passphrase_respects_word_count_and_separator() { #[test] fn generated_passphrase_clamps_word_count() { + // Use a separator that cannot appear in the EFF wordlist so a generated + // word such as "yo-yo" cannot be mistaken for two words. + const SEPARATOR: &str = "|"; + // Below the floor: clamped up to MIN_PASSPHRASE_WORDS, never shorter. - let phrase = generate_passphrase(1, "-").unwrap(); - assert_eq!(phrase.split('-').count(), MIN_PASSPHRASE_WORDS); + let phrase = generate_passphrase(1, SEPARATOR).unwrap(); + assert_eq!(phrase.split(SEPARATOR).count(), MIN_PASSPHRASE_WORDS); // Above the ceiling: clamped down to MAX_PASSPHRASE_WORDS. - let phrase = generate_passphrase(50, "-").unwrap(); - assert_eq!(phrase.split('-').count(), MAX_PASSPHRASE_WORDS); + let phrase = generate_passphrase(50, SEPARATOR).unwrap(); + assert_eq!(phrase.split(SEPARATOR).count(), MAX_PASSPHRASE_WORDS); } #[test] diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs index 6814008f0da..613040b8095 100644 --- a/desktop/src-tauri/src/lib.rs +++ b/desktop/src-tauri/src/lib.rs @@ -1,7 +1,9 @@ #![recursion_limit = "256"] // Deep Tauri command futures exceed the default layout query depth. +mod app_menu; mod app_state; mod archive; mod builderlab; +mod channel_head_cache; mod commands; mod deep_link; mod egress_guard; @@ -9,8 +11,12 @@ mod event_sync; mod events; mod huddle; mod identity_storage; +mod initial_window; mod key_backup; +mod link_preview_tags; mod linux_media; +#[cfg(target_os = "macos")] +mod macos_notifications; mod managed_agents; mod media_proxy; #[cfg(feature = "mesh-llm")] @@ -21,9 +27,13 @@ mod migration; #[cfg(test)] mod model_tests; mod models; +mod native_relay_client; mod native_websocket; +mod native_websocket_batch; mod nostr_bind; pub mod nostr_convert; +mod observed_unread; +mod persona_catalog; mod prevent_sleep; mod ptt_shortcut; mod relay; @@ -32,28 +42,39 @@ mod reset; mod secret_store; mod shutdown; mod templates; +mod terminal_runtime; +#[cfg_attr(not(test), allow(dead_code))] +mod terminal_transport; #[cfg(target_os = "macos")] mod tray_menu; +mod unread_catch_up; mod util; #[cfg(target_os = "linux")] pub mod webkit_rendering; use app_state::{build_app_state, resolve_persisted_identity, AppState}; use builderlab::*; +#[doc(hidden)] +pub use commands::print_agent_access_owner_only_probe_if_requested; use commands::*; use deep_link::{ - acknowledge_pending_community_deep_link, handle_deep_link_url, - take_pending_community_deep_link, PendingCommunityDeepLinks, -}; -use huddle::audio_output::{ - get_audio_output_device, list_audio_output_devices, set_audio_output_device, + acknowledge_pending_community_deep_link, acknowledge_pending_entity_deep_link, + acknowledge_pending_navigation_deep_link, clear_pending_navigation_deep_links, + handle_deep_link_url, take_pending_community_deep_link, take_pending_entity_deep_link, + take_pending_navigation_deep_link, PendingCommunityDeepLinks, PendingEntityDeepLinks, + PendingNavigationDeepLinks, }; -use huddle::reconnect::reconnect_huddle_audio; use huddle::{ - add_agent_to_huddle, check_pipeline_hotstart, confirm_huddle_active, download_voice_models, + add_agent_to_huddle, + audio_output::{get_audio_output_device, list_audio_output_devices, set_audio_output_device}, + check_pipeline_hotstart, close_huddle_companion, confirm_huddle_active, download_voice_models, end_huddle, get_huddle_agent_pubkeys, get_huddle_state, get_model_status, get_voice_input_mode, - join_huddle, leave_huddle, push_audio_pcm, set_huddle_transcription_enabled, set_tts_enabled, - set_voice_input_mode, speak_agent_message, start_huddle, start_stt_pipeline, + interrupt_huddle_speech, join_huddle, leave_huddle, open_huddle_window, push_audio_pcm, + reconnect::reconnect_huddle_audio, + remove_agent_from_huddle, set_huddle_manual_mic_unmuted, set_huddle_transcription_enabled, + set_tts_enabled, set_voice_input_mode, speak_agent_message, start_huddle, start_stt_pipeline, + HuddlePhase, }; +use initial_window::*; use managed_agents::{ backfill_persona_snapshots, ensure_nest, list_managed_agent_runtimes, put_managed_agent_runtime_lifecycle, reconcile_managed_agent_runtimes, @@ -65,84 +86,13 @@ use mesh_llm_stubs::*; #[cfg(all(feature = "mesh-llm", target_os = "macos"))] use shutdown::{hard_exit_after_mesh_shutdown, relaunch_after_mesh_shutdown}; use shutdown::{is_restart_request, shut_down_app}; -use std::sync::{ - atomic::{AtomicBool, Ordering}, - Arc, -}; -use tauri::{Emitter, Manager, RunEvent}; +use std::sync::{atomic::AtomicBool, atomic::Ordering, Arc}; #[cfg(target_os = "macos")] -use tauri::{Listener, WindowEvent}; +use tauri::Listener; +use tauri::{Emitter, Manager, RunEvent, WindowEvent}; use tauri_plugin_window_state::StateFlags; #[cfg(target_os = "macos")] use tray_menu::show_main_window; - -#[cfg(target_os = "macos")] -const INITIAL_RENDER_READY_EVENT: &str = "initial-render-ready"; - -fn reveal_initial_window(window: &tauri::Window) { - if let Err(error) = window.show() { - eprintln!("buzz-desktop: failed to reveal main window: {error}"); - return; - } - if let Err(error) = window.set_focus() { - eprintln!("buzz-desktop: failed to focus main window: {error}"); - } -} - -#[cfg(target_os = "macos")] -fn set_initial_window_backing(window: &tauri::Window) { - // The window remains transparent at runtime for vibrancy. Use an opaque - // native backing only across the first visible frames so the previous app - // cannot show through before WebKit has submitted its first surface. - if let Err(error) = window.set_background_color(Some(tauri::window::Color(17, 21, 24, 255))) { - eprintln!("buzz-desktop: failed to set initial window backing: {error}"); - } -} - -#[cfg(target_os = "macos")] -async fn clear_initial_window_backing(window: &tauri::Window) { - tokio::time::sleep(std::time::Duration::from_millis(250)).await; - if let Err(error) = window.set_background_color(None) { - eprintln!("buzz-desktop: failed to clear initial window backing: {error}"); - } -} - -#[cfg(target_os = "macos")] -async fn wait_for_stable_initial_window_geometry(window: &tauri::Window) { - const MAX_POLLS: usize = 120; - const REQUIRED_STABLE_POLLS: usize = 4; - - let mut previous_bounds = None; - let mut stable_polls = 0; - - for _ in 0..MAX_POLLS { - // Accept whatever geometry the window-state plugin restores — maximized - // or a normal saved size. macOS applies the restore asynchronously, so - // we only need consecutive identical outer bounds to know it settled. - // Gating on `is_maximized()` here would leave `bounds` permanently - // `None` for restored non-maximized windows and stall the reveal until - // the poll timeout. - let bounds = match (window.outer_position(), window.outer_size()) { - (Ok(position), Ok(size)) => Some((position.x, position.y, size.width, size.height)), - _ => None, - }; - - if bounds.is_some() && bounds == previous_bounds { - stable_polls += 1; - if stable_polls >= REQUIRED_STABLE_POLLS { - return; - } - } else { - stable_polls = 0; - } - previous_bounds = bounds; - - tokio::time::sleep(std::time::Duration::from_millis(16)).await; - } - - eprintln!("buzz-desktop: initial window geometry did not settle before reveal timeout"); -} - #[cfg_attr(mobile, tauri::mobile_entry_point)] pub fn run() { // mesh-llm's async chains (model download, node start/join) overflow @@ -172,7 +122,6 @@ pub fn run() { eprintln!("buzz-mesh: failed to build big-stack tokio runtime, using default: {error}"); } } - let builder = tauri::Builder::default() .plugin(tauri_plugin_single_instance::init(|app, argv, _cwd| { // Focus the existing window when a duplicate instance launches. @@ -202,7 +151,6 @@ pub fn run() { if webview.label() != "main" { return; } - // Linux/WebKitGTK needs media-stream settings and a // permission-request handler for getUserMedia; no-op // on macOS/Windows. @@ -255,96 +203,10 @@ pub fn run() { .plugin(tauri_plugin_dialog::init()) .plugin(tauri_plugin_process::init()); - // The global-shortcut plugin is omitted from test builds: linking it into - // the lib-test binary makes it fail to load on Windows - // (STATUS_ENTRYPOINT_NOT_FOUND) before any test runs. - #[cfg(not(test))] - let builder = builder.plugin({ - use tauri_plugin_global_shortcut::ShortcutState; - - // Generation counter for the release delay task. Incremented on - // every press — a delayed release only fires if the generation - // hasn't changed (i.e. no new press happened during the delay). - // This prevents press→release→press within 200 ms from having - // the first release clobber the second press. - let ptt_press_gen = Arc::new(std::sync::atomic::AtomicU64::new(0)); - - tauri_plugin_global_shortcut::Builder::new() - .with_handler(move |app, _shortcut, event| { - let state = match app.try_state::() { - Some(s) => s, - None => return, - }; - - // Only act if a huddle is active and mode is PTT. - let (is_ptt_mode, is_active) = match state.huddle_state.lock() { - Ok(hs) => ( - hs.voice_input_mode == huddle::VoiceInputMode::PushToTalk, - matches!( - hs.phase, - huddle::HuddlePhase::Connected | huddle::HuddlePhase::Active - ), - ), - Err(_) => return, - }; - - if !is_ptt_mode || !is_active { - return; - } - - match event.state { - ShortcutState::Pressed => { - // Bump generation — invalidates any pending release delay. - ptt_press_gen.fetch_add(1, std::sync::atomic::Ordering::Release); - - if let Ok(hs) = state.huddle_state.lock() { - hs.ptt_active - .store(true, std::sync::atomic::Ordering::Release); - // Only cancel TTS if it's actually playing — avoids - // a stale cancel flag that drops the next queued message. - if hs.tts_active.load(std::sync::atomic::Ordering::Acquire) { - hs.tts_cancel - .store(true, std::sync::atomic::Ordering::Release); - } - } - // Emit ptt-state=true to the frontend. - // The React side plays the press audio cue on this event - // (Web Audio API via HuddleContext). Rust-side rodio audio - // was considered but rejected: the rodio OutputStream must - // outlive the handler and sharing it across the shortcut - // closure adds lifecycle complexity for marginal gain. - // The React implementation is sufficient and simpler. - let _ = app.emit("ptt-state", true); - } - ShortcutState::Released => { - // Capture generation at release time. - let gen_at_release = - ptt_press_gen.load(std::sync::atomic::Ordering::Acquire); - let gen_arc = Arc::clone(&ptt_press_gen); - let app_handle = app.clone(); - // 200 ms release delay — captures the tail of the utterance. - // Only applies if no new press happened during the delay. - tauri::async_runtime::spawn(async move { - tokio::time::sleep(std::time::Duration::from_millis(200)).await; - // Check generation — if it changed, a new press arrived. - if gen_arc.load(std::sync::atomic::Ordering::Acquire) != gen_at_release - { - return; // Superseded by a new press. - } - if let Some(state) = app_handle.try_state::() { - if let Ok(hs) = state.huddle_state.lock() { - hs.ptt_active - .store(false, std::sync::atomic::Ordering::Release); - } - } - // Emit ptt-state=false — React plays the release audio cue. - let _ = app_handle.emit("ptt-state", false); - }); - } - } - }) - .build() - }); + // The push-to-talk global-shortcut plugin lives in `ptt_shortcut`, next to + // the registration lifecycle it drives. Installing it is a no-op in test + // builds; see that module for why. + let builder = ptt_shortcut::install(builder); // Register the updater only in configured release builds; omit it locally. #[cfg(buzz_updater_enabled)] @@ -353,11 +215,7 @@ pub fn run() { } else { builder.plugin(tauri_plugin_updater::Builder::new().build()) }; - - #[cfg(not(buzz_updater_enabled))] - let builder = builder; - - let app = builder + let app = app_menu::install(builder) .register_asynchronous_uri_scheme_protocol("buzz-media", |ctx, request, responder| { let app = ctx.app_handle().clone(); tauri::async_runtime::spawn(async move { @@ -368,13 +226,23 @@ pub fn run() { .manage(build_app_state()) .manage(ClipboardState::new()) .manage(PendingCommunityDeepLinks::default()) + .manage(PendingNavigationDeepLinks::default()) + .manage(PendingEntityDeepLinks::default()) .manage(BuilderlabSession::default()) .manage(BuilderlabLogin::default()) .manage(commands::pairing::PairingHandle::new()) + .manage(terminal_runtime::TerminalSessions::default()) + .manage(archive::sync::ArchiveSyncState::default()) + .manage(native_relay_client::NativeRelayClient::default()) + .manage(observed_unread::ObservedUnreadStore::default()) + .manage(channel_head_cache::ChannelHeadCacheStore::default()) .setup(move |app| { let app_handle = app.handle().clone(); #[cfg(target_os = "macos")] - tray_menu::init(&app_handle)?; + { + tray_menu::init(&app_handle)?; + macos_notifications::init(&app_handle)?; + } // ── Phase 2: boot-time sentinel wipe ────────────────────────────── // Must run before migrations and identity resolution so the wipe @@ -427,13 +295,12 @@ pub fn run() { // present), all owner-keyed side effects (event sync, agent restore, // relay publish) are skipped. The frontend shows a recovery screen; // the user must relaunch after restoring the identity. - let identity_lost = state + let recovery_mode = state .identity_lost - .load(std::sync::atomic::Ordering::Acquire); - let keyring_locked = state - .keyring_locked - .load(std::sync::atomic::Ordering::Acquire); - let recovery_mode = identity_lost || keyring_locked; + .load(std::sync::atomic::Ordering::Acquire) + || state + .keyring_locked + .load(std::sync::atomic::Ordering::Acquire); // Backfill the pinned persona snapshot for any pre-existing agent // that predates the record-authoritative-spawn cutover (persona_id @@ -449,16 +316,14 @@ pub fn run() { // agent spawns can resolve custom/preset runtime ids without // waiting for the frontend's discover_acp_providers call. This is // a pure directory scan — no PATH probing, no async work. - { - let custom_dir = app_handle - .path() - .app_data_dir() - .ok() - .map(|d| d.join("custom_harnesses")); - managed_agents::custom_harnesses::warm_harness_registry_from_dir( - custom_dir.as_deref(), - ); - } + let custom_harness_dir = app_handle + .path() + .app_data_dir() + .ok() + .map(|d| d.join("custom_harnesses")); + managed_agents::custom_harnesses::warm_harness_registry_from_dir( + custom_harness_dir.as_deref(), + ); // Store the AppHandle so huddle commands can emit `huddle-state-changed` // events via `huddle::emit_huddle_state` without threading the handle @@ -488,10 +353,7 @@ pub fn run() { // Route mesh-llm's download progress (model weights, runtime) // onto Tauri events so the UI can render real progress. crate::mesh_llm::install_progress_sink(&app_handle); - let mesh_app = app_handle.clone(); - tauri::async_runtime::spawn(async move { - crate::mesh_llm::start_coordinator(mesh_app).await; - }); + tauri::async_runtime::spawn(crate::mesh_llm::start_coordinator(app_handle.clone())); } // Start the localhost media streaming proxy. Uses the shared HTTP @@ -514,6 +376,7 @@ pub fn run() { if let Err(error) = ensure_nest() { eprintln!("buzz-desktop: failed to create nest: {error}"); } + archive::spawn_warm_init(app_handle.clone()); // Resolve the REPOS symlink from the persisted repos_dir BEFORE // agents are restored below, and decide whether restore is safe. @@ -575,15 +438,7 @@ pub fn run() { // and on cold start. The single-instance plugin handles forwarding // from duplicate launches on Windows/Linux. #[cfg(desktop)] - { - use tauri_plugin_deep_link::DeepLinkExt; - let dl_handle = app.handle().clone(); - app.deep_link().on_open_url(move |event| { - for url in event.urls() { - handle_deep_link_url(&dl_handle, url.as_str()); - } - }); - } + deep_link::install_deep_link_handlers(app); // Defer launch-time agent restoration until `apply_workspace` has // installed the active workspace relay and identity. Starting here @@ -662,12 +517,25 @@ pub fn run() { } }); } - Ok(()) }) .invoke_handler(tauri::generate_handler![ + terminal_runtime::terminal_attach, + terminal_runtime::terminal_detach, + terminal_runtime::terminal_close, + terminal_runtime::terminal_input, + terminal_runtime::terminal_resize, + terminal_runtime::terminal_scroll, + terminal_runtime::terminal_ack, + terminal_runtime::terminal_viewport_ready, + terminal_runtime::terminal_focus, take_pending_community_deep_link, acknowledge_pending_community_deep_link, + take_pending_navigation_deep_link, + acknowledge_pending_navigation_deep_link, + clear_pending_navigation_deep_links, + take_pending_entity_deep_link, + acknowledge_pending_entity_deep_link, start_builderlab_login, cancel_builderlab_login, get_builderlab_auth, @@ -698,18 +566,24 @@ pub fn run() { get_user_notes, get_git_identity, get_project_repo_snapshot, + get_project_repo_file_content, get_project_repo_diff, get_project_local_repo_diff, get_project_local_repo_snapshot, + get_project_local_repo_file_content, get_project_repo_sync_status, list_project_local_repositories, + open_project_repository_folder, clone_project_repository, create_project_remote_branch, delete_project_remote_branch, push_project_local_repository, pull_project_local_repository, + publish_project_owner_announcement, sign_project_pull_request_status, sign_project_pull_request_review_request, + sign_project_issue_assignment, + sign_project_issue_unassignment, publish_project_pull_request_merged_status, merge_project_pull_request, open_project_terminal, @@ -724,7 +598,7 @@ pub fn run() { get_relay_ws_url, get_relay_http_url, get_media_proxy_port, - fetch_link_preview_title, + fetch_link_preview_metadata, discover_acp_auth_methods, discover_acp_providers, discover_git_bash_prerequisite, @@ -742,6 +616,7 @@ pub fn run() { nip44_encrypt_to_self, nip44_decrypt_from_self, get_channels, + get_open_channel_directory, create_channel, ensure_starter_channels, open_dm, @@ -769,6 +644,7 @@ pub fn run() { get_forum_posts, get_forum_thread, get_thread_replies, + get_channel_reconnect_repair, get_channel_window, get_channel_messages_before, edit_message, @@ -776,17 +652,28 @@ pub fn run() { add_reaction, remove_reaction, get_event, + get_events, show_native_notification, + #[cfg(target_os = "macos")] + macos_notifications::take_pending_activations, + #[cfg(target_os = "macos")] + macos_notifications::notification_permission_state, + #[cfg(target_os = "macos")] + macos_notifications::request_notification_access, upload_media, pick_and_upload_media, pick_and_upload_image, upload_media_bytes, + upload_media_bytes_raw, + cancel_media_upload, + release_media_upload, download_image, save_png_data_url, download_file, fetch_media_bytes, copy_image_to_clipboard, copy_text_to_clipboard, + read_clipboard_text, fetch_snapshot_bytes, relay_requires_membership, list_relay_members, @@ -800,6 +687,7 @@ pub fn run() { get_relay_self, resolve_oa_owner, list_relay_agents, + revalidate_relay_agents, list_managed_agents, list_managed_agent_runtimes, start_managed_agent_runtime, @@ -817,11 +705,13 @@ pub fn run() { get_managed_agent_log, get_agent_models, discover_agent_models, + agent_access_owner_only, get_agent_config_surface, get_runtime_file_config, get_baked_build_env_keys, get_baked_build_env, put_agent_session_config, + persist_agent_effort_level, get_global_agent_config, set_global_agent_config, mesh_start_node, @@ -833,6 +723,13 @@ pub fn run() { update_managed_agent, discover_backend_providers, probe_backend_provider, + persona_catalog::fetch_persona_catalog, + unread_catch_up::unread_catch_up, + observed_unread::observed_unread_open_scope, + observed_unread::observed_unread_ingest, + channel_head_cache::channel_head_cache_load, + channel_head_cache::channel_head_cache_store, + channel_head_cache::channel_head_cache_clear, list_personas, create_persona, update_persona, @@ -851,6 +748,12 @@ pub fn run() { update_team, delete_team, export_agent_snapshot, + card_mint_key_status, + card_mint_save_openai_key, + mint_agent_card, + save_agent_card, + list_agent_cards, + load_agent_card, preview_agent_snapshot_import, confirm_agent_snapshot_import, encode_agent_snapshot_for_send, @@ -882,6 +785,8 @@ pub fn run() { leave_huddle, end_huddle, get_huddle_state, + close_huddle_companion, + open_huddle_window, push_audio_pcm, reconnect_huddle_audio, start_stt_pipeline, @@ -895,18 +800,26 @@ pub fn run() { huddle::tts_settings::preview_pocket_voice, huddle::tts_settings::import_pocket_voice, huddle::tts_settings::delete_pocket_voice, + huddle::agent_voice::ensure_huddle_agent_voice_settings, + huddle::agent_voice::set_huddle_agent_tts_enabled, + huddle::agent_voice::set_huddle_agent_voice, speak_agent_message, + interrupt_huddle_speech, add_agent_to_huddle, + remove_agent_from_huddle, + huddle::agents::sync_agents_to_active_huddle, check_pipeline_hotstart, confirm_huddle_active, perform_sidebar_default_haptic, get_huddle_agent_pubkeys, set_voice_input_mode, get_voice_input_mode, + set_huddle_manual_mic_unmuted, list_audio_output_devices, set_audio_output_device, get_audio_output_device, start_pairing, + start_identity_recovery_pairing, confirm_pairing_sas, cancel_pairing, apply_workspace, @@ -930,6 +843,13 @@ pub fn run() { archive::read_archived_observer_events_for_channel, archive::index_observer_channel_id, archive::read_unindexed_observer_rows, + archive::get_agent_usage_series, + archive::get_observer_retention_days, + archive::set_observer_retention_days, + archive::archive_size_stats, + archive::sync::announce_archive_sync_epoch, + archive::sync::start_archive_sync, + archive::sync::stop_archive_sync, is_auto_update_supported, set_window_vibrancy, #[cfg(target_os = "macos")] @@ -943,7 +863,6 @@ pub fn run() { ]) .build(tauri::generate_context!()) .expect("error while building tauri application"); - let shutdown_done = Arc::new(AtomicBool::new(false)); #[cfg(unix)] @@ -968,6 +887,29 @@ pub fn run() { } } } + RunEvent::WindowEvent { + label, + event: WindowEvent::CloseRequested { .. }, + .. + } if label.starts_with("huddle-") => { + let is_active_huddle_window = + app_handle + .state::() + .huddle() + .ok() + .is_some_and(|huddle| { + !matches!(huddle.phase, HuddlePhase::Idle | HuddlePhase::Leaving) + && huddle + .ephemeral_channel_id + .as_deref() + .is_some_and(|channel_id| label == format!("huddle-{channel_id}")) + }); + if is_active_huddle_window { + if let Err(error) = app_handle.emit("huddle-companion-returned", ()) { + eprintln!("buzz-desktop: failed to restore huddle drawer: {error}"); + } + } + } RunEvent::ExitRequested { code, .. } => { if is_restart_request(code) { restart_requested.store(true, Ordering::SeqCst); @@ -977,7 +919,6 @@ pub fn run() { RunEvent::Exit => { shut_down_app(app_handle, &run_shutdown_done); app_handle.state::().release(); - #[cfg(all(feature = "mesh-llm", target_os = "macos"))] if restart_requested.load(Ordering::SeqCst) { relaunch_after_mesh_shutdown(app_handle); diff --git a/desktop/src-tauri/src/link_preview_tags.rs b/desktop/src-tauri/src/link_preview_tags.rs new file mode 100644 index 00000000000..fc57e2e47cd --- /dev/null +++ b/desktop/src-tauri/src/link_preview_tags.rs @@ -0,0 +1,189 @@ +use nostr::Tag; +use std::collections::HashSet; + +const MAX_SNAPSHOTS: usize = 8; +const MAX_TITLE: usize = 300; +const MAX_SITE: usize = 100; +const MAX_DESCRIPTION: usize = 1000; + +fn valid_text(value: &str, max: usize, allow_newlines: bool) -> bool { + value.len() <= max + && !value + .chars() + .any(|character| character.is_control() && !(allow_newlines && character == '\n')) +} + +fn valid_sha256(value: &str) -> bool { + value.len() == 64 && value.chars().all(|c| matches!(c, '0'..='9' | 'a'..='f')) +} + +fn valid_media_pair(url: &str, hash: &str, relay_base: &url::Url) -> bool { + if url.is_empty() && hash.is_empty() { + return true; + } + if url.is_empty() || !valid_sha256(hash) { + return false; + } + let Ok(parsed) = url::Url::parse(url) else { + return false; + }; + if parsed.origin() != relay_base.origin() + || !parsed.username().is_empty() + || parsed.password().is_some() + || parsed.query().is_some() + || parsed.fragment().is_some() + { + return false; + } + let Some(filename) = parsed.path().strip_prefix("/media/") else { + return false; + }; + if filename.contains('/') || filename.contains('%') { + return false; + } + let Some((path_hash, ext)) = filename.split_once('.') else { + return false; + }; + path_hash == hash && valid_sha256(path_hash) && matches!(ext, "jpg" | "png" | "gif" | "webp") +} + +pub fn append( + preview_tags: &[Vec], + relay_base: &str, + tags: &mut Vec, +) -> Result<(), String> { + if preview_tags.len() > MAX_SNAPSHOTS { + return Err(format!( + "too many link preview snapshots (max {MAX_SNAPSHOTS})" + )); + } + let base = url::Url::parse(relay_base).map_err(|_| "invalid relay base URL")?; + let mut seen = HashSet::new(); + for preview_tag in preview_tags { + if preview_tag.as_slice() == ["link-preview", "none"] { + if preview_tags.len() != 1 { + return Err("link-preview suppression cannot include snapshots".into()); + } + tags.push( + Tag::parse(["link-preview", "none"]) + .map_err(|e| format!("invalid link-preview tag: {e}"))?, + ); + continue; + } + let valid = preview_tag.len() == 11 + && preview_tag[0] == "link-preview" + && preview_tag[1] == "snapshot" + && preview_tag[2] == "1" + && url::Url::parse(&preview_tag[3]).is_ok_and(|url| { + url.scheme() == "https" + && url.username().is_empty() + && url.password().is_none() + && url.fragment().is_none() + }) + && seen.insert(preview_tag[3].clone()) + && valid_text(&preview_tag[4], MAX_TITLE, false) + && valid_text(&preview_tag[5], MAX_SITE, false) + && valid_text(&preview_tag[6], MAX_DESCRIPTION, true) + && valid_media_pair(&preview_tag[7], &preview_tag[8], &base) + && valid_media_pair(&preview_tag[9], &preview_tag[10], &base); + if !valid { + return Err("invalid link-preview snapshot tag".into()); + } + let parts: Vec<&str> = preview_tag.iter().map(String::as_str).collect(); + tags.push(Tag::parse(parts).map_err(|e| format!("invalid link-preview tag: {e}"))?); + } + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::*; + + const HASH: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; + const BASE: &str = "https://relay.example"; + + fn tag(image_url: &str, image_hash: &str) -> Vec { + [ + "link-preview", + "snapshot", + "1", + "https://linear.app/acme/issue/ABC-123/example", + "Example", + "Linear", + "Description", + image_url, + image_hash, + "", + "", + ] + .map(str::to_string) + .to_vec() + } + + #[test] + fn append_accepts_complete_local_snapshot() { + let mut tags = Vec::new(); + append( + &[tag(&format!("{BASE}/media/{HASH}.png"), HASH)], + BASE, + &mut tags, + ) + .unwrap(); + assert_eq!(tags.len(), 1); + } + + #[test] + fn append_accepts_blanket_suppression_by_itself() { + let mut tags = Vec::new(); + append( + &[vec!["link-preview".into(), "none".into()]], + BASE, + &mut tags, + ) + .unwrap(); + assert_eq!(tags[0].as_slice(), ["link-preview", "none"]); + assert!(append( + &[vec!["link-preview".into(), "none".into()], tag("", ""),], + BASE, + &mut Vec::new(), + ) + .is_err()); + } + + #[test] + fn append_accepts_description_newlines() { + let mut preview_tag = tag("", ""); + preview_tag[6] = "First paragraph\n\nSecond paragraph".into(); + assert!(append(&[preview_tag], BASE, &mut Vec::new()).is_ok()); + } + + #[test] + fn append_rejects_other_control_characters() { + let mut preview_tag = tag("", ""); + preview_tag[6] = "Unsafe\tdescription".into(); + assert!(append(&[preview_tag], BASE, &mut Vec::new()).is_err()); + } + + #[test] + fn append_rejects_untrusted_or_malformed_snapshot_media() { + for url in [ + format!("https://evil.example/media/{HASH}.png"), + format!("{BASE}/media/{HASH}.png?token=leak"), + format!("{BASE}/media/{HASH}.png#fragment"), + format!("https://user@relay.example/media/{HASH}.png"), + format!("{BASE}/media/{HASH}.svg"), + format!("{BASE}/media/{HASH}.png/extra"), + ] { + assert!( + append(&[tag(&url, HASH)], BASE, &mut Vec::new()).is_err(), + "{url}" + ); + } + assert!(append( + &[tag(&format!("{BASE}/media/{HASH}.png"), &"b".repeat(64))], + BASE, + &mut Vec::new(), + ) + .is_err()); + } +} diff --git a/desktop/src-tauri/src/macos_notifications.rs b/desktop/src-tauri/src/macos_notifications.rs new file mode 100644 index 00000000000..5bcedd8975b --- /dev/null +++ b/desktop/src-tauri/src/macos_notifications.rs @@ -0,0 +1,422 @@ +//! Modern macOS notification delivery and activation routing. +//! +//! Apple delivers every notification response through one process-wide +//! `UNUserNotificationCenterDelegate`. The delegate is installed once during +//! app setup and retained for the process lifetime. Notification targets live +//! in `userInfo`, so there are no per-notification listeners, waiter threads, +//! or request maps to leak when Notification Center clears a notification. + +use std::{ + collections::VecDeque, + path::Path, + ptr::NonNull, + sync::{mpsc, Mutex, OnceLock}, + time::Duration, +}; + +use block2::{Block, RcBlock}; +use objc2::{ + define_class, msg_send, + rc::Retained, + runtime::{AnyObject, Bool, ProtocolObject}, + AnyThread, DefinedClass, +}; +use objc2_foundation::{NSBundle, NSDictionary, NSError, NSObject, NSObjectProtocol, NSString}; +use objc2_user_notifications::{ + UNAuthorizationOptions, UNAuthorizationStatus, UNMutableNotificationContent, + UNNotificationDefaultActionIdentifier, UNNotificationPresentationOptions, + UNNotificationRequest, UNNotificationResponse, UNNotificationSettings, + UNUserNotificationCenter, UNUserNotificationCenterDelegate, +}; +use tauri::{AppHandle, Emitter}; + +use crate::commands::NATIVE_NOTIFICATION_ACTIVATED_EVENT; + +const TARGET_USER_INFO_KEY: &str = "buzzNotificationTarget"; +const MAX_PENDING_ACTIVATIONS: usize = 64; + +#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize)] +#[serde(rename_all = "lowercase")] +pub(crate) enum NotificationPermissionState { + Default, + Denied, + Granted, +} + +fn permission_state(status: UNAuthorizationStatus) -> NotificationPermissionState { + match status { + UNAuthorizationStatus::Denied => NotificationPermissionState::Denied, + UNAuthorizationStatus::Authorized + | UNAuthorizationStatus::Provisional + | UNAuthorizationStatus::Ephemeral => NotificationPermissionState::Granted, + _ => NotificationPermissionState::Default, + } +} + +static PENDING_ACTIVATIONS: OnceLock>> = OnceLock::new(); + +struct NotificationDelegateIvars { + app: AppHandle, +} + +define_class!( + // SAFETY: NSObject permits AnyThread subclasses, and AppHandle is Send + + // Sync. Apple does not guarantee a queue for notification delegate calls; + // both Tauri operations used by the callbacks are thread-safe. + #[unsafe(super(NSObject))] + #[name = "BuzzNotificationCenterDelegate"] + #[thread_kind = AnyThread] + #[ivars = NotificationDelegateIvars] + struct NotificationDelegate; + + unsafe impl NSObjectProtocol for NotificationDelegate {} + + unsafe impl UNUserNotificationCenterDelegate for NotificationDelegate { + #[unsafe(method(userNotificationCenter:willPresentNotification:withCompletionHandler:))] + fn will_present_notification( + &self, + _center: &UNUserNotificationCenter, + _notification: &objc2_user_notifications::UNNotification, + completion_handler: &Block, + ) { + // Preserve the prior macOS behavior: keep foreground notifications + // in Notification Center without interrupting the user with a banner. + completion_handler.call((UNNotificationPresentationOptions::List,)); + } + + #[unsafe(method(userNotificationCenter:didReceiveNotificationResponse:withCompletionHandler:))] + fn did_receive_notification_response( + &self, + _center: &UNUserNotificationCenter, + response: &UNNotificationResponse, + completion_handler: &Block, + ) { + if &*response.actionIdentifier() == unsafe { UNNotificationDefaultActionIdentifier } { + if let Some(target) = target_from_response(response) { + queue_activation(target); + crate::tray_menu::show_main_window(&self.ivars().app); + if let Err(error) = self + .ivars() + .app + .emit(NATIVE_NOTIFICATION_ACTIVATED_EVENT, ()) + { + eprintln!( + "buzz-desktop: failed to emit macOS notification activation: {error}" + ); + } + } + } + + // Apple requires this for every response, including dismissals and + // malformed notifications that Buzz intentionally ignores. + completion_handler.call(()); + } + } +); + +impl NotificationDelegate { + fn new(app: AppHandle) -> Retained { + let delegate = Self::alloc().set_ivars(NotificationDelegateIvars { app }); + unsafe { msg_send![super(delegate), init] } + } +} + +/// Install the one application-lifetime notification response delegate. +pub(crate) fn init(app: &AppHandle) -> tauri::Result<()> { + if !is_bundled_application() { + // UNUserNotificationCenter raises an Objective-C exception when the + // current process has no application bundle (notably `tauri dev`). + // objc2 cannot turn that exception into a Rust error, so do not call + // into the framework at all in this environment. + eprintln!( + "buzz-desktop: macOS notifications disabled because the process is not running from an app bundle" + ); + return Ok(()); + } + + let center = UNUserNotificationCenter::currentNotificationCenter(); + let delegate = NotificationDelegate::new(app.clone()); + let delegate: Retained> = + ProtocolObject::from_retained(delegate); + center.setDelegate(Some(&delegate)); + + // UNUserNotificationCenter.delegate is weak. This object is deliberately + // process-lifetime state, matching the application-lifetime delegate Apple + // documents and avoiding mutable global or per-notification registrations. + std::mem::forget(delegate); + Ok(()) +} + +fn ensure_bundled_application() -> Result<(), String> { + if is_bundled_application() { + Ok(()) + } else { + Err( + "macOS notifications are unavailable when Buzz is not running from an app bundle" + .to_string(), + ) + } +} + +fn notification_permission_state_sync() -> Result { + ensure_bundled_application()?; + + let (sender, receiver) = mpsc::sync_channel(1); + let handler = RcBlock::new(move |settings: NonNull| { + // SAFETY: Apple guarantees a live UNNotificationSettings object for + // the duration of this completion handler. + let status = unsafe { settings.as_ref() }.authorizationStatus(); + let _ = sender.send(permission_state(status)); + }); + UNUserNotificationCenter::currentNotificationCenter() + .getNotificationSettingsWithCompletionHandler(&handler); + + receiver + .recv_timeout(Duration::from_secs(10)) + .map_err(|_| "macOS notification settings request timed out".to_string()) +} + +#[tauri::command] +pub(crate) async fn notification_permission_state() -> Result { + tokio::task::spawn_blocking(notification_permission_state_sync) + .await + .map_err(|error| format!("macOS notification settings task failed: {error}"))? +} + +fn request_notification_access_sync() -> Result { + ensure_bundled_application()?; + + let (sender, receiver) = mpsc::sync_channel(1); + let handler = RcBlock::new(move |_granted: Bool, error: *mut NSError| { + let result = match unsafe { error.as_ref() } { + Some(error) => Err(format!("macOS notification authorization failed: {error}")), + None => Ok(()), + }; + let _ = sender.send(result); + }); + UNUserNotificationCenter::currentNotificationCenter() + .requestAuthorizationWithOptions_completionHandler( + UNAuthorizationOptions::Alert | UNAuthorizationOptions::Sound, + &handler, + ); + + receiver + .recv_timeout(Duration::from_secs(60)) + .map_err(|_| "macOS notification authorization request timed out".to_string())??; + notification_permission_state_sync() +} + +#[tauri::command] +pub(crate) async fn request_notification_access() -> Result { + tokio::task::spawn_blocking(request_notification_access_sync) + .await + .map_err(|error| format!("macOS notification authorization task failed: {error}"))? +} + +fn show_sync( + title: String, + body: Option, + target: Option, +) -> Result<(), String> { + ensure_bundled_application()?; + if notification_permission_state_sync()? != NotificationPermissionState::Granted { + return Err("macOS notification permission is not granted".to_string()); + } + + let content = UNMutableNotificationContent::new(); + content.setTitle(&NSString::from_str(&title)); + if let Some(body) = body { + content.setBody(&NSString::from_str(&body)); + } + + if let Some(target) = target { + let serialized = serde_json::to_string(&target) + .map_err(|error| format!("failed to serialize notification target: {error}"))?; + let key = NSString::from_str(TARGET_USER_INFO_KEY); + let value = NSString::from_str(&serialized); + let user_info = NSDictionary::::from_slices(&[&*key], &[&*value]); + // SAFETY: Both the key and value are property-list-safe NSString values. + unsafe { + let user_info = + Retained::cast_unchecked::>(user_info); + content.setUserInfo(&user_info); + } + } + + let identifier = NSString::from_str(&uuid::Uuid::new_v4().to_string()); + let request = + UNNotificationRequest::requestWithIdentifier_content_trigger(&identifier, &content, None); + let (sender, receiver) = mpsc::sync_channel(1); + let delivery_handler = RcBlock::new(move |error: *mut NSError| { + let result = match unsafe { error.as_ref() } { + Some(error) => Err(format!("failed to deliver macOS notification: {error}")), + None => Ok(()), + }; + let _ = sender.send(result); + }); + UNUserNotificationCenter::currentNotificationCenter() + .addNotificationRequest_withCompletionHandler(&request, Some(&delivery_handler)); + + receiver + .recv_timeout(Duration::from_secs(10)) + .map_err(|_| "macOS notification delivery request timed out".to_string())? +} + +pub(crate) async fn show( + title: String, + body: Option, + target: Option, +) -> Result<(), String> { + tokio::task::spawn_blocking(move || show_sync(title, body, target)) + .await + .map_err(|error| format!("macOS notification delivery task failed: {error}"))? +} + +fn queue_activation(target: serde_json::Value) { + let queue = PENDING_ACTIVATIONS.get_or_init(Default::default); + let Ok(mut queue) = queue.lock() else { + eprintln!("buzz-desktop: macOS notification activation queue is unavailable"); + return; + }; + if queue.len() == MAX_PENDING_ACTIVATIONS { + queue.pop_front(); + } + queue.push_back(target); +} + +#[tauri::command] +pub(crate) fn take_pending_activations() -> Result, String> { + let queue = PENDING_ACTIVATIONS.get_or_init(Default::default); + let mut queue = queue + .lock() + .map_err(|_| "macOS notification activation queue is unavailable".to_string())?; + Ok(queue.drain(..).collect()) +} + +fn is_bundled_application() -> bool { + let bundle = NSBundle::mainBundle(); + bundle.bundleIdentifier().is_some() + && bundle.executablePath().is_some_and(|executable_path| { + is_application_bundle_layout( + Path::new(&bundle.bundlePath().to_string()), + Path::new(&executable_path.to_string()), + ) + }) +} + +fn is_application_bundle_layout(bundle_path: &Path, executable_path: &Path) -> bool { + let Some(macos_path) = executable_path.parent() else { + return false; + }; + let Some(contents_path) = macos_path.parent() else { + return false; + }; + + bundle_path + .extension() + .is_some_and(|extension| extension == "app") + && macos_path.file_name() == Some("MacOS".as_ref()) + && contents_path.file_name() == Some("Contents".as_ref()) + && contents_path.parent() == Some(bundle_path) +} + +fn target_from_response(response: &UNNotificationResponse) -> Option { + let user_info = response.notification().request().content().userInfo(); + let key = NSString::from_str(TARGET_USER_INFO_KEY); + let target = user_info.objectForKey(key.as_ref())?; + let target = target.downcast::().ok()?; + parse_target(&target.to_string()) +} + +fn parse_target(serialized: &str) -> Option { + serde_json::from_str(serialized).ok() +} + +#[cfg(test)] +mod tests { + use super::{ + is_application_bundle_layout, is_bundled_application, parse_target, permission_state, + queue_activation, take_pending_activations, NotificationPermissionState, + MAX_PENDING_ACTIVATIONS, + }; + use objc2_user_notifications::UNAuthorizationStatus; + use std::path::Path; + + #[test] + fn activation_queue_is_bounded_and_drained() { + let _ = take_pending_activations(); + for index in 0..=MAX_PENDING_ACTIVATIONS { + queue_activation(serde_json::json!({ "index": index })); + } + + let activations = take_pending_activations().expect("activation queue"); + assert_eq!(activations.len(), MAX_PENDING_ACTIVATIONS); + assert_eq!(activations[0]["index"], 1); + assert!(take_pending_activations() + .expect("drained activation queue") + .is_empty()); + } + + #[test] + fn cargo_test_process_is_not_treated_as_bundled() { + assert!(!is_bundled_application()); + } + + #[test] + fn requires_the_executable_to_use_the_app_bundle_layout() { + assert!(is_application_bundle_layout( + Path::new("/Applications/Buzz.app"), + Path::new("/Applications/Buzz.app/Contents/MacOS/buzz-desktop"), + )); + assert!(!is_application_bundle_layout( + Path::new("/tmp/Fake.app"), + Path::new("/tmp/Fake.app/buzz-desktop"), + )); + assert!(!is_application_bundle_layout( + Path::new("/Users/developer/buzz/desktop/src-tauri/target/debug"), + Path::new("/Users/developer/buzz/desktop/src-tauri/target/debug/buzz-desktop"), + )); + assert!(!is_application_bundle_layout( + Path::new("/Applications/Buzz.app"), + Path::new("/Applications/Other.app/Contents/MacOS/buzz-desktop"), + )); + } + + #[test] + fn maps_native_authorization_states_to_frontend_contract() { + assert_eq!( + permission_state(UNAuthorizationStatus::NotDetermined), + NotificationPermissionState::Default + ); + assert_eq!( + permission_state(UNAuthorizationStatus::Denied), + NotificationPermissionState::Denied + ); + for status in [ + UNAuthorizationStatus::Authorized, + UNAuthorizationStatus::Provisional, + UNAuthorizationStatus::Ephemeral, + ] { + assert_eq!( + permission_state(status), + NotificationPermissionState::Granted + ); + } + } + + #[test] + fn parses_opaque_notification_target() { + let target = + parse_target(r#"{"channelId":"channel","eventId":"event","threadRootId":"root"}"#) + .expect("valid target"); + + assert_eq!(target["channelId"], "channel"); + assert_eq!(target["eventId"], "event"); + assert_eq!(target["threadRootId"], "root"); + } + + #[test] + fn rejects_malformed_notification_target() { + assert!(parse_target("not-json").is_none()); + } +} diff --git a/desktop/src-tauri/src/main.rs b/desktop/src-tauri/src/main.rs index ebcc127683a..3606272e590 100644 --- a/desktop/src-tauri/src/main.rs +++ b/desktop/src-tauri/src/main.rs @@ -2,6 +2,10 @@ #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")] fn main() { + if buzz_lib::print_agent_access_owner_only_probe_if_requested() { + return; + } + // Before anything else: WebKitGTK reads its rendering environment once at // process start, and this is the only point where the process is still // single threaded and no GTK object exists yet, which is what makes diff --git a/desktop/src-tauri/src/managed_agents/access_policy.rs b/desktop/src-tauri/src/managed_agents/access_policy.rs new file mode 100644 index 00000000000..2d8326abc30 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/access_policy.rs @@ -0,0 +1,190 @@ +//! Distribution policy at managed-agent enforcement boundaries. +//! +//! ## What this build capability guarantees, and what it does not +//! +//! `BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY` marks a build whose managed agents may +//! answer only their owner. Enforcement is applied at the two boundaries where +//! Desktop hands access to something that runs the agent, and nowhere else. The +//! stored record and its relay-advertised access fields are left untouched, so +//! the same profile keeps its user-chosen access when it is opened in an OSS +//! build. +//! +//! Enforced: +//! +//! - **Local spawn.** [`build_respond_to_env_with_policy`] clamps +//! `BUZZ_ACP_RESPOND_TO` to `owner-only` and pins the independent +//! `BUZZ_ACP_ALLOWED_RESPOND_TO=owner-only` guard on every start, whatever +//! the record says. +//! - **Provider deployment, including upgrades.** +//! [`projected_access_with_policy`] projects owner-only into every payload. +//! Workspace apply redeploys each existing provider agent before the marked +//! build renders community UI. A failed redeploy fails the apply, so Desktop +//! does not present the locked owner-only control as applied while the remote +//! deployment may still use a wider policy. +//! +//! ## "owner-only" is owner plus verified same-owner sibling agents +//! +//! The harness gate this projection targets admits the human owner *and* every +//! cryptographically NIP-OA-verified agent that shares that owner (see +//! `crates/buzz-acp/src/lib.rs`). That is the intended boundary, not an +//! oversight: an owner's own agents are inside their trust boundary, and Buzz's +//! built-in Welcome team relies on it, because the lead instructs its teammates +//! while every teammate is created owner-only (see +//! `welcomeTeammateHasExpectedAccess` in +//! `desktop/src/features/onboarding/welcomeGuide.ts`). Read every use of +//! "owner-only" in this module as `owner ∪ verified same-owner agents`. The +//! setting's own copy says so: the line under Only me reads "Only you and your +//! agents can send instructions." (`RespondToField.tsx`). The dropdown label +//! stays "Only me", which is the audience the user picks. + +use super::{validate_respond_to_allowlist, ManagedAgentRecord, RespondTo}; + +pub(crate) type RespondToEnv = (Vec<(&'static str, String)>, Vec<&'static str>); + +/// Release packaging sets `BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY`; OSS/custom +/// builds do not. +pub(crate) fn owner_only_access_build() -> bool { + option_env!("BUZZ_DESKTOP_BUILD_AGENT_ACCESS_OWNER_ONLY").is_some() +} + +pub(crate) fn owner_only() -> bool { + owner_only_with_policy(owner_only_access_build()) +} + +pub(crate) fn owner_only_with_policy(owner_only_access: bool) -> bool { + owner_only_access +} + +/// Project effective access at a behavioral boundary without changing the +/// stored or relay-advertised access fields. +pub(crate) fn projected_access_with_policy( + record: &ManagedAgentRecord, + owner_only_access: bool, +) -> (RespondTo, Vec) { + if owner_only_with_policy(owner_only_access) { + (RespondTo::OwnerOnly, Vec::new()) + } else { + (record.respond_to, record.respond_to_allowlist.clone()) + } +} + +/// Build the inbound-author access environment for a launched agent. The +/// explicit policy input keeps owner-only access enforcement testable without +/// weakening the production caller's compile-time decision. +pub(crate) fn build_respond_to_env_with_policy( + record: &ManagedAgentRecord, + owner_hex: Option<&str>, + enforced_owner_only: bool, +) -> Result { + let (respond_to, _) = projected_access_with_policy(record, enforced_owner_only); + let normalized = validate_respond_to_allowlist(&record.respond_to_allowlist)?; + if respond_to == RespondTo::Allowlist && normalized.is_empty() { + return Err( + "respond-to mode 'allowlist' requires at least one pubkey in the allowlist".to_string(), + ); + } + + let mut set = vec![("BUZZ_ACP_RESPOND_TO", respond_to.as_str().to_string())]; + let mut remove = Vec::new(); + if enforced_owner_only { + set.push(( + "BUZZ_ACP_ALLOWED_RESPOND_TO", + RespondTo::OwnerOnly.as_str().to_string(), + )); + } else { + remove.push("BUZZ_ACP_ALLOWED_RESPOND_TO"); + } + if respond_to == RespondTo::Allowlist { + set.push(("BUZZ_ACP_RESPOND_TO_ALLOWLIST", normalized.join(","))); + } else { + remove.push("BUZZ_ACP_RESPOND_TO_ALLOWLIST"); + } + + if record.auth_tag.is_none() { + if let Some(owner) = owner_hex { + set.push(("BUZZ_ACP_AGENT_OWNER", owner.to_string())); + } else { + remove.push("BUZZ_ACP_AGENT_OWNER"); + } + } else { + remove.push("BUZZ_ACP_AGENT_OWNER"); + } + Ok((set, remove)) +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::managed_agents::BackendKind; + + fn record(backend: BackendKind) -> ManagedAgentRecord { + let mut record: ManagedAgentRecord = serde_json::from_value(serde_json::json!({ + "pubkey": "agent", "name": "Agent", "relay_url": "", "acp_command": "", + "agent_command": "", "agent_args": [], "mcp_command": "", + "turn_timeout_seconds": 0, "system_prompt": null, "created_at": "", + "updated_at": "", "last_started_at": null, "last_stopped_at": null, + "last_exit_code": null, "last_error": null + })) + .unwrap(); + record.backend = backend; + record.respond_to = RespondTo::Anyone; + record.respond_to_allowlist = vec!["a".repeat(64)]; + record + } + + #[test] + fn owner_only_access_policy_rejects_malformed_stored_allowlist_before_clamping() { + let mut record = record(BackendKind::Local); + record.respond_to_allowlist = vec!["malformed stale allowlist".into()]; + + let error = build_respond_to_env_with_policy(&record, Some("owner"), true) + .expect_err("owner-only access policy accepted a malformed stored allowlist"); + + assert!( + error.contains("invalid pubkey in respond-to allowlist"), + "owner-only access policy returned the wrong malformed-allowlist error: {error}", + ); + } + + #[test] + fn owner_only_access_enforcement_clamps_local_and_provider() { + for (label, backend) in [ + ("local", BackendKind::Local), + ( + "provider", + BackendKind::Provider { + id: "p".into(), + config: serde_json::json!({}), + }, + ), + ] { + let record = record(backend); + let (gate_set, _) = + build_respond_to_env_with_policy(&record, Some("owner"), true).unwrap(); + let gate_set: std::collections::HashMap<_, _> = gate_set.into_iter().collect(); + assert_eq!( + gate_set.get("BUZZ_ACP_RESPOND_TO").map(String::as_str), + Some("owner-only"), + "owner-only runtime env did not clamp {label} agent", + ); + assert_eq!( + gate_set + .get("BUZZ_ACP_ALLOWED_RESPOND_TO") + .map(String::as_str), + Some("owner-only"), + "owner-only runtime env omitted the {label} agent guard", + ); + + let (respond_to, allowlist) = projected_access_with_policy(&record, true); + assert_eq!( + respond_to, + RespondTo::OwnerOnly, + "owner-only provider payload did not clamp {label} agent", + ); + assert!( + allowlist.is_empty(), + "owner-only provider payload retained {label} agent allowlist", + ); + } + } +} diff --git a/desktop/src-tauri/src/managed_agents/agent_env.rs b/desktop/src-tauri/src/managed_agents/agent_env.rs index bf6bcb2298f..59b300d9d17 100644 --- a/desktop/src-tauri/src/managed_agents/agent_env.rs +++ b/desktop/src-tauri/src/managed_agents/agent_env.rs @@ -8,6 +8,25 @@ use std::collections::BTreeMap; use base64::Engine as _; +/// Seconds a woken lazy harness stays warm before it releases its worker +/// subprocesses back to the empty-slot state (via `BUZZ_ACP_IDLE_POOL_SLEEP`). +/// The next accepted event re-wakes it through the same lazy path. Matches the +/// harness's own 15-minute per-turn idle window so a warm pool survives a +/// normal back-and-forth but a truly quiet harness stops paying for workers. +const IDLE_POOL_SLEEP_SECS: &str = "900"; + +/// Value for `BUZZ_ACP_IDLE_POOL_SLEEP`. Idle re-sleep is only meaningful for +/// lazy harnesses (the harness ignores it otherwise); gate to `lazy` here so +/// the env reads inert (`"0"` = disabled) for eager harnesses. This is a +/// desktop-owned lifetime policy (reserved key), not user-tunable. +pub(super) fn idle_pool_sleep_env(lazy: bool) -> &'static str { + if lazy { + IDLE_POOL_SLEEP_SECS + } else { + "0" + } +} + /// Return the baked-in build-time env pairs as a map. /// /// Internal builds (buzz-releases) bake provider/model defaults and arbitrary @@ -58,6 +77,19 @@ fn build_env_map( } } } + // Defense in depth. `build.rs` already refuses to bake a reserved key, so + // reaching this filter means the binary was produced by a build that + // skipped that check. Drop the key rather than let it override the access + // gate: the baked map is written into the spawned agent's environment last + // (see `managed_agents/runtime.rs`), so a baked `BUZZ_ACP_RESPOND_TO` would + // otherwise win over the gate Desktop just set. + map.retain(|key, _| { + if super::env_vars::is_reserved_env_key(key) { + eprintln!("buzz-desktop: ignoring reserved env var `{key}` from the baked build env"); + return false; + } + true + }); map } @@ -356,4 +388,66 @@ mod tests { "unrelated merged_env keys must pass through unchanged" ); } + + // ── baked reserved-key filtering ────────────────────────────────────── + // + // The baked map is written into a spawned agent's environment LAST (see + // `managed_agents/runtime.rs`), after Buzz sets the access gates. If a + // baked reserved key survived here, an internal build packaged with + // `BUZZ_ACP_RESPOND_TO=anyone` would answer anyone while the UI shows + // "Only me". `build.rs` rejects such a key at build time; these tests pin + // the runtime backstop for a binary built without that check. + + #[test] + fn build_env_map_drops_baked_access_gate_keys() { + use base64::Engine as _; + let raw = "BUZZ_ACP_RESPOND_TO=anyone\nBUZZ_ACP_ALLOWED_RESPOND_TO=anyone\nBUZZ_ACP_RESPOND_TO_ALLOWLIST=deadbeef\nDATABRICKS_MODEL=goose-claude-opus-4-8"; + let blob = base64::engine::general_purpose::STANDARD.encode(raw.as_bytes()); + let map = build_env_map(None, None, Some(&blob)); + for key in [ + "BUZZ_ACP_RESPOND_TO", + "BUZZ_ACP_ALLOWED_RESPOND_TO", + "BUZZ_ACP_RESPOND_TO_ALLOWLIST", + ] { + assert!( + !map.contains_key(key), + "baked `{key}` must not reach the spawned agent env" + ); + } + assert_eq!( + map.get("DATABRICKS_MODEL").map(String::as_str), + Some("goose-claude-opus-4-8"), + "non-reserved baked keys must still pass through" + ); + } + + #[test] + fn build_env_map_drops_baked_reserved_keys_case_insensitively() { + use base64::Engine as _; + // `is_reserved_env_key` compares case-insensitively, and so must the + // baked filter: env lookup is case-sensitive on Unix, but a lowercase + // spelling would still be a reserved key smuggled past a case-sensitive + // check on Windows. + let raw = "buzz_acp_respond_to=anyone\nBuzz_Private_Key=nsec1fake"; + let blob = base64::engine::general_purpose::STANDARD.encode(raw.as_bytes()); + let map = build_env_map(None, None, Some(&blob)); + assert!( + map.is_empty(), + "reserved keys in any casing must be dropped from the baked env: {map:?}" + ); + } + + #[test] + fn build_env_map_drops_every_reserved_key() { + use base64::Engine as _; + for key in super::super::env_vars::RESERVED_ENV_KEYS { + let raw = format!("{key}=baked-value"); + let blob = base64::engine::general_purpose::STANDARD.encode(raw.as_bytes()); + let map = build_env_map(None, None, Some(&blob)); + assert!( + map.is_empty(), + "baked reserved key `{key}` must be dropped, got {map:?}" + ); + } + } } diff --git a/desktop/src-tauri/src/managed_agents/agent_events.rs b/desktop/src-tauri/src/managed_agents/agent_events.rs index 4a7b80079d8..f0a4fabfed8 100644 --- a/desktop/src-tauri/src/managed_agents/agent_events.rs +++ b/desktop/src-tauri/src/managed_agents/agent_events.rs @@ -111,6 +111,12 @@ pub fn agent_event_content(record: &ManagedAgentRecord) -> ManagedAgentEventCont /// Returns an unsigned `EventBuilder` — the caller signs and submits. The /// `d_tag` is the agent's pubkey. pub fn build_agent_event(record: &ManagedAgentRecord) -> Result { + super::validate_managed_agent_definition_text( + &record.name, + record.persona_id.as_deref(), + record.system_prompt.as_deref(), + ) + .map_err(|error| format!("Managed agent definition is unsafe to publish: {error}"))?; let content = serde_json::to_string(&agent_event_content(record)) .map_err(|e| format!("failed to serialize managed-agent content: {e}"))?; let tags = @@ -187,6 +193,7 @@ mod tests { config: serde_json::json!({ "api_key": "sk-provider-secret" }), }, backend_agent_id: Some("remote-id".to_string()), + provider_policy_pending: false, provider_binary_path: Some("/path/to/binary".to_string()), team_id: None, persona_team_dir: None, @@ -216,6 +223,7 @@ mod tests { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -227,6 +235,31 @@ mod tests { assert_eq!(event.kind.as_u16() as u32, KIND_MANAGED_AGENT); } + #[test] + fn publication_rejects_unsafe_definition_less_name_and_prompt() { + let mut unsafe_name = sample_agent(); + unsafe_name.persona_id = None; + unsafe_name.name = "Review\u{200B}er".to_string(); + let error = build_agent_event(&unsafe_name) + .expect_err("publication must reject an invisible agent name"); + assert!(error.contains("U+200B"), "unexpected error: {error}"); + + let mut unsafe_prompt = sample_agent(); + unsafe_prompt.persona_id = None; + unsafe_prompt.system_prompt = Some("Review\u{202E} code.".to_string()); + let error = build_agent_event(&unsafe_prompt) + .expect_err("publication must reject bidi formatting in instructions"); + assert!(error.contains("U+202E"), "unexpected error: {error}"); + } + + #[test] + fn publication_ignores_inert_linked_record_prompt() { + let mut linked = sample_agent(); + linked.system_prompt = Some("stale\u{200B} prompt".to_string()); + build_agent_event(&linked) + .expect("linked record prompt is omitted in favor of the validated persona"); + } + #[test] fn d_tag_is_agent_pubkey() { let builder = build_agent_event(&sample_agent()).unwrap(); diff --git a/desktop/src-tauri/src/managed_agents/agent_snapshot.rs b/desktop/src-tauri/src/managed_agents/agent_snapshot.rs index 16a0d35b23d..4b734ce1591 100644 --- a/desktop/src-tauri/src/managed_agents/agent_snapshot.rs +++ b/desktop/src-tauri/src/managed_agents/agent_snapshot.rs @@ -56,6 +56,13 @@ pub const PNG_CHUNK_KEYWORD: &str = "buzz_agent_snapshot"; /// this are stored as a URL reference instead. const MAX_AVATAR_INLINE_BYTES: usize = 2 * 1024 * 1024; // 2 MB +/// Maximum edge (px) for the PNG image body. The body is only a card +/// thumbnail — the manifest keeps the full-resolution source reference — so a +/// large avatar is downscaled here to keep the encoded snapshot well under +/// `MAX_SNAPSHOT_PNG_BYTES`. Mirrors the frontend SVG rasterizer's 512×512 cap +/// in `snapshotAvatarPng.ts`. +const MAX_PNG_BODY_EDGE: u32 = 512; + /// Format discriminator — used for sniffing and validation. pub const FORMAT_DISCRIMINATOR: &str = "buzz-agent-snapshot"; @@ -306,16 +313,29 @@ pub fn encode_snapshot_png( ); } - // Manifest → JSON → base64 for the tEXt chunk payload. + // Manifest → JSON for the tEXt chunk payload. The payload/PNG composition + // is shared with the locked-card encoder in `agent_snapshot_envelope`; + // plain cards remain byte-identical to the pre-envelope encoder. let json_bytes = encode_snapshot_json(snapshot)?; - let chunk_text = STANDARD.encode(&json_bytes); + encode_chunk_payload_png(&json_bytes, avatar_bytes) +} + +/// Encode arbitrary chunk-payload JSON (plain manifest or locked envelope) +/// into a PNG carrying it base64-encoded in the `buzz_agent_snapshot` tEXt +/// chunk. Shared by the plain encoder above and +/// `agent_snapshot_envelope::encode_locked_snapshot_png`. +pub(crate) fn encode_chunk_payload_png( + json_bytes: &[u8], + avatar_bytes: Option<&[u8]>, +) -> Result, String> { + let chunk_text = STANDARD.encode(json_bytes); // Use the avatar as the PNG image body, transcoding decodable non-PNG // avatars. Fall back to a minimal 1×1 transparent placeholder only when // there is no avatar or it cannot be decoded. let png_bytes = match avatar_bytes.filter(|bytes| !bytes.is_empty()) { Some(bytes) => { - let encoded_avatar = if bytes.starts_with(b"\x89PNG") { + let encoded_avatar = if bytes.starts_with(b"\x89PNG") && png_within_body_cap(bytes) { inject_text_chunk(bytes, PNG_CHUNK_KEYWORD, &chunk_text).or_else(|_| { transcode_avatar_to_png_with_text(bytes, PNG_CHUNK_KEYWORD, &chunk_text) }) @@ -334,8 +354,11 @@ pub fn encode_snapshot_png( Ok(png_bytes) } -/// Decode a manifest from a `.agent.png` tEXt chunk. -pub fn decode_snapshot_png(png_bytes: &[u8]) -> Result { +/// Extract and base64-decode the raw `buzz_agent_snapshot` chunk payload +/// (JSON bytes) from a PNG, without interpreting it. The payload may be a +/// plain manifest or a locked envelope — callers dispatch on the parsed +/// `format` via `agent_snapshot_envelope::parse_chunk_payload`. +pub(crate) fn extract_chunk_payload_png(png_bytes: &[u8]) -> Result, String> { let decoder = Decoder::new(Cursor::new(png_bytes)); let reader = decoder .read_info() @@ -349,10 +372,18 @@ pub fn decode_snapshot_png(png_bytes: &[u8]) -> Result { .map(|c| c.text.as_str()) .ok_or_else(|| "PNG does not contain a buzz_agent_snapshot tEXt chunk".to_string())?; - let json_bytes = STANDARD + STANDARD .decode(chunk_text.trim()) - .map_err(|e| format!("Invalid base64 in PNG chunk: {e}"))?; + .map_err(|e| format!("Invalid base64 in PNG chunk: {e}")) +} +/// Decode a manifest from a `.agent.png` tEXt chunk. +/// +/// Plain snapshots only — a locked (encrypted) chunk payload fails here with +/// the manifest format error. Import paths that must handle locked cards go +/// through `agent_snapshot_envelope::parse_chunk_payload` instead. +pub fn decode_snapshot_png(png_bytes: &[u8]) -> Result { + let json_bytes = extract_chunk_payload_png(png_bytes)?; decode_snapshot_json(&json_bytes) } @@ -379,6 +410,15 @@ pub(crate) fn validate_snapshot(snapshot: &AgentSnapshot) -> Result<(), String> if snapshot.profile.display_name.trim().is_empty() { return Err("Snapshot profile.displayName is empty".to_string()); } + super::validate_agent_definition_text( + &snapshot.profile.display_name, + snapshot + .definition + .system_prompt + .as_deref() + .unwrap_or_default(), + ) + .map_err(|error| format!("Snapshot definition is unsafe: {error}"))?; Ok(()) } @@ -416,6 +456,11 @@ pub(crate) fn make_png_with_text(keyword: &str, text: &str) -> Result, S } /// Transcode a decodable avatar to PNG and add the snapshot manifest chunk. +/// +/// The decoded image is downscaled so its longest edge is at most +/// `MAX_PNG_BODY_EDGE` before PNG re-encoding. The body is only a card +/// thumbnail — this keeps a large source avatar (e.g. a 4K webp) from +/// producing a PNG that blows `MAX_SNAPSHOT_PNG_BYTES`. fn transcode_avatar_to_png_with_text( avatar_bytes: &[u8], keyword: &str, @@ -423,6 +468,7 @@ fn transcode_avatar_to_png_with_text( ) -> Result, String> { let image = image::load_from_memory(avatar_bytes) .map_err(|e| format!("Failed to decode avatar image: {e}"))?; + let image = downscale_to_body_cap(image); let mut png_bytes = Vec::new(); image .write_to(&mut Cursor::new(&mut png_bytes), image::ImageFormat::Png) @@ -430,6 +476,32 @@ fn transcode_avatar_to_png_with_text( inject_text_chunk(&png_bytes, keyword, text) } +/// Downscale so the longest edge is at most `MAX_PNG_BODY_EDGE`, preserving +/// aspect ratio. Images already within the cap are returned untouched. +fn downscale_to_body_cap(image: image::DynamicImage) -> image::DynamicImage { + if image.width() <= MAX_PNG_BODY_EDGE && image.height() <= MAX_PNG_BODY_EDGE { + return image; + } + image.resize( + MAX_PNG_BODY_EDGE, + MAX_PNG_BODY_EDGE, + image::imageops::FilterType::Lanczos3, + ) +} + +/// Whether an already-PNG avatar is within the body dimension cap and can be +/// carried as-is (via a cheap tEXt-chunk injection) instead of being decoded +/// and downscaled. Undecodable headers fall through to the transcode path. +fn png_within_body_cap(png_bytes: &[u8]) -> bool { + Decoder::new(Cursor::new(png_bytes)) + .read_info() + .map(|reader| { + let info = reader.info(); + info.width <= MAX_PNG_BODY_EDGE && info.height <= MAX_PNG_BODY_EDGE + }) + .unwrap_or(false) +} + /// Inject a tEXt chunk into an existing PNG by re-encoding it. /// /// Re-decodes the image data via the `png` crate and writes a fresh PNG with @@ -473,527 +545,5 @@ fn inject_text_chunk(png_bytes: &[u8], keyword: &str, text: &str) -> Result ManagedAgentRecord { - ManagedAgentRecord { - pubkey: "deadbeef".to_string(), - name: "Test Agent".to_string(), - display_name: Some("Test Agent Display".to_string()), - persona_id: Some("SENTINEL_PERSONA_ID".to_string()), // MUST NOT appear in snapshot - team_id: Some("SENTINEL_TEAM_ID".to_string()), // MUST NOT appear in snapshot - private_key_nsec: "nsec1secret".to_string(), // MUST NOT appear in snapshot - auth_tag: Some("auth-tag-secret".to_string()), // MUST NOT appear in snapshot - relay_url: "wss://relay.example.com".to_string(), // MUST NOT appear in snapshot - avatar_url: Some("https://example.com/avatar.png".to_string()), - acp_command: "/usr/local/bin/acp".to_string(), // MUST NOT appear in snapshot - agent_command: "goose".to_string(), // MUST NOT appear in snapshot - agent_command_override: Some("goose-override".to_string()), // MUST NOT appear - agent_args: vec!["--arg".to_string()], // MUST NOT appear in snapshot - mcp_command: "mcp-server".to_string(), // MUST NOT appear in snapshot - turn_timeout_seconds: 120, // deprecated, MUST NOT appear - idle_timeout_seconds: Some(30), - max_turn_duration_seconds: Some(600), - parallelism: 2, - system_prompt: Some("You are a test agent.".to_string()), - model: Some("claude-opus-4".to_string()), - provider: Some("anthropic".to_string()), - persona_source_version: Some("v1.0".to_string()), // MUST NOT appear - env_vars: { - let mut m = BTreeMap::new(); - m.insert("API_KEY".to_string(), "secret123".to_string()); // MUST NOT appear - m - }, - start_on_app_launch: true, - auto_restart_on_config_change: true, - runtime_pid: Some(12345), // MUST NOT appear - backend: BackendKind::Provider { - // MUST NOT appear — carries a provider secret - id: "SENTINEL_BACKEND_ID".to_string(), - config: serde_json::json!({"api_key": "SENTINEL_BACKEND_SECRET"}), - }, - backend_agent_id: Some("SENTINEL_BACKEND_AGENT_ID".to_string()), // MUST NOT appear - provider_binary_path: Some("/usr/bin/SENTINEL_PROVIDER_BINARY".to_string()), // MUST NOT appear - persona_team_dir: Some(std::path::PathBuf::from("SENTINEL_TEAM_DIR")), // MUST NOT appear - persona_name_in_team: Some("SENTINEL_NAME_IN_TEAM".to_string()), // MUST NOT appear - created_at: "2024-01-01T00:00:00Z".to_string(), - updated_at: "2024-01-02T00:00:00Z".to_string(), - last_started_at: Some("2024-01-03T00:00:00Z".to_string()), // MUST NOT appear - last_stopped_at: None, - last_exit_code: Some(0), // MUST NOT appear - last_error: Some("SENTINEL_LAST_ERROR".to_string()), // MUST NOT appear - last_error_code: Some(42), // MUST NOT appear - respond_to: RespondTo::default(), - respond_to_allowlist: vec!["pubkey1hex".to_string()], - slug: Some("test-agent".to_string()), - runtime: Some("goose".to_string()), - name_pool: vec!["Alice".to_string(), "Bob".to_string()], - is_builtin: false, - is_active: true, - shared: false, - source_team: Some("team-id-123".to_string()), // MUST NOT appear - source_team_persona_slug: Some("lep".to_string()), // MUST NOT appear - definition_respond_to: Some("allowlist".to_string()), - catalog_source: None, - definition_respond_to_allowlist: vec!["abc123def".to_string()], - definition_parallelism: Some(4), - relay_mesh: None, - } - } - - // ── Round-trip tests ────────────────────────────────────────────────────── - - #[test] - fn json_round_trip_config_only() { - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); - let bytes = encode_snapshot_json(&snapshot).unwrap(); - let parsed = decode_snapshot_json(&bytes).unwrap(); - assert_eq!(parsed, snapshot); - } - - #[test] - fn json_round_trip_with_memory() { - let record = minimal_record(); - let entries = vec![ - AgentSnapshotMemoryEntry { - slug: "core".to_string(), - body: "I am a test agent.".to_string(), - }, - AgentSnapshotMemoryEntry { - slug: "mem/research".to_string(), - body: "Some research notes.".to_string(), - }, - ]; - let snapshot = build_snapshot(&record, MemoryLevel::Everything, entries, None); - let bytes = encode_snapshot_json(&snapshot).unwrap(); - let parsed = decode_snapshot_json(&bytes).unwrap(); - assert_eq!(parsed, snapshot); - } - - #[test] - fn png_round_trip_no_memory() { - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); - let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); - let parsed = decode_snapshot_png(&png_bytes).unwrap(); - assert_eq!(parsed.definition.name, snapshot.definition.name); - assert_eq!(parsed.profile.display_name, snapshot.profile.display_name); - assert_eq!(parsed.memory.level, MemoryLevel::None); - } - - #[test] - fn png_round_trip_with_avatar_png() { - // Build a minimal PNG avatar. - let avatar = make_png_with_text("dummy", "value").unwrap(); - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&avatar)); - // Avatar should be inlined as a data URL. - assert!(snapshot - .profile - .avatar_data_url - .as_deref() - .unwrap_or("") - .starts_with("data:image/png;base64,")); - - let png_bytes = encode_snapshot_png(&snapshot, Some(&avatar)).unwrap(); - let parsed = decode_snapshot_png(&png_bytes).unwrap(); - assert_eq!(parsed.definition.name, snapshot.definition.name); - } - - #[test] - fn png_snapshot_transcodes_jpeg_avatar_into_image_body() { - let avatar = image::DynamicImage::ImageRgb8(image::RgbImage::from_pixel( - 3, - 2, - image::Rgb([0x12, 0x34, 0x56]), - )); - let mut jpeg_bytes = Vec::new(); - avatar - .write_to(&mut Cursor::new(&mut jpeg_bytes), image::ImageFormat::Jpeg) - .unwrap(); - - let snapshot = build_snapshot( - &minimal_record(), - MemoryLevel::None, - vec![], - Some(&jpeg_bytes), - ); - let png_bytes = encode_snapshot_png(&snapshot, Some(&jpeg_bytes)).unwrap(); - let decoder = Decoder::new(Cursor::new(png_bytes)); - let reader = decoder.read_info().unwrap(); - - assert_eq!((reader.info().width, reader.info().height), (3, 2)); - } - - // ── PNG memory parity ───────────────────────────────────────────────────── - - #[test] - fn png_round_trip_with_core_memory() { - let record = minimal_record(); - let entries = vec![AgentSnapshotMemoryEntry { - slug: "core".to_string(), - body: "remember this".to_string(), - }]; - let snapshot = build_snapshot(&record, MemoryLevel::Core, entries, None); - - let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); - let parsed = decode_snapshot_png(&png_bytes).unwrap(); - - assert_eq!(parsed.memory, snapshot.memory); - } - - #[test] - fn png_round_trip_with_everything_memory() { - let record = minimal_record(); - let entries = vec![ - AgentSnapshotMemoryEntry { - slug: "core".to_string(), - body: "remember this".to_string(), - }, - AgentSnapshotMemoryEntry { - slug: "mem/notes".to_string(), - body: "private notes".to_string(), - }, - ]; - let snapshot = build_snapshot(&record, MemoryLevel::Everything, entries, None); - - let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); - let parsed = decode_snapshot_png(&png_bytes).unwrap(); - - assert_eq!(parsed.memory, snapshot.memory); - } - - #[test] - fn png_export_with_no_memory_succeeds() { - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); - assert!(encode_snapshot_png(&snapshot, None).is_ok()); - } - - #[test] - fn png_export_rejects_none_level_with_nonempty_entries() { - // Inconsistent state: level == None but entries is non-empty. - // The encoder must reject this to prevent a memory-leak bypass. - let record = minimal_record(); - let entries = vec![AgentSnapshotMemoryEntry { - slug: "core".to_string(), - body: "leaked memory".to_string(), - }]; - // Build with entries, then override level to None in the struct. - let mut snapshot = build_snapshot(&record, MemoryLevel::Core, entries, None); - snapshot.memory.level = MemoryLevel::None; // force inconsistency - let result = encode_snapshot_png(&snapshot, None); - assert!( - result.is_err(), - "PNG encoder must reject level=None with non-empty entries" - ); - assert!( - result - .unwrap_err() - .contains("memory.level 'none' and non-empty memory entries"), - "Error must explain the malformed memory state" - ); - } - - // ── Secret exclusion tests ──────────────────────────────────────────────── - // - // These tests assert that every field in the exclusion list is absent from - // the serialized snapshot. We serialize to JSON and assert the key is NOT - // present. - - fn snapshot_json_string(record: &ManagedAgentRecord) -> String { - let snapshot = build_snapshot(record, MemoryLevel::None, vec![], None); - let bytes = encode_snapshot_json(&snapshot).unwrap(); - String::from_utf8(bytes).unwrap() - } - - #[test] - fn secret_exclusion_private_key_nsec_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("nsec1secret"), - "nsec must not appear in snapshot" - ); - assert!( - !json.contains("privateKeyNsec") && !json.contains("private_key_nsec"), - "privateKeyNsec field must not appear in snapshot" - ); - } - - #[test] - fn secret_exclusion_auth_tag_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("auth-tag-secret"), - "auth_tag value must not appear in snapshot" - ); - assert!( - !json.contains("authTag") && !json.contains("auth_tag"), - "authTag field must not appear in snapshot" - ); - } - - #[test] - fn secret_exclusion_env_vars_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("API_KEY") && !json.contains("secret123"), - "env_vars content must not appear in snapshot" - ); - assert!( - !json.contains("envVars") && !json.contains("env_vars"), - "envVars field must not appear in snapshot" - ); - } - - #[test] - fn secret_exclusion_relay_url_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("wss://relay.example.com"), - "relay_url value must not appear in snapshot" - ); - assert!( - !json.contains("relayUrl") && !json.contains("relay_url"), - "relayUrl field must not appear in snapshot" - ); - } - - #[test] - fn snapshot_omits_removed_mcp_toolsets_config() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("mcpToolsets") && !json.contains("mcp_toolsets"), - "removed MCP toolsets config must not re-enter snapshots" - ); - } - - #[test] - fn secret_exclusion_machine_commands_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - // acp_command / agent_command / agent_command_override / agent_args / mcp_command - assert!( - !json.contains("/usr/local/bin/acp"), - "acp_command path must not appear" - ); - assert!( - !json.contains("acpCommand") && !json.contains("acp_command"), - "acpCommand field must not appear" - ); - assert!( - !json.contains("agentCommand") && !json.contains("agent_command"), - "agentCommand field must not appear" - ); - assert!( - !json.contains("mcpCommand") && !json.contains("mcp_command"), - "mcpCommand field must not appear" - ); - } - - #[test] - fn secret_exclusion_runtime_state_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("runtimePid") && !json.contains("runtime_pid"), - "runtimePid must not appear" - ); - assert!( - !json.contains("backendAgentId") && !json.contains("backend_agent_id"), - "backendAgentId must not appear" - ); - assert!( - !json.contains("SENTINEL_BACKEND_AGENT_ID"), - "backendAgentId value must not appear" - ); - assert!( - !json.contains("providerBinaryPath") && !json.contains("provider_binary_path"), - "providerBinaryPath must not appear" - ); - assert!( - !json.contains("SENTINEL_PROVIDER_BINARY"), - "providerBinaryPath value must not appear" - ); - assert!( - !json.contains("lastStartedAt") && !json.contains("last_started_at"), - "lastStartedAt must not appear" - ); - assert!( - !json.contains("lastExitCode") && !json.contains("last_exit_code"), - "lastExitCode must not appear" - ); - // backend blob — neither the type tag nor provider secret must leak. - assert!( - !json.contains("\"backend\"") && !json.contains("backend"), - "backend field must not appear" - ); - assert!( - !json.contains("SENTINEL_BACKEND_ID") && !json.contains("SENTINEL_BACKEND_SECRET"), - "backend config values must not appear" - ); - // last_error / last_error_code - assert!( - !json.contains("lastError") && !json.contains("last_error"), - "lastError must not appear" - ); - assert!( - !json.contains("SENTINEL_LAST_ERROR"), - "lastError value must not appear" - ); - assert!( - !json.contains("lastErrorCode") && !json.contains("last_error_code"), - "lastErrorCode must not appear" - ); - } - - #[test] - fn secret_exclusion_lineage_ids_absent() { - let record = minimal_record(); - let json = snapshot_json_string(&record); - assert!( - !json.contains("team-id-123"), - "source_team value must not appear" - ); - assert!( - !json.contains("sourceTeam") && !json.contains("source_team"), - "sourceTeam field must not appear" - ); - assert!( - !json.contains("sourceTeamPersonaSlug"), - "sourceTeamPersonaSlug must not appear" - ); - assert!( - !json.contains("personaSourceVersion") && !json.contains("persona_source_version"), - "personaSourceVersion must not appear" - ); - // personaId - assert!( - !json.contains("personaId") && !json.contains("persona_id"), - "personaId field must not appear" - ); - assert!( - !json.contains("SENTINEL_PERSONA_ID"), - "personaId value must not appear" - ); - // teamId - assert!( - !json.contains("teamId") && !json.contains("team_id"), - "teamId field must not appear" - ); - assert!( - !json.contains("SENTINEL_TEAM_ID"), - "teamId value must not appear" - ); - // personaTeamDir - assert!( - !json.contains("personaTeamDir") && !json.contains("persona_team_dir"), - "personaTeamDir field must not appear" - ); - assert!( - !json.contains("SENTINEL_TEAM_DIR"), - "personaTeamDir value must not appear" - ); - // personaNameInTeam - assert!( - !json.contains("personaNameInTeam") && !json.contains("persona_name_in_team"), - "personaNameInTeam field must not appear" - ); - assert!( - !json.contains("SENTINEL_NAME_IN_TEAM"), - "personaNameInTeam value must not appear" - ); - } - - // ── Definition field presence tests ────────────────────────────────────── - - #[test] - fn definition_fields_present_in_snapshot() { - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); - - assert_eq!(snapshot.definition.name, "Test Agent Display"); - assert!(!snapshot.definition.source_is_builtin); - assert_eq!( - snapshot.definition.system_prompt.as_deref(), - Some("You are a test agent.") - ); - assert_eq!(snapshot.definition.runtime.as_deref(), Some("goose")); - assert_eq!(snapshot.definition.model.as_deref(), Some("claude-opus-4")); - assert_eq!(snapshot.definition.provider.as_deref(), Some("anthropic")); - assert_eq!(snapshot.definition.name_pool, vec!["Alice", "Bob"]); - // definition_respond_to maps to respond_to in the snapshot definition - assert_eq!(snapshot.definition.respond_to.as_deref(), Some("allowlist")); - // definition_respond_to_allowlist should be included - assert!(!snapshot.definition.respond_to_allowlist.is_empty()); - } - - #[test] - fn profile_fields_present_in_snapshot() { - let record = minimal_record(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); - assert_eq!(snapshot.profile.display_name, "Test Agent Display"); - // No bytes → should fall back to avatar_url - assert_eq!( - snapshot.profile.avatar_url.as_deref(), - Some("https://example.com/avatar.png") - ); - assert!(snapshot.profile.avatar_data_url.is_none()); - } - - #[test] - fn avatar_inlined_when_under_size_limit() { - let record = minimal_record(); - let small_png = make_png_with_text("k", "v").unwrap(); - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&small_png)); - assert!(snapshot.profile.avatar_data_url.is_some()); - assert!(snapshot.profile.avatar_url.is_none()); - } - - #[test] - fn avatar_url_fallback_when_over_size_limit() { - let mut record = minimal_record(); - record.avatar_url = Some("https://example.com/big.png".to_string()); - // Synthesize oversized avatar bytes (> 2 MB) — just a large zeroed vec. - let big_bytes = vec![0u8; MAX_AVATAR_INLINE_BYTES + 1]; - let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&big_bytes)); - assert!(snapshot.profile.avatar_data_url.is_none()); - assert_eq!( - snapshot.profile.avatar_url.as_deref(), - Some("https://example.com/big.png") - ); - } - - // ── Format/version validation ───────────────────────────────────────────── - - #[test] - fn invalid_format_discriminator_is_rejected() { - let mut snapshot = build_snapshot(&minimal_record(), MemoryLevel::None, vec![], None); - snapshot.format = "not-a-buzz-snapshot".to_string(); - let bytes = serde_json::to_vec(&snapshot).unwrap(); - let result = decode_snapshot_json(&bytes); - assert!(result.is_err()); - assert!(result.unwrap_err().contains("Unsupported snapshot format")); - } - - #[test] - fn unsupported_version_is_rejected() { - let mut snapshot = build_snapshot(&minimal_record(), MemoryLevel::None, vec![], None); - snapshot.version = 99; - let bytes = serde_json::to_vec(&snapshot).unwrap(); - let result = decode_snapshot_json(&bytes); - assert!(result.is_err()); - assert!(result.unwrap_err().contains("Unsupported snapshot version")); - } -} +#[path = "agent_snapshot_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/managed_agents/agent_snapshot_envelope.rs b/desktop/src-tauri/src/managed_agents/agent_snapshot_envelope.rs new file mode 100644 index 00000000000..de2f71577a6 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/agent_snapshot_envelope.rs @@ -0,0 +1,640 @@ +//! Locked (encrypted) agent-card envelope — NIP-44 v2 over the snapshot manifest. +//! +//! A locked card carries the same `buzz_agent_snapshot` tEXt chunk as a plain +//! card, but the chunk JSON is a typed outer envelope whose ciphertext +//! decrypts to the ordinary manifest. The NIP-44 v2 conversation key is +//! symmetric over the (owner, agent) pair, so BOTH the owner's and the +//! agent's nsec decrypt the card — nobody else's does (NIP-AE's scheme). +//! +//! Wire contract (agreed with Wren, buzz-agent-trading-cards thread): +//! - Plain cards keep today's exact bytes; detection dispatches once on the +//! exact `format` discriminator and rejects unknown versions/schemes +//! rather than falling through to manifest parsing. +//! - Key lookup is exact-endpoint only: the owner identity key when its +//! pubkey equals `ownerPubkey`, or a hydrated local managed-agent record +//! whose record pubkey AND derived-secret pubkey equal `agentPubkey`. +//! No trial decryption; anything else fails closed as locked. +//! - Caps beyond the outer 10 MiB PNG gate: 65,535-byte NIP-44 plaintext +//! limit on the serialized manifest BEFORE encryption; envelope JSON and +//! ciphertext are capped before serde/base64/decrypt work; decrypted bytes +//! are capped before snapshot parsing. +//! - Decrypt/auth failures return only the locked-card refusal — never +//! partial plaintext or crypto details. + +use buzz_core_pkg::engram::NIP44_PLAINTEXT_MAX; +use nostr::nips::nip44::{self, Version}; +use nostr::{Keys, PublicKey, SecretKey}; +use serde::{Deserialize, Serialize}; + +use super::agent_snapshot::{ + decode_snapshot_json, encode_chunk_payload_png, encode_snapshot_json, AgentSnapshot, + MemoryLevel, FORMAT_DISCRIMINATOR, +}; +use super::types::ManagedAgentRecord; + +/// Discriminator for the locked envelope. Distinct from the plain manifest's +/// `buzz-agent-snapshot` so detection never guesses. +pub const LOCKED_FORMAT: &str = "buzz-agent-snapshot-encrypted"; +/// Envelope schema version this module produces and accepts. +pub const LOCKED_VERSION: u32 = 1; +/// Encryption scheme identifier this module produces and accepts. +pub const LOCKED_SCHEME: &str = "nip44-v2"; + +/// A max-size NIP-44 v2 payload (1 version + 32 nonce + 2 len + 65,536 +/// padded + 32 MAC = 65,603 bytes) base64-encodes to 87,472 chars. +/// Anything larger is rejected before base64/decrypt work. +pub const MAX_LOCKED_CIPHERTEXT_BYTES: usize = 90_000; +/// Envelope JSON = ciphertext + two pubkeys + fixed keys. Rejected before +/// typed deserialization. +pub const MAX_LOCKED_ENVELOPE_JSON_BYTES: usize = MAX_LOCKED_CIPHERTEXT_BYTES + 1024; + +/// The only error a failed unlock may surface. Deliberately says nothing +/// about which key was tried or why decryption failed. +pub const LOCKED_CARD_REFUSAL: &str = + "This card is locked to its owner and agent. Only they can import it."; + +// ── Envelope types ──────────────────────────────────────────────────────────── + +/// Typed outer envelope stored (base64 JSON) in the `buzz_agent_snapshot` +/// chunk of a locked card. +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)] +#[serde(rename_all = "camelCase")] +pub struct LockedSnapshotEnvelope { + /// Always [`LOCKED_FORMAT`]. + pub format: String, + /// Always [`LOCKED_VERSION`]. + pub version: u32, + pub encryption: LockedEncryption, +} + +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)] +#[serde(rename_all = "camelCase")] +pub struct LockedEncryption { + /// Always [`LOCKED_SCHEME`]. + pub scheme: String, + /// Owner identity pubkey (64 lowercase hex). Plaintext so a decryptor + /// knows which counterparty to pair with. + pub owner_pubkey: String, + /// Agent instance pubkey (64 lowercase hex). + pub agent_pubkey: String, + /// NIP-44 v2 ciphertext (base64) of the plain manifest JSON. + pub ciphertext: String, +} + +/// Result of parsing a chunk payload: either today's plain manifest or a +/// validated locked envelope. The plain manifest is boxed because it may +/// inline a multi-KB avatar data URL, dwarfing the envelope variant. +#[derive(Debug)] +pub enum ChunkPayload { + Plain(Box), + Locked(LockedSnapshotEnvelope), +} + +/// Minimal probe used to read the `format` discriminator without building a +/// full JSON tree for large plain manifests. +#[derive(Deserialize)] +struct FormatProbe { + #[serde(default)] + format: Option, +} + +// ── Validation ──────────────────────────────────────────────────────────────── + +/// Canonical pubkey check: exactly 64 lowercase hex chars that parse as a +/// valid x-only pubkey. Lowercase is required so string comparisons against +/// record pubkeys (always `to_hex()` output) stay sound. Curve validation is +/// explicit: nostr's `PublicKey::from_hex` only decodes 32 bytes and defers +/// lift-x validation to `xonly()`, so a non-point like `"f" * 64` would +/// otherwise pass structurally and fail only at decrypt time. +pub(crate) fn parse_canonical_pubkey(field: &str, value: &str) -> Result { + if value.len() != 64 + || !value + .chars() + .all(|c| c.is_ascii_digit() || ('a'..='f').contains(&c)) + { + return Err(format!( + "Locked card envelope has a malformed {field} (expected 64 lowercase hex chars)." + )); + } + let pubkey = PublicKey::from_hex(value) + .map_err(|_| format!("Locked card envelope has an invalid {field}."))?; + pubkey + .xonly() + .map_err(|_| format!("Locked card envelope has an invalid {field} (not a curve point)."))?; + Ok(pubkey) +} + +/// Structural validation of a locked envelope: exact version + scheme, +/// canonical pubkeys, distinct endpoints, bounded ciphertext. Does no +/// key lookup or crypto. +pub fn validate_envelope( + envelope: &LockedSnapshotEnvelope, +) -> Result<(PublicKey, PublicKey), String> { + if envelope.format != LOCKED_FORMAT { + return Err(format!( + "Unsupported locked card format: {:?} (expected {LOCKED_FORMAT:?})", + envelope.format + )); + } + if envelope.version != LOCKED_VERSION { + return Err(format!( + "Unsupported locked card envelope version: {} (expected {LOCKED_VERSION})", + envelope.version + )); + } + if envelope.encryption.scheme != LOCKED_SCHEME { + return Err(format!( + "Unsupported locked card encryption scheme: {:?} (expected {LOCKED_SCHEME:?})", + envelope.encryption.scheme + )); + } + let owner = parse_canonical_pubkey("ownerPubkey", &envelope.encryption.owner_pubkey)?; + let agent = parse_canonical_pubkey("agentPubkey", &envelope.encryption.agent_pubkey)?; + if owner == agent { + return Err("Locked card envelope owner and agent pubkeys must differ.".to_string()); + } + if envelope.encryption.ciphertext.len() > MAX_LOCKED_CIPHERTEXT_BYTES { + return Err("Locked card ciphertext exceeds the maximum size.".to_string()); + } + if envelope.encryption.ciphertext.is_empty() { + return Err("Locked card ciphertext is empty.".to_string()); + } + Ok((owner, agent)) +} + +// ── Dispatch ────────────────────────────────────────────────────────────────── + +/// Parse a raw chunk payload (JSON bytes from `extract_chunk_payload_png` or +/// an `.agent.json` file) and dispatch on the exact `format` discriminator. +/// +/// - `buzz-agent-snapshot` → full plain-manifest decode + validation. +/// - `buzz-agent-snapshot-encrypted` → size caps, typed envelope parse, +/// structural validation. No decryption happens here. +/// - anything else (including missing `format`) → error, never a fall-through. +pub fn parse_chunk_payload(json_bytes: &[u8]) -> Result { + let probe: FormatProbe = + serde_json::from_slice(json_bytes).map_err(|e| format!("Invalid snapshot JSON: {e}"))?; + match probe.format.as_deref() { + Some(f) if f == FORMAT_DISCRIMINATOR => Ok(ChunkPayload::Plain(Box::new( + decode_snapshot_json(json_bytes)?, + ))), + Some(f) if f == LOCKED_FORMAT => { + // Cap the envelope JSON before typed deserialization; a locked + // envelope is small by construction (unlike plain manifests, + // which may inline a multi-MB avatar). + if json_bytes.len() > MAX_LOCKED_ENVELOPE_JSON_BYTES { + return Err("Locked card envelope exceeds the maximum size.".to_string()); + } + let envelope: LockedSnapshotEnvelope = serde_json::from_slice(json_bytes) + .map_err(|e| format!("Invalid locked card envelope: {e}"))?; + validate_envelope(&envelope)?; + Ok(ChunkPayload::Locked(envelope)) + } + Some(other) => Err(format!("Unsupported snapshot format: {other:?}")), + None => Err("Snapshot payload has no format discriminator.".to_string()), + } +} + +// ── Encrypt ─────────────────────────────────────────────────────────────────── + +/// Encrypt a snapshot manifest into a locked envelope under the NIP-44 v2 +/// conversation key for (owner secret, agent pubkey). +/// +/// Fails clearly (never silently truncates) when the serialized manifest +/// exceeds the NIP-44 plaintext limit. +pub fn encrypt_snapshot_envelope( + snapshot: &AgentSnapshot, + owner_keys: &Keys, + agent_pubkey: &PublicKey, +) -> Result { + let json_bytes = encode_snapshot_json(snapshot)?; + if json_bytes.len() > NIP44_PLAINTEXT_MAX { + return Err(format!( + "Agent manifest is too large to lock ({} bytes; the encrypted \ + format caps at {NIP44_PLAINTEXT_MAX}). Reduce the avatar size \ + or mint an unlocked card.", + json_bytes.len() + )); + } + let plaintext = std::str::from_utf8(&json_bytes) + .map_err(|e| format!("Manifest JSON was not UTF-8: {e}"))?; + let ciphertext = nip44::encrypt( + owner_keys.secret_key(), + agent_pubkey, + plaintext, + Version::V2, + ) + .map_err(|e| format!("Failed to encrypt card manifest: {e}"))?; + + Ok(LockedSnapshotEnvelope { + format: LOCKED_FORMAT.to_string(), + version: LOCKED_VERSION, + encryption: LockedEncryption { + scheme: LOCKED_SCHEME.to_string(), + owner_pubkey: owner_keys.public_key().to_hex(), + agent_pubkey: agent_pubkey.to_hex(), + ciphertext, + }, + }) +} + +/// Encode a snapshot into a LOCKED `.agent.png`: encrypt the manifest into +/// the envelope, then compose the PNG through the same chunk encoder plain +/// cards use. Mirrors `encode_snapshot_png`'s structural memory guard. +pub fn encode_locked_snapshot_png( + snapshot: &AgentSnapshot, + owner_keys: &Keys, + agent_pubkey: &PublicKey, + avatar_bytes: Option<&[u8]>, +) -> Result, String> { + if snapshot.memory.level == MemoryLevel::None && !snapshot.memory.entries.is_empty() { + return Err( + "Cannot write a snapshot with memory.level 'none' and non-empty memory entries." + .to_string(), + ); + } + let envelope = encrypt_snapshot_envelope(snapshot, owner_keys, agent_pubkey)?; + let envelope_json = serde_json::to_vec(&envelope) + .map_err(|e| format!("Failed to serialize locked card envelope: {e}"))?; + encode_chunk_payload_png(&envelope_json, avatar_bytes) +} + +// ── Decrypt ─────────────────────────────────────────────────────────────────── + +/// Exact-endpoint key resolution (no trial decryption): +/// - the owner identity secret, only when its pubkey equals `ownerPubkey`; +/// - a hydrated local managed-agent record whose record pubkey AND +/// derived-secret pubkey both equal `agentPubkey`. +/// +/// Returns `None` when neither exact endpoint exists — callers fail closed +/// with [`LOCKED_CARD_REFUSAL`]. +pub fn resolve_unlock_secret( + envelope: &LockedSnapshotEnvelope, + owner_keys: Option<&Keys>, + records: &[ManagedAgentRecord], +) -> Option { + if let Some(keys) = owner_keys { + if keys.public_key().to_hex() == envelope.encryption.owner_pubkey { + return Some(keys.secret_key().clone()); + } + } + let record = records + .iter() + .find(|r| r.pubkey == envelope.encryption.agent_pubkey)?; + let agent_keys = Keys::parse(record.private_key_nsec.trim()).ok()?; + if agent_keys.public_key().to_hex() != envelope.encryption.agent_pubkey { + return None; + } + Some(agent_keys.secret_key().clone()) +} + +/// Decrypt a validated envelope with `my_secret`, which must be one of the +/// envelope's two exact endpoints (its derived pubkey selects the +/// counterparty). Returns the decoded, validated snapshot manifest. +/// +/// Every auth/crypto failure maps to [`LOCKED_CARD_REFUSAL`] — nothing about +/// the failure mode leaks. Manifest decode errors after a successful decrypt +/// are surfaced normally (the caller proved key possession). +pub fn decrypt_envelope( + envelope: &LockedSnapshotEnvelope, + my_secret: &SecretKey, +) -> Result { + let (owner_pub, agent_pub) = validate_envelope(envelope)?; + let my_pub = Keys::new(my_secret.clone()).public_key(); + let counterparty = if my_pub == owner_pub { + agent_pub + } else if my_pub == agent_pub { + owner_pub + } else { + return Err(LOCKED_CARD_REFUSAL.to_string()); + }; + + let plaintext = nip44::decrypt(my_secret, &counterparty, &envelope.encryption.ciphertext) + .map_err(|_| LOCKED_CARD_REFUSAL.to_string())?; + if plaintext.len() > NIP44_PLAINTEXT_MAX { + return Err(LOCKED_CARD_REFUSAL.to_string()); + } + decode_snapshot_json(plaintext.as_bytes()) +} + +// ── Tests ───────────────────────────────────────────────────────────────────── + +#[cfg(test)] +mod tests { + use super::*; + use crate::managed_agents::agent_snapshot::{ + extract_chunk_payload_png, AgentSnapshotDefinition, AgentSnapshotMemory, + AgentSnapshotProfile, FORMAT_VERSION, + }; + + fn sample_snapshot() -> AgentSnapshot { + AgentSnapshot { + format: FORMAT_DISCRIMINATOR.to_string(), + version: FORMAT_VERSION, + definition: AgentSnapshotDefinition { + name: "Locked Test".to_string(), + system_prompt: Some("You are a locked test agent.".to_string()), + runtime: None, + model: None, + provider: None, + parallelism: Some(1), + respond_to: None, + respond_to_allowlist: Vec::new(), + name_pool: Vec::new(), + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + source_is_builtin: false, + }, + profile: AgentSnapshotProfile { + display_name: "Locked Test".to_string(), + about: None, + avatar_data_url: None, + avatar_url: None, + }, + memory: AgentSnapshotMemory { + level: MemoryLevel::None, + entries: Vec::new(), + }, + } + } + + fn owner_agent_keys() -> (Keys, Keys) { + (Keys::generate(), Keys::generate()) + } + + /// Minimal hydrated record for endpoint-resolution tests. Only the + /// pubkey/nsec pair matters here. + fn record_with_keys(pubkey: String, private_key_nsec: String) -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey, + name: "Locked Test".to_string(), + persona_id: None, + private_key_nsec, + auth_tag: None, + relay_url: "ws://localhost:3000".to_string(), + avatar_url: None, + acp_command: "buzz-acp".to_string(), + agent_command: "goose".to_string(), + agent_args: vec![], + mcp_command: String::new(), + turn_timeout_seconds: 300, + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + parallelism: 1, + system_prompt: None, + model: None, + env_vars: std::collections::BTreeMap::new(), + start_on_app_launch: false, + auto_restart_on_config_change: true, + runtime_pid: None, + backend: crate::managed_agents::types::BackendKind::Local, + backend_agent_id: None, + provider_policy_pending: false, + provider_binary_path: None, + team_id: None, + persona_team_dir: None, + persona_name_in_team: None, + created_at: String::new(), + updated_at: String::new(), + last_started_at: None, + last_stopped_at: None, + last_exit_code: None, + last_error: None, + last_error_code: None, + respond_to: crate::managed_agents::types::RespondTo::OwnerOnly, + respond_to_allowlist: vec![], + display_name: None, + slug: None, + runtime: None, + name_pool: Vec::new(), + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + definition_respond_to: None, + definition_respond_to_allowlist: Vec::new(), + definition_parallelism: None, + relay_mesh: None, + effort_level: None, + agent_command_override: None, + persona_source_version: None, + provider: None, + } + } + + fn locked_envelope() -> (LockedSnapshotEnvelope, Keys, Keys) { + let (owner, agent) = owner_agent_keys(); + let env = + encrypt_snapshot_envelope(&sample_snapshot(), &owner, &agent.public_key()).unwrap(); + (env, owner, agent) + } + + #[test] + fn owner_secret_decrypts() { + let (env, owner, _agent) = locked_envelope(); + let decoded = decrypt_envelope(&env, owner.secret_key()).unwrap(); + assert_eq!(decoded, sample_snapshot()); + } + + #[test] + fn agent_secret_decrypts() { + let (env, _owner, agent) = locked_envelope(); + let decoded = decrypt_envelope(&env, agent.secret_key()).unwrap(); + assert_eq!(decoded, sample_snapshot()); + } + + #[test] + fn unrelated_key_fails_closed_with_refusal_only() { + let (env, _owner, _agent) = locked_envelope(); + let stranger = Keys::generate(); + let err = decrypt_envelope(&env, stranger.secret_key()).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); + } + + #[test] + fn tampered_ciphertext_fails_with_refusal_only() { + let (mut env, owner, _agent) = locked_envelope(); + // Flip a character mid-ciphertext (keep valid base64 alphabet). + let mid = env.encryption.ciphertext.len() / 2; + let mut bytes = env.encryption.ciphertext.into_bytes(); + bytes[mid] = if bytes[mid] == b'A' { b'B' } else { b'A' }; + env.encryption.ciphertext = String::from_utf8(bytes).unwrap(); + let err = decrypt_envelope(&env, owner.secret_key()).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); + } + + #[test] + fn swapped_pubkeys_fail_closed_at_endpoint_resolution() { + let (mut env, owner, agent) = locked_envelope(); + std::mem::swap( + &mut env.encryption.owner_pubkey, + &mut env.encryption.agent_pubkey, + ); + // The NIP-44 conversation key is symmetric over the pair, so a swap + // cannot grant a stranger anything — but it desyncs the routing + // hints, and exact-endpoint resolution fails closed rather than + // guessing: the owner identity no longer matches `ownerPubkey`, and + // no local record holds the pubkey now in `agentPubkey`. + assert!(resolve_unlock_secret(&env, Some(&owner), &[]).is_none()); + let nsec = nostr::ToBech32::to_bech32(agent.secret_key()).unwrap(); + let record = record_with_keys(agent.public_key().to_hex(), nsec); + assert!(resolve_unlock_secret(&env, None, std::slice::from_ref(&record)).is_none()); + } + + #[test] + fn mislabeled_pubkey_fails_decryption_with_refusal_only() { + // Replacing `agentPubkey` with a third party's key makes the owner + // derive the wrong conversation key — the NIP-44 MAC fails and only + // the refusal surfaces. + let (mut env, owner, _agent) = locked_envelope(); + env.encryption.agent_pubkey = Keys::generate().public_key().to_hex(); + let err = decrypt_envelope(&env, owner.secret_key()).unwrap_err(); + assert_eq!(err, LOCKED_CARD_REFUSAL); + } + + #[test] + fn malformed_pubkeys_rejected_structurally() { + let (env, _owner, _agent) = locked_envelope(); + + let mut short = env.clone(); + short.encryption.owner_pubkey = "abc123".to_string(); + assert!(validate_envelope(&short).unwrap_err().contains("malformed")); + + let mut upper = env.clone(); + upper.encryption.agent_pubkey = upper.encryption.agent_pubkey.to_uppercase(); + assert!(validate_envelope(&upper).unwrap_err().contains("malformed")); + + // A 64-hex string that is not a curve point (lift-x fails for + // x = p-1... all-f) must be rejected STRUCTURALLY — before any key + // lookup or decrypt work — per the wire contract. + let mut not_a_point = env.clone(); + not_a_point.encryption.agent_pubkey = "f".repeat(64); + assert!(validate_envelope(¬_a_point) + .unwrap_err() + .contains("not a curve point")); + + let mut same = env; + same.encryption.agent_pubkey = same.encryption.owner_pubkey.clone(); + assert!(validate_envelope(&same).unwrap_err().contains("differ")); + } + + #[test] + fn unknown_format_version_scheme_rejected() { + let (env, ..) = locked_envelope(); + + let mut bad_version = env.clone(); + bad_version.version = 2; + assert!(validate_envelope(&bad_version) + .unwrap_err() + .contains("version")); + + let mut bad_scheme = env.clone(); + bad_scheme.encryption.scheme = "nip44-v3".to_string(); + assert!(validate_envelope(&bad_scheme) + .unwrap_err() + .contains("scheme")); + + // Unknown top-level format never falls through to manifest parsing. + let unknown = serde_json::json!({"format": "buzz-agent-snapshot-v9", "version": 1}); + let err = parse_chunk_payload(unknown.to_string().as_bytes()).unwrap_err(); + assert!(err.contains("Unsupported snapshot format"), "{err}"); + + let missing = serde_json::json!({"version": 1}); + let err = parse_chunk_payload(missing.to_string().as_bytes()).unwrap_err(); + assert!(err.contains("no format discriminator"), "{err}"); + } + + #[test] + fn plaintext_cap_enforced_before_encryption() { + let (owner, agent) = owner_agent_keys(); + let mut snapshot = sample_snapshot(); + // Inflate the manifest beyond the NIP-44 plaintext limit. + snapshot.definition.system_prompt = Some("x".repeat(NIP44_PLAINTEXT_MAX)); + let err = encrypt_snapshot_envelope(&snapshot, &owner, &agent.public_key()).unwrap_err(); + assert!(err.contains("too large to lock"), "{err}"); + } + + #[test] + fn ciphertext_and_envelope_caps_enforced_before_crypto() { + let (mut env, ..) = locked_envelope(); + env.encryption.ciphertext = "A".repeat(MAX_LOCKED_CIPHERTEXT_BYTES + 1); + assert!(validate_envelope(&env) + .unwrap_err() + .contains("maximum size")); + + // Oversized envelope JSON is rejected before typed deserialization. + let huge = format!( + r#"{{"format":"{LOCKED_FORMAT}","version":1,"pad":"{}","encryption":{{}}}}"#, + "p".repeat(MAX_LOCKED_ENVELOPE_JSON_BYTES) + ); + let err = parse_chunk_payload(huge.as_bytes()).unwrap_err(); + assert!(err.contains("maximum size"), "{err}"); + } + + #[test] + fn locked_png_round_trips_through_chunk_and_decrypt() { + let (owner, agent) = owner_agent_keys(); + let snapshot = sample_snapshot(); + let png = encode_locked_snapshot_png(&snapshot, &owner, &agent.public_key(), None).unwrap(); + + let payload = extract_chunk_payload_png(&png).unwrap(); + let ChunkPayload::Locked(env) = parse_chunk_payload(&payload).unwrap() else { + panic!("locked PNG must parse as a locked envelope"); + }; + // Both endpoints decrypt to the same logical manifest (compare + // manifests, never ciphertext — the NIP-44 nonce is random). + assert_eq!( + decrypt_envelope(&env, owner.secret_key()).unwrap(), + snapshot + ); + assert_eq!( + decrypt_envelope(&env, agent.secret_key()).unwrap(), + snapshot + ); + } + + #[test] + fn plain_manifest_dispatches_to_plain() { + let json = encode_snapshot_json(&sample_snapshot()).unwrap(); + let ChunkPayload::Plain(decoded) = parse_chunk_payload(&json).unwrap() else { + panic!("plain manifest must parse as Plain"); + }; + assert_eq!(*decoded, sample_snapshot()); + } + + #[test] + fn resolve_unlock_secret_owner_exact_endpoint() { + let (env, owner, _agent) = locked_envelope(); + let secret = resolve_unlock_secret(&env, Some(&owner), &[]).unwrap(); + assert_eq!(&secret, owner.secret_key()); + + // A different identity key is NOT tried. + let other = Keys::generate(); + assert!(resolve_unlock_secret(&env, Some(&other), &[]).is_none()); + assert!(resolve_unlock_secret(&env, None, &[]).is_none()); + } + + #[test] + fn resolve_unlock_secret_agent_requires_record_and_derived_match() { + let (env, _owner, agent) = locked_envelope(); + let nsec = nostr::ToBech32::to_bech32(agent.secret_key()).unwrap(); + + let record = record_with_keys(agent.public_key().to_hex(), nsec); + let secret = resolve_unlock_secret(&env, None, std::slice::from_ref(&record)).unwrap(); + assert_eq!(&secret, agent.secret_key()); + + // Record pubkey matches but the stored secret derives a DIFFERENT + // pubkey → refused (no trial decryption on mismatched material). + let mut forged = record.clone(); + forged.private_key_nsec = + nostr::ToBech32::to_bech32(Keys::generate().secret_key()).unwrap(); + assert!(resolve_unlock_secret(&env, None, std::slice::from_ref(&forged)).is_none()); + + // Record for some other agent → not an endpoint. + let mut unrelated = record; + unrelated.pubkey = Keys::generate().public_key().to_hex(); + assert!(resolve_unlock_secret(&env, None, std::slice::from_ref(&unrelated)).is_none()); + } +} diff --git a/desktop/src-tauri/src/managed_agents/agent_snapshot_tests.rs b/desktop/src-tauri/src/managed_agents/agent_snapshot_tests.rs new file mode 100644 index 00000000000..9f234749bc9 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/agent_snapshot_tests.rs @@ -0,0 +1,654 @@ +//! Unit tests for `managed_agents/agent_snapshot.rs`. +//! +//! Kept in a sibling file so `agent_snapshot.rs` stays under the +//! 1000-line gate; `#[path]`-included from there. + +use super::*; +use crate::managed_agents::types::{BackendKind, ManagedAgentRecord, RespondTo}; +use std::collections::BTreeMap; + +/// Build a minimal `ManagedAgentRecord` for testing. Only the fields +/// relevant to snapshot export are filled; the rest use defaults. +fn minimal_record() -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey: "deadbeef".to_string(), + name: "Test Agent".to_string(), + display_name: Some("Test Agent Display".to_string()), + persona_id: Some("SENTINEL_PERSONA_ID".to_string()), // MUST NOT appear in snapshot + team_id: Some("SENTINEL_TEAM_ID".to_string()), // MUST NOT appear in snapshot + private_key_nsec: "nsec1secret".to_string(), // MUST NOT appear in snapshot + auth_tag: Some("auth-tag-secret".to_string()), // MUST NOT appear in snapshot + relay_url: "wss://relay.example.com".to_string(), // MUST NOT appear in snapshot + avatar_url: Some("https://example.com/avatar.png".to_string()), + acp_command: "/usr/local/bin/acp".to_string(), // MUST NOT appear in snapshot + agent_command: "goose".to_string(), // MUST NOT appear in snapshot + agent_command_override: Some("goose-override".to_string()), // MUST NOT appear + agent_args: vec!["--arg".to_string()], // MUST NOT appear in snapshot + mcp_command: "mcp-server".to_string(), // MUST NOT appear in snapshot + turn_timeout_seconds: 120, // deprecated, MUST NOT appear + idle_timeout_seconds: Some(30), + max_turn_duration_seconds: Some(600), + parallelism: 2, + system_prompt: Some("You are a test agent.".to_string()), + model: Some("claude-opus-4".to_string()), + provider: Some("anthropic".to_string()), + persona_source_version: Some("v1.0".to_string()), // MUST NOT appear + env_vars: { + let mut m = BTreeMap::new(); + m.insert("API_KEY".to_string(), "secret123".to_string()); // MUST NOT appear + m + }, + start_on_app_launch: true, + auto_restart_on_config_change: true, + runtime_pid: Some(12345), // MUST NOT appear + backend: BackendKind::Provider { + // MUST NOT appear — carries a provider secret + id: "SENTINEL_BACKEND_ID".to_string(), + config: serde_json::json!({"api_key": "SENTINEL_BACKEND_SECRET"}), + }, + backend_agent_id: Some("SENTINEL_BACKEND_AGENT_ID".to_string()), // MUST NOT appear + provider_policy_pending: false, + provider_binary_path: Some("/usr/bin/SENTINEL_PROVIDER_BINARY".to_string()), // MUST NOT appear + persona_team_dir: Some(std::path::PathBuf::from("SENTINEL_TEAM_DIR")), // MUST NOT appear + persona_name_in_team: Some("SENTINEL_NAME_IN_TEAM".to_string()), // MUST NOT appear + created_at: "2024-01-01T00:00:00Z".to_string(), + updated_at: "2024-01-02T00:00:00Z".to_string(), + last_started_at: Some("2024-01-03T00:00:00Z".to_string()), // MUST NOT appear + last_stopped_at: None, + last_exit_code: Some(0), // MUST NOT appear + last_error: Some("SENTINEL_LAST_ERROR".to_string()), // MUST NOT appear + last_error_code: Some(42), // MUST NOT appear + respond_to: RespondTo::default(), + respond_to_allowlist: vec!["pubkey1hex".to_string()], + slug: Some("test-agent".to_string()), + runtime: Some("goose".to_string()), + name_pool: vec!["Alice".to_string(), "Bob".to_string()], + is_builtin: false, + is_active: true, + shared: false, + source_team: Some("team-id-123".to_string()), // MUST NOT appear + source_team_persona_slug: Some("lep".to_string()), // MUST NOT appear + definition_respond_to: Some("allowlist".to_string()), + catalog_source: None, + definition_respond_to_allowlist: vec!["abc123def".to_string()], + definition_parallelism: Some(4), + relay_mesh: None, + effort_level: None, + } +} + +// ── Round-trip tests ────────────────────────────────────────────────────── + +#[test] +fn json_round_trip_config_only() { + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + let bytes = encode_snapshot_json(&snapshot).unwrap(); + let parsed = decode_snapshot_json(&bytes).unwrap(); + assert_eq!(parsed, snapshot); +} + +#[test] +fn json_round_trip_with_memory() { + let record = minimal_record(); + let entries = vec![ + AgentSnapshotMemoryEntry { + slug: "core".to_string(), + body: "I am a test agent.".to_string(), + }, + AgentSnapshotMemoryEntry { + slug: "mem/research".to_string(), + body: "Some research notes.".to_string(), + }, + ]; + let snapshot = build_snapshot(&record, MemoryLevel::Everything, entries, None); + let bytes = encode_snapshot_json(&snapshot).unwrap(); + let parsed = decode_snapshot_json(&bytes).unwrap(); + assert_eq!(parsed, snapshot); +} + +#[test] +fn png_round_trip_no_memory() { + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); + let parsed = decode_snapshot_png(&png_bytes).unwrap(); + assert_eq!(parsed.definition.name, snapshot.definition.name); + assert_eq!(parsed.profile.display_name, snapshot.profile.display_name); + assert_eq!(parsed.memory.level, MemoryLevel::None); +} + +#[test] +fn png_round_trip_with_avatar_png() { + // Build a minimal PNG avatar. + let avatar = make_png_with_text("dummy", "value").unwrap(); + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&avatar)); + // Avatar should be inlined as a data URL. + assert!(snapshot + .profile + .avatar_data_url + .as_deref() + .unwrap_or("") + .starts_with("data:image/png;base64,")); + + let png_bytes = encode_snapshot_png(&snapshot, Some(&avatar)).unwrap(); + let parsed = decode_snapshot_png(&png_bytes).unwrap(); + assert_eq!(parsed.definition.name, snapshot.definition.name); +} + +/// Plain-card byte compatibility: `encode_snapshot_png` was refactored +/// through the shared `encode_chunk_payload_png` when locked cards were +/// added. Plain cards must emit byte-identical PNGs to the pre-envelope +/// encoder. This vector reimplements the legacy encoder body verbatim and +/// asserts equality on all three composition paths: placeholder (no avatar), +/// PNG-avatar (where tEXt chunk injection ordering matters), and +/// JPEG-avatar transcode. +#[test] +fn plain_encoder_bytes_identical_to_pre_envelope_encoder() { + // Verbatim pre-refactor `encode_snapshot_png` body (post memory guard). + fn legacy_encode( + snapshot: &AgentSnapshot, + avatar_bytes: Option<&[u8]>, + ) -> Result, String> { + let json_bytes = encode_snapshot_json(snapshot)?; + let chunk_text = STANDARD.encode(&json_bytes); + let png_bytes = match avatar_bytes.filter(|bytes| !bytes.is_empty()) { + Some(bytes) => { + let encoded_avatar = if bytes.starts_with(b"\x89PNG") { + inject_text_chunk(bytes, PNG_CHUNK_KEYWORD, &chunk_text).or_else(|_| { + transcode_avatar_to_png_with_text(bytes, PNG_CHUNK_KEYWORD, &chunk_text) + }) + } else { + transcode_avatar_to_png_with_text(bytes, PNG_CHUNK_KEYWORD, &chunk_text) + }; + match encoded_avatar { + Ok(png_bytes) => png_bytes, + Err(_) => make_png_with_text(PNG_CHUNK_KEYWORD, &chunk_text)?, + } + } + None => make_png_with_text(PNG_CHUNK_KEYWORD, &chunk_text)?, + }; + Ok(png_bytes) + } + + let record = minimal_record(); + + // Placeholder path (no avatar). + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + assert_eq!( + encode_snapshot_png(&snapshot, None).unwrap(), + legacy_encode(&snapshot, None).unwrap(), + "placeholder-path plain PNG bytes must match the pre-envelope encoder" + ); + + // PNG-avatar path: chunk injected into the avatar image body. + let avatar = make_png_with_text("dummy", "value").unwrap(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&avatar)); + assert_eq!( + encode_snapshot_png(&snapshot, Some(&avatar)).unwrap(), + legacy_encode(&snapshot, Some(&avatar)).unwrap(), + "avatar-path plain PNG bytes must match the pre-envelope encoder" + ); + + // JPEG-avatar path: transcode-to-PNG composition. + let jpeg_avatar = image::DynamicImage::ImageRgb8(image::RgbImage::from_pixel( + 4, + 4, + image::Rgb([0x10, 0x20, 0x30]), + )); + let mut jpeg_bytes = Vec::new(); + jpeg_avatar + .write_to(&mut Cursor::new(&mut jpeg_bytes), image::ImageFormat::Jpeg) + .unwrap(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&jpeg_bytes)); + assert_eq!( + encode_snapshot_png(&snapshot, Some(&jpeg_bytes)).unwrap(), + legacy_encode(&snapshot, Some(&jpeg_bytes)).unwrap(), + "transcode-path plain PNG bytes must match the pre-envelope encoder" + ); +} + +#[test] +fn png_snapshot_transcodes_jpeg_avatar_into_image_body() { + let avatar = image::DynamicImage::ImageRgb8(image::RgbImage::from_pixel( + 3, + 2, + image::Rgb([0x12, 0x34, 0x56]), + )); + let mut jpeg_bytes = Vec::new(); + avatar + .write_to(&mut Cursor::new(&mut jpeg_bytes), image::ImageFormat::Jpeg) + .unwrap(); + + let snapshot = build_snapshot( + &minimal_record(), + MemoryLevel::None, + vec![], + Some(&jpeg_bytes), + ); + let png_bytes = encode_snapshot_png(&snapshot, Some(&jpeg_bytes)).unwrap(); + let decoder = Decoder::new(Cursor::new(png_bytes)); + let reader = decoder.read_info().unwrap(); + + assert_eq!((reader.info().width, reader.info().height), (3, 2)); +} + +#[test] +fn png_snapshot_downscales_oversize_avatar_under_cap() { + // A large avatar (mirrors Gurney's 2764×4096 image that encoded to ~26 MB) + // must be downscaled for the PNG body so the snapshot stays under the + // 10 MiB cap — while the manifest keeps the untouched source reference. + // An already-PNG oversize avatar exercises the `png_within_body_cap` guard + // that routes it through the downscaling transcode path. + let avatar = image::DynamicImage::ImageRgb8(image::RgbImage::from_fn(2764, 4096, |x, y| { + image::Rgb([(x % 256) as u8, (y % 256) as u8, ((x + y) % 256) as u8]) + })); + let mut source_bytes = Vec::new(); + avatar + .write_to(&mut Cursor::new(&mut source_bytes), image::ImageFormat::Png) + .unwrap(); + + let snapshot = build_snapshot( + &minimal_record(), + MemoryLevel::None, + vec![], + Some(&source_bytes), + ); + let png_bytes = encode_snapshot_png(&snapshot, Some(&source_bytes)).unwrap(); + + assert!( + png_bytes.len() + <= super::MAX_PNG_BODY_EDGE as usize * super::MAX_PNG_BODY_EDGE as usize * 4, + "downscaled snapshot ({} bytes) must be far under the 10 MiB cap", + png_bytes.len() + ); + + let reader = Decoder::new(Cursor::new(png_bytes)).read_info().unwrap(); + let (width, height) = (reader.info().width, reader.info().height); + assert!( + width <= 512 && height <= 512, + "body dimensions {width}×{height} must fit the 512px cap" + ); + // Aspect ratio preserved: the longest edge (height) is clamped to the cap. + assert_eq!(height, 512, "longest edge should hit the 512px cap"); + + // The manifest keeps the untouched full-resolution source reference — only + // the PNG body is downscaled. The oversize source bytes exceed the inline + // cap, so the manifest falls back to the record's `avatar_url`. + let manifest = + decode_snapshot_png(&encode_snapshot_png(&snapshot, Some(&source_bytes)).unwrap()).unwrap(); + assert_eq!( + manifest.profile.avatar_url.as_deref(), + Some("https://example.com/avatar.png"), + "manifest must preserve the untouched source avatar reference" + ); + assert!( + manifest.profile.avatar_data_url.is_none(), + "oversize source bytes must not be inlined into the manifest" + ); +} + +#[test] +fn png_round_trip_with_core_memory() { + let record = minimal_record(); + let entries = vec![AgentSnapshotMemoryEntry { + slug: "core".to_string(), + body: "remember this".to_string(), + }]; + let snapshot = build_snapshot(&record, MemoryLevel::Core, entries, None); + + let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); + let parsed = decode_snapshot_png(&png_bytes).unwrap(); + + assert_eq!(parsed.memory, snapshot.memory); +} + +#[test] +fn png_round_trip_with_everything_memory() { + let record = minimal_record(); + let entries = vec![ + AgentSnapshotMemoryEntry { + slug: "core".to_string(), + body: "remember this".to_string(), + }, + AgentSnapshotMemoryEntry { + slug: "mem/notes".to_string(), + body: "private notes".to_string(), + }, + ]; + let snapshot = build_snapshot(&record, MemoryLevel::Everything, entries, None); + + let png_bytes = encode_snapshot_png(&snapshot, None).unwrap(); + let parsed = decode_snapshot_png(&png_bytes).unwrap(); + + assert_eq!(parsed.memory, snapshot.memory); +} + +#[test] +fn png_export_with_no_memory_succeeds() { + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + assert!(encode_snapshot_png(&snapshot, None).is_ok()); +} + +#[test] +fn png_export_rejects_none_level_with_nonempty_entries() { + // Inconsistent state: level == None but entries is non-empty. + // The encoder must reject this to prevent a memory-leak bypass. + let record = minimal_record(); + let entries = vec![AgentSnapshotMemoryEntry { + slug: "core".to_string(), + body: "leaked memory".to_string(), + }]; + // Build with entries, then override level to None in the struct. + let mut snapshot = build_snapshot(&record, MemoryLevel::Core, entries, None); + snapshot.memory.level = MemoryLevel::None; // force inconsistency + let result = encode_snapshot_png(&snapshot, None); + assert!( + result.is_err(), + "PNG encoder must reject level=None with non-empty entries" + ); + assert!( + result + .unwrap_err() + .contains("memory.level 'none' and non-empty memory entries"), + "Error must explain the malformed memory state" + ); +} + +// ── Secret exclusion tests ──────────────────────────────────────────────── +// +// These tests assert that every field in the exclusion list is absent from +// the serialized snapshot. We serialize to JSON and assert the key is NOT +// present. + +fn snapshot_json_string(record: &ManagedAgentRecord) -> String { + let snapshot = build_snapshot(record, MemoryLevel::None, vec![], None); + let bytes = encode_snapshot_json(&snapshot).unwrap(); + String::from_utf8(bytes).unwrap() +} + +#[test] +fn secret_exclusion_private_key_nsec_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("nsec1secret"), + "nsec must not appear in snapshot" + ); + assert!( + !json.contains("privateKeyNsec") && !json.contains("private_key_nsec"), + "privateKeyNsec field must not appear in snapshot" + ); +} + +#[test] +fn secret_exclusion_auth_tag_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("auth-tag-secret"), + "auth_tag value must not appear in snapshot" + ); + assert!( + !json.contains("authTag") && !json.contains("auth_tag"), + "authTag field must not appear in snapshot" + ); +} + +#[test] +fn secret_exclusion_env_vars_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("API_KEY") && !json.contains("secret123"), + "env_vars content must not appear in snapshot" + ); + assert!( + !json.contains("envVars") && !json.contains("env_vars"), + "envVars field must not appear in snapshot" + ); +} + +#[test] +fn secret_exclusion_relay_url_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("wss://relay.example.com"), + "relay_url value must not appear in snapshot" + ); + assert!( + !json.contains("relayUrl") && !json.contains("relay_url"), + "relayUrl field must not appear in snapshot" + ); +} + +#[test] +fn snapshot_omits_removed_mcp_toolsets_config() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("mcpToolsets") && !json.contains("mcp_toolsets"), + "removed MCP toolsets config must not re-enter snapshots" + ); +} + +#[test] +fn secret_exclusion_machine_commands_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + // acp_command / agent_command / agent_command_override / agent_args / mcp_command + assert!( + !json.contains("/usr/local/bin/acp"), + "acp_command path must not appear" + ); + assert!( + !json.contains("acpCommand") && !json.contains("acp_command"), + "acpCommand field must not appear" + ); + assert!( + !json.contains("agentCommand") && !json.contains("agent_command"), + "agentCommand field must not appear" + ); + assert!( + !json.contains("mcpCommand") && !json.contains("mcp_command"), + "mcpCommand field must not appear" + ); +} + +#[test] +fn secret_exclusion_runtime_state_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("runtimePid") && !json.contains("runtime_pid"), + "runtimePid must not appear" + ); + assert!( + !json.contains("backendAgentId") && !json.contains("backend_agent_id"), + "backendAgentId must not appear" + ); + assert!( + !json.contains("SENTINEL_BACKEND_AGENT_ID"), + "backendAgentId value must not appear" + ); + assert!( + !json.contains("providerBinaryPath") && !json.contains("provider_binary_path"), + "providerBinaryPath must not appear" + ); + assert!( + !json.contains("SENTINEL_PROVIDER_BINARY"), + "providerBinaryPath value must not appear" + ); + assert!( + !json.contains("lastStartedAt") && !json.contains("last_started_at"), + "lastStartedAt must not appear" + ); + assert!( + !json.contains("lastExitCode") && !json.contains("last_exit_code"), + "lastExitCode must not appear" + ); + // backend blob — neither the type tag nor provider secret must leak. + assert!( + !json.contains("\"backend\"") && !json.contains("backend"), + "backend field must not appear" + ); + assert!( + !json.contains("SENTINEL_BACKEND_ID") && !json.contains("SENTINEL_BACKEND_SECRET"), + "backend config values must not appear" + ); + // last_error / last_error_code + assert!( + !json.contains("lastError") && !json.contains("last_error"), + "lastError must not appear" + ); + assert!( + !json.contains("SENTINEL_LAST_ERROR"), + "lastError value must not appear" + ); + assert!( + !json.contains("lastErrorCode") && !json.contains("last_error_code"), + "lastErrorCode must not appear" + ); +} + +#[test] +fn secret_exclusion_lineage_ids_absent() { + let record = minimal_record(); + let json = snapshot_json_string(&record); + assert!( + !json.contains("team-id-123"), + "source_team value must not appear" + ); + assert!( + !json.contains("sourceTeam") && !json.contains("source_team"), + "sourceTeam field must not appear" + ); + assert!( + !json.contains("sourceTeamPersonaSlug"), + "sourceTeamPersonaSlug must not appear" + ); + assert!( + !json.contains("personaSourceVersion") && !json.contains("persona_source_version"), + "personaSourceVersion must not appear" + ); + // personaId + assert!( + !json.contains("personaId") && !json.contains("persona_id"), + "personaId field must not appear" + ); + assert!( + !json.contains("SENTINEL_PERSONA_ID"), + "personaId value must not appear" + ); + // teamId + assert!( + !json.contains("teamId") && !json.contains("team_id"), + "teamId field must not appear" + ); + assert!( + !json.contains("SENTINEL_TEAM_ID"), + "teamId value must not appear" + ); + // personaTeamDir + assert!( + !json.contains("personaTeamDir") && !json.contains("persona_team_dir"), + "personaTeamDir field must not appear" + ); + assert!( + !json.contains("SENTINEL_TEAM_DIR"), + "personaTeamDir value must not appear" + ); + // personaNameInTeam + assert!( + !json.contains("personaNameInTeam") && !json.contains("persona_name_in_team"), + "personaNameInTeam field must not appear" + ); + assert!( + !json.contains("SENTINEL_NAME_IN_TEAM"), + "personaNameInTeam value must not appear" + ); +} + +// ── Definition field presence tests ────────────────────────────────────── + +#[test] +fn definition_fields_present_in_snapshot() { + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + + assert_eq!(snapshot.definition.name, "Test Agent Display"); + assert!(!snapshot.definition.source_is_builtin); + assert_eq!( + snapshot.definition.system_prompt.as_deref(), + Some("You are a test agent.") + ); + assert_eq!(snapshot.definition.runtime.as_deref(), Some("goose")); + assert_eq!(snapshot.definition.model.as_deref(), Some("claude-opus-4")); + assert_eq!(snapshot.definition.provider.as_deref(), Some("anthropic")); + assert_eq!(snapshot.definition.name_pool, vec!["Alice", "Bob"]); + // definition_respond_to maps to respond_to in the snapshot definition + assert_eq!(snapshot.definition.respond_to.as_deref(), Some("allowlist")); + // definition_respond_to_allowlist should be included + assert!(!snapshot.definition.respond_to_allowlist.is_empty()); +} + +#[test] +fn profile_fields_present_in_snapshot() { + let record = minimal_record(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], None); + assert_eq!(snapshot.profile.display_name, "Test Agent Display"); + // No bytes → should fall back to avatar_url + assert_eq!( + snapshot.profile.avatar_url.as_deref(), + Some("https://example.com/avatar.png") + ); + assert!(snapshot.profile.avatar_data_url.is_none()); +} + +#[test] +fn avatar_inlined_when_under_size_limit() { + let record = minimal_record(); + let small_png = make_png_with_text("k", "v").unwrap(); + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&small_png)); + assert!(snapshot.profile.avatar_data_url.is_some()); + assert!(snapshot.profile.avatar_url.is_none()); +} + +#[test] +fn avatar_url_fallback_when_over_size_limit() { + let mut record = minimal_record(); + record.avatar_url = Some("https://example.com/big.png".to_string()); + // Synthesize oversized avatar bytes (> 2 MB) — just a large zeroed vec. + let big_bytes = vec![0u8; MAX_AVATAR_INLINE_BYTES + 1]; + let snapshot = build_snapshot(&record, MemoryLevel::None, vec![], Some(&big_bytes)); + assert!(snapshot.profile.avatar_data_url.is_none()); + assert_eq!( + snapshot.profile.avatar_url.as_deref(), + Some("https://example.com/big.png") + ); +} + +// ── Format/version validation ───────────────────────────────────────────── + +#[test] +fn invalid_format_discriminator_is_rejected() { + let mut snapshot = build_snapshot(&minimal_record(), MemoryLevel::None, vec![], None); + snapshot.format = "not-a-buzz-snapshot".to_string(); + let bytes = serde_json::to_vec(&snapshot).unwrap(); + let result = decode_snapshot_json(&bytes); + assert!(result.is_err()); + assert!(result.unwrap_err().contains("Unsupported snapshot format")); +} + +#[test] +fn unsupported_version_is_rejected() { + let mut snapshot = build_snapshot(&minimal_record(), MemoryLevel::None, vec![], None); + snapshot.version = 99; + let bytes = serde_json::to_vec(&snapshot).unwrap(); + let result = decode_snapshot_json(&bytes); + assert!(result.is_err()); + assert!(result.unwrap_err().contains("Unsupported snapshot version")); +} diff --git a/desktop/src-tauri/src/managed_agents/backend.rs b/desktop/src-tauri/src/managed_agents/backend.rs index 5debae41cbf..84dd7e99da4 100644 --- a/desktop/src-tauri/src/managed_agents/backend.rs +++ b/desktop/src-tauri/src/managed_agents/backend.rs @@ -1,3 +1,4 @@ +use sha2::{Digest, Sha256}; use std::io::{BufReader, Read, Write}; use std::path::{Path, PathBuf}; use std::sync::mpsc; @@ -7,6 +8,61 @@ const STDERR_CAP: usize = 65536; /// Provider responses should be small JSON objects. Cap stdout to prevent a /// buggy or malicious provider from OOM-ing the desktop process. const STDOUT_CAP: usize = 1_048_576; // 1 MB +const PROVIDER_PROTOCOL_VERSION: u64 = 1; + +fn validate_provider_info(info: &serde_json::Value) -> Result<(), String> { + let object = info + .as_object() + .ok_or_else(|| "provider info response must be a JSON object".to_string())?; + let actual_version = object + .get("protocol_version") + .and_then(serde_json::Value::as_u64); + if actual_version != Some(PROVIDER_PROTOCOL_VERSION) { + return Err(match actual_version { + Some(version) => format!( + "unsupported provider protocol version {version}; desktop requires {PROVIDER_PROTOCOL_VERSION}" + ), + None => "provider info response missing integer protocol_version".to_string(), + }); + } + if object.get("ok") != Some(&serde_json::Value::Bool(true)) { + return Err("provider info response must contain ok: true".to_string()); + } + for field in ["name", "version", "description"] { + if object + .get(field) + .is_none_or(|value| value.as_str().is_none_or(str::is_empty)) + { + return Err(format!( + "provider info response missing non-empty string {field}" + )); + } + } + if !object + .get("config_schema") + .is_some_and(serde_json::Value::is_object) + { + return Err("provider info response missing object config_schema".to_string()); + } + + const FIELDS: &[&str] = &[ + "ok", + "name", + "version", + "protocol_version", + "description", + "config_schema", + ]; + if let Some(field) = object + .keys() + .find(|field| !FIELDS.contains(&field.as_str())) + { + return Err(format!( + "provider info response contains unknown field {field}" + )); + } + Ok(()) +} /// Invoke a provider binary: write JSON to stdin, read JSON from stdout. /// @@ -333,23 +389,29 @@ pub(crate) fn redact_secrets_with(s: &str, extras: &[&str]) -> String { result } -/// Collect string values from `request["agent"]["env_vars"]` (if present) -/// to feed into [`redact_secrets_with`]. Returns an empty Vec if the -/// request shape doesn't match, which is fine — falls back to the default -/// prefix-based scrubbing. +/// Collect string values from every environment map a deploy request can +/// carry. Providers may echo any of these values in diagnostics, including +/// definition/baked values that exist only in the resolved launch block. fn env_secrets_from_request(request: &serde_json::Value) -> Vec { - request - .get("agent") - .and_then(|a| a.get("env_vars")) - .and_then(|e| e.as_object()) - .map(|obj| { - obj.values() - .filter_map(|v| v.as_str()) - .filter(|s| !s.is_empty()) - .map(String::from) - .collect() - }) - .unwrap_or_default() + let agent = request.get("agent"); + let maps = [ + agent.and_then(|value| value.get("env_vars")), + agent + .and_then(|value| value.get("launch")) + .and_then(|value| value.get("env")), + agent + .and_then(|value| value.get("launch")) + .and_then(|value| value.get("policy_env")), + ]; + + maps.into_iter() + .flatten() + .filter_map(serde_json::Value::as_object) + .flat_map(|map| map.values()) + .filter_map(serde_json::Value::as_str) + .filter(|value| !value.is_empty()) + .map(String::from) + .collect() } /// Public-in-crate helper: redact every non-empty value from `env` (plus @@ -368,22 +430,102 @@ pub(crate) fn redact_env_values_in( redact_secrets_with(s, &values) } -/// Deploy an agent via provider binary. Returns the provider-assigned agent_id. -/// -/// `request_id` is included for provider-side logging/correlation but is not -/// validated in the response — the stdin→stdout exchange is 1:1 per process. +/// Copy a resolved provider into a private staging directory while hashing +/// exactly the bytes copied. The staged file becomes non-writable before either +/// invocation, closing the path replacement and in-place rewrite races. +fn stage_provider( + binary: &Path, +) -> Result<(tempfile::TempDir, PathBuf, String, std::fs::File), String> { + let directory = tempfile::Builder::new() + .prefix("buzz-provider-") + .tempdir() + .map_err(|error| format!("failed to create provider staging directory: {error}"))?; + let suffix = if cfg!(windows) { ".exe" } else { "" }; + let staged_path = directory.path().join(format!("provider{suffix}")); + let mut source = std::fs::File::open(binary) + .map_err(|error| format!("failed to open provider for staging: {error}"))?; + let mut staged = std::fs::OpenOptions::new() + .write(true) + .create_new(true) + .open(&staged_path) + .map_err(|error| format!("failed to create staged provider: {error}"))?; + let mut hasher = Sha256::new(); + let mut buffer = [0_u8; 64 * 1024]; + loop { + let count = source + .read(&mut buffer) + .map_err(|error| format!("failed to read provider for staging: {error}"))?; + if count == 0 { + break; + } + staged + .write_all(&buffer[..count]) + .map_err(|error| format!("failed to write staged provider: {error}"))?; + hasher.update(&buffer[..count]); + } + staged + .sync_all() + .map_err(|error| format!("failed to sync staged provider: {error}"))?; + + let mut permissions = staged + .metadata() + .map_err(|error| format!("failed to inspect staged provider: {error}"))? + .permissions(); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + permissions.set_mode(0o500); + } + #[cfg(not(unix))] + permissions.set_readonly(true); + std::fs::set_permissions(&staged_path, permissions) + .map_err(|error| format!("failed to protect staged provider: {error}"))?; + drop(staged); + + #[cfg(windows)] + let execution_guard = { + use std::os::windows::fs::OpenOptionsExt; + std::fs::OpenOptions::new() + .read(true) + // Permit CreateProcess to read the image while denying replacement, + // writes, and deletion until both invocations finish. + .share_mode(windows_sys::Win32::Storage::FileSystem::FILE_SHARE_READ) + .open(&staged_path) + }; + #[cfg(not(windows))] + let execution_guard = std::fs::File::open(&staged_path); + let execution_guard = execution_guard + .map_err(|error| format!("failed to lock staged provider for execution: {error}"))?; + Ok(( + directory, + staged_path, + hex::encode(hasher.finalize()), + execution_guard, + )) +} + +/// Deploy through one immutable staged copy: negotiate protocol v1 before the +/// secret-bearing request, then invoke deploy on those exact same bytes. pub fn provider_deploy( binary: &Path, agent: &serde_json::Value, provider_config: &serde_json::Value, ) -> Result { + let (_directory, staged, _digest, _execution_guard) = stage_provider(binary)?; + let info_request = serde_json::json!({ + "op": "info", + "request_id": uuid::Uuid::new_v4().to_string(), + }); + let info = invoke_provider(&staged, &info_request, Duration::from_secs(10))?; + validate_provider_info(&info)?; + let request = serde_json::json!({ "op": "deploy", "request_id": uuid::Uuid::new_v4().to_string(), "agent": agent, "provider_config": provider_config, }); - let resp = invoke_provider(binary, &request, Duration::from_secs(600))?; + let resp = invoke_provider(&staged, &request, Duration::from_secs(600))?; resp["agent_id"] .as_str() .map(String::from) @@ -423,6 +565,24 @@ pub fn validate_provider_config(config: &serde_json::Value) -> Result<(), String Ok(()) } +/// Derive a provider id from the filename Tauri stages at runtime. Tauri +/// removes its target-triple suffix while copying an external binary, but on +/// Windows leaves the executable/script extension, which is not part of the +/// provider id. +fn provider_id_from_filename(name: &str) -> Option<&str> { + let raw = name.strip_prefix("buzz-backend-")?; + let id = [".exe", ".bat", ".cmd"] + .into_iter() + .find_map(|extension| { + raw.get(raw.len().saturating_sub(extension.len())..) + .filter(|suffix| suffix.eq_ignore_ascii_case(extension)) + .map(|_| &raw[..raw.len() - extension.len()]) + }) + .unwrap_or(raw); + + (!id.is_empty()).then_some(id) +} + /// Enumerate PATH for buzz-backend-* executables. Returns (id, path) pairs. /// Only includes files that are executable. Does NOT execute any binaries. /// @@ -464,10 +624,12 @@ pub fn discover_provider_candidates() -> Vec<(String, PathBuf)> { }; for entry in entries.flatten() { let name = entry.file_name().to_string_lossy().to_string(); - if let Some(id) = name.strip_prefix(prefix) { - if !id.is_empty() && !seen.contains(&name) && is_executable(&entry.path()) { - seen.insert(name.clone()); - results.push((id.to_string(), entry.path())); + if name.starts_with(prefix) { + if let Some(id) = provider_id_from_filename(&name) { + if !seen.contains(&name) && is_executable(&entry.path()) { + seen.insert(name.clone()); + results.push((id.to_string(), entry.path())); + } } } } @@ -538,203 +700,5 @@ pub struct BackendProviderInfo { } #[cfg(test)] -mod tests { - use super::*; - - #[test] - fn redact_secrets_replaces_nsec() { - let s = "key=nsec1abc123def456 other"; - let r = redact_secrets(s); - assert!(r.contains("[REDACTED]")); - assert!(!r.contains("nsec1abc123def456")); - } - - #[test] - fn redact_secrets_replaces_token() { - let s = r#"{"token":"sprt_tok_xyz789"}"#; - let r = redact_secrets(s); - assert!(r.contains("[REDACTED]")); - assert!(!r.contains("sprt_tok_xyz789")); - } - - #[test] - fn redact_secrets_with_extras_scrubs_user_env_values() { - // If a provider echoes back a user-supplied API key in its error - // output, the desktop must not surface that secret unredacted via - // `last_error`. We scrub the literal values that came from the - // request's `agent.env_vars`. - let secret = "sk-ant-api03-abc123def456"; - let stderr = format!("auth failed with key {secret} on host api.anthropic.com"); - let r = redact_secrets_with(&stderr, &[secret]); - assert!(r.contains("[REDACTED]")); - assert!(!r.contains(secret)); - } - - #[test] - fn redact_secrets_with_extras_skips_short_values() { - // Don't scrub values shorter than 4 chars — too noisy. - let r = redact_secrets_with("error code: 42", &["42"]); - assert!(r.contains("42")); - } - - /// GitHub tokens are recognised by shape, so one that never passed through - /// our environment — embedded in a remote URL an installer echoes — is - /// still scrubbed. The scan runs to the next whitespace or quote, so the - /// rest of the URL goes with it; over-redaction is the safe direction. - #[test] - fn redact_secrets_with_scrubs_github_token_prefixes() { - for token in [ - "ghp_abcdefghij0123456789", - "gho_abcdefghij0123456789", - "ghu_abcdefghij0123456789", - "ghs_abcdefghij0123456789", - "ghr_abcdefghij0123456789", - "github_pat_abcdefghij0123456789", - ] { - let r = - redact_secrets_with(&format!("cloning https://{token}@github.com/o/r now"), &[]); - assert!(!r.contains(token), "leaked {token}: {r}"); - assert!(r.contains("[REDACTED]"), "got: {r}"); - assert!(r.contains("cloning"), "scan must stop at whitespace: {r}"); - assert!(r.ends_with(" now"), "scan must stop at whitespace: {r}"); - } - } - - #[test] - fn redact_secrets_with_extras_terminates_when_value_substring_of_marker() { - // Regression: an earlier impl used `while let Some(pos) = find(value)` - // which never terminates if the user's env value is a substring of - // the replacement marker `[REDACTED]` — each replacement - // reintroduces the same text. Now uses `str::replace` (single-pass). - for value in ["REDACTED", "EDACTE", "REDA", "ACTED"] { - let r = redact_secrets_with(&format!("leak={value}"), &[value]); - assert!(r.contains("[REDACTED]")); - } - } - - #[test] - fn redact_secrets_with_extras_handles_overlapping_secrets() { - // Longer entries get scrubbed first so the substring "abc12" isn't - // matched before "abc123" is consumed. - let s = "key1=abc123 key2=abc12"; - let r = redact_secrets_with(s, &["abc12", "abc123"]); - assert!(!r.contains("abc123")); - assert!(!r.contains("abc12 ")); - } - - #[test] - fn env_secrets_from_request_extracts_string_values() { - let req = serde_json::json!({ - "op": "deploy", - "agent": { - "env_vars": { - "ANTHROPIC_API_KEY": "sk-ant-test", - "EMPTY": "", - "NUMERIC": 42, - }, - }, - }); - let secrets = env_secrets_from_request(&req); - assert!(secrets.iter().any(|v| v == "sk-ant-test")); - // Empty and non-string values are filtered out. - assert_eq!(secrets.len(), 1); - } - - #[test] - fn env_secrets_from_request_handles_missing_shape() { - assert!(env_secrets_from_request(&serde_json::json!({})).is_empty()); - assert!(env_secrets_from_request(&serde_json::json!({"agent": {}})).is_empty()); - assert!( - env_secrets_from_request(&serde_json::json!({"agent": {"env_vars": null}})).is_empty() - ); - } - - #[test] - fn redact_env_values_in_scrubs_map_values() { - let mut env = std::collections::BTreeMap::new(); - env.insert("ANTHROPIC_API_KEY".to_string(), "sk-ant-real".to_string()); - env.insert("EMPTY".to_string(), String::new()); - let stderr = "auth=sk-ant-real failed; other context"; - let r = redact_env_values_in(stderr, &env); - assert!(!r.contains("sk-ant-real")); - assert!(r.contains("[REDACTED]")); - } - - #[test] - fn validate_provider_config_rejects_secret_key() { - let cfg = serde_json::json!({"api_key": "val"}); - assert!(validate_provider_config(&cfg).is_err()); - } - - #[test] - fn validate_provider_config_rejects_nested() { - let cfg = serde_json::json!({"region": {"us": "east"}}); - assert!(validate_provider_config(&cfg).is_err()); - } - - #[test] - fn validate_provider_config_accepts_scalars() { - let cfg = serde_json::json!({"region": "us-east-1", "tier": "standard"}); - assert!(validate_provider_config(&cfg).is_ok()); - } - - #[test] - fn validate_provider_config_allows_key_as_substring() { - // "keyboard", "monkey" contain "key" as substring but not as a word segment. - let cfg = serde_json::json!({"keyboard_layout": "us", "monkey_wrench": "tight"}); - assert!(validate_provider_config(&cfg).is_ok()); - } - - #[test] - fn validate_provider_config_rejects_camel_case_secrets() { - assert!(validate_provider_config(&serde_json::json!({"apiKey": "val"})).is_err()); - assert!(validate_provider_config(&serde_json::json!({"accessToken": "val"})).is_err()); - assert!(validate_provider_config(&serde_json::json!({"clientSecret": "val"})).is_err()); - // ALL-CAPS variants - assert!(validate_provider_config(&serde_json::json!({"apiKEY": "val"})).is_err()); - assert!(validate_provider_config(&serde_json::json!({"accessTOKEN": "val"})).is_err()); - } - - #[test] - fn split_config_key_handles_all_styles() { - assert_eq!(split_config_key("apiKey"), vec!["api", "key"]); - assert_eq!(split_config_key("access_token"), vec!["access", "token"]); - assert_eq!(split_config_key("keyboard"), vec!["keyboard"]); - assert_eq!(split_config_key("client-secret"), vec!["client", "secret"]); - // Acronym runs stay together - assert_eq!(split_config_key("APIKey"), vec!["api", "key"]); - assert_eq!(split_config_key("apiKEY"), vec!["api", "key"]); - assert_eq!(split_config_key("accessTOKEN"), vec!["access", "token"]); - assert_eq!(split_config_key("MyAPIKey"), vec!["my", "api", "key"]); - } - - #[test] - fn resolve_provider_binary_rejects_invalid_ids() { - // Path traversal - assert!(resolve_provider_binary("../evil").is_err()); - // Empty - assert!(resolve_provider_binary("").is_err()); - // Uppercase - assert!(resolve_provider_binary("MyProvider").is_err()); - // Spaces - assert!(resolve_provider_binary("my provider").is_err()); - // Shell metacharacters - assert!(resolve_provider_binary("foo;rm -rf /").is_err()); - // Valid format but not on PATH — should fail with "not found" - assert!(resolve_provider_binary("nonexistent-test-id-12345").is_err()); - } - - #[test] - fn resolve_provider_binary_accepts_valid_id_format() { - // Valid ID format should pass validation. If the binary happens to - // exist on PATH, Ok is returned; otherwise Err contains "not found" - // (not "invalid provider ID"). Either outcome proves validation passed. - match resolve_provider_binary("zzz-nonexistent-test-provider") { - Ok(_) => {} // unlikely but fine — binary exists - Err(e) => assert!( - e.contains("not found"), - "expected 'not found' error, got: {e}" - ), - } - } -} +#[path = "backend_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/managed_agents/backend_tests.rs b/desktop/src-tauri/src/managed_agents/backend_tests.rs new file mode 100644 index 00000000000..ce1f81466fc --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/backend_tests.rs @@ -0,0 +1,452 @@ +use super::*; + +#[test] +fn redact_secrets_replaces_nsec() { + let s = "key=nsec1abc123def456 other"; + let r = redact_secrets(s); + assert!(r.contains("[REDACTED]")); + assert!(!r.contains("nsec1abc123def456")); +} + +#[test] +fn redact_secrets_replaces_token() { + let s = r#"{"token":"sprt_tok_xyz789"}"#; + let r = redact_secrets(s); + assert!(r.contains("[REDACTED]")); + assert!(!r.contains("sprt_tok_xyz789")); +} + +#[test] +fn redact_secrets_with_extras_scrubs_user_env_values() { + // If a provider echoes back a user-supplied API key in its error + // output, the desktop must not surface that secret unredacted via + // `last_error`. We scrub the literal values that came from the + // request's `agent.env_vars`. + let secret = "sk-ant-api03-abc123def456"; + let stderr = format!("auth failed with key {secret} on host api.anthropic.com"); + let r = redact_secrets_with(&stderr, &[secret]); + assert!(r.contains("[REDACTED]")); + assert!(!r.contains(secret)); +} + +#[test] +fn redact_secrets_with_extras_skips_short_values() { + // Don't scrub values shorter than 4 chars — too noisy. + let r = redact_secrets_with("error code: 42", &["42"]); + assert!(r.contains("42")); +} + +/// GitHub tokens are recognised by shape, so one that never passed through +/// our environment — embedded in a remote URL an installer echoes — is +/// still scrubbed. The scan runs to the next whitespace or quote, so the +/// rest of the URL goes with it; over-redaction is the safe direction. +#[test] +fn redact_secrets_with_scrubs_github_token_prefixes() { + for token in [ + "ghp_abcdefghij0123456789", + "gho_abcdefghij0123456789", + "ghu_abcdefghij0123456789", + "ghs_abcdefghij0123456789", + "ghr_abcdefghij0123456789", + "github_pat_abcdefghij0123456789", + ] { + let r = redact_secrets_with(&format!("cloning https://{token}@github.com/o/r now"), &[]); + assert!(!r.contains(token), "leaked {token}: {r}"); + assert!(r.contains("[REDACTED]"), "got: {r}"); + assert!(r.contains("cloning"), "scan must stop at whitespace: {r}"); + assert!(r.ends_with(" now"), "scan must stop at whitespace: {r}"); + } +} + +#[test] +fn redact_secrets_with_extras_terminates_when_value_substring_of_marker() { + // Regression: an earlier impl used `while let Some(pos) = find(value)` + // which never terminates if the user's env value is a substring of + // the replacement marker `[REDACTED]` — each replacement + // reintroduces the same text. Now uses `str::replace` (single-pass). + for value in ["REDACTED", "EDACTE", "REDA", "ACTED"] { + let r = redact_secrets_with(&format!("leak={value}"), &[value]); + assert!(r.contains("[REDACTED]")); + } +} + +#[test] +fn redact_secrets_with_extras_handles_overlapping_secrets() { + // Longer entries get scrubbed first so the substring "abc12" isn't + // matched before "abc123" is consumed. + let s = "key1=abc123 key2=abc12"; + let r = redact_secrets_with(s, &["abc12", "abc123"]); + assert!(!r.contains("abc123")); + assert!(!r.contains("abc12 ")); +} + +#[test] +fn env_secrets_from_request_extracts_string_values() { + let req = serde_json::json!({ + "op": "deploy", + "agent": { + "env_vars": { + "ANTHROPIC_API_KEY": "sk-ant-test", + "EMPTY": "", + "NUMERIC": 42, + }, + }, + }); + let secrets = env_secrets_from_request(&req); + assert!(secrets.iter().any(|v| v == "sk-ant-test")); + // Empty and non-string values are filtered out. + assert_eq!(secrets.len(), 1); +} + +#[test] +fn env_secrets_from_request_handles_missing_shape() { + assert!(env_secrets_from_request(&serde_json::json!({})).is_empty()); + assert!(env_secrets_from_request(&serde_json::json!({"agent": {}})).is_empty()); + assert!(env_secrets_from_request(&serde_json::json!({"agent": {"env_vars": null}})).is_empty()); +} + +#[test] +fn redact_env_values_in_scrubs_map_values() { + let mut env = std::collections::BTreeMap::new(); + env.insert("ANTHROPIC_API_KEY".to_string(), "sk-ant-real".to_string()); + env.insert("EMPTY".to_string(), String::new()); + let stderr = "auth=sk-ant-real failed; other context"; + let r = redact_env_values_in(stderr, &env); + assert!(!r.contains("sk-ant-real")); + assert!(r.contains("[REDACTED]")); +} + +#[test] +fn env_secrets_from_request_includes_resolved_launch_maps() { + let req = serde_json::json!({ + "agent": { + "env_vars": {"LEGACY": "legacy-secret"}, + "launch": { + "env": {"PERSONA": "persona-secret"}, + "policy_env": {"POLICY": "policy-secret"} + } + } + }); + let secrets = env_secrets_from_request(&req); + assert_eq!(secrets.len(), 3); + for secret in ["legacy-secret", "persona-secret", "policy-secret"] { + assert!(secrets.iter().any(|candidate| candidate == secret)); + } +} + +#[cfg(unix)] +fn write_test_provider(path: &Path, body: &str) { + use std::os::unix::fs::PermissionsExt; + std::fs::write(path, format!("#!/bin/sh\nset -eu\n{body}\n")).unwrap(); + std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700)).unwrap(); +} + +#[cfg(unix)] +#[test] +fn provider_deploy_negotiates_and_deploys_the_same_staged_bytes() { + let directory = tempfile::tempdir().unwrap(); + let provider = directory.path().join("provider"); + let log = directory.path().join("invocations"); + let body = format!( + r#"read request +printf '%s\n' "$0" >> '{}' +case "$request" in + *\"op\":\"info\"*) printf '%s\n' '{{"ok":true,"name":"test","version":"1.0.0","protocol_version":1,"description":"test provider","config_schema":{{}}}}' ;; + *\"op\":\"deploy\"*) printf '%s\n' '{{"ok":true,"agent_id":"remote-1"}}' ;; +esac"#, + log.display() + ); + write_test_provider(&provider, &body); + + let id = provider_deploy(&provider, &serde_json::json!({}), &serde_json::json!({})) + .expect("staged deploy"); + assert_eq!(id, "remote-1"); + let paths: Vec<_> = std::fs::read_to_string(log) + .unwrap() + .lines() + .map(str::to_owned) + .collect(); + assert_eq!(paths.len(), 2); + assert_eq!(paths[0], paths[1]); + assert_ne!(Path::new(&paths[0]), provider); + assert!( + !Path::new(&paths[0]).exists(), + "staging directory must be deleted" + ); +} + +#[cfg(unix)] +fn replacement_provider() -> &'static str { + r#"#!/bin/sh +set -eu +read request +case "$request" in + *\"op\":\"info\"*) printf '%s\n' '{"ok":true,"name":"replacement","version":"9.9.9","protocol_version":1,"description":"replacement provider","config_schema":{}}' ;; + *\"op\":\"deploy\"*) printf '%s\n' '{"ok":true,"agent_id":"replacement-bytes-ran"}' ;; +esac +"# +} + +#[cfg(unix)] +#[test] +fn provider_deploy_uses_staged_bytes_after_same_inode_source_rewrite() { + use std::os::unix::fs::MetadataExt; + + let directory = tempfile::tempdir().unwrap(); + let provider = directory.path().join("provider"); + let replacement = directory.path().join("replacement"); + std::fs::write(&replacement, replacement_provider()).unwrap(); + let body = format!( + r#"read request +case "$request" in + *\"op\":\"info\"*) + cat '{}' > '{}' + chmod 700 '{}' + printf '%s\n' '{{"ok":true,"name":"original","version":"1.0.0","protocol_version":1,"description":"original provider","config_schema":{{}}}}' + ;; + *\"op\":\"deploy\"*) printf '%s\n' '{{"ok":true,"agent_id":"original-staged-bytes"}}' ;; +esac"#, + replacement.display(), + provider.display(), + provider.display(), + ); + write_test_provider(&provider, &body); + let inode_before = std::fs::metadata(&provider).unwrap().ino(); + + let id = provider_deploy(&provider, &serde_json::json!({}), &serde_json::json!({})) + .expect("deploy from immutable staged copy"); + + assert_eq!(id, "original-staged-bytes"); + assert_eq!( + std::fs::metadata(&provider).unwrap().ino(), + inode_before, + "test must rewrite the source binary in place" + ); + assert_eq!( + std::fs::read_to_string(&provider).unwrap(), + replacement_provider(), + "source pathname must contain replacement bytes before deploy" + ); +} + +#[cfg(unix)] +#[test] +fn provider_deploy_uses_staged_bytes_after_source_pathname_replacement() { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let directory = tempfile::tempdir().unwrap(); + let provider = directory.path().join("provider"); + let replacement = directory.path().join("replacement"); + std::fs::write(&replacement, replacement_provider()).unwrap(); + std::fs::set_permissions(&replacement, std::fs::Permissions::from_mode(0o700)).unwrap(); + let body = format!( + r#"read request +case "$request" in + *\"op\":\"info\"*) + mv '{}' '{}' + printf '%s\n' '{{"ok":true,"name":"original","version":"1.0.0","protocol_version":1,"description":"original provider","config_schema":{{}}}}' + ;; + *\"op\":\"deploy\"*) printf '%s\n' '{{"ok":true,"agent_id":"original-staged-bytes"}}' ;; +esac"#, + replacement.display(), + provider.display(), + ); + write_test_provider(&provider, &body); + let inode_before = std::fs::metadata(&provider).unwrap().ino(); + + let id = provider_deploy(&provider, &serde_json::json!({}), &serde_json::json!({})) + .expect("deploy from immutable staged copy"); + + assert_eq!(id, "original-staged-bytes"); + assert_ne!( + std::fs::metadata(&provider).unwrap().ino(), + inode_before, + "test must replace the source pathname with a different inode" + ); + assert_eq!( + std::fs::read_to_string(&provider).unwrap(), + replacement_provider(), + "source pathname must contain replacement bytes before deploy" + ); +} + +#[cfg(unix)] +#[test] +fn provider_deploy_refuses_mismatch_before_sending_agent_secret() { + let directory = tempfile::tempdir().unwrap(); + let provider = directory.path().join("provider"); + let marker = directory.path().join("deploy-received"); + let body = format!( + r#"read request +case "$request" in + *\"op\":\"info\"*) printf '%s\n' '{{"ok":true,"name":"test","version":"2.0.0","protocol_version":2,"description":"test provider","config_schema":{{}}}}' ;; + *\"op\":\"deploy\"*) touch '{}'; printf '%s\n' '{{"ok":true,"agent_id":"bad"}}' ;; +esac"#, + marker.display() + ); + write_test_provider(&provider, &body); + + let error = provider_deploy( + &provider, + &serde_json::json!({"private_key_nsec": "nsec1must-not-cross"}), + &serde_json::json!({}), + ) + .unwrap_err(); + assert!(error.contains("protocol version 2"), "{error}"); + assert!(!marker.exists()); + assert!(!error.contains("nsec1must-not-cross")); +} + +#[cfg(unix)] +#[test] +fn provider_deploy_requires_an_explicit_integer_protocol_version() { + let directory = tempfile::tempdir().unwrap(); + let provider = directory.path().join("provider"); + write_test_provider( + &provider, + r#"read request +printf '%s\n' '{"ok":true,"version":"1.0.0"}'"#, + ); + + let error = + provider_deploy(&provider, &serde_json::json!({}), &serde_json::json!({})).unwrap_err(); + assert!( + error.contains("missing integer protocol_version"), + "{error}" + ); +} + +#[test] +fn provider_info_requires_the_complete_flat_wire_shape() { + let complete = serde_json::json!({ + "ok": true, + "name": "kubernetes", + "version": "1.0.0", + "protocol_version": 1, + "description": "Kubernetes provider", + "config_schema": {} + }); + assert!(validate_provider_info(&complete).is_ok()); + + let mut missing = complete.clone(); + missing.as_object_mut().unwrap().remove("config_schema"); + assert!(validate_provider_info(&missing) + .unwrap_err() + .contains("config_schema")); + + let mut nested = complete; + nested.as_object_mut().unwrap().insert( + "provider".into(), + serde_json::json!({"protocol_version": 1}), + ); + assert!(validate_provider_info(&nested) + .unwrap_err() + .contains("unknown field provider")); +} + +#[test] +fn validate_provider_config_rejects_secret_key() { + let cfg = serde_json::json!({"api_key": "val"}); + assert!(validate_provider_config(&cfg).is_err()); +} + +#[test] +fn validate_provider_config_rejects_nested() { + let cfg = serde_json::json!({"region": {"us": "east"}}); + assert!(validate_provider_config(&cfg).is_err()); +} + +#[test] +fn validate_provider_config_accepts_scalars() { + let cfg = serde_json::json!({"region": "us-east-1", "tier": "standard"}); + assert!(validate_provider_config(&cfg).is_ok()); +} + +#[test] +fn validate_provider_config_allows_key_as_substring() { + // "keyboard", "monkey" contain "key" as substring but not as a word segment. + let cfg = serde_json::json!({"keyboard_layout": "us", "monkey_wrench": "tight"}); + assert!(validate_provider_config(&cfg).is_ok()); +} + +#[test] +fn validate_provider_config_rejects_camel_case_secrets() { + assert!(validate_provider_config(&serde_json::json!({"apiKey": "val"})).is_err()); + assert!(validate_provider_config(&serde_json::json!({"accessToken": "val"})).is_err()); + assert!(validate_provider_config(&serde_json::json!({"clientSecret": "val"})).is_err()); + // ALL-CAPS variants + assert!(validate_provider_config(&serde_json::json!({"apiKEY": "val"})).is_err()); + assert!(validate_provider_config(&serde_json::json!({"accessTOKEN": "val"})).is_err()); +} + +#[test] +fn split_config_key_handles_all_styles() { + assert_eq!(split_config_key("apiKey"), vec!["api", "key"]); + assert_eq!(split_config_key("access_token"), vec!["access", "token"]); + assert_eq!(split_config_key("keyboard"), vec!["keyboard"]); + assert_eq!(split_config_key("client-secret"), vec!["client", "secret"]); + // Acronym runs stay together + assert_eq!(split_config_key("APIKey"), vec!["api", "key"]); + assert_eq!(split_config_key("apiKEY"), vec!["api", "key"]); + assert_eq!(split_config_key("accessTOKEN"), vec!["access", "token"]); + assert_eq!(split_config_key("MyAPIKey"), vec!["my", "api", "key"]); +} + +#[test] +fn provider_filename_strips_the_windows_extension() { + assert_eq!( + provider_id_from_filename("buzz-backend-kubernetes"), + Some("kubernetes") + ); + assert_eq!( + provider_id_from_filename("buzz-backend-kubernetes.exe"), + Some("kubernetes") + ); + assert_eq!( + provider_id_from_filename("buzz-backend-kubernetes.EXE"), + Some("kubernetes") + ); + assert_eq!( + provider_id_from_filename("buzz-backend-kubernetes.bat"), + Some("kubernetes") + ); + assert_eq!( + provider_id_from_filename("buzz-backend-kubernetes.CMD"), + Some("kubernetes") + ); + assert_eq!( + provider_id_from_filename("buzz-backend-my-provider"), + Some("my-provider") + ); + assert_eq!(provider_id_from_filename("other"), None); +} + +#[test] +fn resolve_provider_binary_rejects_invalid_ids() { + // Path traversal + assert!(resolve_provider_binary("../evil").is_err()); + // Empty + assert!(resolve_provider_binary("").is_err()); + // Uppercase + assert!(resolve_provider_binary("MyProvider").is_err()); + // Spaces + assert!(resolve_provider_binary("my provider").is_err()); + // Shell metacharacters + assert!(resolve_provider_binary("foo;rm -rf /").is_err()); + // Valid format but not on PATH — should fail with "not found" + assert!(resolve_provider_binary("nonexistent-test-id-12345").is_err()); +} + +#[test] +fn resolve_provider_binary_accepts_valid_id_format() { + // Valid ID format should pass validation. If the binary happens to + // exist on PATH, Ok is returned; otherwise Err contains "not found" + // (not "invalid provider ID"). Either outcome proves validation passed. + match resolve_provider_binary("zzz-nonexistent-test-provider") { + Ok(_) => {} // unlikely but fine — binary exists + Err(e) => assert!( + e.contains("not found"), + "expected 'not found' error, got: {e}" + ), + } +} diff --git a/desktop/src-tauri/src/managed_agents/claude_config/mod.rs b/desktop/src-tauri/src/managed_agents/claude_config/mod.rs new file mode 100644 index 00000000000..647ea56209e --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/claude_config/mod.rs @@ -0,0 +1,53 @@ +//! Claude Code agent spawn-time env helpers. +//! +//! A1 contract: `ANTHROPIC_MODEL` is the single startup model authority for +//! local Claude Code agents. `BUZZ_ACP_MODEL` is removed from the spawned +//! env so the harness never sees two model authorities simultaneously. +//! +//! B5 contract: `BUZZ_ACP_EFFORT_LEVEL` is the canonical persisted startup +//! effort authority for all local agents. Written after `descriptor.env` so +//! user-supplied entries cannot shadow a persisted canonical value. + +/// The spawn-time env var carrying startup effort. Shared by the spawn +/// application ([`apply_effort_env`]) and the snapshot projection +/// (`spawn_snapshot::effective_effort`) so the value the harness receives and +/// the value the restart badge compares are named from one place. +pub const EFFORT_LEVEL_ENV_VAR: &str = "BUZZ_ACP_EFFORT_LEVEL"; + +/// Apply the A1 model authority: inject `ANTHROPIC_MODEL` from `effective_model` +/// (or remove it if `None`) and strip `BUZZ_ACP_MODEL` from the spawned env. +/// +/// Must be called after `descriptor.env` is written so that any user-supplied +/// `ANTHROPIC_MODEL` is overridden by the Buzz-resolved value. +pub fn apply_claude_model_env(command: &mut std::process::Command, effective_model: Option<&str>) { + // Remove BUZZ_ACP_MODEL — the catalog-switch path is for live ACP switches + // only; at spawn time ANTHROPIC_MODEL is the sole authority. + command.env_remove("BUZZ_ACP_MODEL"); + match effective_model { + Some(m) => { + command.env("ANTHROPIC_MODEL", m); + } + None => { + command.env_remove("ANTHROPIC_MODEL"); + } + } +} + +/// Apply the B5 effort authority: inject `BUZZ_ACP_EFFORT_LEVEL` from +/// `effort_level` (or leave it untouched if `None`). +/// +/// Must be called after `descriptor.env` is written so the canonical persisted +/// value wins over any user-supplied `BUZZ_ACP_EFFORT_LEVEL` entry. When +/// `effort_level` is `None` there is no canonical value to assert; the command +/// env is left untouched so a user-supplied value from `descriptor.env` +/// legitimately seeds startup effort. +pub fn apply_effort_env(command: &mut std::process::Command, effort_level: Option<&str>) { + if let Some(e) = effort_level { + command.env(EFFORT_LEVEL_ENV_VAR, e); + } + // None: no canonical value — leave whatever descriptor.env wrote intact. +} + +#[cfg(test)] +#[path = "tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/managed_agents/claude_config/tests.rs b/desktop/src-tauri/src/managed_agents/claude_config/tests.rs new file mode 100644 index 00000000000..f6f0f90cb2d --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/claude_config/tests.rs @@ -0,0 +1,127 @@ +use super::{apply_claude_model_env, apply_effort_env}; + +/// A1: BUZZ_ACP_MODEL must NOT be present in the spawned-child env after +/// `apply_claude_model_env`, even if it was set before (dual-authority defect). +/// ANTHROPIC_MODEL must be set to the resolved model. +#[test] +fn a1_buzz_acp_model_absent_anthropic_model_present_after_env_apply() { + let mut cmd = std::process::Command::new("true"); + // Simulate descriptor.env writing BUZZ_ACP_MODEL (the pre-A1 path). + cmd.env("BUZZ_ACP_MODEL", "claude-opus-4"); + apply_claude_model_env(&mut cmd, Some("claude-opus-4")); + + let env_map: std::collections::HashMap<_, _> = cmd.get_envs().collect(); + + // BUZZ_ACP_MODEL must be removed. Command::get_envs returns None for + // explicitly-removed keys. + let buzz_acp = env_map.get(std::ffi::OsStr::new("BUZZ_ACP_MODEL")); + assert!( + buzz_acp.is_none() || buzz_acp.unwrap().is_none(), + "BUZZ_ACP_MODEL must be absent (or explicitly removed) after A1 policy" + ); + + // ANTHROPIC_MODEL must be set to the resolved model value. + let anthropic = env_map.get(std::ffi::OsStr::new("ANTHROPIC_MODEL")); + assert!(anthropic.is_some(), "ANTHROPIC_MODEL must be present"); + assert_eq!( + anthropic.unwrap().unwrap_or_default(), + "claude-opus-4", + "ANTHROPIC_MODEL must equal the effective model" + ); +} + +/// A1: when no model is resolved, ANTHROPIC_MODEL must be removed so Claude +/// uses its own default rather than inheriting a stale env value. +#[test] +fn a1_anthropic_model_removed_when_no_effective_model() { + let mut cmd = std::process::Command::new("true"); + // Pre-set a stale value that might have leaked in. + cmd.env("ANTHROPIC_MODEL", "claude-3-5-sonnet"); + cmd.env("BUZZ_ACP_MODEL", "claude-3-5-sonnet"); + apply_claude_model_env(&mut cmd, None); + + let env_map: std::collections::HashMap<_, _> = cmd.get_envs().collect(); + + let anthropic = env_map.get(std::ffi::OsStr::new("ANTHROPIC_MODEL")); + assert!( + anthropic.is_none() || anthropic.unwrap().is_none(), + "ANTHROPIC_MODEL must be absent when no effective model" + ); + let buzz_acp = env_map.get(std::ffi::OsStr::new("BUZZ_ACP_MODEL")); + assert!( + buzz_acp.is_none() || buzz_acp.unwrap().is_none(), + "BUZZ_ACP_MODEL must always be absent after A1 policy" + ); +} + +// ── B5 effort-authority contract tests ────────────────────────────────────── +// +// These tests verify that `apply_effort_env`, called after `descriptor.env`, +// makes the canonical persisted effort win over any user-supplied value. + +/// B5 (local): canonical effort wins when user env supplies a conflicting value. +/// Simulates the defect scenario: descriptor.env wrote BUZZ_ACP_EFFORT_LEVEL=low, +/// then apply_effort_env is called with the canonical "high". The canonical value +/// must be what survives in the spawned-child env. +#[test] +fn b5_canonical_effort_wins_over_user_env_collision() { + let mut cmd = std::process::Command::new("true"); + // Simulate descriptor.env writing a user-supplied value (the pre-fix + // ordering: effort written before the loop, then loop overwrote it, or + // equivalently: effort written post-loop but with user value also post-loop). + cmd.env("BUZZ_ACP_EFFORT_LEVEL", "low"); + + // Post-loop canonical application — the fix. + apply_effort_env(&mut cmd, Some("high")); + + let env_map: std::collections::HashMap<_, _> = cmd.get_envs().collect(); + let effort = env_map.get(std::ffi::OsStr::new("BUZZ_ACP_EFFORT_LEVEL")); + assert!(effort.is_some(), "BUZZ_ACP_EFFORT_LEVEL must be present"); + assert_eq!( + effort.unwrap().unwrap_or_default(), + "high", + "canonical effort must win over the user-supplied 'low' — B5 authority ordering" + ); +} + +/// B5 (local): when no canonical effort is persisted (effort_level is None), +/// user env passthrough is preserved — the descriptor.env entry seeds startup effort. +/// Simulates: descriptor.env wrote BUZZ_ACP_EFFORT_LEVEL=low (already in command), +/// then apply_effort_env(None) is called — user value must survive. +#[test] +fn b5_user_effort_env_survives_when_no_canonical_value() { + let mut cmd = std::process::Command::new("true"); + // Simulate descriptor.env loop having written a user-supplied value first. + cmd.env("BUZZ_ACP_EFFORT_LEVEL", "low"); + + // No canonical value — apply_effort_env(None) is a no-op so the user + // value already written by the descriptor.env loop survives intact. + apply_effort_env(&mut cmd, None); + + let env_map: std::collections::HashMap<_, _> = cmd.get_envs().collect(); + let effort = env_map.get(std::ffi::OsStr::new("BUZZ_ACP_EFFORT_LEVEL")); + assert!(effort.is_some(), "BUZZ_ACP_EFFORT_LEVEL must be present"); + assert_eq!( + effort.unwrap().unwrap_or_default(), + "low", + "user-supplied effort must survive when no canonical value is persisted" + ); +} + +/// B5 (local): canonical effort is present in the spawned env even when user +/// env did NOT supply a conflicting value (basic injection contract). +#[test] +fn b5_canonical_effort_injected_when_no_user_collision() { + let mut cmd = std::process::Command::new("true"); + // No user-supplied BUZZ_ACP_EFFORT_LEVEL in descriptor.env. + apply_effort_env(&mut cmd, Some("medium")); + + let env_map: std::collections::HashMap<_, _> = cmd.get_envs().collect(); + let effort = env_map.get(std::ffi::OsStr::new("BUZZ_ACP_EFFORT_LEVEL")); + assert!(effort.is_some(), "BUZZ_ACP_EFFORT_LEVEL must be present"); + assert_eq!( + effort.unwrap().unwrap_or_default(), + "medium", + "canonical effort must be injected when no collision" + ); +} diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/claude.rs b/desktop/src-tauri/src/managed_agents/config_bridge/claude.rs index 449197a3b31..b54297df800 100644 --- a/desktop/src-tauri/src/managed_agents/config_bridge/claude.rs +++ b/desktop/src-tauri/src/managed_agents/config_bridge/claude.rs @@ -1,10 +1,28 @@ use super::types::{ExtensionEntry, RuntimeFileConfig}; -/// Read Claude Code config from `~/.claude/settings.json` and `~/.claude.json`. -pub(super) fn read_config_file() -> Option { +/// Read Claude Code config from `settings.json` and `.claude.json`. +/// +/// `config_dir` — when `Some`, reads both `settings.json` and `.claude.json` +/// from that directory (the agent's effective `CLAUDE_CONFIG_DIR`). +/// Defaults to `~/.claude/settings.json` and `~/.claude.json` when `None`. +/// +/// Both files are resolved from the same directory: the claude 2.1.x binary +/// resolves `.claude.json` as `join(process.env.CLAUDE_CONFIG_DIR || homedir(), +/// ".claude.json")`, mirroring the `settings.json` resolver. A user-set +/// `CLAUDE_CONFIG_DIR` therefore remaps both files — honoring only +/// `settings.json` would misrepresent the agent's actual MCP config. +pub(super) fn read_config_file(config_dir: Option<&std::path::Path>) -> Option { let home = dirs::home_dir()?; - let settings_path = home.join(".claude").join("settings.json"); - let mcp_path = home.join(".claude.json"); + + // #3493: honor user-set CLAUDE_CONFIG_DIR for both settings.json and + // .claude.json — the binary resolves both relative to CLAUDE_CONFIG_DIR. + // Panel reflects the actual config the agent reads. + let settings_path = config_dir + .map(|d| d.join("settings.json")) + .unwrap_or_else(|| home.join(".claude").join("settings.json")); + let mcp_path = config_dir + .map(|d| d.join(".claude.json")) + .unwrap_or_else(|| home.join(".claude.json")); let settings = read_json_file(&settings_path); let mcp_config = read_json_file(&mcp_path); @@ -74,6 +92,22 @@ mod tests { } } + /// #3493: read_config_file(Some(dir)) must read settings.json from the + /// custom dir, not ~/.claude/settings.json — proves CLAUDE_CONFIG_DIR + /// actually remaps the settings read (not just the reported MCP path). + #[test] + fn reads_settings_from_custom_config_dir() { + use std::io::Write; + let dir = tempfile::tempdir().unwrap(); + let mut f = std::fs::File::create(dir.path().join("settings.json")).unwrap(); + f.write_all(br#"{"model": "claude-opus-4", "effortLevel": "high"}"#) + .unwrap(); + + let cfg = read_config_file(Some(dir.path())).expect("settings.json in custom dir is read"); + assert_eq!(cfg.model.as_deref(), Some("claude-opus-4")); + assert_eq!(cfg.thinking_effort.as_deref(), Some("high")); + } + #[test] fn parse_model_from_settings() { let cfg = parse_settings(r#"{"model": "claude-sonnet-4-20250514"}"#); diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/reader.rs b/desktop/src-tauri/src/managed_agents/config_bridge/reader.rs index 372d2cfde1e..93827635e90 100644 --- a/desktop/src-tauri/src/managed_agents/config_bridge/reader.rs +++ b/desktop/src-tauri/src/managed_agents/config_bridge/reader.rs @@ -3,15 +3,22 @@ use crate::managed_agents::types::ManagedAgentRecord; use super::types::*; -/// Build the full config surface for an agent, merging all four tiers. +/// Build the full config surface for an agent, merging all tiers. /// -/// Pre-spawn (no session cache): tiers 2a (env vars / record) and 2b (config files). -/// Post-spawn (session cache present): adds tiers 1a (ACP native) and 1b (ACP configOptions). +/// Inherited values flow through `tiers` — a sanitized snapshot of the +/// persona and global tiers assembled at the command boundary. Each field +/// builder constructs its own candidate list and resolves via +/// `resolve_with_override`. +/// +/// `claude_config_dir` — when `Some`, the panel reads claude `settings.json` +/// and `.claude.json` from that directory (the agent's effective +/// `CLAUDE_CONFIG_DIR`) instead of `~/.claude/`. Ignored for non-claude runtimes. pub(crate) fn read_config_surface( record: &ManagedAgentRecord, runtime_meta: Option<&KnownAcpRuntime>, session_cache: Option<&SessionConfigCache>, - baseline: Option<(&str, ConfigOrigin)>, + tiers: &InheritedConfigTiers, + claude_config_dir: Option<&std::path::Path>, ) -> RuntimeConfigSurface { let is_pre_spawn = session_cache.is_none(); @@ -20,21 +27,14 @@ pub(crate) fn read_config_surface( .map(|m| m.id) .and_then(|id| match id { "goose" => super::goose::read_config_file().map(|c| (c, true)), - "claude" => super::claude::read_config_file().map(|c| (c, true)), + "claude" => super::claude::read_config_file(claude_config_dir).map(|c| (c, true)), "codex" => super::codex::read_config_file().map(|c| (c, true)), "buzz-agent" => super::buzz_agent::read_config_file().map(|c| (c, true)), _ => None, }) .unwrap_or_else(|| (RuntimeFileConfig::default(), false)); - // Tier 2a: record-level values (Buzz-explicit). - let record_model = record.model.clone(); - let record_provider = record - .env_vars - .get(runtime_meta.and_then(|m| m.provider_env_var).unwrap_or("")) - .cloned() - .or_else(|| record.provider.clone()); // structured provider field as fallback - + // Runtime-specific env var keys. let supports_acp_model = runtime_meta.is_some_and(|m| m.supports_acp_model_switching); let model_env_var = runtime_meta.and_then(|m| m.model_env_var); let provider_env_var = runtime_meta.and_then(|m| m.provider_env_var); @@ -48,72 +48,67 @@ pub(crate) fn read_config_surface( let context_limit_env_var = runtime_meta.and_then(|m| m.context_limit_env_var); // Tier 1b: ACP configOptions from session cache. - // For unstable/switchable agents, current_model comes from the `models` - // field. For stable agents that only report model via configOptions - // (category="model", current_value), fall back to find_config_option_value - // so their current model is surfaced in the panel. let acp_model = session_cache.and_then(|c| { c.current_model .clone() .or_else(|| find_config_option_value(c, "model")) }); let acp_mode = session_cache.and_then(|c| find_config_option_value(c, "mode")); - let acp_effort = session_cache.and_then(|c| find_config_option_value(c, "effort")); - let record_effort = thinking_env_var - .and_then(|k| record.env_vars.get(k)) - .cloned(); + + // B5: the adapter-advertised effort control, selected ONCE by its category. + // The adapter defines it as category `thought_level` with its own config id + // (Claude Code emits `id="effort"`); reading by the literal category `effort` + // would miss it entirely. The running value, the write config id, and the + // picker options all derive from this single entry. + let effort_option = session_cache.and_then(find_effort_option); + let acp_effort = effort_option.and_then(|o| o.current_value.clone()); let model_overridden = session_cache.is_some_and(|c| c.model_overridden); let normalized = NormalizedConfig { - model: Some(apply_runtime_override( - build_model_field( - &record_model, - &file_config.model, - &acp_model, - model_env_var, - supports_acp_model, - is_pre_spawn, - session_cache, - required_fields.contains(&"model"), - ), - acp_model.as_deref(), - baseline, + model: Some(build_model_field( + record, + &file_config.model, + &acp_model, + model_env_var, + supports_acp_model, + is_pre_spawn, + session_cache, + required_fields.contains(&"model"), model_overridden, + tiers, )), provider: build_provider_field( - &record_provider, + record, &file_config.provider, provider_env_var, provider_locked, required_fields.contains(&"provider"), + tiers, ), mode: build_mode_field(&file_config.mode, &acp_mode, is_pre_spawn, session_cache), thinking_effort: build_thinking_field( - &record_effort, + record, &file_config.thinking_effort, &acp_effort, + effort_option.map(|o| o.config_id.as_str()), thinking_env_var, is_pre_spawn, - session_cache, + tiers, ), max_output_tokens: build_numeric_env_field( max_tokens_env_var, - &record.env_vars, + record, &file_config.max_output_tokens, + tiers, ), context_limit: build_numeric_env_field( context_limit_env_var, - &record.env_vars, + record, &file_config.context_limit, + tiers, ), - system_prompt: build_system_prompt_field( - &record - .system_prompt - .clone() - .or_else(|| record.env_vars.get("BUZZ_ACP_SYSTEM_PROMPT").cloned()), - &file_config.system_prompt, - ), + system_prompt: build_system_prompt_field(record, &file_config.system_prompt, tiers), }; // Advanced fields from config file extras. @@ -130,7 +125,7 @@ pub(crate) fn read_config_surface( }) .collect(); - // Collect the env var keys already covered by normalized fields so we don't double-surface them. + // Collect the env var keys already covered by normalized fields. let normalized_env_keys: Vec<&str> = [ model_env_var, provider_env_var, @@ -144,15 +139,13 @@ pub(crate) fn read_config_surface( .collect(); // Tier 2a: remaining env vars not covered by normalized fields. - // Env var wins over config file for the same key (tier 2a > 2b), so skip - // keys already present in file_config.extra. let mut advanced = advanced; for (k, v) in &record.env_vars { if normalized_env_keys.contains(&k.as_str()) { continue; } if file_config.extra.contains_key(k) { - continue; // config file already surfaced this key + continue; } advanced.push(ConfigField { key: k.clone(), @@ -164,10 +157,9 @@ pub(crate) fn read_config_surface( }); } - let config_file_path = runtime_meta - .and_then(|m| m.config_file_path) - .map(resolve_tilde); - let mcp_config_file_path = runtime_meta.and_then(mcp_config_file_path_for_runtime); + let config_file_path = config_file_path_for_runtime(runtime_meta, claude_config_dir); + let mcp_config_file_path = + runtime_meta.and_then(|m| mcp_config_file_path_for_runtime(m, claude_config_dir)); let extensions = file_config.extensions.clone(); let sources = ConfigSourceReport { @@ -178,8 +170,6 @@ pub(crate) fn read_config_surface( { ConfigTierStatus::Available } else { - // Post-spawn without native config data is also Pending — it arrives - // asynchronously after the session/new response. ConfigTierStatus::Pending } } else { @@ -202,6 +192,12 @@ pub(crate) fn read_config_surface( mcp_config_file_path, }; + // B5: the adapter-advertised effort control, discovered once above. The UI + // uses `effort_config_id` to send `set_config_option` and renders + // `effort_options` instead of hardcoded values (never hardcoded here). + let effort_config_id = effort_option.map(|o| o.config_id.clone()); + let effort_options = effort_option.map(|o| o.options.clone()).unwrap_or_default(); + RuntimeConfigSurface { runtime_id: runtime_meta.map(|m| m.id.to_string()), runtime_label: runtime_meta.map(|m| m.label.to_string()), @@ -210,15 +206,52 @@ pub(crate) fn read_config_surface( advanced, extensions, sources, + claude_config_dir_custom: claude_config_dir.is_some(), + effort_config_id, + effort_options, + } +} + +/// Resolve the reported `settings.json` path. #3493: for a claude agent with a +/// custom `CLAUDE_CONFIG_DIR`, the reader reads `/settings.json`, so the +/// reported path must point there — not the static `~/.claude/settings.json` +/// from the runtime metadata. All other runtimes (and claude with no custom +/// dir) use the static metadata path. +fn config_file_path_for_runtime( + runtime_meta: Option<&KnownAcpRuntime>, + claude_config_dir: Option<&std::path::Path>, +) -> Option { + let runtime = runtime_meta?; + if runtime.id == "claude" { + if let Some(dir) = claude_config_dir { + return Some(dir.join("settings.json").to_string_lossy().into_owned()); + } } + runtime.config_file_path.map(resolve_tilde) } -fn mcp_config_file_path_for_runtime(runtime: &KnownAcpRuntime) -> Option { +fn mcp_config_file_path_for_runtime( + runtime: &KnownAcpRuntime, + claude_config_dir: Option<&std::path::Path>, +) -> Option { match runtime.id { "goose" => { super::goose::goose_config_path().map(|path| path.to_string_lossy().into_owned()) } - "claude" => Some(resolve_tilde("~/.claude.json")), + // #3493: the claude 2.1.x binary resolves .claude.json as + // join(CLAUDE_CONFIG_DIR || homedir(), ".claude.json"), so the MCP + // config file moves with a user-set CLAUDE_CONFIG_DIR. + "claude" => Some( + claude_config_dir + .map(|d| d.join(".claude.json")) + .unwrap_or_else(|| { + dirs::home_dir() + .map(|h| h.join(".claude.json")) + .unwrap_or_default() + }) + .to_string_lossy() + .into_owned(), + ), "codex" => { super::codex::codex_config_path().map(|path| path.to_string_lossy().into_owned()) } @@ -226,9 +259,27 @@ fn mcp_config_file_path_for_runtime(runtime: &KnownAcpRuntime) -> Option } } +/// Extract an env-backed candidate value for `env_key` from each tier in +/// spawn precedence: record env > persona env > global env > definition env. +/// Returns `[record, persona, global, definition]` — `None` when key is absent. +fn env_candidates<'a>( + env_key: &str, + record_env: &'a std::collections::BTreeMap, + persona_env: &'a std::collections::BTreeMap, + global_env: &'a std::collections::BTreeMap, + definition_env: &'a std::collections::BTreeMap, +) -> [Option<&'a str>; 4] { + [ + record_env.get(env_key).map(String::as_str), + persona_env.get(env_key).map(String::as_str), + global_env.get(env_key).map(String::as_str), + definition_env.get(env_key).map(String::as_str), + ] +} + #[allow(clippy::too_many_arguments)] fn build_model_field( - record_model: &Option, + record: &ManagedAgentRecord, file_model: &Option, acp_model: &Option, model_env_var: Option<&str>, @@ -236,30 +287,109 @@ fn build_model_field( is_pre_spawn: bool, session_cache: Option<&SessionConfigCache>, is_required: bool, + model_overridden: bool, + tiers: &InheritedConfigTiers, ) -> NormalizedField { - // Precedence: Buzz-explicit > ACP current > config file - let (value, origin) = if let Some(ref m) = record_model { - (Some(m.clone()), ConfigOrigin::BuzzExplicit) - } else if let Some(ref m) = acp_model { - (Some(m.clone()), ConfigOrigin::AcpConfigOption) - } else if let Some(ref m) = file_model { - (Some(m.clone()), ConfigOrigin::ConfigFile) - } else { - // No value from any tier. EnvVar is the sentinel origin for "no value - // resolved" — there is no dedicated None-origin variant. The panel - // renders this as an empty/absent field. - (None, ConfigOrigin::EnvVar) - }; + let [rec_env, pers_env, glob_env, def_env] = model_env_var + .map(|k| { + env_candidates( + k, + &record.env_vars, + &tiers.persona_env, + &tiers.global_env, + &tiers.definition_env, + ) + }) + .unwrap_or([None, None, None, None]); + + // Structured record model (definition-less only; linked cleared upstream). + let struct_record = record.model.as_deref(); + let struct_persona = tiers.persona_model.as_deref(); + let struct_global = tiers.global_model.as_deref(); + + // Configured candidates in spawn order: record env > persona env > global env > + // definition env > struct record > struct persona > struct global > file. + // The file entry is always last; everything before it is a "configured" candidate + // that gates whether ACP participates as a fallback (see any_configured below). + let configured: &[(Option<&str>, ConfigOrigin)] = &[ + (rec_env, ConfigOrigin::BuzzExplicit), + (pers_env, ConfigOrigin::PersonaDefault), + (glob_env, ConfigOrigin::GlobalDefault), + (def_env, ConfigOrigin::HarnessDefault), + (struct_record, ConfigOrigin::BuzzExplicit), + (struct_persona, ConfigOrigin::PersonaDefault), + (struct_global, ConfigOrigin::GlobalDefault), + (file_model.as_deref(), ConfigOrigin::ConfigFile), + ]; + // "Configured" = any non-file candidate. The file entry is always last, so + // slicing to len()-1 is equivalent to the old magic `[..6]` and stays correct + // if the array ever grows again. + let any_configured = configured[..configured.len() - 1] + .iter() + .any(|(v, _)| v.is_some()); + + // When model_overridden is true and ACP is present, ACP is the live winner. + // The top configured candidate becomes the secondary (the overridden baseline). + // Equal-value case: ACP == baseline → fall through to normal resolution so + // the field carries the correct baseline origin rather than RuntimeOverride. + if model_overridden { + if let Some(acp) = acp_model.as_deref() { + let baseline = configured.iter().find(|(v, _)| v.is_some()); + match baseline { + Some((Some(baseline_value), _)) if acp == *baseline_value => { + // Equal-value switch: no real divergence. + // Fall through to the normal resolve path below — it will + // return the same value with its true baseline origin, with + // no secondary row. + } + Some((Some(baseline_value), baseline_origin)) => { + return NormalizedField { + value: Some(acp.to_string()), + origin: ConfigOrigin::RuntimeOverride, + write_via: model_write_mechanism( + is_pre_spawn, + supports_acp_model, + session_cache, + model_env_var, + ), + overridden_value: Some(baseline_value.to_string()), + overridden_origin: Some(baseline_origin.clone()), + is_required, + }; + } + _ => { + // No configured baseline — ACP is the only source. + return NormalizedField { + value: Some(acp.to_string()), + origin: ConfigOrigin::RuntimeOverride, + write_via: model_write_mechanism( + is_pre_spawn, + supports_acp_model, + session_cache, + model_env_var, + ), + overridden_value: None, + overridden_origin: None, + is_required, + }; + } + } + } + } - // The secondary expresses ONLY the static record-vs-file precedence: a - // Buzz-explicit model shadowing a config-file model. The live-session - // override (acp vs record/persona) is exclusively `apply_runtime_override`'s - // job, gated on `model_overridden`. Surfacing `acp_model` here would leak an - // override row even when no live switch has been applied. - let (overridden_value, overridden_origin) = if record_model.is_some() && file_model.is_some() { - (file_model.clone(), Some(ConfigOrigin::ConfigFile)) + let (value, origin, overridden_value, overridden_origin) = if !any_configured { + // No configured candidate: ACP participates as AcpConfigOption fallback. + let full: &[(Option<&str>, ConfigOrigin)] = &[ + (acp_model.as_deref(), ConfigOrigin::AcpConfigOption), + (file_model.as_deref(), ConfigOrigin::ConfigFile), + ]; + resolve_with_override(full).unwrap_or((None, ConfigOrigin::EnvVar, None, None)) } else { - (None, None) + // ACP excluded: a configured value is pending and wins over live ACP. + match resolve_with_override(configured) { + Some(r) => r, + None => (None, ConfigOrigin::EnvVar, None, None), + } }; let write_via = model_write_mechanism( @@ -280,7 +410,6 @@ fn build_model_field( } /// Resolve how the model field is written back to the runtime. -/// Prefer ACP `set_config_option`/`set_model` post-spawn, else env-var respawn. fn model_write_mechanism( is_pre_spawn: bool, supports_acp_model: bool, @@ -301,67 +430,13 @@ fn model_write_mechanism( } } -/// Re-key the model field as a live runtime override when the harness signals -/// that a `SwitchModel` control signal set the model (Phase 3c). -/// -/// The override-active signal is `model_overridden` from the -/// `session_config_captured` payload — NOT `acp_model != persona_model`, which -/// would false-positive when a persona model is edited mid-life while the -/// session is stale on the old model. -/// -/// `baseline` is the value the live model overrides, paired with its true -/// origin — `(persona_model, PersonaDefault)` for a persona-linked agent, or -/// `(record_model, BuzzExplicit)` for a genuine-explicit agent that live- -/// switched. It is `Some` only when there is such a baseline to override -/// against; otherwise the field passes through unchanged. Carrying the origin -/// in the pair (rather than hardcoding it) lets the secondary be tagged by its -/// real source instead of always reading `PersonaDefault`. -/// -/// The `acp == baseline_value` short-circuit keeps a live pick of the baseline -/// model itself from rendering a no-op "override of X with X". It yields a -/// CLEAN single-value field — `overridden_value`/`overridden_origin` cleared — -/// rather than passing `base` through, because `build_model_field` already -/// populates `base`'s secondary with an `AcpConfigOption` row for the -/// record-model-plus-live-session case; returning `base` would leak that -/// spurious row. The override preserves the base field's write mechanism — only -/// the displayed value, origin, and secondary change. -fn apply_runtime_override( - base: NormalizedField, - acp_model: Option<&str>, - baseline: Option<(&str, ConfigOrigin)>, - model_overridden: bool, -) -> NormalizedField { - if !model_overridden { - return base; - } - let (Some(acp), Some((baseline_value, baseline_origin))) = (acp_model, baseline) else { - return base; - }; - if acp == baseline_value { - // Live pick equals the baseline — no real divergence. Strip any - // secondary `build_model_field` may have produced so the panel shows a - // single clean value rather than "X overridden by X". - return NormalizedField { - overridden_value: None, - overridden_origin: None, - ..base - }; - } - NormalizedField { - value: Some(acp.to_string()), - origin: ConfigOrigin::RuntimeOverride, - overridden_value: Some(baseline_value.to_string()), - overridden_origin: Some(baseline_origin), - ..base - } -} - fn build_provider_field( - record_provider: &Option, + record: &ManagedAgentRecord, file_provider: &Option, provider_env_var: Option<&str>, provider_locked: bool, is_required: bool, + tiers: &InheritedConfigTiers, ) -> Option { if provider_locked { return Some(NormalizedField { @@ -374,15 +449,43 @@ fn build_provider_field( }); } - let tiers: &[(Option<&str>, ConfigOrigin)] = &[ - (record_provider.as_deref(), ConfigOrigin::BuzzExplicit), + let [rec_env, pers_env, glob_env, def_env] = provider_env_var + .map(|k| { + env_candidates( + k, + &record.env_vars, + &tiers.persona_env, + &tiers.global_env, + &tiers.definition_env, + ) + }) + .unwrap_or([None, None, None, None]); + + let struct_record = record.provider.as_deref(); + + let tiers_list: &[(Option<&str>, ConfigOrigin)] = &[ + (rec_env, ConfigOrigin::BuzzExplicit), + (pers_env, ConfigOrigin::PersonaDefault), + (glob_env, ConfigOrigin::GlobalDefault), + (def_env, ConfigOrigin::HarnessDefault), + (struct_record, ConfigOrigin::BuzzExplicit), + ( + tiers.persona_provider.as_deref(), + ConfigOrigin::PersonaDefault, + ), + ( + tiers.global_provider.as_deref(), + ConfigOrigin::GlobalDefault, + ), (file_provider.as_deref(), ConfigOrigin::ConfigFile), ]; - let (value, origin, overridden_value, overridden_origin) = match resolve_with_override(tiers) { - Some(resolved) => resolved, - None if is_required => (None, ConfigOrigin::EnvVar, None, None), - None => return None, - }; + + let (value, origin, overridden_value, overridden_origin) = + match resolve_with_override(tiers_list) { + Some(resolved) => resolved, + None if is_required => (None, ConfigOrigin::EnvVar, None, None), + None => return None, + }; let write_via = if let Some(env_key) = provider_env_var { ConfigWriteMechanism::RespawnWithEnvVar { @@ -432,31 +535,58 @@ fn build_mode_field( }) } +#[allow(clippy::too_many_arguments)] fn build_thinking_field( - record_effort: &Option, + record: &ManagedAgentRecord, file_effort: &Option, acp_effort: &Option, + effort_config_id: Option<&str>, thinking_env_var: Option<&str>, is_pre_spawn: bool, - session_cache: Option<&SessionConfigCache>, + tiers: &InheritedConfigTiers, ) -> Option { - let tiers: &[(Option<&str>, ConfigOrigin)] = &[ - (record_effort.as_deref(), ConfigOrigin::BuzzExplicit), + // Tier ordering: + // record env > record.effort_level (canonical Buzz-persisted) > ACP > + // persona env > global env > definition env > config file. + // + // `record.effort_level` is the B5 canonical value: the effort a spawn will + // actually apply at next session start (via `apply_effort_env`). Sitting it + // above ACP means the panel shows the *configured* value the agent will + // launch with rather than a stale live-session reading — the record can't + // be masked by, nor mask, the running value silently. + let [rec_env, pers_env, glob_env, def_env] = thinking_env_var + .map(|k| { + env_candidates( + k, + &record.env_vars, + &tiers.persona_env, + &tiers.global_env, + &tiers.definition_env, + ) + }) + .unwrap_or([None, None, None, None]); + + let canonical_effort = record.effort_level.as_deref(); + + let tiers_list: &[(Option<&str>, ConfigOrigin)] = &[ + (rec_env, ConfigOrigin::BuzzExplicit), + (canonical_effort, ConfigOrigin::BuzzExplicit), (acp_effort.as_deref(), ConfigOrigin::AcpConfigOption), + (pers_env, ConfigOrigin::PersonaDefault), + (glob_env, ConfigOrigin::GlobalDefault), + (def_env, ConfigOrigin::HarnessDefault), (file_effort.as_deref(), ConfigOrigin::ConfigFile), ]; - let (value, origin, overridden_value, overridden_origin) = resolve_with_override(tiers)?; + let (value, origin, overridden_value, overridden_origin) = resolve_with_override(tiers_list)?; - let write_via = if !is_pre_spawn && has_config_option(session_cache, "effort") { - ConfigWriteMechanism::AcpSetConfigOption { - config_id: "effort".to_string(), - } - } else if let Some(env_key) = thinking_env_var { - ConfigWriteMechanism::RespawnWithEnvVar { + let write_via = match (is_pre_spawn, effort_config_id, thinking_env_var) { + (false, Some(config_id), _) => ConfigWriteMechanism::AcpSetConfigOption { + config_id: config_id.to_string(), + }, + (_, _, Some(env_key)) => ConfigWriteMechanism::RespawnWithEnvVar { env_key: env_key.to_string(), - } - } else { - ConfigWriteMechanism::ReadOnly + }, + _ => ConfigWriteMechanism::ReadOnly, }; Some(NormalizedField { @@ -469,67 +599,105 @@ fn build_thinking_field( }) } -/// Numeric fields (max_output_tokens, context_limit) — env-var tier wins over -/// config-file tier. When an env var key is given and present in the record's -/// env_vars map the field is BuzzExplicit + RespawnWithEnvVar; otherwise if the -/// config file supplied a value it is ConfigFile + ReadOnly; otherwise None. +/// Numeric fields (max_output_tokens, context_limit). +/// Tier ordering: record env > persona env > global env > config file. fn build_numeric_env_field( env_var: Option<&'static str>, - record_env: &std::collections::BTreeMap, + record: &ManagedAgentRecord, file_value: &Option, + tiers: &InheritedConfigTiers, ) -> Option { - if let Some(key) = env_var { - if let Some(v) = record_env.get(key) { - return Some(NormalizedField { - value: Some(v.clone()), - origin: ConfigOrigin::BuzzExplicit, - write_via: ConfigWriteMechanism::RespawnWithEnvVar { - env_key: key.to_string(), - }, - overridden_value: file_value.clone(), - overridden_origin: file_value.as_ref().map(|_| ConfigOrigin::ConfigFile), - is_required: false, - }); + let [rec_env, pers_env, glob_env, def_env] = env_var + .map(|k| { + env_candidates( + k, + &record.env_vars, + &tiers.persona_env, + &tiers.global_env, + &tiers.definition_env, + ) + }) + .unwrap_or([None, None, None, None]); + + let tiers_list: &[(Option<&str>, ConfigOrigin)] = &[ + (rec_env, ConfigOrigin::BuzzExplicit), + (pers_env, ConfigOrigin::PersonaDefault), + (glob_env, ConfigOrigin::GlobalDefault), + (def_env, ConfigOrigin::HarnessDefault), + (file_value.as_deref(), ConfigOrigin::ConfigFile), + ]; + + let (value, origin, overridden_value, overridden_origin) = resolve_with_override(tiers_list)?; + + let write_via = if let Some(key) = env_var { + ConfigWriteMechanism::RespawnWithEnvVar { + env_key: key.to_string(), } - } - file_value.as_ref().map(|v| NormalizedField { - value: Some(v.clone()), - origin: ConfigOrigin::ConfigFile, - write_via: ConfigWriteMechanism::ReadOnly, - overridden_value: None, - overridden_origin: None, + } else { + ConfigWriteMechanism::ReadOnly + }; + + Some(NormalizedField { + value, + origin, + write_via, + overridden_value, + overridden_origin, is_required: false, }) } -/// Record/env prompt wins (BuzzExplicit, respawnable); a config-file prompt it -/// shadows is reported as the overridden secondary. A config-file-only prompt -/// — no record/env value to shadow it — is surfaced directly (read-only) -/// instead of being dropped: a prompt that drives the agent should always be -/// visible somewhere in the panel. +/// System prompt field. +/// +/// Tier ordering per v3 plan: record env > persona env > global env > +/// struct record > struct persona > config file. +/// +/// Env tiers sit above structured per spawn contract: `descriptor.env` is +/// written last (after the structured prompt), so env wins on collision. +/// `GlobalAgentConfig` has no structured system_prompt, so the global tier +/// is env-only. `BUZZ_ACP_SYSTEM_PROMPT` is not reserved and is therefore +/// a real global env tier. fn build_system_prompt_field( - record_prompt: &Option, + record: &ManagedAgentRecord, file_prompt: &Option, + tiers: &InheritedConfigTiers, ) -> Option { - if let Some(v) = record_prompt { - return Some(NormalizedField { - value: Some(v.clone()), - origin: ConfigOrigin::BuzzExplicit, - write_via: ConfigWriteMechanism::RespawnWithEnvVar { - env_key: "BUZZ_ACP_SYSTEM_PROMPT".to_string(), - }, - overridden_value: file_prompt.clone(), - overridden_origin: file_prompt.as_ref().map(|_| ConfigOrigin::ConfigFile), - is_required: false, - }); - } + const PROMPT_ENV_KEY: &str = "BUZZ_ACP_SYSTEM_PROMPT"; + + let [rec_env, pers_env, glob_env, def_env] = env_candidates( + PROMPT_ENV_KEY, + &record.env_vars, + &tiers.persona_env, + &tiers.global_env, + &tiers.definition_env, + ); + + // Structured record prompt (definition-less only; linked cleared upstream). + let struct_record = record.system_prompt.as_deref(); + + let tiers_list: &[(Option<&str>, ConfigOrigin)] = &[ + (rec_env, ConfigOrigin::BuzzExplicit), // record env + (pers_env, ConfigOrigin::PersonaDefault), // persona env + (glob_env, ConfigOrigin::GlobalDefault), // global env + (def_env, ConfigOrigin::HarnessDefault), // definition env + (struct_record, ConfigOrigin::BuzzExplicit), // struct record + ( + tiers.persona_prompt.as_deref(), + ConfigOrigin::PersonaDefault, + ), // struct persona + (file_prompt.as_deref(), ConfigOrigin::ConfigFile), + ]; - file_prompt.as_ref().map(|v| NormalizedField { - value: Some(v.clone()), - origin: ConfigOrigin::ConfigFile, - write_via: ConfigWriteMechanism::ReadOnly, - overridden_value: None, - overridden_origin: None, + let (value, origin, overridden_value, overridden_origin) = resolve_with_override(tiers_list)?; + + Some(NormalizedField { + value, + origin, + write_via: ConfigWriteMechanism::RespawnWithEnvVar { + env_key: PROMPT_ENV_KEY.to_string(), + }, + overridden_value, + overridden_origin, is_required: false, }) } @@ -572,6 +740,19 @@ fn find_config_option_value(cache: &SessionConfigCache, category: &str) -> Optio .and_then(|o| o.current_value.clone()) } +/// Selects the adapter-advertised effort control from the session cache. +/// +/// The adapter emits effort under category `thought_level` with its own +/// config id (Claude Code uses `id="effort"`). Selecting by category — not by +/// a hardcoded id — is what lets the running value, the write config id, and +/// the picker options all derive from one entry. +fn find_effort_option(cache: &SessionConfigCache) -> Option<&AcpConfigOptionEntry> { + cache + .config_options + .iter() + .find(|o| o.category.as_deref() == Some("thought_level")) +} + fn has_config_option(cache: Option<&SessionConfigCache>, category: &str) -> bool { cache.is_some_and(|c| { c.config_options diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs index 4ee4ec79c32..36b6022b53b 100644 --- a/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs +++ b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests.rs @@ -56,6 +56,7 @@ fn test_runtime() -> &'static KnownAcpRuntime { thinking_env_var: Some("GOOSE_THINKING_EFFORT"), max_tokens_env_var: Some("GOOSE_MAX_TOKENS"), context_limit_env_var: Some("GOOSE_CONTEXT_LIMIT"), + max_rounds_env_var: None, required_normalized_fields: &["model", "provider"], login_hint: None, auth_probe_args: None, @@ -87,6 +88,7 @@ fn test_record() -> ManagedAgentRecord { runtime_pid: None, backend: crate::managed_agents::types::BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -114,17 +116,60 @@ fn test_record() -> ManagedAgentRecord { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, agent_command_override: None, persona_source_version: None, provider: None, } } +/// Default empty tiers: no persona or global inheritance. +fn no_tiers() -> InheritedConfigTiers { + InheritedConfigTiers::default() +} + +/// Tiers with only global env set (for AC-1 style tests). +fn global_env_tiers(key: &str, val: &str) -> InheritedConfigTiers { + let mut global_env = BTreeMap::new(); + global_env.insert(key.to_string(), val.to_string()); + InheritedConfigTiers { + global_env, + ..Default::default() + } +} + +/// Tiers with only persona env set. +fn persona_env_tiers(key: &str, val: &str) -> InheritedConfigTiers { + let mut persona_env = BTreeMap::new(); + persona_env.insert(key.to_string(), val.to_string()); + InheritedConfigTiers { + persona_env, + ..Default::default() + } +} + +/// Tiers with both persona and global env set for the same key. +fn persona_and_global_env_tiers( + key: &str, + persona_val: &str, + global_val: &str, +) -> InheritedConfigTiers { + let mut persona_env = BTreeMap::new(); + persona_env.insert(key.to_string(), persona_val.to_string()); + let mut global_env = BTreeMap::new(); + global_env.insert(key.to_string(), global_val.to_string()); + InheritedConfigTiers { + persona_env, + global_env, + ..Default::default() + } +} + #[test] fn pre_spawn_surface_reports_pending_acp_tiers() { let record = test_record(); let runtime = test_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); assert!(surface.is_pre_spawn); assert_eq!(surface.sources.acp_native, ConfigTierStatus::Pending); @@ -140,7 +185,7 @@ fn surface_reports_mcp_specific_config_path() { let record = test_record(); let runtime = test_runtime(); let surface = with_goose_path_root(None, || { - read_config_surface(&record, Some(runtime), None, None) + read_config_surface(&record, Some(runtime), None, &no_tiers(), None) }); let path = surface @@ -159,7 +204,7 @@ fn goose_mcp_config_path_follows_path_root_override() { let record = test_record(); let runtime = test_runtime(); let surface = with_goose_path_root(Some("/tmp/buzz-goose-root"), || { - read_config_surface(&record, Some(runtime), None, None) + read_config_surface(&record, Some(runtime), None, &no_tiers(), None) }); let expected_path = Path::new("/tmp/buzz-goose-root") @@ -183,7 +228,7 @@ fn claude_surface_uses_mcp_config_path_not_settings_path() { config_file_path: Some("~/.claude/settings.json"), ..*test_runtime() }; - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); assert!(surface .sources @@ -203,7 +248,7 @@ fn record_model_overrides_file_model() { record.model = Some("explicit-model".to_string()); let runtime = test_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let model = surface.normalized.model.unwrap(); assert_eq!(model.value.as_deref(), Some("explicit-model")); assert_eq!(model.origin, ConfigOrigin::BuzzExplicit); @@ -216,7 +261,7 @@ fn provider_locked_shows_locked() { provider_locked: true, ..*test_runtime() }; - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let provider = surface.normalized.provider.unwrap(); assert_eq!(provider.value.as_deref(), Some("Anthropic (locked)")); assert_eq!(provider.origin, ConfigOrigin::HarnessConstraint); @@ -242,7 +287,7 @@ fn post_spawn_with_model_config_option_uses_acp() { captured_at: "".to_string(), }; - let surface = read_config_surface(&record, Some(runtime), Some(&cache), None); + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &no_tiers(), None); assert!(!surface.is_pre_spawn); let model = surface.normalized.model.unwrap(); assert_eq!(model.value.as_deref(), Some("claude-opus-4")); @@ -266,53 +311,86 @@ fn acp_model_overrides_file_model_with_override_tracking() { captured_at: "".to_string(), }; - let surface = read_config_surface(&record, Some(runtime), Some(&cache), None); + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &no_tiers(), None); let model = surface.normalized.model.unwrap(); assert_eq!(model.value.as_deref(), Some("acp-model")); assert_eq!(model.origin, ConfigOrigin::AcpConfigOption); - // The goose config file might have a model too — since we can't control - // the actual file in a unit test, just verify the override fields are populated - // when we manually construct the scenario via build_model_field. } -// ── Persona resolution integration tests ──────────────────────────── -// -// These simulate the call-site pattern in agent_config.rs: -// 1. Inject persona-resolved values into the record (as if absent) -// 2. Call read_config_surface (reader tags them BuzzExplicit) -// 3. Re-tag injected fields to PersonaDefault +// ── Persona / global tier integration tests ────────────────────────────────── // -// This exercises the same logic path as get_agent_config_surface without -// requiring Tauri AppHandle/State infrastructure. +// These exercise the tiers-based candidate resolution for model, provider, and +// system_prompt via `InheritedConfigTiers` — replacing the old inject+retag +// simulation tests. #[test] -fn persona_model_injection_produces_persona_default_origin() { - let mut record = test_record(); - // Simulate: record has no model, persona provides one. - // The call-site injects it before calling the reader. - record.model = Some("persona-model".to_string()); +fn persona_model_tier_produces_persona_default_origin() { + let record = test_record(); // no record.model let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + persona_model: Some("persona-model".to_string()), + ..Default::default() + }; - let mut surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); - // Reader sees injected model as BuzzExplicit. - let model = surface.normalized.model.as_ref().unwrap(); + let model = surface.normalized.model.unwrap(); assert_eq!(model.value.as_deref(), Some("persona-model")); - assert_eq!(model.origin, ConfigOrigin::BuzzExplicit); + assert_eq!(model.origin, ConfigOrigin::PersonaDefault); +} - // Call-site re-tags (simulating had_model == false). - if let Some(ref mut field) = surface.normalized.model { - if field.origin == ConfigOrigin::BuzzExplicit { - field.origin = ConfigOrigin::PersonaDefault; - } - } +#[test] +fn global_model_tier_produces_global_default_origin() { + let record = test_record(); + let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + global_model: Some("global-model".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); let model = surface.normalized.model.unwrap(); - assert_eq!(model.value.as_deref(), Some("persona-model")); - assert_eq!(model.origin, ConfigOrigin::PersonaDefault); + assert_eq!(model.value.as_deref(), Some("global-model")); + assert_eq!(model.origin, ConfigOrigin::GlobalDefault); +} + +#[test] +fn persona_provider_tier_produces_persona_default_origin() { + let record = test_record(); + let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + persona_provider: Some("anthropic".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let provider = surface.normalized.provider.unwrap(); + assert_eq!(provider.value.as_deref(), Some("anthropic")); + assert_eq!(provider.origin, ConfigOrigin::PersonaDefault); } -// ── Runtime override (Phase 3c) ────────────────────────────────────── +#[test] +fn persona_prompt_tier_produces_persona_default_origin() { + let record = test_record(); + let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + persona_prompt: Some("You are a helpful assistant.".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let prompt = surface.normalized.system_prompt.unwrap(); + assert_eq!( + prompt.value.as_deref(), + Some("You are a helpful assistant.") + ); + assert_eq!(prompt.origin, ConfigOrigin::PersonaDefault); +} + +// ── Runtime override (model_overridden gate) ────────────────────────────────── // // A live ModelPicker switch is signalled by `model_overridden: true` in the // `session_config_captured` payload. The reader keys the override-active @@ -321,7 +399,7 @@ fn persona_model_injection_produces_persona_default_origin() { #[test] fn runtime_override_wins_display_when_model_overridden_is_true() { - // Persona-linked agent (record.model == None); persona == "persona-model". + // Persona-linked agent (record.model == None); persona model via tiers. // A live switch pushed "live-model" to the session and set model_overridden. let record = test_record(); let runtime = test_runtime(); @@ -334,29 +412,27 @@ fn runtime_override_wins_display_when_model_overridden_is_true() { goose_native_config: None, captured_at: "".to_string(), }; + let tiers = InheritedConfigTiers { + persona_model: Some("persona-model".to_string()), + ..Default::default() + }; - let surface = read_config_surface( - &record, - Some(runtime), - Some(&cache), - Some(("persona-model", ConfigOrigin::PersonaDefault)), - ); + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &tiers, None); let model = surface.normalized.model.unwrap(); // Override wins the display value with a runtime-override origin. assert_eq!(model.value.as_deref(), Some("live-model")); assert_eq!(model.origin, ConfigOrigin::RuntimeOverride); - // Persona is the secondary value (not struck through — the UI keys off - // the RuntimeOverride origin to suppress strikethrough). + // Persona is the secondary value. assert_eq!(model.overridden_value.as_deref(), Some("persona-model")); assert_eq!(model.overridden_origin, Some(ConfigOrigin::PersonaDefault)); } #[test] fn no_runtime_override_when_model_overridden_is_false() { - // At spawn the session's current_model == persona model (BUZZ_ACP_MODEL - // is set to the persona model) and model_overridden is false. No override; - // the field falls through to normal precedence. + // At spawn the session's current_model == persona model and + // model_overridden is false. No override; field falls through to normal + // precedence. let record = test_record(); let runtime = test_runtime(); let cache = SessionConfigCache { @@ -368,17 +444,15 @@ fn no_runtime_override_when_model_overridden_is_false() { goose_native_config: None, captured_at: "".to_string(), }; + let tiers = InheritedConfigTiers { + persona_model: Some("persona-model".to_string()), + ..Default::default() + }; - let surface = read_config_surface( - &record, - Some(runtime), - Some(&cache), - Some(("persona-model", ConfigOrigin::PersonaDefault)), - ); + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &tiers, None); let model = surface.normalized.model.unwrap(); - // model_overridden is false => the override branch is not taken: origin - // is the normal precedence result, never RuntimeOverride. + // model_overridden is false => the override branch is not taken. assert_ne!(model.origin, ConfigOrigin::RuntimeOverride); assert_eq!(model.value.as_deref(), Some("persona-model")); assert_ne!(model.overridden_origin, Some(ConfigOrigin::PersonaDefault)); @@ -402,106 +476,51 @@ fn no_false_positive_override_when_persona_edited_mid_life() { goose_native_config: None, captured_at: "".to_string(), }; + let tiers = InheritedConfigTiers { + persona_model: Some("new-persona-model".to_string()), + ..Default::default() + }; - let surface = read_config_surface( - &record, - Some(runtime), - Some(&cache), - Some(("new-persona-model", ConfigOrigin::PersonaDefault)), - ); + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &tiers, None); let model = surface.normalized.model.unwrap(); // model_overridden is false => no RuntimeOverride, even though // acp_model != persona_model. The old divergence-based signal would - // have false-positived here. The persona is never surfaced as the - // overridden secondary (that marker is exclusive to a real override). + // have false-positived here. assert_ne!(model.origin, ConfigOrigin::RuntimeOverride); assert_ne!(model.overridden_origin, Some(ConfigOrigin::PersonaDefault)); } -#[test] -fn persona_provider_injection_produces_persona_default_origin() { - let mut record = test_record(); - // Simulate: record has no provider env var, persona provides one. - // The call-site injects it as GOOSE_PROVIDER before calling the reader. - record - .env_vars - .insert("GOOSE_PROVIDER".to_string(), "anthropic".to_string()); - let runtime = test_runtime(); - - let mut surface = read_config_surface(&record, Some(runtime), None, None); - - // Reader sees injected provider as BuzzExplicit. - let provider = surface.normalized.provider.as_ref().unwrap(); - assert_eq!(provider.value.as_deref(), Some("anthropic")); - assert_eq!(provider.origin, ConfigOrigin::BuzzExplicit); - - // Call-site re-tags (simulating had_provider == false). - if let Some(ref mut field) = surface.normalized.provider { - if field.origin == ConfigOrigin::BuzzExplicit { - field.origin = ConfigOrigin::PersonaDefault; - } - } - - let provider = surface.normalized.provider.unwrap(); - assert_eq!(provider.value.as_deref(), Some("anthropic")); - assert_eq!(provider.origin, ConfigOrigin::PersonaDefault); -} - -#[test] -fn persona_system_prompt_injection_produces_persona_default_origin() { - let mut record = test_record(); - // Simulate: record has no system_prompt, persona provides one via env var. - // The call-site injects it as BUZZ_ACP_SYSTEM_PROMPT before calling the reader. - record.env_vars.insert( - "BUZZ_ACP_SYSTEM_PROMPT".to_string(), - "You are a helpful assistant.".to_string(), - ); - let runtime = test_runtime(); - - let mut surface = read_config_surface(&record, Some(runtime), None, None); - - // Reader sees injected prompt as BuzzExplicit. - let prompt = surface.normalized.system_prompt.as_ref().unwrap(); - assert_eq!( - prompt.value.as_deref(), - Some("You are a helpful assistant.") - ); - assert_eq!(prompt.origin, ConfigOrigin::BuzzExplicit); - - // Call-site re-tags (simulating had_prompt == false). - if let Some(ref mut field) = surface.normalized.system_prompt { - if field.origin == ConfigOrigin::BuzzExplicit { - field.origin = ConfigOrigin::PersonaDefault; - } - } - - let prompt = surface.normalized.system_prompt.unwrap(); - assert_eq!( - prompt.value.as_deref(), - Some("You are a helpful assistant.") - ); - assert_eq!(prompt.origin, ConfigOrigin::PersonaDefault); -} +// ── system_prompt builder unit tests ───────────────────────────────────────── #[test] -fn config_file_only_system_prompt_surfaces_as_read_only_config_file_field() { - // Record/env has no prompt; the config file does. It must NOT be - // dropped — it should surface with ConfigFile origin, read-only. - let field = build_system_prompt_field(&None, &Some("File-driven prompt.".to_string())).unwrap(); +fn config_file_only_system_prompt_surfaces_as_config_file_origin() { + // Record/env has no prompt; the config file does. Must surface with + // ConfigFile origin. Write mechanism is always RespawnWithEnvVar for + // system_prompt — the UI writes back via BUZZ_ACP_SYSTEM_PROMPT. + let record = test_record(); + let field = build_system_prompt_field( + &record, + &Some("File-driven prompt.".to_string()), + &no_tiers(), + ) + .unwrap(); assert_eq!(field.value.as_deref(), Some("File-driven prompt.")); assert_eq!(field.origin, ConfigOrigin::ConfigFile); - assert!(matches!(field.write_via, ConfigWriteMechanism::ReadOnly)); + assert!(matches!( + field.write_via, + ConfigWriteMechanism::RespawnWithEnvVar { ref env_key } + if env_key == "BUZZ_ACP_SYSTEM_PROMPT" + )); assert!(field.overridden_value.is_none()); } #[test] fn record_system_prompt_shadows_config_file_prompt_as_secondary() { - let field = build_system_prompt_field( - &Some("Record prompt.".to_string()), - &Some("File prompt.".to_string()), - ) - .unwrap(); + let mut record = test_record(); + record.system_prompt = Some("Record prompt.".to_string()); + let field = + build_system_prompt_field(&record, &Some("File prompt.".to_string()), &no_tiers()).unwrap(); assert_eq!(field.value.as_deref(), Some("Record prompt.")); assert_eq!(field.origin, ConfigOrigin::BuzzExplicit); assert_eq!(field.overridden_value.as_deref(), Some("File prompt.")); @@ -510,19 +529,19 @@ fn record_system_prompt_shadows_config_file_prompt_as_secondary() { #[test] fn no_system_prompt_from_any_tier_yields_none() { - assert!(build_system_prompt_field(&None, &None).is_none()); + let record = test_record(); + assert!(build_system_prompt_field(&record, &None, &no_tiers()).is_none()); } #[test] fn explicit_record_model_not_retagged_when_already_present() { let mut record = test_record(); - // Record already has its own model — persona resolution should NOT re-tag. + // Record already has its own model — origin stays BuzzExplicit. record.model = Some("explicit-model".to_string()); let runtime = test_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); - // had_model == true, so no re-tagging occurs. Origin stays BuzzExplicit. let model = surface.normalized.model.unwrap(); assert_eq!(model.value.as_deref(), Some("explicit-model")); assert_eq!(model.origin, ConfigOrigin::BuzzExplicit); @@ -544,7 +563,7 @@ fn extra_env_vars_appear_in_advanced_as_buzz_explicit() { .insert("SPROUT_ACP_MEMORY".to_string(), "mem-value".to_string()); let runtime = test_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let advanced_keys: Vec<&str> = surface.advanced.iter().map(|f| f.key.as_str()).collect(); assert!( @@ -575,21 +594,15 @@ fn extra_env_vars_appear_in_advanced_as_buzz_explicit() { #[test] fn extra_env_var_skipped_when_already_in_file_config_extra() { - // If a key is in both record.env_vars and file_config.extra, the config - // file entry wins (it was already added to advanced). The env var must - // not produce a second entry. - // - // We can't inject into file_config.extra directly in a unit test (it - // comes from disk), so we verify the dedup logic via the normalized-key - // path: GOOSE_THINKING_EFFORT is a normalized key and must not appear - // in advanced even if set in env_vars. + // If a key is normalized, it must not appear in advanced even if set + // in env_vars. let mut record = test_record(); record .env_vars .insert("GOOSE_THINKING_EFFORT".to_string(), "high".to_string()); let runtime = test_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let advanced_keys: Vec<&str> = surface.advanced.iter().map(|f| f.key.as_str()).collect(); assert!( @@ -598,7 +611,7 @@ fn extra_env_var_skipped_when_already_in_file_config_extra() { ); } -// ── buzz-agent normalized env-var field tests ─────────────────────────────── +// ── buzz-agent normalized env-var field tests ───────────────────────────────── // // buzz-agent uses env vars (not a config file) for max_output_tokens and // context_limit. build_numeric_env_field must surface these as BuzzExplicit @@ -634,6 +647,7 @@ fn buzz_agent_runtime() -> &'static KnownAcpRuntime { thinking_env_var: Some("BUZZ_AGENT_THINKING_EFFORT"), max_tokens_env_var: Some("BUZZ_AGENT_MAX_OUTPUT_TOKENS"), context_limit_env_var: Some("BUZZ_AGENT_MAX_CONTEXT_TOKENS"), + max_rounds_env_var: Some("BUZZ_AGENT_MAX_ROUNDS"), required_normalized_fields: &["model", "provider"], login_hint: None, auth_probe_args: None, @@ -649,7 +663,7 @@ fn buzz_agent_max_output_tokens_from_env_is_buzz_explicit() { ); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let field = surface.normalized.max_output_tokens.unwrap(); assert_eq!(field.value.as_deref(), Some("8192")); @@ -670,7 +684,7 @@ fn buzz_agent_context_limit_from_env_is_buzz_explicit() { ); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let field = surface.normalized.context_limit.unwrap(); assert_eq!(field.value.as_deref(), Some("100000")); @@ -688,7 +702,7 @@ fn buzz_agent_max_tokens_absent_when_no_env_var_or_file() { let record = test_record(); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); assert!( surface.normalized.max_output_tokens.is_none(), @@ -713,7 +727,7 @@ fn buzz_agent_max_tokens_env_var_not_double_surfaced_in_advanced() { ); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let advanced_keys: Vec<&str> = surface.advanced.iter().map(|f| f.key.as_str()).collect(); assert!( @@ -734,7 +748,7 @@ fn buzz_agent_thinking_effort_from_env_is_buzz_explicit() { .insert("BUZZ_AGENT_THINKING_EFFORT".to_string(), "high".to_string()); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let field = surface.normalized.thinking_effort.unwrap(); assert_eq!(field.value.as_deref(), Some("high")); @@ -755,7 +769,7 @@ fn buzz_agent_thinking_effort_env_var_not_double_surfaced_in_advanced() { ); let runtime = buzz_agent_runtime(); - let surface = read_config_surface(&record, Some(runtime), None, None); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); let advanced_keys: Vec<&str> = surface.advanced.iter().map(|f| f.key.as_str()).collect(); assert!( @@ -764,10 +778,20 @@ fn buzz_agent_thinking_effort_env_var_not_double_surfaced_in_advanced() { ); } +// ── provider builder unit tests ─────────────────────────────────────────────── + #[test] fn missing_required_provider_still_returns_dropdown_field() { - let provider = build_provider_field(&None, &None, Some("GOOSE_PROVIDER"), false, true) - .expect("required provider field should be surfaced even when empty"); + let record = test_record(); + let provider = build_provider_field( + &record, + &None, + Some("GOOSE_PROVIDER"), + false, + true, + &no_tiers(), + ) + .expect("required provider field should be surfaced even when empty"); assert_eq!(provider.value, None); assert_eq!(provider.origin, ConfigOrigin::EnvVar); @@ -776,5 +800,159 @@ fn missing_required_provider_still_returns_dropdown_field() { #[test] fn missing_optional_provider_stays_hidden() { - assert!(build_provider_field(&None, &None, Some("GOOSE_PROVIDER"), false, false).is_none()); + let record = test_record(); + assert!(build_provider_field( + &record, + &None, + Some("GOOSE_PROVIDER"), + false, + false, + &no_tiers() + ) + .is_none()); +} + +// ── thinking_effort persona/global tier tests (AC-1..5) ────────────────────── +// +// The plan's acceptance criteria for effort tier resolution. +// Tier ordering: record env > ACP > persona env > global env > config file. + +fn buzz_agent_rt() -> &'static KnownAcpRuntime { + crate::managed_agents::discovery::known_acp_runtime_exact("buzz-agent") + .expect("buzz-agent must be in catalog") +} + +/// AC-1: no record effort, global env has effort → GlobalDefault. +/// Real-world case: global-agent-config has BUZZ_AGENT_THINKING_EFFORT=high, +/// per-agent record has no env_vars → effort must surface with GlobalDefault origin. +#[test] +fn global_effort_surfaces_as_global_default_when_record_has_none() { + let record = test_record(); + let runtime = buzz_agent_rt(); + let tiers = global_env_tiers("BUZZ_AGENT_THINKING_EFFORT", "high"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface from global tier"); + assert_eq!(effort.value.as_deref(), Some("high")); + assert_eq!(effort.origin, ConfigOrigin::GlobalDefault); +} + +/// AC-2: persona env has effort, global also has effort → PersonaDefault wins, shadows global. +#[test] +fn persona_effort_shadows_global_and_tags_persona_default() { + let record = test_record(); + let runtime = buzz_agent_rt(); + let tiers = persona_and_global_env_tiers("BUZZ_AGENT_THINKING_EFFORT", "medium", "high"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface from persona tier"); + assert_eq!(effort.value.as_deref(), Some("medium")); + assert_eq!(effort.origin, ConfigOrigin::PersonaDefault); + // global is the overridden baseline + assert_eq!(effort.overridden_value.as_deref(), Some("high")); + assert_eq!(effort.overridden_origin, Some(ConfigOrigin::GlobalDefault)); } + +/// AC-3: record-level effort wins over persona and global, stays BuzzExplicit. +#[test] +fn record_effort_outranks_persona_and_global_keeps_buzz_explicit() { + let mut record = test_record(); + record.env_vars.insert( + "BUZZ_AGENT_THINKING_EFFORT".to_string(), + "xhigh".to_string(), + ); + let runtime = buzz_agent_rt(); + let tiers = persona_and_global_env_tiers("BUZZ_AGENT_THINKING_EFFORT", "medium", "high"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface from record tier"); + assert_eq!(effort.value.as_deref(), Some("xhigh")); + assert_eq!(effort.origin, ConfigOrigin::BuzzExplicit); +} + +/// AC-4: no effort from any tier → thinking_effort field is absent. +#[test] +fn no_effort_anywhere_yields_no_thinking_effort_field() { + let record = test_record(); + let runtime = buzz_agent_rt(); + + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + + assert!( + surface.normalized.thinking_effort.is_none(), + "thinking_effort must be None when no tier has a value" + ); +} + +/// AC-5 (conflicting-ACP): inherited effort set (global=high) + live ACP effort=low +/// → ACP wins as primary (AcpConfigOption), global is the overridden secondary. +/// +/// The ACP entry uses the real adapter shape: category `thought_level` with an +/// adapter-defined config id (`effort`), NOT category `effort`. +#[test] +fn acp_effort_wins_over_inherited_global_effort_as_secondary() { + let record = test_record(); + let runtime = buzz_agent_rt(); + let cache = SessionConfigCache { + config_options: vec![AcpConfigOptionEntry { + config_id: "effort".to_string(), + category: Some("thought_level".to_string()), + display_name: Some("Effort".to_string()), + current_value: Some("low".to_string()), + options: vec![], + }], + available_modes: vec![], + available_models: vec![], + current_model: None, + model_overridden: false, + goose_native_config: None, + captured_at: "".to_string(), + }; + let tiers = global_env_tiers("BUZZ_AGENT_THINKING_EFFORT", "high"); + + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &tiers, None); + + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface from ACP tier"); + // Live ACP value wins. + assert_eq!(effort.value.as_deref(), Some("low")); + assert_eq!(effort.origin, ConfigOrigin::AcpConfigOption); + // Global is surfaced as the overridden baseline. + assert_eq!(effort.overridden_value.as_deref(), Some("high")); + assert_eq!(effort.overridden_origin, Some(ConfigOrigin::GlobalDefault)); +} + +// ── Numerics inheritance tests ──────────────────────────────────────────────── +// +// max_output_tokens and context_limit gain persona/global tiers. + +#[test] +fn numeric_max_tokens_inherits_from_global_env() { + let record = test_record(); + let runtime = buzz_agent_runtime(); + let tiers = global_env_tiers("BUZZ_AGENT_MAX_OUTPUT_TOKENS", "16384"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let field = surface.normalized.max_output_tokens.unwrap(); + assert_eq!(field.value.as_deref(), Some("16384")); + assert_eq!(field.origin, ConfigOrigin::GlobalDefault); +} + +// ── Extended tests (split file to respect line-count ratchet) ──────────────── +#[path = "reader_tests_ext.rs"] +mod ext; diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests_ext.rs b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests_ext.rs new file mode 100644 index 00000000000..f86793f91a1 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/config_bridge/reader_tests_ext.rs @@ -0,0 +1,520 @@ +//! Additional tests for `config_bridge/reader.rs` — split out to keep +//! `reader_tests.rs` under the 1000-line file-size ratchet. +//! +//! Included as `mod ext` inside `reader_tests.rs`, so `use super::*` gives +//! access to all helpers and types from that module. + +use super::*; + +// ── Numerics inheritance tests ──────────────────────────────────────────────── +// +// max_output_tokens and context_limit gain persona/global tiers. + +#[test] +fn numeric_context_limit_inherits_from_persona_env() { + let record = test_record(); + let runtime = buzz_agent_runtime(); + let tiers = persona_env_tiers("BUZZ_AGENT_MAX_CONTEXT_TOKENS", "200000"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let field = surface.normalized.context_limit.unwrap(); + assert_eq!(field.value.as_deref(), Some("200000")); + assert_eq!(field.origin, ConfigOrigin::PersonaDefault); +} + +#[test] +fn record_max_tokens_overrides_global_env_with_secondary() { + let mut record = test_record(); + record.env_vars.insert( + "BUZZ_AGENT_MAX_OUTPUT_TOKENS".to_string(), + "8192".to_string(), + ); + let runtime = buzz_agent_runtime(); + let tiers = global_env_tiers("BUZZ_AGENT_MAX_OUTPUT_TOKENS", "16384"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let field = surface.normalized.max_output_tokens.unwrap(); + assert_eq!(field.value.as_deref(), Some("8192")); + assert_eq!(field.origin, ConfigOrigin::BuzzExplicit); + // Global value is the overridden secondary. + assert_eq!(field.overridden_value.as_deref(), Some("16384")); + assert_eq!(field.overridden_origin, Some(ConfigOrigin::GlobalDefault)); +} + +// ── Env-vs-structured collision tests (plan v3, Phase 2) ───────────────────── + +/// Collision test 1: persona structured prompt + global env BUZZ_ACP_SYSTEM_PROMPT +/// → global env wins (env block sits entirely above structured). +#[test] +fn global_env_prompt_wins_over_persona_structured_prompt() { + let record = test_record(); + let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + global_env: { + let mut m = BTreeMap::new(); + m.insert( + "BUZZ_ACP_SYSTEM_PROMPT".to_string(), + "global-env-prompt".to_string(), + ); + m + }, + persona_prompt: Some("persona-structured-prompt".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let prompt = surface.normalized.system_prompt.unwrap(); + assert_eq!(prompt.value.as_deref(), Some("global-env-prompt")); + assert_eq!(prompt.origin, ConfigOrigin::GlobalDefault); +} + +/// Collision test 2: structured persona/record model + higher user-env value at +/// the runtime's model key → env value wins. +#[test] +fn persona_env_model_wins_over_persona_structured_model() { + let record = test_record(); // no record.model + let runtime = test_runtime(); // GOOSE_MODEL + let tiers = InheritedConfigTiers { + persona_env: { + let mut m = BTreeMap::new(); + m.insert("GOOSE_MODEL".to_string(), "env-model".to_string()); + m + }, + persona_model: Some("struct-persona-model".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let model = surface.normalized.model.unwrap(); + // persona env outranks persona struct because env candidates precede struct + assert_eq!(model.value.as_deref(), Some("env-model")); + assert_eq!(model.origin, ConfigOrigin::PersonaDefault); +} + +/// Collision test 3: no env representation → structured persona/record/global +/// fallback and provenance remain intact. +#[test] +fn structured_fallback_intact_when_no_env_representation() { + let record = test_record(); // no record.model, no env vars + let runtime = test_runtime(); + let tiers = InheritedConfigTiers { + persona_model: Some("struct-persona-model".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let model = surface.normalized.model.unwrap(); + assert_eq!(model.value.as_deref(), Some("struct-persona-model")); + assert_eq!(model.origin, ConfigOrigin::PersonaDefault); +} + +// ── Post-sanitization fallthrough test ─────────────────────────────────────── +// +// Sanitization itself happens at the command boundary in `build_inherited_tiers` +// (a value with a NUL byte or an oversize value is dropped from the tier) and is +// pinned by the tests in `commands/agent_config_tests.rs`. The reader only ever +// sees the sanitized result, so what it must guarantee is the downstream half: +// a key stripped from one tier falls through to the next. + +/// A key absent from the global env tier — the shape the reader sees after the +/// command boundary strips an invalid value — falls through to the persona tier. +#[test] +fn post_sanitization_empty_global_env_falls_through_to_persona_tier() { + let record = test_record(); + let runtime = buzz_agent_rt(); + // No global env (stripped); persona provides the valid fallback. + let tiers = persona_env_tiers("BUZZ_AGENT_THINKING_EFFORT", "medium"); + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + // Persona value surfaces instead of the stripped global value. + let effort = surface.normalized.thinking_effort.unwrap(); + assert_eq!(effort.value.as_deref(), Some("medium")); + assert_eq!(effort.origin, ConfigOrigin::PersonaDefault); +} + +// ── Pass-3 prompt collision test ───────────────────────────────────────────── +// +// From Thufir's pass-3 verdict MINOR clarification (promoted to required): +// definition-less record with both structured and env prompt — env wins. + +/// Pass-3 clarification: record.system_prompt = A + record env +/// BUZZ_ACP_SYSTEM_PROMPT = B → B wins as BuzzExplicit. +/// The env block sits above the struct block per v3 candidate-preparation +/// contract; current reader semantics (struct before env) would be wrong. +#[test] +fn record_env_prompt_wins_over_record_struct_prompt_as_buzz_explicit() { + let mut record = test_record(); + record.system_prompt = Some("struct-prompt-A".to_string()); + record.env_vars.insert( + "BUZZ_ACP_SYSTEM_PROMPT".to_string(), + "env-prompt-B".to_string(), + ); + let runtime = test_runtime(); + + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + + let prompt = surface.normalized.system_prompt.unwrap(); + assert_eq!(prompt.value.as_deref(), Some("env-prompt-B")); + assert_eq!(prompt.origin, ConfigOrigin::BuzzExplicit); + // Struct prompt is the secondary. + assert_eq!(prompt.overridden_value.as_deref(), Some("struct-prompt-A")); + assert_eq!(prompt.overridden_origin, Some(ConfigOrigin::BuzzExplicit)); +} + +// ── Definition env tier tests (Layer 2b) ───────────────────────────────────── +// +// The harness definition's `env` block sits below global env and above +// structured values in spawn's precedence (Layer 2b). These tests exercise +// the reader's mapping of that tier to `HarnessDefault` origin. + +/// Definition env wins over structured persona model when no user-env or +/// global-env candidate is present. +#[test] +fn definition_env_beats_structured_persona_model() { + let record = test_record(); // no record.model, no record.env_vars + let runtime = test_runtime(); // model_env_var = "GOOSE_MODEL" + let tiers = InheritedConfigTiers { + definition_env: { + let mut m = BTreeMap::new(); + m.insert("GOOSE_MODEL".to_string(), "harness-model".to_string()); + m + }, + persona_model: Some("persona-struct-model".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let model = surface.normalized.model.unwrap(); + assert_eq!(model.value.as_deref(), Some("harness-model")); + assert_eq!(model.origin, ConfigOrigin::HarnessDefault); + // Structured persona model is the overridden secondary. + assert_eq!( + model.overridden_value.as_deref(), + Some("persona-struct-model") + ); + assert_eq!(model.overridden_origin, Some(ConfigOrigin::PersonaDefault)); +} + +/// Global env beats definition env — user-settable tiers always win over the +/// harness author's defaults. +#[test] +fn global_env_beats_definition_env() { + let record = test_record(); + let runtime = test_runtime(); // model_env_var = "GOOSE_MODEL" + let tiers = InheritedConfigTiers { + global_env: { + let mut m = BTreeMap::new(); + m.insert("GOOSE_MODEL".to_string(), "global-model".to_string()); + m + }, + definition_env: { + let mut m = BTreeMap::new(); + m.insert("GOOSE_MODEL".to_string(), "harness-model".to_string()); + m + }, + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let model = surface.normalized.model.unwrap(); + assert_eq!(model.value.as_deref(), Some("global-model")); + assert_eq!(model.origin, ConfigOrigin::GlobalDefault); + // Harness default is the overridden secondary. + assert_eq!(model.overridden_value.as_deref(), Some("harness-model")); + assert_eq!(model.overridden_origin, Some(ConfigOrigin::HarnessDefault)); +} + +/// A reserved key in the definition env is stripped by sanitization and must +/// not reach the reader. This test exercises the reader's contract (a key +/// absent from the tier falls through) — sanitization itself is pinned in +/// the `agent_config_tests.rs` constructor tests. +#[test] +fn reserved_key_absent_from_definition_env_falls_through() { + let record = test_record(); + let runtime = test_runtime(); // model_env_var = "GOOSE_MODEL" + // definition_env contains only an unrelated key — the env map here is what + // the command boundary would produce after stripping a reserved key; the + // reader must fall through to the next tier (persona structured model). + let tiers = InheritedConfigTiers { + definition_env: BTreeMap::new(), // stripped — nothing survives + persona_model: Some("persona-struct-model".to_string()), + ..Default::default() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &tiers, None); + + let model = surface.normalized.model.unwrap(); + // Falls through to persona structured model. + assert_eq!(model.value.as_deref(), Some("persona-struct-model")); + assert_eq!(model.origin, ConfigOrigin::PersonaDefault); +} + +// ── B4/B5 canonical effort_level tier tests ──────────────────────────────── +// +// record.effort_level is the Buzz-canonical seeded value (the effort a spawn +// applies at next session start via `apply_effort_env`). It must surface as +// BuzzExplicit and take precedence over the config-file tier, but not over a +// record env var override. + +/// B4: record.effort_level surfaces as BuzzExplicit when no env var is set. +#[test] +fn b4_canonical_effort_level_surfaces_as_buzz_explicit() { + let mut record = test_record(); + record.effort_level = Some("high".to_string()); + let runtime = buzz_agent_runtime(); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface from canonical record tier"); + assert_eq!(effort.value.as_deref(), Some("high")); + assert_eq!(effort.origin, ConfigOrigin::BuzzExplicit); +} + +/// B4: record.effort_level shadows the config-file tier. +#[test] +fn b4_canonical_effort_level_shadows_file_tier() { + let mut record = test_record(); + record.effort_level = Some("medium".to_string()); + // No env var set — the config-file tier would win if canonical were absent. + let runtime = buzz_agent_runtime(); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + let effort = surface + .normalized + .thinking_effort + .expect("canonical effort must shadow file tier"); + assert_eq!(effort.value.as_deref(), Some("medium")); + assert_eq!(effort.origin, ConfigOrigin::BuzzExplicit); +} + +/// B4: a record env var override still wins over record.effort_level, which +/// becomes the overridden baseline. +#[test] +fn b4_record_env_var_wins_over_canonical_effort_level() { + let mut record = test_record(); + record.effort_level = Some("low".to_string()); + record + .env_vars + .insert("BUZZ_AGENT_THINKING_EFFORT".to_string(), "high".to_string()); + let runtime = buzz_agent_runtime(); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + let effort = surface + .normalized + .thinking_effort + .expect("env var must win over canonical effort"); + assert_eq!(effort.value.as_deref(), Some("high")); + assert_eq!(effort.origin, ConfigOrigin::BuzzExplicit); + assert_eq!(effort.overridden_value.as_deref(), Some("low")); +} + +/// B4: None effort_level does not introduce a spurious tier. +#[test] +fn b4_none_canonical_effort_does_not_surface() { + let record = test_record(); // effort_level defaults to None + let runtime = buzz_agent_runtime(); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + assert!( + surface.normalized.thinking_effort.is_none(), + "effort field must be absent when no tier has a value" + ); +} + +// ── CLAUDE_CONFIG_DIR path resolution (#3493) ───────────────────────────────── + +#[test] +fn claude_mcp_config_path_honors_custom_claude_config_dir() { + // #3493: mcp_config_file_path_for_runtime must use the custom dir when + // claude_config_dir is Some, not fall back to ~/.claude.json. + let record = test_record(); + let runtime = &KnownAcpRuntime { + id: "claude", + config_file_path: Some("~/.claude/settings.json"), + ..*test_runtime() + }; + let custom_dir = std::path::PathBuf::from("/custom/config/dir"); + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), Some(&custom_dir)); + + let mcp_path = surface + .sources + .mcp_config_file_path + .expect("mcp_config_file_path must be present for claude runtime"); + assert_eq!( + std::path::Path::new(&mcp_path), + custom_dir.join(".claude.json"), + "mcp config path must be /.claude.json when CLAUDE_CONFIG_DIR is set" + ); + assert!( + surface.claude_config_dir_custom, + "claude_config_dir_custom must be true when a custom dir was passed" + ); +} + +#[test] +fn claude_config_dir_none_falls_back_to_home_claude_json() { + // #3493: None (i.e. the caller stripped an empty string) must resolve to + // the default ~/.claude.json path, matching Claude's `CLAUDE_CONFIG_DIR || homedir()`. + let record = test_record(); + let runtime = &KnownAcpRuntime { + id: "claude", + config_file_path: Some("~/.claude/settings.json"), + ..*test_runtime() + }; + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + assert!( + !surface.claude_config_dir_custom, + "claude_config_dir_custom must be false when dir is None (unset)" + ); + assert!( + surface + .sources + .mcp_config_file_path + .as_deref() + .is_some_and(|p| p.ends_with(".claude.json")), + "mcp path must fall back to ~/.claude.json when no custom dir" + ); +} + +/// F1 regression: the effort control is selected by its `thought_level` category, +/// and the running value, the write config id, and the picker options all derive +/// from that single entry — even when the adapter's config id is a nonliteral +/// value and differs from the canonical (configured) effort. +/// +/// Live shape: `id="thinking-level", category="thought_level", currentValue="default"` +/// while canonical `record.effort_level=high`. Both facts must render: configured +/// `high` as the value and running `default` as the overridden secondary; the +/// write mechanism must carry the adapter's real id, never a hardcoded `"effort"`. +#[test] +fn effort_option_selected_by_category_drives_all_facts() { + let mut record = test_record(); + record.effort_level = Some("high".to_string()); + let runtime = buzz_agent_rt(); + let cache = SessionConfigCache { + config_options: vec![AcpConfigOptionEntry { + config_id: "thinking-level".to_string(), + category: Some("thought_level".to_string()), + display_name: Some("Thinking level".to_string()), + current_value: Some("default".to_string()), + options: vec![ + AcpConfigOptionValue { + value: "default".to_string(), + display_name: Some("Default".to_string()), + }, + AcpConfigOptionValue { + value: "high".to_string(), + display_name: Some("High".to_string()), + }, + ], + }], + available_modes: vec![], + available_models: vec![], + current_model: None, + model_overridden: false, + goose_native_config: None, + captured_at: "".to_string(), + }; + let tiers = InheritedConfigTiers::default(); + + let surface = read_config_surface(&record, Some(runtime), Some(&cache), &tiers, None); + + // Two-facts display: configured `high` wins, running `default` is the secondary. + let effort = surface + .normalized + .thinking_effort + .expect("effort must surface with both configured and running facts"); + assert_eq!(effort.value.as_deref(), Some("high")); + assert_eq!(effort.origin, ConfigOrigin::BuzzExplicit); + assert_eq!(effort.overridden_value.as_deref(), Some("default")); + assert_eq!( + effort.overridden_origin, + Some(ConfigOrigin::AcpConfigOption) + ); + + // Write mechanism carries the adapter's real id, never a hardcoded "effort". + match &effort.write_via { + ConfigWriteMechanism::AcpSetConfigOption { config_id } => { + assert_eq!(config_id, "thinking-level"); + } + other => panic!("expected AcpSetConfigOption with adapter id, got {other:?}"), + } + + // Picker metadata derives from the same entry. + assert_eq!(surface.effort_config_id.as_deref(), Some("thinking-level")); + assert_eq!( + surface + .effort_options + .iter() + .map(|o| o.value.as_str()) + .collect::>(), + vec!["default", "high"], + ); +} + +// ── #3493: config_file_path follows a custom CLAUDE_CONFIG_DIR ───────────────── + +#[test] +fn claude_custom_config_dir_reports_isolated_settings_path() { + let record = test_record(); + let runtime = &KnownAcpRuntime { + id: "claude", + config_file_path: Some("~/.claude/settings.json"), + ..*test_runtime() + }; + let custom = std::path::Path::new("/tmp/iso-config"); + + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), Some(custom)); + + // The reported settings path is rooted at the custom dir the reader used, + // not the static ~/.claude/settings.json metadata. Compare as paths so the + // separator is native (Windows joins with `\`, not `/`). + assert_eq!( + surface + .sources + .config_file_path + .as_deref() + .map(std::path::Path::new), + Some(custom.join("settings.json").as_path()), + ); + // And the MCP file attribution follows the same custom root. + assert_eq!( + surface + .sources + .mcp_config_file_path + .as_deref() + .map(std::path::Path::new), + Some(custom.join(".claude.json").as_path()), + ); +} + +#[test] +fn claude_default_config_dir_reports_static_settings_path() { + let record = test_record(); + let runtime = &KnownAcpRuntime { + id: "claude", + config_file_path: Some("~/.claude/settings.json"), + ..*test_runtime() + }; + + let surface = read_config_surface(&record, Some(runtime), None, &no_tiers(), None); + + // With no custom dir, the settings path resolves the static tilde metadata. + // Compare the trailing components as a path so the check is separator-native. + assert!(surface + .sources + .config_file_path + .as_deref() + .map(std::path::Path::new) + .is_some_and(|p| p.ends_with(".claude/settings.json"))); + assert!(surface + .sources + .config_file_path + .as_deref() + .is_some_and(|p| !p.starts_with('~'))); +} diff --git a/desktop/src-tauri/src/managed_agents/config_bridge/types.rs b/desktop/src-tauri/src/managed_agents/config_bridge/types.rs index 15ccb718e7f..d96736fb69c 100644 --- a/desktop/src-tauri/src/managed_agents/config_bridge/types.rs +++ b/desktop/src-tauri/src/managed_agents/config_bridge/types.rs @@ -2,6 +2,41 @@ use std::collections::BTreeMap; use serde::{Deserialize, Serialize}; +/// Sanitized inherited config tiers passed to the reader. +/// +/// Built at the `agent_config` command boundary with spawn-equivalent +/// sanitization: reserved, malformed, NUL-value, and oversize-value env keys +/// are stripped (matching `merged_user_env`). Structured fields are +/// normalized: blank/whitespace-only values collapse to `None`. +/// +/// Orphaned persona links (persona_id references a missing persona) produce +/// an empty persona env tier and `None` for all structured persona fields — +/// the panel still renders from record/global. This diverges deliberately from +/// spawn's `OrphanedInstance` refusal, which is a spawn-safety property the +/// display surface does not need to enforce. +#[derive(Debug, Clone, Default)] +pub struct InheritedConfigTiers { + /// Sanitized env vars from the linked persona definition. + pub persona_env: BTreeMap, + /// Sanitized env vars from the global agent config. + pub global_env: BTreeMap, + /// Sanitized env vars from the resolved harness definition (`HarnessDefinition::env`). + /// Sits below global env and above structured values, matching spawn Layer 2b. + /// Empty for preset harnesses (all shipped presets have `env: {}`); only + /// user-authored custom harness JSONs with a non-empty `env` block contribute here. + pub definition_env: BTreeMap, + /// Structured model from the linked persona (non-blank only). + pub persona_model: Option, + /// Structured provider from the linked persona (non-blank only). + pub persona_provider: Option, + /// Structured system_prompt from the linked persona (non-blank only). + pub persona_prompt: Option, + /// Structured model from global config (non-blank only). + pub global_model: Option, + /// Structured provider from global config (non-blank only). + pub global_provider: Option, +} + /// Where a config value came from — determines precedence and UI annotations. #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] #[serde(rename_all = "camelCase")] @@ -17,14 +52,12 @@ pub enum ConfigOrigin { /// Read from harness config file on disk (tier 2b, lowest precedence). ConfigFile, /// Value inherited from persona defaults. - /// Populated by the `get_agent_config_surface` call site: persona values are - /// resolved before calling the reader, then the surface is post-processed to - /// re-tag injected fields from `BuzzExplicit` to `PersonaDefault`. + /// Populated when a persona's env var or structured field wins for this + /// field in the reader's candidate resolution. PersonaDefault, /// Value inherited from global agent configuration defaults. /// The lowest user-settable layer — active when neither the agent record nor - /// the linked persona specifies a value. Re-tagged from `BuzzExplicit` by the - /// `resolve_config_surface` call site, analogously to `PersonaDefault`. + /// the linked persona specifies a value. GlobalDefault, /// Live runtime model override applied via the ModelPicker (Phase 3). /// The ACP session's current model diverges from the persona model because @@ -35,11 +68,29 @@ pub enum ConfigOrigin { /// env var. E.g. Claude Code only supports Anthropic as a provider; the /// "locked" display is synthesized by the config bridge, not read from disk. HarnessConstraint, + /// Value comes from a custom harness definition's `env` block. + /// Sits below global env and above structured persona/global values, + /// matching spawn Layer 2b. Only reachable for user-authored custom harness + /// JSONs with a non-empty `env` block; preset harnesses always have empty env. + HarnessDefault, } /// How a config field can be written back to the runtime. +/// +/// `rename_all_fields` is load-bearing, not decoration: on an internally +/// tagged enum `rename_all` renames the *variants*, never the variants' +/// fields, so without it `RespawnWithEnvVar` serializes as +/// `{"type":"respawnWithEnvVar","env_key":"…"}` while +/// `desktop/src/shared/api/types.ts` declares `envKey`. `invokeTauri` is an +/// unchecked cast, so `tsc` cannot see the mismatch — the reader just gets +/// `undefined`. `wire_format_matches_typescript_contract` below pins the exact +/// bytes. #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] -#[serde(tag = "type", rename_all = "camelCase")] +#[serde( + tag = "type", + rename_all = "camelCase", + rename_all_fields = "camelCase" +)] pub enum ConfigWriteMechanism { /// Update record env vars, save, stop + restart agent. RespawnWithEnvVar { env_key: String }, @@ -137,6 +188,25 @@ pub struct RuntimeConfigSurface { pub advanced: Vec, pub extensions: Vec, pub sources: ConfigSourceReport, + /// #3493: `true` when the panel is reading from a user-set `CLAUDE_CONFIG_DIR` + /// rather than the default `~/.claude/`. Used to show the Keychain caveat + /// note in the panel: a custom config dir means a fresh Keychain namespace + /// (hash-suffixed), so the agent will be logged out unless the user also + /// manages `CLAUDE_SECURESTORAGE_CONFIG_DIR`. + #[serde(default)] + pub claude_config_dir_custom: bool, + /// B5: the real `configId` for the `thought_level` ACP config option, + /// as advertised by the adapter in `session/new`. Present only for claude + /// runtimes after the first session is created. The UI uses this to send + /// `set_config_option` without hardcoding the configId. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub effort_config_id: Option, + /// B5/I-7: the adapter-advertised option values for the `thought_level` + /// config option. Present when `effort_config_id` is Some. The UI renders + /// these instead of hardcoded low/medium/high so model-specific option sets + /// are reflected correctly. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub effort_options: Vec, } /// Raw config values extracted from a runtime's config file. @@ -206,3 +276,105 @@ pub struct AcpModelEntry { pub name: Option, pub description: Option, } + +#[cfg(test)] +mod wire_format_tests { + use super::*; + use serde_json::json; + + /// Every `ConfigWriteMechanism` variant, as `desktop/src/shared/api/types.ts` + /// declares it. Whole-value comparison, not a key-set check: a key-set + /// assertion still passes if the variant *name* regresses, and the `type` + /// discriminant is what every `switch (writeVia.type)` reads. Compared as + /// `serde_json::Value` rather than as text, because JSON object order is + /// not semantic and the contract is the keys and values, not the encoder's + /// field order. + #[test] + fn wire_format_matches_typescript_contract() { + let cases = [ + ( + ConfigWriteMechanism::RespawnWithEnvVar { + env_key: "GOOSE_MODE".into(), + }, + json!({"type": "respawnWithEnvVar", "envKey": "GOOSE_MODE"}), + ), + ( + ConfigWriteMechanism::AcpSetConfigOption { + config_id: "model".into(), + }, + json!({"type": "acpSetConfigOption", "configId": "model"}), + ), + ( + ConfigWriteMechanism::AcpSetSessionModel, + json!({"type": "acpSetSessionModel"}), + ), + ( + ConfigWriteMechanism::GooseNativeConfigWrite { + config_key: "goose.model".into(), + }, + json!({"type": "gooseNativeConfigWrite", "configKey": "goose.model"}), + ), + (ConfigWriteMechanism::ReadOnly, json!({"type": "readOnly"})), + ]; + for (mechanism, expected) in cases { + assert_eq!( + serde_json::to_value(&mechanism).expect("serialize"), + expected + ); + } + } + + /// The renderer never sees a bare mechanism — it arrives nested inside + /// `NormalizedField`, which is where the mismatch used to hide: the + /// enclosing struct's `writeVia` / `overriddenValue` / `isRequired` all + /// renamed correctly, so only the variant's own field was snake_case. + #[test] + fn nested_field_is_camel_case_all_the_way_down() { + let field = NormalizedField { + value: Some("v".into()), + origin: ConfigOrigin::EnvVar, + write_via: ConfigWriteMechanism::RespawnWithEnvVar { + env_key: "GOOSE_MODE".into(), + }, + overridden_value: Some("o".into()), + overridden_origin: Some(ConfigOrigin::ConfigFile), + is_required: true, + }; + assert_eq!( + serde_json::to_value(&field).expect("serialize"), + json!({ + "value": "v", + "origin": "envVar", + "writeVia": {"type": "respawnWithEnvVar", "envKey": "GOOSE_MODE"}, + "overriddenValue": "o", + "overriddenOrigin": "configFile", + "isRequired": true, + }) + ); + } + + /// The contract is singular: the shape the renderer sends back round-trips, + /// and the old snake_case spelling is no longer accepted. Without the + /// second half, a future revert would still deserialize and the read path + /// would look healthy. + #[test] + fn camel_case_round_trips_and_snake_case_is_rejected() { + let parsed: ConfigWriteMechanism = + serde_json::from_str(r#"{"type":"respawnWithEnvVar","envKey":"GOOSE_MODE"}"#) + .expect("the TypeScript shape must deserialize"); + assert_eq!( + parsed, + ConfigWriteMechanism::RespawnWithEnvVar { + env_key: "GOOSE_MODE".into(), + } + ); + + assert!( + serde_json::from_str::( + r#"{"type":"respawnWithEnvVar","env_key":"GOOSE_MODE"}"# + ) + .is_err(), + "the pre-fix snake_case spelling must not be accepted" + ); + } +} diff --git a/desktop/src-tauri/src/managed_agents/custom_harnesses.rs b/desktop/src-tauri/src/managed_agents/custom_harnesses.rs index e6bc09496ca..ba0448beaff 100644 --- a/desktop/src-tauri/src/managed_agents/custom_harnesses.rs +++ b/desktop/src-tauri/src/managed_agents/custom_harnesses.rs @@ -268,7 +268,7 @@ pub(crate) fn registry_test_lock() -> std::sync::MutexGuard<'static, ()> { /// Thread-safe registry of non-builtin (preset + custom) harness definitions, /// populated on every `discover_acp_runtimes_from` call and queried at spawn time. -fn loaded_harness_registry() -> &'static RwLock>> { +pub(super) fn loaded_harness_registry() -> &'static RwLock>> { use std::sync::OnceLock; static REGISTRY: OnceLock>>> = OnceLock::new(); REGISTRY.get_or_init(|| RwLock::new(Vec::new())) diff --git a/desktop/src-tauri/src/managed_agents/definition_validation.rs b/desktop/src-tauri/src/managed_agents/definition_validation.rs new file mode 100644 index 00000000000..92445604d2e --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/definition_validation.rs @@ -0,0 +1,270 @@ +//! Validation for human-reviewed agent definition text. +//! +//! Shared definitions are executable configuration: `system_prompt` is shown +//! to a person, then delivered verbatim to an ACP harness. Characters that +//! consume input bytes without a visible glyph break that review invariant and +//! are rejected rather than silently stripped. + +use regex::Regex; +use std::sync::LazyLock; + +const MAX_DISPLAY_NAME_CHARS: usize = 128; +const MAX_SYSTEM_PROMPT_BYTES: usize = 64 * 1024; +const EMOJI_VARIATION_SELECTOR: char = '\u{FE0F}'; +const ZERO_WIDTH_JOINER: char = '\u{200D}'; + +static EXTENDED_PICTOGRAPHIC: LazyLock> = + LazyLock::new(|| Regex::new(r"^\p{Extended_Pictographic}$").ok()); + +/// Validate the human-visible fields of an agent definition. +pub(crate) fn validate_agent_definition_text( + display_name: &str, + system_prompt: &str, +) -> Result<(), String> { + if display_name.trim().is_empty() { + return Err("Display name is required".to_string()); + } + let display_name_chars = display_name.chars().count(); + if display_name_chars > MAX_DISPLAY_NAME_CHARS { + return Err(format!( + "Display name is too long ({display_name_chars} characters, max {MAX_DISPLAY_NAME_CHARS})" + )); + } + if system_prompt.len() > MAX_SYSTEM_PROMPT_BYTES { + return Err(format!( + "Agent instructions are too long ({} bytes, max {MAX_SYSTEM_PROMPT_BYTES})", + system_prompt.len() + )); + } + + validate_visible_text(display_name, "Display name", false)?; + validate_visible_text(system_prompt, "Agent instructions", true) +} + +/// Validate the human-reviewed definition text carried by a managed agent. +/// +/// Definition-linked agents resolve their executable prompt through the +/// separately validated persona, so only their instance name is checked here. +/// Definition-less agents carry their executable prompt directly and must +/// validate both fields at every local, inbound, and publication boundary. +pub(crate) fn validate_managed_agent_definition_text( + name: &str, + persona_id: Option<&str>, + system_prompt: Option<&str>, +) -> Result<(), String> { + let executable_prompt = if persona_id.is_none() { + system_prompt.unwrap_or_default() + } else { + "" + }; + validate_agent_definition_text(name, executable_prompt) +} + +fn validate_visible_text( + value: &str, + label: &str, + allow_layout_controls: bool, +) -> Result<(), String> { + let characters = value.chars().collect::>(); + for (index, &character) in characters.iter().enumerate() { + let allowed_layout_control = allow_layout_controls && matches!(character, '\n' | '\t'); + let allowed_emoji_format = is_allowed_emoji_format(&characters, index); + if (!allowed_layout_control && character.is_control()) + || (is_default_ignorable(character) && !allowed_emoji_format) + { + return Err(format!( + "{label} contains prohibited invisible or formatting character U+{:04X}", + character as u32 + )); + } + } + Ok(()) +} + +fn is_allowed_emoji_format(characters: &[char], index: usize) -> bool { + match characters[index] { + EMOJI_VARIATION_SELECTOR => index + .checked_sub(1) + .and_then(|previous| characters.get(previous)) + .is_some_and(|&character| is_emoji_variation_base(character)), + ZERO_WIDTH_JOINER => { + has_preceding_emoji_base(characters, index) + && characters + .get(index + 1) + .is_some_and(|&character| is_extended_pictographic(character)) + } + _ => false, + } +} + +fn has_preceding_emoji_base(characters: &[char], index: usize) -> bool { + let mut previous = index.checked_sub(1); + while let Some(previous_index) = previous { + let character = characters[previous_index]; + if character != EMOJI_VARIATION_SELECTOR && !is_emoji_modifier(character) { + return is_extended_pictographic(character); + } + previous = previous_index.checked_sub(1); + } + false +} + +fn is_emoji_variation_base(character: char) -> bool { + matches!(character, '#' | '*' | '0'..='9') || is_extended_pictographic(character) +} + +fn is_emoji_modifier(character: char) -> bool { + matches!(character as u32, 0x1F3FB..=0x1F3FF) +} + +fn is_extended_pictographic(character: char) -> bool { + let mut encoded = [0; 4]; + let character = character.encode_utf8(&mut encoded); + EXTENDED_PICTOGRAPHIC + .as_ref() + .is_some_and(|pattern| pattern.is_match(character)) +} + +/// Unicode `Default_Ignorable_Code_Point` ranges (DerivedCoreProperties). +/// +/// Joiners and variation selectors remain in this set. The validation pass +/// makes a narrow contextual exception for rendered emoji composition while +/// rejecting detached instances and every other default-ignorable character. +fn is_default_ignorable(character: char) -> bool { + matches!( + character as u32, + 0x00AD + | 0x034F + | 0x061C + | 0x115F..=0x1160 + | 0x17B4..=0x17B5 + | 0x180B..=0x180F + | 0x200B..=0x200F + | 0x202A..=0x202E + | 0x2060..=0x206F + | 0x3164 + | 0xFE00..=0xFE0F + | 0xFEFF + | 0xFFA0 + | 0xFFF0..=0xFFF8 + | 0x1BCA0..=0x1BCA3 + | 0x1D173..=0x1D17A + | 0xE0000..=0xE0FFF + ) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn accepts_plain_multiline_instructions() { + assert!(validate_agent_definition_text( + "Code Reviewer 🐝", + "Review changes.\n\tCall out security risks." + ) + .is_ok()); + } + + #[test] + fn accepts_rendered_emoji_sequences_in_names_and_prompts() { + for emoji in ["❤️", "☕️", "👩‍💻", "🧑🏽‍💻", "👨‍👩‍👧‍👦", "1️⃣"] + { + assert!(validate_agent_definition_text( + &format!("Reviewer {emoji}"), + &format!("Review changes {emoji}") + ) + .is_ok()); + } + } + + #[test] + fn rejects_default_ignorable_characters_in_name_or_prompt() { + for character in [ + '\u{00AD}', + '\u{034F}', + '\u{200B}', + '\u{202E}', + '\u{2060}', + '\u{2066}', + '\u{3164}', + '\u{E007F}', + ] { + let name = format!("Review{character}er"); + let prompt = format!("Review code.{character}"); + assert!(validate_agent_definition_text(&name, "Review code.").is_err()); + assert!(validate_agent_definition_text("Reviewer", &prompt).is_err()); + } + } + + #[test] + fn rejects_detached_or_text_embedded_emoji_formatting() { + for value in [ + "Review\u{FE0F}er", + "Review\u{200D}er", + "Review code.\u{200D}", + ] { + assert!(validate_agent_definition_text(value, "Review code.").is_err()); + assert!(validate_agent_definition_text("Reviewer", value).is_err()); + } + } + + #[test] + fn rejects_emoji_tag_sequences() { + let tagged_flag = "\u{1F3F4}\u{E0067}\u{E0062}\u{E0073}\u{E0063}\u{E0074}\u{E007F}"; + assert!( + validate_agent_definition_text(&format!("Reviewer {tagged_flag}"), "Review code.") + .is_err() + ); + assert!( + validate_agent_definition_text("Reviewer", &format!("Review code. {tagged_flag}")) + .is_err() + ); + } + + #[test] + fn rejects_non_layout_control_characters() { + for character in ['\0', '\r', '\u{0007}', '\u{0085}'] { + let prompt = format!("Review{character}code"); + assert!(validate_agent_definition_text("Reviewer", &prompt).is_err()); + } + } + + #[test] + fn enforces_display_name_and_prompt_bounds() { + assert!(validate_agent_definition_text(&"a".repeat(129), "prompt").is_err()); + assert!(validate_agent_definition_text("Reviewer", &"a".repeat(64 * 1024 + 1)).is_err()); + } + + #[test] + fn definition_less_managed_agent_validates_its_own_name_and_prompt() { + assert!(validate_managed_agent_definition_text( + "Review\u{200B}er", + None, + Some("Review code."), + ) + .is_err()); + assert!(validate_managed_agent_definition_text( + "Reviewer", + None, + Some("Review\u{200B} code."), + ) + .is_err()); + assert!(validate_managed_agent_definition_text( + "Reviewer 🐝", + None, + Some("Review changes.\n\tCall out risks."), + ) + .is_ok()); + } + + #[test] + fn definition_linked_managed_agent_ignores_inert_record_prompt() { + assert!(validate_managed_agent_definition_text( + "Reviewer", + Some("custom:reviewer"), + Some("stale\u{200B} prompt"), + ) + .is_ok()); + } +} diff --git a/desktop/src-tauri/src/managed_agents/discovery.rs b/desktop/src-tauri/src/managed_agents/discovery.rs index 8d1b8a5013a..78592357c9b 100644 --- a/desktop/src-tauri/src/managed_agents/discovery.rs +++ b/desktop/src-tauri/src/managed_agents/discovery.rs @@ -9,12 +9,23 @@ use crate::managed_agents::{ AcpAvailabilityStatus, AcpRuntimeCatalogEntry, AuthStatus, CommandAvailabilityInfo, HarnessSource, }; - +mod auth_status_cache; +mod login_shell; mod presets; mod runtime_metadata; - +#[macro_use] +mod windows_install; +pub use login_shell::{find_nvm_default_bin, login_shell_path}; +pub(crate) use login_shell::{find_via_login_shell, refresh_login_shell_path}; +#[cfg(test)] +pub(crate) use login_shell::{ + is_login_shell_path_uninit, is_safe_nvm_tag, login_shell_candidates, parse_semver_tag, +}; +pub(crate) use presets::{ + canonical_harness_command, command_for_runtime_id, preset_harness_definitions, + preset_harness_ids, +}; use presets::{preset_catalog_entry, PRESET_HARNESSES}; -pub(crate) use presets::{preset_harness_definitions, preset_harness_ids}; pub(crate) use runtime_metadata::KnownAcpRuntime; const GOOSE_AVATAR_URL: &str = "https://goose-docs.ai/img/logo_dark.png"; @@ -85,7 +96,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ cli_install_commands: &["curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash"], // Goose's stable release currently publishes only the Unix installer; // its official Windows instructions intentionally point at this main-branch script. - cli_install_commands_windows: &["powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"$env:CONFIGURE='false'; irm https://raw.githubusercontent.com/aaif-goose/goose/main/download_cli.ps1 | iex\""], + cli_install_commands_windows: &[windows_install_command!("goose", "https://raw.githubusercontent.com/aaif-goose/goose/main/download_cli.ps1", "$env:CONFIGURE='false'; ")], adapter_install_commands: &[], cli_install_instructions_url: "https://goose-docs.ai/docs/getting-started/installation/", adapter_install_instructions_url: "", @@ -103,6 +114,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ thinking_env_var: Some("GOOSE_THINKING_EFFORT"), max_tokens_env_var: Some("GOOSE_MAX_TOKENS"), context_limit_env_var: Some("GOOSE_CONTEXT_LIMIT"), + max_rounds_env_var: None, required_normalized_fields: &["model", "provider"], login_hint: None, auth_probe_args: None, @@ -117,7 +129,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ mcp_hooks: false, underlying_cli: Some("claude"), cli_install_commands: &["curl -fsSL https://claude.ai/install.sh | bash"], - cli_install_commands_windows: &["powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"irm https://claude.ai/install.ps1 | iex\""], + cli_install_commands_windows: &[windows_install_command!("claude", "https://claude.ai/install.ps1")], adapter_install_commands: &["npm install -g @agentclientprotocol/claude-agent-acp"], cli_install_instructions_url: "https://code.claude.com/docs/en/getting-started", adapter_install_instructions_url: "https://github.com/agentclientprotocol/claude-agent-acp", @@ -135,6 +147,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ thinking_env_var: None, max_tokens_env_var: None, context_limit_env_var: None, + max_rounds_env_var: None, required_normalized_fields: &[], login_hint: Some("Run the Claude CLI to complete authentication."), auth_probe_args: Some(&["claude", "auth", "status"]), @@ -149,7 +162,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ mcp_hooks: false, underlying_cli: Some("codex"), cli_install_commands: &["curl -fsSL https://chatgpt.com/codex/install.sh | sh"], - cli_install_commands_windows: &["powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"irm https://chatgpt.com/codex/install.ps1 | iex\""], + cli_install_commands_windows: &[windows_install_command!("codex", "https://chatgpt.com/codex/install.ps1")], adapter_install_commands: &["npm install -g @agentclientprotocol/codex-acp"], cli_install_instructions_url: "https://developers.openai.com/codex/cli/", adapter_install_instructions_url: "https://github.com/agentclientprotocol/codex-acp", @@ -167,6 +180,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ thinking_env_var: None, max_tokens_env_var: None, context_limit_env_var: None, + max_rounds_env_var: None, required_normalized_fields: &[], login_hint: Some("Run `codex login` to authenticate."), // Verified: `codex login status` exits 0 when logged in, non-zero otherwise. @@ -200,6 +214,7 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[ thinking_env_var: Some("BUZZ_AGENT_THINKING_EFFORT"), max_tokens_env_var: Some("BUZZ_AGENT_MAX_OUTPUT_TOKENS"), context_limit_env_var: Some("BUZZ_AGENT_MAX_CONTEXT_TOKENS"), + max_rounds_env_var: Some("BUZZ_AGENT_MAX_ROUNDS"), required_normalized_fields: &["model", "provider"], login_hint: None, auth_probe_args: None, @@ -229,7 +244,7 @@ fn executable_basename(command: &str) -> String { } } -fn normalize_command_identity(command: &str) -> String { +pub(crate) fn normalize_command_identity(command: &str) -> String { let normalized = command.trim().replace('\\', "/"); let basename = normalized.rsplit('/').next().unwrap_or(normalized.as_str()); let lower = basename @@ -278,11 +293,8 @@ pub(crate) fn known_acp_runtime_exact(id: &str) -> Option<&'static KnownAcpRunti /// The agent command a freshly-created agent defaults to when the create /// request supplies none. Resolves the bundled `buzz-agent` from the catalog so /// the default cannot drift from the provider definition. Falls back to the id -/// if the catalog entry is missing. -/// -/// The previous default was the bare global `goose`, which is not on PATH on a -/// stock Windows install: every worker failed with `program not found`. The -/// bundled `buzz-agent` ships with the app and resolves on every platform. +/// if the catalog entry is missing. (Previous default was bare `goose`, which +/// is not on PATH on a stock Windows install; buzz-agent ships with the app.) pub fn default_agent_command() -> String { known_acp_runtime_exact("buzz-agent") .and_then(|p| p.commands.first().copied()) @@ -294,9 +306,10 @@ pub fn default_agent_command() -> String { /// /// Resolution order: /// 1. explicit override (non-empty) — a deliberate per-instance pin; -/// 2. the record's own `runtime` id mapped to its primary command — -/// records materialize their runtime at create/migration time; -/// checks both static builtins AND the loaded preset/custom registry; +/// 2. the record's own `runtime` id mapped to its primary command via the +/// authoritative three-tier lookup (static builtins → static preset list +/// → loaded registry) — preset harnesses (e.g. openclaw) resolve +/// correctly even with a cold registry; /// 3. legacy fallback: the linked persona's `runtime` (records created /// before the unified model carry `persona_id` but no `runtime`); /// 4. `default_agent_command()`. @@ -314,15 +327,11 @@ pub fn record_agent_command( } if let Some(id) = record.runtime.as_deref() { - // Check static builtins first. - if let Some(command) = known_acp_runtime_exact(id).and_then(|r| r.commands.first().copied()) - { - return command.to_string(); - } - // Fall back to loaded registry for preset/custom harnesses. - if let Some(def) = crate::managed_agents::custom_harnesses::lookup_loaded_harness_by_id(id) - { - return def.command.clone(); + // Three-tier lookup: static builtins → static presets → loaded registry. + // Using the shared resolver ensures preset harnesses (e.g. openclaw) + // resolve correctly even without a warm registry. + if let Some(cmd) = presets::command_for_runtime_id(id) { + return cmd; } } @@ -335,8 +344,9 @@ pub fn record_agent_command( /// /// Resolution order: /// 1. explicit override (non-empty) — a deliberate per-instance pin; -/// 2. the linked persona's `runtime` id mapped to its primary command -/// (checks builtins then loaded preset/custom registry); +/// 2. the linked persona's `runtime` id mapped to its primary command via +/// the authoritative three-tier lookup (static builtins → static preset +/// list → loaded registry); /// 3. `default_agent_command()` — no persona/runtime, or persona deleted. pub fn effective_agent_command( persona_id: Option<&str>, @@ -355,15 +365,9 @@ pub fn effective_agent_command( .and_then(|persona| persona.runtime.as_deref()); if let Some(id) = runtime_id { - // Check static builtins first. - if let Some(command) = known_acp_runtime_exact(id).and_then(|r| r.commands.first().copied()) - { - return command.to_string(); - } - // Check loaded preset/custom registry. - if let Some(def) = crate::managed_agents::custom_harnesses::lookup_loaded_harness_by_id(id) - { - return def.command.clone(); + // Three-tier lookup: static builtins → static presets → loaded registry. + if let Some(cmd) = presets::command_for_runtime_id(id) { + return cmd; } } @@ -375,10 +379,8 @@ pub use overrides::{apply_agent_command_update, create_time_agent_command_overri /// Prefix of the typed dangling-harness error produced by /// `try_record_agent_command` / `resolve_effective_harness_descriptor`. -/// -/// This sentinel is an internal Rust contract: user-facing surfaces must -/// convert it to a sentence via [`user_facing_harness_error`] (spawn) or to -/// the missing id via [`dangling_harness_id`] (summary) — never show it raw. +/// Internal Rust contract: surfaces must convert it via [`user_facing_harness_error`] or +/// [`dangling_harness_id`] — never show it raw. pub(crate) const DANGLING_HARNESS_PREFIX: &str = "DANGLING_HARNESS_ID:"; /// Extract the missing harness id from a `DANGLING_HARNESS_ID:` error. @@ -398,22 +400,16 @@ pub(crate) fn user_facing_harness_error(error: &str) -> String { } } -/// Summary-row display for a dangling harness id: shows the *missing* id so -/// the agent list tells the same story as spawn (which refuses with the -/// sentence above), rather than silently falling back to the default command -/// as if the agent were healthy. +/// Summary-row display for a dangling harness id: shows the *missing* id so the agent list +/// tells the same story as spawn rather than silently falling back to the default command. pub(crate) fn dangling_harness_display(id: &str) -> String { format!("harness (deleted): {id}") } /// Spawn-time variant of `record_agent_command` that returns a typed error when -/// a record's `runtime` id or its persona's `runtime` id is set but cannot be -/// resolved (i.e. the definition was deleted after the agent was created). -/// -/// Returns `Err("DANGLING_HARNESS_ID:")` so callers can surface the error -/// without falling through to `buzz-agent`. When there is no runtime id at all -/// the fallback to `default_agent_command()` is intentional (legacy agents -/// pre-date the unified harness model). +/// a record's `runtime` id or persona's `runtime` id is set but unresolvable +/// (definition deleted after agent was created). Returns `Err("DANGLING_HARNESS_ID:")`. +/// When there is no runtime id at all, falls through to `default_agent_command()` intentionally. pub fn try_record_agent_command( record: &crate::managed_agents::types::ManagedAgentRecord, personas: &[crate::managed_agents::types::AgentDefinition], @@ -430,12 +426,8 @@ pub fn try_record_agent_command( // Record-level runtime id: if set but unresolvable → typed error. if let Some(id) = record.runtime.as_deref() { - if let Some(cmd) = known_acp_runtime_exact(id).and_then(|r| r.commands.first().copied()) { - return Ok(cmd.to_string()); - } - if let Some(def) = crate::managed_agents::custom_harnesses::lookup_loaded_harness_by_id(id) - { - return Ok(def.command.clone()); + if let Some(cmd) = presets::command_for_runtime_id(id) { + return Ok(cmd); } return Err(format!("DANGLING_HARNESS_ID:{id}")); } @@ -444,15 +436,8 @@ pub fn try_record_agent_command( if let Some(persona_id) = record.persona_id.as_deref() { if let Some(persona) = personas.iter().find(|p| p.id == persona_id) { if let Some(id) = persona.runtime.as_deref() { - if let Some(cmd) = - known_acp_runtime_exact(id).and_then(|r| r.commands.first().copied()) - { - return Ok(cmd.to_string()); - } - if let Some(def) = - crate::managed_agents::custom_harnesses::lookup_loaded_harness_by_id(id) - { - return Ok(def.command.clone()); + if let Some(cmd) = presets::command_for_runtime_id(id) { + return Ok(cmd); } return Err(format!("DANGLING_HARNESS_ID:{id}")); } @@ -581,18 +566,40 @@ pub fn resolve_command(command: &str) -> Option { } } - // Slow path: resolve and cache. + // Slow path: resolve and cache. Negative results are cached too: an absent + // command must not re-run `resolve_command_uncached` (which spawns a login + // shell via `find_via_login_shell`) on every cheap discovery — that spawn + // on the channel-switch/composer hot path is exactly what this cache exists + // to prevent. `clear_resolve_cache` (run by every forced discovery) is the + // invalidation seam, so a newly-installed binary is still found on refresh. let result = resolve_command_uncached(command); - if result.is_some() { - if let Ok(mut guard) = cache.lock() { - guard.insert(command.to_string(), result.clone()); - } + if let Ok(mut guard) = cache.lock() { + guard.insert(command.to_string(), result.clone()); } result } +/// Cache-only command resolution for the cheap discovery path. +/// +/// Consults the Buzz-managed shim dir (a filesystem stat, never a spawn) and +/// the resolve cache; on a miss it reports the command absent rather than +/// resolving live via `resolve_command_uncached` → `find_via_login_shell`, +/// which spawns a login shell on the channel-switch / composer hot path — the +/// freeze the cheap path exists to avoid. `resolve_command` (the forced path) +/// is the sole prober and cache populator. +pub fn resolve_command_cached(command: &str) -> Option { + if let Some(managed) = resolve_buzz_managed_command(command) { + return Some(managed); + } + resolve_cache() + .lock() + .ok() + .and_then(|guard| guard.get(command).cloned()) + .flatten() +} + /// Clear the resolve_command cache so that newly-installed binaries are detected. pub fn clear_resolve_cache() { let mut guard = resolve_cache().lock().unwrap_or_else(|e| e.into_inner()); @@ -600,6 +607,9 @@ pub fn clear_resolve_cache() { // Also invalidate the adapter-availability cache so a freshly-installed // adapter is reflected the next time the summary builder checks the badge. clear_adapter_availability_cache(); + // And the auth-status cache so a forced re-discovery re-probes rather than + // reusing stale login state. + auth_status_cache::clear(); } // ── Adapter availability cache (Phase-2 badge fallback) ───────────────────── @@ -780,222 +790,10 @@ fn path_candidates_from_env_raw(basename: &str) -> Vec { .unwrap_or_default() } -/// Collect login shell candidates for the current platform. -/// -/// On Unix: `/bin/zsh`, `/bin/bash` (the historical defaults). -/// On Windows: Git Bash via `resolve_bash_path` — skips `BUZZ_SHELL` because -/// login-shell callers use bash-only `-l -c` syntax. -fn login_shell_candidates() -> Vec { - #[cfg(not(windows))] - { - vec![PathBuf::from("/bin/zsh"), PathBuf::from("/bin/bash")] - } - #[cfg(windows)] - { - super::git_bash::resolve_bash_path().into_iter().collect() - } -} - -/// Run a command in a login shell (tries zsh then bash on Unix, Git Bash on Windows). -/// Returns trimmed stdout if the command succeeds with non-empty output. -fn run_in_login_shell(args: &[&str]) -> Option { - for shell in login_shell_candidates() { - let mut cmd = Command::new(&shell); - cmd.args(args); - crate::util::configure_no_window(&mut cmd); - let Ok(output) = cmd.output() else { - continue; - }; - if !output.status.success() { - continue; - } - let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string(); - if !stdout.is_empty() { - return Some(stdout); - } - } - None -} - -fn find_via_login_shell(command: &str) -> Option { - let stdout = run_in_login_shell(&["-l", "-c", r#"command -v -- "$1""#, "_", command])?; - let resolved = stdout.lines().rfind(|line| !line.trim().is_empty())?; - let path = PathBuf::from(resolved.trim()); - (path.is_absolute() && is_executable_file(&path)).then_some(path) -} - -/// Three-state backing store for the login-shell PATH cache. -#[derive(Clone)] -enum LoginShellPath { - /// Cache has never been populated; the next call will spawn a login shell. - Uninit, - /// A login shell was invoked; the inner value is the PATH it returned - /// (`None` when the shell produced no output). - Probed(Option), -} - -fn path_cache() -> &'static std::sync::Mutex { - use std::sync::{Mutex, OnceLock}; - static CACHE: OnceLock> = OnceLock::new(); - CACHE.get_or_init(|| Mutex::new(LoginShellPath::Uninit)) -} - -fn fetch_login_shell_path_inner() -> Option { - // On Windows, Git Bash's `echo $PATH` returns POSIX colon-delimited paths - // (`/mingw64/bin:/c/Users/...`) which poison native Windows children that - // split on `;`. login_shell_path() feeds agent_models, runtime, and - // cli_probe — all native processes. Return None so they inherit the real - // Windows PATH instead. - #[cfg(windows)] - { - return None; - } - - #[cfg(not(windows))] - { - let stdout = run_in_login_shell(&["-l", "-c", "echo $PATH"])?; - let last_line = stdout.lines().rfind(|l| !l.trim().is_empty())?; - Some(last_line.trim().to_string()) - } -} - -/// Return the user's full PATH from a login shell. -/// -/// The result is cached after the first call. Call [`refresh_login_shell_path`] -/// to invalidate the cache so the next call re-fetches — e.g. after the user -/// installs Node.js mid-session and clicks Retry. -/// -/// The lock is never held while the login shell spawns: we check for a cached -/// value, release the lock, run the shell, then re-lock to write. Two concurrent -/// callers may both run the shell (last-writer-wins is fine — both produce the -/// same result), but neither blocks a concurrent agent spawn on the Mutex. -pub fn login_shell_path() -> Option { - // Fast path: return cached result without spawning a shell. - { - let guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); - if let LoginShellPath::Probed(ref result) = *guard { - return result.clone(); - } - } - - // Slow path: spawn shell outside any lock. - let result = fetch_login_shell_path_inner(); - - // Write back; last-writer-wins is safe here. - { - let mut guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); - *guard = LoginShellPath::Probed(result.clone()); - } - - result -} - -/// Invalidate the login-shell PATH cache so the next [`login_shell_path`] call -/// re-fetches from a fresh login shell. -/// -/// Called before every install/retry operation and on Doctor Re-run so a -/// newly-installed tool becomes visible without restarting the app. -pub(crate) fn refresh_login_shell_path() { - let mut guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); - *guard = LoginShellPath::Uninit; -} - +/// Test-only counter for login-shell spawn attempts (see submodule). #[cfg(test)] -fn is_login_shell_path_uninit() -> bool { - matches!( - *path_cache().lock().unwrap_or_else(|e| e.into_inner()), - LoginShellPath::Uninit - ) -} - -/// Return `true` when `tag` is a safe nvm alias/version tag that can be joined -/// onto a `PathBuf` without escaping the nvm root. -/// -/// nvm uses tags like `v22.1.0` or `lts/hydrogen`. We allow ASCII alphanumeric -/// plus `. - / _` and require that no path component is `..` and that the tag -/// does not start with `/` (which would replace the base in `PathBuf::join`). -fn is_safe_nvm_tag(tag: &str) -> bool { - if tag.is_empty() { - return false; - } - // An absolute path in the alias file would let PathBuf::join silently - // replace the nvm root with an attacker-controlled path. - if tag.starts_with('/') { - return false; - } - // Reject any .. component to prevent upward traversal. - for component in tag.split('/') { - if component == ".." { - return false; - } - } - // Allow only the characters nvm uses in real tag names. - tag.chars() - .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '/' | '_')) -} - -/// Locate the `bin` directory for nvm's default Node.js version. -/// -/// Reads `~/.nvm/alias/default`; resolves at most one alias hop to handle -/// nvm alias chains; falls back to the highest-semver directory under -/// `~/.nvm/versions/node/`. Returns the `bin` subdirectory only when it exists. -/// -/// Cheap: at most two file reads or one `read_dir`. Never cached — computed -/// fresh per call so a mid-session `nvm install` is visible at the next spawn. -pub fn find_nvm_default_bin(home: &Path) -> Option { - let nvm_root = home.join(".nvm"); - let versions_root = nvm_root.join("versions").join("node"); - - // 1. Try alias/default, with at most one hop. - let default_alias = nvm_root.join("alias").join("default"); - if let Ok(content) = std::fs::read_to_string(&default_alias) { - let tag = content.trim().to_string(); - if is_safe_nvm_tag(&tag) { - let candidate = versions_root.join(&tag).join("bin"); - if candidate.is_dir() { - return Some(candidate); - } - // One alias hop: ~/.nvm/alias/ - let hop_file = nvm_root.join("alias").join(&tag); - if let Ok(hop_content) = std::fs::read_to_string(&hop_file) { - let hop_tag = hop_content.trim().to_string(); - if is_safe_nvm_tag(&hop_tag) { - let hop_candidate = versions_root.join(&hop_tag).join("bin"); - if hop_candidate.is_dir() { - return Some(hop_candidate); - } - } - } - } - } - - // 2. Fall back to highest-semver directory under ~/.nvm/versions/node/. - let entries = std::fs::read_dir(&versions_root).ok()?; - let best = entries - .filter_map(|e| e.ok()) - .filter_map(|e| { - let name = e.file_name(); - let s = name.to_string_lossy().into_owned(); - parse_semver_tag(&s).map(|v| (v, s)) - }) - .max_by(|(a, _), (b, _)| a.cmp(b)); - - let (_, tag) = best?; - let bin = versions_root.join(&tag).join("bin"); - bin.is_dir().then_some(bin) -} - -/// Parse a `vMAJ.MIN.PATCH` (or `vMAJ.MIN.PATCH-extra`) tag into a numeric -/// triple for semver comparison. -fn parse_semver_tag(s: &str) -> Option<(u64, u64, u64)> { - let s = s.strip_prefix('v')?; - let mut parts = s.splitn(3, '.'); - let major = parts.next()?.parse::().ok()?; - let minor = parts.next()?.parse::().ok()?; - let patch_str = parts.next()?; - let patch = patch_str.split('-').next()?.parse::().ok()?; - Some((major, minor, patch)) -} +#[path = "discovery/login_shell_spawn_probe.rs"] +pub(crate) mod login_shell_spawn_probe; pub(crate) fn find_command(command: &str) -> Option { resolve_command(command) @@ -1136,7 +934,7 @@ pub fn missing_command_message(command: &str, role: &str) -> String { } format!( - "{role} `{command}` was not found. Build the workspace binaries (`cargo build --release --workspace`) or add `target/release` to PATH as described in TESTING.md." + "{role} `{command}` was not found. Make sure it is installed and on your PATH. Antivirus software can quarantine bundled binaries — if that happened, restore the file or reinstall Buzz. (Source builds: see TESTING.md.)" ) } @@ -1318,27 +1116,39 @@ struct PartialEntry { entry: AcpRuntimeCatalogEntry, } -fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntry { +fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime, force: bool) -> PartialEntry { + // Cheap path is cache-only (no login-shell spawn); forced path resolves live. + let resolve = if force { + resolve_command + } else { + resolve_command_cached + }; let adapter_result = runtime .commands .iter() - .find_map(|command| find_command(command).map(|path| (*command, path))); + .find_map(|command| resolve(command).map(|path| (*command, path))); let underlying_cli_found = runtime .underlying_cli - .map(|cli| find_command(cli).is_some()) + .map(|cli| resolve(cli).is_some()) .unwrap_or(false); let (mut availability, command, binary_path) = classify_runtime(adapter_result, runtime.underlying_cli, underlying_cli_found); - // For codex-acp: when the adapter resolves as Available, probe its full - // version. An adapter below MIN_CODEX_ACP_VERSION is treated as outdated. + // For codex-acp: when the adapter resolves as Available, determine its full + // version. A forced discovery probes the binary (spawns a subprocess); the + // cheap default path reuses the last cached availability so it stays + // process-free. An adapter below MIN_CODEX_ACP_VERSION is treated as outdated. if runtime.id == "codex" && availability == AcpAvailabilityStatus::Available && command.as_deref() == Some("codex-acp") { - if let Some(path_str) = &binary_path { - availability = codex_adapter_availability(&PathBuf::from(path_str)); + if force { + if let Some(path_str) = &binary_path { + availability = codex_adapter_availability(&PathBuf::from(path_str)); + } + } else if let Some(cached) = adapter_availability_cached() { + availability = cached; } } @@ -1351,7 +1161,7 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr let underlying_cli_path = runtime .underlying_cli - .and_then(find_command) + .and_then(resolve) .map(|p| p.display().to_string()); let default_args = command @@ -1396,8 +1206,8 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr AcpAvailabilityStatus::AdapterMissing | AcpAvailabilityStatus::NotInstalled ) && runtime_needs_npm(runtime) && buzz_managed_node_bin_dir().is_none() - && resolve_command("npm").is_none() - && resolve_command("node").is_none(); + && resolve("npm").is_none() + && resolve("node").is_none(); PartialEntry { runtime, @@ -1413,6 +1223,9 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr model_env_var: runtime.model_env_var.map(str::to_string), provider_env_var: runtime.provider_env_var.map(str::to_string), thinking_env_var: runtime.thinking_env_var.map(str::to_string), + max_tokens_env_var: runtime.max_tokens_env_var.map(str::to_string), + context_limit_env_var: runtime.context_limit_env_var.map(str::to_string), + max_rounds_env_var: runtime.max_rounds_env_var.map(str::to_string), install_hint, install_instructions_url: install_instructions_url.to_string(), can_auto_install, @@ -1423,8 +1236,8 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr auth_status: AuthStatus::Unknown, login_hint: None, source: HarnessSource::Builtin, - // Builtin entries have no user-editable env; definition_env is empty. definition_env: Default::default(), + max_parallelism: super::parallelism::harness_max_parallelism(runtime.id), }, } } @@ -1435,7 +1248,9 @@ fn discover_acp_runtime_phase1(runtime: &'static KnownAcpRuntime) -> PartialEntr /// resolves, so it should not pay the cost of authenticating every catalog entry. pub(crate) fn discover_acp_runtime_availability(runtime_id: &str) -> Option { known_acp_runtime_exact(runtime_id) - .map(discover_acp_runtime_phase1) + // Post-install verification wants fresh filesystem/version state, so + // probe rather than trust the cheap-path cache. + .map(|runtime| discover_acp_runtime_phase1(runtime, true)) .map(|partial| partial.entry.availability) } @@ -1458,47 +1273,24 @@ pub(crate) fn discover_acp_runtime_availability(runtime_id: &str) -> Option, + force: bool, ) -> Vec { + // Cheap path is cache-only (no login-shell spawn); forced path resolves live. + let resolve = if force { + resolve_command + } else { + resolve_command_cached + }; + // Phase 1: build all builtin entries (fast — no probes yet). let mut partials: Vec = KNOWN_ACP_RUNTIMES .iter() - .map(discover_acp_runtime_phase1) - .collect(); - - // Phase 2: run auth probes in parallel for entries that need them. - // Spawn one thread per probeable entry; total cost = max(probe latency). - let probe_handles: Vec<(usize, std::thread::JoinHandle)> = partials - .iter() - .enumerate() - .filter_map(|(idx, partial)| { - if partial.entry.availability != AcpAvailabilityStatus::Available { - return None; - } - let probe_args = partial.runtime.auth_probe_args?; - // Need the resolved binary path for the CLI (e.g. the actual `claude` binary). - let binary_path = resolve_command(probe_args[0])?; - let probe_args_owned: Vec = probe_args.iter().map(|s| s.to_string()).collect(); - - let handle = std::thread::spawn(move || { - let refs: Vec<&str> = probe_args_owned.iter().map(String::as_str).collect(); - probe_auth_status(&binary_path, &refs) - }); - Some((idx, handle)) - }) + .map(|runtime| discover_acp_runtime_phase1(runtime, force)) .collect(); - // Collect probe results and patch entries. - for (idx, handle) in probe_handles { - let status = handle.join().unwrap_or(AuthStatus::Unknown); - let partial = &mut partials[idx]; - partial.entry.login_hint = - if matches!(status, AuthStatus::LoggedIn | AuthStatus::NotApplicable) { - None - } else { - partial.runtime.login_hint.map(str::to_string) - }; - partial.entry.auth_status = status; - } + // Phase 2: resolve each available runtime's auth status (forced discovery + // spawns parallel CLI probes and warms the cache; the cheap path reuses it). + auth_status_cache::resolve_auth_statuses(&mut partials, force); // Fill NotApplicable / Unknown for non-probed entries. for partial in &mut partials { @@ -1528,7 +1320,7 @@ pub fn discover_acp_runtimes_from( } seen_ids.insert(def.id.to_string()); - entries.push(preset_catalog_entry(def, find_command)); + entries.push(preset_catalog_entry(def, resolve)); } // Phase 3: load and append custom harness definitions. @@ -1543,8 +1335,8 @@ pub fn discover_acp_runtimes_from( continue; } - // Availability: command on PATH → Available, else NotInstalled. - let (availability, command, binary_path) = match find_command(&def.command) { + // Availability: command resolves → Available, else NotInstalled. + let (availability, command, binary_path) = match resolve(&def.command) { Some(path) => ( AcpAvailabilityStatus::Available, Some(def.command.clone()), @@ -1571,6 +1363,9 @@ pub fn discover_acp_runtimes_from( model_env_var: None, provider_env_var: None, thinking_env_var: None, + max_tokens_env_var: None, + context_limit_env_var: None, + max_rounds_env_var: None, install_hint: def.install_hint.clone(), install_instructions_url: def.install_instructions_url.clone(), // Security line: custom definitions carry no install scripts. @@ -1582,9 +1377,8 @@ pub fn discover_acp_runtimes_from( auth_status: AuthStatus::NotApplicable, login_hint: None, source: HarnessSource::Custom, - // Carry definition env into the catalog so the edit form can - // read it back — prevents silently erasing env on save. - definition_env: def.env.clone(), + definition_env: def.env.clone(), // preserve for edit round-trip + max_parallelism: super::parallelism::harness_max_parallelism(&def.command), }); } } diff --git a/desktop/src-tauri/src/managed_agents/discovery/auth_status_cache.rs b/desktop/src-tauri/src/managed_agents/discovery/auth_status_cache.rs new file mode 100644 index 00000000000..cae0d7e2c94 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/discovery/auth_status_cache.rs @@ -0,0 +1,105 @@ +//! Auth-status cache for cheap ACP runtime discovery. +//! +//! A forced discovery (`discover_acp_providers(force: true)`) spawns one CLI +//! auth probe per available runtime — the expensive pipeline. The cheap default +//! discovery must not pay that cost, so it reuses the last known auth statuses +//! from this cache instead of probing. The cache is keyed by runtime id, warmed +//! by the forced probe phase, and cleared by `clear_resolve_cache` (which a +//! forced discovery calls before re-probing). + +use std::collections::HashMap; +use std::sync::{Mutex, OnceLock}; + +use crate::managed_agents::AuthStatus; + +fn cache() -> &'static Mutex> { + static CACHE: OnceLock>> = OnceLock::new(); + CACHE.get_or_init(|| Mutex::new(HashMap::new())) +} + +pub(super) fn clear() { + if let Ok(mut guard) = cache().lock() { + guard.clear(); + } +} + +pub(super) fn store(runtime_id: &str, status: &AuthStatus) { + if let Ok(mut guard) = cache().lock() { + guard.insert(runtime_id.to_string(), status.clone()); + } +} + +/// Last known auth status for `runtime_id`, or `AuthStatus::Unknown` when no +/// forced discovery has probed it yet. Never spawns a process. +pub(super) fn get(runtime_id: &str) -> AuthStatus { + cache() + .lock() + .ok() + .and_then(|g| g.get(runtime_id).cloned()) + .unwrap_or(AuthStatus::Unknown) +} + +#[cfg(test)] +pub(crate) fn len() -> usize { + cache().lock().map(|g| g.len()).unwrap_or(0) +} + +/// Resolve the auth status of every available, probeable runtime in `partials`, +/// patching each entry's `auth_status` + `login_hint` in place. +/// +/// Forced discovery spawns one CLI auth probe per available runtime (in +/// parallel; total cost = max(probe latency)) and warms this cache. The cheap +/// default path spawns nothing — it reuses the last cached status, falling back +/// to `Unknown` for a runtime never probed this session. +pub(super) fn resolve_auth_statuses(partials: &mut [super::PartialEntry], force: bool) { + use crate::managed_agents::AcpAvailabilityStatus; + + if force { + let probe_handles: Vec<(usize, std::thread::JoinHandle)> = partials + .iter() + .enumerate() + .filter_map(|(idx, partial)| { + if partial.entry.availability != AcpAvailabilityStatus::Available { + return None; + } + let probe_args = partial.runtime.auth_probe_args?; + // Need the resolved binary path for the CLI (e.g. the actual `claude` binary). + let binary_path = super::resolve_command(probe_args[0])?; + let probe_args_owned: Vec = + probe_args.iter().map(|s| s.to_string()).collect(); + + let handle = std::thread::spawn(move || { + let refs: Vec<&str> = probe_args_owned.iter().map(String::as_str).collect(); + super::probe_auth_status(&binary_path, &refs) + }); + Some((idx, handle)) + }) + .collect(); + + for (idx, handle) in probe_handles { + let status = handle.join().unwrap_or(AuthStatus::Unknown); + store(&partials[idx].entry.id, &status); + patch_entry(&mut partials[idx], status); + } + } else { + for partial in partials.iter_mut() { + if partial.entry.availability != AcpAvailabilityStatus::Available + || partial.runtime.auth_probe_args.is_none() + { + continue; + } + let status = get(&partial.entry.id); + patch_entry(partial, status); + } + } +} + +fn patch_entry(partial: &mut super::PartialEntry, status: AuthStatus) { + partial.entry.login_hint = if matches!(status, AuthStatus::LoggedIn | AuthStatus::NotApplicable) + { + None + } else { + partial.runtime.login_hint.map(str::to_string) + }; + partial.entry.auth_status = status; +} diff --git a/desktop/src-tauri/src/managed_agents/discovery/login_shell.rs b/desktop/src-tauri/src/managed_agents/discovery/login_shell.rs new file mode 100644 index 00000000000..d8f8e603546 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/discovery/login_shell.rs @@ -0,0 +1,236 @@ +//! Login-shell PATH discovery and nvm fallback. +//! +//! Extracted verbatim from `discovery.rs` to keep that file under the +//! file-size ratchet. Covers login-shell candidate selection, the cached +//! login-shell PATH probe, and nvm default-bin resolution. + +use std::path::{Path, PathBuf}; +use std::process::Command; + +use super::is_executable_file; + +/// Test-only spawn counter lives beside `discovery.rs`; import it here so the +/// spawn-record call site stays byte-identical to the pre-extraction source. +#[cfg(test)] +use super::login_shell_spawn_probe; + +/// Collect login shell candidates for the current platform. +/// +/// On Unix: `/bin/zsh`, `/bin/bash` (the historical defaults). +/// On Windows: Git Bash via `resolve_bash_path` — skips `BUZZ_SHELL` because +/// login-shell callers use bash-only `-l -c` syntax. +pub(crate) fn login_shell_candidates() -> Vec { + #[cfg(not(windows))] + { + vec![PathBuf::from("/bin/zsh"), PathBuf::from("/bin/bash")] + } + #[cfg(windows)] + { + super::super::git_bash::resolve_bash_path() + .into_iter() + .collect() + } +} + +/// Run a command in a login shell (tries zsh then bash on Unix, Git Bash on Windows). +/// Returns trimmed stdout if the command succeeds with non-empty output. +fn run_in_login_shell(args: &[&str]) -> Option { + #[cfg(test)] + login_shell_spawn_probe::record(); + for shell in login_shell_candidates() { + let mut cmd = Command::new(&shell); + cmd.args(args); + crate::util::configure_no_window(&mut cmd); + let Ok(output) = cmd.output() else { + continue; + }; + if !output.status.success() { + continue; + } + let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string(); + if !stdout.is_empty() { + return Some(stdout); + } + } + None +} + +pub(crate) fn find_via_login_shell(command: &str) -> Option { + let stdout = run_in_login_shell(&["-l", "-c", r#"command -v -- "$1""#, "_", command])?; + let resolved = stdout.lines().rfind(|line| !line.trim().is_empty())?; + let path = PathBuf::from(resolved.trim()); + (path.is_absolute() && is_executable_file(&path)).then_some(path) +} + +/// Three-state backing store for the login-shell PATH cache. +#[derive(Clone)] +enum LoginShellPath { + /// Cache has never been populated; the next call will spawn a login shell. + Uninit, + /// A login shell was invoked; the inner value is the PATH it returned + /// (`None` when the shell produced no output). + Probed(Option), +} + +fn path_cache() -> &'static std::sync::Mutex { + use std::sync::{Mutex, OnceLock}; + static CACHE: OnceLock> = OnceLock::new(); + CACHE.get_or_init(|| Mutex::new(LoginShellPath::Uninit)) +} + +fn fetch_login_shell_path_inner() -> Option { + // On Windows, Git Bash's `echo $PATH` returns POSIX colon-delimited paths + // (`/mingw64/bin:/c/Users/...`) which poison native Windows children that + // split on `;`. login_shell_path() feeds agent_models, runtime, and + // cli_probe — all native processes. Return None so they inherit the real + // Windows PATH instead. + #[cfg(windows)] + { + return None; + } + + #[cfg(not(windows))] + { + let stdout = run_in_login_shell(&["-l", "-c", "echo $PATH"])?; + let last_line = stdout.lines().rfind(|l| !l.trim().is_empty())?; + Some(last_line.trim().to_string()) + } +} + +/// Return the user's full PATH from a login shell. +/// +/// The result is cached after the first call. Call [`refresh_login_shell_path`] +/// to invalidate the cache so the next call re-fetches — e.g. after the user +/// installs Node.js mid-session and clicks Retry. +/// +/// The lock is never held while the login shell spawns: we check for a cached +/// value, release the lock, run the shell, then re-lock to write. Two concurrent +/// callers may both run the shell (last-writer-wins is fine — both produce the +/// same result), but neither blocks a concurrent agent spawn on the Mutex. +pub fn login_shell_path() -> Option { + // Fast path: return cached result without spawning a shell. + { + let guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); + if let LoginShellPath::Probed(ref result) = *guard { + return result.clone(); + } + } + + // Slow path: spawn shell outside any lock. + let result = fetch_login_shell_path_inner(); + + // Write back; last-writer-wins is safe here. + { + let mut guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); + *guard = LoginShellPath::Probed(result.clone()); + } + + result +} + +/// Invalidate the login-shell PATH cache so the next [`login_shell_path`] call +/// re-fetches from a fresh login shell. +/// +/// Called before every install/retry operation and on Doctor Re-run so a +/// newly-installed tool becomes visible without restarting the app. +pub(crate) fn refresh_login_shell_path() { + let mut guard = path_cache().lock().unwrap_or_else(|e| e.into_inner()); + *guard = LoginShellPath::Uninit; +} + +#[cfg(test)] +pub(crate) fn is_login_shell_path_uninit() -> bool { + matches!( + *path_cache().lock().unwrap_or_else(|e| e.into_inner()), + LoginShellPath::Uninit + ) +} + +/// Return `true` when `tag` is a safe nvm alias/version tag that can be joined +/// onto a `PathBuf` without escaping the nvm root. +/// +/// nvm uses tags like `v22.1.0` or `lts/hydrogen`. We allow ASCII alphanumeric +/// plus `. - / _` and require that no path component is `..` and that the tag +/// does not start with `/` (which would replace the base in `PathBuf::join`). +pub(crate) fn is_safe_nvm_tag(tag: &str) -> bool { + if tag.is_empty() { + return false; + } + // An absolute path in the alias file would let PathBuf::join silently + // replace the nvm root with an attacker-controlled path. + if tag.starts_with('/') { + return false; + } + // Reject any .. component to prevent upward traversal. + for component in tag.split('/') { + if component == ".." { + return false; + } + } + // Allow only the characters nvm uses in real tag names. + tag.chars() + .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '/' | '_')) +} + +/// Locate the `bin` directory for nvm's default Node.js version. +/// +/// Reads `~/.nvm/alias/default`; resolves at most one alias hop to handle +/// nvm alias chains; falls back to the highest-semver directory under +/// `~/.nvm/versions/node/`. Returns the `bin` subdirectory only when it exists. +/// +/// Cheap: at most two file reads or one `read_dir`. Never cached — computed +/// fresh per call so a mid-session `nvm install` is visible at the next spawn. +pub fn find_nvm_default_bin(home: &Path) -> Option { + let nvm_root = home.join(".nvm"); + let versions_root = nvm_root.join("versions").join("node"); + + // 1. Try alias/default, with at most one hop. + let default_alias = nvm_root.join("alias").join("default"); + if let Ok(content) = std::fs::read_to_string(&default_alias) { + let tag = content.trim().to_string(); + if is_safe_nvm_tag(&tag) { + let candidate = versions_root.join(&tag).join("bin"); + if candidate.is_dir() { + return Some(candidate); + } + // One alias hop: ~/.nvm/alias/ + let hop_file = nvm_root.join("alias").join(&tag); + if let Ok(hop_content) = std::fs::read_to_string(&hop_file) { + let hop_tag = hop_content.trim().to_string(); + if is_safe_nvm_tag(&hop_tag) { + let hop_candidate = versions_root.join(&hop_tag).join("bin"); + if hop_candidate.is_dir() { + return Some(hop_candidate); + } + } + } + } + } + + // 2. Fall back to highest-semver directory under ~/.nvm/versions/node/. + let entries = std::fs::read_dir(&versions_root).ok()?; + let best = entries + .filter_map(|e| e.ok()) + .filter_map(|e| { + let name = e.file_name(); + let s = name.to_string_lossy().into_owned(); + parse_semver_tag(&s).map(|v| (v, s)) + }) + .max_by(|(a, _), (b, _)| a.cmp(b)); + + let (_, tag) = best?; + let bin = versions_root.join(&tag).join("bin"); + bin.is_dir().then_some(bin) +} + +/// Parse a `vMAJ.MIN.PATCH` (or `vMAJ.MIN.PATCH-extra`) tag into a numeric +/// triple for semver comparison. +pub(crate) fn parse_semver_tag(s: &str) -> Option<(u64, u64, u64)> { + let s = s.strip_prefix('v')?; + let mut parts = s.splitn(3, '.'); + let major = parts.next()?.parse::().ok()?; + let minor = parts.next()?.parse::().ok()?; + let patch_str = parts.next()?; + let patch = patch_str.split('-').next()?.parse::().ok()?; + Some((major, minor, patch)) +} diff --git a/desktop/src-tauri/src/managed_agents/discovery/login_shell_spawn_probe.rs b/desktop/src-tauri/src/managed_agents/discovery/login_shell_spawn_probe.rs new file mode 100644 index 00000000000..a716dee9f56 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/discovery/login_shell_spawn_probe.rs @@ -0,0 +1,21 @@ +//! Test-only counter for login-shell spawn attempts. +//! +//! `run_in_login_shell` is the single subprocess-spawning step on the +//! absent-command resolution path, so counting its calls proves whether a +//! cheap discovery re-spawns after a negative resolution was cached. + +use std::sync::atomic::{AtomicUsize, Ordering}; + +static COUNT: AtomicUsize = AtomicUsize::new(0); + +pub(crate) fn record() { + COUNT.fetch_add(1, Ordering::SeqCst); +} + +pub(crate) fn reset() { + COUNT.store(0, Ordering::SeqCst); +} + +pub(crate) fn count() -> usize { + COUNT.load(Ordering::SeqCst) +} diff --git a/desktop/src-tauri/src/managed_agents/discovery/presets.rs b/desktop/src-tauri/src/managed_agents/discovery/presets.rs index 72c4657dc74..fd853094515 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/presets.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/presets.rs @@ -67,6 +67,9 @@ pub(super) fn preset_catalog_entry( model_env_var: None, provider_env_var: None, thinking_env_var: None, + max_tokens_env_var: None, + context_limit_env_var: None, + max_rounds_env_var: None, install_hint: def.install_hint.to_string(), install_instructions_url: def.install_instructions_url.to_string(), can_auto_install: false, @@ -79,6 +82,10 @@ pub(super) fn preset_catalog_entry( login_hint: None, source: HarnessSource::Preset, definition_env: Default::default(), + // Derived from the static preset command (`def.command`). This ensures + // unavailable entries (command: null in JSON, None here) still carry + // the cap — the harness cap is command-keyed, not availability-gated. + max_parallelism: crate::managed_agents::harness_max_parallelism(def.command), } } @@ -106,7 +113,7 @@ pub(super) const PRESET_HARNESSES: &[PresetHarness] = &[ label: "Oh My Pi", command: "omp", args: &["acp"], - install_instructions_url: "https://github.com/can1357/oh-my-pi", + install_instructions_url: "https://omp.sh/", install_hint: "Buzz talks to Oh My Pi through its CLI's ACP mode (omp acp).", underlying_cli: None, }, @@ -199,6 +206,76 @@ pub(crate) fn preset_harness_ids() -> &'static [&'static str] { .as_slice() } +/// Return the primary command for a preset harness by id, or `None` if the id +/// is not a known preset. +/// +/// Returns a `&'static str` so callers can use it without allocation. +pub(super) fn preset_command_for_id(id: &str) -> Option<&'static str> { + PRESET_HARNESSES + .iter() + .find(|p| p.id == id) + .map(|p| p.command) +} + +/// Return the primary harness command for a given runtime id, or `None`. +/// +/// Checks static builtins, then the static preset list (always available, +/// no registry warm-up required — covers openclaw, devin, cursor, etc.), +/// then the loaded preset/custom registry. +pub(crate) fn command_for_runtime_id(id: &str) -> Option { + super::known_acp_runtime_exact(id) + .and_then(|r| r.commands.first().copied()) + .map(str::to_string) + .or_else(|| preset_command_for_id(id).map(str::to_string)) + .or_else(|| { + crate::managed_agents::custom_harnesses::lookup_loaded_harness_by_id(id) + .map(|d| d.command.clone()) + }) +} + +/// Resolve a harness to its canonical command accepting either a runtime id or +/// a command string (including path prefixes and aliases). +/// +/// This is the pin-classification resolver for `apply_persona_snapshot`: the +/// create-time override in `record.agent_command_override` can hold any of the +/// forms a user or the harness selector might have stored — bare command +/// ("goose"), alias ("claude-code-acp"), path ("/usr/local/bin/goose"), or the +/// runtime id directly ("claude"). All three tiers are searched: +/// +/// 1. **Builtins** — `known_acp_runtime(input)` matches by id, command, or +/// alias in `KNOWN_ACP_RUNTIMES`; returns its first primary command. +/// 2. **Static presets** — searched by id or by normalised command. +/// 3. **Loaded registry** — searched by id or by normalised command. +/// +/// Returns `None` for inputs that do not resolve to any known harness; those +/// pins are treated as custom/unknown and always kept. +pub(crate) fn canonical_harness_command(input: &str) -> Option { + let normalized = super::normalize_command_identity(input); + + // Tier 1: builtins — matched by id, command, or alias. + if let Some(rt) = super::known_acp_runtime(&normalized) { + if let Some(cmd) = rt.commands.first() { + return Some(cmd.to_string()); + } + } + + // Tier 2: static presets — matched by id or by normalized command. + if let Some(p) = PRESET_HARNESSES + .iter() + .find(|p| p.id == normalized || super::normalize_command_identity(p.command) == normalized) + { + return Some(p.command.to_string()); + } + + // Tier 3: loaded registry — matched by id or by normalized command. + let reg = crate::managed_agents::custom_harnesses::loaded_harness_registry() + .read() + .unwrap_or_else(|e| e.into_inner()); + reg.iter() + .find(|d| d.id == normalized || super::normalize_command_identity(&d.command) == normalized) + .map(|d| d.command.clone()) +} + #[cfg(test)] mod tests { use std::path::PathBuf; @@ -259,7 +336,7 @@ mod tests { let _path_guard = crate::managed_agents::lock_path_mutex(); let _registry_guard = registry_test_lock(); - let entry = super::super::discover_acp_runtimes_from(None) + let entry = super::super::discover_acp_runtimes_from(None, true) .into_iter() .find(|entry| entry.id == "devin") .expect("Devin preset should appear in the runtime catalog"); @@ -332,4 +409,65 @@ mod tests { assert!(!entry.requires_external_cli); assert!(entry.underlying_cli_path.is_none()); } + + // ── Catalog max_parallelism: command-keyed execution policy ────────────── + + /// Unavailable OpenClaw (command not on PATH → command: null in JSON): + /// max_parallelism must still be Some(5) — derived from the static `def.command`, + /// not the probed `entry.command`. + #[test] + fn openclaw_preset_unavailable_carries_max_parallelism() { + let openclaw = PRESET_HARNESSES + .iter() + .find(|p| p.id == "openclaw") + .expect("openclaw preset must be present"); + + // Simulate "not installed" — resolver always returns None. + let entry = preset_catalog_entry(openclaw, |_| None); + assert_eq!(entry.availability, AcpAvailabilityStatus::NotInstalled); + assert!( + entry.command.is_none(), + "unavailable entry must have command: null" + ); + assert_eq!( + entry.max_parallelism, + Some(crate::managed_agents::parallelism::OPENCLAW_MAX_PARALLELISM), + "unavailable OpenClaw must still carry max_parallelism {}", + crate::managed_agents::parallelism::OPENCLAW_MAX_PARALLELISM + ); + } + + /// Available OpenClaw: max_parallelism present regardless of install status. + #[test] + fn openclaw_preset_available_carries_max_parallelism() { + let openclaw = PRESET_HARNESSES + .iter() + .find(|p| p.id == "openclaw") + .expect("openclaw preset must be present"); + + let entry = preset_catalog_entry(openclaw, |cmd| { + (cmd == openclaw.id || cmd == "openclaw") + .then(|| std::path::PathBuf::from("/usr/local/bin/openclaw")) + }); + assert_eq!( + entry.max_parallelism, + Some(crate::managed_agents::parallelism::OPENCLAW_MAX_PARALLELISM), + "available OpenClaw must carry max_parallelism {}", + crate::managed_agents::parallelism::OPENCLAW_MAX_PARALLELISM + ); + } + + /// Uncapped preset (devin): max_parallelism must be None. + #[test] + fn uncapped_preset_has_no_max_parallelism() { + let devin = PRESET_HARNESSES + .iter() + .find(|p| p.id == "devin") + .expect("devin preset must be present"); + let entry = preset_catalog_entry(devin, |_| None); + assert_eq!( + entry.max_parallelism, None, + "uncapped preset (devin) must have max_parallelism: None" + ); + } } diff --git a/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs b/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs index fdfe9b8be71..34edecdcd9c 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/runtime_metadata.rs @@ -52,6 +52,8 @@ pub(crate) struct KnownAcpRuntime { pub max_tokens_env_var: Option<&'static str>, /// Env var for normalizing `context_limit`. `None` when not applicable. pub context_limit_env_var: Option<&'static str>, + /// Env var for normalizing `max_rounds`. `None` when not applicable. + pub max_rounds_env_var: Option<&'static str>, /// Normalized field keys that must be set for this harness to function. /// Used by the config bridge to mark fields as required in the UI. /// Keys match the camelCase names used in `NormalizedConfig` (e.g. "model", "provider"). diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests.rs b/desktop/src-tauri/src/managed_agents/discovery/tests.rs index 6fe6a77521b..2d1db692932 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/tests.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/tests.rs @@ -4,11 +4,10 @@ use super::overrides::{divergent_agent_command_override, update_time_agent_comma use super::{ apply_agent_command_update, classify_runtime, codex_adapter_availability, codex_adapter_is_outdated, create_time_agent_command_override, default_agent_command, - effective_agent_command, find_nvm_default_bin, find_via_login_shell, - is_login_shell_path_uninit, is_safe_nvm_tag, managed_agent_avatar_url, normalize_agent_args, - parse_semver_tag, probe_codex_acp_version, record_agent_command, refresh_login_shell_path, - try_record_agent_command, BUZZ_AGENT_AVATAR_URL, CLAUDE_CODE_AVATAR_URL, CODEX_AVATAR_URL, - GOOSE_AVATAR_URL, + effective_agent_command, find_nvm_default_bin, is_login_shell_path_uninit, is_safe_nvm_tag, + managed_agent_avatar_url, normalize_agent_args, parse_semver_tag, probe_codex_acp_version, + record_agent_command, refresh_login_shell_path, try_record_agent_command, + BUZZ_AGENT_AVATAR_URL, CLAUDE_CODE_AVATAR_URL, CODEX_AVATAR_URL, GOOSE_AVATAR_URL, }; use crate::managed_agents::AcpAvailabilityStatus; @@ -94,24 +93,6 @@ fn normalizes_buzz_agent_args_to_empty() { ); } -#[test] -fn login_shell_lookup_treats_command_as_data() { - let marker = - std::env::temp_dir().join(format!("buzz-discovery-marker-{}", uuid::Uuid::new_v4())); - let payload = format!("doesnotexist; touch {} #", marker.display()); - - let resolved = find_via_login_shell(&payload); - - assert!( - resolved.is_none(), - "payload should not resolve to a command" - ); - assert!( - !marker.exists(), - "shell lookup must not execute injected commands" - ); -} - #[cfg(unix)] #[test] fn explicit_path_resolution_ignores_non_executable_files() { @@ -255,6 +236,7 @@ fn record_with( runtime_pid: None, backend: Default::default(), backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -283,13 +265,13 @@ fn record_with( definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, } } #[test] fn record_agent_command_own_runtime_wins_over_persona() { - // A record with its own materialized runtime never consults the - // persona list — the unified-model resolution. + // A record with its own runtime never consults the persona list. let personas = vec![persona_with_runtime("p1", Some("goose"))]; let record = record_with(Some("claude"), Some("p1"), None); assert_eq!(record_agent_command(&record, &personas), "claude-agent-acp"); @@ -316,8 +298,6 @@ fn record_agent_command_bare_record_defaults() { assert_eq!(record_agent_command(&record, &[]), default_agent_command()); } -// ── try_record_agent_command ───────────────────────────────────────────────── - /// When the record carries a dangling (unknown) runtime id, `try_record_agent_command` /// must return `Err` containing "DANGLING_HARNESS_ID" — NEVER the buzz-agent default. /// This test would fail if the function silently fell back to `default_agent_command()`. @@ -669,8 +649,8 @@ fn apply_agent_command_update_concrete_pin_keeps_materialized_runtime() { // ── probe_codex_acp_version ─────────────────────────────────────────────────── +mod forced_discovery; mod managed_path_resolution; - #[cfg(unix)] #[test] fn probe_codex_acp_version_parses_full_semver_output() { @@ -1686,7 +1666,7 @@ fn custom_catalog_entry_carries_definition_env_for_edit_roundtrip() { ) .unwrap(); - let entries = discover_acp_runtimes_from(Some(dir.path())); + let entries = discover_acp_runtimes_from(Some(dir.path()), true); let entry = entries .iter() .find(|e| e.id == "env-harness") @@ -1716,7 +1696,7 @@ fn builtin_catalog_entry_has_empty_definition_env() { // publishes to the global registry. let _path_guard = crate::managed_agents::lock_path_mutex(); let _lock = registry_test_lock(); - let entries = discover_acp_runtimes_from(None); + let entries = discover_acp_runtimes_from(None, true); // Find any builtin entry (e.g. "goose" or "claude"). let builtin = entries .iter() @@ -1797,7 +1777,7 @@ fn discovery_publish_path_survives_mid_flight_save() { assert!(lookup_loaded_harness_by_id("mid-flight-save").is_some()); })); - let _entries = discover_acp_runtimes_from(Some(dir.path())); + let _entries = discover_acp_runtimes_from(Some(dir.path()), true); assert!( lookup_loaded_harness_by_id("mid-flight-save").is_some(), @@ -1830,7 +1810,7 @@ fn discovery_publish_path_drops_mid_flight_delete() { assert!(lookup_loaded_harness_by_id("mid-flight-delete").is_none()); })); - let _entries = discover_acp_runtimes_from(Some(dir.path())); + let _entries = discover_acp_runtimes_from(Some(dir.path()), true); assert!( lookup_loaded_harness_by_id("mid-flight-delete").is_none(), diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests/forced_discovery.rs b/desktop/src-tauri/src/managed_agents/discovery/tests/forced_discovery.rs new file mode 100644 index 00000000000..cfbad365e3a --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/discovery/tests/forced_discovery.rs @@ -0,0 +1,163 @@ +// ── Cheap vs. forced discovery: the auth-probe split ──────────────────────── +// +// `discover_acp_providers(force: true)` spawns one CLI auth probe per available +// runtime; the cheap default path must reuse the last cached status and spawn +// nothing. These tests pin that split through the real `discover_acp_runtimes_from` +// pipeline with a fake `claude` CLI that records every invocation to a sentinel. + +/// Build a fake `claude` runtime on a fresh PATH: the adapter (`claude-agent-acp`) +/// and the CLI (`claude`). The CLI appends a line to `probe_log` each time it +/// runs and exits 0 (→ `LoggedIn`), so the log's existence proves whether the +/// auth probe was spawned. +#[cfg(unix)] +#[test] +fn forced_discovery_probes_auth_but_cheap_discovery_reuses_cached_status() { + use crate::managed_agents::custom_harnesses::registry_test_lock; + use crate::managed_agents::discovery::{clear_resolve_cache, discover_acp_runtimes_from}; + use crate::managed_agents::{AcpAvailabilityStatus, AuthStatus}; + use std::os::unix::fs::PermissionsExt; + + let _path_guard = crate::managed_agents::lock_path_mutex(); + let _registry_guard = registry_test_lock(); + + let dir = tempfile::tempdir().expect("tempdir"); + let probe_log = dir.path().join("claude-probe.log"); + + for name in ["claude-agent-acp", "claude"] { + let bin = dir.path().join(name); + // The adapter is never executed; only `claude` logs + exits 0. + let script = format!( + "#!/bin/sh\necho ran >> \"{}\"\nexit 0\n", + probe_log.display() + ); + std::fs::write(&bin, script).expect("write fake bin"); + std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod"); + } + + // Start from a clean resolve + auth cache, and a PATH that only sees our fakes. + clear_resolve_cache(); + let old_path = std::env::var_os("PATH").unwrap_or_default(); + let mut new_path = vec![dir.path().to_path_buf()]; + new_path.extend(std::env::split_paths(&old_path)); + std::env::set_var("PATH", std::env::join_paths(&new_path).expect("join PATH")); + + let result = std::panic::catch_unwind(|| { + // ── Forced: probes run, status is LoggedIn, cache is warmed. ────────── + let forced = discover_acp_runtimes_from(None, true); + let claude = forced + .iter() + .find(|e| e.id == "claude") + .expect("claude entry present"); + assert_eq!(claude.availability, AcpAvailabilityStatus::Available); + assert_eq!(claude.auth_status, AuthStatus::LoggedIn); + assert!( + probe_log.exists(), + "forced discovery must spawn the auth probe" + ); + assert!( + super::super::auth_status_cache::len() > 0, + "forced discovery must warm the auth-status cache" + ); + + // ── Cheap: no probe spawned, status reused from cache. ──────────────── + std::fs::remove_file(&probe_log).expect("clear probe log"); + let cheap = discover_acp_runtimes_from(None, false); + let claude = cheap + .iter() + .find(|e| e.id == "claude") + .expect("claude entry present"); + assert_eq!( + claude.availability, + AcpAvailabilityStatus::Available, + "cheap path keeps availability (resolved from cache)" + ); + assert_eq!( + claude.auth_status, + AuthStatus::LoggedIn, + "cheap path must reuse the cached auth status" + ); + assert!( + !probe_log.exists(), + "cheap discovery must not spawn any auth probe" + ); + }); + + // Restore global state before propagating any panic. + std::env::set_var("PATH", &old_path); + clear_resolve_cache(); + if let Err(e) = result { + std::panic::resume_unwind(e); + } +} + +/// Before any forced probe warms the resolve cache, the cheap path resolves +/// nothing live — it must not resolve a present-but-uncached binary by spawning +/// a login shell to discover it. This is the flip side of the zero-spawn +/// contract: cache-only resolution cannot see a binary the forced path has not +/// yet cached. The forced path (exercised on every surface mount) resolves it +/// and warms the cache; a subsequent cheap call then sees it Available (covered +/// by `forced_discovery_probes_auth_but_cheap_discovery_reuses_cached_status`). +/// +/// The assertion is scoped to what holds on any machine: the fake PATH-only +/// `claude` CLI must not be resolved by the cheap path (availability is never +/// `Available`, auth stays `Unknown`) and no login shell is spawned. It does +/// not pin the exact `NotInstalled` vs `CliMissing` variant, because a real +/// Buzz-managed `claude-agent-acp` shim on the host resolves via a filesystem +/// stat (production-correct, never a spawn) and yields `CliMissing` — a genuine +/// environment difference, not a regression. +#[cfg(unix)] +#[test] +fn cheap_discovery_reports_absent_before_any_forced_probe() { + use crate::managed_agents::custom_harnesses::registry_test_lock; + use crate::managed_agents::discovery::{ + clear_resolve_cache, discover_acp_runtimes_from, login_shell_spawn_probe, + }; + use crate::managed_agents::{AcpAvailabilityStatus, AuthStatus}; + use std::os::unix::fs::PermissionsExt; + + let _path_guard = crate::managed_agents::lock_path_mutex(); + let _registry_guard = registry_test_lock(); + + let dir = tempfile::tempdir().expect("tempdir"); + for name in ["claude-agent-acp", "claude"] { + let bin = dir.path().join(name); + std::fs::write(&bin, "#!/bin/sh\nexit 0\n").expect("write fake bin"); + std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).expect("chmod"); + } + + clear_resolve_cache(); // also clears the auth-status cache + login_shell_spawn_probe::reset(); + let old_path = std::env::var_os("PATH").unwrap_or_default(); + let mut new_path = vec![dir.path().to_path_buf()]; + new_path.extend(std::env::split_paths(&old_path)); + std::env::set_var("PATH", std::env::join_paths(&new_path).expect("join PATH")); + + let result = std::panic::catch_unwind(|| { + let cheap = discover_acp_runtimes_from(None, false); + let claude = cheap + .iter() + .find(|e| e.id == "claude") + .expect("claude entry present"); + assert_ne!( + claude.availability, + AcpAvailabilityStatus::Available, + "cache-only cheap discovery must not resolve the PATH-only claude CLI live" + ); + assert_eq!( + claude.auth_status, + AuthStatus::Unknown, + "an unresolved runtime with no cached status stays Unknown" + ); + assert_eq!( + login_shell_spawn_probe::count(), + 0, + "cheap discovery must not spawn a login shell to resolve the PATH-only CLI" + ); + }); + + std::env::set_var("PATH", &old_path); + clear_resolve_cache(); + if let Err(e) = result { + std::panic::resume_unwind(e); + } +} diff --git a/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs b/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs index 0795bb2345e..5369b6321b7 100644 --- a/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs +++ b/desktop/src-tauri/src/managed_agents/discovery/tests/managed_path_resolution.rs @@ -1,5 +1,28 @@ use crate::managed_agents::discovery::{clear_resolve_cache, resolve_command}; +/// A login-shell command lookup must treat its argument as pure data — a +/// payload containing shell metacharacters must never execute. +#[test] +fn login_shell_lookup_treats_command_as_data() { + use super::super::find_via_login_shell; + + let _guard = crate::managed_agents::lock_path_mutex(); + let marker = + std::env::temp_dir().join(format!("buzz-discovery-marker-{}", uuid::Uuid::new_v4())); + let payload = format!("doesnotexist; touch {} #", marker.display()); + + let resolved = find_via_login_shell(&payload); + + assert!( + resolved.is_none(), + "payload should not resolve to a command" + ); + assert!( + !marker.exists(), + "shell lookup must not execute injected commands" + ); +} + /// The legacy Goose Windows installer wrote `%USERPROFILE%\goose\goose.exe`, /// a directory on no standard PATH. `resolve_command_uncached` finds binaries /// outside PATH only by scanning `common_binary_paths()`, so that directory @@ -88,3 +111,79 @@ fn resolve_command_prefers_buzz_managed_npm_shim_over_path() { "Buzz-managed npm shim must win over PATH/global shims" ); } + +/// The cheap discovery path must never spawn a login shell — not even on a +/// cold cache. +/// +/// `force: false` resolves commands from cache only (`resolve_command_cached`): +/// on a resolve-cache miss it reports the command absent instead of falling +/// through to `resolve_command_uncached` → `find_via_login_shell`, which spawns +/// zsh/bash. That spawn on the channel-switch/composer hot path is the exact +/// freeze source the cheap path exists to avoid, so a cold cheap call must +/// spawn zero login shells. The forced path remains the sole prober: the same +/// absent-command fixture spawns at least once under `force: true`, proving the +/// cheap-path zero is real and not a fixture that never reaches the probe. +#[cfg(unix)] +#[test] +fn cheap_discovery_never_spawns_login_shell_even_when_cold() { + use crate::managed_agents::custom_harnesses::registry_test_lock; + use crate::managed_agents::discovery::{ + clear_resolve_cache, discover_acp_runtimes_from, login_shell_spawn_probe, + }; + use std::fs; + use tempfile::tempdir; + + // Serialize with every other test that spawns a login shell: the spawn + // counter and the PATH/login-shell caches are process-global. + let _path_guard = crate::managed_agents::lock_path_mutex(); + let _registry = registry_test_lock(); + + // A custom harness whose command cannot resolve anywhere, so the resolver + // reaches `find_via_login_shell` under the forced (live) path. + let dir = tempdir().unwrap(); + fs::write( + dir.path().join("absent-harness.json"), + r#"{ + "id": "absent-harness", + "label": "Absent Harness", + "command": "buzz-absent-command-xyzzy", + "args": [] + }"#, + ) + .unwrap(); + + // Cold cache, cheap path: must spawn ZERO login shells (cache-only resolve + // reports the absent command missing without probing). + clear_resolve_cache(); + login_shell_spawn_probe::reset(); + let _ = discover_acp_runtimes_from(Some(dir.path()), false); + let cold_cheap = login_shell_spawn_probe::count(); + assert_eq!( + cold_cheap, 0, + "a cold cheap discovery must not spawn any login shell, got {cold_cheap}" + ); + + // Second cheap discovery, still cold (no forced probe populated the cache): + // still zero — cache-only resolution never probes. + login_shell_spawn_probe::reset(); + let _ = discover_acp_runtimes_from(Some(dir.path()), false); + let second_cheap = login_shell_spawn_probe::count(); + assert_eq!( + second_cheap, 0, + "a repeated cheap discovery must not spawn any login shell, got {second_cheap}" + ); + + // Forced path over the SAME absent fixture: resolves live and reaches + // `find_via_login_shell` at least once. Proves the cheap-path zero above is + // genuine — the fixture does drive the probe when live resolution runs — + // not a vacuous zero from a fixture that never reaches it. + clear_resolve_cache(); + login_shell_spawn_probe::reset(); + let _ = discover_acp_runtimes_from(Some(dir.path()), true); + let forced = login_shell_spawn_probe::count(); + clear_resolve_cache(); + assert!( + forced >= 1, + "the forced path must probe the absent command via login shell at least once, got {forced}" + ); +} diff --git a/desktop/src-tauri/src/managed_agents/discovery/windows_install.rs b/desktop/src-tauri/src/managed_agents/discovery/windows_install.rs new file mode 100644 index 00000000000..09e27a62bea --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/discovery/windows_install.rs @@ -0,0 +1,225 @@ +//! Defender-safe construction of the Windows PowerShell CLI install commands. +//! +//! # Why the shape matters +//! +//! Windows Defender's ML classifier flags the bare `irm | iex` command +//! line as `Trojan:Win32/Commando.A!ml` — piping a downloaded string straight +//! into `Invoke-Expression` is a textbook dropper signature, so the *command +//! line itself* is scored, independent of what the URL actually serves. The +//! spawn is denied before PowerShell runs, surfacing as +//! `failed to spawn shell: Access is denied. (os error 5)`, and the block is +//! sticky: Defender's "Allow" button does not clear it. +//! +//! [`windows_install_command!`] emits the two-step form instead — download the +//! vendor script to a file, then execute the file — which does not match that +//! signature. All three runtimes use it, not only the one observed failing: +//! Goose and Claude escaped by scoring under the classifier threshold, which is +//! luck rather than design, and the threshold is not ours to depend on. +//! +//! # Why one macro instead of three literals +//! +//! The catalog needs `&'static str`, so the commands must be built at compile +//! time from literals. Emitting them from a single macro means the security +//! shape is defined once and cannot drift between runtimes as URLs change — +//! a per-runtime literal would let one entry silently regress to `iex`. +//! +//! # Exit-code fidelity +//! +//! [#2892](https://github.com/block/buzz/pull/2892) established that an install +//! step must not report success when the download failed. Two pieces preserve +//! that here, and both are load-bearing: +//! +//! - `$ErrorActionPreference='Stop'` makes a failed `Invoke-RestMethod` +//! terminate the whole command. Without it a failed download falls through to +//! `& $installer` on a path that does not exist, and PowerShell exits **0** — +//! the exact masking #2892 removed, in a new dress. `Stop` also prevents +//! executing a *stale* installer left in `$env:TEMP` by an earlier run. +//! - `exit $LASTEXITCODE` propagates the vendor script's own exit code. Without +//! it PowerShell reports its own status and a vendor failure of `3` flattens +//! to `1`, losing the distinction the retry logic reads. +//! +//! Verified against `pwsh` over a local HTTP server: vendor exit 3 surfaces as +//! 3, vendor exit 0 as 0, a 404 and an unresolvable host as non-zero, and a +//! planted stale installer is never executed. The old `irm | iex` shape +//! produces identical codes for all four, so this is not a behavior change. +//! +//! # Quoting contract +//! +//! The emitted body is wrapped in one double-quote pair, which +//! `install_powershell_command` strips before handing the body to PowerShell. +//! The body therefore uses **only single quotes** internally; a double quote +//! would terminate that pair early and truncate the command. + +/// Build the Windows CLI install command for one runtime. +/// +/// `slug` names the downloaded script (`buzz-install-.ps1`) so concurrent +/// installs of different runtimes cannot overwrite each other's file. The +/// optional third argument carries a runtime's env prefix (Goose's +/// `$env:CONFIGURE='false'; `) and must end with `; `. +/// +/// See the module docs for why each fragment is present. +macro_rules! windows_install_command { + ($slug:literal, $url:literal) => { + windows_install_command!($slug, $url, "") + }; + ($slug:literal, $url:literal, $env_prefix:literal) => { + concat!( + "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"", + $env_prefix, + "$ErrorActionPreference='Stop'; ", + "$installer=Join-Path $env:TEMP 'buzz-install-", + $slug, + ".ps1'; ", + "Invoke-RestMethod ", + $url, + " -OutFile $installer; ", + "& $installer; ", + "exit $LASTEXITCODE\"", + ) + }; +} + +#[cfg(test)] +mod tests { + use crate::managed_agents::known_acp_runtime_exact; + + /// Every runtime that ships a Windows install command. `cli_install_commands_windows` + /// is read directly rather than through `cli_install_commands_for_os()` so these + /// assertions cover the Windows strings while running on the Linux CI host. + fn windows_install_commands() -> Vec<(&'static str, &'static str)> { + ["goose", "claude", "codex"] + .into_iter() + .flat_map(|id| { + known_acp_runtime_exact(id) + .expect("runtime must exist in the catalog") + .cli_install_commands_windows + .iter() + .map(move |command| (id, *command)) + }) + .collect() + } + + /// The whole point of the change: no runtime may carry the flagged + /// download-and-execute-in-one-line signature. + #[test] + fn test_no_windows_install_command_pipes_a_download_into_iex() { + for (id, command) in windows_install_commands() { + assert!( + !command.contains("| iex"), + "{id}: `irm | iex` is the shape Defender flags as Trojan:Win32/Commando.A!ml; \ + download to a file and execute the file instead. Got: {command}" + ); + assert!( + !command.contains("Invoke-Expression"), + "{id}: Invoke-Expression on downloaded content carries the same signature. \ + Got: {command}" + ); + } + } + + /// All three runtimes must be hardened, not just the one observed failing. + /// Goose and Claude escaped only by scoring under the classifier threshold. + #[test] + fn test_every_windows_install_command_downloads_to_a_file_then_executes_it() { + let commands = windows_install_commands(); + assert_eq!( + commands.len(), + 3, + "expected exactly one Windows install command for each of goose, claude, codex" + ); + for (id, command) in commands { + assert!( + command.contains("-OutFile $installer"), + "{id}: must download the vendor script to a file. Got: {command}" + ); + assert!( + command.contains("& $installer"), + "{id}: must execute the downloaded file. Got: {command}" + ); + assert!( + command.contains(&format!("buzz-install-{id}.ps1")), + "{id}: script name must be runtime-specific so concurrent installs of \ + different runtimes cannot overwrite each other. Got: {command}" + ); + } + } + + /// Guards the #2892 regression: without `Stop`, a failed download falls + /// through to a missing file and PowerShell exits 0, reporting a failed + /// install as a success. Without `exit $LASTEXITCODE`, the vendor's own + /// exit code is replaced by PowerShell's. + #[test] + fn test_every_windows_install_command_preserves_failure_exit_codes() { + for (id, command) in windows_install_commands() { + assert!( + command.contains("$ErrorActionPreference='Stop'"), + "{id}: a failed download must abort instead of running a missing or stale \ + installer and exiting 0 (see #2892). Got: {command}" + ); + assert!( + command.contains("exit $LASTEXITCODE"), + "{id}: the vendor script's exit code must propagate. Got: {command}" + ); + } + } + + /// `install_powershell_command` strips exactly one outer double-quote pair. + /// An inner double quote would close that pair early and truncate the body. + #[test] + fn test_every_windows_install_command_quotes_the_body_exactly_once() { + for (id, command) in windows_install_commands() { + let body = command + .split_once(" -Command ") + .map(|(_, body)| body) + .unwrap_or_else(|| panic!("{id}: command must pass a -Command body: {command}")); + assert!( + body.starts_with('"') && body.ends_with('"'), + "{id}: body must be wrapped in one double-quote pair. Got: {body}" + ); + assert_eq!( + body.matches('"').count(), + 2, + "{id}: body must contain no inner double quotes — one would terminate the \ + outer pair early and truncate the command. Got: {body}" + ); + } + } + + /// Goose's installer reads `CONFIGURE` to stay non-interactive; losing the + /// prefix hangs the install waiting on input that never comes. + #[test] + fn test_goose_windows_install_command_keeps_its_env_prefix() { + let goose = known_acp_runtime_exact("goose").unwrap(); + let command = goose.cli_install_commands_windows[0]; + assert!( + command.contains("$env:CONFIGURE='false'"), + "goose must stay non-interactive. Got: {command}" + ); + assert!( + command.find("$env:CONFIGURE='false'").unwrap() + < command.find("Invoke-RestMethod").unwrap(), + "the env prefix must be set before the installer runs. Got: {command}" + ); + } + + /// The vendor URLs are the payload; pin them so a refactor of the shared + /// shape cannot silently retarget a download. + #[test] + fn test_windows_install_commands_target_the_official_vendor_urls() { + for (id, expected) in [ + ( + "goose", + "https://raw.githubusercontent.com/aaif-goose/goose/main/download_cli.ps1", + ), + ("claude", "https://claude.ai/install.ps1"), + ("codex", "https://chatgpt.com/codex/install.ps1"), + ] { + let runtime = known_acp_runtime_exact(id).unwrap(); + let command = runtime.cli_install_commands_windows[0]; + assert!( + command.contains(&format!("Invoke-RestMethod {expected} -OutFile")), + "{id}: must download from {expected}. Got: {command}" + ); + } + } +} diff --git a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs index c8e437809ce..5b048b815cb 100644 --- a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs +++ b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs @@ -64,6 +64,7 @@ fn record( runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -88,6 +89,7 @@ fn record( source_team_persona_slug: None, catalog_source: None, relay_mesh: None, + effort_level: None, auto_restart_on_config_change: false, definition_respond_to: None, definition_respond_to_allowlist: vec![], diff --git a/desktop/src-tauri/src/managed_agents/env_vars.rs b/desktop/src-tauri/src/managed_agents/env_vars.rs index 592a5cbbd92..de6ec28c41a 100644 --- a/desktop/src-tauri/src/managed_agents/env_vars.rs +++ b/desktop/src-tauri/src/managed_agents/env_vars.rs @@ -5,11 +5,13 @@ //! Precedence: desktop parent env < persona env < agent env (last wins on //! key collision). See `runtime::spawn_agent_child`. //! -//! A small set of *reserved* keys — Buzz's identity and secrets — are -//! rejected at save time and stripped at runtime so a typo or malicious -//! value can't swap the agent's nsec. Behavior knobs (GOOSE_MODE, BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain -//! freely overridable — those have dedicated UI fields, but power users -//! may want to bypass them. +//! A small set of *reserved* keys includes Buzz's identity, secrets, security +//! gates, and control-plane values. Save-time validation rejects those keys. +//! Runtime filtering strips old persisted overrides. Behavior knobs +//! (GOOSE_MODE, BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain freely +//! overridable. Power users can still bypass their dedicated UI fields. +//! `BUZZ_ACP_AGENTS` is reserved because Desktop applies harness-specific caps +//! before it writes the provider launch policy. use std::collections::BTreeMap; @@ -39,61 +41,9 @@ pub(crate) fn is_derived_provider_model_key(key: &str) -> bool { .any(|k| k.eq_ignore_ascii_case(key)) } -/// Env var keys that Buzz sets itself and users must not override from -/// the persona/agent env_vars UI. Three categories: -/// -/// 1. **Identity / secrets** — overriding would swap the agent's nsec or -/// leak credentials. -/// 2. **Code-execution surface** — overriding the binary/args lets the -/// user run arbitrary code as the agent process. -/// 3. **Security gates** — overriding the respond-to mode/allowlist or -/// relay URL would silently break the saved security settings (the UI -/// shows owner-only while the running agent answers anyone, for -/// example), or redirect the agent to an attacker-controlled relay. -/// -/// This list is deliberately narrow — it only covers keys with security -/// implications. Behavior knobs (GOOSE_MODE, BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain freely -/// overridable; those have dedicated UI fields but power users may want -/// to bypass them. -pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[ - // Identity / secrets. - "BUZZ_PRIVATE_KEY", - "NOSTR_PRIVATE_KEY", - "BUZZ_AUTH_TAG", - "BUZZ_API_TOKEN", - "BUZZ_ACP_PRIVATE_KEY", - "BUZZ_ACP_API_TOKEN", - // Relay URL: overriding would let a malicious config redirect the - // agent to an attacker-controlled relay. - "BUZZ_RELAY_URL", - // Code-execution surface: overriding would let the user run arbitrary - // binaries/args as the agent process. - "BUZZ_ACP_AGENT_COMMAND", - "BUZZ_ACP_AGENT_ARGS", - "BUZZ_ACP_MCP_COMMAND", - // Security gates: respond-to mode + allowlist + legacy owner-only - // fallback. Overriding would make the running agent's gate diverge - // from the saved/UI-visible settings. - "BUZZ_ACP_RESPOND_TO", - "BUZZ_ACP_RESPOND_TO_ALLOWLIST", - "BUZZ_ACP_AGENT_OWNER", - // Readiness handoff: desktop is the ONLY readiness source. A saved or - // ambient env var must not be able to forge setup mode (NotReady) on a - // Ready agent or suppress it (empty/stale payload) on a NotReady one. - "BUZZ_ACP_SETUP_PAYLOAD", - // Desktop ownership markers: these brand every spawned harness with the - // launching Desktop instance. A user-supplied override would let a - // definition masquerade as a different instance or fake the nonce used - // for same-session sweep decisions. - "BUZZ_MANAGED_AGENT", - "BUZZ_MANAGED_AGENT_START_NONCE", -]; - -pub(crate) fn is_reserved_env_key(key: &str) -> bool { - RESERVED_ENV_KEYS - .iter() - .any(|reserved| reserved.eq_ignore_ascii_case(key)) -} +// Canonical reserved-key list + predicate, shared verbatim with `build.rs`. +// See `reserved_env_keys.rs` for why this is `include!`d rather than a module. +include!("reserved_env_keys.rs"); /// Returns true if `key` is a well-formed POSIX-shaped env var name: /// `[A-Za-z_][A-Za-z0-9_]*`. This is a hard requirement, not a stylistic @@ -220,6 +170,30 @@ pub fn validate_user_env_keys(env_vars: &BTreeMap) -> Result<(), Ok(()) } +/// Returns `true` when `key` is safe to show verbatim — not a credential. +/// +/// Default-deny: every key NOT in this explicit allowlist is masked. Callers +/// that display env values (baked-env UI, spawn-diff tooltip) share this +/// single authority — no second list. +/// +/// Allowlist (case-insensitive): +/// - `BUZZ_AGENT_PROVIDER`, `BUZZ_AGENT_MODEL` — agent runtime selection +/// - `BUZZ_AGENT_THINKING_EFFORT` — non-secret enum (none/minimal/low/medium/high/xhigh/max) +/// - `BUZZ_AGENT_THINKING_SUMMARY` — non-secret enum (auto/concise/detailed) +/// - `DATABRICKS_HOST`, `DATABRICKS_MODEL` — Block non-secret defaults +pub(crate) fn is_safe_to_reveal(key: &str) -> bool { + const SAFE_KEYS: &[&str] = &[ + "BUZZ_AGENT_PROVIDER", + "BUZZ_AGENT_MODEL", + "BUZZ_AGENT_THINKING_EFFORT", + "BUZZ_AGENT_THINKING_SUMMARY", + "DATABRICKS_HOST", + "DATABRICKS_MODEL", + ]; + let upper = key.to_ascii_uppercase(); + SAFE_KEYS.iter().any(|safe| upper == *safe) +} + /// Per-value byte cap for env values. 32 KiB is generous for credentials, /// JWT-ish tokens, certs etc., but small enough that a malformed IPC /// caller can't blow up the persona/agent JSON file. Tune up if real @@ -307,28 +281,5 @@ pub(crate) fn live_persona_env( .unwrap_or_default() } -/// Resolve live env_vars for a linked persona, loading personas from disk. -/// -/// Returns the persona's `env_vars` map if a persona_id is provided and found; -/// returns an empty map if no persona is linked. Errors if the linked persona -/// is missing. Used by the provider deploy path, which has no pre-loaded -/// persona slice. -pub(crate) fn resolve_persona_env( - app: &tauri::AppHandle, - persona_id: Option<&str>, -) -> Result, String> { - let Some(pid) = persona_id else { - return Ok(std::collections::BTreeMap::new()); - }; - let personas = super::load_personas(app).map_err(|e| { - format!("failed to load personas while resolving env for persona `{pid}`: {e}") - })?; - let persona = personas - .into_iter() - .find(|p| p.id == pid) - .ok_or_else(|| format!("persona `{pid}` not found while resolving env"))?; - Ok(persona.env_vars) -} - #[cfg(test)] mod tests; diff --git a/desktop/src-tauri/src/managed_agents/env_vars/tests.rs b/desktop/src-tauri/src/managed_agents/env_vars/tests.rs index cf57b125468..f3de11ad242 100644 --- a/desktop/src-tauri/src/managed_agents/env_vars/tests.rs +++ b/desktop/src-tauri/src/managed_agents/env_vars/tests.rs @@ -150,7 +150,11 @@ fn reserved_keys_include_respond_to_gate() { // Respond-to mode + allowlist control who the agent answers. // Overriding via env_vars would let the running agent answer // anyone even when the UI/record says owner-only. - for key in ["BUZZ_ACP_RESPOND_TO", "BUZZ_ACP_RESPOND_TO_ALLOWLIST"] { + for key in [ + "BUZZ_ACP_RESPOND_TO", + "BUZZ_ACP_RESPOND_TO_ALLOWLIST", + "BUZZ_ACP_ALLOWED_RESPOND_TO", + ] { assert!(is_reserved_env_key(key), "{key} should be reserved"); let agent = map(&[(key, "anyone")]); let merged = merged_user_env(&BTreeMap::new(), &agent); @@ -158,6 +162,19 @@ fn reserved_keys_include_respond_to_gate() { } } +#[test] +fn reserved_keys_include_remote_lifetime_policy() { + for key in [ + "BUZZ_ACP_EXIT_AFTER_INACTIVITY", + "BUZZ_ACP_IDLE_POOL_SLEEP", + "BUZZ_ACP_NO_PRESENCE", + ] { + assert!(is_reserved_env_key(key), "{key} should be reserved"); + let agent = map(&[(key, "0")]); + assert!(merged_user_env(&BTreeMap::new(), &agent).is_empty()); + } +} + #[test] fn reserved_keys_include_code_execution_surface() { // The agent/MCP command + args are what Buzz actually exec's. diff --git a/desktop/src-tauri/src/managed_agents/global_config/tests.rs b/desktop/src-tauri/src/managed_agents/global_config/tests.rs index 553596e226c..65cde47f26b 100644 --- a/desktop/src-tauri/src/managed_agents/global_config/tests.rs +++ b/desktop/src-tauri/src/managed_agents/global_config/tests.rs @@ -324,6 +324,7 @@ fn bare_record() -> ManagedAgentRecord { runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -348,6 +349,7 @@ fn bare_record() -> ManagedAgentRecord { source_team_persona_slug: None, catalog_source: None, relay_mesh: None, + effort_level: None, auto_restart_on_config_change: false, definition_respond_to: None, definition_respond_to_allowlist: vec![], diff --git a/desktop/src-tauri/src/managed_agents/mod.rs b/desktop/src-tauri/src/managed_agents/mod.rs index be9b07cf11f..272c03348b9 100644 --- a/desktop/src-tauri/src/managed_agents/mod.rs +++ b/desktop/src-tauri/src/managed_agents/mod.rs @@ -1,13 +1,18 @@ +pub(crate) mod access_policy; mod agent_env; pub(crate) mod agent_events; pub(crate) mod agent_snapshot; +pub(crate) mod agent_snapshot_envelope; pub(crate) mod team_snapshot; +pub(crate) use access_policy::{owner_only, owner_only_access_build, projected_access_with_policy}; pub(crate) use agent_env::{ baked_build_env, build_buzz_agent_provider_defaults, discovery_env_with_baked_floor, }; mod backend; +pub(crate) mod claude_config; pub(crate) mod config_bridge; pub(crate) mod custom_harnesses; +mod definition_validation; mod discovery; pub(crate) mod effective_config; mod env_vars; @@ -15,6 +20,7 @@ pub(crate) mod git_bash; pub(crate) mod global_config; mod managed_node_paths; mod nest; +pub(crate) mod parallelism; mod persona_avatars; pub(crate) mod persona_events; mod personas; @@ -30,10 +36,11 @@ mod runtime; mod runtime_commands; mod runtime_types; pub(crate) mod snapshot_avatar; -pub(crate) mod spawn_hash; +pub(crate) mod spawn_snapshot; pub(crate) mod storage; pub(crate) mod team_events; mod team_repair; +pub(crate) use team_repair::team_persona_key; mod teams; mod types; @@ -47,6 +54,9 @@ pub(crate) fn lock_path_mutex() -> std::sync::MutexGuard<'static, ()> { } pub use backend::*; +pub(crate) use definition_validation::{ + validate_agent_definition_text, validate_managed_agent_definition_text, +}; pub use discovery::*; pub use env_vars::*; #[cfg(windows)] @@ -58,6 +68,7 @@ pub(crate) use global_config::{ }; pub(crate) use managed_node_paths::*; pub use nest::*; +pub use parallelism::{acp_agents_value, effective_parallelism, harness_max_parallelism}; pub use personas::*; #[cfg(windows)] pub use process_lifecycle::*; diff --git a/desktop/src-tauri/src/managed_agents/nest.rs b/desktop/src-tauri/src/managed_agents/nest.rs index c8f008836d7..3d191926a39 100644 --- a/desktop/src-tauri/src/managed_agents/nest.rs +++ b/desktop/src-tauri/src/managed_agents/nest.rs @@ -11,10 +11,12 @@ use super::{load_managed_agents, load_personas, AgentDefinition, ManagedAgentRec #[cfg(test)] use super::{BackendKind, RespondTo}; use crate::app_state::AppState; -use crate::relay::relay_ws_url_with_override; +use crate::commands::{capture_relay_target, fetch_archived_pubkeys_at}; +use std::collections::HashSet; use std::fs; use std::io; use std::path::{Path, PathBuf}; +use std::sync::Mutex; use tauri::{AppHandle, Manager}; use crate::managed_agents::discovery::known_skill_dirs; @@ -46,7 +48,7 @@ const BUZZ_CLI_SKILL_MD: &str = include_str!("nest_skill.md"); /// Template content version for AGENTS.md static content (above managed markers). /// Bump this when changing `nest_agents.md` to trigger refresh on existing installs. /// Version 1 is implicitly "before this mechanism existed" (no version file). -const NEST_AGENTS_VERSION: u32 = 4; +const NEST_AGENTS_VERSION: u32 = 5; /// Template content version for SKILL.md. /// Bump this when changing `nest_skill.md` to trigger refresh on existing installs. @@ -106,31 +108,6 @@ pub fn nest_dir() -> Option { } } -/// Returns `true` iff `path` ends with the dev-nest directory name (`.buzz-dev`). -/// -/// Pure function — no globals — so it can be unit-tested without touching the -/// process-lifetime [`NEST_DIR`] `OnceLock`. -fn path_is_dev_nest(path: &std::path::Path) -> bool { - path.file_name() - .and_then(|n| n.to_str()) - .map(|n| n == NEST_DIR_DEV) - .unwrap_or(false) -} - -/// Returns `true` when the running binary is using the dev nest (`~/.buzz-dev`). -/// -/// This is `true` for all dev builds — `just staging` and `just dev` — because -/// [`init_nest_dir`] is called with `is_dev = true` when the Tauri app-data -/// directory starts with `"xyz.block.buzz.app.dev"`. -/// -/// Returns `false` when: -/// - The nest is the production nest (`~/.buzz`, signed DMG). -/// - [`init_nest_dir`] has not been called yet (unit tests, home dir -/// unresolvable) — the fallback path is always the prod nest. -pub fn nest_is_dev() -> bool { - nest_dir().map(|p| path_is_dev_nest(&p)).unwrap_or(false) -} - /// Creates the Buzz nest at `~/.buzz` if it doesn't already exist. /// /// Delegates to [`ensure_nest_at`] with the resolved nest directory. @@ -548,19 +525,35 @@ fn escape_md_cell(s: &str) -> String { s.replace('|', "\\|").replace('\n', " ") } +/// True iff the relay has archived this instance's identity. Membership is +/// tested against the relay's `kind:13535` snapshot (lowercased hex); an empty +/// set (relay unreachable) fails open — see [`regenerate_nest_context`]. +fn is_archived(record: &ManagedAgentRecord, archived: &HashSet) -> bool { + archived.contains(&record.pubkey.to_ascii_lowercase()) +} + pub fn render_dynamic_section( personas: &[AgentDefinition], agents: &[ManagedAgentRecord], + archived: &HashSet, relay_url: &str, ) -> String { - let active_agents = if agents.is_empty() { + // Every managed agent is eligible on every community — `relay_url` is a + // legacy creation-era field that `effective_agent_relay_url()` deliberately + // ignores, and snapshot-imported records store it empty by design. The only + // roster filter is identity-archive. + let live: Vec<&ManagedAgentRecord> = agents + .iter() + .filter(|a| !is_archived(a, archived)) + .collect(); + let active_agents = if live.is_empty() { "## Active Agents\n\n*(No agents deployed yet. Add agents in the Buzz desktop app.)*" .to_string() } else { let mut table = "## Active Agents\n\n| Name | Persona | How to address |\n|------|---------|----------------|" .to_string(); - for agent in agents { + for agent in live { let role = agent .persona_id .as_deref() @@ -670,7 +663,124 @@ pub fn upsert_managed_section(file_path: &Path, new_section_content: &str) -> io Ok(()) } -pub fn regenerate_nest_context(app: &AppHandle) -> Result<(), String> { +/// Serializes nest-context writes so a slow, stale regeneration cannot roll the +/// file back over a newer one. This is an ordered, latest-request-wins gate — +/// not a work coalescer: every superseded generation still performs its relay +/// reads, then drops its result at commit time. Adding a true dirty-loop owner +/// would be a larger change and is unwarranted at this user-driven trigger rate. +/// +/// Each regeneration request claims a monotonic generation *synchronously* at +/// request time (see [`NestRegenGate::claim`]), so the generation encodes +/// program order: boot's regen is claimed before `apply_workspace`'s, an edit's +/// regen before the next edit's. The claimed generation travels with the +/// spawned task and gates its write in [`NestRegenGate::commit`]: a task drops +/// its result once a *newer generation has been requested*, even if that newer +/// generation later fails before it writes. Gating on the highest *requested* +/// generation — not the highest *written* one — is what stops a slow, stale +/// pre-edit render from publishing after a newer post-edit render was claimed +/// and then failed during its relay work (which would otherwise leave the +/// obsolete roster authoritative until the next unrelated trigger). Declared +/// semantic: once a newer regeneration is requested, no older one publishes; +/// if that newer one fails, the file simply waits for the next trigger. +/// +/// `claim` and `commit` share one lock, so the "is this still the newest +/// request?" compare is atomic with the synchronous file write. A bare atomic +/// watermark checked separately from the write would let a new claim slip +/// between an older task's eligibility check and its write; holding the lock +/// across both closes that window (no `await` occurs while it is held). +struct NestRegenGate { + /// Highest generation *requested* so far (`0` = none yet). Advanced by + /// [`claim`] and read by [`commit`]; guarding both under this single lock + /// keeps the eligibility compare atomic with the file write. + highest_requested: Mutex, +} + +impl NestRegenGate { + const fn new() -> Self { + Self { + highest_requested: Mutex::new(0), + } + } + + /// Claim the next generation. Call synchronously at request time so the + /// value reflects when the regeneration was requested, not when its task + /// happens to run. Advancing the shared watermark here is what lets a later + /// [`commit`] recognize — and drop — any older generation's stale render. + fn claim(&self) -> u64 { + let mut requested = self + .highest_requested + .lock() + .unwrap_or_else(|poisoned| poisoned.into_inner()); + *requested += 1; + *requested + } + + /// Non-blocking [`claim`] against the *exact* lock `claim` takes. Returns + /// `Some(generation)` if it acquired the lock — i.e. a claim could proceed + /// with no contention — or `None` if the lock is already held, meaning a + /// concurrent claim would block on it. Because `claim` and `commit` share + /// `highest_requested`, calling this from inside `commit_hooked`'s + /// under-lock hook reports `None`: the eligibility compare and the write + /// are serialized against any new claim. A design that advanced the + /// watermark under a separate lock (or a lock-free atomic) would report + /// `Some` here — the regression this probe proves absent, with no reliance + /// on elapsed time or thread scheduling. + #[cfg(test)] + fn try_claim(&self) -> Option { + match self.highest_requested.try_lock() { + Ok(mut requested) => { + *requested += 1; + Some(*requested) + } + Err(std::sync::TryLockError::WouldBlock) => None, + Err(std::sync::TryLockError::Poisoned(poisoned)) => { + let mut requested = poisoned.into_inner(); + *requested += 1; + Some(*requested) + } + } + } + + /// Commit `content` for `generation`, dropping the write once a newer + /// generation has been *requested* (regardless of whether that newer + /// generation has written or ever will). Returns whether the file was + /// written. The lock spans the compare and the write so the check-and-write + /// is atomic and no await occurs while it is held. + fn commit(&self, agents_md: &Path, content: &str, generation: u64) -> io::Result { + self.commit_hooked(agents_md, content, generation, || {}) + } + + /// [`commit`] with a hook invoked while the lock is held, after the + /// eligibility compare and before the write. Production passes a no-op, so + /// this is exactly [`commit`]; tests pass a hook that calls [`try_claim`] + /// to prove no claim can land inside the compare-then-write window — the + /// probe reports the lock held here, whereas the flawed + /// separate-watermark/separate-write-lock design would report it free. The + /// `impl FnOnce` monomorphizes the no-op away. + fn commit_hooked( + &self, + agents_md: &Path, + content: &str, + generation: u64, + under_lock: impl FnOnce(), + ) -> io::Result { + let requested = self + .highest_requested + .lock() + .map_err(|_| io::Error::other("nest regen gate lock poisoned"))?; + if generation < *requested { + return Ok(false); + } + under_lock(); + upsert_managed_section(agents_md, content)?; + Ok(true) + } +} + +/// Process-wide ordered write gate for nest-context regeneration. +static NEST_REGEN: NestRegenGate = NestRegenGate::new(); + +pub async fn regenerate_nest_context(app: &AppHandle, generation: u64) -> Result<(), String> { let nest = nest_dir().ok_or("cannot resolve home directory for nest")?; let agents_md = nest.join("AGENTS.md"); @@ -681,23 +791,51 @@ pub fn regenerate_nest_context(app: &AppHandle) -> Result<(), String> { let personas = load_personas(app)?; let agents = load_managed_agents(app)?; let state = app.state::(); - let relay_url = relay_ws_url_with_override(&state); - let content = render_dynamic_section(&personas, &agents, &relay_url); - upsert_managed_section(&agents_md, &content) + // Capture the relay target once, before any network work, so this + // generation's rendered footer, NIP-11 signer, and snapshot query all + // belong to one relay even if a workspace switch changes the override + // between the two archive awaits below. + let target = capture_relay_target(&state); + // Identity-archived agents live only in the relay's `kind:13535` snapshot; + // local records all read `is_active: true`. Fails open (empty set → render + // everyone) so an unreachable relay can't blank the roster. The archive read + // uses the same captured target as the rendered relay; a later generation's + // task always wins the commit, so a fallback-relay boot render cannot bury a + // later apply_workspace render. + let archived: HashSet = fetch_archived_pubkeys_at(&state, &target) + .await + .into_iter() + .collect(); + let content = render_dynamic_section(&personas, &agents, &archived, &target.ws_url); + NEST_REGEN + .commit(&agents_md, &content, generation) .map_err(|e| format!("regenerate nest context: {e}"))?; Ok(()) } -/// Convenience wrapper: regenerates nest context, logging a warning on failure. +/// Convenience wrapper: claims a regeneration generation, then regenerates on a +/// spawned task, logging a warning on failure. /// /// All call sites treat regeneration as fire-and-forget — agents run fine with /// a stale AGENTS.md, so we warn and continue rather than propagating the error. +/// The generation is claimed *here*, synchronously, so it encodes call order; +/// the spawned task carries it into [`NestRegenGate::commit`], which drops +/// a stale render rather than letting a slow task overwrite a newer file. +/// Archive/unarchive trigger this directly, but the regen races the relay's +/// `kind:13535` snapshot update, so a just-archived agent may still linger for +/// one cycle until the next regen (any agent/team edit or the next launch). pub fn try_regenerate_nest(app: &AppHandle) { - if let Err(error) = regenerate_nest_context(app) { - eprintln!("buzz-desktop: nest context regeneration failed: {error}"); - } + let generation = NEST_REGEN.claim(); + let app = app.clone(); + tauri::async_runtime::spawn(async move { + if let Err(error) = regenerate_nest_context(&app, generation).await { + eprintln!("buzz-desktop: nest context regeneration failed: {error}"); + } + }); } +#[cfg(test)] +mod render_tests; #[cfg(test)] mod tests; diff --git a/desktop/src-tauri/src/managed_agents/nest/render_tests.rs b/desktop/src-tauri/src/managed_agents/nest/render_tests.rs new file mode 100644 index 00000000000..ed4ee2c1f9b --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/nest/render_tests.rs @@ -0,0 +1,713 @@ +//! Tests for the dynamic AGENTS.md section renderer, the managed-section +//! upsert, and the regeneration gate. Split from `tests.rs` to keep +//! each test file under the repository's per-file line ratchet. + +use super::*; +use std::collections::HashSet; + +/// Relay URL passed to render calls. Since the roster no longer filters on +/// `relay_url`, this is only echoed into the Workspace footer. +const TEST_RELAY: &str = "ws://example.com:3000"; + +fn make_persona(id: &str, display_name: &str) -> AgentDefinition { + AgentDefinition { + id: id.to_string(), + display_name: display_name.to_string(), + avatar_url: None, + system_prompt: String::new(), + runtime: None, + model: None, + provider: None, + name_pool: vec![], + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + env_vars: std::collections::BTreeMap::new(), + respond_to: None, + respond_to_allowlist: Vec::new(), + parallelism: None, + created_at: String::new(), + updated_at: String::new(), + } +} + +fn make_agent(name: &str, persona_id: Option<&str>) -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey: String::new(), + name: name.to_string(), + persona_id: persona_id.map(|s| s.to_string()), + private_key_nsec: String::new(), + auth_tag: None, + relay_url: TEST_RELAY.to_string(), + avatar_url: None, + acp_command: String::new(), + agent_command: String::new(), + agent_command_override: None, + agent_args: vec![], + mcp_command: String::new(), + turn_timeout_seconds: 0, + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + parallelism: 1, + system_prompt: None, + model: None, + provider: None, + persona_source_version: None, + start_on_app_launch: false, + auto_restart_on_config_change: true, + runtime_pid: None, + backend: BackendKind::default(), + backend_agent_id: None, + provider_policy_pending: false, + provider_binary_path: None, + team_id: None, + persona_team_dir: None, + persona_name_in_team: None, + created_at: String::new(), + updated_at: String::new(), + last_started_at: None, + last_stopped_at: None, + last_exit_code: None, + last_error: None, + last_error_code: None, + respond_to: RespondTo::default(), + respond_to_allowlist: vec![], + env_vars: std::collections::BTreeMap::new(), + display_name: None, + slug: None, + runtime: None, + name_pool: Vec::new(), + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + definition_respond_to: None, + definition_respond_to_allowlist: Vec::new(), + definition_parallelism: None, + relay_mesh: None, + effort_level: None, + } +} + +#[test] +fn test_render_dynamic_section_with_agents() { + let personas = vec![make_persona("p1", "Builder")]; + let agents = vec![make_agent("Kit", Some("p1"))]; + let output = render_dynamic_section(&personas, &agents, &HashSet::new(), TEST_RELAY); + assert!(output.contains("| Kit | Builder | @Kit |")); + assert!(output.contains("| Name | Persona | How to address |")); + assert!(output.contains("## Workspace")); +} + +#[test] +fn test_render_dynamic_section_empty() { + let output = render_dynamic_section(&[], &[], &HashSet::new(), TEST_RELAY); + assert!(output.contains("No agents deployed yet")); +} + +#[test] +fn test_render_dynamic_section_agent_no_persona() { + let personas = vec![make_persona("p1", "Builder")]; + let agents = vec![make_agent("Scout", Some("nonexistent"))]; + let output = render_dynamic_section(&personas, &agents, &HashSet::new(), TEST_RELAY); + assert!(output.contains("| Scout | — | @Scout |")); +} + +#[test] +fn test_render_excludes_archived_agents() { + let personas = vec![make_persona("p1", "Builder")]; + let mut live = make_agent("Live", Some("p1")); + live.pubkey = "aa".repeat(32); + let mut gone = make_agent("Archived", Some("p1")); + gone.pubkey = "bb".repeat(32); + let archived: HashSet = [gone.pubkey.clone()].into_iter().collect(); + + let output = render_dynamic_section(&personas, &[live, gone], &archived, TEST_RELAY); + + assert!(output.contains("| Live | Builder | @Live |")); + assert!( + !output.contains("Archived"), + "archived agent must not render" + ); +} + +#[test] +fn test_render_archived_match_is_case_insensitive() { + let personas = vec![make_persona("p1", "Builder")]; + let mut gone = make_agent("Archived", Some("p1")); + gone.pubkey = "AB".repeat(32); // uppercase hex in the record + // Snapshot pubkeys are lowercased by `archived_pubkeys_from_snapshot`. + let archived: HashSet = ["ab".repeat(32)].into_iter().collect(); + + let output = render_dynamic_section(&personas, &[gone], &archived, TEST_RELAY); + + assert!( + output.contains("No agents deployed yet"), + "all-archived roster renders the empty placeholder" + ); +} + +#[test] +fn test_render_empty_archived_set_renders_all() { + let personas = vec![make_persona("p1", "Builder")]; + let mut a = make_agent("Kit", Some("p1")); + a.pubkey = "cc".repeat(32); + // Fail-open: an empty snapshot (relay unreachable) must render everyone. + let output = render_dynamic_section(&personas, &[a], &HashSet::new(), TEST_RELAY); + assert!(output.contains("| Kit | Builder | @Kit |")); +} + +#[test] +fn test_render_keeps_agent_with_legacy_foreign_relay_pin() { + // `relay_url` is a legacy creation-era field that `effective_agent_relay_url()` + // deliberately ignores — every agent is eligible on every community. A record + // whose stored pin points at a now-defunct relay must still render on the + // active workspace; only identity-archive removes an agent. + let personas = vec![make_persona("p1", "Builder")]; + let here = make_agent("Local", Some("p1")); + let mut elsewhere = make_agent("Foreign", Some("p1")); + elsewhere.relay_url = "wss://defunct.communities.buzz.xyz".to_string(); + + let output = render_dynamic_section(&personas, &[here, elsewhere], &HashSet::new(), TEST_RELAY); + + assert!(output.contains("| Local | Builder | @Local |")); + assert!( + output.contains("| Foreign | Builder | @Foreign |"), + "a legacy foreign relay pin must not hide an agent — the pin is ignored" + ); +} + +#[test] +fn test_render_keeps_snapshot_imported_agent_with_empty_relay_pin() { + // Snapshot-imported records store `relay_url: ""` by design; they resolve + // to the workspace relay at runtime. Such an agent must appear on the active + // workspace, not be hidden by an empty pin. + let personas = vec![make_persona("p1", "Builder")]; + let mut imported = make_agent("Imported", Some("p1")); + imported.relay_url = String::new(); + + let output = render_dynamic_section(&personas, &[imported], &HashSet::new(), TEST_RELAY); + + assert!( + output.contains("| Imported | Builder | @Imported |"), + "an empty relay_url (snapshot-import shape) must still render" + ); +} + +#[test] +fn test_upsert_managed_section_with_markers() { + let tmp = tempfile::tempdir().unwrap(); + let file = tmp.path().join("AGENTS.md"); + fs::write( + &file, + "# Header\n\nsome content\n\n\nold section\n\n\nafter\n", + ) + .unwrap(); + + upsert_managed_section(&file, "new section").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + assert!(result.contains("")); + assert!(result.contains("new section")); + assert!(!result.contains("old section")); + assert!(result.contains("# Header")); + assert!(result.contains("some content")); + assert!(result.contains("after")); +} + +#[test] +fn test_upsert_managed_section_without_markers() { + let tmp = tempfile::tempdir().unwrap(); + let file = tmp.path().join("AGENTS.md"); + fs::write(&file, "# Header\n\nexisting content\n").unwrap(); + + upsert_managed_section(&file, "injected section").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + assert!(result.contains("# Header")); + assert!(result.contains("existing content")); + assert!(result.contains("")); + assert!(result.contains("injected section")); + let begin_pos = result.find("\nsome middle content\n\nold section\n", + ) + .unwrap(); + + upsert_managed_section(&file, "new section").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + + assert!(result.contains("# Header"), "original header must survive"); + assert!( + result.contains("new section"), + "new content must be present" + ); + assert!( + result.contains("some middle content"), + "content between markers must survive" + ); + + // Exactly one BEGIN marker in the output (the orphan was stripped, new one appended). + assert_eq!( + result.matches(BEGIN_MARKER).count(), + 1, + "exactly one BEGIN marker after orphan cleanup" + ); + + // The single BEGIN marker must have a matching END marker after it. + let begin_pos = result + .find(BEGIN_MARKER) + .expect("BEGIN marker must be present"); + let end_pos = result[begin_pos..].find(END_MARKER).map(|p| begin_pos + p); + assert!( + end_pos.is_some(), + "an END marker must appear after the appended BEGIN marker" + ); +} + +#[test] +fn test_upsert_begin_only_no_end() { + // A file with BEGIN but no END has an orphan marker. + // find_managed_markers returns None (no END found after BEGIN), + // so strip_orphan_begin_marker removes the BEGIN line. + // Content that followed the orphan BEGIN is preserved (only the marker line is stripped, + // not the body that came after it). + let tmp = tempfile::tempdir().unwrap(); + let file = tmp.path().join("AGENTS.md"); + fs::write( + &file, + "# Header\n\nsome content\n\n\norphaned section without end marker\n", + ) + .unwrap(); + + upsert_managed_section(&file, "fresh section").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + + assert!(result.contains("# Header"), "original header must survive"); + assert!( + result.contains("some content"), + "original body must survive" + ); + assert!( + result.contains("fresh section"), + "new content must be present" + ); + + let begin_pos = result + .find(BEGIN_MARKER) + .expect("BEGIN marker must be present"); + let end_pos = result.find(END_MARKER).expect("END marker must be present"); + assert!( + begin_pos < end_pos, + "the appended BEGIN marker must precede the appended END marker" + ); + + // Exactly one BEGIN marker after orphan cleanup. + assert_eq!( + result.matches(BEGIN_MARKER).count(), + 1, + "exactly one BEGIN marker after orphan cleanup" + ); +} + +#[test] +fn test_upsert_duplicate_markers() { + let tmp = tempfile::tempdir().unwrap(); + let file = tmp.path().join("AGENTS.md"); + fs::write( + &file, + "# Header\n\n\nfirst block\n\n\nbetween blocks\n\n\nsecond block\n\n", + ) + .unwrap(); + + upsert_managed_section(&file, "replaced").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + + assert!( + result.contains("replaced"), + "replacement content must be present" + ); + assert!( + !result.contains("first block"), + "first block must be replaced" + ); + assert!( + result.contains("second block"), + "second pair content must survive" + ); + assert!( + result.contains("between blocks"), + "text between pairs must survive" + ); +} + +#[test] +fn test_upsert_marker_in_code_block() { + let tmp = tempfile::tempdir().unwrap(); + let file = tmp.path().join("AGENTS.md"); + // Indented by 4 spaces — not at column 0, so should NOT match as a real marker. + fs::write( + &file, + "# Header\n\n \n\nReal content here\n", + ) + .unwrap(); + + upsert_managed_section(&file, "appended content").unwrap(); + + let result = fs::read_to_string(&file).unwrap(); + + assert!( + result.contains(" "), + "indented marker inside code block must be preserved verbatim" + ); + assert!( + result.contains("appended content"), + "new content must be appended" + ); + assert!( + result.contains("Real content here"), + "existing body must survive" + ); + + // The real markers appended at the end must be at line-start (column 0). + let begin_pos = result + .find("\nexisting section\n\n", + ) + .unwrap(); + + upsert_managed_section(&file, "same content").unwrap(); + let after_first = fs::read_to_string(&file).unwrap(); + + upsert_managed_section(&file, "same content").unwrap(); + let after_second = fs::read_to_string(&file).unwrap(); + + assert_eq!( + after_first, after_second, + "upsert must be idempotent: second call must not alter the file" + ); +} + +/// Write an AGENTS.md skeleton with an empty managed section and return its path. +fn agents_md_with_markers(dir: &Path) -> PathBuf { + let file = dir.join("AGENTS.md"); + fs::write( + &file, + "# Header\n\n\n\n\n", + ) + .unwrap(); + file +} + +#[test] +fn commit_newer_generation_wins_over_a_stale_finisher() { + // Models the CRUD race: generation A snapshots pre-edit state and its relay + // fetch is slow; generation B snapshots post-edit state and commits first. + // When A finally finishes and commits LAST, its lower generation is dropped + // so the file still reflects B. Ordering of *finishing* is the only variable — + // the generation, claimed at request time, decides the winner. + let gate = NestRegenGate::new(); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + + let gen_a = gate.claim(); // pre-edit request + let gen_b = gate.claim(); // post-edit request + assert!(gen_a < gen_b); + + // B (newer) commits first. + assert!(gate.commit(&file, "post-edit roster", gen_b).unwrap()); + // A (older) finishes last and must be dropped. + assert!( + !gate.commit(&file, "pre-edit roster", gen_a).unwrap(), + "a stale (lower-generation) render must not overwrite a newer one" + ); + + let content = fs::read_to_string(&file).unwrap(); + assert!(content.contains("post-edit roster")); + assert!( + !content.contains("pre-edit roster"), + "final file must reflect the newer generation, not the stale finisher" + ); +} + +#[test] +fn commit_boot_fallback_relay_cannot_bury_apply_workspace_relay() { + // Models boot→apply_workspace relay switching: the boot regen (generation 1, + // fallback relay) is claimed first but finishes last; the apply_workspace + // regen (generation 2, workspace relay) commits first. The workspace relay + // render must survive even though the fallback-relay task writes afterward. + let gate = NestRegenGate::new(); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + + let boot_gen = gate.claim(); // boot, fallback relay + let apply_gen = gate.claim(); // apply_workspace, workspace relay + + // apply_workspace's render lands first. + assert!(gate + .commit( + &file, + "## Workspace\n- Relay: wss://workspace.example", + apply_gen, + ) + .unwrap()); + // Boot's slower fallback-relay render finishes last and is dropped. + assert!(!gate + .commit( + &file, + "## Workspace\n- Relay: wss://fallback.example", + boot_gen, + ) + .unwrap()); + + let content = fs::read_to_string(&file).unwrap(); + assert!(content.contains("wss://workspace.example")); + assert!( + !content.contains("wss://fallback.example"), + "the fallback-relay boot render must not overwrite the workspace-relay render" + ); +} + +#[test] +fn commit_failed_newer_request_still_supersedes_older_snapshot() { + // Carl 4954831197, case 1: a newer request that never writes must still + // permanently supersede an older snapshot. gen1 (pre-edit) is claimed and + // its relay work is slow; an edit claims gen2 (post-edit); gen2 then FAILS + // during its relay work, so it never commits. When gen1 finally finishes, + // it must NOT publish its obsolete roster — gating on highest-*requested* + // (advanced by gen2's claim) drops it, whereas gating on highest-*written* + // (0, since gen2 never wrote) would wrongly let gen1 publish. + let gate = NestRegenGate::new(); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + + let gen1 = gate.claim(); // pre-edit request + let gen2 = gate.claim(); // post-edit request + assert!(gen1 < gen2); + + // gen2 fails during relay work and never reaches commit — nothing written. + + // gen1 finishes last; its stale render must be dropped. + assert!( + !gate.commit(&file, "pre-edit roster", gen1).unwrap(), + "an older snapshot must not publish once a newer generation was requested, \ + even if that newer generation failed before writing" + ); + + let content = fs::read_to_string(&file).unwrap(); + assert!( + !content.contains("pre-edit roster"), + "the obsolete pre-edit roster must never become authoritative" + ); +} + +#[test] +fn commit_claim_at_the_older_tasks_cutover_supersedes_it() { + // Carl 4954831197, case 2: a claim arriving at the older task's commit + // cutover must not slip between the eligibility compare and the write. + // gen1 becomes eligible and enters `commit`; while it holds the lock + // (after the compare, before the write) a claim is attempted. The correct + // single-lock gate shares `highest_requested` between `claim` and + // `commit`, so that claim cannot acquire the lock until gen1's write + // releases it — the flawed separate-watermark/separate-write-lock design + // Carl warned about would let the claim proceed immediately. + // + // Determinism: the under-lock hook calls `try_claim`, a non-blocking claim + // against the exact lock `claim` takes, and asserts it reports the lock + // held (`None`). This is a direct statement about the gate's locking with + // no thread, channel, or sleep — the correct design necessarily returns + // `None` and the separate-watermark design necessarily returns `Some`, so + // the discriminator cannot be flipped by scheduler timing. + let gate = NestRegenGate::new(); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + + let gen1 = gate.claim(); + + let wrote_gen1 = gate + .commit_hooked(&file, "gen1 roster", gen1, || { + // We are past the eligibility compare and hold the lock. A claim + // attempted now must find the shared lock held — proving the + // compare and the write are atomic against any new claim. + assert!( + gate.try_claim().is_none(), + "a claim must not acquire the gate while an older commit holds \ + the shared lock between its eligibility check and its write — \ + the eligibility compare is not atomic with the write \ + (separate-watermark design)" + ); + }) + .unwrap(); + assert!( + wrote_gen1, + "gen1 was still the highest request when it entered commit, so its write \ + is legitimate; the newer request only lands after the lock releases" + ); + + // The lock is free once commit returns, so a newer request now claims and + // may publish over gen1. + let gen2 = gate.claim(); + assert!(gen1 < gen2); + assert!(gate.commit(&file, "gen2 roster", gen2).unwrap()); + + let content = fs::read_to_string(&file).unwrap(); + assert!(content.contains("gen2 roster")); + assert!(!content.contains("gen1 roster")); +} + +#[test] +fn commit_equal_generation_is_allowed() { + // The gate rejects only strictly-lower generations. Re-committing the same + // generation (e.g. a retried request) is permitted and refreshes the file. + let gate = NestRegenGate::new(); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + + let gen = gate.claim(); + assert!(gate.commit(&file, "first", gen).unwrap()); + assert!( + gate.commit(&file, "second", gen).unwrap(), + "an equal generation must still be allowed to write" + ); + + let content = fs::read_to_string(&file).unwrap(); + assert!(content.contains("second")); +} + +#[test] +fn commit_poisoned_lock_returns_error_instead_of_panicking() { + // A poisoned gate lock must degrade to an io::Error so the fire-and-forget + // caller warns and continues, never panicking the desktop process (root + // AGENTS.md: no new expect() in production paths). Poison the lock by + // panicking a thread while it holds the guard, then assert commit yields + // Err rather than unwinding. + let gate = std::sync::Arc::new(NestRegenGate::new()); + let tmp = tempfile::tempdir().unwrap(); + let file = agents_md_with_markers(tmp.path()); + let gen = gate.claim(); + + let poisoner = gate.clone(); + let _ = std::thread::spawn(move || { + let _guard = poisoner.highest_requested.lock().unwrap(); + panic!("poison the gate lock"); + }) + .join(); + + let result = gate.commit(&file, "after poison", gen); + assert!( + result.is_err(), + "a poisoned lock must surface as an error, not a panic" + ); +} diff --git a/desktop/src-tauri/src/managed_agents/nest/tests.rs b/desktop/src-tauri/src/managed_agents/nest/tests.rs index 031b049a495..9aa1eeb0985 100644 --- a/desktop/src-tauri/src/managed_agents/nest/tests.rs +++ b/desktop/src-tauri/src/managed_agents/nest/tests.rs @@ -41,6 +41,21 @@ fn nest_skill_contains_safe_mention_workflow() { assert!(BUZZ_CLI_SKILL_MD.contains("never changes membership automatically")); } +#[test] +fn nest_agents_template_separates_commit_attribution_claims() { + assert_eq!(AGENTS_MD.matches("## Git Commit Attribution").count(), 1); + assert!(AGENTS_MD.contains( + "Git authorship, co-authorship, DCO sign-off, and cryptographic signing are separate claims" + )); + assert!(AGENTS_MD + .contains("Request, approval, review, or accountability alone is not co-authorship")); + assert!(AGENTS_MD.contains("A sign-off is not an approval marker")); + assert!(AGENTS_MD.contains("Never use another person's signing key")); + assert!(AGENTS_MD.contains("inspect every outgoing commit against the actual upstream or base")); + assert!(AGENTS_MD.contains("An agent-owned repository may use the agent as author")); + assert!(!AGENTS_MD.contains("every commit MUST include a `Signed-off-by`")); +} + #[test] fn ensure_nest_creates_all_dirs_and_agents_md() { let tmp = tempfile::tempdir().unwrap(); @@ -422,421 +437,41 @@ fn ensure_cli_symlink_does_not_clobber_regular_file_dev() { ); } -fn make_persona(id: &str, display_name: &str) -> AgentDefinition { - AgentDefinition { - id: id.to_string(), - display_name: display_name.to_string(), - avatar_url: None, - system_prompt: String::new(), - runtime: None, - model: None, - provider: None, - name_pool: vec![], - is_builtin: false, - is_active: true, - shared: false, - source_team: None, - source_team_persona_slug: None, - catalog_source: None, - env_vars: std::collections::BTreeMap::new(), - respond_to: None, - respond_to_allowlist: Vec::new(), - parallelism: None, - created_at: String::new(), - updated_at: String::new(), - } -} - -fn make_agent(name: &str, persona_id: Option<&str>) -> ManagedAgentRecord { - ManagedAgentRecord { - pubkey: String::new(), - name: name.to_string(), - persona_id: persona_id.map(|s| s.to_string()), - private_key_nsec: String::new(), - auth_tag: None, - relay_url: String::new(), - avatar_url: None, - acp_command: String::new(), - agent_command: String::new(), - agent_command_override: None, - agent_args: vec![], - mcp_command: String::new(), - turn_timeout_seconds: 0, - idle_timeout_seconds: None, - max_turn_duration_seconds: None, - parallelism: 1, - system_prompt: None, - model: None, - provider: None, - persona_source_version: None, - start_on_app_launch: false, - auto_restart_on_config_change: true, - runtime_pid: None, - backend: BackendKind::default(), - backend_agent_id: None, - provider_binary_path: None, - team_id: None, - persona_team_dir: None, - persona_name_in_team: None, - created_at: String::new(), - updated_at: String::new(), - last_started_at: None, - last_stopped_at: None, - last_exit_code: None, - last_error: None, - last_error_code: None, - respond_to: RespondTo::default(), - respond_to_allowlist: vec![], - env_vars: std::collections::BTreeMap::new(), - display_name: None, - slug: None, - runtime: None, - name_pool: Vec::new(), - is_builtin: false, - is_active: true, - shared: false, - source_team: None, - source_team_persona_slug: None, - catalog_source: None, - definition_respond_to: None, - definition_respond_to_allowlist: Vec::new(), - definition_parallelism: None, - relay_mesh: None, - } -} - -#[test] -fn test_render_dynamic_section_with_agents() { - let personas = vec![make_persona("p1", "Builder")]; - let agents = vec![make_agent("Kit", Some("p1"))]; - let output = render_dynamic_section(&personas, &agents, "ws://example.com:3000"); - assert!(output.contains("| Kit | Builder | @Kit |")); - assert!(output.contains("| Name | Persona | How to address |")); - assert!(output.contains("## Workspace")); -} - -#[test] -fn test_render_dynamic_section_empty() { - let output = render_dynamic_section(&[], &[], "ws://example.com:3000"); - assert!(output.contains("No agents deployed yet")); -} - -#[test] -fn test_render_dynamic_section_agent_no_persona() { - let personas = vec![make_persona("p1", "Builder")]; - let agents = vec![make_agent("Scout", Some("nonexistent"))]; - let output = render_dynamic_section(&personas, &agents, "ws://example.com:3000"); - assert!(output.contains("| Scout | — | @Scout |")); -} - -#[test] -fn test_upsert_managed_section_with_markers() { - let tmp = tempfile::tempdir().unwrap(); - let file = tmp.path().join("AGENTS.md"); - fs::write( - &file, - "# Header\n\nsome content\n\n\nold section\n\n\nafter\n", - ) - .unwrap(); - - upsert_managed_section(&file, "new section").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - assert!(result.contains("")); - assert!(result.contains("new section")); - assert!(!result.contains("old section")); - assert!(result.contains("# Header")); - assert!(result.contains("some content")); - assert!(result.contains("after")); -} - -#[test] -fn test_upsert_managed_section_without_markers() { - let tmp = tempfile::tempdir().unwrap(); - let file = tmp.path().join("AGENTS.md"); - fs::write(&file, "# Header\n\nexisting content\n").unwrap(); - - upsert_managed_section(&file, "injected section").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - assert!(result.contains("# Header")); - assert!(result.contains("existing content")); - assert!(result.contains("")); - assert!(result.contains("injected section")); - let begin_pos = result.find("\nsome middle content\n\nold section\n", - ) - .unwrap(); - - upsert_managed_section(&file, "new section").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - - assert!(result.contains("# Header"), "original header must survive"); - assert!( - result.contains("new section"), - "new content must be present" - ); - assert!( - result.contains("some middle content"), - "content between markers must survive" - ); - - // Exactly one BEGIN marker in the output (the orphan was stripped, new one appended). - assert_eq!( - result.matches(BEGIN_MARKER).count(), - 1, - "exactly one BEGIN marker after orphan cleanup" - ); - - // The single BEGIN marker must have a matching END marker after it. - let begin_pos = result - .find(BEGIN_MARKER) - .expect("BEGIN marker must be present"); - let end_pos = result[begin_pos..].find(END_MARKER).map(|p| begin_pos + p); - assert!( - end_pos.is_some(), - "an END marker must appear after the appended BEGIN marker" - ); -} - -#[test] -fn test_upsert_begin_only_no_end() { - // A file with BEGIN but no END has an orphan marker. - // find_managed_markers returns None (no END found after BEGIN), - // so strip_orphan_begin_marker removes the BEGIN line. - // Content that followed the orphan BEGIN is preserved (only the marker line is stripped, - // not the body that came after it). +fn refresh_agents_md_writes_version_file() { let tmp = tempfile::tempdir().unwrap(); - let file = tmp.path().join("AGENTS.md"); - fs::write( - &file, - "# Header\n\nsome content\n\n\norphaned section without end marker\n", - ) - .unwrap(); - - upsert_managed_section(&file, "fresh section").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - - assert!(result.contains("# Header"), "original header must survive"); - assert!( - result.contains("some content"), - "original body must survive" - ); - assert!( - result.contains("fresh section"), - "new content must be present" - ); - - let begin_pos = result - .find(BEGIN_MARKER) - .expect("BEGIN marker must be present"); - let end_pos = result.find(END_MARKER).expect("END marker must be present"); - assert!( - begin_pos < end_pos, - "the appended BEGIN marker must precede the appended END marker" - ); - - // Exactly one BEGIN marker after orphan cleanup. - assert_eq!( - result.matches(BEGIN_MARKER).count(), - 1, - "exactly one BEGIN marker after orphan cleanup" - ); + let root = tmp.path().join(".buzz"); + ensure_nest_at(&root).unwrap(); + let version = fs::read_to_string(root.join(".nest-agents-version")).unwrap(); + assert_eq!(version.trim(), NEST_AGENTS_VERSION.to_string()); } #[test] -fn test_upsert_duplicate_markers() { +fn refresh_agents_md_upgrades_attribution_and_preserves_owned_content() { let tmp = tempfile::tempdir().unwrap(); - let file = tmp.path().join("AGENTS.md"); - fs::write( - &file, - "# Header\n\n\nfirst block\n\n\nbetween blocks\n\n\nsecond block\n\n", - ) - .unwrap(); - - upsert_managed_section(&file, "replaced").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - - assert!( - result.contains("replaced"), - "replacement content must be present" - ); - assert!( - !result.contains("first block"), - "first block must be replaced" - ); - assert!( - result.contains("second block"), - "second pair content must survive" - ); - assert!( - result.contains("between blocks"), - "text between pairs must survive" - ); -} + let root = tmp.path().join(".buzz"); + ensure_nest_at(&root).unwrap(); -#[test] -fn test_upsert_marker_in_code_block() { - let tmp = tempfile::tempdir().unwrap(); - let file = tmp.path().join("AGENTS.md"); - // Indented by 4 spaces — not at column 0, so should NOT match as a real marker. + let agents_md = root.join("AGENTS.md"); fs::write( - &file, - "# Header\n\n \n\nReal content here\n", + &agents_md, + "# Buzz Nest\n\n## Git Commit Identity\n\n\ + - **Human sign-off (required):** every commit MUST include a `Signed-off-by`.\n\n\ + \n\ + ## Active Agents\n\n| Name | Persona | How to address |\n\ + |------|---------|----------------|\n| Kit | Builder | @Kit |\n\ + \n\n## Local Notes\n\nKeep me.\n", ) .unwrap(); + fs::write(root.join(".nest-agents-version"), "4\n").unwrap(); - upsert_managed_section(&file, "appended content").unwrap(); - - let result = fs::read_to_string(&file).unwrap(); - - assert!( - result.contains(" "), - "indented marker inside code block must be preserved verbatim" - ); - assert!( - result.contains("appended content"), - "new content must be appended" - ); - assert!( - result.contains("Real content here"), - "existing body must survive" - ); - - // The real markers appended at the end must be at line-start (column 0). - let begin_pos = result - .find("\nexisting section\n\n", - ) - .unwrap(); - - upsert_managed_section(&file, "same content").unwrap(); - let after_first = fs::read_to_string(&file).unwrap(); - - upsert_managed_section(&file, "same content").unwrap(); - let after_second = fs::read_to_string(&file).unwrap(); - - assert_eq!( - after_first, after_second, - "upsert must be idempotent: second call must not alter the file" - ); -} - -#[test] -fn refresh_agents_md_writes_version_file() { - let tmp = tempfile::tempdir().unwrap(); - let root = tmp.path().join(".buzz"); ensure_nest_at(&root).unwrap(); - let version = fs::read_to_string(root.join(".nest-agents-version")).unwrap(); - assert_eq!(version.trim(), NEST_AGENTS_VERSION.to_string()); + + let content = fs::read_to_string(&agents_md).unwrap(); + assert_eq!(content.matches("## Git Commit Attribution").count(), 1); + assert!(!content.contains("**Human sign-off (required):**")); + assert!(content.contains("| Kit | Builder | @Kit |")); + assert!(content.contains("## Local Notes\n\nKeep me.")); } #[test] @@ -923,39 +558,3 @@ fn refresh_skill_overwrites_on_version_bump() { "SKILL.md must be refreshed on version bump" ); } - -#[test] -fn test_path_is_dev_nest_dev_path_returns_true() { - let path = std::path::Path::new("/Users/someone/.buzz-dev"); - assert!( - path_is_dev_nest(path), - ".buzz-dev path must be identified as dev nest" - ); -} - -#[test] -fn test_path_is_dev_nest_prod_path_returns_false() { - let path = std::path::Path::new("/Users/someone/.buzz"); - assert!( - !path_is_dev_nest(path), - ".buzz path must not be identified as dev nest" - ); -} - -#[test] -fn test_path_is_dev_nest_unrelated_path_returns_false() { - let path = std::path::Path::new("/Users/someone/.buzz-staging"); - assert!( - !path_is_dev_nest(path), - "unrelated path must not be identified as dev nest" - ); -} - -#[test] -fn test_path_is_dev_nest_root_returns_false() { - let path = std::path::Path::new("/"); - assert!( - !path_is_dev_nest(path), - "root path must not be identified as dev nest" - ); -} diff --git a/desktop/src-tauri/src/managed_agents/nest_agents.md b/desktop/src-tauri/src/managed_agents/nest_agents.md index 7cb7489b852..dbba2624db7 100644 --- a/desktop/src-tauri/src/managed_agents/nest_agents.md +++ b/desktop/src-tauri/src/managed_agents/nest_agents.md @@ -44,15 +44,18 @@ created: 2026-01-15 - **`.scratch/` is disposable** — don't rely on it across sessions - **Stay on task** — only stage files relevant to your current work -## Git Commit Identity +## Git Commit Attribution -The human operator signs off for accountability. +Git authorship, co-authorship, DCO sign-off, and cryptographic signing are separate claims. Follow repository-local rules and the authorizing human's explicit directions; do not infer attribution from repository ownership or from who requested, approved, or reviewed the work. -- **Human sign-off (required):** every commit MUST include a `Signed-off-by` trailer for the human operator who is responsible for the agent's work. Add via `git commit --trailer "Signed-off-by: Human Name "`. One blank line must separate trailers from the commit body. -- **Human credit (`Co-authored-by`):** every commit MUST also include a `Co-authored-by` trailer for the same human operator, with identical name and email to the `Signed-off-by` line. GitHub parses `Co-authored-by` for contribution-graph credit; `Signed-off-by` alone does not grant it. Add via `git commit --trailer "Co-authored-by: Human Name "`. Place `Co-authored-by` before `Signed-off-by` in the trailer block. -- **Discovering the human's identity:** read `git config user.name` and `git config user.email` from the working repository. These reflect the human operator's configured identity for that repo (which may differ from their global config). Use these exact values for both trailers. Do NOT hardcode, guess, or prompt for the email — the repo config is the source of truth. If `git config user.email` returns empty, STOP and ask the human operator for their name and email before committing. -- **Signing:** if the agent has a registered signing key, sign commits. If not, commits will land unverified — this is acceptable until agent SSH keys are provisioned. Do NOT use the human's signing key. -- **Verify before pushing:** `git log -1` should show the human's `Signed-off-by` trailer. +- **Author:** use the person or agent required by the applicable policy. If no policy specifies an author, use the identity that actually authored the change. +- **Co-authors:** add `Co-authored-by` only for other people or agents who materially authored the change. Request, approval, review, or accountability alone is not co-authorship. +- **DCO:** add `Signed-off-by` only when repository policy requires that identity's DCO certification. A sign-off is not an approval marker. +- **Identity:** resolve required identities from trusted local configuration or explicit verified direction; never hard-code or guess them. A managed runtime may make effective `git config user.*` values identify the agent. Stop and ask if a required identity cannot be established. +- **Signing:** use only the signing key configured for the committing identity. Never use another person's signing key. +- **Verify before pushing:** inspect every outgoing commit against the actual upstream or base and confirm its attribution matches the applicable policy. + +A repository may require an accountable human as author and the implementing agent as co-author. An agent-owned repository may use the agent as author and require no human trailer. In both cases, repository-local policy controls. ## Active Agents diff --git a/desktop/src-tauri/src/managed_agents/parallelism.rs b/desktop/src-tauri/src/managed_agents/parallelism.rs new file mode 100644 index 00000000000..734772d73d9 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/parallelism.rs @@ -0,0 +1,307 @@ +// ── Per-harness parallelism cap ─────────────────────────────────────────────── +// +// Contract: stored = requested; effective = min(requested, harness cap). +// +// `ManagedAgentRecord.parallelism` stores the user's requested value verbatim, +// never clamped at persistence. The cap is applied only where the value +// becomes a running worker-pool size: +// +// * local spawn — `BUZZ_ACP_AGENTS` in the child environment +// * remote deploy — `launch.policy_env["BUZZ_ACP_AGENTS"]` + legacy field +// * restart hash — `SpawnConfigSnapshot` stores the effective value +// * display copy — the UI derives effective for explanatory hints only +// +// `AgentDefinition.parallelism` is the portable requested value, unchanged +// at every boundary so it travels across devices and harness switches intact. + +/// Maximum parallelism for the OpenClaw harness. +/// +/// Each buzz-acp worker spawned by the Desktop is a client of the single +/// shared OpenClaw Gateway daemon — running more than this number of workers +/// is both resource-expensive and architecturally wrong per the OpenClaw +/// design. Tyler's ruling: "try 5 and lower if needed." +pub const OPENCLAW_MAX_PARALLELISM: u32 = 5; + +/// Return the maximum allowed parallelism for the given harness command, or +/// `None` when the harness has no cap. +/// +/// Keyed on [`super::discovery::normalize_command_identity`] so path prefixes, +/// the `.exe` suffix on Windows, and other cosmetic differences are ignored. +pub fn harness_max_parallelism(command: &str) -> Option { + match super::discovery::normalize_command_identity(command).as_str() { + "openclaw" => Some(OPENCLAW_MAX_PARALLELISM), + _ => None, + } +} + +/// Return the effective parallelism for the given harness command and +/// requested value: `min(value, harness_max_parallelism(command))`. +/// +/// For harnesses without a cap this is the identity function. +pub fn effective_parallelism(command: &str, value: u32) -> u32 { + match harness_max_parallelism(command) { + Some(cap) => value.min(cap), + None => value, + } +} + +/// Return the value to emit as `BUZZ_ACP_AGENTS` for a spawn command. +/// +/// Pure helper extracted from `spawn_agent_child` so both the production path +/// and tests can call it without spawning a process. The result is +/// `effective_parallelism(effective_command, record_parallelism)` formatted as +/// a decimal string ready for `command.env("BUZZ_ACP_AGENTS", …)`. +/// +/// `effective_command` must be the already-resolved harness command (override → +/// runtime → persona runtime → default). +pub fn acp_agents_value(effective_command: &str, record_parallelism: u32) -> String { + effective_parallelism(effective_command, record_parallelism).to_string() +} + +#[cfg(test)] +mod tests { + use crate::managed_agents::types::ManagedAgentRecord; + + fn record_with(runtime: Option<&str>, parallelism: u32) -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey: String::new(), + name: "r".to_string(), + persona_id: None, + private_key_nsec: String::new(), + auth_tag: None, + relay_url: String::new(), + avatar_url: None, + acp_command: String::new(), + agent_command: String::new(), + agent_command_override: None, + agent_args: vec![], + mcp_command: String::new(), + turn_timeout_seconds: 0, + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + parallelism, + system_prompt: None, + model: None, + provider: None, + persona_source_version: None, + start_on_app_launch: false, + auto_restart_on_config_change: true, + runtime_pid: None, + backend: Default::default(), + backend_agent_id: None, + provider_policy_pending: false, + provider_binary_path: None, + team_id: None, + persona_team_dir: None, + persona_name_in_team: None, + env_vars: std::collections::BTreeMap::new(), + created_at: String::new(), + updated_at: String::new(), + last_started_at: None, + last_stopped_at: None, + last_exit_code: None, + last_error: None, + last_error_code: None, + respond_to: Default::default(), + respond_to_allowlist: vec![], + display_name: None, + slug: None, + runtime: runtime.map(str::to_string), + name_pool: Vec::new(), + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + definition_respond_to: None, + definition_respond_to_allowlist: Vec::new(), + definition_parallelism: None, + relay_mesh: None, + effort_level: None, + } + } + + fn persona_def( + id: &str, + runtime: Option<&str>, + ) -> crate::managed_agents::types::AgentDefinition { + use crate::managed_agents::types::AgentDefinition; + AgentDefinition { + id: id.to_string(), + display_name: String::new(), + avatar_url: None, + system_prompt: String::new(), + runtime: runtime.map(str::to_string), + model: None, + provider: None, + name_pool: vec![], + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + env_vars: std::collections::BTreeMap::new(), + respond_to: None, + respond_to_allowlist: vec![], + parallelism: None, + created_at: String::new(), + updated_at: String::new(), + } + } + + // ── Policy table: harness_max_parallelism / effective_parallelism ───────── + + #[test] + fn policy_table() { + let cap = super::OPENCLAW_MAX_PARALLELISM; + + // harness_max_parallelism: openclaw variants → Some(cap); others → None. + assert_eq!(super::harness_max_parallelism("openclaw"), Some(cap)); + assert_eq!( + super::harness_max_parallelism("/usr/local/bin/openclaw"), + Some(cap) + ); + assert_eq!(super::harness_max_parallelism("openclaw.exe"), Some(cap)); + assert_eq!( + super::harness_max_parallelism(r"C:\Tools\openclaw.exe"), + Some(cap) + ); + assert_eq!(super::harness_max_parallelism("goose"), None); + assert_eq!(super::harness_max_parallelism("buzz-agent"), None); + assert_eq!(super::harness_max_parallelism(""), None); + + // effective_parallelism: openclaw clamps above cap, honors at/below; goose passes through. + assert_eq!(super::effective_parallelism("openclaw", cap + 5), cap); + assert_eq!(super::effective_parallelism("openclaw", cap), cap); + assert_eq!(super::effective_parallelism("openclaw", cap - 2), cap - 2); + assert_eq!(super::effective_parallelism("goose", 99), 99); + assert_eq!(super::effective_parallelism("buzz-agent", 32), 32); + } + + // ── acp_agents_value: spawn-env seam ────────────────────────────────────── + // + // Drives the pure helper extracted from spawn_agent_child. + // Deleting or changing it breaks this test AND the production spawn env. + + /// Legacy OpenClaw record (parallelism 10, above cap): BUZZ_ACP_AGENTS must be "5". + #[test] + fn acp_agents_value_openclaw_above_cap_is_capped() { + assert_eq!( + super::acp_agents_value("openclaw", 10), + "5", + "BUZZ_ACP_AGENTS for openclaw with parallelism 10 must be \"5\"" + ); + assert_eq!(super::acp_agents_value("goose", 10), "10"); + } + + // ── Override-direction: summary seam agreement ──────────────────────────── + // + // Tests effective_parallelism and record_agent_command agreement for both + // override directions. Removing either direction loses the seam test for + // that cap/uncap path through the summary resolver. + + /// OpenClaw runtime + Goose override: summary resolves goose → uncapped (10). + #[test] + fn override_direction_openclaw_runtime_goose_override_is_uncapped() { + let mut record = record_with(Some("openclaw"), 10); + record.agent_command_override = Some("goose".to_string()); + let cmd = crate::managed_agents::record_agent_command(&record, &[]); + assert_eq!(cmd, "goose"); + assert_eq!(super::effective_parallelism(&cmd, record.parallelism), 10); + } + + /// Goose runtime + OpenClaw override: summary resolves openclaw → capped (5). + #[test] + fn override_direction_goose_runtime_openclaw_override_is_capped() { + let mut record = record_with(Some("goose"), 10); + record.agent_command_override = Some("openclaw".to_string()); + let cmd = crate::managed_agents::record_agent_command(&record, &[]); + assert_eq!(cmd, "openclaw"); + assert_eq!( + super::effective_parallelism(&cmd, record.parallelism), + super::OPENCLAW_MAX_PARALLELISM + ); + } + + // ── Summary: persona-inherited runtime (runtime=None) ───────────────────── + // + // Covers the case where runtime was cleared by an "inherit from persona" + // update: summary must resolve via the LIVE persona, not stale agent_command. + + /// Stale agent_command="openclaw", live persona=goose → summary resolves goose → uncapped. + #[test] + fn summary_persona_inherited_stale_openclaw_live_goose_is_uncapped() { + let persona = persona_def("p-goose", Some("goose")); + let mut record = record_with(None, 10); + record.persona_id = Some("p-goose".to_string()); + record.agent_command = "openclaw".to_string(); + let cmd = + crate::managed_agents::record_agent_command(&record, std::slice::from_ref(&persona)); + assert_eq!( + cmd, "goose", + "live persona must win over stale agent_command" + ); + assert_eq!(super::effective_parallelism(&cmd, record.parallelism), 10); + } + + /// Stale agent_command="goose", live persona=openclaw → summary resolves openclaw → capped. + #[test] + fn summary_persona_inherited_stale_goose_live_openclaw_is_capped() { + let persona = persona_def("p-openclaw", Some("openclaw")); + let mut record = record_with(None, 10); + record.persona_id = Some("p-openclaw".to_string()); + record.agent_command = "goose".to_string(); + let cmd = + crate::managed_agents::record_agent_command(&record, std::slice::from_ref(&persona)); + assert_eq!( + cmd, "openclaw", + "live persona must win over stale agent_command" + ); + assert_eq!( + super::effective_parallelism(&cmd, record.parallelism), + super::OPENCLAW_MAX_PARALLELISM + ); + } + + // ── Snapshot export: requested-definition / effective-instance contract ─── + + fn snapshot_record( + runtime: Option<&str>, + parallelism: u32, + definition_parallelism: Option, + ) -> ManagedAgentRecord { + use crate::managed_agents::types::{BackendKind, RespondTo}; + use std::collections::BTreeMap; + let mut r = record_with(runtime, parallelism); + r.name = "snap-test".to_string(); + r.definition_parallelism = definition_parallelism; + r.backend = BackendKind::Local; + r.respond_to = RespondTo::OwnerOnly; + r.env_vars = BTreeMap::new(); + r + } + + /// Snapshot export carries the requested definition parallelism verbatim. + #[test] + fn snapshot_export_carries_requested_definition_parallelism() { + use crate::managed_agents::agent_snapshot::{build_snapshot, MemoryLevel}; + // definition_parallelism=Some(10) stored → exported as 10 unchanged. + let snap = build_snapshot( + &snapshot_record(Some("openclaw"), 10, Some(10)), + MemoryLevel::None, + vec![], + None, + ); + assert_eq!(snap.definition.parallelism, Some(10)); + // No definition_parallelism stored → falls back to record.parallelism. + let snap2 = build_snapshot( + &snapshot_record(Some("openclaw"), 10, None), + MemoryLevel::None, + vec![], + None, + ); + assert_eq!(snap2.definition.parallelism, Some(10)); + } +} diff --git a/desktop/src-tauri/src/managed_agents/persona_events.rs b/desktop/src-tauri/src/managed_agents/persona_events.rs index 6afc18a5013..7a3ce35b036 100644 --- a/desktop/src-tauri/src/managed_agents/persona_events.rs +++ b/desktop/src-tauri/src/managed_agents/persona_events.rs @@ -247,7 +247,22 @@ pub async fn flush_active_pending_events( flush_pending_events_at(&scope.db_path, state, &scope.relay_url, &scope.owner_keys).await } -async fn flush_pending_events_at( +pub fn active_pending_event( + app: &tauri::AppHandle, + state: &AppState, + kind: u32, + d_tag: &str, +) -> Result { + let scope = crate::managed_agents::retention::active_retention_scope(app, state)?; + let owner_pubkey = scope.owner_keys.public_key().to_hex(); + let conn = crate::managed_agents::retention::open_retention_db(&scope.db_path)?; + Ok( + crate::managed_agents::retention::get_retained_event(&conn, kind, &owner_pubkey, d_tag)? + .is_some_and(|event| event.pending_sync), + ) +} + +pub(crate) async fn flush_pending_events_at( db_path: &std::path::Path, state: &AppState, relay_url: &str, @@ -450,12 +465,12 @@ pub fn persona_snapshot(persona: &AgentDefinition) -> PersonaSnapshot { /// This is the single apply used by every snapshot-apply site: the spawn /// re-pin (`start_local_agent_with_preflight`), the launch backfill and /// restore re-snapshot (`restore.rs`), and the prospective re-snapshot inside -/// `spawn_config_hash` — so a future `PersonaSnapshot` field addition -/// propagates to all of them at once. +/// `prospective_spawn_config_snapshot` — so a future `PersonaSnapshot` field +/// addition propagates to all of them at once. /// /// Deliberately does NOT touch `updated_at`: persistence stamps are the -/// caller's concern, and `spawn_config_hash` (which applies this to a clone) -/// must stay pure. +/// caller's concern, and the prospective snapshot (which applies this to a +/// clone) must stay pure. pub fn apply_persona_snapshot(record: &mut ManagedAgentRecord, persona: &AgentDefinition) { let snapshot = persona_snapshot(persona); if let Some(prompt) = snapshot.system_prompt { @@ -464,23 +479,42 @@ pub fn apply_persona_snapshot(record: &mut ManagedAgentRecord, persona: &AgentDe record.model = snapshot.model; record.provider = snapshot.provider; record.runtime = snapshot.runtime; - // Drop a stale create-time harness pin when the definition names a - // different known runtime; custom commands stay pinned. - if let Some(def_runtime) = persona + // Drop a stale create-time harness pin when the definition switches to a + // different known runtime (builtin, static preset, or loaded custom). A pin + // that names an unknown/custom command is always kept. + // + // Both sides are resolved through the canonical harness-identity resolver + // (`canonical_harness_command`) which accepts either a runtime id OR a + // command string — covering aliases (e.g. "claude-code-acp"), path prefixes + // ("/usr/local/bin/goose"), and harnesses whose id ≠ command. The persona + // runtime side is resolved via `command_for_runtime_id` (id-only input is + // sufficient there since persona.runtime is always an authoritative id). + // + // Comparison is on canonical primary commands so "goose", "/usr/local/bin/goose", + // and runtime id "goose" all represent the same harness; the stale pin is + // dropped only when the canonical commands differ. + if let Some(new_cmd) = persona .runtime .as_deref() .map(str::trim) .filter(|r| !r.is_empty()) - .and_then(crate::managed_agents::known_acp_runtime_exact) + .and_then(super::command_for_runtime_id) { - if let Some(pin_runtime) = record + if let Some(pin) = record .agent_command_override .as_deref() - .and_then(crate::managed_agents::known_acp_runtime) + .map(str::trim) + .filter(|v| !v.is_empty()) { - if !std::ptr::eq(pin_runtime, def_runtime) { - record.agent_command_override = None; + // Resolve the pin via the canonical resolver (accepts id OR command). + if let Some(pin_cmd) = super::canonical_harness_command(pin) { + if pin_cmd != new_cmd { + // Known harness switched to a different known harness — drop stale pin. + record.agent_command_override = None; + } + // Same harness: keep the pin (e.g. explicit path override for same runtime). } + // Custom/unknown pin: always keep. } } // env_vars stay overrides-only. Self-heal records written before the env @@ -498,8 +532,9 @@ pub fn apply_persona_snapshot(record: &mut ManagedAgentRecord, persona: &AgentDe /// paths re-pin it to its linked persona, without mutating `record` itself. /// /// Every decision made ahead of the real re-pin — the relay-mesh preflight in -/// `start_local_agent_with_preflight`, the restart-badge hash in -/// `spawn_config_hash` — needs to reason about spawn-time state, not +/// `start_local_agent_with_preflight`, the restart-badge snapshot in +/// `prospective_spawn_config_snapshot` — needs to reason about spawn-time +/// state, not /// pre-snapshot bytes, so a persona edit that flips a field (e.g. `provider` /// to/from relay-mesh) between saves is reflected in the decision instead of /// the stale value the real [`apply_persona_snapshot`] is about to overwrite @@ -507,7 +542,7 @@ pub fn apply_persona_snapshot(record: &mut ManagedAgentRecord, persona: &AgentDe /// so the spawn-time stamp and later recomputes agree when nothing changed. /// /// Orphaned records (persona deleted) pass through unchanged: the caller's -/// own orphan handling — refusing to spawn, hashing as `(None, None, None)` +/// own orphan handling — refusing to spawn, snapshotting as `(None, None, None)` /// — runs on the real record downstream, not on this preview. pub fn preview_prospective_persona_snapshot( record: &ManagedAgentRecord, @@ -522,4 +557,6 @@ pub fn preview_prospective_persona_snapshot( preview } #[cfg(test)] +mod stale_pin_tests; +#[cfg(test)] mod tests; diff --git a/desktop/src-tauri/src/managed_agents/persona_events/stale_pin_tests.rs b/desktop/src-tauri/src/managed_agents/persona_events/stale_pin_tests.rs new file mode 100644 index 00000000000..2bd7ba3d1c9 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/persona_events/stale_pin_tests.rs @@ -0,0 +1,151 @@ +//! Stale-pin drop tests for `apply_persona_snapshot`. +//! +//! Covers the `canonical_harness_command` resolver used to classify a +//! create-time `agent_command_override` before deciding whether it should be +//! dropped when the persona switches to a different harness. + +use super::tests::{sample_persona, sample_record}; +use crate::managed_agents::persona_events::apply_persona_snapshot; +use crate::managed_agents::types::AgentDefinition; + +// ── Stale-pin drop: OpenClaw↔Goose (preset↔builtin) ───────────────────────── + +/// Persona→OpenClaw: stale Goose override dropped. +/// Regression for the original preset stale-pin fix. +#[test] +fn apply_persona_snapshot_goose_to_openclaw_drops_stale_goose_pin() { + let mut record = sample_record(); + record.agent_command_override = Some("goose".to_string()); + apply_persona_snapshot( + &mut record, + &AgentDefinition { + runtime: Some("openclaw".to_string()), + ..sample_persona() + }, + ); + assert_eq!( + record.agent_command_override, None, + "stale goose pin must be dropped when persona switches to openclaw" + ); +} + +/// Persona→Goose: stale OpenClaw override dropped. +#[test] +fn apply_persona_snapshot_openclaw_to_goose_drops_stale_openclaw_pin() { + let mut record = sample_record(); + record.agent_command_override = Some("openclaw".to_string()); + apply_persona_snapshot( + &mut record, + &AgentDefinition { + runtime: Some("goose".to_string()), + ..sample_persona() + }, + ); + assert_eq!( + record.agent_command_override, None, + "stale openclaw pin must be dropped when persona switches to goose" + ); +} + +// ── Stale-pin drop: alias pin (command ≠ id) ───────────────────────────────── + +/// Persona→OpenClaw; record has a stale `claude-code-acp` alias pin (id="claude", +/// command="claude-agent-acp"). The canonical resolver must recognise the alias +/// as the Claude harness and drop it when the persona switches to a different +/// harness (OpenClaw). +/// +/// This is the correctness case that motivated the `canonical_harness_command` +/// resolver: the old pointer-comparison code treated the alias as a +/// custom/unknown pin and kept it — the agent kept running Claude instead of +/// OpenClaw. +#[test] +fn apply_persona_snapshot_claude_alias_pin_to_openclaw_drops_stale_alias() { + let mut record = sample_record(); + // "claude-code-acp" is an alias of the Claude runtime (id="claude"). + record.agent_command_override = Some("claude-code-acp".to_string()); + apply_persona_snapshot( + &mut record, + &AgentDefinition { + runtime: Some("openclaw".to_string()), + ..sample_persona() + }, + ); + assert_eq!( + record.agent_command_override, None, + "stale claude-code-acp alias pin must be dropped when persona switches to openclaw" + ); +} + +// ── Stale-pin keep: same harness, path/alias override ─────────────────────── + +/// Same-harness case: record has an explicit path override pointing at the same +/// harness as the new persona runtime. The pin must NOT be dropped — it is a +/// deliberate per-instance configuration (e.g. a specific goose binary path). +#[test] +fn apply_persona_snapshot_same_harness_path_pin_is_kept() { + let mut record = sample_record(); + // Explicit path override for goose — same harness as the persona runtime. + record.agent_command_override = Some("/usr/local/bin/goose".to_string()); + apply_persona_snapshot( + &mut record, + &AgentDefinition { + runtime: Some("goose".to_string()), + ..sample_persona() + }, + ); + assert_eq!( + record.agent_command_override.as_deref(), + Some("/usr/local/bin/goose"), + "same-harness path override must NOT be dropped" + ); +} + +// ── Stale-pin drop: builtin pin → loaded custom harness (tier-1→tier-3) ────── + +/// Persona→CustomHarness: stale Goose override dropped. +/// +/// This is the custom-direction regression: before `canonical_harness_command` +/// the destination lookup (`known_acp_runtime_exact`) only saw the four +/// tier-1 builtins, so a switch to a loaded custom harness left any stale +/// builtin pin authoritative. +/// +/// Tier-3 (loaded custom harness) is reached via `lookup_loaded_harness_by_id`, +/// which reads the in-process registry — so we must populate it via +/// `update_loaded_harness_registry` under `registry_test_lock()`. +#[test] +fn apply_persona_snapshot_goose_to_custom_harness_drops_stale_goose_pin() { + use crate::managed_agents::custom_harnesses::{ + registry_test_lock, update_loaded_harness_registry, HarnessDefinition, + }; + use std::collections::BTreeMap; + + let _lock = registry_test_lock(); + + // Register a custom harness definition so the resolver finds it at tier 3. + update_loaded_harness_registry(vec![HarnessDefinition { + id: "my-custom-harness".to_string(), + label: "My Custom Harness".to_string(), + command: "my-custom-bin".to_string(), + args: vec![], + env: BTreeMap::new(), + install_instructions_url: String::new(), + install_hint: String::new(), + }]); + + let mut record = sample_record(); + record.agent_command_override = Some("goose".to_string()); + apply_persona_snapshot( + &mut record, + &AgentDefinition { + runtime: Some("my-custom-harness".to_string()), + ..sample_persona() + }, + ); + assert_eq!( + record.agent_command_override, None, + "stale goose pin must be dropped when persona switches to a loaded custom harness" + ); + + // Clean up the registry so parallel tests start from a known state. + update_loaded_harness_registry(vec![]); +} diff --git a/desktop/src-tauri/src/managed_agents/persona_events/tests.rs b/desktop/src-tauri/src/managed_agents/persona_events/tests.rs index b9542f9a879..af8cfe66182 100644 --- a/desktop/src-tauri/src/managed_agents/persona_events/tests.rs +++ b/desktop/src-tauri/src/managed_agents/persona_events/tests.rs @@ -3,7 +3,7 @@ use crate::managed_agents::{BackendKind, ManagedAgentRecord, RespondTo}; /// A linked instance record with no persona-derived fields set yet — the /// state right after creation, before any snapshot apply. -fn sample_record() -> ManagedAgentRecord { +pub(super) fn sample_record() -> ManagedAgentRecord { ManagedAgentRecord { pubkey: "p".repeat(64), name: "agent".into(), @@ -31,6 +31,7 @@ fn sample_record() -> ManagedAgentRecord { runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -58,6 +59,7 @@ fn sample_record() -> ManagedAgentRecord { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -139,7 +141,7 @@ fn preview_passes_through_unchanged_when_persona_missing() { assert_eq!(preview.persona_id.as_deref(), Some("deleted-persona")); } -fn sample_persona() -> AgentDefinition { +pub(super) fn sample_persona() -> AgentDefinition { AgentDefinition { id: "test-persona".to_string(), display_name: "Test Persona".to_string(), diff --git a/desktop/src-tauri/src/managed_agents/personas.rs b/desktop/src-tauri/src/managed_agents/personas.rs index 9bf7ab74b01..8ff0e633dc8 100644 --- a/desktop/src-tauri/src/managed_agents/personas.rs +++ b/desktop/src-tauri/src/managed_agents/personas.rs @@ -23,7 +23,17 @@ const FIZZ_SYSTEM_PROMPT: &str = "You are Fizz, an energetic maker who turns ide const HONEY_SYSTEM_PROMPT: &str = "You are Honey, a warm and thoughtful communicator. Help users write clearly, organize ideas, brainstorm, summarize, and prepare for conversations. Be kind, creative, and concise. Add occasional bee wordplay or 🍯🐝—keep it sweet, never excessive."; -const BUMBLE_SYSTEM_PROMPT: &str = "You are Bumble, a curious and adventurous researcher. Explore questions, compare options, check assumptions, and explain what you find clearly. Be candid when uncertain and favor useful evidence. Add occasional bee wordplay or 🐝🔎—keep it playful, never chaotic."; +// Keep the published NIP-33 coordinate stable so existing Pollen agents and +// references are upgraded in place instead of being orphaned by the rename. +pub(crate) const POLLEN_PERSONA_ID: &str = "builtin:bumble"; +pub(crate) const POLLEN_DISPLAY_NAME: &str = "Pollen"; +pub(crate) const POLLEN_SYSTEM_PROMPT: &str = "You are Pollen, a curious and adventurous researcher. Explore questions, compare options, check assumptions, and explain what you find clearly. Be candid when uncertain and favor useful evidence. Add occasional bee wordplay or 🐝🔎—keep it playful, never chaotic."; +pub(crate) const POLLEN_LEGACY_DISPLAY_NAME: &str = "Bumble"; +pub(crate) const POLLEN_LEGACY_SYSTEM_PROMPT: &str = "You are Bumble, a curious and adventurous researcher. Explore questions, compare options, check assumptions, and explain what you find clearly. Be candid when uncertain and favor useful evidence. Add occasional bee wordplay or 🐝🔎—keep it playful, never chaotic."; +// The embedded bytes are unchanged by the display-name migration. Keep the +// original storage symbol as the compatibility source and expose the current +// product name everywhere it is consumed. +const POLLEN_AVATAR: &str = BUMBLE_AVATAR; const BUILT_IN_PERSONAS: &[BuiltInPersona] = &[ BuiltInPersona { @@ -32,7 +42,7 @@ const BUILT_IN_PERSONAS: &[BuiltInPersona] = &[ avatar_url: Some(FIZZ_AVATAR), system_prompt: FIZZ_SYSTEM_PROMPT, name_pool: &[ - "Nectar", "Comet", "Bramble", "Clover", "Pollen", "Amber", "Daisy", "Mason", "Thistle", + "Nectar", "Comet", "Bramble", "Clover", "Amber", "Daisy", "Mason", "Thistle", "Waxwing", "Hive", "Meadow", "Juniper", "Aster", "Sage", "Willow", "Orchard", "Buzz", ], model: None, @@ -50,11 +60,11 @@ const BUILT_IN_PERSONAS: &[BuiltInPersona] = &[ default_active: true, }, BuiltInPersona { - id: "builtin:bumble", - display_name: "Bumble", - avatar_url: Some(BUMBLE_AVATAR), - system_prompt: BUMBLE_SYSTEM_PROMPT, - name_pool: &["Bumble"], + id: POLLEN_PERSONA_ID, + display_name: POLLEN_DISPLAY_NAME, + avatar_url: Some(POLLEN_AVATAR), + system_prompt: POLLEN_SYSTEM_PROMPT, + name_pool: &[POLLEN_DISPLAY_NAME], model: None, runtime: None, default_active: true, diff --git a/desktop/src-tauri/src/managed_agents/personas/tests.rs b/desktop/src-tauri/src/managed_agents/personas/tests.rs index 387b4d72c65..cc21861a9f3 100644 --- a/desktop/src-tauri/src/managed_agents/personas/tests.rs +++ b/desktop/src-tauri/src/managed_agents/personas/tests.rs @@ -45,7 +45,7 @@ fn merge_personas_adds_missing_built_ins() { .iter() .map(|record| record.display_name.as_str()) .collect(); - assert_eq!(display_names, vec!["Fizz", "Honey", "Bumble"]); + assert_eq!(display_names, vec!["Fizz", "Honey", "Pollen"]); let active_ids: Vec<&str> = records .iter() .filter(|record| record.is_active) diff --git a/desktop/src-tauri/src/managed_agents/process_lifecycle.rs b/desktop/src-tauri/src/managed_agents/process_lifecycle.rs index 8dddf9f7159..479d6ec913e 100644 --- a/desktop/src-tauri/src/managed_agents/process_lifecycle.rs +++ b/desktop/src-tauri/src/managed_agents/process_lifecycle.rs @@ -133,7 +133,7 @@ pub fn taskkill_tree(pid: u32) -> Result<(), String> { pub fn finish_spawn( child: std::process::Child, log_path: std::path::PathBuf, - spawn_config_hash: u64, + spawn_config: super::spawn_snapshot::SpawnConfigSnapshot, setup_mode: bool, adapter_availability: Option, start_nonce: String, @@ -149,7 +149,7 @@ pub fn finish_spawn( super::ManagedAgentProcess { child, log_path, - spawn_config_hash, + spawn_config, setup_mode, adapter_availability, start_nonce, diff --git a/desktop/src-tauri/src/managed_agents/readiness.rs b/desktop/src-tauri/src/managed_agents/readiness.rs index fa8eb36fa1d..f7f5d5c5d0e 100644 --- a/desktop/src-tauri/src/managed_agents/readiness.rs +++ b/desktop/src-tauri/src/managed_agents/readiness.rs @@ -82,7 +82,7 @@ pub(crate) struct EffectiveAgentEnv { // // A single owned type that fully describes what a spawn would run. Produced // by `resolve_effective_harness_descriptor` and consumed by spawn_agent_child, -// spawn_config_hash, build_managed_agent_summary, get_agent_models, and +// spawn_snapshot, build_managed_agent_summary, get_agent_models, and // agent_readiness — so the harness-definition lookup and arg/env resolution // happen exactly once, in one place. @@ -1051,19 +1051,16 @@ mod tests { thinking_env_var: None, max_tokens_env_var: None, context_limit_env_var: None, + max_rounds_env_var: None, required_normalized_fields: &[], login_hint: None, auth_probe_args: None, } } - /// Returns the absolute path of the currently-running test binary as a - /// `&'static str`. Host-portable stand-in for a "present" binary: - /// the path is absolute so `find_command` resolves it via `path.exists()` - /// rather than searching `PATH`, and the file always exists on the host. - /// - /// The tiny allocation is intentionally leaked — this runs at most once per - /// test process and the process exits immediately after tests complete. + /// Returns the absolute path of the currently-running test binary as a `&'static str`. + /// Host-portable stand-in for a "present" binary: absolute path so `find_command` resolves + /// it via `path.exists()`. Leaked allocation is intentional — process exits after tests. fn present_binary_str() -> &'static str { let path = std::env::current_exe().expect("current_exe must be available in tests"); Box::leak(path.to_string_lossy().into_owned().into_boxed_str()) @@ -1246,6 +1243,7 @@ mod tests { thinking_env_var: None, max_tokens_env_var: None, context_limit_env_var: None, + max_rounds_env_var: None, required_normalized_fields: &[], login_hint: None, auth_probe_args: None, @@ -1467,9 +1465,8 @@ mod tests { #[test] fn resolve_effective_agent_env_user_env_wins_over_structured_fields() { - // A record whose env_vars explicitly set provider/model must win over - // any baked defaults. In OSS test builds the baked map is empty, so - // this test validates the user-env layer is present in the output. + // User env_vars must win over baked defaults; in OSS builds baked map is empty, + // so this validates the user-env layer is present in the output. let mut env_vars = BTreeMap::new(); env_vars.insert("BUZZ_AGENT_PROVIDER".to_string(), "anthropic".to_string()); env_vars.insert( @@ -1505,6 +1502,7 @@ mod tests { runtime_pid: None, backend: Default::default(), backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -1532,6 +1530,7 @@ mod tests { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, }; let runtime = known_acp_runtime_exact("buzz-agent"); @@ -1548,8 +1547,6 @@ mod tests { ); } - // ── provider-specific model fallback tests ──────────────────────────── - #[test] fn buzz_agent_databricks_v2_with_databricks_model_but_no_buzz_agent_model_is_ready() { // The baked buzz-releases env sets DATABRICKS_MODEL but not BUZZ_AGENT_MODEL. diff --git a/desktop/src-tauri/src/managed_agents/relay_mesh.rs b/desktop/src-tauri/src/managed_agents/relay_mesh.rs index 5c246feedc5..3858212bbba 100644 --- a/desktop/src-tauri/src/managed_agents/relay_mesh.rs +++ b/desktop/src-tauri/src/managed_agents/relay_mesh.rs @@ -1,9 +1,33 @@ pub const RELAY_MESH_API_BASE_URL: &str = "http://127.0.0.1:9337/v1"; pub const RELAY_MESH_API_KEY_PLACEHOLDER: &str = "buzz-mesh-local"; pub const RELAY_MESH_PROVIDER_ID: &str = "relay-mesh"; +/// Stored value for "let the mesh decide", kept as the user-facing word. pub const RELAY_MESH_AUTO_MODEL_ID: &str = "auto"; +/// MeshLLM's virtual model. It resolves per request: a Mixture-of-Agents +/// committee when two or more workers are reachable, and otherwise degrades to +/// a single served model rather than erroring +/// (`moa_gateway::degrade_to_single_model`). That degradation is a pre-flight +/// capacity decision, so a committee that forms and *then* loses a worker still +/// surfaces as a failed turn — MoA repairs partial results internally +/// (`repair_tool_result_answer`) before it gets that far. Buzz translates the +/// stored `auto` here rather than teaching buzz-agent anything about meshes. #[cfg(feature = "mesh-llm")] -pub const RELAY_MESH_PREFER_MESH_FOR_AUTO_ENV: &str = "BUZZ_AGENT_PREFER_MESH_FOR_AUTO"; +pub const RELAY_MESH_VIRTUAL_MODEL_ID: &str = "mesh"; + +/// The wire name for a stored shared-compute model: `auto` (and a blank legacy +/// value) means "let the mesh decide" and becomes MeshLLM's virtual `mesh` +/// model; anything else is a model the user named and is passed through. +/// +/// The single place this mapping happens. Every consumer that has to name a +/// model to the mesh — the LLM transport env and the ACP harness — goes through +/// here, so they cannot disagree. +#[cfg(feature = "mesh-llm")] +pub fn relay_mesh_wire_model(stored: &str) -> &str { + match stored.trim() { + "" | RELAY_MESH_AUTO_MODEL_ID => RELAY_MESH_VIRTUAL_MODEL_ID, + named => named, + } +} /// Translate the native Buzz shared compute provider into the OpenAI-compatible /// transport understood by buzz-agent. These are derived runtime details, not @@ -17,11 +41,7 @@ pub fn apply_relay_mesh_env( if provider.map(str::trim) != Some(RELAY_MESH_PROVIDER_ID) { return; } - let model = model - .map(str::trim) - .filter(|value| !value.is_empty()) - .unwrap_or(RELAY_MESH_AUTO_MODEL_ID) - .to_string(); + let model = relay_mesh_wire_model(model.unwrap_or(RELAY_MESH_AUTO_MODEL_ID)).to_string(); env.insert("BUZZ_AGENT_PROVIDER".to_string(), "openai".to_string()); env.insert("BUZZ_AGENT_MODEL".to_string(), model.clone()); env.insert( @@ -34,14 +54,6 @@ pub fn apply_relay_mesh_env( RELAY_MESH_API_KEY_PLACEHOLDER.to_string(), ); env.insert("OPENAI_COMPAT_API".to_string(), "chat".to_string()); - // Buzz owns the meaning of relay-mesh `auto`: buzz-agent dynamically uses - // mesh-llm's virtual Mixture-of-Agents model whenever the live catalog says - // at least two distinct models are available, and otherwise keeps the - // router's normal single-model `auto` behavior. - env.insert( - RELAY_MESH_PREFER_MESH_FOR_AUTO_ENV.to_string(), - "1".to_string(), - ); // Keep the requested response inside smaller local-model context windows. // These are defaults, not policy: the effective agent/persona/global env // may deliberately choose a smaller cap or a different effort. This function @@ -128,10 +140,76 @@ mod tests { // stops gemma tool-calling; enabling thinking makes Qwen3 burn ~4x the // output budget). assert_eq!(env.get("BUZZ_AGENT_THINKING_EFFORT"), None); + } + + /// Stored `auto` is translated here, so buzz-agent receives a plain model + /// name and needs no knowledge of the mesh. MeshLLM decides per request + /// whether `mesh` becomes a committee or a single served model. + #[test] + fn stored_auto_becomes_the_virtual_mesh_model_on_the_wire() { + let mut env = BTreeMap::new(); + apply_relay_mesh_env( + &mut env, + Some(RELAY_MESH_PROVIDER_ID), + Some(RELAY_MESH_AUTO_MODEL_ID), + ); + assert_eq!( - env.get(RELAY_MESH_PREFER_MESH_FOR_AUTO_ENV) - .map(String::as_str), - Some("1") + env.get("BUZZ_AGENT_MODEL").map(String::as_str), + Some(RELAY_MESH_VIRTUAL_MODEL_ID) + ); + assert_eq!( + env.get("OPENAI_COMPAT_MODEL").map(String::as_str), + Some(RELAY_MESH_VIRTUAL_MODEL_ID) + ); + } + + /// A blank stored model is the legacy encoding of the same intent. + #[test] + fn blank_stored_model_becomes_the_virtual_mesh_model() { + let mut env = BTreeMap::new(); + apply_relay_mesh_env(&mut env, Some(RELAY_MESH_PROVIDER_ID), Some(" ")); + + assert_eq!( + env.get("BUZZ_AGENT_MODEL").map(String::as_str), + Some(RELAY_MESH_VIRTUAL_MODEL_ID) + ); + } + + /// Every consumer that names a model to the mesh goes through one helper, + /// so the LLM transport and the ACP harness cannot be told different things. + #[test] + fn wire_model_maps_auto_and_blank_but_passes_named_through() { + assert_eq!( + relay_mesh_wire_model(RELAY_MESH_AUTO_MODEL_ID), + RELAY_MESH_VIRTUAL_MODEL_ID + ); + assert_eq!(relay_mesh_wire_model(""), RELAY_MESH_VIRTUAL_MODEL_ID); + assert_eq!(relay_mesh_wire_model(" "), RELAY_MESH_VIRTUAL_MODEL_ID); + assert_eq!( + relay_mesh_wire_model("unsloth/gemma-4-E4B-it-GGUF:Q4_K_M"), + "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M" + ); + } + + /// A named model is sent verbatim: picking one is an explicit choice to + /// bypass mesh routing, and must not be rewritten. + #[test] + fn a_named_model_is_sent_verbatim() { + let mut env = BTreeMap::new(); + apply_relay_mesh_env( + &mut env, + Some(RELAY_MESH_PROVIDER_ID), + Some("unsloth/Qwen3-8B-GGUF:Q4_K_M"), + ); + + assert_eq!( + env.get("BUZZ_AGENT_MODEL").map(String::as_str), + Some("unsloth/Qwen3-8B-GGUF:Q4_K_M") + ); + assert_eq!( + env.get("OPENAI_COMPAT_MODEL").map(String::as_str), + Some("unsloth/Qwen3-8B-GGUF:Q4_K_M") ); } diff --git a/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs b/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs new file mode 100644 index 00000000000..afaaa2b4eb3 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs @@ -0,0 +1,82 @@ +// Canonical reserved-env-key list, `include!`d into BOTH `build.rs` +// (compile-time rejection of baked `BUZZ_BUILD_AGENT_ENV` collisions) and +// `managed_agents/env_vars.rs` (save-time validation and spawn-time +// filtering). Build scripts cannot import from the crate, so sharing the +// source via `include!` is what guarantees the build-time check and the +// runtime filter use one identical list — zero drift surface. See +// `commands/reconnect_hook_config.rs` for the same pattern. +// +// Keep this file dependency-free: no crate-internal imports, no external +// crates. Both consumers compile it as-is. + +/// Env var keys that Buzz sets itself and users must not override from +/// the persona/agent env_vars UI. Three categories: +/// +/// 1. **Identity / secrets** — overriding would swap the agent's nsec or +/// leak credentials. +/// 2. **Code-execution surface** — overriding the binary/args lets the +/// user run arbitrary code as the agent process. +/// 3. **Security gates** — overriding the respond-to mode/allowlist or +/// relay URL would silently break the saved security settings (the UI +/// shows owner-only while the running agent answers anyone, for +/// example), or redirect the agent to an attacker-controlled relay. +/// +/// This list is deliberately narrow — it only covers keys with security +/// implications. Behavior knobs (GOOSE_MODE, BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain freely +/// overridable; those have dedicated UI fields but power users may want +/// to bypass them. +pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[ + // Identity / secrets. + "BUZZ_PRIVATE_KEY", + "NOSTR_PRIVATE_KEY", + "BUZZ_AUTH_TAG", + "BUZZ_API_TOKEN", + "BUZZ_ACP_PRIVATE_KEY", + "BUZZ_ACP_API_TOKEN", + // Relay URL: overriding would let a malicious config redirect the + // agent to an attacker-controlled relay. + "BUZZ_RELAY_URL", + // Code-execution surface: overriding would let the user run arbitrary + // binaries/args as the agent process. + "BUZZ_ACP_AGENT_COMMAND", + "BUZZ_ACP_AGENT_ARGS", + "BUZZ_ACP_MCP_COMMAND", + // Control-plane parallelism: the Desktop resolves the effective + // worker-pool size (applying any per-harness cap) and writes it into + // launch.policy_env. A user-supplied BUZZ_ACP_AGENTS would bypass the + // harness cap and cause OpenClaw agents to spawn uncapped workers. + "BUZZ_ACP_AGENTS", + // Security gates: respond-to mode + allowlist + deployment allowlist + + // legacy owner-only fallback. Overriding would make the running agent's + // gate diverge from the saved/UI-visible settings. + "BUZZ_ACP_RESPOND_TO", + "BUZZ_ACP_RESPOND_TO_ALLOWLIST", + "BUZZ_ACP_ALLOWED_RESPOND_TO", + "BUZZ_ACP_AGENT_OWNER", + // Stable agent identity used for git attribution and private-conversation + // provenance must come from the managed-agent record, not user overrides. + "BUZZ_ACP_DISPLAY_NAME", + // Remote lifetime/presence policy: user env must not disable the + // desktop/provider-owned bounds while the saved record still promises them. + "BUZZ_ACP_EXIT_AFTER_INACTIVITY", + // Desktop-owned pool lifetime policy: user env must not disable or reset + // the idle worker-reclamation window while the desktop launcher sets it. + "BUZZ_ACP_IDLE_POOL_SLEEP", + "BUZZ_ACP_NO_PRESENCE", + // Readiness handoff: desktop is the ONLY readiness source. A saved or + // ambient env var must not be able to forge setup mode (NotReady) on a + // Ready agent or suppress it (empty/stale payload) on a NotReady one. + "BUZZ_ACP_SETUP_PAYLOAD", + // Desktop ownership markers: these brand every spawned harness with the + // launching Desktop instance. A user-supplied override would let a + // definition masquerade as a different instance or fake the nonce used + // for same-session sweep decisions. + "BUZZ_MANAGED_AGENT", + "BUZZ_MANAGED_AGENT_START_NONCE", +]; + +pub(crate) fn is_reserved_env_key(key: &str) -> bool { + RESERVED_ENV_KEYS + .iter() + .any(|reserved| reserved.eq_ignore_ascii_case(key)) +} diff --git a/desktop/src-tauri/src/managed_agents/restore.rs b/desktop/src-tauri/src/managed_agents/restore.rs index 19106201594..a225f492d33 100644 --- a/desktop/src-tauri/src/managed_agents/restore.rs +++ b/desktop/src-tauri/src/managed_agents/restore.rs @@ -18,7 +18,9 @@ use tauri::Manager; /// restore would kill reconcile's lazy child by its receipt and replace it with /// an eager one, flipping the pair's laziness on a startup race. enum SpawnOutcome { - Spawned(super::ManagedAgentRuntimeKey, ManagedAgentProcess), + /// Boxed: the spawned process carries its full spawn-config snapshot, so an + /// inline variant would make every `Skipped`/`Failed` outcome pay for it. + Spawned(super::ManagedAgentRuntimeKey, Box), Skipped, Failed(String), } @@ -338,7 +340,9 @@ pub async fn restore_managed_agents_on_launch( owner_hex_ref, ) }) { - Ok(process) => SpawnOutcome::Spawned(key, process), + Ok(process) => { + SpawnOutcome::Spawned(key, Box::new(process)) + } Err(error) => SpawnOutcome::Failed(error), } } @@ -369,7 +373,7 @@ pub async fn restore_managed_agents_on_launch( .lock() .map_err(|error| error.to_string())?; - let mut successfully_spawned: Vec = Vec::new(); + let mut successfully_spawned: Vec<(String, String)> = Vec::new(); for (pubkey, outcome) in spawn_results { match outcome { @@ -400,8 +404,15 @@ pub async fn restore_managed_agents_on_launch( record.last_stopped_at = None; record.last_exit_code = None; record.last_error = None; - runtimes.insert(key, super::ManagedAgentPairRuntime::starting(process)); - successfully_spawned.push(pubkey); + runtimes.insert( + key.clone(), + super::ManagedAgentPairRuntime::starting(*process), + ); + // Carry the spawn key's relay into profile reconciliation so + // the background task queries/publishes on the relay this + // spawn was actually keyed to — not whatever workspace is + // active when the task eventually executes. + successfully_spawned.push((pubkey, key.relay_url.clone())); } SpawnOutcome::Failed(error) => { let Ok(record) = find_managed_agent_mut(&mut records, &pubkey) else { @@ -421,7 +432,7 @@ pub async fn restore_managed_agents_on_launch( let reconcile_items: Vec<(String, crate::commands::ProfileReconcileData)> = successfully_spawned .iter() - .filter_map(|pubkey| { + .filter_map(|(pubkey, spawn_relay)| { let record = records.iter().find(|r| r.pubkey == *pubkey)?; // Resolve the effective harness for the avatar-fallback // derivation (the snapshot may be empty/stale for an inherited @@ -434,6 +445,10 @@ pub async fn restore_managed_agents_on_launch( private_key_nsec: record.private_key_nsec.clone(), name: record.name.clone(), relay_url: record.relay_url.clone(), + // Pin the relay this spawn was keyed to (see the + // successfully_spawned push above) so the deferred + // task cannot resolve a post-switch workspace. + target_relay_url: Some(spawn_relay.clone()), avatar_url: record.avatar_url.clone(), auth_tag: record.auth_tag.clone(), pubkey: record.pubkey.clone(), @@ -468,6 +483,73 @@ pub async fn restore_managed_agents_on_launch( Ok(()) } +fn profile_reconcile_completed(outcome: crate::commands::ProfileReconcileOutcome) -> bool { + outcome == crate::commands::ProfileReconcileOutcome::Reconciled +} + +pub(crate) fn spawn_pending_profile_reconciliations(app: &tauri::AppHandle, workspace_relay: &str) { + let state = app.state::(); + if !state + .managed_agent_profile_reconcile_enabled + .load(Ordering::Acquire) + { + return; + } + let items = match crate::commands::load_pending_profile_reconciliations(app, workspace_relay) { + Ok(items) => items, + Err(error) => { + eprintln!("buzz-desktop: failed to load pending profile reconciliations: {error}"); + return; + } + }; + + for (pubkey, data) in items { + let reconcile_app = app.clone(); + let relay_url = data + .target_relay_url + .clone() + .unwrap_or_else(|| data.relay_url.clone()); + tauri::async_runtime::spawn(async move { + let state = reconcile_app.state::(); + match crate::commands::reconcile_agent_profile(&state, &reconcile_app, &pubkey, &data) + .await + { + Ok(outcome) if profile_reconcile_completed(outcome) => { + if let Err(error) = crate::commands::mark_profile_reconciled( + &reconcile_app, + &pubkey, + &relay_url, + ) { + eprintln!( + "buzz-desktop: failed to record profile reconciliation for agent {pubkey}: {error}" + ); + } + } + Ok(_) => {} + Err(error) => eprintln!( + "buzz-desktop: profile reconciliation failed for agent {pubkey}: {error}" + ), + } + }); + } +} + +#[cfg(test)] +mod profile_reconcile_tests { + use super::profile_reconcile_completed; + use crate::commands::ProfileReconcileOutcome; + + #[test] + fn skipped_reconciliation_never_retires_pending_work() { + assert!(profile_reconcile_completed( + ProfileReconcileOutcome::Reconciled + )); + assert!(!profile_reconcile_completed( + ProfileReconcileOutcome::SkippedDisabled + )); + } +} + #[cfg(feature = "mesh-llm")] fn persist_restore_error( app: &tauri::AppHandle, diff --git a/desktop/src-tauri/src/managed_agents/retention.rs b/desktop/src-tauri/src/managed_agents/retention.rs index 7e97fa1f566..e6231bbe42b 100644 --- a/desktop/src-tauri/src/managed_agents/retention.rs +++ b/desktop/src-tauri/src/managed_agents/retention.rs @@ -261,21 +261,32 @@ pub enum InboundOutcome { /// pending row intact so the flush republishes and the relay resolves /// last-writer-wins. (A re-received echo at equal time is also a no-op.) /// - Inbound older: skip — nothing to change. -pub fn retain_inbound_event( +/// +/// Decide whether an inbound event is newer than the retained coordinate without +/// mutating retention. Callers that must update another durable store first use +/// this preflight, apply that store change, and only then commit with +/// [`retain_inbound_event`]. +pub fn inbound_event_outcome( conn: &Connection, event: &RetainedEvent, ) -> Result { let existing = get_retained_event(conn, event.kind, &event.pubkey, &event.d_tag)?; - - let apply = match &existing { - None => true, - Some(row) if event.created_at > row.created_at => true, + Ok(match existing { + None => InboundOutcome::Applied, + Some(row) if event.created_at > row.created_at => InboundOutcome::Applied, // Equal or older: skip. Equal time may collide with a pending local // edit, so we never clear its `pending_sync`; older is stale. - Some(_) => false, - }; + Some(_) => InboundOutcome::Skipped, + }) +} - if !apply { +pub fn retain_inbound_event( + conn: &Connection, + event: &RetainedEvent, +) -> Result { + let outcome = inbound_event_outcome(conn, event)?; + + if outcome == InboundOutcome::Skipped { return Ok(InboundOutcome::Skipped); } @@ -553,6 +564,37 @@ mod tests { } } + #[test] + fn inbound_preflight_does_not_consume_event_before_commit() { + let conn = test_db(); + let mut inbound = sample_event(); + inbound.pending_sync = false; + + assert_eq!( + inbound_event_outcome(&conn, &inbound).unwrap(), + InboundOutcome::Applied + ); + assert!( + get_retained_event(&conn, inbound.kind, &inbound.pubkey, &inbound.d_tag) + .unwrap() + .is_none() + ); + // A failed store/runtime apply can replay the same head because the + // preflight did not advance retention. + assert_eq!( + inbound_event_outcome(&conn, &inbound).unwrap(), + InboundOutcome::Applied + ); + assert_eq!( + retain_inbound_event(&conn, &inbound).unwrap(), + InboundOutcome::Applied + ); + assert_eq!( + inbound_event_outcome(&conn, &inbound).unwrap(), + InboundOutcome::Skipped + ); + } + #[test] fn retain_and_retrieve() { let conn = test_db(); diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs index 37927961ed4..0ce5ca7b219 100644 --- a/desktop/src-tauri/src/managed_agents/runtime.rs +++ b/desktop/src-tauri/src/managed_agents/runtime.rs @@ -2,7 +2,7 @@ use std::collections::HashMap; use tauri::AppHandle; -use super::agent_env::build_buzz_agent_provider_defaults; +use super::agent_env::{build_buzz_agent_provider_defaults, idle_pool_sleep_env}; use crate::{ managed_agents::{ @@ -14,16 +14,17 @@ use crate::{ util::now_iso, }; +use super::claude_config::{apply_claude_model_env, apply_effort_env}; mod path; pub(in crate::managed_agents) use path::build_augmented_path; -pub(crate) use path::compose_path_entries; -pub(crate) use path::should_skip_claude_executable; -pub(crate) use path::should_use_inherited; +pub(crate) use path::{compose_path_entries, should_skip_claude_executable, should_use_inherited}; + +pub(crate) use super::access_policy::{build_respond_to_env_with_policy, RespondToEnv}; mod metadata; pub(crate) use metadata::{ - resolve_effective_prompt_model_provider, resolve_session_title, runtime_metadata_env_vars, - SESSION_TITLE_ENV_VAR, + apply_agent_display_env, resolve_session_title, runtime_metadata_env_vars, + DISPLAY_NAME_ENV_VAR, SESSION_TITLE_ENV_VAR, }; mod stop; @@ -33,8 +34,6 @@ pub use stop::{stop_managed_agent_process, stop_managed_agent_workspace_pair}; mod sweep; pub(crate) use sweep::sweep_untracked_bundle_harnesses; -type RespondToEnv = (Vec<(&'static str, String)>, Vec<&'static str>); - mod process; #[cfg(test)] use process::{ @@ -69,6 +68,8 @@ mod lifecycle; #[cfg(test)] use lifecycle::kill_stale_tracked_processes_with; pub use lifecycle::{kill_stale_tracked_processes, sync_managed_agent_processes}; +mod spawn_key; // production spawn-key derivation + its regressions +pub(crate) use spawn_key::bound_runtime_key; /// Classify an agent's persona against the live catalog for the Agents-menu /// drift indicator. Returns `(out_of_date, orphaned)`. @@ -135,6 +136,7 @@ pub fn build_managed_agent_summary( record: &ManagedAgentRecord, runtimes: &HashMap, personas: &[crate::managed_agents::types::AgentDefinition], + teams: &[crate::managed_agents::TeamRecord], global_config: &crate::managed_agents::GlobalAgentConfig, ) -> Result { use crate::managed_agents::BackendKind; @@ -197,12 +199,10 @@ pub fn build_managed_agent_summary( let (persona_out_of_date, persona_orphaned) = persona_drift_state(record, personas); - let global_for_summary = - crate::managed_agents::load_global_agent_config(app).unwrap_or_default(); let effective_cfg = crate::managed_agents::effective_config::resolve_effective_config( record, personas, - &global_for_summary, + global_config, ); let (effective_model, effective_provider, effective_prompt, model_source) = match effective_cfg { @@ -226,49 +226,50 @@ pub fn build_managed_agent_summary( } }; - // Restart badge: the running process stamped its effective spawn config - // at launch; recompute from current disk state and flag drift. Only the - // tracked live pair for THIS workspace can drift — stopped agents spawn - // fresh, adopted (runtime_pid-only) processes have no stamped hash to - // compare, and pairs running for other communities are judged in their - // own community (hashing them against this workspace's relay would flag - // a spurious restart on every community switch). + // Restart badge: the running process stamped the effective spawn config + // it was launched with; recompute a prospective one from current disk + // state and report every differing field. Only the tracked live pair for + // THIS workspace can drift — stopped agents spawn fresh, adopted + // (runtime_pid-only) processes have no stamp to compare, and pairs running + // for other communities are judged in their own community (comparing them + // against this workspace's relay would flag a spurious restart on every + // community switch). // - // Additionally, for runtimes with an adapter version gate (codex only), - // check whether the cached adapter availability has drifted from the value - // stamped at spawn. This catches out-of-band adapter changes (manual - // npm install/downgrade) that Phase-1 auto-restart doesn't cover. The - // cache is read-only here — no subprocess is spawned. + // Adapter-availability drift (codex only) contributes its own synthetic + // entry, so an out-of-band adapter change (manual npm install/downgrade) + // that Phase-1 auto-restart doesn't cover still shows the user what moved. + // The cache is read-only here — no subprocess is spawned. // - // Global config drives both the restart-drift hash and descriptor env - // layering below — the caller loads it once and passes it in, so + // Global config drives both the prospective snapshot and the descriptor + // env layering below — the caller loads it once and passes it in, so // list-style callers pay one disk read per call rather than one per record. - let needs_restart = pair_key - .as_ref() - .and_then(|key| runtimes.get(key).map(|runtime| (key, runtime))) - .is_some_and(|(key, runtime)| { - let teams_for_hash = crate::managed_agents::load_teams(app).unwrap_or_default(); - let hash_drift = runtime.spawn_config_hash - != crate::managed_agents::spawn_hash::spawn_config_hash( - record, - personas, - &teams_for_hash, - &key.relay_url, - global_config, - ); - let availability_drift = super::availability_drift( - runtime.adapter_availability.as_ref(), - super::adapter_availability_cached(), - ); - // An orphan can never be restarted successfully — - // `spawn_agent_child` refuses it before any process side effect — - // so `needs_restart` must never fire for one regardless of hash or - // availability drift. Surfacing "Restart required" here would offer - // an action guaranteed to fail; the UI shows `persona_orphaned` - // instead (see `ManagedAgentSummary::persona_orphaned`). - restart_eligible(persona_orphaned, hash_drift, availability_drift) - }); + // The prospective side is computed only for a tracked pair: an unstamped + // agent has nothing to compare against. + let tracked_spawn = pair_key.as_ref().zip(pair_runtime).map(|(key, runtime)| { + let current = crate::managed_agents::spawn_snapshot::prospective_spawn_config_snapshot( + record, + personas, + teams, + &key.relay_url, + global_config, + super::owner_only_access_build(), + ); + (runtime, current) + }); + let restart_diff = crate::managed_agents::spawn_snapshot::eligible_restart_diff( + persona_orphaned, + tracked_spawn.as_ref().map(|(runtime, current)| { + crate::managed_agents::spawn_snapshot::TrackedSpawnState { + stamped: &runtime.spawn_config, + current, + stamped_availability: runtime.adapter_availability.as_ref(), + current_availability: super::adapter_availability_cached(), + } + }), + ); + // One vector is the whole truth: badge on ⟺ there is a diff to show. + let needs_restart = !restart_diff.is_empty(); // Resolve the effective harness via the single typed descriptor — same resolver // as spawn, so the UI reflects the persona's current harness (or explicit pin). @@ -321,6 +322,7 @@ pub fn build_managed_agent_summary( persona_out_of_date, persona_orphaned, needs_restart, + restart_diff, env_vars: record.env_vars.clone(), backend: record.backend.clone(), backend_agent_id: record.backend_agent_id.clone(), @@ -341,19 +343,6 @@ pub fn build_managed_agent_summary( }) } -/// Pure predicate: should the "Restart required" badge fire? -/// -/// An orphaned linked instance (its persona/definition no longer exists) -/// can never be restarted successfully — `spawn_agent_child` refuses to -/// spawn it before any process side effect. Surfacing "Restart required" -/// for one would offer an action guaranteed to fail, so this always -/// returns `false` for an orphan regardless of drift. Extracted for unit -/// testing without `AppHandle`/global state, following the -/// `availability_drift` pattern in `discovery.rs`. -fn restart_eligible(persona_orphaned: bool, hash_drift: bool, availability_drift: bool) -> bool { - !persona_orphaned && (hash_drift || availability_drift) -} - pub fn find_managed_agent_mut<'a>( records: &'a mut [ManagedAgentRecord], pubkey: &str, @@ -381,44 +370,7 @@ pub(crate) fn build_respond_to_env( record: &ManagedAgentRecord, owner_hex: Option<&str>, ) -> Result { - // Defensive re-validation: an on-disk record could have been hand-edited. - let normalized = super::types::validate_respond_to_allowlist(&record.respond_to_allowlist)?; - if record.respond_to == super::types::RespondTo::Allowlist && normalized.is_empty() { - return Err( - "respond-to mode 'allowlist' requires at least one pubkey in the allowlist".to_string(), - ); - } - - let mut set: Vec<(&'static str, String)> = Vec::new(); - let mut remove: Vec<&'static str> = Vec::new(); - - set.push(( - "BUZZ_ACP_RESPOND_TO", - record.respond_to.as_str().to_string(), - )); - - if record.respond_to == super::types::RespondTo::Allowlist { - set.push(("BUZZ_ACP_RESPOND_TO_ALLOWLIST", normalized.join(","))); - } else { - remove.push("BUZZ_ACP_RESPOND_TO_ALLOWLIST"); - } - - // Legacy fallback: agents created before NIP-OA lack `auth_tag`. Without - // it the harness can't resolve the owner, and owner-dependent gate modes - // would drop every event. Forwarding the workspace owner pubkey via - // BUZZ_ACP_AGENT_OWNER keeps those records functional. Modern records - // (`auth_tag = Some(...)`) use `BUZZ_AUTH_TAG` as before. - if record.auth_tag.is_none() { - if let Some(owner) = owner_hex { - set.push(("BUZZ_ACP_AGENT_OWNER", owner.to_string())); - } else { - remove.push("BUZZ_ACP_AGENT_OWNER"); - } - } else { - remove.push("BUZZ_ACP_AGENT_OWNER"); - } - - Ok((set, remove)) + build_respond_to_env_with_policy(record, owner_hex, super::owner_only()) } pub(crate) fn configure_runtime_cli( @@ -474,7 +426,7 @@ pub fn spawn_agent_child( let global = crate::managed_agents::load_global_agent_config(app).unwrap_or_default(); // Resolve model/provider/prompt ONCE, here, at the shared spawn boundary — - // the single source both the env writes below and `spawn_config_hash` + // the single source both the env writes below and the spawn-config snapshot // read from. Previously prompt was read from the record's own (possibly // stale, Phase-A-snapshot) bytes while model/provider were resolved live // from `personas`; a definition edit landing between a caller's snapshot @@ -491,8 +443,9 @@ pub fn spawn_agent_child( // Single typed resolver: validates runtime id (dangling harness → Err), resolves // command, args (instance wins over definition default), and the full env layer stack. - // This is the sole path for harness-definition lookup — spawn, hash, summary, and - // model probes all consume this descriptor rather than assembling values inline. + // This is the sole path for harness-definition lookup — spawn, snapshot, + // summary, and model probes all consume this descriptor rather than + // assembling values inline. // Like the orphan refusal above, this runs before any side effect so a refused // spawn leaves no trace. let descriptor = @@ -580,6 +533,7 @@ pub fn spawn_agent_child( command.env("BUZZ_PRIVATE_KEY", &record.private_key_nsec); command.env("BUZZ_RELAY_URL", &effective_relay_url); command.env("BUZZ_ACP_LAZY_POOL", if lazy { "true" } else { "false" }); + command.env("BUZZ_ACP_IDLE_POOL_SLEEP", idle_pool_sleep_env(lazy)); command.env("BUZZ_ACP_AGENT_COMMAND", &resolved_agent_command); command.env("BUZZ_ACP_AGENT_ARGS", agent_args.join(",")); match &resolved_mcp_command { @@ -713,12 +667,9 @@ pub fn spawn_agent_child( ); } } - // Only emit BUZZ_ACP_IDLE_TIMEOUT when the user has explicitly set an - // override. When unset, the buzz-acp harness applies its own default - // (see `DEFAULT_IDLE_TIMEOUT_SECS` in crates/buzz-acp/src/config.rs), - // which is the single source of truth. The previously-emitted - // `BUZZ_ACP_TURN_TIMEOUT` is deprecated upstream and was pinning every - // agent to the desktop's stale default (320s), bypassing harness bumps. + // Emit BUZZ_ACP_IDLE_TIMEOUT only when explicitly set; the harness + // DEFAULT_IDLE_TIMEOUT_SECS is the single source of truth. The deprecated + // BUZZ_ACP_TURN_TIMEOUT pinned agents to a stale default (320s). if let Some(idle) = record.idle_timeout_seconds { command.env("BUZZ_ACP_IDLE_TIMEOUT", idle.to_string()); } @@ -726,7 +677,8 @@ pub fn spawn_agent_child( if let Some(max_dur) = record.max_turn_duration_seconds { command.env("BUZZ_ACP_MAX_TURN_DURATION", max_dur.to_string()); } - command.env("BUZZ_ACP_AGENTS", record.parallelism.to_string()); + let acp_n = super::acp_agents_value(effective_command, record.parallelism); + command.env("BUZZ_ACP_AGENTS", acp_n); command.env("BUZZ_ACP_MULTIPLE_EVENT_HANDLING", "steer"); command.env("BUZZ_ACP_DEDUP", "queue"); if let Some(meta) = runtime_meta { @@ -736,7 +688,7 @@ pub fn spawn_agent_child( } } } - let team_instructions = super::spawn_hash::effective_team_instructions(record, &teams); + let team_instructions = super::spawn_snapshot::effective_team_instructions(record, &teams); if let Some(instructions) = &team_instructions { command.env("BUZZ_ACP_TEAM_INSTRUCTIONS", instructions); } else { @@ -744,8 +696,8 @@ pub fn spawn_agent_child( } // Prompt, model, and provider all come from the single `effective_cfg` - // resolved at the top of this function — the SAME resolve `spawn_config_hash` - // performs below, so env write and restart badge cannot disagree. Linked + // resolved at the top of this function — the SAME resolve the spawn-config + // snapshot reads, so env write and restart badge cannot disagree. Linked // instances never consult the record's own model/provider/prompt bytes; // definition-less instances fall back to their own fields, then global. // @@ -764,20 +716,32 @@ pub fn spawn_agent_child( } else { command.env_remove("BUZZ_ACP_SYSTEM_PROMPT"); } - if let Some(model) = effective_model.as_deref() { + // Shared compute stores `auto`, but the wire name is MeshLLM's virtual + // `mesh` model. Translate here too, so the harness and the LLM client are + // told the same thing: `BUZZ_ACP_MODEL=auto` would name a model the mesh + // never advertises, leaving buzz-acp to warn and fall back on every new + // session while `BUZZ_AGENT_MODEL` said `mesh`. + #[cfg(feature = "mesh-llm")] + let acp_model = match (&mesh_model_id, effective_model.as_deref()) { + (Some(mesh_model_id), _) => Some(super::relay_mesh_wire_model(mesh_model_id).to_string()), + (None, model) => model.map(str::to_owned), + }; + #[cfg(not(feature = "mesh-llm"))] + let acp_model = effective_model.as_deref().map(str::to_owned); + if let Some(model) = acp_model.as_deref() { command.env("BUZZ_ACP_MODEL", model); } else { command.env_remove("BUZZ_ACP_MODEL"); } // Session title for the harness to pass out-of-band on `session/new`. The // adapter names the session after it; it never reaches the prompt, so this - // is display metadata only. `spawn_config_hash` hashes the same resolve, so - // a rename raises the restart badge instead of leaving the process stale. - if let Some(title) = resolve_session_title(record.display_name.as_deref(), &record.name) { - command.env(SESSION_TITLE_ENV_VAR, title); - } else { - command.env_remove(SESSION_TITLE_ENV_VAR); - } + // is display metadata only. The spawn-config snapshot records the same + // resolve, so a rename raises the restart badge instead of leaving the + // process stale. + apply_agent_display_env( + &mut command, + resolve_session_title(record.display_name.as_deref(), &record.name), + ); build_buzz_agent_provider_defaults(&mut command); if let Some(meta) = runtime_meta { for (key, value) in runtime_metadata_env_vars( @@ -814,17 +778,8 @@ pub fn spawn_agent_child( command.env("BUZZ_ACP_RELAY_OBSERVER", "true"); - // ── Git credential helper for Buzz relay ────────────────────────── - // - // Agents need to clone/push repos hosted on the Buzz relay's git - // server, which authenticates via NIP-98. The `git-credential-nostr` - // binary signs auth events using the agent's nostr key. - // - // We configure git via GIT_CONFIG_COUNT env vars (ephemeral, no - // filesystem writes) scoped to the relay's git URL so we don't - // interfere with other remotes (e.g. GitHub). - // - // NOSTR_PRIVATE_KEY mirrors BUZZ_PRIVATE_KEY — keep in sync. + // Git credential helper: NIP-98 auth for Buzz relay git via git-credential-nostr. + // Ephemeral GIT_CONFIG_COUNT env vars scoped to relay HTTP URL; NOSTR_PRIVATE_KEY mirrors BUZZ_PRIVATE_KEY. if let Some(cred_helper) = resolve_command("git-credential-nostr") { let relay_http_url = crate::relay::relay_http_base_url(&effective_relay_url); @@ -849,17 +804,27 @@ pub fn spawn_agent_child( ); } - // ── User env vars: definition floor + global + live persona + agent overrides ── - // - // `descriptor.env` is the fully-layered result from `resolve_effective_harness_descriptor`: - // baked floor → runtime metadata → definition env (harness author defaults) → - // global → live persona → per-agent, with reserved-key and malformed-key filtering - // applied. Writing it last lets user-provided values win over every Buzz-set env - // written above — reserved keys were already stripped from descriptor.env so they - // cannot clobber BUZZ_PRIVATE_KEY, NOSTR_PRIVATE_KEY, etc. + // User env (descriptor.env): fully-layered floor→runtime→definition→global→persona→agent, + // reserved-key filtered. Written last so user-explicit values win over Buzz-set env. for (key, value) in &descriptor.env { command.env(key, value); } + + // B5: carry persisted effort; harness resolves thought_level configId at first session. + // Written AFTER descriptor.env so the canonical persisted value wins over any + // user-supplied BUZZ_ACP_EFFORT_LEVEL entry, mirroring the A1 model-authority pattern + // (ANTHROPIC_MODEL is applied post-loop for the same reason). When effort_level is + // None there is no canonical value to assert, so env passthrough stands — user env + // legitimately seeds startup effort in that case. + apply_effort_env(&mut command, record.effort_level.as_deref()); + + // A1: for local claude agents, ANTHROPIC_MODEL is the single startup model authority. + // BUZZ_ACP_MODEL is removed (live ACP switches only; two authorities in the same env + // would be ambiguous). + if record.backend == super::BackendKind::Local && runtime_meta.is_some_and(|r| r.id == "claude") + { + apply_claude_model_env(&mut command, effective_model.as_deref()); + } configure_runtime_cli(&mut command, runtime_meta); // Buzz shared compute is stored as a native provider; derive the OpenAI-compatible @@ -882,6 +847,23 @@ pub fn spawn_agent_child( .env("BUZZ_MANAGED_AGENT", current_instance_id(app)) .env("BUZZ_MANAGED_AGENT_START_NONCE", &start_nonce); + // Stamp the effective spawn config from the values that populated the + // `Command` above, BEFORE spawning. Re-resolving after `spawn()` would let + // a persona/harness/global edit landing in between stamp the NEW config + // onto a child running the OLD one, silently suppressing the badge. + let spawn_config = super::spawn_snapshot::SpawnConfigSnapshot::from_inputs( + super::spawn_snapshot::SpawnConfigInputs { + record, + descriptor: &descriptor, + relay_url: &effective_relay_url, + team_instructions: team_instructions.as_deref(), + system_prompt: effective_prompt.as_deref(), + model: effective_model.as_deref(), + provider: effective_provider.as_deref(), + enforced_owner_only: super::owner_only_access_build(), + }, + ); + // Spawn the harness in its own process group so we can kill the entire // tree (harness + MCP servers + agent subprocesses) on shutdown. #[cfg(unix)] @@ -907,18 +889,6 @@ pub fn spawn_agent_child( ) })?; - // Stamp the effective spawn config so the summary builder can flag - // needs_restart when disk state drifts from what this process runs. - // `effective_relay_url` is already resolved, and resolution is idempotent, - // so it serves as the workspace-relay input here. - let spawn_config_hash = super::spawn_hash::spawn_config_hash( - record, - &personas, - &teams, - &effective_relay_url, - &global, - ); - // Stamp the adapter availability for runtimes with a version gate (codex // only). The summary builder compares this against the current cached value // to detect out-of-band adapter changes after spawn (Phase-2 badge fallback). @@ -941,7 +911,7 @@ pub fn spawn_agent_child( return Ok(super::process_lifecycle::finish_spawn( child, log_path, - spawn_config_hash, + spawn_config, spawned_setup_mode, spawned_adapter_availability, start_nonce, @@ -951,7 +921,7 @@ pub fn spawn_agent_child( Ok(crate::managed_agents::ManagedAgentProcess { child, log_path, - spawn_config_hash, + spawn_config, setup_mode: spawned_setup_mode, adapter_availability: spawned_adapter_availability, start_nonce, @@ -966,21 +936,20 @@ fn child_rust_log_filter() -> String { } } +/// Spawn (or adopt) the runtime pair for `record` on the caller's bound +/// workspace relay. `workspace_relay` can only be produced by +/// `bind_expected_relay_scope`, so this spawn consumes — by construction — the +/// exact workspace-relay read the caller's scope assertion passed on; it never +/// re-reads the mutable override (see `relay::scope`). The key comes from +/// [`bound_runtime_key`] — the seam the spawn-key regressions exercise. pub fn start_managed_agent_process( app: &AppHandle, record: &mut ManagedAgentRecord, runtimes: &mut HashMap, owner_hex: Option<&str>, + workspace_relay: &crate::relay::ScopedWorkspaceRelay, ) -> Result<(), String> { - let relay_url = { - use tauri::Manager; - let state = app.state::(); - crate::relay::effective_agent_relay_url( - &record.relay_url, - &crate::relay::relay_ws_url_with_override(&state), - ) - }; - let key = ManagedAgentRuntimeKey::new(record.pubkey.clone(), &relay_url)?; + let key = bound_runtime_key(record, workspace_relay)?; if let Some(runtime) = runtimes.get_mut(&key) { if runtime .child @@ -1023,5 +992,8 @@ pub fn start_managed_agent_process( Ok(()) } +#[cfg(test)] +mod test_fixtures; + #[cfg(test)] mod tests; diff --git a/desktop/src-tauri/src/managed_agents/runtime/cli_tests.rs b/desktop/src-tauri/src/managed_agents/runtime/cli_tests.rs new file mode 100644 index 00000000000..2d4fee340a1 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/runtime/cli_tests.rs @@ -0,0 +1,38 @@ +//! Runtime CLI configuration regression tests kept beside the configured seam. + +use super::super::configure_runtime_cli; +use crate::managed_agents::known_acp_runtime; + +#[test] +fn claude_spawn_uses_the_probed_cli_executable() { + let _guard = crate::managed_agents::lock_path_mutex(); + let temp = tempfile::tempdir().expect("temp dir"); + let cli = temp + .path() + .join(format!("claude{}", std::env::consts::EXE_SUFFIX)); + std::fs::write(&cli, "").expect("write fake cli"); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + std::fs::set_permissions(&cli, std::fs::Permissions::from_mode(0o755)) + .expect("make fake cli executable"); + } + let original_path = std::env::var_os("PATH"); + std::env::set_var("PATH", temp.path()); + // The resolver retains negative results across tests, so the fake CLI must + // invalidate both before configuration and after restoring PATH. + crate::managed_agents::clear_resolve_cache(); + + let mut command = std::process::Command::new("buzz-acp"); + configure_runtime_cli(&mut command, known_acp_runtime("claude-agent-acp")); + + if let Some(path) = original_path { + std::env::set_var("PATH", path); + } else { + std::env::remove_var("PATH"); + } + crate::managed_agents::clear_resolve_cache(); + assert!(command + .get_envs() + .any(|(key, value)| { key == "CLAUDE_CODE_EXECUTABLE" && value == Some(cli.as_os_str()) })); +} diff --git a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs index 288ce06b0ad..5aef424ea61 100644 --- a/desktop/src-tauri/src/managed_agents/runtime/metadata.rs +++ b/desktop/src-tauri/src/managed_agents/runtime/metadata.rs @@ -25,8 +25,25 @@ pub(crate) fn runtime_metadata_env_vars<'a>( } /// Env var carrying the session title to the harness. Shared with -/// `spawn_hash` so the restart badge hashes the same key the spawn writes. +/// `spawn_snapshot` so the restart badge records the same key the spawn writes. pub(crate) const SESSION_TITLE_ENV_VAR: &str = "BUZZ_ACP_SESSION_TITLE"; +/// Stable agent display name forwarded to the ACP tool surface for git +/// attribution and private-conversation provenance. +pub(crate) const DISPLAY_NAME_ENV_VAR: &str = "BUZZ_ACP_DISPLAY_NAME"; + +/// Apply the shared stable agent name to both session display metadata and +/// git attribution, clearing both keys when no usable name is available. +pub(crate) fn apply_agent_display_env(command: &mut std::process::Command, title: Option) { + if let Some(title) = title { + command + .env(SESSION_TITLE_ENV_VAR, &title) + .env(DISPLAY_NAME_ENV_VAR, title); + } else { + command + .env_remove(SESSION_TITLE_ENV_VAR) + .env_remove(DISPLAY_NAME_ENV_VAR); + } +} /// Resolve the session title for an agent: its `display_name` when it has one, /// otherwise its unique `name` handle. `None` when both are blank, so the @@ -57,32 +74,6 @@ pub(crate) fn resolve_session_title(display_name: Option<&str>, name: &str) -> O .find(|value| !value.is_empty()) } -/// Resolve effective prompt/model/provider using definition-authoritative -/// semantics for linked instances. -/// -/// Used by `agent_config.rs` to inject persona defaults into the config surface -/// before running the reader. -pub(crate) fn resolve_effective_prompt_model_provider( - persona_id: Option<&str>, - personas: &[crate::managed_agents::types::AgentDefinition], - record_prompt: Option, - record_model: Option, - record_provider: Option, -) -> (Option, Option, Option) { - match persona_id.and_then(|pid| personas.iter().find(|p| p.id == pid)) { - Some(p) => { - fn non_blank(v: Option<&str>) -> Option { - v.filter(|s| !s.trim().is_empty()).map(str::to_owned) - } - let prompt = non_blank(Some(&p.system_prompt)); - let model = non_blank(p.model.as_deref()); - let provider = non_blank(p.provider.as_deref()); - (prompt, model, provider) - } - None => (record_prompt, record_model, record_provider), - } -} - #[cfg(test)] mod tests { use super::resolve_session_title; diff --git a/desktop/src-tauri/src/managed_agents/runtime/spawn_key.rs b/desktop/src-tauri/src/managed_agents/runtime/spawn_key.rs new file mode 100644 index 00000000000..fe302ffc67e --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/runtime/spawn_key.rs @@ -0,0 +1,84 @@ +//! Production spawn-key derivation — split from `runtime.rs` (file-size +//! guard). The regression tests live beside the function so they exercise +//! the exact seam production spawn keys on. + +use crate::managed_agents::types::ManagedAgentRecord; +use crate::managed_agents::ManagedAgentRuntimeKey; + +/// The one production derivation from a caller-bound workspace relay to the +/// runtime-pair key `start_managed_agent_process` spawns and persists under. +/// Extracted so the regression suite exercises the exact seam production +/// uses: a mutation that keys the spawn to anything but the bound value now +/// fails the tests below, instead of leaving them green while a painted +/// guard watches the door. +pub(crate) fn bound_runtime_key( + record: &ManagedAgentRecord, + workspace_relay: &crate::relay::ScopedWorkspaceRelay, +) -> Result { + let relay_url = + crate::relay::effective_agent_relay_url(&record.relay_url, workspace_relay.as_str()); + ManagedAgentRuntimeKey::new(record.pubkey.clone(), &relay_url) +} + +#[cfg(test)] +mod tests { + use super::bound_runtime_key; + use crate::managed_agents::types::ManagedAgentRecord; + + fn record(pubkey: &str, relay_url: &str) -> ManagedAgentRecord { + serde_json::from_value(serde_json::json!({ + "pubkey": pubkey, + "name": "test", + "private_key_nsec": "nsec1fake", + "relay_url": relay_url, + "acp_command": "buzz-acp", + "agent_command": "buzz-agent", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "created_at": "", + "updated_at": "" + })) + .expect("record fixture") + } + + #[test] + fn production_spawn_key_derives_from_the_bound_relay_not_the_post_switch_workspace() { + // Round-8 regression: the previous test reconstructed the key + // derivation by hand, so hard-coding a wrong tenant inside production + // spawn stayed green. This calls `bound_runtime_key` — the exact + // function `start_managed_agent_process` keys its spawn, receipt, and + // runtimes-map insert on — so that mutation now fails here. + let record = record(&"aa".repeat(32), ""); // never-pinned record + let mut workspace = "wss://tenant-a.example".to_string(); + let bound = crate::relay::bind_expected_relay_scope( + Some("wss://tenant-a.example"), + workspace.clone(), + ) + .expect("scope matches at bind time"); + workspace = "wss://tenant-b.example".to_string(); // the switch lands post-check + + let key = bound_runtime_key(&record, &bound).expect("keyable record and relay"); + assert_eq!(key.relay_url, "wss://tenant-a.example"); + assert_eq!(key.pubkey, "aa".repeat(32)); + assert_ne!( + key.relay_url, workspace, + "the production spawn key must be unrepresentable for the post-switch tenant" + ); + } + + #[test] + fn production_spawn_key_ignores_a_legacy_record_pin() { + // agents-everywhere (#2122): the stored per-record pin never + // contributes; the bound workspace relay is the only input. Pins the + // same contract at the production seam so a regression re-honoring + // the pin fails loudly. + let record = record(&"bb".repeat(32), "wss://stale-pin.example"); + let bound = + crate::relay::bind_expected_relay_scope(None, "wss://tenant-a.example".to_string()) + .expect("unscoped bind"); + + let key = bound_runtime_key(&record, &bound).expect("keyable record and relay"); + assert_eq!(key.relay_url, "wss://tenant-a.example"); + } +} diff --git a/desktop/src-tauri/src/managed_agents/runtime/test_fixtures.rs b/desktop/src-tauri/src/managed_agents/runtime/test_fixtures.rs new file mode 100644 index 00000000000..9076766b2e6 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/runtime/test_fixtures.rs @@ -0,0 +1,95 @@ +use crate::managed_agents::types::{ManagedAgentRecord, RespondTo}; + +pub(super) const EXPECTED_ACCESS_ENV: &str = "BUZZ_TEST_EXPECTED_AGENT_ACCESS_OWNER_ONLY"; + +pub(super) fn expected_owner_only() -> bool { + match std::env::var(EXPECTED_ACCESS_ENV) { + Ok(value) => value + .parse::() + .unwrap_or_else(|_| panic!("{EXPECTED_ACCESS_ENV} must be true or false")), + Err(std::env::VarError::NotPresent) + if !crate::managed_agents::owner_only_access_build() => + { + false + } + Err(std::env::VarError::NotPresent) => { + panic!("{EXPECTED_ACCESS_ENV} must be set for owner-only-access-build tests") + } + Err(std::env::VarError::NotUnicode(_)) => { + panic!("{EXPECTED_ACCESS_ENV} must be valid UTF-8") + } + } +} + +pub(super) fn expected_mode(oss_mode: &'static str) -> &'static str { + if expected_owner_only() { + "owner-only" + } else { + oss_mode + } +} + +/// Construct a minimal record fixture for runtime tests. +pub(super) fn fixture( + respond_to: RespondTo, + allowlist: Vec, + auth_tag: Option, +) -> ManagedAgentRecord { + ManagedAgentRecord { + pubkey: "p".into(), + name: "n".into(), + persona_id: None, + private_key_nsec: "nsec1fake".into(), + auth_tag, + relay_url: "ws://localhost:3000".into(), + avatar_url: None, + acp_command: "buzz-acp".into(), + agent_command: "goose".into(), + agent_command_override: None, + agent_args: vec![], + mcp_command: String::new(), + turn_timeout_seconds: 320, + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + parallelism: 1, + system_prompt: None, + model: None, + provider: None, + persona_source_version: None, + env_vars: std::collections::BTreeMap::new(), + start_on_app_launch: false, + auto_restart_on_config_change: true, + runtime_pid: None, + backend: Default::default(), + backend_agent_id: None, + provider_policy_pending: false, + provider_binary_path: None, + team_id: None, + persona_team_dir: None, + persona_name_in_team: None, + created_at: "now".into(), + updated_at: "now".into(), + last_started_at: None, + last_stopped_at: None, + last_exit_code: None, + last_error: None, + last_error_code: None, + respond_to, + respond_to_allowlist: allowlist, + display_name: None, + slug: None, + runtime: None, + name_pool: Vec::new(), + is_builtin: false, + is_active: true, + shared: false, + source_team: None, + source_team_persona_slug: None, + catalog_source: None, + definition_respond_to: None, + definition_respond_to_allowlist: Vec::new(), + definition_parallelism: None, + relay_mesh: None, + effort_level: None, + } +} diff --git a/desktop/src-tauri/src/managed_agents/runtime/tests.rs b/desktop/src-tauri/src/managed_agents/runtime/tests.rs index 3f6ee996f6c..8bedfe53207 100644 --- a/desktop/src-tauri/src/managed_agents/runtime/tests.rs +++ b/desktop/src-tauri/src/managed_agents/runtime/tests.rs @@ -1,5 +1,8 @@ use crate::managed_agents::known_acp_runtime; +#[path = "cli_tests.rs"] +mod cli_tests; + // ── desktop binary name tests ─────────────────────────────────────────── #[test] @@ -117,73 +120,10 @@ fn unknown_command_returns_none() { // ── build_respond_to_env tests ─────────────────────────────────────── -use super::build_respond_to_env; +use super::test_fixtures::{expected_mode, expected_owner_only, fixture}; +use super::{build_respond_to_env, build_respond_to_env_with_policy}; use crate::managed_agents::types::{ManagedAgentRecord, RespondTo}; -/// Construct a minimal record fixture for env-building tests. Only the -/// fields read by `build_respond_to_env` matter here. -fn fixture( - respond_to: RespondTo, - allowlist: Vec, - auth_tag: Option, -) -> ManagedAgentRecord { - ManagedAgentRecord { - pubkey: "p".into(), - name: "n".into(), - persona_id: None, - private_key_nsec: "nsec1fake".into(), - auth_tag, - relay_url: "ws://localhost:3000".into(), - avatar_url: None, - acp_command: "buzz-acp".into(), - agent_command: "goose".into(), - agent_command_override: None, - agent_args: vec![], - mcp_command: String::new(), - turn_timeout_seconds: 320, - idle_timeout_seconds: None, - max_turn_duration_seconds: None, - parallelism: 1, - system_prompt: None, - model: None, - provider: None, - persona_source_version: None, - env_vars: std::collections::BTreeMap::new(), - start_on_app_launch: false, - auto_restart_on_config_change: true, - runtime_pid: None, - backend: Default::default(), - backend_agent_id: None, - provider_binary_path: None, - team_id: None, - persona_team_dir: None, - persona_name_in_team: None, - created_at: "now".into(), - updated_at: "now".into(), - last_started_at: None, - last_stopped_at: None, - last_exit_code: None, - last_error: None, - last_error_code: None, - respond_to, - respond_to_allowlist: allowlist, - display_name: None, - slug: None, - runtime: None, - name_pool: Vec::new(), - is_builtin: false, - is_active: true, - shared: false, - source_team: None, - source_team_persona_slug: None, - catalog_source: None, - definition_respond_to: None, - definition_respond_to_allowlist: Vec::new(), - definition_parallelism: None, - relay_mesh: None, - } -} - #[test] fn build_env_owner_only_sets_mode_and_removes_others() { let rec = fixture(RespondTo::OwnerOnly, vec![], Some("tag".into())); @@ -195,6 +135,18 @@ fn build_env_owner_only_sets_mode_and_removes_others() { ); assert!(!set_map.contains_key("BUZZ_ACP_RESPOND_TO_ALLOWLIST")); assert!(remove.contains(&"BUZZ_ACP_RESPOND_TO_ALLOWLIST")); + if expected_owner_only() { + assert_eq!( + set_map + .get("BUZZ_ACP_ALLOWED_RESPOND_TO") + .map(String::as_str), + Some("owner-only") + ); + assert!(!remove.contains(&"BUZZ_ACP_ALLOWED_RESPOND_TO")); + } else { + assert!(!set_map.contains_key("BUZZ_ACP_ALLOWED_RESPOND_TO")); + assert!(remove.contains(&"BUZZ_ACP_ALLOWED_RESPOND_TO")); + } // auth_tag is present → no AGENT_OWNER fallback fires. assert!(remove.contains(&"BUZZ_ACP_AGENT_OWNER")); } @@ -214,14 +166,19 @@ fn build_env_allowlist_sets_both_envs_and_joins() { let set_map: std::collections::HashMap<_, _> = set.into_iter().collect(); assert_eq!( set_map.get("BUZZ_ACP_RESPOND_TO").map(String::as_str), - Some("allowlist") - ); - assert_eq!( - set_map - .get("BUZZ_ACP_RESPOND_TO_ALLOWLIST") - .map(String::as_str), - Some(format!("{a},{b}").as_str()), + Some(expected_mode("allowlist")), + "runtime wrapper did not apply the declared build policy", ); + if expected_owner_only() { + assert!(!set_map.contains_key("BUZZ_ACP_RESPOND_TO_ALLOWLIST")); + } else { + assert_eq!( + set_map + .get("BUZZ_ACP_RESPOND_TO_ALLOWLIST") + .map(String::as_str), + Some(format!("{a},{b}").as_str()), + ); + } } #[test] @@ -231,7 +188,30 @@ fn build_env_anyone_omits_allowlist_var() { let set_map: std::collections::HashMap<_, _> = set.into_iter().collect(); assert_eq!( set_map.get("BUZZ_ACP_RESPOND_TO").map(String::as_str), - Some("anyone") + Some(expected_mode("anyone")), + "runtime wrapper did not apply the declared build policy", + ); + assert!(!set_map.contains_key("BUZZ_ACP_RESPOND_TO_ALLOWLIST")); + assert!(remove.contains(&"BUZZ_ACP_RESPOND_TO_ALLOWLIST")); +} + +#[test] +fn owner_only_access_policy_overrides_stale_anyone_record_at_runtime() { + let rec = fixture(RespondTo::Anyone, vec!["a".repeat(64)], Some("tag".into())); + let (set, remove) = build_respond_to_env_with_policy(&rec, Some("owner"), true).unwrap(); + let set_map: std::collections::HashMap<_, _> = set.into_iter().collect(); + + assert_eq!( + set_map.get("BUZZ_ACP_RESPOND_TO").map(String::as_str), + Some("owner-only"), + "owner-only-access runtime env widened stale access", + ); + assert_eq!( + set_map + .get("BUZZ_ACP_ALLOWED_RESPOND_TO") + .map(String::as_str), + Some("owner-only"), + "owner-only-access runtime env omitted the owner-only guard", ); assert!(!set_map.contains_key("BUZZ_ACP_RESPOND_TO_ALLOWLIST")); assert!(remove.contains(&"BUZZ_ACP_RESPOND_TO_ALLOWLIST")); @@ -271,8 +251,17 @@ fn build_env_rejects_corrupted_allowlist() { #[test] fn build_env_rejects_empty_allowlist_in_allowlist_mode() { let rec = fixture(RespondTo::Allowlist, vec![], Some("tag".into())); - let err = build_respond_to_env(&rec, Some("owner")).unwrap_err(); - assert!(err.contains("at least one pubkey")); + if expected_owner_only() { + let (set, _) = build_respond_to_env(&rec, Some("owner")).unwrap(); + let set_map: std::collections::HashMap<_, _> = set.into_iter().collect(); + assert_eq!( + set_map.get("BUZZ_ACP_RESPOND_TO").map(String::as_str), + Some("owner-only") + ); + } else { + let err = build_respond_to_env(&rec, Some("owner")).unwrap_err(); + assert!(err.contains("at least one pubkey")); + } } // ── persona fixture helpers ───────────────────────────────────────── @@ -596,36 +585,6 @@ fn name_matches_interpreter_rejects_node_prefix() { assert!(!super::name_matches_interpreter("node-gyp")); } -#[test] -fn claude_spawn_uses_the_probed_cli_executable() { - let _guard = crate::managed_agents::lock_path_mutex(); - let temp = tempfile::tempdir().expect("temp dir"); - let cli = temp - .path() - .join(format!("claude{}", std::env::consts::EXE_SUFFIX)); - std::fs::write(&cli, "").expect("write fake cli"); - #[cfg(unix)] - { - use std::os::unix::fs::PermissionsExt; - std::fs::set_permissions(&cli, std::fs::Permissions::from_mode(0o755)) - .expect("make fake cli executable"); - } - let original_path = std::env::var_os("PATH"); - std::env::set_var("PATH", temp.path()); - - let mut command = std::process::Command::new("buzz-acp"); - super::configure_runtime_cli(&mut command, super::known_acp_runtime("claude-agent-acp")); - - if let Some(path) = original_path { - std::env::set_var("PATH", path); - } else { - std::env::remove_var("PATH"); - } - assert!(command - .get_envs() - .any(|(key, value)| { key == "CLAUDE_CODE_EXECUTABLE" && value == Some(cli.as_os_str()) })); -} - #[test] fn codex_spawn_does_not_set_a_claude_executable() { let mut command = std::process::Command::new("buzz-acp"); @@ -1220,7 +1179,7 @@ fn receipt_invalid_when_process_not_running() { ); } -// ── Test helpers ──────────────────────────────────────────────────────────── +// ── Test helpers (spawn-key regressions: see `runtime/spawn_key.rs`) ─────── fn minimal_record(pubkey: &str) -> crate::managed_agents::ManagedAgentRecord { serde_json::from_str(&format!( @@ -1253,7 +1212,6 @@ fn make_pair_runtime_placeholder() -> crate::managed_agents::ManagedAgentPairRun use std::process::{Command, Stdio}; // Spawn a real child so ManagedAgentProcess's Child field is satisfied. // `true` exits immediately with 0 — just a handle we need for type purposes. - // // Absolute `/usr/bin/true` on unix (present on both macOS and Linux): // parallel tests holding `lock_path_mutex` swap PATH to a tempdir, and a // bare `true` lookup during that window fails with NotFound (observed @@ -1270,8 +1228,15 @@ fn make_pair_runtime_placeholder() -> crate::managed_agents::ManagedAgentPairRun .expect("spawn true for placeholder"); let process = crate::managed_agents::ManagedAgentProcess { child, - log_path: std::path::PathBuf::new(), - spawn_config_hash: 0, + log_path: Default::default(), + spawn_config: crate::managed_agents::spawn_snapshot::prospective_spawn_config_snapshot( + &minimal_record(&"cc".repeat(32)), + &[], + &[], + "wss://relay.example", + &Default::default(), + false, + ), setup_mode: false, adapter_availability: None, start_nonce: "test-nonce".to_string(), @@ -1280,37 +1245,3 @@ fn make_pair_runtime_placeholder() -> crate::managed_agents::ManagedAgentPairRun }; crate::managed_agents::ManagedAgentPairRuntime::starting(process) } - -// ── restart_eligible tests ────────────────────────────────────────────── - -#[test] -fn restart_eligible_true_when_non_orphan_has_hash_drift() { - assert!(super::restart_eligible(false, true, false)); -} - -#[test] -fn restart_eligible_true_when_non_orphan_has_availability_drift() { - assert!(super::restart_eligible(false, false, true)); -} - -#[test] -fn restart_eligible_false_when_orphan_has_hash_drift() { - // An orphan can never be restarted successfully — spawn refuses it — - // so hash drift alone must not surface "Restart required". - assert!(!super::restart_eligible(true, true, false)); -} - -#[test] -fn restart_eligible_false_when_orphan_has_availability_drift() { - assert!(!super::restart_eligible(true, false, true)); -} - -#[test] -fn restart_eligible_false_when_orphan_has_no_drift() { - assert!(!super::restart_eligible(true, false, false)); -} - -#[test] -fn restart_eligible_false_when_non_orphan_has_no_drift() { - assert!(!super::restart_eligible(false, false, false)); -} diff --git a/desktop/src-tauri/src/managed_agents/runtime_commands.rs b/desktop/src-tauri/src/managed_agents/runtime_commands.rs index c0e55184b19..135224d01db 100644 --- a/desktop/src-tauri/src/managed_agents/runtime_commands.rs +++ b/desktop/src-tauri/src/managed_agents/runtime_commands.rs @@ -137,86 +137,91 @@ pub fn put_managed_agent_runtime_lifecycle( Ok(status) } +// Keep disk, process, and mutex work off the main thread so opening members cannot stall the UI. #[tauri::command] -pub fn list_managed_agent_runtimes( +pub async fn list_managed_agent_runtimes( app: AppHandle, ) -> Result, String> { - // This command is polled whenever the members sidebar opens and refetched - // on every status event — load the per-row status inputs once, outside - // the locks, instead of hitting disk per row while holding them. - let personas = load_personas(&app).unwrap_or_default(); - let global = load_global_agent_config(&app).unwrap_or_default(); - let state = app.state::(); - let _transition = state - .managed_agent_runtime_transition - .lock() - .map_err(|e| e.to_string())?; - let _store = state - .managed_agents_store_lock - .lock() - .map_err(|e| e.to_string())?; - let mut records = load_managed_agents(&app)?; - let mut runtimes = state - .managed_agent_processes - .lock() - .map_err(|e| e.to_string())?; - let exited_keys: Vec<_> = runtimes - .iter_mut() - .filter_map(|(key, runtime)| match runtime.child.try_wait() { - Ok(Some(_)) | Err(_) => Some(key.clone()), - Ok(None) => None, - }) - .collect(); - let records_changed = !exited_keys.is_empty(); - let mut statuses = Vec::new(); - for key in exited_keys { - runtimes.remove(&key); - super::remove_agent_runtime_receipt(&app, &key); - state.clear_agent_session_cache(&key); - if let Some(record) = records + tokio::task::spawn_blocking(move || { + // This command is polled whenever the members sidebar opens and refetched + // on every status event — load the per-row status inputs once, outside + // the locks, instead of hitting disk per row while holding them. + let personas = load_personas(&app).unwrap_or_default(); + let global = load_global_agent_config(&app).unwrap_or_default(); + let state = app.state::(); + let _transition = state + .managed_agent_runtime_transition + .lock() + .map_err(|e| e.to_string())?; + let _store = state + .managed_agents_store_lock + .lock() + .map_err(|e| e.to_string())?; + let mut records = load_managed_agents(&app)?; + let mut runtimes = state + .managed_agent_processes + .lock() + .map_err(|e| e.to_string())?; + let exited_keys: Vec<_> = runtimes .iter_mut() - .find(|record| record.pubkey.eq_ignore_ascii_case(&key.pubkey)) - { - record.updated_at = crate::util::now_iso(); - record.last_stopped_at = Some(record.updated_at.clone()); - let status = status_for_with( + .filter_map(|(key, runtime)| match runtime.child.try_wait() { + Ok(Some(_)) | Err(_) => Some(key.clone()), + Ok(None) => None, + }) + .collect(); + let records_changed = !exited_keys.is_empty(); + let mut statuses = Vec::new(); + for key in exited_keys { + runtimes.remove(&key); + super::remove_agent_runtime_receipt(&app, &key); + state.clear_agent_session_cache(&key); + if let Some(record) = records + .iter_mut() + .find(|record| record.pubkey.eq_ignore_ascii_case(&key.pubkey)) + { + record.updated_at = crate::util::now_iso(); + record.last_stopped_at = Some(record.updated_at.clone()); + let status = status_for_with( + &app, + record, + &key, + None, + None, + StatusInputs { + personas: &personas, + global: &global, + }, + ); + emit_status(&app, &status); + statuses.push(status); + } + } + statuses.extend(runtimes.iter().filter_map(|(key, runtime)| { + let record = records + .iter() + .find(|record| record.pubkey.eq_ignore_ascii_case(&key.pubkey))?; + Some(status_for_with( &app, record, - &key, - None, + key, + Some(runtime), None, StatusInputs { personas: &personas, global: &global, }, - ); - emit_status(&app, &status); - statuses.push(status); + )) + })); + drop(runtimes); + // Records are only mutated above when a runtime exited — skip the store + // rewrite on the common nothing-changed poll. + if records_changed { + save_managed_agents(&app, &records)?; } - } - statuses.extend(runtimes.iter().filter_map(|(key, runtime)| { - let record = records - .iter() - .find(|record| record.pubkey.eq_ignore_ascii_case(&key.pubkey))?; - Some(status_for_with( - &app, - record, - key, - Some(runtime), - None, - StatusInputs { - personas: &personas, - global: &global, - }, - )) - })); - drop(runtimes); - // Records are only mutated above when a runtime exited — skip the store - // rewrite on the common nothing-changed poll. - if records_changed { - save_managed_agents(&app, &records)?; - } - Ok(statuses) + Ok(statuses) + }) + .await + .map_err(|e| format!("spawn_blocking failed: {e}"))? } pub(crate) fn start_managed_agent_runtime_pair_lazy( @@ -572,6 +577,18 @@ pub async fn reconcile_managed_agent_runtimes( mod tests { use super::*; + #[test] + fn list_managed_agent_runtimes_returns_a_future() { + fn assert_async_command(_command: F) + where + F: Fn(AppHandle) -> Fut, + Fut: std::future::Future, String>>, + { + } + + assert_async_command(list_managed_agent_runtimes); + } + fn payload( relay_url: &str, lifecycle: ManagedAgentRuntimeLifecycle, diff --git a/desktop/src-tauri/src/managed_agents/spawn_hash.rs b/desktop/src-tauri/src/managed_agents/spawn_hash.rs deleted file mode 100644 index 648cc62bbed..00000000000 --- a/desktop/src-tauri/src/managed_agents/spawn_hash.rs +++ /dev/null @@ -1,160 +0,0 @@ -//! Spawn-time config hash for the restart-required badge. -//! -//! [`spawn_config_hash`] digests the *effective spawned values* — what a -//! process launch of `record` would actually receive — so the UI can compare -//! a running process's hash (stamped on [`super::ManagedAgentProcess`] at -//! spawn) against a recomputation from current disk state and show a -//! "restart required" badge only when a restart would change what runs. -//! -//! Scope rules (decided in #centralize-personas-and-agents, revised in PR -//! #1602 review): -//! - Inputs mirror what a start would actually run: the start/restore paths -//! re-snapshot the linked persona's prompt/model/provider/env onto the -//! record immediately before spawning (`start_local_agent_with_preflight`, -//! `restore_managed_agents_on_launch`), so persona edits to those fields DO -//! apply on a plain restart and are hashed via the same prospective -//! re-snapshot. Harness command, args/mcp, env layering, and the record -//! fields the spawn env writes read are hashed as spawn resolves them. -//! - The relay URL is hashed in resolved form (`effective_agent_relay_url`): -//! every record spawns against the active workspace relay (legacy per-record -//! pins are ignored), so a workspace relay change means a restart would -//! change what runs. -//! - Channel membership is not an input: agents pick up channel changes live -//! (#1468), never via restart. -//! -//! The hash never crosses a process or persistence boundary, so -//! `DefaultHasher` (not stable across Rust releases) is sufficient. - -use std::hash::{DefaultHasher, Hash, Hasher}; - -use super::{ - effective_config::{resolve_effective_config, EffectiveConfigResult}, - known_acp_runtime, normalize_agent_args, - persona_events::preview_prospective_persona_snapshot, - runtime::{resolve_session_title, SESSION_TITLE_ENV_VAR}, - types::{AgentDefinition, ManagedAgentRecord, TeamRecord}, - GlobalAgentConfig, -}; - -/// Resolve the current instructions for this instance's deployment-time team binding. -/// A deleted team deliberately degrades to no team section. -pub(crate) fn effective_team_instructions( - record: &ManagedAgentRecord, - teams: &[TeamRecord], -) -> Option { - teams - .iter() - .find(|team| Some(team.id.as_str()) == record.team_id.as_deref()) - .and_then(|team| team.instructions.as_deref()) - .map(str::trim) - .filter(|instructions| !instructions.is_empty()) - .map(str::to_string) -} - -/// Digest the effective spawn configuration of `record` under the current -/// `personas`, resolving a blank record relay against `workspace_relay`. -/// Pure — no `AppHandle`, no disk, no keyring. -pub(crate) fn spawn_config_hash( - record: &ManagedAgentRecord, - personas: &[AgentDefinition], - teams: &[TeamRecord], - workspace_relay: &str, - global: &GlobalAgentConfig, -) -> u64 { - // Prospective re-snapshot: apply the same `apply_persona_snapshot` the - // start/restore paths run right before spawning, so the hash covers what a - // restart would actually run. Idempotent, so the spawn-time stamp - // (post-snapshot record) and later recomputes (persisted record) agree - // when nothing changed. The persona env itself reaches the hash through - // the descriptor's layered env below; `persona_source_version` is set on - // the clone but is not a hash input. - let record = preview_prospective_persona_snapshot(record, personas); - let record = &record; - - // Resolve command, args, and env via the single typed descriptor — same path - // as spawn_agent_child. Dangling harness id falls back to the infallible - // record_agent_command (no-op: a dangling harness can't be spawned, so the - // hash never matters for that agent). - let descriptor = - crate::managed_agents::resolve_effective_harness_descriptor(record, personas, global) - .unwrap_or_else(|_| { - let cmd = crate::managed_agents::record_agent_command(record, personas); - let args = normalize_agent_args(&cmd, record.agent_args.clone()); - crate::managed_agents::readiness::EffectiveHarnessDescriptor { - command: cmd, - args, - env: Default::default(), - } - }); - let runtime_meta = known_acp_runtime(&descriptor.command); - - let mut hasher = DefaultHasher::new(); - - // Harness identity and derivations (live-persona-resolved, like spawn). - record.acp_command.hash(&mut hasher); - descriptor.command.hash(&mut hasher); - descriptor.args.hash(&mut hasher); - runtime_meta - .and_then(|r| r.mcp_command) - .unwrap_or("") - .hash(&mut hasher); - - // Effective env layering (baked floor → runtime metadata → definition env - // → global → persona → agent). BTreeMap iteration is ordered, deterministic. - descriptor.env.hash(&mut hasher); - - // Record fields the spawn env writes read directly. The relay is hashed - // resolved: every record spawns on the workspace relay (legacy pins - // ignored), so a workspace relay change must trip the badge. - crate::relay::effective_agent_relay_url(&record.relay_url, workspace_relay).hash(&mut hasher); - // Team instructions use the same resolver as spawn. - effective_team_instructions(record, teams).hash(&mut hasher); - // Prompt, model, and provider all come from ONE `resolve_effective_config` - // call — the SAME resolve `spawn_agent_child` performs for the env write, - // so env write and this badge cannot disagree. An orphaned link (missing - // definition) hashes as if all three were absent: `spawn_agent_child` - // refuses to spawn an orphan regardless, so this is a display-only - // convenience, not the spawn gate. - let (resolved_prompt, resolved_model, resolved_provider) = - match resolve_effective_config(record, personas, global) { - EffectiveConfigResult::Resolved(cfg) => { - (cfg.system_prompt.value, cfg.model.value, cfg.provider.value) - } - EffectiveConfigResult::OrphanedInstance { .. } => (None, None, None), - }; - resolved_prompt.hash(&mut hasher); - resolved_model.hash(&mut hasher); - resolved_provider.hash(&mut hasher); - // Session title: the same resolve `spawn_agent_child` performs for its env - // write, so a rename raises the restart badge. Skipped when a user env - // override shadows it — spawn writes the title BEFORE the user env layer, - // so the override is what actually runs, and it already reaches this hash - // through `descriptor.env` above. Hashing the record-derived value under an - // override would badge a rename that changes nothing. - let effective_session_title = (!descriptor.env.contains_key(SESSION_TITLE_ENV_VAR)) - .then(|| resolve_session_title(record.display_name.as_deref(), &record.name)) - .flatten(); - effective_session_title.hash(&mut hasher); - record.auth_tag.hash(&mut hasher); - record.respond_to.as_str().hash(&mut hasher); - // The allowlist is hashed as the env receives it: spawn sets - // BUZZ_ACP_RESPOND_TO_ALLOWLIST only in allowlist mode, and normalized - // (trim/lowercase/dedup via `validate_respond_to_allowlist`) — so edits - // that don't survive normalization, or edits while another mode is - // active, must not badge. A list spawn would reject hashes raw: the - // stamped hash comes from a successful spawn, so any invalid edit - // correctly compares unequal. - if record.respond_to == super::types::RespondTo::Allowlist { - super::types::validate_respond_to_allowlist(&record.respond_to_allowlist) - .unwrap_or_else(|_| record.respond_to_allowlist.clone()) - .hash(&mut hasher); - } - record.idle_timeout_seconds.hash(&mut hasher); - record.max_turn_duration_seconds.hash(&mut hasher); - record.parallelism.hash(&mut hasher); - - hasher.finish() -} - -#[cfg(test)] -mod tests; diff --git a/desktop/src-tauri/src/managed_agents/spawn_snapshot.rs b/desktop/src-tauri/src/managed_agents/spawn_snapshot.rs new file mode 100644 index 00000000000..8a6f68a693d --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/spawn_snapshot.rs @@ -0,0 +1,316 @@ +//! Spawn-time config snapshot for the restart-required badge. +//! +//! [`SpawnConfigSnapshot`] captures the *effective spawned values* — what a +//! process launch of a record would actually receive. The running process +//! stamps one on [`super::ManagedAgentProcess`] at spawn; the summary builder +//! recomputes a prospective one from current disk state and compares. Drift +//! means a restart would change what runs, and the field-by-field difference +//! is what the UI shows (see [`diff`]). +//! +//! Scope rules (decided in #centralize-personas-and-agents, revised in PR +//! #1602 review): +//! - Inputs mirror what a start would actually run: the start/restore paths +//! re-snapshot the linked persona's prompt/model/provider/env onto the +//! record immediately before spawning (`start_local_agent_with_preflight`, +//! `restore_managed_agents_on_launch`), so persona edits to those fields DO +//! apply on a plain restart and reach the prospective snapshot via the same +//! re-snapshot. Harness command, args/mcp, env layering, and the record +//! fields the spawn env writes read are captured as spawn resolves them. +//! - The relay URL is captured in resolved form (`effective_agent_relay_url`): +//! every record spawns against the active workspace relay (legacy per-record +//! pins are ignored), so a workspace relay change means a restart would +//! change what runs. +//! - Channel membership is not an input: agents pick up channel changes live +//! (#1468), never via restart. +//! +//! The snapshot never crosses a process or persistence boundary — it is +//! runtime state only, held on the running `ManagedAgentProcess`. + +use std::collections::BTreeMap; + +use serde::Serialize; + +use super::{ + claude_config::EFFORT_LEVEL_ENV_VAR, + effective_config::{resolve_effective_config, EffectiveConfigResult}, + known_acp_runtime, normalize_agent_args, + persona_events::preview_prospective_persona_snapshot, + readiness::EffectiveHarnessDescriptor, + runtime::{resolve_session_title, SESSION_TITLE_ENV_VAR}, + types::{AgentDefinition, ManagedAgentRecord, TeamRecord}, + GlobalAgentConfig, +}; + +pub(crate) mod diff; +pub(crate) use diff::{eligible_restart_diff, RestartDiffEntry, TrackedSpawnState}; + +/// Resolve the current instructions for this instance's deployment-time team binding. +/// A deleted team deliberately degrades to no team section. +pub(crate) fn effective_team_instructions( + record: &ManagedAgentRecord, + teams: &[TeamRecord], +) -> Option { + teams + .iter() + .find(|team| Some(team.id.as_str()) == record.team_id.as_deref()) + .and_then(|team| team.instructions.as_deref()) + .map(str::trim) + .filter(|instructions| !instructions.is_empty()) + .map(str::to_string) +} + +/// The already-resolved values a spawn feeds into its `Command`. +/// +/// Taking them rather than re-resolving is what makes the stamp describe the +/// process that was actually launched: a persona/harness/global edit landing +/// between spawn's resolution and the stamp can no longer suppress the badge. +pub(crate) struct SpawnConfigInputs<'a> { + pub record: &'a ManagedAgentRecord, + pub descriptor: &'a EffectiveHarnessDescriptor, + /// Resolved workspace/pair relay — never the record's legacy pin. + pub relay_url: &'a str, + pub team_instructions: Option<&'a str>, + pub system_prompt: Option<&'a str>, + pub model: Option<&'a str>, + pub provider: Option<&'a str>, + /// Compile-time distribution capability projected at this runtime boundary. + /// The stored record remains portable; only effective spawned access is stamped. + pub enforced_owner_only: bool, +} + +/// The effective spawn configuration of one managed-agent process. +/// +/// Serialization invariants (load-bearing — the drift comparison and the diff +/// walk both read `canonical()`): +/// - plain derived `Serialize`: no `flatten`, no `skip_serializing_if`, no +/// custom or fallible field serializers, no colliding serialized names, so +/// every field is always present on both sides of a comparison; +/// - `Option::None` serializes as JSON `null`; a *missing* key is reserved for +/// dynamic-map membership (`env.` added/removed); +/// - arrays are atomic leaves — `args` and `respond_to_allowlist` compare and +/// render whole, never element-wise. +/// +/// `Debug` is implemented by hand: [`ManagedAgentProcess`] derives `Debug`, so +/// a derived impl here would print env values, auth tags, and CLI arguments. +/// +/// [`ManagedAgentProcess`]: super::ManagedAgentProcess +#[derive(Clone, Serialize)] +pub(crate) struct SpawnConfigSnapshot { + /// The ACP harness binary the desktop launches (`buzz-acp`). + pub acp_command: String, + /// The effective agent command the harness drives. + pub command: String, + pub args: Vec, + /// Catalog-derived from `command`; `""` when the runtime has none. + pub mcp_command: String, + /// Fully layered process env: baked floor -> runtime metadata -> + /// definition -> global -> persona -> agent. + pub env: BTreeMap, + pub relay_url: String, + pub team_instructions: Option, + pub system_prompt: Option, + pub model: Option, + pub provider: Option, + /// `None` when a user env override shadows `BUZZ_ACP_SESSION_TITLE`: spawn + /// writes the title BEFORE the user env layer, so the override is what + /// actually runs and it already reaches this snapshot through `env`. + /// Capturing the record-derived value under an override would badge a + /// rename that changes nothing. + pub session_title: Option, + pub auth_tag: Option, + pub respond_to: String, + /// `None` outside allowlist mode — spawn sets + /// `BUZZ_ACP_RESPOND_TO_ALLOWLIST` only there, so edits to a dormant list + /// must not badge. Normalized (trim/lowercase/dedup) as the env receives + /// it, so edits that don't survive normalization must not badge either. + pub respond_to_allowlist: Option>, + pub idle_timeout_seconds: Option, + pub max_turn_duration_seconds: Option, + pub parallelism: u32, + /// The startup effort the harness will actually apply, resolved by + /// [`effective_effort`]: the persisted canonical `record.effort_level` when + /// present, else the user-seeded `BUZZ_ACP_EFFORT_LEVEL` from the layered + /// env. This is the *sole* representation of effort in the snapshot — the + /// key is stripped from `env` (see `from_inputs`) so an authority handoff + /// that leaves the effective value unchanged (canonical `low` replacing a + /// user env `low`, or the reverse) produces no spurious drift entry, and an + /// env-only edit still surfaces as exactly one `effort_level` entry. + pub effort_level: Option, +} + +/// The startup effort a spawn would actually apply, mirroring `apply_effort_env` +/// exactly: the persisted canonical `record.effort_level` wins, and only when it +/// is absent does a user-supplied `BUZZ_ACP_EFFORT_LEVEL` from the layered env +/// seed startup effort. This is the resolver input for the snapshot's single +/// `effort_level` representation; the same precedence runs at spawn time in +/// `runtime.rs`, so badge and process can never disagree. +pub(crate) fn effective_effort( + record: &ManagedAgentRecord, + descriptor_env: &BTreeMap, +) -> Option { + record + .effort_level + .clone() + .or_else(|| descriptor_env.get(EFFORT_LEVEL_ENV_VAR).cloned()) +} + +impl SpawnConfigSnapshot { + /// Assemble the snapshot from values a spawn has already resolved. + pub(crate) fn from_inputs(inputs: SpawnConfigInputs<'_>) -> Self { + let SpawnConfigInputs { + record, + descriptor, + relay_url, + team_instructions, + system_prompt, + model, + provider, + enforced_owner_only, + } = inputs; + let (respond_to, respond_to_allowlist) = + super::projected_access_with_policy(record, enforced_owner_only); + Self { + acp_command: record.acp_command.clone(), + command: descriptor.command.clone(), + args: descriptor.args.clone(), + mcp_command: known_acp_runtime(&descriptor.command) + .and_then(|runtime| runtime.mcp_command) + .unwrap_or("") + .to_string(), + // Effort has ONE representation in the snapshot: `effort_level` + // below, always holding `effective_effort`. Stripping the env key + // here means a canonical/user-env authority handoff at the same + // value is a no-op (no phantom `env.BUZZ_ACP_EFFORT_LEVEL` add or + // remove) and an env-only effort edit surfaces as exactly one + // `effort_level` entry rather than a duplicate under `env.`. + env: { + let mut env = descriptor.env.clone(); + env.remove(EFFORT_LEVEL_ENV_VAR); + env + }, + relay_url: relay_url.to_string(), + team_instructions: team_instructions.map(str::to_string), + system_prompt: system_prompt.map(str::to_string), + model: model.map(str::to_string), + provider: provider.map(str::to_string), + session_title: (!descriptor.env.contains_key(SESSION_TITLE_ENV_VAR)) + .then(|| resolve_session_title(record.display_name.as_deref(), &record.name)) + .flatten(), + auth_tag: record.auth_tag.clone(), + respond_to: respond_to.as_str().to_string(), + respond_to_allowlist: (respond_to == super::types::RespondTo::Allowlist).then(|| { + // A list spawn would reject is captured raw: the stamped + // snapshot comes from a successful spawn, so any invalid + // edit correctly compares unequal. + super::types::validate_respond_to_allowlist(&respond_to_allowlist) + .unwrap_or(respond_to_allowlist) + }), + idle_timeout_seconds: record.idle_timeout_seconds, + max_turn_duration_seconds: record.max_turn_duration_seconds, + // Hash the effective parallelism so over-cap edits that don't change + // the running pool size (e.g. 10 → 8, both clamp to 5 on OpenClaw) + // do not raise a spurious "restart required" badge. Cap crossings + // (e.g. 8 → 3, where 3 is below the cap) do change the effective + // pool and must badge. The diff surface consequently displays the + // effective value — that is correct, it is what actually runs. + parallelism: super::effective_parallelism(&descriptor.command, record.parallelism), + // Sole effort representation — see the field doc and the `env` + // strip above. Resolver reads the record's canonical value and the + // raw descriptor env (before the strip), so a user-seeded env value + // is preserved as the effective effort when no canonical is set. + effort_level: effective_effort(record, &descriptor.env), + } + } + + /// Canonical JSON projection — the single representation both the drift + /// comparison and the diff walk read, so a lit badge always has a + /// non-empty diff and vice versa. + /// + /// Infallible by the serialization invariants documented on the struct + /// (plain derive over strings, scalars, string maps, and string vectors); + /// a failure here is a broken invariant, never a runtime condition, so it + /// must not degrade into an empty diff. + pub(crate) fn canonical(&self) -> serde_json::Value { + serde_json::to_value(self).expect("SpawnConfigSnapshot serializes infallibly") + } +} + +impl std::fmt::Debug for SpawnConfigSnapshot { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + write!( + f, + "SpawnConfigSnapshot({})", + diff::redacted_canonical(&self.canonical()) + ) + } +} + +/// Snapshot the effective spawn configuration `record` would get if it were +/// started right now under the current `personas`/`teams`/`global`, resolving +/// a blank record relay against `workspace_relay`. +/// +/// Pure — no `AppHandle`, no disk, no keyring. This is the *prospective* side +/// of the comparison; the stamped side is built at spawn from the values that +/// actually fed the child's `Command`. +pub(crate) fn prospective_spawn_config_snapshot( + record: &ManagedAgentRecord, + personas: &[AgentDefinition], + teams: &[TeamRecord], + workspace_relay: &str, + global: &GlobalAgentConfig, + enforced_owner_only: bool, +) -> SpawnConfigSnapshot { + // Prospective re-snapshot: apply the same `apply_persona_snapshot` the + // start/restore paths run right before spawning, so this describes what a + // restart would actually run. Idempotent, so a spawn-time stamp taken + // after those paths saved the record compares equal when nothing changed. + // The persona env itself arrives through the descriptor's layered env + // below; `persona_source_version` is set on the clone but is not an input. + let record = preview_prospective_persona_snapshot(record, personas); + let record = &record; + + // Resolve command, args, and env via the single typed descriptor — same + // path as spawn_agent_child. Dangling harness id falls back to the + // infallible record_agent_command (no-op: a dangling harness can't be + // spawned, so the snapshot never matters for that agent). + let descriptor = + crate::managed_agents::resolve_effective_harness_descriptor(record, personas, global) + .unwrap_or_else(|_| { + let command = crate::managed_agents::record_agent_command(record, personas); + let args = normalize_agent_args(&command, record.agent_args.clone()); + EffectiveHarnessDescriptor { + command, + args, + env: Default::default(), + } + }); + + // Prompt, model, and provider all come from ONE `resolve_effective_config` + // call — the SAME resolve `spawn_agent_child` performs for the env write, + // so env write and this badge cannot disagree. An orphaned link (missing + // definition) resolves as if all three were absent: `spawn_agent_child` + // refuses to spawn an orphan regardless, and `eligible_restart_diff` + // suppresses the badge for one. + let (prompt, model, provider) = match resolve_effective_config(record, personas, global) { + EffectiveConfigResult::Resolved(cfg) => { + (cfg.system_prompt.value, cfg.model.value, cfg.provider.value) + } + EffectiveConfigResult::OrphanedInstance { .. } => (None, None, None), + }; + + SpawnConfigSnapshot::from_inputs(SpawnConfigInputs { + record, + descriptor: &descriptor, + // Resolved, not stored: every record spawns on the workspace relay + // (legacy pins ignored), so a workspace relay change must badge. + relay_url: &crate::relay::effective_agent_relay_url(&record.relay_url, workspace_relay), + team_instructions: effective_team_instructions(record, teams).as_deref(), + system_prompt: prompt.as_deref(), + model: model.as_deref(), + provider: provider.as_deref(), + enforced_owner_only, + }) +} + +#[cfg(test)] +mod tests; diff --git a/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff.rs b/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff.rs new file mode 100644 index 00000000000..0ae3009bae3 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff.rs @@ -0,0 +1,308 @@ +//! Redacted field-by-field diff of two [`SpawnConfigSnapshot`]s. +//! +//! The walk is generic over the snapshot's canonical JSON: it compares leaves +//! by path and emits one entry per inequality. Adding a field to +//! [`SpawnConfigSnapshot`] therefore reaches the UI with no change here — the +//! only per-path knowledge in this module is [`policy_for`], which decides how +//! a leaf may be *shown*, never which leaves are compared. +//! +//! Raw values drive comparison; redaction happens strictly afterwards, when +//! the serializable entry is built. Comparing masked forms would let two +//! secrets with colliding suffixes read as "no drift". + +use serde::Serialize; +use serde_json::{Map, Value}; + +use super::SpawnConfigSnapshot; +use crate::managed_agents::AcpAvailabilityStatus; + +/// Synthetic field id for adapter-availability drift, which lives outside the +/// snapshot: it describes the environment around the process, not the config +/// the process was spawned with. +const ADAPTER_AVAILABILITY_FIELD: &str = "adapter_availability"; + +const MASK: &str = "••••"; + +/// One changed field. `field` is a dotted path built from serde field names, +/// with dynamic map keys appended verbatim (`env.OPENAI_API_KEY`). The UI +/// humanizes it generically and must never switch on its value. +#[derive(Debug, Clone, PartialEq, Serialize)] +pub struct RestartDiffEntry { + pub field: String, + pub change: RestartChange, +} + +/// How a changed field is presented. The UI switches on `kind` — a closed set +/// — and renders any `field` path. +#[derive(Debug, Clone, PartialEq, Serialize)] +#[serde(tag = "kind", rename_all = "snake_case")] +pub enum RestartChange { + /// Safe scalar or array shown verbatim. `null` means absent. + Value { before: Value, after: Value }, + /// Large text shown as character counts only. `null` means absent. + Text { + before_chars: Option, + after_chars: Option, + }, + /// Secret-bearing leaf. `null` means absent. + Masked { + before: Option, + after: Option, + }, + /// Dynamic-map key present only on the new side. No payload — the value + /// would be secret-bearing and the key name alone is the useful signal. + Added, + /// Dynamic-map key present only on the old side. + Removed, +} + +/// How a leaf at `path` may be displayed. +#[derive(Clone, Copy, PartialEq)] +enum MaskPolicy { + /// Shown verbatim. + Plain, + /// Character counts only. + Text, + /// `••••` plus the last four characters when longer than eight. + MaskedSuffix, + /// `••••` and nothing else. + MaskedBare, +} + +/// The single redaction authority: the wire diff and the snapshot's `Debug` +/// both route every leaf through this. +/// +/// A new snapshot field needs an arm here only if it can carry a credential or +/// is too large to render; everything else falls through to `Plain`. +fn policy_for(path: &str) -> MaskPolicy { + match path { + // Arbitrary user text — a rendered before/after would be unbounded as + // well as unreadable. + "system_prompt" | "team_instructions" => MaskPolicy::Text, + // Arbitrary CLI arguments: `--token=...` is legal, so no part of the + // value may be disclosed. Same for the relay URL — `normalize_relay_url` + // rejects userinfo but deliberately preserves query strings, so + // `wss://relay.example/ws?token=...` is a valid value. + "args" | "relay_url" => MaskPolicy::MaskedBare, + // NIP-OA auth tag: a credential, but a suffix tells the user which tag + // they are looking at. + "auth_tag" => MaskPolicy::MaskedSuffix, + // Env values: consult the shared allowlist. Allowlisted keys (e.g. + // `BUZZ_AGENT_THINKING_EFFORT`) render plain so the user sees the + // actual enum values; every other env key stays masked. + _ if path.starts_with("env.") => { + let key = &path[4..]; + if crate::managed_agents::is_safe_to_reveal(key) { + MaskPolicy::Plain + } else { + MaskPolicy::MaskedSuffix + } + } + // Plain arm. Every path reaching it is already rendered verbatim in + // the runtime UI today: + // acp_command / command / mcp_command — resolved binary names + // session_title — display chrome + // model / provider — catalog ids + // effort_level — non-secret effort enum + // respond_to / respond_to_allowlist — gate mode + pubkeys + // idle_timeout_seconds / max_turn_duration_seconds / parallelism + // — numeric limits + // adapter_availability — an enum variant name + _ => MaskPolicy::Plain, + } +} + +/// `••••` plus the last four characters, or a bare `••••` when the value is +/// short enough that a suffix would disclose too much of it. +/// +/// Character-based throughout: byte slicing can panic on a multi-byte value or +/// disclose the wrong suffix. +fn mask(value: &str) -> String { + let chars: Vec = value.chars().collect(); + match chars.len() { + len if len > 8 => format!("{MASK}{}", chars[len - 4..].iter().collect::()), + _ => MASK.to_string(), + } +} + +/// Character count of a text leaf; `None` when the leaf is absent. +fn char_count(value: &Value) -> Option { + match value { + Value::Null => None, + Value::String(text) => Some(text.chars().count()), + // Fail closed on an unexpected shape: count it, never show it. + other => Some(other.to_string().chars().count()), + } +} + +/// Masked rendering of a leaf; `None` when the leaf is absent. +fn masked(policy: MaskPolicy, value: &Value) -> Option { + match (policy, value) { + (_, Value::Null) => None, + (MaskPolicy::MaskedSuffix, Value::String(text)) => Some(mask(text)), + // Fail closed: an unexpected shape under a redacting policy still + // redacts rather than disclosing the raw value. + _ => Some(MASK.to_string()), + } +} + +fn change_for(policy: MaskPolicy, before: &Value, after: &Value) -> RestartChange { + match policy { + MaskPolicy::Plain => RestartChange::Value { + before: before.clone(), + after: after.clone(), + }, + MaskPolicy::Text => RestartChange::Text { + before_chars: char_count(before), + after_chars: char_count(after), + }, + MaskPolicy::MaskedSuffix | MaskPolicy::MaskedBare => RestartChange::Masked { + before: masked(policy, before), + after: masked(policy, after), + }, + } +} + +/// Lexicographically sorted union of both maps' keys, so entry order — and +/// therefore the UI's "first N plus and-N-more" truncation — is stable. +fn key_union<'a>(before: &'a Map, after: &'a Map) -> Vec<&'a str> { + let mut keys: Vec<&str> = before + .keys() + .chain(after.keys()) + .map(String::as_str) + .collect(); + keys.sort_unstable(); + keys.dedup(); + keys +} + +fn child_path(parent: &str, key: &str) -> String { + if parent.is_empty() { + key.to_string() + } else { + format!("{parent}.{key}") + } +} + +fn walk( + path: &str, + before: Option<&Value>, + after: Option<&Value>, + out: &mut Vec, +) { + match (before, after) { + (before, after) if before == after => {} + // Present on one side only. Struct fields are always present (`None` + // serializes as `null`), so this is dynamic-map membership. + (None, Some(_)) => out.push(RestartDiffEntry { + field: path.to_string(), + change: RestartChange::Added, + }), + (Some(_), None) => out.push(RestartDiffEntry { + field: path.to_string(), + change: RestartChange::Removed, + }), + (Some(Value::Object(before)), Some(Value::Object(after))) => { + for key in key_union(before, after) { + walk(&child_path(path, key), before.get(key), after.get(key), out); + } + } + // Everything else is a leaf: scalars, and arrays (atomic — `args` + // changed as a whole, never `args.0`). + (before, after) => out.push(RestartDiffEntry { + field: path.to_string(), + change: change_for( + policy_for(path), + before.unwrap_or(&Value::Null), + after.unwrap_or(&Value::Null), + ), + }), + } +} + +/// The redacted diff of two snapshots, in stable path order. +fn diff(before: &SpawnConfigSnapshot, after: &SpawnConfigSnapshot) -> Vec { + let mut entries = Vec::new(); + walk( + "", + Some(&before.canonical()), + Some(&after.canonical()), + &mut entries, + ); + entries +} + +fn availability_value(status: Option<&AcpAvailabilityStatus>) -> Value { + status + .and_then(|status| serde_json::to_value(status).ok()) + .unwrap_or(Value::Null) +} + +/// What a tracked runtime was launched with, paired with what a launch would +/// use now. Absent (`None` at the call site) for every agent this workspace +/// tracks no live pair for — stopped, or `runtime_pid`-adopted across an app +/// restart, whose spawn config was never stamped and so can never be shown to +/// have drifted. +pub(crate) struct TrackedSpawnState<'a> { + pub stamped: &'a SpawnConfigSnapshot, + pub current: &'a SpawnConfigSnapshot, + pub stamped_availability: Option<&'a AcpAvailabilityStatus>, + pub current_availability: Option, +} + +/// The final restart-diff for one agent — the single source of both the wire +/// field and the badge, which is `!result.is_empty()`. +/// +/// Empty for an un-stamped agent (see [`TrackedSpawnState`]) and for an +/// orphaned instance: `spawn_agent_child` refuses to spawn an orphan before +/// any side effect, so "Restart required" would offer an action guaranteed to +/// fail. The UI surfaces `persona_orphaned` instead. +pub(crate) fn eligible_restart_diff( + persona_orphaned: bool, + tracked: Option>, +) -> Vec { + let Some(tracked) = tracked.filter(|_| !persona_orphaned) else { + return Vec::new(); + }; + let mut entries = diff(tracked.stamped, tracked.current); + if crate::managed_agents::availability_drift( + tracked.stamped_availability, + tracked.current_availability.clone(), + ) { + entries.push(RestartDiffEntry { + field: ADAPTER_AVAILABILITY_FIELD.to_string(), + change: RestartChange::Value { + before: availability_value(tracked.stamped_availability), + after: availability_value(tracked.current_availability.as_ref()), + }, + }); + } + entries +} + +/// The canonical snapshot with every leaf passed through [`policy_for`], +/// rendered as JSON text. Backs `SpawnConfigSnapshot`'s manual `Debug` so a +/// log line can never disclose what the wire diff redacts. +pub(crate) fn redacted_canonical(value: &Value) -> String { + fn redact(path: &str, value: &Value) -> Value { + match value { + Value::Object(fields) => Value::Object( + fields + .iter() + .map(|(key, child)| (key.clone(), redact(&child_path(path, key), child))) + .collect(), + ), + leaf => match policy_for(path) { + MaskPolicy::Plain => leaf.clone(), + MaskPolicy::Text => char_count(leaf).map_or(Value::Null, |count| { + Value::String(format!("<{count} chars>")) + }), + policy => masked(policy, leaf).map_or(Value::Null, Value::String), + }, + } + } + redact("", value).to_string() +} + +#[cfg(test)] +mod tests; diff --git a/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff/tests.rs b/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff/tests.rs new file mode 100644 index 00000000000..e21dc4735c7 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/spawn_snapshot/diff/tests.rs @@ -0,0 +1,608 @@ +use super::*; +use std::collections::{BTreeMap, BTreeSet}; + +const SECRET: &str = "sk-live-SENTINEL-0000"; +const RELAY_WITH_TOKEN: &str = "wss://relay.example/ws?token=SENTINEL"; + +/// Every field populated, so mutating one to `None` is a real change and the +/// coverage guard below sees the full serialized key set. +fn base() -> SpawnConfigSnapshot { + SpawnConfigSnapshot { + acp_command: "buzz-acp".into(), + command: "goose".into(), + args: vec!["--mode".into(), "acp".into()], + mcp_command: "goose-mcp".into(), + env: BTreeMap::from([ + ("OPENAI_API_KEY".to_string(), SECRET.to_string()), + ("BUZZ_LOG".to_string(), "info".to_string()), + ]), + relay_url: "wss://relay.example".into(), + team_instructions: Some("Team says hello.".into()), + system_prompt: Some("You are a test agent.".into()), + model: Some("gpt-5".into()), + provider: Some("openai".into()), + session_title: Some("Fizz".into()), + auth_tag: Some("tag-abcdefgh".into()), + respond_to: "owner-only".into(), + respond_to_allowlist: Some(vec!["a".repeat(64)]), + idle_timeout_seconds: Some(600), + max_turn_duration_seconds: Some(7200), + parallelism: 1, + effort_level: Some("high".into()), + } +} + +fn fields(entries: &[RestartDiffEntry]) -> Vec<&str> { + entries.iter().map(|entry| entry.field.as_str()).collect() +} + +fn change_at<'a>(entries: &'a [RestartDiffEntry], field: &str) -> &'a RestartChange { + &entries + .iter() + .find(|entry| entry.field == field) + .unwrap_or_else(|| panic!("no entry for {field}; got {:?}", fields(entries))) + .change +} + +/// One mutation per snapshot field, keyed by the diff path it must produce. +type Mutation = (&'static str, fn(&mut SpawnConfigSnapshot)); + +fn mutations() -> Vec { + vec![ + ("acp_command", |s| s.acp_command = "other-acp".into()), + ("command", |s| s.command = "claude".into()), + ("args", |s| s.args = vec!["--other".into()]), + ("mcp_command", |s| s.mcp_command = String::new()), + ("env.OPENAI_API_KEY", |s| { + s.env + .insert("OPENAI_API_KEY".into(), "sk-live-rotated-9999".into()); + }), + ("relay_url", |s| s.relay_url = "wss://other.example".into()), + ("team_instructions", |s| s.team_instructions = None), + ("system_prompt", |s| s.system_prompt = None), + ("model", |s| s.model = None), + ("provider", |s| s.provider = None), + ("session_title", |s| s.session_title = None), + ("auth_tag", |s| s.auth_tag = None), + ("respond_to", |s| s.respond_to = "anyone".into()), + ("respond_to_allowlist", |s| s.respond_to_allowlist = None), + ("idle_timeout_seconds", |s| s.idle_timeout_seconds = None), + ("max_turn_duration_seconds", |s| { + s.max_turn_duration_seconds = None + }), + ("parallelism", |s| s.parallelism = 8), + ("effort_level", |s| s.effort_level = None), + ] +} + +#[test] +fn every_field_mutation_drifts_the_canonical_value_and_names_that_field() { + for (field, mutate) in mutations() { + let before = base(); + let mut after = base(); + mutate(&mut after); + + assert_ne!( + before.canonical(), + after.canonical(), + "{field}: mutation must move the canonical value the badge compares" + ); + assert_eq!( + fields(&diff(&before, &after)), + vec![field], + "{field}: mutation must produce exactly that field's entry" + ); + // Both directions: `None -> Some` must be as visible as `Some -> None`. + assert_eq!( + fields(&diff(&after, &before)), + vec![field], + "{field}: reverse mutation must be equally visible" + ); + } +} + +#[test] +fn mutation_table_covers_every_serialized_field() { + let covered: BTreeSet<&str> = mutations() + .iter() + .map(|(field, _)| field.split('.').next().expect("non-empty path")) + .collect(); + let canonical = base().canonical(); + let serialized: BTreeSet<&str> = canonical + .as_object() + .expect("snapshot serializes as an object") + .keys() + .map(String::as_str) + .collect(); + assert_eq!( + covered, serialized, + "add a mutation row for every new snapshot field" + ); +} + +#[test] +fn identical_snapshots_produce_no_entries() { + assert!(diff(&base(), &base()).is_empty()); +} + +#[test] +fn env_map_insertion_order_is_not_drift() { + let mut reordered = base(); + reordered.env = base().env.into_iter().rev().collect(); + assert!(diff(&base(), &reordered).is_empty()); +} + +#[test] +fn entries_are_ordered_lexicographically_by_path() { + let mut after = base(); + after.parallelism = 4; + after.command = "claude".into(); + after.env.insert("ZZZ".into(), "1".into()); + after.env.insert("AAA".into(), "1".into()); + assert_eq!( + fields(&diff(&base(), &after)), + vec!["command", "env.AAA", "env.ZZZ", "parallelism"] + ); +} + +// ── map membership vs. nullable struct fields ──────────────────────────── + +#[test] +fn env_key_insertion_is_added_without_a_payload() { + let mut after = base(); + after.env.insert("NEW_KEY".into(), SECRET.into()); + assert_eq!( + change_at(&diff(&base(), &after), "env.NEW_KEY"), + &RestartChange::Added + ); +} + +#[test] +fn env_key_removal_is_removed_without_a_payload() { + let mut after = base(); + after.env.remove("BUZZ_LOG"); + assert_eq!( + change_at(&diff(&base(), &after), "env.BUZZ_LOG"), + &RestartChange::Removed + ); +} + +#[test] +fn cleared_nullable_field_stays_a_value_change_not_a_removal() { + let mut after = base(); + after.model = None; + assert_eq!( + change_at(&diff(&base(), &after), "model"), + &RestartChange::Value { + before: Value::String("gpt-5".into()), + after: Value::Null, + } + ); +} + +#[test] +fn array_field_changes_as_one_atomic_leaf() { + let mut after = base(); + after.respond_to_allowlist = Some(vec!["b".repeat(64)]); + let entries = diff(&base(), &after); + assert_eq!(fields(&entries), vec!["respond_to_allowlist"]); + assert!(matches!( + change_at(&entries, "respond_to_allowlist"), + RestartChange::Value { .. } + )); +} + +#[test] +fn allowlisted_env_key_shows_plain_value() { + // BUZZ_AGENT_THINKING_EFFORT is on the safe-to-reveal allowlist — the user + // must be able to see actual enum values like "medium → high". + let mut before = base(); + before + .env + .insert("BUZZ_AGENT_THINKING_EFFORT".into(), "medium".into()); + let mut after = before.clone(); + after + .env + .insert("BUZZ_AGENT_THINKING_EFFORT".into(), "high".into()); + assert_eq!( + change_at(&diff(&before, &after), "env.BUZZ_AGENT_THINKING_EFFORT"), + &RestartChange::Value { + before: Value::String("medium".into()), + after: Value::String("high".into()), + }, + "allowlisted env key must render plain before/after values" + ); +} + +#[test] +fn allowlisted_env_key_is_case_insensitive() { + // The allowlist comparison is case-insensitive; lowercase path must also + // render plain. + let mut before = base(); + before + .env + .insert("buzz_agent_provider".into(), "anthropic".into()); + let mut after = before.clone(); + after + .env + .insert("buzz_agent_provider".into(), "openai".into()); + assert_eq!( + change_at(&diff(&before, &after), "env.buzz_agent_provider"), + &RestartChange::Value { + before: Value::String("anthropic".into()), + after: Value::String("openai".into()), + }, + "allowlist match must be case-insensitive" + ); +} + +#[test] +fn non_allowlisted_env_key_stays_masked() { + // A key not in the allowlist must remain masked regardless of its name. + let mut after = base(); + after + .env + .insert("SOME_API_KEY".into(), "sk-live-rotated-9999".into()); + // SOME_API_KEY is a new key — starts as Added, not a value change. + // Use an existing env key (OPENAI_API_KEY is in base()) to test masking. + let mut before = base(); + before + .env + .insert("OPENAI_API_KEY".into(), "sk-live-SENTINEL-0000".into()); + let mut after2 = before.clone(); + after2 + .env + .insert("OPENAI_API_KEY".into(), "sk-live-rotated-9999".into()); + assert!( + matches!( + change_at(&diff(&before, &after2), "env.OPENAI_API_KEY"), + RestartChange::Masked { .. } + ), + "non-allowlisted env key must stay masked" + ); +} + +// ── masking policy ─────────────────────────────────────────────────────── + +#[test] +fn env_value_longer_than_eight_chars_shows_a_four_char_suffix() { + let mut after = base(); + after + .env + .insert("OPENAI_API_KEY".into(), "abcdefghi".into()); + assert_eq!( + change_at(&diff(&base(), &after), "env.OPENAI_API_KEY"), + &RestartChange::Masked { + before: Some("••••0000".into()), + after: Some("••••fghi".into()), + } + ); +} + +#[test] +fn env_value_of_exactly_eight_chars_shows_no_suffix() { + let mut before = base(); + before + .env + .insert("OPENAI_API_KEY".into(), "abcdefgh".into()); + let mut after = before.clone(); + after.env.insert("OPENAI_API_KEY".into(), "12345678".into()); + assert_eq!( + change_at(&diff(&before, &after), "env.OPENAI_API_KEY"), + &RestartChange::Masked { + before: Some("••••".into()), + after: Some("••••".into()), + } + ); +} + +#[test] +fn masking_counts_characters_not_bytes() { + // Nine two-byte characters: a byte-based length test would call this + // short, and byte slicing the last four would split a code point. + let mut before = base(); + before.env.insert("K".into(), "áéíóúàèìò".into()); + let mut after = before.clone(); + after.env.insert("K".into(), "áéíóúàèìá".into()); + assert_eq!( + change_at(&diff(&before, &after), "env.K"), + &RestartChange::Masked { + before: Some("••••àèìò".into()), + after: Some("••••àèìá".into()), + } + ); +} + +#[test] +fn args_are_masked_without_any_suffix() { + let mut after = base(); + after.args = vec![format!("--token={SECRET}")]; + assert_eq!( + change_at(&diff(&base(), &after), "args"), + &RestartChange::Masked { + before: Some("••••".into()), + after: Some("••••".into()), + } + ); +} + +#[test] +fn relay_url_is_masked_without_any_suffix() { + let mut after = base(); + after.relay_url = RELAY_WITH_TOKEN.into(); + assert_eq!( + change_at(&diff(&base(), &after), "relay_url"), + &RestartChange::Masked { + before: Some("••••".into()), + after: Some("••••".into()), + } + ); +} + +#[test] +fn auth_tag_is_masked_with_a_suffix() { + let mut after = base(); + after.auth_tag = Some("tag-ijklmnop".into()); + assert_eq!( + change_at(&diff(&base(), &after), "auth_tag"), + &RestartChange::Masked { + before: Some("••••efgh".into()), + after: Some("••••mnop".into()), + } + ); +} + +#[test] +fn large_text_fields_report_character_counts_only() { + let mut after = base(); + after.system_prompt = Some("Longer replacement prompt.".into()); + after.team_instructions = None; + let entries = diff(&base(), &after); + assert_eq!( + change_at(&entries, "system_prompt"), + &RestartChange::Text { + before_chars: Some("You are a test agent.".chars().count()), + after_chars: Some("Longer replacement prompt.".chars().count()), + } + ); + assert_eq!( + change_at(&entries, "team_instructions"), + &RestartChange::Text { + before_chars: Some("Team says hello.".chars().count()), + after_chars: None, + } + ); +} + +// ── secrecy sentinels ──────────────────────────────────────────────────── + +/// A snapshot whose every secret-bearing leaf carries a sentinel. +fn seeded_with_sentinels() -> SpawnConfigSnapshot { + let mut snapshot = base(); + snapshot.relay_url = RELAY_WITH_TOKEN.into(); + snapshot.args = vec![format!("--token={SECRET}")]; + snapshot.auth_tag = Some(SECRET.into()); + snapshot.env.insert("OPENAI_API_KEY".into(), SECRET.into()); + snapshot +} + +/// Every sentinel-bearing leaf changed, plus an added key, so each masking +/// arm has to redact a real value. +fn rotated_sentinels() -> SpawnConfigSnapshot { + let mut snapshot = seeded_with_sentinels(); + snapshot.relay_url = format!("{RELAY_WITH_TOKEN}2"); + snapshot.args = vec![format!("--token={SECRET}2")]; + snapshot.auth_tag = Some(format!("{SECRET}2")); + snapshot + .env + .insert("OPENAI_API_KEY".into(), format!("{SECRET}2")); + snapshot.env.insert("ADDED".into(), SECRET.into()); + snapshot +} + +#[test] +fn no_sentinel_reaches_the_serialized_diff() { + let entries = diff(&seeded_with_sentinels(), &rotated_sentinels()); + assert!(!entries.is_empty(), "fixture must actually drift"); + let wire = serde_json::to_string(&entries).expect("diff serializes"); + assert!(!wire.contains("SENTINEL"), "diff leaked a secret: {wire}"); + assert!( + !wire.contains("token="), + "diff leaked a query token: {wire}" + ); +} + +#[test] +fn no_sentinel_reaches_snapshot_debug_output() { + let rendered = format!("{:?}", seeded_with_sentinels()); + assert!(!rendered.contains("SENTINEL"), "Debug leaked: {rendered}"); + assert!(!rendered.contains("token="), "Debug leaked: {rendered}"); + // Large text is summarized rather than dumped. + assert!(!rendered.contains("You are a test agent.")); + // Non-secret leaves stay legible, or the log line is useless. + assert!(rendered.contains("goose")); +} + +#[test] +fn no_sentinel_reaches_the_owning_process_debug_output() { + // `ManagedAgentProcess` derives `Debug` and delegates to the snapshot's + // manual impl — this pins that the derive can never become the leak path. + #[cfg(unix)] + let program = "/usr/bin/true"; + #[cfg(windows)] + let program = "true"; + let child = std::process::Command::new(program) + .stdin(std::process::Stdio::null()) + .stdout(std::process::Stdio::null()) + .stderr(std::process::Stdio::null()) + .spawn() + .expect("spawn placeholder child"); + let process = crate::managed_agents::ManagedAgentProcess { + child, + log_path: std::path::PathBuf::new(), + spawn_config: seeded_with_sentinels(), + setup_mode: false, + adapter_availability: None, + start_nonce: "test-nonce".to_string(), + #[cfg(windows)] + job: None, + }; + let rendered = format!("{process:?}"); + assert!( + !rendered.contains("SENTINEL"), + "process Debug leaked a secret" + ); + assert!( + !rendered.contains("token="), + "process Debug leaked a query token" + ); +} + +// ── B1: the eligible vector is the single source of the badge ──────────── + +fn eligible( + orphaned: bool, + stamped: &SpawnConfigSnapshot, + current: &SpawnConfigSnapshot, + stamped_availability: Option, + current_availability: Option, +) -> (bool, Vec) { + let entries = eligible_restart_diff( + orphaned, + Some(TrackedSpawnState { + stamped, + current, + stamped_availability: stamped_availability.as_ref(), + current_availability, + }), + ); + (!entries.is_empty(), entries) +} + +#[test] +fn no_drift_yields_no_badge_and_no_entries() { + let (needs_restart, entries) = eligible(false, &base(), &base(), None, None); + assert!(!needs_restart); + assert!(entries.is_empty()); +} + +#[test] +fn snapshot_drift_yields_a_badge_and_that_entry() { + let mut current = base(); + current.model = Some("claude-4".into()); + let (needs_restart, entries) = eligible(false, &base(), ¤t, None, None); + assert!(needs_restart); + assert_eq!(fields(&entries), vec!["model"]); +} + +#[test] +fn availability_drift_alone_yields_a_badge_and_its_synthetic_entry() { + let (needs_restart, entries) = eligible( + false, + &base(), + &base(), + Some(AcpAvailabilityStatus::Available), + Some(AcpAvailabilityStatus::AdapterOutdated), + ); + assert!(needs_restart); + assert_eq!(fields(&entries), vec!["adapter_availability"]); + assert_eq!( + change_at(&entries, "adapter_availability"), + &RestartChange::Value { + before: Value::String("available".into()), + after: Value::String("adapter_outdated".into()), + } + ); +} + +#[test] +fn orphan_with_snapshot_drift_yields_no_badge_and_no_entries() { + let mut current = base(); + current.model = Some("claude-4".into()); + let (needs_restart, entries) = eligible(true, &base(), ¤t, None, None); + assert!(!needs_restart); + assert!(entries.is_empty()); +} + +#[test] +fn orphan_with_availability_drift_yields_no_badge_and_no_entries() { + let (needs_restart, entries) = eligible( + true, + &base(), + &base(), + Some(AcpAvailabilityStatus::Available), + Some(AcpAvailabilityStatus::AdapterOutdated), + ); + assert!(!needs_restart); + assert!(entries.is_empty()); +} + +#[test] +fn unstamped_availability_is_not_drift() { + // A runtime without a version gate stamps no availability; comparing that + // absence against a freshly cached value must not invent a badge. + let (needs_restart, entries) = eligible( + false, + &base(), + &base(), + None, + Some(AcpAvailabilityStatus::AdapterOutdated), + ); + assert!(!needs_restart); + assert!(entries.is_empty()); +} + +#[test] +fn unstamped_agent_yields_no_badge_and_no_entries() { + // A `runtime_pid`-adopted process — and any agent this workspace tracks no + // live pair for — has no `ManagedAgentProcess`, so no spawn config was ever + // stamped. With nothing to compare against there is no drift to report, and + // the badge derives from that emptiness. Distinct from the case above, + // where a real pair IS tracked and only its availability stamp is absent. + for orphaned in [false, true] { + let entries = eligible_restart_diff(orphaned, None); + let needs_restart = !entries.is_empty(); + assert!( + entries.is_empty(), + "unstamped agent (orphaned={orphaned}) must report no changed fields" + ); + assert!( + !needs_restart, + "unstamped agent (orphaned={orphaned}) must not light the badge" + ); + } +} + +// ── B5 effort lifecycle: restart-diff and re-stamp ─────────────────────── + +#[test] +fn tracked_running_old_effort_edited_to_new_yields_effort_level_diff() { + // A process was stamped at effort `high`; the record's canonical effort is + // later edited to `low`. Until a restart re-stamps, the tracked pair must + // light the badge and name exactly `effort_level`. + let stamped = base(); // effort_level = high + let mut current = base(); + current.effort_level = Some("low".into()); + let (needs_restart, entries) = eligible(false, &stamped, ¤t, None, None); + assert!(needs_restart); + assert_eq!(fields(&entries), vec!["effort_level"]); + assert_eq!( + change_at(&entries, "effort_level"), + &RestartChange::Value { + before: Value::String("high".into()), + after: Value::String("low".into()), + } + ); +} + +#[test] +fn restart_restamps_effort_and_clears_the_badge() { + // After the edit above, a restart stamps the new effort, so stamped and + // current agree again: the badge clears and no entry remains. + let mut restamped = base(); + restamped.effort_level = Some("low".into()); + let current = restamped.clone(); + let (needs_restart, entries) = eligible(false, &restamped, ¤t, None, None); + assert!(!needs_restart); + assert!(entries.is_empty()); +} diff --git a/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs b/desktop/src-tauri/src/managed_agents/spawn_snapshot/tests.rs similarity index 57% rename from desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs rename to desktop/src-tauri/src/managed_agents/spawn_snapshot/tests.rs index f4ad4048143..b007e0b2ffa 100644 --- a/desktop/src-tauri/src/managed_agents/spawn_hash/tests.rs +++ b/desktop/src-tauri/src/managed_agents/spawn_snapshot/tests.rs @@ -2,6 +2,44 @@ use super::*; use crate::managed_agents::types::RespondTo; use std::collections::BTreeMap; +/// Canonical projection of a prospective snapshot — the exact value the drift +/// comparison reads, so these tests assert on drift itself rather than on a +/// proxy for it. +fn snapshot_with_policy( + record: &ManagedAgentRecord, + personas: &[AgentDefinition], + teams: &[TeamRecord], + workspace_relay: &str, + global: &GlobalAgentConfig, + enforced_owner_only: bool, +) -> serde_json::Value { + prospective_spawn_config_snapshot( + record, + personas, + teams, + workspace_relay, + global, + enforced_owner_only, + ) + .canonical() +} + +fn snapshot( + record: &ManagedAgentRecord, + personas: &[AgentDefinition], + teams: &[TeamRecord], + workspace_relay: &str, + global: &GlobalAgentConfig, +) -> serde_json::Value { + snapshot_with_policy(record, personas, teams, workspace_relay, global, false) +} + +/// `snapshot` with the fixed no-persona/no-team/default-global shape the effort +/// tests share, so their call sites read as `snap(&record)` instead of wrapping. +fn snap(record: &ManagedAgentRecord) -> serde_json::Value { + snapshot(record, &[], &[], "wss://ws.example", &Default::default()) +} + fn record() -> ManagedAgentRecord { ManagedAgentRecord { pubkey: "p".repeat(64), @@ -30,6 +68,7 @@ fn record() -> ManagedAgentRecord { runtime_pid: None, backend: Default::default(), backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -57,6 +96,7 @@ fn record() -> ManagedAgentRecord { definition_respond_to_allowlist: Vec::new(), definition_parallelism: None, relay_mesh: None, + effort_level: None, } } @@ -86,22 +126,22 @@ fn persona(id: &str, runtime: Option<&str>, prompt: &str) -> AgentDefinition { } #[test] -fn hash_is_deterministic() { +fn snapshot_is_deterministic() { let rec = record(); assert_eq!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn materializing_runtime_keeps_hash_stable() { +fn materializing_runtime_keeps_snapshot_stable() { // Migration cutover invariant (Phase 1A): materializing the linked - // persona's runtime onto the record must NOT change the spawn hash — + // persona's runtime onto the record must NOT change the spawn snapshot — // otherwise every running persona-linked agent would show a spurious // restart badge right after migration. Pre-migration the command resolves // through the persona fallback; post-migration through record.runtime. - // Same persona, same runtime, same command → same hash. + // Same persona, same runtime, same command → equal snapshots. let personas = vec![persona("p1", Some("goose"), "Persona prompt.")]; let mut pre = record(); @@ -111,14 +151,14 @@ fn materializing_runtime_keeps_hash_stable() { post.runtime = Some("goose".into()); assert_eq!( - spawn_config_hash( + snapshot( &pre, &personas, &[], "wss://ws.example", &Default::default() ), - spawn_config_hash( + snapshot( &post, &personas, &[], @@ -129,31 +169,31 @@ fn materializing_runtime_keeps_hash_stable() { } #[test] -fn record_env_var_edit_changes_hash() { +fn record_env_var_edit_changes_snapshot() { let rec = record(); let mut edited = record(); edited .env_vars .insert("SOME_KEY".into(), "some-value".into()); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn record_prompt_edit_changes_hash() { +fn record_prompt_edit_changes_snapshot() { let rec = record(); let mut edited = record(); edited.system_prompt = Some("Edited prompt.".into()); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn persona_runtime_edit_changes_hash() { +fn persona_runtime_edit_changes_snapshot() { // The harness command resolves live personas at spawn, so a persona // runtime change means a restart WOULD change what runs → badge trips. let mut rec = record(); @@ -161,13 +201,13 @@ fn persona_runtime_edit_changes_hash() { let before = [persona("pers", Some("goose"), "prompt")]; let after = [persona("pers", Some("claude"), "prompt")]; assert_ne!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()) ); } #[test] -fn persona_prompt_edit_changes_hash() { +fn persona_prompt_edit_changes_snapshot() { // Start/restore re-snapshot the persona prompt onto the record right // before spawning, so a persona prompt edit DOES apply on a plain // restart → the badge must trip. @@ -176,13 +216,13 @@ fn persona_prompt_edit_changes_hash() { let before = [persona("pers", Some("goose"), "old prompt")]; let after = [persona("pers", Some("goose"), "new prompt")]; assert_ne!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()) ); } #[test] -fn workspace_relay_change_trips_hash_even_for_stored_record_relay() { +fn workspace_relay_change_trips_snapshot_even_for_stored_record_relay() { // The legacy per-record relay pin is ignored (#2122): every record spawns // against the active workspace relay, so a workspace relay change means a // restart would change what runs — pinned records included. @@ -192,13 +232,13 @@ fn workspace_relay_change_trips_hash_even_for_stored_record_relay() { "fixture should carry a legacy pin" ); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://relay-a.example", &Default::default()), - spawn_config_hash(&rec, &[], &[], "wss://relay-b.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://relay-a.example", &Default::default()), + snapshot(&rec, &[], &[], "wss://relay-b.example", &Default::default()) ); } #[test] -fn stored_record_relay_does_not_affect_hash() { +fn stored_record_relay_does_not_affect_snapshot() { // Editing the (ignored) stored pin must not badge a restart: what a // restart would run is identical either way. let mut a = record(); @@ -206,20 +246,98 @@ fn stored_record_relay_does_not_affect_hash() { a.relay_url = String::new(); b.relay_url = "wss://legacy-pin.example".into(); assert_eq!( - spawn_config_hash(&a, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&b, &[], &[], "wss://ws.example", &Default::default()) - ); + snapshot(&a, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&b, &[], &[], "wss://ws.example", &Default::default()) + ); +} + +#[test] +fn owner_only_mode_and_allowlist_edits_do_not_change_effective_snapshot() { + let mut before = record(); + before.respond_to = RespondTo::Allowlist; + before.respond_to_allowlist = vec!["a".repeat(64)]; + + let mut mode_edited = before.clone(); + mode_edited.respond_to = RespondTo::Anyone; + + let mut allowlist_edited = before.clone(); + allowlist_edited.respond_to_allowlist = vec!["b".repeat(64)]; + + let effective_before = snapshot_with_policy( + &before, + &[], + &[], + "wss://ws.example", + &Default::default(), + true, + ); + for (label, edited) in [ + ("respond-to mode", mode_edited), + ("respond-to allowlist", allowlist_edited), + ] { + assert_eq!( + effective_before, + snapshot_with_policy( + &edited, + &[], + &[], + "wss://ws.example", + &Default::default(), + true, + ), + "portable {label} edit must not create restart drift when both spawns enforce owner-only", + ); + } } #[test] -fn respond_to_allowlist_edit_changes_hash() { +fn oss_mode_and_allowlist_edits_change_effective_snapshot() { + let mut before = record(); + before.respond_to = RespondTo::Allowlist; + before.respond_to_allowlist = vec!["a".repeat(64)]; + + let mut mode_edited = before.clone(); + mode_edited.respond_to = RespondTo::Anyone; + + let mut allowlist_edited = before.clone(); + allowlist_edited.respond_to_allowlist = vec!["b".repeat(64)]; + + let effective_before = snapshot_with_policy( + &before, + &[], + &[], + "wss://ws.example", + &Default::default(), + false, + ); + for (label, edited) in [ + ("respond-to mode", mode_edited), + ("respond-to allowlist", allowlist_edited), + ] { + assert_ne!( + effective_before, + snapshot_with_policy( + &edited, + &[], + &[], + "wss://ws.example", + &Default::default(), + false, + ), + "OSS spawn must retain restart drift for effective {label} edits", + ); + } +} + +#[test] +fn respond_to_allowlist_edit_changes_snapshot() { let rec = record(); let mut edited = record(); edited.respond_to = RespondTo::Allowlist; edited.respond_to_allowlist = vec!["a".repeat(64)]; assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } @@ -231,13 +349,13 @@ fn allowlist_ignored_when_mode_is_not_allowlist() { let mut edited = record(); edited.respond_to_allowlist = vec!["a".repeat(64)]; assert_eq!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn allowlist_normalization_equivalent_edits_do_not_change_hash() { +fn allowlist_normalization_equivalent_edits_do_not_change_snapshot() { // The env receives the normalized list (trim/lowercase/dedup), so edits // that normalize to the same value must not badge. let mut rec = record(); @@ -249,48 +367,48 @@ fn allowlist_normalization_equivalent_edits_do_not_change_hash() { "a".repeat(64), // duplicate ]; assert_eq!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn allowlist_content_edit_still_changes_hash() { +fn allowlist_content_edit_still_changes_snapshot() { let mut rec = record(); rec.respond_to = RespondTo::Allowlist; rec.respond_to_allowlist = vec!["a".repeat(64)]; let mut edited = rec.clone(); edited.respond_to_allowlist = vec!["b".repeat(64)]; assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn explicit_max_turn_duration_changes_hash_from_none() { +fn explicit_max_turn_duration_changes_snapshot_from_none() { let rec = record(); let mut edited = record(); edited.max_turn_duration_seconds = Some(7200); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn non_default_max_turn_duration_changes_hash() { +fn non_default_max_turn_duration_changes_snapshot() { let rec = record(); let mut edited = record(); edited.max_turn_duration_seconds = Some(42); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] -fn non_spawn_bookkeeping_fields_do_not_change_hash() { +fn non_spawn_bookkeeping_fields_do_not_change_snapshot() { // updated_at / runtime_pid / last_* are lifecycle bookkeeping, not spawn // inputs — routine record saves must not trip the badge. let rec = record(); @@ -300,17 +418,17 @@ fn non_spawn_bookkeeping_fields_do_not_change_hash() { edited.last_started_at = Some("later".into()); edited.last_exit_code = Some(0); assert_eq!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()) + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()) ); } #[test] fn resnapshot_does_not_clobber_record_quad_with_definition_absent_quad() { - // B5 hash row 3: the prospective re-snapshot copies ONLY + // B5 drift row 3: the prospective re-snapshot copies ONLY // prompt/model/provider/env from the linked definition. An instance // whose owner hand-set respond_to/allowlist/parallelism must - // hash identically whether or not its definition carries a quad — + // snapshot identically whether or not its definition carries a quad — // activation of the definition-level defaults must never reach through // spawn and overwrite instance state. let quadless_definition = vec![persona("p1", Some("goose"), "Persona prompt.")]; @@ -326,44 +444,44 @@ fn resnapshot_does_not_clobber_record_quad_with_definition_absent_quad() { definition_with_quad[0].parallelism = Some(8); assert_eq!( - spawn_config_hash( + snapshot( &rec, &quadless_definition, &[], "wss://ws.example", &Default::default() ), - spawn_config_hash( + snapshot( &rec, &definition_with_quad, &[], "wss://ws.example", &Default::default() ), - "definition quad must not leak into the spawn hash of an existing instance" + "definition quad must not leak into the spawn snapshot of an existing instance" ); } #[test] -fn empty_prompt_hashes_like_absent_prompt() { - // B5 hash row 2 foundation: Some("") and None spawn identically (env var - // absent either way), so they must hash equal — a backfilled prompt-less +fn empty_prompt_snapshots_like_absent_prompt() { + // B5 drift row 2 foundation: Some("") and None spawn identically (env var + // absent either way), so they must snapshot equal — a backfilled prompt-less // record re-snapshots to Some("") and must not trip the badge. let mut absent = record(); absent.system_prompt = None; let mut empty = record(); empty.system_prompt = Some(String::new()); assert_eq!( - spawn_config_hash(&absent, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&empty, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&absent, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&empty, &[], &[], "wss://ws.example", &Default::default()), ); } -/// (a) A definition-runtime edit must change spawn_config_hash for a +/// (a) A definition-runtime edit must change the snapshot for a /// materialized, override-free record — the prospective re-snapshot now -/// copies the persona's runtime onto the record before hashing. +/// copies the persona's runtime onto the record before snapshotting. #[test] -fn definition_runtime_edit_changes_hash_for_materialized_record() { +fn definition_runtime_edit_changes_snapshot_for_materialized_record() { let mut rec = record(); rec.persona_id = Some("pers".into()); rec.runtime = Some("goose".into()); // materialized runtime on instance @@ -371,8 +489,8 @@ fn definition_runtime_edit_changes_hash_for_materialized_record() { let before = [persona("pers", Some("goose"), "prompt")]; let after = [persona("pers", Some("claude"), "prompt")]; assert_ne!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()), "definition runtime edit must badge a materialized, override-free instance" ); } @@ -389,8 +507,8 @@ fn known_runtime_pin_yields_to_definition_runtime_change() { let before = [persona("pers", Some("goose"), "prompt")]; let after = [persona("pers", Some("claude"), "prompt")]; assert_ne!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()), "stale known-runtime pin must not shadow a definition runtime edit" ); } @@ -407,16 +525,16 @@ fn custom_command_override_beats_definition_runtime_change() { let before = [persona("pers", Some("goose"), "prompt")]; let after = [persona("pers", Some("claude"), "prompt")]; assert_eq!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()), "custom command override must win regardless of definition runtime change" ); } /// (d) When the linked definition is absent the prospective re-snapshot is -/// skipped entirely: the materialized runtime must still affect the hash. +/// skipped entirely: the materialized runtime must still reach the snapshot. #[test] -fn missing_definition_leaves_materialized_runtime_in_hash() { +fn missing_definition_leaves_materialized_runtime_in_snapshot() { let mut rec = record(); rec.persona_id = Some("missing".into()); rec.runtime = Some("goose".into()); // materialized runtime @@ -427,28 +545,28 @@ fn missing_definition_leaves_materialized_runtime_in_hash() { no_runtime.runtime = None; assert_ne!( - spawn_config_hash( + snapshot( &rec, no_personas, &[], "wss://ws.example", &Default::default() ), - spawn_config_hash( + snapshot( &no_runtime, no_personas, &[], "wss://ws.example", &Default::default() ), - "materialized runtime must still affect hash when definition is absent" + "materialized runtime must still reach the snapshot when definition is absent" ); } -// ── Global default trips hash for linked inherited agents ───────────────── +// ── Global default trips drift for linked inherited agents ─────────────── #[test] -fn global_model_change_trips_hash_for_linked_inherited_agent() { +fn global_model_change_trips_snapshot_for_linked_inherited_agent() { let mut rec = record(); rec.persona_id = Some("p1".into()); rec.model = Some("stale-record-model".into()); @@ -466,17 +584,17 @@ fn global_model_change_trips_hash_for_linked_inherited_agent() { ..Default::default() }; - let hash_a = spawn_config_hash(&rec, &personas, &[], "wss://ws.example", &global_a); - let hash_b = spawn_config_hash(&rec, &personas, &[], "wss://ws.example", &global_b); + let snapshot_a = snapshot(&rec, &personas, &[], "wss://ws.example", &global_a); + let snapshot_b = snapshot(&rec, &personas, &[], "wss://ws.example", &global_b); assert_ne!( - hash_a, hash_b, - "changing the global default must trip the hash for a linked inherited agent" + snapshot_a, snapshot_b, + "changing the global default must drift a linked inherited agent" ); } #[test] -fn global_model_change_trips_hash_without_model_env_var() { +fn global_model_change_trips_snapshot_without_model_env_var() { let mut rec = record(); rec.persona_id = Some("p1".into()); rec.agent_command = "some-harness-without-model-env".into(); @@ -497,26 +615,26 @@ fn global_model_change_trips_hash_without_model_env_var() { ..Default::default() }; - let hash_a = spawn_config_hash(&rec, &personas, &[], "wss://ws.example", &global_a); - let hash_b = spawn_config_hash(&rec, &personas, &[], "wss://ws.example", &global_b); + let snapshot_a = snapshot(&rec, &personas, &[], "wss://ws.example", &global_a); + let snapshot_b = snapshot(&rec, &personas, &[], "wss://ws.example", &global_b); assert_ne!( - hash_a, hash_b, - "global model change must trip hash even without a model_env_var runtime" + snapshot_a, snapshot_b, + "global model change must drift even without a model_env_var runtime" ); } #[test] -fn linked_instance_stale_prompt_bytes_are_inert_at_hash_time() { +fn linked_instance_stale_prompt_bytes_are_inert_at_snapshot_time() { // Regression for the split-resolve defect: prompt used to be read from // the record's own (possibly Phase-A-snapshot-stale) bytes while // model/provider were resolved live from the definition. A definition // edit landing between a caller's snapshot apply and spawn could hand a - // fresh model/provider to a stale prompt, and the hash (which already + // fresh model/provider to a stale prompt, and the drift check (which already // resolved model/provider live) would silently agree with a spawn that // wrote the stale prompt. Now both come from one `resolve_effective_config` // call, so a record whose own `system_prompt` bytes disagree with the - // live definition must hash exactly as if the record carried the + // live definition must snapshot exactly as if the record carried the // definition's prompt verbatim — the record's prompt bytes are inert for // a linked instance. let mut rec = record(); @@ -529,26 +647,26 @@ fn linked_instance_stale_prompt_bytes_are_inert_at_hash_time() { let personas = [persona("p1", Some("goose"), "live prompt")]; assert_eq!( - spawn_config_hash( + snapshot( &rec, &personas, &[], "wss://ws.example", &Default::default() ), - spawn_config_hash( + snapshot( &matching_bytes, &personas, &[], "wss://ws.example", &Default::default() ), - "record's own system_prompt bytes must not affect the hash of a linked instance" + "record's own system_prompt bytes must not affect the snapshot of a linked instance" ); } #[test] -fn display_name_edit_changes_hash() { +fn display_name_edit_changes_snapshot() { // The spawn writes BUZZ_ACP_SESSION_TITLE from display_name-or-name, so a // rename must trip the badge: the running process keeps the old title // until it restarts, and the operator has to be told that. @@ -556,32 +674,32 @@ fn display_name_edit_changes_hash() { let mut renamed = record(); renamed.display_name = Some("Fizz".into()); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&renamed, &[], &[], "wss://ws.example", &Default::default()), "a display-name rename changes the spawned session title and must badge" ); } #[test] -fn name_edit_changes_hash_when_display_name_is_absent() { +fn name_edit_changes_snapshot_when_display_name_is_absent() { // With no display_name the title falls back to the unique handle, so the - // handle is what the env write carries and what must be hashed. + // handle is what the env write carries and what must be snapshotted. let rec = record(); let mut renamed = record(); renamed.name = "agent-2".into(); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()), - "the fallback title source must reach the hash too" + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&renamed, &[], &[], "wss://ws.example", &Default::default()), + "the fallback title source must reach the snapshot too" ); } #[test] -fn display_name_edit_does_not_change_hash_under_an_explicit_title_override() { +fn display_name_edit_does_not_change_snapshot_under_an_explicit_title_override() { // User env is written AFTER the Buzz-set title (last-wins), so an explicit // BUZZ_ACP_SESSION_TITLE is what the child actually runs with. Renaming the // record changes nothing about the spawned process, so badging it would be - // a false restart prompt. The override itself still reaches the hash + // a false restart prompt. The override itself still reaches the snapshot // through the effective env. let mut rec = record(); rec.env_vars @@ -589,14 +707,14 @@ fn display_name_edit_does_not_change_hash_under_an_explicit_title_override() { let mut renamed = rec.clone(); renamed.display_name = Some("Fizz".into()); assert_eq!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&renamed, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&renamed, &[], &[], "wss://ws.example", &Default::default()), "a rename shadowed by an explicit title override must not badge" ); } #[test] -fn title_override_edit_changes_hash() { +fn title_override_edit_changes_snapshot() { // Counterpart to the test above: the override is not inert — editing it // changes what the child runs with and must badge. let mut rec = record(); @@ -607,8 +725,8 @@ fn title_override_edit_changes_hash() { .env_vars .insert("BUZZ_ACP_SESSION_TITLE".into(), "Other Title".into()); assert_ne!( - spawn_config_hash(&rec, &[], &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&edited, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&edited, &[], &[], "wss://ws.example", &Default::default()), "editing an explicit title override must badge" ); } @@ -616,7 +734,7 @@ fn title_override_edit_changes_hash() { #[test] fn linked_instance_prompt_model_provider_resolve_from_one_call() { // The prompt for a linked instance must track the definition, exactly - // like model/provider — a definition prompt edit trips the hash even + // like model/provider — a definition prompt edit drifts the snapshot even // though the record's own (stale) system_prompt bytes are unchanged. let mut rec = record(); rec.persona_id = Some("p1".into()); @@ -626,25 +744,25 @@ fn linked_instance_prompt_model_provider_resolve_from_one_call() { let after = [persona("p1", Some("goose"), "new definition prompt")]; assert_ne!( - spawn_config_hash(&rec, &before, &[], "wss://ws.example", &Default::default()), - spawn_config_hash(&rec, &after, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &before, &[], "wss://ws.example", &Default::default()), + snapshot(&rec, &after, &[], "wss://ws.example", &Default::default()), "linked instance prompt must resolve from the live definition, not stale record bytes" ); } -// ── I2: definition args and env reach spawn_config_hash ────────────────────── +// ── I2: definition args and env reach the snapshot ─────────────────────────── // // These tests prove that editing a custom harness definition's args or env -// changes spawn_config_hash, which trips the "restart required" badge. -// They would fail if spawn_config_hash used only record.agent_args without +// change the snapshot, which trips the "restart required" badge. +// They would fail if the snapshot used only record.agent_args without // falling back to definition args, or if resolve_effective_agent_env did not // include definition env. /// When a record has no instance args but the definition has default args, -/// changing the definition args changes the spawn hash. This would fail if -/// spawn_config_hash used only record.agent_args. +/// changing the definition args changes the snapshot. This would fail if +/// the snapshot used only record.agent_args. #[test] -fn spawn_hash_changes_when_definition_default_args_change() { +fn spawn_snapshot_changes_when_definition_default_args_change() { use crate::managed_agents::custom_harnesses::{ registry_test_lock, warm_harness_registry_from_dir, }; @@ -652,8 +770,8 @@ fn spawn_hash_changes_when_definition_default_args_change() { use tempfile::tempdir; // The loaded-harness registry is process-global: a parallel test re-warming - // it between the two hash computations makes both resolve to no-definition - // and h1 == h2 (observed on Windows CI). + // it between the two snapshots makes both resolve to no-definition + // and s1 == s2 (observed on Windows CI). let _lock = registry_test_lock(); let dir = tempdir().unwrap(); @@ -669,7 +787,7 @@ fn spawn_hash_changes_when_definition_default_args_change() { r.runtime = Some("my-def".into()); r.agent_args = vec![]; // no instance args → definition args are used - let h1 = spawn_config_hash(&r, &[], &[], "ws://relay", &Default::default()); + let s1 = snapshot(&r, &[], &[], "ws://relay", &Default::default()); // Update to v2 args and re-warm (simulating save + transactional refresh). fs::write( @@ -679,18 +797,18 @@ fn spawn_hash_changes_when_definition_default_args_change() { .unwrap(); warm_harness_registry_from_dir(Some(dir.path())); - let h2 = spawn_config_hash(&r, &[], &[], "ws://relay", &Default::default()); + let s2 = snapshot(&r, &[], &[], "ws://relay", &Default::default()); assert_ne!( - h1, h2, - "changing definition default args must change the spawn hash" + s1, s2, + "changing definition default args must change the snapshot" ); } -/// When a definition has env vars, adding them changes the spawn hash. This +/// When a definition has env vars, adding them changes the snapshot. This /// proves resolve_effective_agent_env includes definition env in the layering. #[test] -fn spawn_hash_changes_when_definition_env_changes() { +fn spawn_snapshot_changes_when_definition_env_changes() { use crate::managed_agents::custom_harnesses::{ registry_test_lock, warm_harness_registry_from_dir, }; @@ -712,7 +830,7 @@ fn spawn_hash_changes_when_definition_env_changes() { let mut r = record(); r.runtime = Some("env-def".into()); - let h1 = spawn_config_hash(&r, &[], &[], "ws://relay", &Default::default()); + let s1 = snapshot(&r, &[], &[], "ws://relay", &Default::default()); // Update to include env and re-warm. fs::write( @@ -722,16 +840,16 @@ fn spawn_hash_changes_when_definition_env_changes() { .unwrap(); warm_harness_registry_from_dir(Some(dir.path())); - let h2 = spawn_config_hash(&r, &[], &[], "ws://relay", &Default::default()); + let s2 = snapshot(&r, &[], &[], "ws://relay", &Default::default()); - assert_ne!(h1, h2, "adding definition env must change the spawn hash"); + assert_ne!(s1, s2, "adding definition env must change the snapshot"); } /// Instance-level args win over definition default args (non-empty instance -/// args must NOT be overridden by the definition). The hash must match a record +/// args must NOT be overridden by the definition). The snapshot must match a record /// that has the same effective args from either source. #[test] -fn spawn_hash_instance_args_win_over_definition_args() { +fn spawn_snapshot_instance_args_win_over_definition_args() { use crate::managed_agents::custom_harnesses::{ registry_test_lock, warm_harness_registry_from_dir, }; @@ -756,12 +874,65 @@ fn spawn_hash_instance_args_win_over_definition_args() { r_no_instance.runtime = Some("arg-def".into()); r_no_instance.agent_args = vec![]; - let h_instance = spawn_config_hash(&r_instance, &[], &[], "ws://relay", &Default::default()); - let h_no_instance = - spawn_config_hash(&r_no_instance, &[], &[], "ws://relay", &Default::default()); + let snapshot_instance = snapshot(&r_instance, &[], &[], "ws://relay", &Default::default()); + let snapshot_no_instance = + snapshot(&r_no_instance, &[], &[], "ws://relay", &Default::default()); + + assert_ne!( + snapshot_instance, snapshot_no_instance, + "instance args and definition args must produce different snapshots" + ); +} + +// ── Parallelism cap: above-cap equivalence + cap crossing ───────────────────── +// +// The snapshot stores the *effective* parallelism (min(requested, harness cap)) +// so that over-cap edits that don't change the running pool size do not raise a +// spurious "restart required" badge, while cap crossings (e.g. 8 → 3, where 3 +// is below the cap) still badge because the pool actually changes. + +/// Two over-cap parallelism values (10 and 8) produce the same snapshot for +/// OpenClaw: both clamp to OPENCLAW_MAX_PARALLELISM (5). +#[test] +fn openclaw_above_cap_parallelism_snapshots_equal() { + let mut at_10 = record(); + at_10.runtime = Some("openclaw".into()); + at_10.agent_command = "openclaw".into(); + at_10.parallelism = 10; + + let mut at_8 = record(); + at_8.runtime = Some("openclaw".into()); + at_8.agent_command = "openclaw".into(); + at_8.parallelism = 8; + + assert_eq!( + snapshot(&at_10, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&at_8, &[], &[], "wss://ws.example", &Default::default()), + "parallelism 10 and 8 both clamp to 5 for OpenClaw — snapshots must be equal, no restart badge" + ); +} + +/// A cap-crossing edit (8 → 3) produces different snapshots: 8 clamps to 5, +/// but 3 is below the cap and runs as 3 — the pool changes, so the badge fires. +#[test] +fn openclaw_cap_crossing_parallelism_snapshots_differ() { + let mut at_8 = record(); + at_8.runtime = Some("openclaw".into()); + at_8.agent_command = "openclaw".into(); + at_8.parallelism = 8; + + let mut at_3 = record(); + at_3.runtime = Some("openclaw".into()); + at_3.agent_command = "openclaw".into(); + at_3.parallelism = 3; assert_ne!( - h_instance, h_no_instance, - "instance args and definition args must produce different hashes" + snapshot(&at_8, &[], &[], "wss://ws.example", &Default::default()), + snapshot(&at_3, &[], &[], "wss://ws.example", &Default::default()), + "parallelism 8 (clamps to 5) and 3 (runs as 3) must produce different snapshots" ); } + +#[cfg(test)] +#[path = "tests_ext.rs"] +mod ext; diff --git a/desktop/src-tauri/src/managed_agents/spawn_snapshot/tests_ext.rs b/desktop/src-tauri/src/managed_agents/spawn_snapshot/tests_ext.rs new file mode 100644 index 00000000000..dd708b6e59e --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/spawn_snapshot/tests_ext.rs @@ -0,0 +1,189 @@ +//! B5 effort lifecycle tests split out of `spawn_snapshot/tests.rs` to hold +//! that file under the 1000-line file-size ratchet. +//! +//! Included as `mod ext` inside `tests.rs`, so `use super::*` gives access to +//! its `record`, `snap`, and `record_with_env_effort` helpers. + +use super::*; + +#[test] +fn effort_set_then_cleared_round_trips_to_no_effort_projection() { + // Persist a canonical effort, then clear it: the projection must return to + // the exact no-effort baseline, so the badge lights on set and clears on + // clear rather than sticking. + let baseline = snap(&record()); + let mut set = record(); + set.effort_level = Some("high".into()); + assert_ne!(baseline, snap(&set), "setting canonical effort must badge"); + // Clear the SAME record back to None — the projection must return to the + // exact no-effort baseline, proving the round-trip clears rather than a + // fresh record merely matching baseline. + set.effort_level = None; + assert_eq!( + baseline, + snap(&set), + "clearing canonical effort restores the no-effort projection" + ); +} + +#[test] +fn shadowed_user_env_effort_edit_under_canonical_is_empty_diff() { + // Canonical `high` shadows the user env seed. Editing that seed low→medium + // changes nothing effective (canonical wins and the env key is stripped), + // so the projections are identical and no badge lights. + let mut low_env = record_with_env_effort("low"); + low_env.effort_level = Some("high".into()); + let mut medium_env = record_with_env_effort("medium"); + medium_env.effort_level = Some("high".into()); + assert_eq!( + snap(&low_env), + snap(&medium_env), + "editing a canonical-shadowed user env must not badge" + ); +} + +#[test] +fn clearing_canonical_reveals_env_fallback_and_creates_a_diff() { + // Canonical `high` over a user env seed `low`: clearing the canonical drops + // the effective effort to the env fallback `low`, a real change that badges. + let mut canonical = record_with_env_effort("low"); + canonical.effort_level = Some("high".into()); + let env_only = record_with_env_effort("low"); + assert_ne!( + snap(&canonical), + snap(&env_only), + "clearing canonical must reveal the env fallback and badge" + ); +} + +// ── B5 effort: single canonical representation ─────────────────────────── +// +// `effective_effort` and the snapshot's `effort_level` field are the sole +// carrier of startup effort. `BUZZ_ACP_EFFORT_LEVEL` is stripped from the +// snapshot `env` so an authority handoff at an unchanged effective value +// (canonical replacing a user-env seed, or the reverse) raises no spurious +// restart badge, while a genuine effort change surfaces exactly once. + +/// Look up the `env.BUZZ_ACP_EFFORT_LEVEL` leaf of a canonical snapshot, if any. +fn effort_env_leaf(canonical: &serde_json::Value) -> Option<&serde_json::Value> { + canonical + .get("env") + .and_then(|env| env.get("BUZZ_ACP_EFFORT_LEVEL")) +} + +/// A record whose user env seeds `BUZZ_ACP_EFFORT_LEVEL` (the pre-canonical +/// authority: no persisted `effort_level`, effort comes from user env_vars). +fn record_with_env_effort(value: &str) -> ManagedAgentRecord { + let mut rec = record(); + rec.env_vars + .insert("BUZZ_ACP_EFFORT_LEVEL".into(), value.into()); + rec +} + +#[test] +fn effective_effort_prefers_persisted_canonical_over_user_env() { + // Canonical wins, mirroring spawn's `apply_effort_env` (written after the + // user env layer). The env value is ignored when a canonical is present. + let mut rec = record(); + rec.effort_level = Some("high".into()); + let env = BTreeMap::from([("BUZZ_ACP_EFFORT_LEVEL".to_string(), "low".to_string())]); + assert_eq!(effective_effort(&rec, &env).as_deref(), Some("high")); +} + +#[test] +fn effective_effort_falls_back_to_user_env_when_no_canonical() { + // No persisted canonical → the user-seeded env value is the effective + // startup effort, exactly what a spawn would leave in place. + let rec = record(); + let env = BTreeMap::from([("BUZZ_ACP_EFFORT_LEVEL".to_string(), "low".to_string())]); + assert_eq!(effective_effort(&rec, &env).as_deref(), Some("low")); +} + +#[test] +fn effective_effort_is_none_without_canonical_or_env() { + assert_eq!(effective_effort(&record(), &BTreeMap::new()), None); +} + +#[test] +fn snapshot_carries_effort_in_field_not_env() { + // Always-canonicalize: a user-seeded effort reaches the snapshot ONLY as + // the `effort_level` field; the raw env key is stripped so effort has one + // representation, never two. + let canonical = snap(&record_with_env_effort("low")); + assert_eq!( + canonical.get("effort_level").and_then(|v| v.as_str()), + Some("low"), + "effective effort must land in the effort_level field" + ); + assert_eq!( + effort_env_leaf(&canonical), + None, + "BUZZ_ACP_EFFORT_LEVEL must be stripped from the snapshot env" + ); +} + +#[test] +fn equal_value_effort_authority_handoff_env_to_canonical_is_no_op() { + // User env `low` (no canonical) → persisted canonical `low` while the env + // seed remains: the effective effort is `low` either way, so a restart + // would change nothing. Old raw-env snapshots would have shown drift; the + // single canonical representation makes the projections identical. + let env_authority = record_with_env_effort("low"); + let mut canonical_authority = record_with_env_effort("low"); + canonical_authority.effort_level = Some("low".into()); + assert_eq!( + snap(&env_authority), + snap(&canonical_authority), + "an authority handoff at the same effort value must not badge" + ); +} + +#[test] +fn equal_value_effort_authority_handoff_canonical_to_env_is_no_op() { + // The reverse direction: canonical `low` (env seed present) → env `low` + // only (canonical cleared). Effective effort stays `low`; no badge. + let mut canonical_authority = record_with_env_effort("low"); + canonical_authority.effort_level = Some("low".into()); + let env_authority = record_with_env_effort("low"); + assert_eq!( + snap(&canonical_authority), + snap(&env_authority), + "clearing the canonical while the env seed holds the same value must not badge" + ); +} + +#[test] +fn env_only_effort_edit_changes_effort_level_not_env() { + // An env-only effort edit (no canonical) moves the single `effort_level` + // representation and never reintroduces an `env.BUZZ_ACP_EFFORT_LEVEL` + // leaf, so the diff names `effort_level` once rather than duplicating it. + let low = snap(&record_with_env_effort("low")); + let high = snap(&record_with_env_effort("high")); + assert_ne!( + low, high, + "an env-only effort edit must change the snapshot" + ); + assert_eq!( + low.get("effort_level").and_then(|v| v.as_str()), + Some("low") + ); + assert_eq!( + high.get("effort_level").and_then(|v| v.as_str()), + Some("high") + ); + assert_eq!(effort_env_leaf(&low), None); + assert_eq!(effort_env_leaf(&high), None); +} + +#[test] +fn canonical_effort_edit_changes_snapshot() { + let mut low = record(); + low.effort_level = Some("low".into()); + let mut high = record(); + high.effort_level = Some("high".into()); + assert_ne!( + snap(&low), + snap(&high), + "a canonical effort edit must trip the restart badge" + ); +} diff --git a/desktop/src-tauri/src/managed_agents/team_snapshot.rs b/desktop/src-tauri/src/managed_agents/team_snapshot.rs index 96082acc76d..2b6918b16e4 100644 --- a/desktop/src-tauri/src/managed_agents/team_snapshot.rs +++ b/desktop/src-tauri/src/managed_agents/team_snapshot.rs @@ -283,6 +283,7 @@ mod tests { runtime_pid: None, backend: BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -309,6 +310,7 @@ mod tests { definition_respond_to_allowlist: vec![], definition_parallelism: None, relay_mesh: None, + effort_level: None, } } diff --git a/desktop/src-tauri/src/managed_agents/teams_tests.rs b/desktop/src-tauri/src/managed_agents/teams_tests.rs index 1ffa60eda97..ff7900d3923 100644 --- a/desktop/src-tauri/src/managed_agents/teams_tests.rs +++ b/desktop/src-tauri/src/managed_agents/teams_tests.rs @@ -190,6 +190,7 @@ fn managed_agent(name: &str) -> ManagedAgentRecord { runtime_pid: None, backend: crate::managed_agents::BackendKind::Local, backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, persona_team_dir: None, persona_name_in_team: None, @@ -213,6 +214,7 @@ fn managed_agent(name: &str) -> ManagedAgentRecord { source_team_persona_slug: None, catalog_source: None, relay_mesh: None, + effort_level: None, definition_respond_to: None, definition_respond_to_allowlist: vec![], definition_parallelism: None, diff --git a/desktop/src-tauri/src/managed_agents/types.rs b/desktop/src-tauri/src/managed_agents/types.rs index fcd8b13fc96..9049482de3a 100644 --- a/desktop/src-tauri/src/managed_agents/types.rs +++ b/desktop/src-tauri/src/managed_agents/types.rs @@ -125,6 +125,7 @@ impl AgentDefinition { runtime_pid: None, backend: BackendKind::default(), backend_agent_id: None, + provider_policy_pending: false, provider_binary_path: None, team_id: None, persona_team_dir: None, @@ -153,6 +154,7 @@ impl AgentDefinition { definition_respond_to_allowlist: self.respond_to_allowlist, definition_parallelism: self.parallelism, relay_mesh: None, + effort_level: None, } } } @@ -196,6 +198,8 @@ impl ManagedAgentRecord { #[derive(Debug, Clone, Serialize, Deserialize)] pub struct RelayAgentInfo { pub pubkey: String, + #[serde(default)] + pub owner_pubkey: Option, pub name: String, pub agent_type: String, pub channels: Vec, @@ -245,13 +249,9 @@ pub struct ManagedAgentRecord { pub avatar_url: Option, pub acp_command: String, pub agent_command: String, - /// Explicit per-instance harness pin. `None` (the default) means inherit - /// the harness from the linked persona's `runtime`, so persona harness - /// edits propagate on the next spawn — mirroring the opt-in `model` - /// override. `Some` is set only when the user deliberately picks a harness - /// that diverges from the persona. Resolved via `effective_agent_command`; - /// `agent_command` above is the create-time snapshot kept for avatar/legacy - /// derivations and is not authoritative for spawn. + /// Explicit per-instance harness pin; `None` inherits the persona runtime. + /// The effective command is resolved at spawn; `agent_command` is a legacy + /// create-time snapshot. #[serde(default)] pub agent_command_override: Option, pub agent_args: Vec, @@ -321,6 +321,8 @@ pub struct ManagedAgentRecord { #[serde(default)] pub backend_agent_id: Option, #[serde(default)] + pub provider_policy_pending: bool, + #[serde(default)] pub provider_binary_path: Option, /// Installed team directory path (absolute). Set when agent was created from a team persona. #[serde( @@ -438,37 +440,22 @@ pub struct ManagedAgentRecord { /// deserialize as `None`. #[serde(default, skip_serializing_if = "Option::is_none")] pub relay_mesh: Option, -} - -/// Typed relay-mesh configuration carried on a [`ManagedAgentRecord`]. -/// -/// Feature-independent on purpose: the field is always present in the record -/// schema so saved agents round-trip identically whether or not the `mesh-llm` -/// feature is compiled in. -#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] -pub struct RelayMeshConfig { - /// The served model id this agent routes to (e.g. "Qwen3"). - /// - /// `alias` because this struct crosses two boundaries with different - /// casing conventions: the TS create request sends camelCase - /// (`relayMesh: { modelRef }` — `rename_all` on the request does not - /// recurse into nested structs), while persisted records use snake_case. - /// Serialization stays `model_ref` so saved records are stable. - #[serde(alias = "modelRef")] - pub model_ref: String, + /// Canonical Claude Code effort level. Injected as `BUZZ_ACP_EFFORT_LEVEL` at spawn + /// so the harness applies it via `session/set_config_option` at session creation. + #[serde(default, skip_serializing_if = "Option::is_none")] + pub effort_level: Option, } #[derive(Debug)] pub struct ManagedAgentProcess { pub child: Child, pub log_path: PathBuf, - /// Digest of the effective spawn config at launch (see - /// `spawn_hash::spawn_config_hash`). Runtime-only — never persisted. The - /// summary builder recomputes the hash from current disk state and flags - /// `needs_restart` on mismatch. Agents adopted via a persisted - /// `runtime_pid` have no `ManagedAgentProcess` entry, so their spawn - /// config is unknown and the badge stays off. - pub spawn_config_hash: u64, + /// The effective spawn config this process was launched with (see + /// `spawn_snapshot::SpawnConfigSnapshot`). Runtime-only — never persisted. + /// The summary builder recomputes a prospective snapshot and reports + /// differing fields via `ManagedAgentSummary::restart_diff`. Agents + /// adopted via `runtime_pid` have none; their config is unknown. + pub spawn_config: super::spawn_snapshot::SpawnConfigSnapshot, /// Whether this process was spawned in setup-listener mode (i.e. /// `BUZZ_ACP_SETUP_PAYLOAD` was set at launch because the agent was /// `NotReady`). Runtime-only — never persisted. Used by @@ -541,13 +528,14 @@ pub struct ManagedAgentSummary { /// `OrphanedInstance` arm via `require_resolved`) — so the UI /// should surface that it's stuck, not merely stale. pub persona_orphaned: bool, - /// `true` when the running process was spawned with a config that no - /// longer matches what a spawn would use today — a plain restart would - /// change what runs. Complements `persona_out_of_date`: the badge means - /// "a restart would change what runs"; out-of-date means "a respawn - /// would." Always `false` for stopped agents and for processes adopted - /// via a persisted `runtime_pid` (their spawn config is unknown). + /// `true` when the running process's spawn config no longer matches + /// what a spawn would use today. Derived from `restart_diff` — lit + /// exactly when there is something to show. Always `false` for stopped, + /// orphaned, or `runtime_pid`-adopted agents. pub needs_restart: bool, + /// Fields that drifted since launch, redacted for display. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub restart_diff: Vec, #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] pub env_vars: BTreeMap, pub backend: BackendKind, @@ -594,10 +582,8 @@ pub enum AcpAvailabilityStatus { NotInstalled, } -/// Authentication/login status for a CLI-based ACP runtime. -/// -/// Serializes as a tagged union `{ status: "...", diagnostic?: "..." }` so -/// the TypeScript side can exhaustively switch on `status`. +/// Authentication/login status for a CLI-based ACP runtime. Serializes as a tagged union +/// `{ status: "...", diagnostic?: "..." }` so the TypeScript side can exhaustively switch on `status`. #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] #[serde(rename_all = "snake_case", tag = "status")] pub enum AuthStatus { @@ -616,8 +602,7 @@ pub enum AuthStatus { Unknown, } -/// Origin of an ACP runtime catalog entry. Serializes as a lowercase string -/// so the TypeScript consumer can switch on it without numeric comparisons. +/// Origin of an ACP runtime catalog entry. Serializes as a lowercase string so the TypeScript consumer can switch on it without numeric comparisons. #[derive(Debug, Clone, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] pub enum HarnessSource { @@ -645,6 +630,9 @@ pub struct AcpRuntimeCatalogEntry { pub provider_env_var: Option, /// Environment variable used to apply thinking effort, when supported. pub thinking_env_var: Option, + pub max_tokens_env_var: Option, + pub context_limit_env_var: Option, + pub max_rounds_env_var: Option, pub install_hint: String, pub install_instructions_url: String, /// true when at least one automated install step is available @@ -663,16 +651,14 @@ pub struct AcpRuntimeCatalogEntry { /// Whether this entry came from the compiled-in catalog or a user-supplied /// JSON file in `custom_harnesses/`. The UI uses this to decide editability. pub source: HarnessSource, - /// Definition-level environment variables for `source: custom` entries. - /// - /// Populated from `HarnessDefinition.env` so the edit form can read them - /// back and the user doesn't silently lose env vars when saving. Always - /// empty for `builtin` and `preset` entries (those env values come from the - /// runtime metadata path, not user-editable JSON). - /// - /// Skipped in serialization when empty to keep the catalog payload compact. + /// Definition-level env vars for `source: custom` entries; populated from + /// `HarnessDefinition.env` so saves don't silently erase existing vars. + /// Absent for builtin/preset entries. Skipped when empty in serialization. #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] pub definition_env: BTreeMap, + /// Spawn-time parallelism cap; absent for uncapped harnesses. + #[serde(skip_serializing_if = "Option::is_none")] + pub max_parallelism: Option, } /// Result of a single install step (CLI or adapter). @@ -992,6 +978,8 @@ pub fn resolve_mint_behavioral_defaults( mod catalog_source; pub use catalog_source::CatalogSource; +mod relay_mesh; +pub use relay_mesh::RelayMeshConfig; mod requests; pub use requests::*; diff --git a/desktop/src-tauri/src/managed_agents/types/relay_mesh.rs b/desktop/src-tauri/src/managed_agents/types/relay_mesh.rs new file mode 100644 index 00000000000..a9ec2d28388 --- /dev/null +++ b/desktop/src-tauri/src/managed_agents/types/relay_mesh.rs @@ -0,0 +1,19 @@ +use serde::{Deserialize, Serialize}; + +/// Typed relay-mesh configuration carried on a [`super::ManagedAgentRecord`]. +/// +/// Feature-independent on purpose: the field is always present in the record +/// schema so saved agents round-trip identically whether or not the `mesh-llm` +/// feature is compiled in. +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +pub struct RelayMeshConfig { + /// The served model id this agent routes to (e.g. "Qwen3"). + /// + /// `alias` because this struct crosses two boundaries with different + /// casing conventions: the TS create request sends camelCase + /// (`relayMesh: { modelRef }` — `rename_all` on the request does not + /// recurse into nested structs), while persisted records use snake_case. + /// Serialization stays `model_ref` so saved records are stable. + #[serde(alias = "modelRef")] + pub model_ref: String, +} diff --git a/desktop/src-tauri/src/managed_agents/types/tests.rs b/desktop/src-tauri/src/managed_agents/types/tests.rs index 96ed5560689..0ae584e4acd 100644 --- a/desktop/src-tauri/src/managed_agents/types/tests.rs +++ b/desktop/src-tauri/src/managed_agents/types/tests.rs @@ -442,6 +442,21 @@ fn managed_agent_record_without_key_deserializes_empty() { .expect("keyring-backed record without inline key should deserialize"); assert_eq!(record.private_key_nsec, ""); + assert!( + !record.provider_policy_pending, + "pre-pending stores must deserialize as acknowledged" + ); +} + +#[test] +fn pending_provider_policy_round_trips() { + let mut record = sample_agent_record(); + record.provider_policy_pending = true; + + let json = serde_json::to_string(&record).expect("serialize pending policy"); + let reloaded: ManagedAgentRecord = serde_json::from_str(&json).expect("reload pending policy"); + + assert!(reloaded.provider_policy_pending); } fn sample_agent_record() -> ManagedAgentRecord { @@ -694,3 +709,93 @@ fn mint_rejects_out_of_range_input_parallelism() { "input-branch error must not blame the definition: {err}" ); } + +// ── Restart-diff wire shape ───────────────────────────────────────────────── + +fn summary_fixture( + restart_diff: Vec, +) -> super::ManagedAgentSummary { + super::ManagedAgentSummary { + pubkey: "aa".repeat(32), + name: "test".into(), + persona_id: None, + runtime: None, + team_id: None, + relay_url: String::new(), + acp_command: "buzz-acp".into(), + agent_command: "goose".into(), + agent_command_override: None, + agent_args: Vec::new(), + mcp_command: String::new(), + turn_timeout_seconds: 320, + idle_timeout_seconds: None, + max_turn_duration_seconds: None, + parallelism: 1, + system_prompt: None, + avatar_url: None, + model: None, + model_source: None, + provider: None, + persona_out_of_date: false, + persona_orphaned: false, + // Both fields derive from one vector in `build_managed_agent_summary`; + // the fixture reproduces that rule rather than letting them disagree. + needs_restart: !restart_diff.is_empty(), + restart_diff, + env_vars: Default::default(), + backend: super::BackendKind::Local, + backend_agent_id: None, + status: "running".into(), + pid: Some(4242), + created_at: "2026-01-01T00:00:00Z".into(), + updated_at: "2026-01-01T00:00:00Z".into(), + last_started_at: None, + last_stopped_at: None, + last_exit_code: None, + last_error: None, + last_error_code: None, + start_on_app_launch: false, + auto_restart_on_config_change: false, + log_path: String::new(), + respond_to: RespondTo::OwnerOnly, + respond_to_allowlist: Vec::new(), + } +} + +#[test] +fn summary_without_drift_omits_restart_diff_from_the_wire() { + // An adopted `runtime_pid`-only process is never stamped, so its summary + // carries an empty vector. `skip_serializing_if` must then drop the key + // entirely — the frontend normalizes omission to `[]`, and emitting an + // empty array on every stopped agent would bloat every list response. + let wire = serde_json::to_value(summary_fixture(Vec::new())).expect("summary serializes"); + assert_eq!(wire.get("needs_restart"), Some(&serde_json::json!(false))); + assert!( + wire.get("restart_diff").is_none(), + "empty restart_diff must be omitted, got: {wire}" + ); +} + +#[test] +fn summary_with_drift_serializes_restart_diff_entries() { + // The other side of the same rule: a present entry must reach the wire + // under its snake_case key with the tagged change payload intact. + let wire = serde_json::to_value(summary_fixture(vec![ + crate::managed_agents::spawn_snapshot::RestartDiffEntry { + field: "model".into(), + change: crate::managed_agents::spawn_snapshot::diff::RestartChange::Value { + before: serde_json::json!("gpt-5"), + after: serde_json::json!("claude-4"), + }, + }, + ])) + .expect("summary serializes"); + assert_eq!(wire.get("needs_restart"), Some(&serde_json::json!(true))); + assert_eq!( + wire.get("restart_diff"), + Some(&serde_json::json!([{ + "field": "model", + "change": { "kind": "value", "before": "gpt-5", "after": "claude-4" }, + }])) + ); +} diff --git a/desktop/src-tauri/src/mesh_llm/recovery.rs b/desktop/src-tauri/src/mesh_llm/recovery.rs index 89ca6396e9f..7933fd291e4 100644 --- a/desktop/src-tauri/src/mesh_llm/recovery.rs +++ b/desktop/src-tauri/src/mesh_llm/recovery.rs @@ -149,8 +149,25 @@ fn should_evict_after_probe( probe: MeshIngressProbe, consecutive: u32, ) -> bool { - urgency == MeshRecoveryUrgency::Foreground && probe == MeshIngressProbe::PortClosed - || consecutive >= DEAD_PROBE_EVICT_THRESHOLD + // Only a CLOSED port is evidence of death. A bound-but-HTTP-unresponsive + // port ("Unhealthy") is a BUSY node, not a dead one: mesh serializes all + // HTTP on the ingress — including the `/v1/models` liveness probe — behind + // in-flight inference, so a large-prompt turn on a big model leaves the + // control plane unresponsive for the whole turn (measured ~27s on a + // gemma-4-26B node) while TCP-connect keeps answering in ~0ms. Model load + // and package-layer download are unresponsive in exactly the same way. + // Evicting on any of those turns ordinary backpressure into a destructive + // whole-app restart loop, which is the regression this fixes. A genuinely + // wedged bound port cannot be distinguished from a busy one without a + // lock-free health endpoint on the ingress (tracked upstream in mesh-llm); + // until that exists we never evict a bound port and rely solely on the + // unambiguous closed-port signal. + match probe { + MeshIngressProbe::Live | MeshIngressProbe::Unhealthy => false, + MeshIngressProbe::PortClosed => { + urgency == MeshRecoveryUrgency::Foreground || consecutive >= DEAD_PROBE_EVICT_THRESHOLD + } + } } fn requires_process_restart( @@ -160,10 +177,11 @@ fn requires_process_restart( startup_in_progress || mode == crate::mesh_llm::MeshNodeMode::Serve } -/// Probe and, when justified, remove one stale runtime. A closed port is -/// decisive for a foreground agent start; watchdog and ambiguous/unhealthy -/// ports require consecutive failures to avoid restarting on a transient load -/// spike. +/// Probe and, when justified, remove one stale runtime. Only a CLOSED port is +/// treated as death: a foreground agent start evicts immediately, the watchdog +/// after a short consecutive-failure streak. A bound-but-unresponsive +/// ("Unhealthy") port is never evicted — it is a busy or still-loading node, +/// not a dead one (see `should_evict_after_probe`). pub(crate) async fn recover_stale_mesh_runtime( state: &AppState, urgency: MeshRecoveryUrgency, @@ -490,6 +508,89 @@ mod tests { )); } + #[test] + fn watchdog_closed_port_still_evicts_after_consecutive_streak() { + // A genuinely dead listener (crashed / released its port) must still be + // reclaimed — the closed-port signal is unchanged by this fix. + assert!(!should_evict_after_probe( + MeshRecoveryUrgency::Watchdog, + MeshIngressProbe::PortClosed, + 1 + )); + assert!(should_evict_after_probe( + MeshRecoveryUrgency::Watchdog, + MeshIngressProbe::PortClosed, + DEAD_PROBE_EVICT_THRESHOLD + )); + } + + #[test] + fn busy_or_loading_bound_port_is_never_evicted() { + // The regression this fixes: mesh serializes all ingress HTTP (incl. + // the `/v1/models` liveness probe) behind in-flight inference, so a + // large-prompt turn, a model load, or a layer download leaves the port + // bound-but-unresponsive ("Unhealthy"). No probe streak, and no + // urgency, may evict such a node — doing so restarts a node that is + // alive and working. + for consecutive in [1, 2, 5, 100] { + for urgency in [ + MeshRecoveryUrgency::Watchdog, + MeshRecoveryUrgency::Foreground, + ] { + assert!( + !should_evict_after_probe(urgency, MeshIngressProbe::Unhealthy, consecutive), + "a bound-but-busy port must never evict (urgency={urgency:?}, \ + consecutive={consecutive})" + ); + } + } + } + + #[test] + fn long_model_load_never_reaches_the_restart_path() { + // Pins the exact false positive this fix removes. A big model stays + // bound-but-unresponsive for MINUTES while it loads weights and + // downloads package layers, so the watchdog sees an unbroken run of + // `Unhealthy` probes. Walk ~5 minutes of watchdog passes at its 15s + // base interval and assert the eviction gate stays shut the whole way + // — for a serve node, one `true` here is a whole-app restart. + let state = MeshRecoveryState::default(); + let runtime_id = 42; + let passes = (5 * 60) / 15; + + for pass in 1..=passes { + let consecutive = state.record_dead_probe(runtime_id); + // The streak really does climb — the non-eviction below is the + // rule refusing to act, not the counter quietly resetting. + assert_eq!( + consecutive, pass, + "probe streak should keep climbing across a long load" + ); + for urgency in [ + MeshRecoveryUrgency::Watchdog, + MeshRecoveryUrgency::Foreground, + ] { + assert!( + !should_evict_after_probe(urgency, MeshIngressProbe::Unhealthy, consecutive), + "a still-loading node must never be evicted \ + (urgency={urgency:?}, minute={}, streak={consecutive})", + pass * 15 / 60 + ); + } + } + + // Sanity: the streak blew far past the threshold that used to evict, + // so the old logic WOULD have restarted this healthy loading node. + assert!( + passes >= DEAD_PROBE_EVICT_THRESHOLD, + "test must exceed the old eviction threshold to be meaningful" + ); + + // Once the load finishes and the ingress answers, the streak clears. + state.reset_probe_streak(); + assert_eq!(state.record_dead_probe(runtime_id), 1); + } + #[test] fn probe_streak_is_scoped_to_runtime_identity() { let state = MeshRecoveryState::default(); @@ -570,4 +671,39 @@ mod tests { ); assert!(!"user note: shared compute config".starts_with(MESH_REARM_ERROR_SENTINEL)); } + + // Black-box proof of the classification the eviction rule stands on. A + // mesh node busy in inference (or loading, or downloading) keeps its + // ingress TCP port accepting connections in ~0ms while HTTP does not answer + // within the probe timeout — measured directly against a gemma-4-26B node: + // a concurrent `/v1/models` took ~27s, queued behind one in-flight turn. + // This stands up exactly that shape — a listener that accepts then never + // replies — and asserts the probe reads `Unhealthy` (busy), the verdict + // `should_evict_after_probe` now refuses to evict on. If this regressed to + // `PortClosed`, a busy node would again be misread as dead and restarted. + #[tokio::test] + async fn bound_but_stalled_http_classifies_as_unhealthy_not_closed() { + let listener = tokio::net::TcpListener::bind("127.0.0.1:0") + .await + .expect("bind ephemeral port"); + let port = listener.local_addr().unwrap().port(); + // Accept and hold connections open without ever writing a response — + // the wire-level equivalent of a node serializing HTTP behind a turn. + let accept_task = tokio::spawn(async move { + let mut held = Vec::new(); + while let Ok((stream, _)) = listener.accept().await { + held.push(stream); // keep the socket open, never respond + } + }); + + let probe = probe_mesh_ingress_at(&format!("http://127.0.0.1:{port}/v1")).await; + accept_task.abort(); + + assert_eq!( + probe, + MeshIngressProbe::Unhealthy, + "a TCP-bound port that stalls HTTP (a busy/loading node) must read \ + Unhealthy, never PortClosed — the eviction fix depends on this" + ); + } } diff --git a/desktop/src-tauri/src/migration.rs b/desktop/src-tauri/src/migration.rs index b3e613621ec..1e22d7aaeca 100644 --- a/desktop/src-tauri/src/migration.rs +++ b/desktop/src-tauri/src/migration.rs @@ -149,8 +149,7 @@ fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) { // ensures the dev nest boots with the correct workspace on its first launch, // matching what the prod nest had configured. Skip-if-dest-exists so it is // idempotent and never clobbers a value the dev nest already set explicitly. - // Uses the composed helper so the gate + migration run through the same - // code path that the behavioral test exercises. + // Uses the composed helper so gate + migration share the tested code path. if let (Some(home), Some(dev_nest)) = (dirs::home_dir(), crate::managed_agents::nest_dir()) { maybe_migrate_dev_repos_dir(is_dev, reset_completed, &home, &dev_nest); } @@ -169,13 +168,11 @@ fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) { } migrate_persona_provider_to_runtime(app); reconcile_legacy_command_names(app); - // Fold personas.json into the unified store HERE: after the JSON-level - // personas.json migrations above (which must see the legacy file), and - // before every consumer of the load/save_personas shims below — - // sync_team_personas would otherwise operate on an empty definition set. - // Post-fold readers of the runtime map (`load_persona_runtimes`) fall - // back to the unified store's definitions. + // Fold personas.json after its JSON-level migrations and before consumers + // below; otherwise sync_team_personas sees an empty definition set. + // Post-fold runtime reads fall back to unified-store definitions. fold_personas_into_agent_store(app); + pollen::migrate_pollen_agent_name(app); // Clean the legacy baked team-instructions suffix out of stored prompts // AFTER the fold (so definitions lifted out of personas.json are cleaned in // the same boot) and BEFORE backfill_standalone_agents (so a manufactured @@ -183,11 +180,12 @@ fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) { strip_baked_team_instructions(app); refresh_builtin_agent_avatars(app); // B5: manufacture definitions for standalone agents AFTER the fold (so - // pre-existing definition slugs are present for collision checks) and - // before event sync republishes — the backfilled link is what flips the - // 30177 projection to its slim shape. + // pre-existing definition slugs exist for collision checks) and before event + // sync republishes — the backfilled link flips the 30177 projection. backfill_standalone_agents(app); - detach_directory_backed_teams(app); + // Repair dropped team↔member links, then detach directory-backed teams, + // gated on a clean repair so a failure preserves `source_dir` for a retry. + team_membership::repair_then_detach_teams(app); reconcile_provider_mcp_commands(app); reconcile_databricks_v1_to_v2(app); materialize_agent_runtimes(app); @@ -1375,7 +1373,9 @@ use fold::load_persona_runtimes; mod backfill; pub use backfill::backfill_standalone_agents; mod detach; -pub use detach::detach_directory_backed_teams; +mod pollen; +mod team_membership; +pub(crate) use pollen::*; mod team_suffix; pub use team_suffix::strip_baked_team_instructions; diff --git a/desktop/src-tauri/src/migration/backfill.rs b/desktop/src-tauri/src/migration/backfill.rs index cd62f63bbb1..74cef7ffe6f 100644 --- a/desktop/src-tauri/src/migration/backfill.rs +++ b/desktop/src-tauri/src/migration/backfill.rs @@ -26,7 +26,7 @@ use crate::managed_agents::{ /// `unwrap_or_default`, env COPIED so later instances inherit a working /// config, quad copied to the definition defaults) and the record gains /// `persona_source_version` = the new definition's content hash, so -/// neither `spawn_config_hash` nor the drift badge moves. +/// neither the spawn-config snapshot nor the drift badge moves. /// /// The manufactured definition's slug is the agent's pubkey: 64-hex passes /// the NIP-AP slug grammar on both relay and desktop ends, and agent pubkeys diff --git a/desktop/src-tauri/src/migration/backfill_tests.rs b/desktop/src-tauri/src/migration/backfill_tests.rs index 5d52d566783..754a40769c1 100644 --- a/desktop/src-tauri/src/migration/backfill_tests.rs +++ b/desktop/src-tauri/src/migration/backfill_tests.rs @@ -1,5 +1,5 @@ use super::backfill_standalone_agents_in_dir; -use crate::managed_agents::spawn_hash::spawn_config_hash; +use crate::managed_agents::spawn_snapshot::prospective_spawn_config_snapshot; use crate::managed_agents::{AgentDefinition, ManagedAgentRecord}; use crate::migration::test_support::{read_agents_json, write_agents_json}; use std::path::Path; @@ -116,11 +116,11 @@ fn backfilled_definition_carries_prompt_present_even_if_empty() { } #[test] -fn backfill_of_promptless_record_keeps_spawn_hash_stable() { - // B5 hash row 2: pre-backfill the record hashes prompt None; post-backfill +fn backfill_of_promptless_record_keeps_spawn_snapshot_stable() { + // B5 drift row 2: pre-backfill the record snapshots prompt None; post-backfill // the prospective re-snapshot pulls Some("") from the manufactured // definition. The spawn layer treats an empty prompt as no prompt (env - // absent either way), so the hash must not move — otherwise every + // absent either way), so the snapshot must not move — otherwise every // prompt-less standalone agent lights the restart badge on upgrade. let dir = tempfile::tempdir().unwrap(); let pubkey = "c".repeat(64); @@ -131,12 +131,13 @@ fn backfill_of_promptless_record_keeps_spawn_hash_stable() { let pre_records = load_typed(dir.path()); let pre_instance = pre_records.iter().find(|r| !r.pubkey.is_empty()).unwrap(); - let hash_before = spawn_config_hash( + let before = prospective_spawn_config_snapshot( pre_instance, &[], &[], "wss://ws.example", &Default::default(), + false, ); backfill_standalone_agents_in_dir(&base(dir.path())).unwrap(); @@ -147,24 +148,26 @@ fn backfill_of_promptless_record_keeps_spawn_hash_stable() { .iter() .filter_map(|r| r.to_definition_view()) .collect(); - let hash_after = spawn_config_hash( + let after = prospective_spawn_config_snapshot( post_instance, &personas, &[], "wss://ws.example", &Default::default(), + false, ); assert_eq!( - hash_before, hash_after, + before.canonical(), + after.canonical(), "backfill must not flip the restart badge for prompt-less agents" ); } #[test] -fn backfill_of_prompted_record_keeps_spawn_hash_stable() { +fn backfill_of_prompted_record_keeps_spawn_snapshot_stable() { // The general no-behavior-change rail: a standalone agent WITH config - // must also hash identically across backfill (the definition snapshots + // must also snapshot identically across backfill (the definition snapshots // the record's own values, so the re-snapshot writes back what is // already there). let dir = tempfile::tempdir().unwrap(); @@ -180,12 +183,13 @@ fn backfill_of_prompted_record_keeps_spawn_hash_stable() { let pre_records = load_typed(dir.path()); let pre_instance = pre_records.iter().find(|r| !r.pubkey.is_empty()).unwrap(); - let hash_before = spawn_config_hash( + let before = prospective_spawn_config_snapshot( pre_instance, &[], &[], "wss://ws.example", &Default::default(), + false, ); backfill_standalone_agents_in_dir(&base(dir.path())).unwrap(); @@ -196,15 +200,16 @@ fn backfill_of_prompted_record_keeps_spawn_hash_stable() { .iter() .filter_map(|r| r.to_definition_view()) .collect(); - let hash_after = spawn_config_hash( + let after = prospective_spawn_config_snapshot( post_instance, &personas, &[], "wss://ws.example", &Default::default(), + false, ); - assert_eq!(hash_before, hash_after); + assert_eq!(before.canonical(), after.canonical()); } #[test] diff --git a/desktop/src-tauri/src/migration/detach.rs b/desktop/src-tauri/src/migration/detach.rs index 9f746e479fc..79123653316 100644 --- a/desktop/src-tauri/src/migration/detach.rs +++ b/desktop/src-tauri/src/migration/detach.rs @@ -9,10 +9,12 @@ use crate::managed_agents::{ManagedAgentRecord, TeamRecord}; /// Lift pack instructions into `TeamRecord.instructions` and detach /// directory-backed teams from their source directories. /// -/// Runs on app launch if any `TeamRecord` still has `source_dir` set. -/// Both output files are written atomically (temp-file + rename), so a crash -/// mid-write leaves the previous version intact and the migration can safely -/// retry on next boot. +/// Core logic, decoupled from the Tauri `AppHandle` for testing. +/// +/// Runs on app launch (gated on a clean team-membership repair) if any +/// `TeamRecord` still has `source_dir` set. Both output files are written +/// atomically (temp-file + rename), so a crash mid-write leaves the previous +/// version intact and the migration can safely retry on next boot. /// /// Steps (written last so the idempotency gate stays open until both files /// are committed): @@ -24,18 +26,6 @@ use crate::managed_agents::{ManagedAgentRecord, TeamRecord}; /// `instructions` if the field is not already set. /// 4. Clear `source_dir`, `is_symlink`, `symlink_target`, `version` on each /// directory-backed `TeamRecord`. -pub fn detach_directory_backed_teams(app: &tauri::AppHandle) { - let Ok(base_dir) = crate::managed_agents::managed_agents_base_dir(app) else { - return; - }; - match detach_directory_backed_teams_in_dir(&base_dir) { - Ok(0) => {} - Ok(n) => eprintln!("buzz-desktop: detach-dir-teams: detached {n} directory-backed team(s)"), - Err(e) => eprintln!("buzz-desktop: detach-dir-teams: {e}"), - } -} - -/// Core logic, decoupled from the Tauri `AppHandle` for testing. /// /// `base_dir` is the managed-agents base directory (`/agents/`). /// Returns the number of teams detached (0 = nothing to do). diff --git a/desktop/src-tauri/src/migration/materialize.rs b/desktop/src-tauri/src/migration/materialize.rs index 5930920dd21..6ca23200e6f 100644 --- a/desktop/src-tauri/src/migration/materialize.rs +++ b/desktop/src-tauri/src/migration/materialize.rs @@ -15,8 +15,8 @@ use super::{canonical_dev_data_dir, load_persona_runtimes, patch_json_records}; /// persona (unified agent model, Phase 1A). After this, spawn resolution reads /// the record's own runtime (`record_agent_command` step 2) instead of the /// live persona — same effective command by construction, so the spawn-config -/// hash is unchanged and no running agent shows a spurious restart badge (see -/// `spawn_hash::tests::materializing_runtime_keeps_hash_stable`). +/// snapshot is unchanged and no running agent shows a spurious restart badge +/// (see `spawn_snapshot::tests::materializing_runtime_keeps_snapshot_stable`). /// /// Idempotent: records that already carry `runtime` are untouched, as are /// records with no linked persona or a persona without a runtime (both keep diff --git a/desktop/src-tauri/src/migration/pollen.rs b/desktop/src-tauri/src/migration/pollen.rs new file mode 100644 index 00000000000..4276301ea23 --- /dev/null +++ b/desktop/src-tauri/src/migration/pollen.rs @@ -0,0 +1,862 @@ +//! Compatibility migration for the Bumble-to-Pollen built-in agent rename. + +use std::path::Path; + +use tauri::Manager; + +use super::persona_version_from_record; + +/// Rename the built-in research agent in persisted definitions and linked +/// instances without overwriting user-customized fields. +pub(super) fn migrate_pollen_agent_name(app: &tauri::AppHandle) { + let Ok(dir) = app.path().app_data_dir() else { + return; + }; + let path = dir.join("agents/managed-agents.json"); + if path.exists() { + migrate_pollen_agent_name_in_file(&path, &crate::util::now_iso()); + } +} + +fn migrate_pollen_agent_name_in_file(path: &Path, now: &str) { + let Ok(contents) = std::fs::read_to_string(path) else { + return; + }; + let Ok(mut records) = serde_json::from_str::>(&contents) else { + eprintln!( + "buzz-desktop: migrate-pollen-agent-name: invalid JSON in {}", + path.display() + ); + return; + }; + + let mut version_updates = stock_version_updates(now); + let has_stock_pollen_instance = records.iter().any(|record| { + record + .get("pubkey") + .and_then(serde_json::Value::as_str) + .is_some_and(|key| !key.is_empty()) + && record.get("persona_id").and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_PERSONA_ID) + && record.get("name").and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME) + }); + let mut occupied_names = records + .iter() + .filter_map(|record| record.get("name").and_then(serde_json::Value::as_str)) + .map(|name| name.to_lowercase()) + .collect::>(); + let mut profile_reconciliations = Vec::new(); + let mut changed = false; + + // Migrate the definition first so an in-sync linked instance can advance + // its source version instead of surfacing a false out-of-date warning. + for record in &mut records { + let is_definition = record + .get("pubkey") + .and_then(serde_json::Value::as_str) + .is_some_and(str::is_empty); + let Some(persona_id) = record + .get("slug") + .and_then(serde_json::Value::as_str) + .map(str::to_string) + else { + continue; + }; + if !is_definition { + continue; + } + + let old_version = persona_version_from_record(record); + let Some(object) = record.as_object_mut() else { + continue; + }; + let record_changed = if persona_id == crate::managed_agents::POLLEN_PERSONA_ID { + migrate_pollen_fields(object, true) + } else if persona_id == "builtin:fizz" { + remove_pollen_from_legacy_fizz_name_pool(object) + } else { + false + }; + if !record_changed { + continue; + } + + object.insert( + "updated_at".to_string(), + serde_json::Value::String(now.to_string()), + ); + changed = true; + if let (Some(old_version), Some(new_version)) = + (old_version, persona_version_from_record(record)) + { + version_updates.insert(persona_id, (old_version, new_version)); + } + } + + for record in &mut records { + let is_instance = record + .get("pubkey") + .and_then(serde_json::Value::as_str) + .is_some_and(|pubkey| !pubkey.is_empty()); + let Some(persona_id) = record + .get("persona_id") + .and_then(serde_json::Value::as_str) + .map(str::to_string) + else { + continue; + }; + let is_pollen_instance = persona_id == crate::managed_agents::POLLEN_PERSONA_ID; + let is_legacy_fizz_pollen = has_stock_pollen_instance + && persona_id == "builtin:fizz" + && record.get("name").and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_DISPLAY_NAME); + // Definition rows are absent on direct upgrades from the pre-unified + // persona store. The stock hashes still let pristine linked instances + // advance instead of appearing falsely out of date after seeding. + let version_update = version_updates.get(&persona_id); + if !is_instance || (!is_pollen_instance && version_update.is_none()) { + continue; + } + + let source_was_current = version_update.is_some_and(|(old, _)| { + record + .get("persona_source_version") + .and_then(serde_json::Value::as_str) + == Some(old.as_str()) + }); + let Some(object) = record.as_object_mut() else { + continue; + }; + let name_was_migrated = is_pollen_instance + && object.get("name").and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME); + let mut record_changed = is_pollen_instance && migrate_pollen_fields(object, false); + if is_legacy_fizz_pollen && source_was_current { + let replacement = unique_legacy_fizz_name(&occupied_names); + occupied_names.insert(replacement.to_lowercase()); + object.insert( + "name".to_string(), + serde_json::Value::String(replacement.clone()), + ); + if let Some(pubkey) = object + .get("pubkey") + .and_then(serde_json::Value::as_str) + .filter(|pubkey| !pubkey.is_empty()) + { + profile_reconciliations.push((pubkey.to_string(), replacement)); + } + record_changed = true; + } + if name_was_migrated { + if let Some(pubkey) = object + .get("pubkey") + .and_then(serde_json::Value::as_str) + .filter(|pubkey| !pubkey.is_empty()) + { + profile_reconciliations.push(( + pubkey.to_string(), + crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + )); + } + } + if source_was_current { + if let Some((_, new_version)) = version_update { + object.insert( + "persona_source_version".to_string(), + serde_json::Value::String(new_version.clone()), + ); + record_changed = true; + } + } + if record_changed { + object.insert( + "updated_at".to_string(), + serde_json::Value::String(now.to_string()), + ); + changed = true; + } + } + + if !profile_reconciliations.is_empty() { + // Queue first: a crash after this write but before the agent-store write + // leaves harmless stale items. The loader verifies each queued expected + // name against the durable record before publishing. + if let Err(error) = persist_profile_reconcile_queue(path, &profile_reconciliations) { + eprintln!("buzz-desktop: migrate-pollen-agent-name: {error}"); + return; + } + if let Ok(bytes) = serde_json::to_vec_pretty(&records) { + if let Err(error) = crate::managed_agents::atomic_write_json_restricted(path, &bytes) { + eprintln!("buzz-desktop: migrate-pollen-agent-name: {error}"); + } + } + } else if changed { + if let Ok(bytes) = serde_json::to_vec_pretty(&records) { + if let Err(error) = crate::managed_agents::atomic_write_json_restricted(path, &bytes) { + eprintln!("buzz-desktop: migrate-pollen-agent-name: {error}"); + } + } + } +} + +fn unique_legacy_fizz_name(occupied_names: &std::collections::HashSet) -> String { + let base = "Pollen-Fizz"; + if !occupied_names.contains(&base.to_lowercase()) { + return base.to_string(); + } + for suffix in 2.. { + let candidate = format!("{base}-{suffix}"); + if !occupied_names.contains(&candidate.to_lowercase()) { + return candidate; + } + } + unreachable!() +} + +fn stock_version_updates(now: &str) -> std::collections::HashMap { + let mut updates = std::collections::HashMap::new(); + + if let Some(mut legacy_pollen) = crate::managed_agents::built_in_persona_definition( + crate::managed_agents::POLLEN_PERSONA_ID, + now, + ) { + let current_pollen = persona_version(&legacy_pollen); + legacy_pollen.display_name = crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME.to_string(); + legacy_pollen.system_prompt = + crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT.to_string(); + legacy_pollen.name_pool = + vec![crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME.to_string()]; + updates.insert( + crate::managed_agents::POLLEN_PERSONA_ID.to_string(), + (persona_version(&legacy_pollen), current_pollen), + ); + } + + if let Some(mut legacy_fizz) = + crate::managed_agents::built_in_persona_definition("builtin:fizz", now) + { + let current_fizz = persona_version(&legacy_fizz); + legacy_fizz + .name_pool + .insert(4, crate::managed_agents::POLLEN_DISPLAY_NAME.to_string()); + updates.insert( + "builtin:fizz".to_string(), + (persona_version(&legacy_fizz), current_fizz), + ); + } + + updates +} + +fn persona_version(definition: &crate::managed_agents::AgentDefinition) -> String { + crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(definition), + ) +} + +#[derive(Debug, Clone, serde::Serialize, PartialEq, Eq)] +pub(crate) struct ProfileReconcileQueueEntry { + pub(crate) pubkey: String, + #[serde(default = "default_profile_reconcile_name")] + pub(crate) expected_name: String, + /// Canonical relay identities already repaired for this migrated agent. + /// + /// Keep the entry after success: Desktop does not persist its community + /// list in Rust, so a community that is inactive (or re-added later) must + /// still get one repair when it is next applied. + #[serde(default)] + pub(crate) reconciled_relays: Vec, +} + +fn default_profile_reconcile_name() -> String { + crate::managed_agents::POLLEN_DISPLAY_NAME.to_string() +} + +#[derive(serde::Deserialize)] +struct CurrentProfileReconcileQueueEntry { + pubkey: String, + #[serde(default = "default_profile_reconcile_name")] + expected_name: String, + #[serde(default)] + reconciled_relays: Vec, +} + +#[derive(serde::Deserialize)] +#[serde(untagged)] +enum StoredProfileReconcileQueueEntry { + Current(CurrentProfileReconcileQueueEntry), + Legacy(String), +} + +impl<'de> serde::Deserialize<'de> for ProfileReconcileQueueEntry { + fn deserialize(deserializer: D) -> Result + where + D: serde::Deserializer<'de>, + { + match StoredProfileReconcileQueueEntry::deserialize(deserializer)? { + StoredProfileReconcileQueueEntry::Current(entry) => Ok(Self { + pubkey: entry.pubkey, + expected_name: entry.expected_name, + reconciled_relays: entry.reconciled_relays, + }), + StoredProfileReconcileQueueEntry::Legacy(pubkey) => Ok(Self { + pubkey, + expected_name: default_profile_reconcile_name(), + reconciled_relays: Vec::new(), + }), + } + } +} + +pub(crate) fn profile_reconcile_queue_path(agent_store_path: &Path) -> std::path::PathBuf { + agent_store_path.with_file_name("profile-reconcile-pending.json") +} + +fn persist_profile_reconcile_queue( + path: &Path, + reconciliations: &[(String, String)], +) -> Result<(), String> { + let queue_path = profile_reconcile_queue_path(path); + let mut pending = if queue_path.exists() { + read_profile_reconcile_queue(&queue_path).unwrap_or_default() + } else { + Vec::new() + }; + for (pubkey, expected_name) in reconciliations { + if let Some(entry) = pending.iter_mut().find(|entry| entry.pubkey == *pubkey) { + entry.expected_name.clone_from(expected_name); + entry.reconciled_relays.clear(); + } else { + pending.push(ProfileReconcileQueueEntry { + pubkey: pubkey.clone(), + expected_name: expected_name.clone(), + reconciled_relays: Vec::new(), + }); + } + } + pending.sort_by(|left, right| left.pubkey.cmp(&right.pubkey)); + write_profile_reconcile_queue(&queue_path, &pending) +} + +pub(crate) const PROFILE_RECONCILE_QUEUE_MAX_BYTES: usize = 1024 * 1024; + +pub(crate) fn read_profile_reconcile_queue( + path: &Path, +) -> Result, String> { + let metadata = std::fs::metadata(path) + .map_err(|error| format!("failed to inspect profile reconcile queue: {error}"))?; + if metadata.len() > PROFILE_RECONCILE_QUEUE_MAX_BYTES as u64 { + return Err("profile reconcile queue exceeds its size limit".to_string()); + } + let contents = std::fs::read_to_string(path) + .map_err(|error| format!("failed to read profile reconcile queue: {error}"))?; + serde_json::from_str(&contents) + .map_err(|error| format!("failed to parse profile reconcile queue: {error}")) +} + +pub(crate) fn write_profile_reconcile_queue( + path: &Path, + entries: &[ProfileReconcileQueueEntry], +) -> Result<(), String> { + if entries.is_empty() { + return match std::fs::remove_file(path) { + Ok(()) => Ok(()), + Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()), + Err(error) => Err(format!( + "failed to remove empty profile reconcile queue {}: {error}", + path.display() + )), + }; + } + let bytes = serde_json::to_vec_pretty(entries) + .map_err(|error| format!("failed to serialize profile reconcile queue: {error}"))?; + if bytes.len() > PROFILE_RECONCILE_QUEUE_MAX_BYTES { + return Err("profile reconcile queue exceeds its size limit".to_string()); + } + crate::managed_agents::atomic_write_json_restricted(path, &bytes) +} + +pub(crate) fn profile_reconcile_relay_key(relay_url: &str) -> Result { + buzz_core_pkg::relay::normalize_relay_url(relay_url) + .map_err(|error| format!("invalid profile reconcile relay: {error}")) +} + +#[cfg(test)] +pub(crate) fn profile_reconcile_is_pending( + entries: &[ProfileReconcileQueueEntry], + pubkey: &str, + relay_key: &str, +) -> bool { + entries.iter().any(|entry| { + entry.pubkey == pubkey + && !entry + .reconciled_relays + .iter() + .any(|relay| relay == relay_key) + }) +} + +pub(crate) fn record_profile_reconciled( + entries: &mut [ProfileReconcileQueueEntry], + pubkey: &str, + relay_key: String, +) { + if let Some(entry) = entries.iter_mut().find(|entry| entry.pubkey == pubkey) { + if !entry.reconciled_relays.contains(&relay_key) { + entry.reconciled_relays.push(relay_key); + entry.reconciled_relays.sort(); + } + } +} + +fn migrate_pollen_fields( + record: &mut serde_json::Map, + is_definition: bool, +) -> bool { + let mut changed = false; + for key in ["name", "display_name"] { + if record.get(key).and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME) + { + record.insert( + key.to_string(), + serde_json::Value::String(crate::managed_agents::POLLEN_DISPLAY_NAME.to_string()), + ); + changed = true; + } + } + if record + .get("system_prompt") + .and_then(serde_json::Value::as_str) + == Some(crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT) + { + record.insert( + "system_prompt".to_string(), + serde_json::Value::String(crate::managed_agents::POLLEN_SYSTEM_PROMPT.to_string()), + ); + changed = true; + } + if is_definition + && record + .get("name_pool") + .and_then(serde_json::Value::as_array) + .is_some_and(|names| { + names.len() == 1 + && names[0].as_str() == Some(crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME) + }) + { + record.insert( + "name_pool".to_string(), + serde_json::json!([crate::managed_agents::POLLEN_DISPLAY_NAME]), + ); + changed = true; + } + changed +} + +fn remove_pollen_from_legacy_fizz_name_pool( + record: &mut serde_json::Map, +) -> bool { + const LEGACY_FIZZ_NAME_POOL: &[&str] = &[ + "Nectar", "Comet", "Bramble", "Clover", "Pollen", "Amber", "Daisy", "Mason", "Thistle", + "Waxwing", "Hive", "Meadow", "Juniper", "Aster", "Sage", "Willow", "Orchard", "Buzz", + ]; + let Some(names) = record + .get("name_pool") + .and_then(serde_json::Value::as_array) + else { + return false; + }; + if !names + .iter() + .map(|name| name.as_str()) + .eq(LEGACY_FIZZ_NAME_POOL.iter().copied().map(Some)) + { + return false; + } + + let names_without_pollen = names + .iter() + .filter(|name| name.as_str() != Some(crate::managed_agents::POLLEN_DISPLAY_NAME)) + .cloned() + .collect(); + record.insert( + "name_pool".to_string(), + serde_json::Value::Array(names_without_pollen), + ); + true +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::migration::test_support::{read_agents_json, write_agents_json}; + + #[test] + fn pollen_name_migration_updates_seeded_fields_and_preserves_customizations() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("agents/managed-agents.json"); + let mut legacy_definition = crate::managed_agents::built_in_persona_definition( + crate::managed_agents::POLLEN_PERSONA_ID, + "before", + ) + .unwrap(); + legacy_definition.display_name = + crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME.to_string(); + legacy_definition.system_prompt = + crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT.to_string(); + legacy_definition.name_pool = + vec![crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME.to_string()]; + let old_version = crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(&legacy_definition), + ); + let mut current_definition = legacy_definition.clone(); + current_definition.display_name = crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(); + current_definition.system_prompt = crate::managed_agents::POLLEN_SYSTEM_PROMPT.to_string(); + current_definition.name_pool = vec![crate::managed_agents::POLLEN_DISPLAY_NAME.to_string()]; + let new_version = crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(¤t_definition), + ); + + let mut definition_record = + serde_json::to_value(legacy_definition.into_agent_record()).unwrap(); + definition_record["future_definition_field"] = serde_json::json!("preserved"); + let pristine_instance = serde_json::json!({ + "pubkey": "pristine-pubkey", + "name": crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME, + "persona_id": crate::managed_agents::POLLEN_PERSONA_ID, + "system_prompt": crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT, + "persona_source_version": old_version, + "start_on_app_launch": false, + "updated_at": "before", + "future_instance_field": "preserved" + }); + let customized_instance = serde_json::json!({ + "pubkey": "customized-pubkey", + "name": "My researcher", + "persona_id": crate::managed_agents::POLLEN_PERSONA_ID, + "system_prompt": "User-edited instructions", + "persona_source_version": "custom-version", + "updated_at": "before" + }); + let unrelated = serde_json::json!({ + "pubkey": "honey-pubkey", + "name": "Honey", + "persona_id": "builtin:honey", + "system_prompt": "You are Honey.", + "updated_at": "before" + }); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition_record, + pristine_instance, + customized_instance, + unrelated + ]), + ); + + migrate_pollen_agent_name_in_file(&path, "after"); + + let records = read_agents_json(dir.path()); + assert_eq!( + records[0]["slug"], + crate::managed_agents::POLLEN_PERSONA_ID, + "the persisted compatibility id must remain stable" + ); + assert_eq!( + records[0]["name"], + crate::managed_agents::POLLEN_DISPLAY_NAME + ); + assert_eq!( + records[0]["display_name"], + crate::managed_agents::POLLEN_DISPLAY_NAME + ); + assert_eq!( + records[0]["system_prompt"], + crate::managed_agents::POLLEN_SYSTEM_PROMPT + ); + assert_eq!( + records[0]["name_pool"], + serde_json::json!([crate::managed_agents::POLLEN_DISPLAY_NAME]) + ); + assert_eq!(records[0]["future_definition_field"], "preserved"); + assert_eq!(records[0]["updated_at"], "after"); + + assert_eq!( + records[1]["name"], + crate::managed_agents::POLLEN_DISPLAY_NAME + ); + assert_eq!( + records[1]["system_prompt"], + crate::managed_agents::POLLEN_SYSTEM_PROMPT + ); + assert_eq!(records[1]["persona_source_version"], new_version); + assert_eq!(records[1]["future_instance_field"], "preserved"); + assert_eq!(records[1]["updated_at"], "after"); + + assert_eq!(records[2]["name"], "My researcher"); + assert_eq!(records[2]["system_prompt"], "User-edited instructions"); + assert_eq!(records[2]["persona_source_version"], "custom-version"); + assert_eq!(records[2]["updated_at"], "before"); + assert_eq!(records[3], unrelated); + assert_eq!( + read_profile_reconcile_queue(&profile_reconcile_queue_path(&path)).unwrap(), + vec![ProfileReconcileQueueEntry { + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + pubkey: "pristine-pubkey".to_string(), + reconciled_relays: Vec::new(), + }], + "a stopped stock instance must retry its relay profile independently of startup" + ); + + let once = std::fs::read(&path).unwrap(); + migrate_pollen_agent_name_in_file(&path, "later"); + assert_eq!( + std::fs::read(path).unwrap(), + once, + "migration is idempotent" + ); + } + + #[test] + fn pollen_name_migration_advances_stock_versions_without_definition_rows() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("agents/managed-agents.json"); + let updates = stock_version_updates("before"); + let (old_pollen, new_pollen) = updates + .get(crate::managed_agents::POLLEN_PERSONA_ID) + .unwrap(); + let (old_fizz, new_fizz) = updates.get("builtin:fizz").unwrap(); + write_agents_json( + dir.path(), + &serde_json::json!([ + { + "pubkey": "pollen-pubkey", + "name": crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME, + "persona_id": crate::managed_agents::POLLEN_PERSONA_ID, + "system_prompt": crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT, + "persona_source_version": old_pollen, + "start_on_app_launch": false, + "updated_at": "before" + }, + { + "pubkey": "fizz-pubkey", + "name": "Fizz", + "persona_id": "builtin:fizz", + "persona_source_version": old_fizz, + "updated_at": "before" + } + ]), + ); + + migrate_pollen_agent_name_in_file(&path, "after"); + + let records = read_agents_json(dir.path()); + assert_eq!(records[0]["persona_source_version"], *new_pollen); + assert_eq!(records[1]["persona_source_version"], *new_fizz); + assert_eq!( + read_profile_reconcile_queue(&profile_reconcile_queue_path(&path)).unwrap(), + vec![ProfileReconcileQueueEntry { + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + pubkey: "pollen-pubkey".to_string(), + reconciled_relays: Vec::new(), + }] + ); + } + + #[test] + fn legacy_profile_reconcile_queue_remains_readable() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("profile-reconcile-pending.json"); + std::fs::write(&path, r#"["pollen-pubkey"]"#).unwrap(); + + assert_eq!( + read_profile_reconcile_queue(&path).unwrap(), + vec![ProfileReconcileQueueEntry { + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + pubkey: "pollen-pubkey".to_string(), + reconciled_relays: Vec::new(), + }] + ); + } + + #[test] + fn profile_reconcile_queue_tracks_each_relay_without_dropping_other_communities() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("profile-reconcile-pending.json"); + let relay_a = profile_reconcile_relay_key("WSS://A.EXAMPLE:443/").unwrap(); + let relay_b = profile_reconcile_relay_key("wss://b.example").unwrap(); + let mut entries = vec![ProfileReconcileQueueEntry { + pubkey: "pollen-pubkey".to_string(), + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + reconciled_relays: Vec::new(), + }]; + assert!(profile_reconcile_is_pending( + &entries, + "pollen-pubkey", + &relay_a + )); + record_profile_reconciled(&mut entries, "pollen-pubkey", relay_a.clone()); + assert!(!profile_reconcile_is_pending( + &entries, + "pollen-pubkey", + &relay_a + )); + assert!(profile_reconcile_is_pending( + &entries, + "pollen-pubkey", + &relay_b + )); + + write_profile_reconcile_queue(&path, &entries).unwrap(); + assert_eq!(read_profile_reconcile_queue(&path).unwrap(), entries); + assert_eq!( + profile_reconcile_relay_key("wss://a.example").unwrap(), + profile_reconcile_relay_key("WSS://A.EXAMPLE:443/").unwrap(), + "equivalent relay spellings must share one completion key" + ); + } + + #[test] + fn empty_profile_reconcile_queue_is_removed() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("profile-reconcile-pending.json"); + write_profile_reconcile_queue( + &path, + &[ProfileReconcileQueueEntry { + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + pubkey: "pollen-pubkey".to_string(), + reconciled_relays: Vec::new(), + }], + ) + .unwrap(); + assert!(path.exists()); + + write_profile_reconcile_queue(&path, &[]).unwrap(); + + assert!(!path.exists()); + } + + #[test] + fn pollen_name_migration_repairs_stock_fizz_collision_and_profiles() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("agents/managed-agents.json"); + let updates = stock_version_updates("before"); + let old_pollen = &updates[crate::managed_agents::POLLEN_PERSONA_ID].0; + let old_fizz = &updates["builtin:fizz"].0; + write_agents_json( + dir.path(), + &serde_json::json!([ + { + "pubkey": "pollen-pubkey", + "name": crate::managed_agents::POLLEN_LEGACY_DISPLAY_NAME, + "persona_id": crate::managed_agents::POLLEN_PERSONA_ID, + "system_prompt": crate::managed_agents::POLLEN_LEGACY_SYSTEM_PROMPT, + "persona_source_version": old_pollen, + "updated_at": "before" + }, + { + "pubkey": "fizz-pubkey", + "name": crate::managed_agents::POLLEN_DISPLAY_NAME, + "persona_id": "builtin:fizz", + "persona_source_version": old_fizz, + "updated_at": "before" + }, + { + "pubkey": "occupied-pubkey", + "name": "pollen-fizz", + "persona_id": "custom:persona", + "updated_at": "before" + }, + { + "pubkey": "custom-fizz-pubkey", + "name": crate::managed_agents::POLLEN_DISPLAY_NAME, + "persona_id": "builtin:fizz", + "persona_source_version": "custom-version", + "updated_at": "before" + } + ]), + ); + + migrate_pollen_agent_name_in_file(&path, "after"); + + let records = read_agents_json(dir.path()); + assert_eq!( + records[0]["name"], + crate::managed_agents::POLLEN_DISPLAY_NAME + ); + assert_eq!(records[1]["name"], "Pollen-Fizz-2"); + assert_eq!(records[2]["name"], "pollen-fizz"); + assert_eq!( + records[3]["name"], + crate::managed_agents::POLLEN_DISPLAY_NAME + ); + assert_eq!(records[3]["updated_at"], "before"); + assert_eq!( + read_profile_reconcile_queue(&profile_reconcile_queue_path(&path)).unwrap(), + vec![ + ProfileReconcileQueueEntry { + pubkey: "fizz-pubkey".to_string(), + expected_name: "Pollen-Fizz-2".to_string(), + reconciled_relays: Vec::new(), + }, + ProfileReconcileQueueEntry { + pubkey: "pollen-pubkey".to_string(), + expected_name: crate::managed_agents::POLLEN_DISPLAY_NAME.to_string(), + reconciled_relays: Vec::new(), + }, + ] + ); + + let once = std::fs::read(&path).unwrap(); + migrate_pollen_agent_name_in_file(&path, "later"); + assert_eq!(std::fs::read(path).unwrap(), once); + } + + #[test] + fn pollen_name_migration_removes_the_new_name_from_the_legacy_fizz_pool() { + let dir = tempfile::tempdir().unwrap(); + let path = dir.path().join("agents/managed-agents.json"); + let mut legacy_fizz = + crate::managed_agents::built_in_persona_definition("builtin:fizz", "before").unwrap(); + legacy_fizz + .name_pool + .insert(4, crate::managed_agents::POLLEN_DISPLAY_NAME.to_string()); + let old_version = crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(&legacy_fizz), + ); + let mut current_fizz = legacy_fizz.clone(); + current_fizz + .name_pool + .retain(|name| name != crate::managed_agents::POLLEN_DISPLAY_NAME); + let new_version = crate::managed_agents::persona_events::persona_content_hash( + &crate::managed_agents::persona_events::persona_event_content(¤t_fizz), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + serde_json::to_value(legacy_fizz.into_agent_record()).unwrap(), + { + "pubkey": "fizz-pubkey", + "name": "Fizz", + "persona_id": "builtin:fizz", + "persona_source_version": old_version, + "updated_at": "before" + } + ]), + ); + + migrate_pollen_agent_name_in_file(&path, "after"); + + let records = read_agents_json(dir.path()); + assert_eq!( + records[0]["name_pool"], + serde_json::json!(current_fizz.name_pool) + ); + assert_eq!(records[0]["updated_at"], "after"); + assert_eq!(records[1]["persona_source_version"], new_version); + assert_eq!(records[1]["updated_at"], "after"); + } +} diff --git a/desktop/src-tauri/src/migration/team_membership.rs b/desktop/src-tauri/src/migration/team_membership.rs new file mode 100644 index 00000000000..632714f3f91 --- /dev/null +++ b/desktop/src-tauri/src/migration/team_membership.rs @@ -0,0 +1,353 @@ +//! Repair team↔member links that a membership edit failed to propagate. +//! +//! Two independent defects, both rooted in a team-membership change not +//! reaching the records that depend on it, are healed in one pass over +//! `teams.json` + `managed-agents.json`: +//! +//! 1. **Stale `persona_ids`.** Team records written before persona ids were +//! namespaced hold bare slugs (`thufir`) instead of the namespaced id +//! (`sietch-tabr:thufir`). Nothing rewrites them, and the interactive save +//! path (`ensure_persona_ids_are_active`) *drops* an id it cannot resolve — +//! silently shrinking the team. This migration rewrites a stale id to the +//! persona it names whenever that persona is unambiguous, and — unlike the +//! save path — never drops one it cannot resolve. +//! +//! 2. **Orphaned or stale instance `team_id`.** Team instructions are injected +//! at spawn by matching `record.team_id` +//! (`spawn_snapshot::effective_team_instructions`), so an instance's binding +//! must track its persona's membership. Two ways it drifts: adding a persona +//! to a team does not backfill `team_id` on that persona's already-running +//! instances (a member in the roster but not in behavior), and removing a +//! persona while keeping its agents leaves the binding pointing at a team +//! that no longer lists it (still drawing that team's instructions). This +//! backfills an unset binding and heals a stale one — always on the same +//! single-team evidence rule, never guessing across teams. +//! +//! The stale-id rewrite is strictly additive (rewrite-or-leave); the binding +//! repair converges to a fixed point (bound-to-a-listing-team or unbound), so a +//! second boot is a clean no-op either way. Runs BEFORE +//! `detach_directory_backed_teams` so a not-yet-detached directory-backed team +//! can still be scoped by its `source_dir`, and before any UI save can drop an +//! unresolvable id. + +use std::collections::HashMap; +use std::path::Path; + +use crate::managed_agents::{team_persona_key, ManagedAgentRecord, TeamRecord}; + +/// Repair stale team `persona_ids`/instance `team_id`, then detach +/// directory-backed teams — but only when the repair succeeded. +/// +/// `repair` clears no `source_dir`; the downstream detach does. A stale bare +/// slug shared across source teams is disambiguated by `source_dir`, so if +/// repair fails (its backup or write errored) and detach still ran, the next +/// boot would see only ambiguous candidates and the original membership-loss +/// path recurs. Gating detach on a clean repair preserves `source_dir` as retry +/// evidence for that boot; the next boot retries repair and, once clean, +/// detaches. +pub(super) fn repair_then_detach_teams(app: &tauri::AppHandle) { + let Ok(base_dir) = crate::managed_agents::managed_agents_base_dir(app) else { + return; + }; + orchestrate_repair_then_detach( + || repair_team_membership_in_dir(&base_dir), + || super::detach::detach_directory_backed_teams_in_dir(&base_dir), + ); +} + +/// Gate `detach` on a successful `repair`: run detach only when repair returned +/// `Ok`. Injected ops keep the gate `AppHandle`-free so a failing repair's +/// skip-detach behavior is unit-testable without a filesystem fault. +fn orchestrate_repair_then_detach( + repair: impl FnOnce() -> Result, + detach: impl FnOnce() -> Result, +) { + match repair() { + Ok(repaired) => { + if repaired > 0 { + eprintln!("buzz-desktop: team-membership-repair: repaired {repaired} record(s)"); + } + match detach() { + Ok(0) => {} + Ok(n) => { + eprintln!( + "buzz-desktop: detach-dir-teams: detached {n} directory-backed team(s)" + ) + } + Err(e) => eprintln!("buzz-desktop: detach-dir-teams: {e}"), + } + } + Err(e) => eprintln!( + "buzz-desktop: team-membership-repair: {e} — skipping directory-backed detach this \ + boot to preserve source_dir for a clean-repair retry" + ), + } +} + +/// Core logic, decoupled from the Tauri `AppHandle` for testing. +/// +/// `base_dir` is the managed-agents base directory (`/agents/`). +/// Returns the number of records changed across both files (0 = nothing to do, +/// nothing written, so a re-run is a clean no-op). +pub(super) fn repair_team_membership_in_dir(base_dir: &Path) -> Result { + let teams_path = base_dir.join("teams.json"); + let agents_path = base_dir.join("managed-agents.json"); + + // Definitions and teams both live in these two files; without either there + // is nothing to link. + if !teams_path.exists() || !agents_path.exists() { + return Ok(0); + } + + let teams_content = std::fs::read_to_string(&teams_path) + .map_err(|e| format!("failed to read teams.json: {e}"))?; + let mut teams: Vec = serde_json::from_str(&teams_content) + .map_err(|e| format!("failed to parse teams.json: {e}"))?; + + let agents_content = std::fs::read_to_string(&agents_path) + .map_err(|e| format!("failed to read managed-agents.json: {e}"))?; + let mut agents: Vec = serde_json::from_str(&agents_content) + .map_err(|e| format!("failed to parse managed-agents.json: {e}"))?; + + let rewrites = rewrite_stale_persona_ids(&mut teams, &agents); + let backfills = backfill_instance_team_ids(&teams, &mut agents); + + if rewrites == 0 && backfills == 0 { + return Ok(0); + } + + // Pre-migration backups, both taken BEFORE either live store write: the + // stated contract is a full recovery pair even if a crash lands between the + // two writes, so neither store may be rewritten until both pristine backups + // exist. A stale bare slug shared across source teams is disambiguated by + // `source_dir`, which the downstream detach clears — so the pristine + // pre-repair `teams.json` is the evidence a retry needs. Each backup is + // created once (create-new), so a re-run after a partial failure never + // overwrites the pristine copy with a half-migrated snapshot. + if rewrites > 0 { + let bak = crate::util::resolved_backup_path( + &teams_path, + "teams.json.pre-team-membership-repair.bak", + ); + crate::util::create_restricted_backup_once(&bak, teams_content.as_bytes()) + .map_err(|e| format!("failed to write teams.json backup: {e}"))?; + } + if backfills > 0 { + let bak = crate::util::resolved_backup_path( + &agents_path, + "managed-agents.json.pre-team-membership-repair.bak", + ); + crate::util::create_restricted_backup_once(&bak, agents_content.as_bytes()) + .map_err(|e| format!("failed to write managed-agents.json backup: {e}"))?; + } + + if rewrites > 0 { + let payload = serde_json::to_vec_pretty(&teams) + .map_err(|e| format!("failed to serialize teams.json: {e}"))?; + crate::managed_agents::atomic_write_json(&teams_path, &payload)?; + } + + if backfills > 0 { + // Restricted: this store can carry plaintext agent nsecs on a + // keyringless host (SECURITY.md:90). + let payload = serde_json::to_vec_pretty(&agents) + .map_err(|e| format!("failed to serialize managed-agents.json: {e}"))?; + crate::managed_agents::atomic_write_json_restricted(&agents_path, &payload)?; + } + + Ok(rewrites + backfills) +} + +/// Set of persona ids that resolve to a definition — the definition records are +/// the key-less unified-store entries (`pubkey == ""`); their `slug` is the id +/// a team references. +fn resolvable_ids(agents: &[ManagedAgentRecord]) -> Vec<&str> { + agents + .iter() + .filter(|r| r.pubkey.is_empty()) + .filter_map(|r| r.slug.as_deref()) + .collect() +} + +/// Rewrite each team's stale `persona_ids` to the persona they name, when +/// unambiguous. Returns the number of ids rewritten. +/// +/// An id is *stale* when no definition slug equals it. Its repair target is the +/// definition whose `source_team_persona_slug` equals the stale id — i.e. the +/// bare slug is the pre-namespacing form of that persona's namespaced slug. The +/// rewrite happens only when exactly one such definition exists (optionally +/// scoped to the team's source team); zero or many candidates leave the id +/// untouched, which is strictly safer than the save path that drops it. +fn rewrite_stale_persona_ids(teams: &mut [TeamRecord], agents: &[ManagedAgentRecord]) -> usize { + let resolvable = resolvable_ids(agents); + let definitions: Vec<&ManagedAgentRecord> = + agents.iter().filter(|r| r.pubkey.is_empty()).collect(); + + let mut rewritten = 0usize; + for team in teams.iter_mut() { + // Scope candidate personas to this team's source team when derivable: + // a directory-backed team keys off its source_dir name; a detached team + // keys off the unique source_team of its already-resolvable members. + let scope = team_source_scope(team, &definitions); + for id in team.persona_ids.iter_mut() { + if resolvable.contains(&id.as_str()) { + continue; + } + let candidates: Vec<&&ManagedAgentRecord> = definitions + .iter() + .filter(|d| d.source_team_persona_slug.as_deref() == Some(id.as_str())) + .filter(|d| match scope.as_deref() { + Some(team_key) => d.source_team.as_deref() == Some(team_key), + None => true, + }) + .collect(); + let [only] = candidates.as_slice() else { + eprintln!( + "buzz-desktop: team-membership-repair: team {:?}: leaving unresolvable \ + persona id {:?} ({} candidate(s))", + team.id, + id, + candidates.len() + ); + continue; + }; + if let Some(slug) = only.slug.as_deref() { + *id = slug.to_string(); + rewritten += 1; + } + } + } + rewritten +} + +/// The source-team key that scopes a team's persona candidates, or `None` when +/// it cannot be derived (matching then falls back to a global unique slug). +/// +/// Directory-backed teams use `team_persona_key` (the pack manifest id). A +/// detached team (`source_dir` cleared) has no such key, so we infer it from +/// the unique `source_team` among its members that already resolve. +fn team_source_scope(team: &TeamRecord, definitions: &[&ManagedAgentRecord]) -> Option { + if team.source_dir.is_some() { + return Some(team_persona_key(team).to_string()); + } + let mut source_teams: Vec<&str> = team + .persona_ids + .iter() + .filter_map(|id| { + definitions + .iter() + .find(|d| d.slug.as_deref() == Some(id.as_str())) + .and_then(|d| d.source_team.as_deref()) + }) + .collect(); + source_teams.sort_unstable(); + source_teams.dedup(); + match source_teams.as_slice() { + [only] => Some((*only).to_string()), + _ => None, + } +} + +/// Repair instance `team_id` against the current rosters. Returns the number of +/// instances changed. +/// +/// Two directions, both conservative and evidence-gated: +/// +/// - **Unbound → bound (backfill).** An instance whose persona is a team member +/// but whose own `team_id` is unset is bound to that team, so it spawns with +/// the team's instructions. Only when the persona belongs to *exactly one* +/// team — a persona spanning several teams has no evidence selecting one +/// (JSON team order is not ownership), so it is left unbound and logged. +/// - **Stale binding → cleared or re-pointed.** An instance bound to a team +/// whose roster no longer lists its persona (a "keep agents" removal left the +/// binding behind, so the kept instance keeps drawing that team's +/// instructions at spawn) is healed: re-pointed when the persona now belongs +/// to exactly one *other* team (same single-evidence rule), otherwise unbound +/// and logged. A binding whose team still lists the persona is authoritative +/// and never touched. +/// +/// Idempotent: after a repair every instance is either bound to a team that +/// lists it or unbound with no single-team evidence, so a second pass is a +/// no-op. +fn backfill_instance_team_ids(teams: &[TeamRecord], agents: &mut [ManagedAgentRecord]) -> usize { + // persona_id → the sole team referencing it, or None once a *distinct* + // second team is seen (ambiguous → never used as binding evidence). A + // persona listed twice within one team is not ambiguity — duplicates are + // not prohibited at the storage boundary (`ensure_persona_ids_are_active` + // checks existence only; create/update/inbound persist the vector + // unchanged), so poisoning on a same-team repeat would strand a + // legitimately single-team instance. + let mut persona_to_team: HashMap<&str, Option<&str>> = HashMap::new(); + // Team ids that exist in the store, and the (team_id, persona_id) pairs they + // list. A binding is *stale* only when its team still exists but no longer + // lists the persona — a binding to an absent team is left alone (it already + // degrades to no instructions via `effective_team_instructions`, and a + // deleted team is not this repair's concern). + let mut team_ids: std::collections::HashSet<&str> = std::collections::HashSet::new(); + let mut membership: std::collections::HashSet<(&str, &str)> = std::collections::HashSet::new(); + for team in teams { + team_ids.insert(team.id.as_str()); + for persona_id in &team.persona_ids { + membership.insert((team.id.as_str(), persona_id.as_str())); + persona_to_team + .entry(persona_id.as_str()) + .and_modify(|slot| { + if slot.is_some_and(|seen| seen != team.id.as_str()) { + *slot = None; + } + }) + .or_insert(Some(team.id.as_str())); + } + } + + let mut repaired = 0usize; + for agent in agents.iter_mut() { + if agent.pubkey.is_empty() { + continue; + } + let Some(persona_id) = agent.persona_id.as_deref() else { + continue; + }; + match agent.team_id.as_deref() { + // Live binding, or a binding to an absent team: leave it. A binding + // is only stale when its team exists and dropped the persona. + Some(bound) + if !team_ids.contains(bound) || membership.contains(&(bound, persona_id)) => {} + // Stale binding: the still-present bound team dropped this persona. + // Re-point on single-team evidence, else unbind — never guess. + Some(_) => match persona_to_team.get(persona_id) { + Some(Some(team_id)) => { + agent.team_id = Some((*team_id).to_string()); + repaired += 1; + } + _ => { + eprintln!( + "buzz-desktop: team-membership-repair: unbinding instance {:?} — persona \ + {persona_id:?} left its team's roster with no single-team successor", + agent.pubkey + ); + agent.team_id = None; + repaired += 1; + } + }, + // Unbound: backfill on single-team evidence. + None => match persona_to_team.get(persona_id) { + Some(Some(team_id)) => { + agent.team_id = Some((*team_id).to_string()); + repaired += 1; + } + Some(None) => eprintln!( + "buzz-desktop: team-membership-repair: leaving instance {:?} unbound — persona \ + {persona_id:?} spans multiple teams", + agent.pubkey + ), + None => {} + }, + } + } + repaired +} + +#[cfg(test)] +#[path = "team_membership_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/migration/team_membership_tests.rs b/desktop/src-tauri/src/migration/team_membership_tests.rs new file mode 100644 index 00000000000..d284d56423b --- /dev/null +++ b/desktop/src-tauri/src/migration/team_membership_tests.rs @@ -0,0 +1,625 @@ +use super::repair_team_membership_in_dir; +use crate::migration::test_support::{ + read_agents_json, read_teams_json, write_agents_json, write_teams_json, +}; +use std::path::{Path, PathBuf}; + +fn base(dir: &Path) -> PathBuf { + dir.join("agents") +} + +/// A key-less definition record: `pubkey == ""`, persona id == `slug`. +/// `source_team` is the manifest id; `source_team_persona_slug` is the +/// pre-namespacing bare slug a stale team id would carry. +fn definition(slug: &str, source_team: &str, bare_slug: &str) -> serde_json::Value { + serde_json::json!({ + "name": slug, + "pubkey": "", + "relay_url": "ws://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "goose", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "parallelism": 4, + "system_prompt": "prompt", + "model": "gpt-x", + "provider": "openai", + "env_vars": {}, + "start_on_app_launch": true, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "slug": slug, + "source_team": source_team, + "source_team_persona_slug": bare_slug, + }) +} + +/// A standalone definition with no team provenance (persona id == slug). +fn standalone_definition(slug: &str) -> serde_json::Value { + serde_json::json!({ + "name": slug, + "pubkey": "", + "relay_url": "ws://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "goose", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "parallelism": 4, + "system_prompt": "prompt", + "model": "gpt-x", + "provider": "openai", + "env_vars": {}, + "start_on_app_launch": true, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "slug": slug, + }) +} + +/// A running instance record: `pubkey` set, linked to a persona by `persona_id`. +fn instance(pubkey_seed: char, persona_id: &str, team_id: Option<&str>) -> serde_json::Value { + let mut record = serde_json::json!({ + "name": persona_id, + "pubkey": pubkey_seed.to_string().repeat(64), + "relay_url": "ws://localhost:3000", + "acp_command": "buzz-acp", + "agent_command": "goose", + "agent_args": [], + "mcp_command": "", + "turn_timeout_seconds": 320, + "parallelism": 4, + "system_prompt": "prompt", + "model": "gpt-x", + "provider": "openai", + "env_vars": {}, + "start_on_app_launch": true, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + "persona_id": persona_id, + }); + record["team_id"] = match team_id { + Some(id) => serde_json::json!(id), + None => serde_json::Value::Null, + }; + record +} + +fn team(id: &str, persona_ids: &[&str]) -> serde_json::Value { + serde_json::json!({ + "id": id, + "name": "Sietch Tabr", + "description": null, + "persona_ids": persona_ids, + "created_at": "2026-01-01T00:00:00Z", + "updated_at": "2026-01-01T00:00:00Z", + }) +} + +fn team_persona_ids(dir: &Path, id: &str) -> Vec { + read_teams_json(dir) + .into_iter() + .find(|t| t["id"] == id) + .unwrap()["persona_ids"] + .as_array() + .unwrap() + .iter() + .map(|v| v.as_str().unwrap().to_string()) + .collect() +} + +fn instance_team_id(dir: &Path, pubkey_seed: char) -> Option { + read_agents_json(dir) + .into_iter() + .find(|r| r["pubkey"].as_str() == Some(&pubkey_seed.to_string().repeat(64))) + .unwrap()["team_id"] + .as_str() + .map(str::to_string) +} + +const TEAM_ID: &str = "ab5c038c-1b12-46e2-8283-d6f7c0606fce"; +const ST: &str = "com.wpfleger.sietch-tabr"; + +/// Will's pre-fix store: the team holds four bare pre-namespacing ids plus one +/// resolvable standalone id. Each bare id names exactly one team persona, so +/// all four are rewritten to their namespaced slug and the standalone id is +/// left untouched — the class the save path silently drops. +#[test] +fn rewrites_bare_ids_to_namespaced_slugs() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([team( + TEAM_ID, + &["369695d6", "thufir", "paul", "duncan", "alia"] + )]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + standalone_definition("369695d6"), + definition("sietch-tabr:thufir", ST, "thufir"), + definition("sietch-tabr:paul", ST, "paul"), + definition("sietch-tabr:duncan", ST, "duncan"), + definition("sietch-tabr:alia", ST, "alia"), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 4); + assert_eq!( + team_persona_ids(dir.path(), TEAM_ID), + vec![ + "369695d6", + "sietch-tabr:thufir", + "sietch-tabr:paul", + "sietch-tabr:duncan", + "sietch-tabr:alia", + ] + ); +} + +/// A directory-backed team scopes candidates by its `source_dir` name (the pack +/// manifest id), so a bare slug that appears under two different source teams is +/// disambiguated to the one this team is sourced from. +#[test] +fn scopes_candidates_by_source_dir_for_directory_backed_team() { + let dir = tempfile::tempdir().unwrap(); + let mut t = team(TEAM_ID, &["thufir"]); + t["source_dir"] = serde_json::json!(format!("/packs/{ST}")); + write_teams_json(dir.path(), &serde_json::json!([t])); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:thufir", ST, "thufir"), + // A collision: a different team also has a persona whose bare slug + // is "thufir". Without source scoping this would be ambiguous. + definition("other:thufir", "com.other.pack", "thufir"), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!( + team_persona_ids(dir.path(), TEAM_ID), + vec!["sietch-tabr:thufir"] + ); +} + +/// A bare id that names two personas with no usable scope is ambiguous: the +/// migration leaves it in place (strictly safer than the save path, which drops +/// it) and the file is not rewritten. +#[test] +fn leaves_ambiguous_id_in_place_without_writing() { + let dir = tempfile::tempdir().unwrap(); + // Detached team (no source_dir) with a single stale member => no resolvable + // sibling to infer a source-team scope from. + write_teams_json(dir.path(), &serde_json::json!([team(TEAM_ID, &["thufir"])])); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:thufir", ST, "thufir"), + definition("other:thufir", "com.other.pack", "thufir"), + ]), + ); + let before = std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 0); + assert_eq!(team_persona_ids(dir.path(), TEAM_ID), vec!["thufir"]); + assert_eq!( + std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(), + before, + "an ambiguous-only store is never rewritten" + ); + assert!( + !base(dir.path()) + .join("teams.json.pre-team-membership-repair.bak") + .exists(), + "no backup when nothing is repaired" + ); +} + +/// A detached team infers its source-team scope from the unique `source_team` +/// among its already-resolvable members, so a bare id is disambiguated even +/// without a `source_dir`. +#[test] +fn infers_scope_from_resolvable_siblings_when_detached() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([team(TEAM_ID, &["sietch-tabr:paul", "thufir"])]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:paul", ST, "paul"), + definition("sietch-tabr:thufir", ST, "thufir"), + definition("other:thufir", "com.other.pack", "thufir"), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!( + team_persona_ids(dir.path(), TEAM_ID), + vec!["sietch-tabr:paul", "sietch-tabr:thufir"] + ); +} + +/// Backfill sets `team_id` on an instance whose persona is a team member but +/// whose own `team_id` is null (the Gurney case), and leaves an already-bound +/// instance untouched (a persona shared across teams keeps its binding). +#[test] +fn backfills_null_team_id_but_never_re_points_a_bound_instance() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([team(TEAM_ID, &["sietch-tabr:gurney", "sietch-tabr:hayt"])]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:gurney", ST, "gurney"), + definition("sietch-tabr:hayt", ST, "hayt"), + instance('g', "sietch-tabr:gurney", None), + instance('h', "sietch-tabr:hayt", Some("other-team")), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!(instance_team_id(dir.path(), 'g').as_deref(), Some(TEAM_ID)); + assert_eq!( + instance_team_id(dir.path(), 'h').as_deref(), + Some("other-team"), + "an already-bound instance is never re-pointed" + ); +} + +/// A legacy unbound instance whose persona belongs to *two* teams is left +/// unbound: JSON team order is not ownership evidence, and the product permits +/// one persona under multiple teams with distinct instructions. Its team +/// sibling — a persona in only one team — is still backfilled in the same pass. +#[test] +fn leaves_unbound_instance_of_a_multi_team_persona_unbound() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([ + team(TEAM_ID, &["sietch-tabr:duncan", "sietch-tabr:paul"]), + team("other-team", &["sietch-tabr:duncan"]), + ]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:duncan", ST, "duncan"), + definition("sietch-tabr:paul", ST, "paul"), + instance('d', "sietch-tabr:duncan", None), + instance('p', "sietch-tabr:paul", None), + ]), + ); + + // Only Paul (single-team) is backfilled; Duncan (two teams) stays unbound. + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!(instance_team_id(dir.path(), 'd'), None); + assert_eq!(instance_team_id(dir.path(), 'p').as_deref(), Some(TEAM_ID)); +} + +/// A persona listed twice within a *single* team is not ambiguity — the storage +/// boundary does not dedupe `persona_ids`. Its unbound instance is still bound +/// to that one team; only a *distinct* second team poisons the entry. +#[test] +fn same_team_duplicate_persona_id_still_backfills() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([team(TEAM_ID, &["sietch-tabr:duncan", "sietch-tabr:duncan"])]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:duncan", ST, "duncan"), + instance('d', "sietch-tabr:duncan", None), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!(instance_team_id(dir.path(), 'd').as_deref(), Some(TEAM_ID)); +} + +/// A stale binding — the bound team no longer lists the instance's persona (a +/// "keep agents" removal left it behind) — is cleared when no other single team +/// claims the persona, so the kept instance stops drawing that team's +/// instructions at spawn. +#[test] +fn clears_stale_binding_when_persona_left_its_team() { + let dir = tempfile::tempdir().unwrap(); + // The team no longer lists gurney; the instance is still bound to it. + write_teams_json( + dir.path(), + &serde_json::json!([team(TEAM_ID, &["sietch-tabr:paul"])]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:gurney", ST, "gurney"), + definition("sietch-tabr:paul", ST, "paul"), + instance('g', "sietch-tabr:gurney", Some(TEAM_ID)), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!(instance_team_id(dir.path(), 'g'), None); +} + +/// A stale binding is *re-pointed* — not merely cleared — when the persona now +/// belongs to exactly one other team, matching the single-evidence backfill +/// rule. +#[test] +fn repoints_stale_binding_to_the_sole_successor_team() { + let dir = tempfile::tempdir().unwrap(); + // gurney left TEAM_ID but is the sole member of other-team. + write_teams_json( + dir.path(), + &serde_json::json!([ + team(TEAM_ID, &["sietch-tabr:paul"]), + team("other-team", &["sietch-tabr:gurney"]), + ]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:gurney", ST, "gurney"), + definition("sietch-tabr:paul", ST, "paul"), + instance('g', "sietch-tabr:gurney", Some(TEAM_ID)), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + assert_eq!( + instance_team_id(dir.path(), 'g').as_deref(), + Some("other-team") + ); +} + +/// A binding whose team still lists the persona is authoritative — a repair pass +/// leaves it untouched even when that persona also belongs to another team. +#[test] +fn leaves_live_binding_untouched_for_multi_team_persona() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([ + team(TEAM_ID, &["sietch-tabr:duncan"]), + team("other-team", &["sietch-tabr:duncan"]), + ]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:duncan", ST, "duncan"), + instance('d', "sietch-tabr:duncan", Some(TEAM_ID)), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 0); + assert_eq!(instance_team_id(dir.path(), 'd').as_deref(), Some(TEAM_ID)); +} + +/// A store that needs no repair is a clean no-op: `Ok(0)`, no write, no backup. +#[test] +fn clean_store_is_a_no_op() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json( + dir.path(), + &serde_json::json!([team(TEAM_ID, &["sietch-tabr:paul"])]), + ); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:paul", ST, "paul"), + instance('p', "sietch-tabr:paul", Some(TEAM_ID)), + ]), + ); + let teams_before = std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(); + let agents_before = + std::fs::read_to_string(base(dir.path()).join("managed-agents.json")).unwrap(); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 0); + assert_eq!( + std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(), + teams_before + ); + assert_eq!( + std::fs::read_to_string(base(dir.path()).join("managed-agents.json")).unwrap(), + agents_before + ); +} + +/// The full repair is idempotent: a second boot over the already-repaired store +/// finds nothing to do and does not write. +#[test] +fn second_run_is_a_no_op() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json(dir.path(), &serde_json::json!([team(TEAM_ID, &["thufir"])])); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:thufir", ST, "thufir"), + instance('t', "sietch-tabr:thufir", None), + ]), + ); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 2); + let teams_after = std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(); + let agents_after = + std::fs::read_to_string(base(dir.path()).join("managed-agents.json")).unwrap(); + + assert_eq!( + repair_team_membership_in_dir(&base(dir.path())).unwrap(), + 0, + "second run finds nothing" + ); + assert_eq!( + std::fs::read_to_string(base(dir.path()).join("teams.json")).unwrap(), + teams_after + ); + assert_eq!( + std::fs::read_to_string(base(dir.path()).join("managed-agents.json")).unwrap(), + agents_after + ); +} + +#[test] +fn missing_store_is_a_no_op() { + let dir = tempfile::tempdir().unwrap(); + std::fs::create_dir_all(base(dir.path())).unwrap(); + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 0); +} + +#[test] +fn unparseable_store_errors_without_writing() { + let dir = tempfile::tempdir().unwrap(); + std::fs::create_dir_all(base(dir.path())).unwrap(); + let teams_path = base(dir.path()).join("teams.json"); + std::fs::write(&teams_path, "{ not json").unwrap(); + write_agents_json(dir.path(), &serde_json::json!([])); + + let err = repair_team_membership_in_dir(&base(dir.path())).unwrap_err(); + assert!(err.contains("failed to parse"), "unexpected error: {err}"); + assert_eq!( + std::fs::read_to_string(&teams_path).unwrap(), + "{ not json", + "a corrupt store is left for manual recovery" + ); +} + +/// The teams.json backup captures the pre-migration bytes and is written once. +#[test] +fn writes_teams_backup_once() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json(dir.path(), &serde_json::json!([team(TEAM_ID, &["thufir"])])); + write_agents_json( + dir.path(), + &serde_json::json!([definition("sietch-tabr:thufir", ST, "thufir")]), + ); + let bak = base(dir.path()).join("teams.json.pre-team-membership-repair.bak"); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 1); + let bak_content = std::fs::read_to_string(&bak).unwrap(); + assert!( + bak_content.contains("\"thufir\""), + "backup holds the pre-migration stale id" + ); +} + +/// Both pristine backups are created BEFORE either live store is rewritten, so +/// a crash between the two writes still leaves a full recovery pair (Carl's +/// backup-contract finding). A stale bare slug on the team (drives the teams +/// rewrite) plus an unbound instance (drives the agents backfill) exercises +/// both stores; each backup must hold the pre-migration bytes. +#[test] +fn both_backups_precede_either_live_write() { + let dir = tempfile::tempdir().unwrap(); + write_teams_json(dir.path(), &serde_json::json!([team(TEAM_ID, &["thufir"])])); + write_agents_json( + dir.path(), + &serde_json::json!([ + definition("sietch-tabr:thufir", ST, "thufir"), + instance('t', "sietch-tabr:thufir", None), + ]), + ); + let teams_bak = base(dir.path()).join("teams.json.pre-team-membership-repair.bak"); + let agents_bak = base(dir.path()).join("managed-agents.json.pre-team-membership-repair.bak"); + + assert_eq!(repair_team_membership_in_dir(&base(dir.path())).unwrap(), 2); + + // teams.json backup holds the stale bare slug (pre-rewrite bytes). + let teams_bak_content = std::fs::read_to_string(&teams_bak).unwrap(); + assert!( + teams_bak_content.contains("\"thufir\"") + && !teams_bak_content.contains("sietch-tabr:thufir"), + "teams backup captures pre-rewrite bytes" + ); + // managed-agents.json backup holds the null binding (pre-backfill bytes). + let agents_bak_content = std::fs::read_to_string(&agents_bak).unwrap(); + assert!( + agents_bak_content.contains("\"team_id\": null"), + "agents backup captures pre-backfill bytes" + ); +} + +// ── repair→detach orchestration gate (Carl's finding #2) ────────────────── + +use super::orchestrate_repair_then_detach; +use std::cell::Cell; + +/// A failed repair must SKIP the directory-backed detach: detach clears +/// `source_dir`, the disambiguating evidence a clean-repair retry needs, so +/// running it after a repair error would let the original membership-loss path +/// recur on the next boot. +#[test] +fn failed_repair_skips_detach() { + let detach_ran = Cell::new(false); + orchestrate_repair_then_detach( + || Err("repair write failed".to_string()), + || { + detach_ran.set(true); + Ok(0) + }, + ); + assert!( + !detach_ran.get(), + "detach must not run when repair failed — source_dir is preserved for retry" + ); +} + +/// A successful repair runs detach, whether or not the repair changed anything +/// (a clean-store boot with directory-backed teams still needs detaching). +#[test] +fn successful_repair_runs_detach() { + let detach_ran = Cell::new(false); + orchestrate_repair_then_detach( + || Ok(0), + || { + detach_ran.set(true); + Ok(1) + }, + ); + assert!( + detach_ran.get(), + "detach runs after a clean repair even when repair changed nothing" + ); +} + +/// End-to-end discriminating proof: a failed repair must leave a +/// directory-backed team's `source_dir` intact, because the gate skips the real +/// detach op that would otherwise clear it. The store here is fully valid — so +/// detach WOULD succeed and strip `source_dir` if the gate let it run — which +/// is what makes this catch a gate that runs detach unconditionally. +#[test] +fn failed_repair_preserves_source_dir_against_real_detach() { + let dir = tempfile::tempdir().unwrap(); + let base_dir = base(dir.path()); + let mut t = team(TEAM_ID, &["sietch-tabr:thufir"]); + t["source_dir"] = serde_json::json!(format!("/packs/{ST}")); + write_teams_json(dir.path(), &serde_json::json!([t])); + write_agents_json( + dir.path(), + &serde_json::json!([definition("sietch-tabr:thufir", ST, "thufir")]), + ); + + orchestrate_repair_then_detach( + || Err("repair backup write failed".to_string()), + || super::super::detach::detach_directory_backed_teams_in_dir(&base_dir), + ); + + let source_dir = read_teams_json(dir.path()) + .into_iter() + .find(|t| t["id"] == TEAM_ID) + .unwrap()["source_dir"] + .clone(); + assert_eq!( + source_dir, + serde_json::json!(format!("/packs/{ST}")), + "a failed repair must preserve source_dir — detach never ran to clear it" + ); +} diff --git a/desktop/src-tauri/src/migration_test_support.rs b/desktop/src-tauri/src/migration_test_support.rs index 64a428949ba..b68415c6b5f 100644 --- a/desktop/src-tauri/src/migration_test_support.rs +++ b/desktop/src-tauri/src/migration_test_support.rs @@ -29,3 +29,17 @@ pub(crate) fn read_personas_json(dir: &Path) -> Vec { let content = std::fs::read_to_string(dir.join("agents/personas.json")).unwrap(); serde_json::from_str(&content).unwrap() } + +pub(crate) fn write_teams_json(dir: &Path, records: &serde_json::Value) { + std::fs::create_dir_all(dir.join("agents")).unwrap(); + std::fs::write( + dir.join("agents/teams.json"), + serde_json::to_vec_pretty(records).unwrap(), + ) + .unwrap(); +} + +pub(crate) fn read_teams_json(dir: &Path) -> Vec { + let content = std::fs::read_to_string(dir.join("agents/teams.json")).unwrap(); + serde_json::from_str(&content).unwrap() +} diff --git a/desktop/src-tauri/src/models.rs b/desktop/src-tauri/src/models.rs index 3f04d3d7a1e..9693f1563ac 100644 --- a/desktop/src-tauri/src/models.rs +++ b/desktop/src-tauri/src/models.rs @@ -178,6 +178,22 @@ pub struct ChannelMembersResponse { pub next_cursor: Option, } +/// Per-item classification of a home feed entry. +/// +/// This is the wire contract for `FeedItem.category` in the desktop frontend +/// (`desktop/src/shared/api/types.ts`). It is distinct from the plural +/// *section* vocabulary (`mentions`, `needs_action`, …) used by +/// [`FeedSections`] and the `--types` filter: a mention item lives in the +/// `mentions` section but carries the singular `mention` category. +#[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq, Eq)] +#[serde(rename_all = "snake_case")] +pub enum FeedItemCategory { + Mention, + NeedsAction, + Activity, + AgentActivity, +} + #[derive(Serialize, Deserialize)] pub struct FeedItemInfo { pub id: String, @@ -190,7 +206,7 @@ pub struct FeedItemInfo { #[serde(default)] pub channel_type: Option, pub tags: Vec>, - pub category: String, + pub category: FeedItemCategory, } #[derive(Serialize, Deserialize)] @@ -358,6 +374,21 @@ fn default_true() -> bool { true } +/// Response payload for `get_channels`. When the caller supplies a hash that +/// matches the computed stable hash, `channels` is `None` so the multi-MB +/// channel list is not serialized across IPC. `last_messages` is always +/// included — it is cheap and changes frequently (every new message). +#[derive(Serialize)] +pub struct GetChannelsPayload { + pub hash: String, + /// `None` on a not-modified response (hash matched); `Some` with the full + /// sorted list otherwise. + pub channels: Option>, + /// Map of channel id → ISO-8601 timestamp of its most recent message. + /// Empty for channels with no messages. + pub last_messages: std::collections::HashMap, +} + // ── Social / Contact list ─────────────────────────────────────────────────── #[derive(Serialize, Deserialize)] diff --git a/desktop/src-tauri/src/mouse_nav.rs b/desktop/src-tauri/src/mouse_nav.rs new file mode 100644 index 00000000000..cd729f73049 --- /dev/null +++ b/desktop/src-tauri/src/mouse_nav.rs @@ -0,0 +1,142 @@ +//! Native macOS handler for back/forward navigation inputs (mouse X1/X2 +//! buttons and horizontal swipe gestures). +//! +//! WKWebView never delivers these inputs to the web content layer, so a DOM +//! listener can't see them (Safari itself handles them natively in the app +//! layer, not in the page). This module installs an NSEvent local monitor +//! and emits a `mouse-nav` Tauri event that `useBackForwardControls` acts on +//! in the frontend. Two event shapes map to navigation: +//! +//! - `otherMouseUp` with button 3/4 — mice whose X1/X2 buttons reach the app +//! as plain mouse buttons. +//! - `swipe` with a horizontal delta — AppKit's page-swipe gesture +//! (`swipeWithEvent:`): `deltaX > 0` is back, `deltaX < 0` is forward. +//! Sent by mouse drivers that synthesize a page-swipe gesture for the +//! back/forward buttons instead of button-3/4 events (the hardware this +//! was verified on). Stock Apple trackpad and Magic Mouse swipes arrive +//! as phased scroll-wheel events instead, which this module does not +//! handle — that path (`ScrollWheel` + `trackSwipeEventWithOptions:`, +//! which also needs scroll-edge detection) is a follow-up. +//! +//! Compiled macOS-only (via `tray_menu`). Non-macOS X1/X2 behavior is left +//! to the underlying webview. + +/// Maps an `otherMouseUp` button number to a navigation direction. +/// Buttons 3 and 4 are X1 (back) and X2 (forward). +fn direction_for_button(button: isize) -> Option<&'static str> { + match button { + 3 => Some("back"), + 4 => Some("forward"), + _ => None, + } +} + +/// Maps a swipe gesture's horizontal delta to a navigation direction, +/// following the AppKit `swipeWithEvent:` convention: positive is back, +/// negative is forward. A swipe arrives as a begin/end pair and only the +/// end event carries the direction, so `deltaX == 0` maps to `None`. +fn direction_for_swipe(delta_x: f64) -> Option<&'static str> { + if delta_x > 0.0 { + Some("back") + } else if delta_x < 0.0 { + Some("forward") + } else { + None + } +} + +pub fn init(app_handle: &tauri::AppHandle) { + use block2::RcBlock; + use objc2_app_kit::{NSEvent, NSEventMask, NSEventType}; + use tauri::Emitter; + + let app = app_handle.clone(); + let block = RcBlock::new(move |event: std::ptr::NonNull| -> *mut NSEvent { + // SAFETY: the monitor hands us a valid NSEvent for the matched mask. + let ev = unsafe { event.as_ref() }; + + match ev.r#type() { + NSEventType::OtherMouseUp => { + if let Some(direction) = direction_for_button(ev.buttonNumber()) { + // Emit to the main window explicitly instead of + // broadcasting (`emit`) so navigation stays scoped if + // multi-window ever lands. "main" is the default label + // for the single configured window (see deep_link.rs). + let _ = app.emit_to("main", "mouse-nav", direction); + // Swallow the release: nothing downstream should also act + // on it. The matching press deliberately passes through: + // WKWebView never delivers X1/X2 to the page, so the + // unmatched down is inert, and swallowing presses risks + // interfering with AppKit behaviors keyed off mouse-down. + return std::ptr::null_mut(); + } + } + NSEventType::Swipe => { + if let Some(direction) = direction_for_swipe(ev.deltaX()) { + let _ = app.emit_to("main", "mouse-nav", direction); + } + // Pass swipes through: nothing else navigates on them, and + // swallowing mid-gesture events could confuse AppKit's + // gesture tracking. + } + _ => {} + } + + event.as_ptr() + }); + + // SAFETY: the block returns either null or the pointer it was given, both + // valid per the monitor contract. The returned monitor token is + // deliberately leaked: the monitor must live for the whole app lifetime. + let monitor = unsafe { + NSEvent::addLocalMonitorForEventsMatchingMask_handler( + NSEventMask::OtherMouseUp | NSEventMask::Swipe, + &block, + ) + }; + + if let Some(monitor) = monitor { + std::mem::forget(monitor); + } else { + eprintln!("buzz-desktop: mouse-nav: failed to install NSEvent monitor"); + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn button_3_is_back() { + assert_eq!(direction_for_button(3), Some("back")); + } + + #[test] + fn button_4_is_forward() { + assert_eq!(direction_for_button(4), Some("forward")); + } + + #[test] + fn other_buttons_do_not_navigate() { + for button in [0, 1, 2, 5, -1] { + assert_eq!(direction_for_button(button), None); + } + } + + #[test] + fn positive_swipe_delta_is_back() { + assert_eq!(direction_for_swipe(1.0), Some("back")); + assert_eq!(direction_for_swipe(0.5), Some("back")); + } + + #[test] + fn negative_swipe_delta_is_forward() { + assert_eq!(direction_for_swipe(-1.0), Some("forward")); + assert_eq!(direction_for_swipe(-0.5), Some("forward")); + } + + #[test] + fn zero_delta_swipe_begin_event_is_ignored() { + assert_eq!(direction_for_swipe(0.0), None); + } +} diff --git a/desktop/src-tauri/src/native_relay_client.rs b/desktop/src-tauri/src/native_relay_client.rs new file mode 100644 index 00000000000..2237076a926 --- /dev/null +++ b/desktop/src-tauri/src/native_relay_client.rs @@ -0,0 +1,962 @@ +//! Shared native relay session. +//! +//! Owns the authenticated relay socket for backend features that need live +//! subscriptions (archive sync today; persona catalog and catch-up next). One +//! session per (relay, pubkey) scope, multiplexing every subscription over a +//! single socket — a second socket per feature would multiply relay connection +//! slots and duplicate the NIP-42 handshake for no benefit. +//! +//! Built on `buzz-ws-client`, which owns the wire format and the NIP-42 +//! handshake. That crate is request/response shaped (one caller, `next_event` +//! off a buffer); the session lifecycle lives here instead of being pushed down +//! into it, because `buzz-cli` and `buzz-test-client` consume that crate and do +//! not want subscription bookkeeping. +//! +//! # Caller contract +//! +//! A subscription id's filter is immutable for the life of a session: to change +//! a filter, use a new id. See [`Subscription::id`] for why this cannot be +//! relaxed from inside this module. + +use std::{ + collections::{HashMap, HashSet}, + sync::Arc, + time::Duration, +}; + +use buzz_ws_client_pkg::{NostrWsConnection, RelayMessage}; +use nostr::{Event, Keys}; +use tokio::{ + sync::{mpsc, oneshot, Mutex}, + time::Instant, +}; +use tokio_util::sync::CancellationToken; + +/// Backoff floor for reconnect attempts. +const RECONNECT_BASE_DELAY: Duration = Duration::from_millis(500); +/// Backoff ceiling. Matches the renderer session's ceiling so a relay outage +/// produces one retry cadence across the app rather than two competing ones. +const RECONNECT_MAX_DELAY: Duration = Duration::from_secs(30); +/// How long a read may block before the loop re-checks cancellation. Not a +/// connection timeout: an idle relay is normal, so a lapsed read just loops. +const READ_TIMEOUT: Duration = Duration::from_secs(30); +/// Backoff floor for reopening a subscription the relay CLOSED. Matches +/// `RETRY_BASE_DELAY_MS` in `relayClosedRecovery.ts`. +const CLOSED_RETRY_BASE_DELAY: Duration = Duration::from_secs(1); +/// Backoff ceiling for reopening a CLOSED subscription. Matches +/// `RETRY_MAX_DELAY_MS` in `relayClosedRecovery.ts`. +const CLOSED_RETRY_MAX_DELAY: Duration = Duration::from_secs(30); +/// Delay for a `rate-limited:` CLOSED that carries no `retry in Ns` hint. +/// Matches `DEFAULT_RATE_LIMIT_SECONDS` on both sides of the client. +const CLOSED_RATE_LIMIT_DEFAULT: Duration = Duration::from_secs(10); + +/// A live subscription request: a filter plus where its events go. +#[derive(Clone)] +pub(crate) struct Subscription { + /// Caller-stable key. Reused verbatim as the relay subscription id so a + /// resubscribe after reconnect replaces rather than duplicates. + /// + /// **An id's filter is immutable for the life of a session.** To change a + /// filter, use a new id — as `archive::sync` does by hashing scope and + /// kinds into the id. Reusing an id for a different filter is unsound and + /// cannot be made sound here: a CLOSED frame carries only the id, so a + /// rejection caused by the old filter is indistinguishable from one caused + /// by the new one, and would latch backoff (or a terminal stop) onto a + /// subscription that never failed. + pub(crate) id: String, + pub(crate) filter: serde_json::Value, +} + +/// An event delivered to the session owner, tagged with the subscription that +/// matched it. Callers demultiplex on `subscription_id`. +#[derive(Clone)] +pub(crate) struct MatchedEvent { + pub(crate) subscription_id: String, + pub(crate) event: Box, +} + +/// App-wide owner of the one native socket for the active `(relay, pubkey)` +/// scope. Features subscribe independently. +/// +/// Only the archive lifecycle may replace the installed scope, and only while +/// holding [`crate::archive::sync::ArchiveOwnership`]; see [`Self::session`] +/// for why finite callers get a non-destructive lease instead. +#[derive(Default)] +pub(crate) struct NativeRelayClient { + current: Mutex>, +} + +struct ManagedSession { + scope: (String, String), + session: Arc, +} + +/// A session borrowed by a finite-request caller, plus whether that caller owns +/// it. Dropping the lease shuts down a private session and leaves a shared one +/// running for the feature that installed it. +/// +/// Exists because a finite caller cannot be trusted to shut the session down by +/// hand: it must not call [`RelaySession::shutdown`] on the shared session, and +/// it must call it on a private one or the socket outlives the request. Tying +/// both to the drop makes the correct behavior the only reachable one. +pub(crate) struct SessionLease { + session: Arc, + /// Set only for a session this lease alone can see, which is therefore the + /// lease's to cancel. + private: bool, +} + +impl std::ops::Deref for SessionLease { + type Target = RelaySession; + + fn deref(&self) -> &Self::Target { + &self.session + } +} + +impl SessionLease { + /// Clones the underlying handle for a task that outlives this binding, as + /// the catch-up fan-out does. Only the lease cancels the session, so the + /// clone must not outlive it. + pub(crate) fn handle(&self) -> Arc { + Arc::clone(&self.session) + } +} + +impl Drop for SessionLease { + fn drop(&mut self) { + if self.private { + self.session.shutdown(); + } + } +} + +impl NativeRelayClient { + /// Installs the session for `scope`, shutting down whatever scope held the + /// slot. Destructive on entry, so every caller must already hold proof it + /// is the current owner — today that is + /// [`crate::archive::sync::ArchiveOwnership`]. + async fn ensure_session(&self, relay_url: String, keys: Keys) -> Arc { + let scope = (relay_url.clone(), keys.public_key().to_hex()); + let mut current = self.current.lock().await; + if let Some(managed) = current.as_ref().filter(|managed| managed.scope == scope) { + return Arc::clone(&managed.session); + } + if let Some(previous) = current.take() { + previous.session.shutdown(); + } + let session = start_managed(relay_url, keys, None); + *current = Some(ManagedSession { + scope, + session: Arc::clone(&session), + }); + session + } + + /// Leases a session for a finite request, never displacing another scope. + /// + /// Finite callers (persona catalog, unread catch-up) hold no ownership + /// proof and cannot obtain one: they are not part of the archive lifecycle. + /// So this is the non-destructive half of the split — it shares the + /// installed session when the scope matches, and otherwise runs the request + /// on a private session that the lease shuts down on drop. + /// + /// A mismatch is deliberately NOT treated as "the caller is stale". These + /// commands are not ordered against archive lifecycle in either direction: + /// a catalog fetch for the community the user just opened routinely arrives + /// *before* that community's `start_archive_sync`, while the previous + /// scope's session is still installed. From inside this lock an early + /// caller and a late one are indistinguishable — both differ from the + /// installed scope — so refusing (or fencing on a generation counter, which + /// answers the same question) would fail the current caller as often as the + /// stale one. Serving both on their own socket is correct for either, and + /// whichever is genuinely stale has its result discarded by the scope + /// re-check each command performs before returning. + /// + /// Filling an empty slot is deliberate: at startup the catalog fetch + /// commonly precedes archive sync, and installing here means the archive + /// start that follows reuses this socket instead of opening a second one. + pub(crate) async fn session(&self, relay_url: String, keys: Keys) -> SessionLease { + let scope = (relay_url.clone(), keys.public_key().to_hex()); + let mut current = self.current.lock().await; + if let Some(managed) = current.as_ref() { + return if managed.scope == scope { + SessionLease { + session: Arc::clone(&managed.session), + private: false, + } + } else { + SessionLease { + session: start_managed(relay_url, keys, None), + private: true, + } + }; + } + let session = start_managed(relay_url, keys, None); + *current = Some(ManagedSession { + scope, + session: Arc::clone(&session), + }); + SessionLease { + session, + private: false, + } + } + + /// Returns the shared session for `(relay_url, keys)` plus the archive + /// event stream, replacing any session for a different scope. + /// + /// Requires proof of archive-sync ownership because both halves are + /// destructive on entry: `ensure_session` shuts down a different scope's + /// socket, and `attach_archive` replaces the session's archive sender, so a + /// superseded caller would steal the live stream from the current owner. + /// The token is un-constructible outside `archive::sync` and holds the + /// ownership locks for its lifetime, so a stale start cannot reach this + /// call. See [`crate::archive::sync::ArchiveOwnership`]. + pub(crate) async fn archive_session( + &self, + relay_url: String, + keys: Keys, + _ownership: &crate::archive::sync::ArchiveOwnership<'_>, + ) -> (Arc, mpsc::Receiver) { + let session = self.ensure_session(relay_url, keys).await; + let event_rx = session.attach_archive().await; + (session, event_rx) + } +} + +pub(crate) struct RelaySession { + state: Arc>, + requests: Arc>>, + /// The archive is the sole persistent-event consumer. Sending through its + /// bounded channel is awaited by the socket loop, preserving the + /// backpressure required by live-only (`limit: 0`) subscriptions: dropping + /// an event here cannot be repaired by replaying it later. + archive_events: Arc>>>, + wake: mpsc::Sender<()>, + cancel: CancellationToken, +} + +struct PendingRequest { + events: Vec, + complete: oneshot::Sender, String>>, +} + +/// Desired set plus the write-time record of what has left it. +/// +/// One lock covers both because reconcile must read them together: snapshotting +/// the desired set and draining `removed` in separate acquisitions lets a +/// `set_subscriptions` land in the gap, so the drain would be consumed against +/// a stale snapshot and could reopen a subscription the caller just dropped. +#[derive(Default)] +struct SessionState { + desired: Vec, + transient: Vec, + /// Ids whose exact subscription has left `desired` since the last + /// reconcile drained this. Written here rather than derived at reconcile + /// time because reconcile cannot derive it: wakes coalesce, so a remove + /// followed by a re-add is observed as a single pass whose desired set + /// never lost the id. See the eviction table on `retries`. + removed: HashSet, +} + +impl SessionState { + /// Installs a new desired set, recording every departure. + /// + /// Returns the ids whose filter changed under a reused id — a violation of + /// the immutable-filter-per-id contract on [`Subscription::id`]. This is + /// the only place that can detect one: the write side alone holds the old + /// and new filter for an id. Behavior after a violation is deliberately + /// unspecified; detection is all this offers. + fn replace_desired(&mut self, subscriptions: Vec) -> Vec { + let mut violations = Vec::new(); + for previous in std::mem::replace(&mut self.desired, subscriptions) { + // Departure is keyed on the exact subscription, not the id alone: + // the relay replaces by id, so a changed filter retires the old + // subscription just as surely as dropping the id would, and its + // backoff must not be inherited. + let survivor = self.desired.iter().find(|next| next.id == previous.id); + if survivor.is_some_and(|next| next.filter == previous.filter) { + continue; + } + if survivor.is_some() { + violations.push(previous.id.clone()); + } + self.removed.insert(previous.id); + } + violations + } +} + +impl RelaySession { + async fn attach_archive(&self) -> mpsc::Receiver { + let (events, receiver) = mpsc::channel(256); + *self.archive_events.lock().await = Some(events); + receiver + } + + /// Fetches one finite page over this session without disturbing persistent + /// feature subscriptions. Request ids are fresh, so CLOSED/backoff history + /// can never leak between pages or into a long-lived subscription. + pub(crate) async fn fetch_events( + &self, + filter: serde_json::Value, + timeout: Duration, + ) -> Result, String> { + let id = format!("native-fetch-{}", uuid::Uuid::new_v4()); + let (complete, result) = oneshot::channel(); + self.requests.lock().await.insert( + id.clone(), + PendingRequest { + events: Vec::new(), + complete, + }, + ); + { + let mut state = self.state.lock().await; + state.transient.push(Subscription { + id: id.clone(), + filter, + }); + } + let _ = self.wake.try_send(()); + + let outcome = tokio::select! { + _ = self.cancel.cancelled() => Err("relay session cancelled".to_string()), + value = tokio::time::timeout(timeout, result) => match value { + Ok(Ok(value)) => value, + Ok(Err(_)) => Err("relay request ended before EOSE".to_string()), + Err(_) => Err("relay request timed out".to_string()), + } + }; + self.finish_request(&id).await; + outcome + } + + async fn finish_request(&self, id: &str) { + self.requests.lock().await.remove(id); + let mut state = self.state.lock().await; + state.transient.retain(|subscription| subscription.id != id); + state.removed.insert(id.to_string()); + drop(state); + let _ = self.wake.try_send(()); + } + + /// Replaces the desired subscription set and wakes the loop to reconcile. + /// + /// Reconciliation is declarative rather than incremental: callers state + /// what they want and the loop diffs. An incremental add/remove API would + /// have to be replayed in order across a reconnect, which is exactly the + /// bug class this avoids. + /// + /// It is also why `open` needs no revision/generation guard. Every + /// reconcile re-reads the current desired set, so a change that lands + /// mid-pass is picked up by the wake it queued rather than having to + /// invalidate work already in flight. + /// + /// That argument holds only for state that is a function of the final + /// desired set. It does not hold for `retries`, whose validity depends on + /// the id having been *continuously* desired — history that coalescing + /// erases. So departures are recorded here, at the only point that can see + /// them. + pub(crate) async fn set_subscriptions(&self, subscriptions: Vec) { + let violations = self.state.lock().await.replace_desired(subscriptions); + for id in violations { + eprintln!( + "buzz-desktop: native_relay_client: subscription {id} changed filter under a \ + reused id; ids must be derived from their filter" + ); + } + // A full channel already means "reconcile pending", so a failed send + // is success: the loop has not yet consumed the previous wake. + let _ = self.wake.try_send(()); + } + + pub(crate) fn shutdown(&self) { + self.cancel.cancel(); + } +} + +/// Starts a session against `relay_url` authenticated as `keys`. +/// +/// Returns the handle plus the receiver for matched events. The session +/// reconnects on drop with exponential backoff and resubscribes the current +/// desired set — never a snapshot captured at connect time, so a subscription +/// change during an outage is honored by the reconnect that follows. +#[cfg(test)] +pub(crate) async fn start( + relay_url: String, + keys: Keys, + auth_tag: Option, +) -> (Arc, mpsc::Receiver) { + let session = start_managed(relay_url, keys, auth_tag); + let events = session.attach_archive().await; + (session, events) +} + +fn start_managed(relay_url: String, keys: Keys, auth_tag: Option) -> Arc { + let (wake, wake_rx) = mpsc::channel(1); + let session = Arc::new(RelaySession { + state: Arc::new(Mutex::new(SessionState::default())), + requests: Arc::new(Mutex::new(HashMap::new())), + archive_events: Arc::new(Mutex::new(None)), + wake, + cancel: CancellationToken::new(), + }); + + tauri::async_runtime::spawn(run_session( + relay_url, + keys, + auth_tag, + Arc::clone(&session), + wake_rx, + )); + + session +} + +async fn run_session( + relay_url: String, + keys: Keys, + auth_tag: Option, + session: Arc, + mut wake_rx: mpsc::Receiver<()>, +) { + let mut delay = RECONNECT_BASE_DELAY; + loop { + if session.cancel.is_cancelled() { + return; + } + + match NostrWsConnection::connect_authenticated(&relay_url, &keys, auth_tag.as_ref()).await { + Ok(conn) => { + // A connection that authenticated is healthy regardless of how + // long it then lived, so backoff resets here rather than on + // clean exit — a socket that drops after one event must not + // inherit the previous failure's delay. + delay = RECONNECT_BASE_DELAY; + run_connection(conn, &session, &mut wake_rx).await; + } + Err(error) => { + eprintln!("buzz-desktop: native_relay_client: connect failed: {error}"); + } + } + + if session.cancel.is_cancelled() { + return; + } + tokio::select! { + _ = session.cancel.cancelled() => return, + _ = tokio::time::sleep(delay) => {} + } + delay = (delay * 2).min(RECONNECT_MAX_DELAY); + } +} + +/// Drives one connected socket until it drops or the session is cancelled. +async fn run_connection( + mut conn: NostrWsConnection, + session: &RelaySession, + wake_rx: &mut mpsc::Receiver<()>, +) { + // Subscription ids currently open ON THIS SOCKET. Deliberately local: a new + // socket has none, so reconnect resubscribes the full desired set without + // any explicit "resubscribe" path that could drift from the normal one. + let mut open: HashMap = HashMap::new(); + // Reopen schedule for ids the relay CLOSED, keyed the same way and equally + // local — for the same reason and one more. Backoff state cannot live in + // `desired`: that set is reloaded from SQLite by the archive task, so a + // subscription deleted there is re-added by the next reload. The JS port + // could delete from its subscription map because that map WAS the desired + // set; here the two are separate, and only this one is per-socket. + // + // An entry is valid only while its id has been continuously desired since + // the CLOSED that created it, which makes eviction the whole design: + // + // | Eviction trigger | Where | Why it is the right edge | + // |---|---|---| + // | event delivered | the EVENT arm below | the subscription is demonstrably healthy | + // | EOSE | the EOSE arm below | the relay served it, so the cause has cleared | + // | id leaves the desired set, including intermediate states the loop never observes | `SessionState::removed`, drained at the top of `reconcile` | validity depends on history, and coalesced wakes erase it — see `set_subscriptions` | + // | socket drops | this map is per-connection | relay policy and our own auth can change across a reconnect | + // + // Reconcile deliberately does NOT also prune ids merely absent from the + // desired snapshot. That clause is unreachable: entries are minted only for + // ids present in `open` (the CLOSED arm's guard below), ids enter `open` + // only from a desired snapshot, and every departure from desired is + // recorded at write time. It would kill no mutant these tests do not + // already kill, while masking the drain that does the work. + let mut retries: HashMap = HashMap::new(); + + if !reconcile(&mut conn, session, &mut open, &mut retries).await { + return; + } + + loop { + // Earliest pending reopen, or `None` when nothing is scheduled. The arm + // below is disabled in that case rather than sleeping on a far-future + // instant, so an idle connection never wakes on this branch. + let retry_at = retries.values().filter_map(|retry| retry.due_at).min(); + + tokio::select! { + _ = session.cancel.cancelled() => { + let _ = conn.disconnect().await; + return; + } + Some(()) = wake_rx.recv() => { + if !reconcile(&mut conn, session, &mut open, &mut retries).await { + return; + } + } + // The edge that makes a CLOSED recoverable. Without it, nothing + // re-enters `reconcile` unless the desired set changes again, and + // for a stable set that means the subscription is dead for the life + // of the socket. + _ = tokio::time::sleep_until(retry_at.unwrap_or_else(Instant::now)), + if retry_at.is_some() => + { + for retry in retries.values_mut() { + if retry.due_at.is_some_and(|due| due <= Instant::now()) { + retry.due_at = None; + } + } + if !reconcile(&mut conn, session, &mut open, &mut retries).await { + return; + } + } + message = conn.next_event(READ_TIMEOUT) => { + match message { + Ok(RelayMessage::Event { subscription_id, event }) => { + // Only forward events for a subscription we still want. + // A CLOSE races in flight with events already queued at + // the relay, so this is the last line of defense + // against delivering out-of-scope events after a change. + // + // This arm drops rather than heals: an event for an id + // we do not have open is generation-ambiguous — it may + // predate a deletion — so it cannot serve as the fence + // an EOSE does. The EOSE arm below is where an + // open-map mismatch is repaired. + if !open.contains_key(&subscription_id) { + continue; + } + let pending = session + .requests + .lock() + .await + .contains_key(&subscription_id); + if pending { + // Reject forged finite-request events before + // retaining them, bounding memory at the transport + // seam. The catalog re-verifies defensively before + // head selection. + if event.verify().is_err() { + continue; + } + if let Some(request) = session + .requests + .lock() + .await + .get_mut(&subscription_id) + { + request.events.push(*event); + } + continue; + } + // Delivery proves the subscription is healthy, so any + // accumulated backoff for it is stale. Mirrors the JS + // port's per-event `closedRetryAttempt = 0`. + retries.remove(&subscription_id); + // Persistent archive subscriptions are live-only, so + // losing an event cannot be repaired with a later REQ. + // Await the bounded archive channel to push back on the + // socket read loop instead. Finite catalog requests are + // fulfilled above and never enter this channel. + // Because this await is outside the session-cancel select, + // teardown depends on `run_sync` dropping its receiver; moving + // ownership or spawning that teardown can strand the socket loop. + let sender = session.archive_events.lock().await.clone(); + if let Some(sender) = sender { + let _ = sender + .send(MatchedEvent { + subscription_id, + event, + }) + .await; + } + } + Ok(RelayMessage::Closed { subscription_id, message }) => { + // The relay dropped it; forget it so a reopen re-sends + // REQ rather than assuming it is still live. + // + // A CLOSED for a subscription this socket is not + // running is stale — our own CLOSE raced it, exactly as + // the EVENT arm above guards. Minting retry state from + // it would resurrect the entry the drain just pruned, + // and nothing would evict it: the id is gone from + // `desired`, so no future removal can record it again. + if open.remove(&subscription_id).is_none() { + continue; + } + if let Some(request) = session.requests.lock().await.remove(&subscription_id) { + let _ = request.complete.send(Err(format!("relay closed request: {message}"))); + let mut state = session.state.lock().await; + state.transient.retain(|subscription| subscription.id != subscription_id); + state.removed.insert(subscription_id.clone()); + drop(state); + let _ = session.wake.try_send(()); + continue; + } + let retry = retries.entry(subscription_id.clone()).or_default(); + retry.schedule(&message); + eprintln!( + "buzz-desktop: native_relay_client: relay closed {subscription_id}: {message}" + ); + } + Ok(RelayMessage::Eose { subscription_id }) => { + // The relay served this subscription, so whatever + // caused an earlier CLOSED has cleared. Same reset the + // JS port performs in `handleSubscriptionEose`, and it + // is what keeps an intermittent relay from ratcheting + // its way to the 30s ceiling and staying there. + let was_open = open.contains_key(&subscription_id); + if let Some(request) = session.requests.lock().await.remove(&subscription_id) { + let _ = request.complete.send(Ok(request.events)); + let mut state = session.state.lock().await; + state.transient.retain(|subscription| subscription.id != subscription_id); + state.removed.insert(subscription_id.clone()); + drop(state); + let _ = session.wake.try_send(()); + continue; + } + retries.remove(&subscription_id); + // The relay is running a subscription this socket does + // not think is open, so the two disagree. EOSE is the + // fence that makes this recoverable: frames on one + // socket are ordered, so a stale CLOSED from a previous + // generation of this id necessarily precedes the + // recreated generation's EOSE. Without this wake a + // terminal stale CLOSED is a blackhole — it clears + // `open`, sets no `due_at`, and so leaves no edge back + // into reconcile while the relay delivers events the + // EVENT arm silently drops. + // + // Deliberately not on the EVENT arm: an event for an + // absent id may belong to the old generation, so it is + // not a fence. Converges rather than storms — the + // reconcile this triggers reopens the id, and the + // replacement EOSE then finds it open. + if !was_open { + let _ = session.wake.try_send(()); + } + } + Ok(_) => {} + Err(error) => { + if !is_read_timeout(&error) { + eprintln!("buzz-desktop: native_relay_client: read failed: {error}"); + return; + } + } + } + } + } + } +} + +/// Brings the socket's open subscriptions in line with the desired set. +/// +/// Returns false when the socket failed and the caller should reconnect. +async fn reconcile( + conn: &mut NostrWsConnection, + session: &RelaySession, + open: &mut HashMap, + retries: &mut HashMap, +) -> bool { + // Snapshot and drain in ONE acquisition. Taking them separately would let a + // `set_subscriptions` land in the gap, spending its removal against a + // desired set captured before it — reopening a subscription the caller had + // just dropped, with no record left to catch it on the next pass. + let (desired, removed) = { + let mut state = session.state.lock().await; + let removed = std::mem::take(&mut state.removed); + ( + state + .desired + .iter() + .chain(&state.transient) + .cloned() + .collect::>(), + removed, + ) + }; + + // Retry state is only valid while its id has been continuously desired + // since the CLOSED that created it. Every departure is here even when the + // id is desired again now, because the loop cannot see the gap: coalesced + // wakes make remove-then-re-add one pass whose desired set never lost it. + for id in removed { + retries.remove(&id); + } + + for id in open.keys().cloned().collect::>() { + if desired.iter().any(|s| s.id == id) { + continue; + } + if conn + .send_raw(&serde_json::json!(["CLOSE", id])) + .await + .is_err() + { + return false; + } + open.remove(&id); + } + + for sub in desired { + // A filter change under the same id must reopen, not be skipped: the + // relay replaces a subscription by id, so re-sending REQ is the update. + if open.get(&sub.id) == Some(&sub.filter) { + continue; + } + // Held back by a CLOSED: either waiting out its backoff, or terminal + // and never to be retried on this socket. Both are `is_blocked`, which + // is what keeps a relay that rejects on policy from being re-asked at + // the speed of the event loop. + if retries.get(&sub.id).is_some_and(ClosedRetry::is_blocked) { + continue; + } + if conn + .send_raw(&serde_json::json!(["REQ", sub.id, sub.filter])) + .await + .is_err() + { + return false; + } + open.insert(sub.id, sub.filter); + } + + true +} + +/// Reopen schedule for one subscription the relay CLOSED. +#[derive(Default)] +struct ClosedRetry { + /// When the reopen is due. `None` means "not waiting": either the delay has + /// elapsed and reconcile may re-send, or `terminal` latched. + due_at: Option, + /// Consecutive CLOSEDs, driving the exponential delay. Reset by a delivered + /// event or EOSE, both of which drop the whole entry. + attempts: u32, + /// The relay rejected this filter for a reason retrying cannot change. + terminal: bool, +} + +impl ClosedRetry { + /// True while reconcile must leave this subscription closed. + fn is_blocked(&self) -> bool { + self.terminal || self.due_at.is_some_and(|due| due > Instant::now()) + } + + /// Records a CLOSED and schedules the reopen its class calls for. + fn schedule(&mut self, message: &str) { + match classify_closed(message) { + // Auth, access, or filter errors will fail identically until + // something outside this socket changes, so stop asking. Scoped to + // this socket by construction: the state lives in `run_connection`, + // so a reconnect retries once through the normal path. That is + // deliberate — relay policy and our own auth can change across a + // reconnect, and one REQ per reconnect is bounded. + ClosedClass::Terminal => { + self.terminal = true; + self.due_at = None; + } + ClosedClass::RateLimited => { + // Arm the process-wide gate so the HTTP bridge backs off too, + // rather than keeping a second private notion of the same + // relay's back-pressure. + let hint = parse_retry_in_seconds(message); + crate::relay_admission::activate_rate_limit(hint); + let hinted = hint + .map(Duration::from_secs) + .unwrap_or(CLOSED_RATE_LIMIT_DEFAULT); + // The longer of the two: a short hint must not undercut a + // backoff already grown by repeated rejections. + self.due_at = Some(Instant::now() + self.backoff().max(hinted)); + self.attempts = self.attempts.saturating_add(1); + } + ClosedClass::Retryable => { + self.due_at = Some(Instant::now() + self.backoff()); + self.attempts = self.attempts.saturating_add(1); + } + } + } + + /// Exponential delay for the current attempt, capped. The shift is bounded + /// before it is taken, so a long-lived rejection cannot overflow its way + /// back down to a short delay. + fn backoff(&self) -> Duration { + CLOSED_RETRY_BASE_DELAY + .saturating_mul(1_u32 << self.attempts.min(16)) + .min(CLOSED_RETRY_MAX_DELAY) + } +} + +/// How a CLOSED message should be handled. +/// +/// Ported from `classifyRelayClosed` in `relayClosedPolicy.ts`; the prefixes are +/// the relay's own machine-readable NIP-01 classes and must stay in step with +/// that file. +#[derive(Debug, PartialEq, Eq)] +enum ClosedClass { + Retryable, + RateLimited, + Terminal, +} + +fn classify_closed(message: &str) -> ClosedClass { + let normalized = message.trim().to_ascii_lowercase(); + if normalized.starts_with("rate-limited:") { + return ClosedClass::RateLimited; + } + // `auth-required:` is deliberately absent, i.e. retryable: it occurs + // transiently when a REQ races the AUTH handshake after a reconnect, and + // the backoff reopen re-sends once authenticated. A session that is + // genuinely unauthenticated fails at `connect_authenticated` instead, so + // this cannot loop forever. + if [ + "restricted:", + "blocked:", + "invalid:", + "pow:", + "duplicate:", + "unsupported:", + "error: mixed search", + "error: too many subscriptions", + ] + .iter() + .any(|prefix| normalized.starts_with(prefix)) + { + return ClosedClass::Terminal; + } + ClosedClass::Retryable +} + +/// Parses the relay's canonical `retry in Ns` hint. Same format the HTTP bridge +/// parses in `relay::extract_retry_in_hint`. +fn parse_retry_in_seconds(message: &str) -> Option { + let after = &message[message.find("retry in ")? + "retry in ".len()..]; + after + .chars() + .take_while(char::is_ascii_digit) + .collect::() + .parse() + .ok() +} + +/// A lapsed read is an idle relay, not a failure. Distinguished by variant +/// rather than by message text so a reworded error cannot turn every idle +/// period into a reconnect storm. +fn is_read_timeout(error: &buzz_ws_client_pkg::WsClientError) -> bool { + matches!(error, buzz_ws_client_pkg::WsClientError::Timeout) +} + +#[cfg(test)] +#[path = "native_relay_client_tests.rs"] +mod closed_recovery_tests; + +#[cfg(test)] +mod relay_backed_tests { + use super::*; + use nostr::{EventBuilder, Tag}; + + /// Relay-backed proof that the session's wire shape is one a real relay + /// accepts and answers. + /// + /// Every other test in this commit drives `run_sync` through a fake + /// [`crate::archive::sync::ArchiveSyncIo`], which is the right default: + /// batching and demultiplexing are the logic worth pinning, and they must + /// not need a socket. But a fake cannot fail the one way this layer + /// actually can — by sending a REQ the relay rejects, or by filtering on a + /// tag key that matches nothing. The JS manager's filters were validated by + /// years of production traffic; this port's have been validated by my + /// reading of that code, which is exactly the claim a real relay can check + /// and I cannot. + /// + /// `#[ignore]`d because it needs a relay on `BUZZ_TEST_RELAY_URL`. Run: + /// + /// ```text + /// ./scripts/start-isolated-test-relay.sh # ws://localhost:3030 + /// BUZZ_TEST_RELAY_URL=ws://localhost:3030 \ + /// cargo test -p buzz-desktop -- --ignored archive_sync_session + /// ``` + #[tokio::test] + #[ignore = "requires a local relay (set BUZZ_TEST_RELAY_URL)"] + async fn archive_sync_session_receives_live_events_from_a_real_relay() { + let Ok(relay_url) = std::env::var("BUZZ_TEST_RELAY_URL") else { + panic!("set BUZZ_TEST_RELAY_URL to a running relay"); + }; + + let owner = Keys::generate(); + let author = Keys::generate(); + let owner_pk = owner.public_key(); + + // Kind 1 rather than the archive's own kind 24200. Publishing a real + // observer frame requires a registered agent-owner binding in the + // relay's database — a relay ACL concern that says nothing about this + // layer. What this test can prove, and what no fake can, is the wire + // shape: that the `#p` tag key and the `limit: 0` live tail produce a + // REQ a real relay accepts and answers. Scope demultiplexing on the + // archive side is covered in `archive/sync_tests.rs`. + let (session, mut events) = start(relay_url.clone(), owner.clone(), None).await; + session + .set_subscriptions(vec![Subscription { + id: "archive:owner_p:test".to_string(), + filter: serde_json::json!({ + "kinds": [1], + "limit": 0, + "#p": [owner_pk.to_hex()], + }), + }]) + .await; + + // The subscription must be live at the relay before the event is + // published. A `limit: 0` filter is a live tail: it replays nothing, + // so anything published into a not-yet-open subscription is missed. + // That is the same ordering hazard the renderer start gate exists to + // prevent for the ephemeral archive kind. + tokio::time::sleep(Duration::from_secs(1)).await; + + let mut publisher = NostrWsConnection::connect_authenticated(&relay_url, &author, None) + .await + .expect("publisher connect"); + let frame = EventBuilder::text_note("archive-sync-probe") + .tag(Tag::public_key(owner_pk)) + .sign_with_keys(&author) + .expect("sign event"); + let frame_id = frame.id.to_hex(); + let ok = publisher.send_event(frame).await.expect("publish frame"); + assert!( + ok.accepted, + "relay rejected the observer frame, so a delivery timeout below would \ + blame the subscription for a publish failure: {}", + ok.message + ); + + let received = tokio::time::timeout(Duration::from_secs(10), events.recv()) + .await + .expect("timed out waiting for the relay to deliver the frame") + .expect("session channel closed"); + + assert_eq!( + received.subscription_id, "archive:owner_p:test", + "delivered event must carry the subscription id the loop demultiplexes on" + ); + assert_eq!( + received.event.id.to_hex(), + frame_id, + "must deliver the published frame" + ); + + session.shutdown(); + } +} diff --git a/desktop/src-tauri/src/native_relay_client_tests.rs b/desktop/src-tauri/src/native_relay_client_tests.rs new file mode 100644 index 00000000000..96ec39a4bf0 --- /dev/null +++ b/desktop/src-tauri/src/native_relay_client_tests.rs @@ -0,0 +1,896 @@ +//! Lifecycle tests for [`super`]'s CLOSED recovery and subscription bookkeeping. +//! +//! Split out of `native_relay_client.rs` to keep that file under the desktop +//! file-size ratchet. Same `#[path]` sibling-module convention as +//! `archive/sync.rs` and its `sync_tests.rs`. + +use super::*; +use futures_util::{SinkExt, StreamExt}; +use nostr::EventBuilder; +use tokio_tungstenite::tungstenite::protocol::Message; + +/// The subscription id every test below drives. +const PROBE_ID: &str = "archive:probe"; + +/// Minimal relay that completes the NIP-42 handshake, records every REQ, +/// and sends a CLOSED only when the test asks it to. +/// +/// A real socket rather than a fake `NostrWsConnection`, because the bug +/// this covers lives in the lifecycle between frames — the loop's only +/// reconcile triggers — and a fake that hands the loop a `Closed` value +/// cannot show that a REQ went back out over the wire afterwards. Same +/// `accept_async` stub shape as `native_websocket.rs`'s live-TCP tests. +/// +/// CLOSED is test-driven rather than a scripted reply to the first REQ so +/// the test can wait for the session to go quiet first. `set_subscriptions` +/// queues a wake that may still be pending when an immediate CLOSED lands, +/// and that wake reopens the subscription on its own — which made the first +/// version of this test pass against the unfixed code. +/// +/// `frames` reports REQ and CLOSE in wire order, not REQ alone: the +/// lifecycle tests below assert that a CLOSE was sent before the REQ that +/// follows it, which a REQ-only channel cannot express. +async fn stub_relay() -> (String, mpsc::Receiver, mpsc::Sender) { + let listener = tokio::net::TcpListener::bind("127.0.0.1:0") + .await + .expect("bind stub relay"); + let address = listener.local_addr().expect("stub relay address"); + let (req_tx, req_rx) = mpsc::channel(16); + let (closed_tx, mut closed_rx) = mpsc::channel::(4); + + tokio::spawn(async move { + let (stream, _) = listener.accept().await.expect("accept"); + let mut socket = tokio_tungstenite::accept_async(stream) + .await + .expect("websocket handshake"); + + socket + .send(Message::Text(r#"["AUTH","stub-challenge"]"#.into())) + .await + .expect("send challenge"); + + loop { + tokio::select! { + incoming = socket.next() => { + let Some(Ok(Message::Text(text))) = incoming else { return }; + let Ok(frame) = serde_json::from_str::(&text) else { + continue; + }; + match frame[0].as_str() { + Some("AUTH") => { + let id = frame[1]["id"].as_str().unwrap_or_default(); + socket + .send(Message::Text( + serde_json::json!(["OK", id, true, ""]).to_string().into(), + )) + .await + .expect("send auth ok"); + } + Some("REQ") => { + let id = frame[1].as_str().unwrap_or_default().to_string(); + if req_tx.send(Frame::Req(id)).await.is_err() { + return; + } + } + Some("CLOSE") => { + let id = frame[1].as_str().unwrap_or_default().to_string(); + if req_tx.send(Frame::Close(id)).await.is_err() { + return; + } + } + _ => {} + } + } + Some(command) = closed_rx.recv() => { + let frame = match command { + StubCommand::Closed(id, message) => { + serde_json::json!(["CLOSED", id, message]) + } + StubCommand::Eose(id) => serde_json::json!(["EOSE", id]), + StubCommand::Event(id, event) => { + serde_json::json!(["EVENT", id, event]) + } + }; + socket + .send(Message::Text(frame.to_string().into())) + .await + .expect("send stub frame"); + } + } + } + }); + + (format!("ws://{address}"), req_rx, closed_tx) +} + +/// A client→relay frame the stub observed, in wire order. +#[derive(Debug, PartialEq, Eq)] +enum Frame { + Req(String), + Close(String), +} + +/// A relay→client frame the test asks the stub to emit. +enum StubCommand { + Closed(String, String), + Eose(String), + Event(String, serde_json::Value), +} + +fn probe_subscription() -> Subscription { + Subscription { + id: PROBE_ID.to_string(), + filter: serde_json::json!({ "kinds": [1], "limit": 0 }), + } +} + +async fn next_frame(frames: &mut mpsc::Receiver, label: &str) -> Frame { + tokio::time::timeout(Duration::from_secs(10), frames.recv()) + .await + .unwrap_or_else(|_| panic!("timed out waiting for {label}")) + .unwrap_or_else(|| panic!("stub relay closed before {label}")) +} + +/// Waits for the next REQ, tolerating the CLOSE frames a reconcile sends +/// first. Asserting on `Frame::Req` directly would couple every test to +/// whether a particular reconcile also had cleanup to do. +async fn next_req(frames: &mut mpsc::Receiver, label: &str) -> String { + loop { + if let Frame::Req(id) = next_frame(frames, label).await { + return id; + } + } +} + +/// Waits out the wake `set_subscriptions` queued, so a CLOSED sent after +/// this cannot be reopened by anything but the CLOSED path itself. +/// +/// A pending wake is harmless while the subscription is still open — that +/// reconcile is a no-op — so draining it before the CLOSED is what makes +/// the assertion below attributable. +async fn settle() { + tokio::time::sleep(Duration::from_millis(500)).await; +} + +/// C's acceptance edge: a finite request shares the authenticated real socket +/// with a persistent subscription, completes on wire EOSE, and does not steal +/// later persistent delivery. A fake connection cannot establish any of those +/// transport/lifetime properties. +#[tokio::test] +async fn finite_fetch_multiplexes_with_persistent_delivery_on_a_real_websocket() { + let (relay_url, mut frames, commands) = stub_relay().await; + let (session, mut events) = start(relay_url, Keys::generate(), None).await; + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the persistent REQ").await, PROBE_ID); + + let fetch = { + let session = Arc::clone(&session); + tokio::spawn(async move { + session + .fetch_events( + serde_json::json!({ "kinds": [buzz_core_pkg::kind::KIND_PERSONA], "limit": 500 }), + Duration::from_secs(10), + ) + .await + }) + }; + let request_id = next_req(&mut frames, "the finite fetch REQ").await; + assert_ne!(request_id, PROBE_ID); + + let relay_keys = Keys::generate(); + let mut forged = EventBuilder::text_note("forged catalog page event") + .sign_with_keys(&relay_keys) + .unwrap(); + forged.content = "tampered after signing".into(); + commands + .send(StubCommand::Event( + request_id.clone(), + serde_json::to_value(forged).unwrap(), + )) + .await + .unwrap(); + let fetched = EventBuilder::text_note("catalog page event") + .sign_with_keys(&relay_keys) + .unwrap(); + commands + .send(StubCommand::Event( + request_id.clone(), + serde_json::to_value(&fetched).unwrap(), + )) + .await + .unwrap(); + commands + .send(StubCommand::Eose(request_id.clone())) + .await + .unwrap(); + + assert_eq!(fetch.await.unwrap().unwrap(), vec![fetched]); + assert_eq!( + next_frame(&mut frames, "finite fetch CLOSE").await, + Frame::Close(request_id) + ); + + let persistent = EventBuilder::text_note("persistent event after fetch") + .sign_with_keys(&relay_keys) + .unwrap(); + commands + .send(StubCommand::Event( + PROBE_ID.into(), + serde_json::to_value(&persistent).unwrap(), + )) + .await + .unwrap(); + let delivered = tokio::time::timeout(Duration::from_secs(10), events.recv()) + .await + .unwrap() + .unwrap(); + assert_eq!(delivered.subscription_id, PROBE_ID); + assert_eq!(*delivered.event, persistent); + session.shutdown(); +} + +async fn run_persistent_burst(drain_concurrently: bool) { + const BURST: usize = 1_200; + + let (relay_url, mut frames, commands) = stub_relay().await; + let (session, mut events) = start(relay_url, Keys::generate(), None).await; + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the burst REQ").await, PROBE_ID); + + let relay_keys = Keys::generate(); + let event = EventBuilder::text_note("persistent burst event") + .sign_with_keys(&relay_keys) + .unwrap(); + let send_burst = tokio::spawn({ + let commands = commands.clone(); + let event = serde_json::to_value(&event).unwrap(); + async move { + for _ in 0..BURST { + commands + .send(StubCommand::Event(PROBE_ID.into(), event.clone())) + .await + .unwrap(); + } + } + }); + + if !drain_concurrently { + // Let the bounded archive channel fill before draining. The socket loop + // must wait here rather than evicting live-only events. + tokio::time::sleep(Duration::from_millis(100)).await; + } + for _ in 0..BURST { + tokio::time::timeout(Duration::from_secs(60), events.recv()) + .await + .expect("timed out draining persistent burst") + .expect("archive receiver closed during persistent burst"); + } + send_burst.await.unwrap(); + + let after = EventBuilder::text_note("persistent event after burst") + .sign_with_keys(&relay_keys) + .unwrap(); + commands + .send(StubCommand::Event( + PROBE_ID.into(), + serde_json::to_value(&after).unwrap(), + )) + .await + .unwrap(); + let delivered = tokio::time::timeout(Duration::from_secs(60), events.recv()) + .await + .expect("timed out after persistent burst") + .expect("archive receiver closed after persistent burst"); + assert_eq!(*delivered.event, after); + session.shutdown(); +} + +/// Persistent archive subscriptions use `limit: 0`, so an event lost during a +/// slow-consumer burst cannot be replayed. Both a fast control and a receiver +/// that starts late must therefore get the whole burst and remain live after it. +#[tokio::test] +async fn persistent_delivery_applies_backpressure_without_losing_a_burst() { + run_persistent_burst(true).await; + run_persistent_burst(false).await; +} + +/// The blocker: a CLOSED with the desired set never changing again must +/// still reopen the subscription. +/// +/// Before the fix the loop removed the id from `open` and waited on a wake +/// that only `set_subscriptions` can produce, so a stable desired set left +/// the subscription dead for the life of the socket — silent permanent +/// loss for ephemeral kind 24200. +#[tokio::test] +async fn a_closed_subscription_reopens_without_a_desired_set_change() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + // Retryable class, sent once: the reopen is answered normally, so a + // failure here means "never retried" rather than "retried into another + // rejection". + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "error: temporary".into(), + )) + .await + .expect("stub relay accepts the closed command"); + + // No `set_subscriptions` between the two REQs: the reopen must come + // from the CLOSED itself, which is exactly the edge that was missing. + assert_eq!(next_req(&mut frames, "the reopened REQ").await, PROBE_ID); + + session.shutdown(); +} + +/// A relay that rejects on policy must not be re-asked in a tight loop. +#[tokio::test] +async fn a_terminal_closed_is_not_retried_on_the_same_socket() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "restricted: not authorized".into(), + )) + .await + .expect("stub relay accepts the closed command"); + + // Long enough that a retryable class (1s base) would have reopened + // several times, so this asserts suppression rather than just slowness. + let retried = tokio::time::timeout(Duration::from_secs(5), frames.recv()).await; + assert!( + retried.is_err(), + "a terminal CLOSED must not be retried on this socket, got {retried:?}" + ); + + session.shutdown(); +} + +/// M18: a subscription deleted and recreated must get a fresh REQ, even +/// though its terminal latch says never to retry. +/// +/// The latch is scoped to the subscription that earned it. Recreating the +/// id is a new subscription that happens to share a name — `archive::sync` +/// derives the id from scope and kinds, so a delete/recreate of the same +/// saved subscription produces a byte-identical id and would otherwise +/// inherit a permanent suppression for the life of the socket. +#[tokio::test] +async fn a_recreated_subscription_does_not_inherit_a_terminal_latch() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "restricted: not authorized".into(), + )) + .await + .expect("stub relay accepts the closed command"); + settle().await; + + // Delete, then recreate — each observed as its own reconcile. + session.set_subscriptions(vec![]).await; + settle().await; + session.set_subscriptions(vec![probe_subscription()]).await; + + assert_eq!( + next_req(&mut frames, "the REQ for the recreated subscription").await, + PROBE_ID, + ); + + session.shutdown(); +} + +/// M19: the same schedule, with both writes landing before the loop +/// consumes its single wake. +/// +/// This is the mutant that discriminates the mechanism. The wake channel +/// has capacity 1 and `set_subscriptions` only ever queues "reconcile +/// pending", so the delete and the recreate collapse into ONE observed +/// reconcile whose desired set already contains the id again. A prune that +/// reads only the current desired set never sees the id absent and leaves +/// the latch in place — passing the test above while failing this one. +/// The departure is therefore recorded at write time, where it is visible. +/// +/// No `settle()` between the two writes: that gap is the whole point, and +/// adding one would silently convert this into a duplicate of M18. +#[tokio::test] +async fn a_recreated_subscription_is_not_suppressed_when_the_writes_coalesce() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "restricted: not authorized".into(), + )) + .await + .expect("stub relay accepts the closed command"); + settle().await; + + session.set_subscriptions(vec![]).await; + session.set_subscriptions(vec![probe_subscription()]).await; + + assert_eq!( + next_req(&mut frames, "the REQ for the recreated subscription").await, + PROBE_ID, + ); + + session.shutdown(); +} + +/// M20: pruning must be scoped to departures, not run every pass. +/// +/// A reconcile triggered while the id is still desired must leave its +/// pending backoff alone. Clearing wholesale would collapse the CLOSED +/// backoff — every unrelated subscription change would re-ask a relay that +/// just rejected us, at the speed of the event loop. +#[tokio::test] +async fn a_reconcile_preserves_the_backoff_of_a_still_desired_subscription() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + // Rate-limited: a long, unambiguously pending backoff, so a reopen + // inside the window is the prune and not the timer. + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "rate-limited: slow down; retry in 30s".into(), + )) + .await + .expect("stub relay accepts the closed command"); + settle().await; + + // A change that adds an unrelated subscription. The probe never leaves + // the desired set, so its backoff must survive this reconcile. + session + .set_subscriptions(vec![ + probe_subscription(), + Subscription { + id: "archive:other".to_string(), + filter: serde_json::json!({ "kinds": [7], "limit": 0 }), + }, + ]) + .await; + + assert_eq!( + next_req(&mut frames, "the REQ for the newly added subscription").await, + "archive:other", + ); + let reopened = tokio::time::timeout(Duration::from_secs(3), frames.recv()).await; + assert!( + reopened.is_err(), + "a still-desired subscription must keep its pending backoff across a \ + reconcile, got {reopened:?}" + ); + + crate::relay_admission::reset_rate_limit_gate(); + session.shutdown(); +} + +/// M21: a CLOSED that arrives after we stopped running the subscription is +/// stale and must mint nothing. +/// +/// Our CLOSE races the relay's in-flight frames — the EVENT arm already +/// guards this. Without the same guard on CLOSED, the frame recreates the +/// retry entry the drain just removed, and nothing can evict it: the id is +/// gone from the desired set, so no future departure records it again. +#[tokio::test] +async fn a_closed_arriving_after_removal_does_not_mint_retry_state() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, _events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + // Delete first, and wait for our CLOSE to reach the wire: that ordering + // is what makes the CLOSED below arrive after the drain rather than + // before it, which is the schedule M18 and M19 do not cover. + session.set_subscriptions(vec![]).await; + assert_eq!( + next_frame(&mut frames, "the CLOSE for the deleted subscription").await, + Frame::Close(PROBE_ID.to_string()), + ); + + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "restricted: not authorized".into(), + )) + .await + .expect("stub relay accepts the closed command"); + settle().await; + + session.set_subscriptions(vec![probe_subscription()]).await; + + assert_eq!( + next_req(&mut frames, "the REQ for the recreated subscription").await, + PROBE_ID, + ); + + session.shutdown(); +} + +/// M22: a stale *terminal* CLOSED landing after the id was recreated must +/// not blackhole the live subscription. +/// +/// This one survives every defense above. The CLOSED is legitimately +/// attributed — the id is open again, so the M21 guard passes it — and +/// terminal means no `due_at`, so the timer arm is disabled and no wake is +/// pending. `open` loses the id while the relay keeps delivering, and the +/// EVENT arm drops every frame in silence. +/// +/// EOSE is the recovery edge because it is the only ordered fence +/// available: frames on one socket are totally ordered, so the previous +/// generation's CLOSED necessarily precedes the new generation's EOSE. +#[tokio::test] +async fn a_stale_terminal_closed_does_not_blackhole_a_recreated_subscription() { + let (relay_url, mut frames, closed) = stub_relay().await; + let (session, mut events) = start(relay_url, Keys::generate(), None).await; + + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!(next_req(&mut frames, "the initial REQ").await, PROBE_ID); + settle().await; + + // Delete and recreate, so the id is open again under a new generation. + session.set_subscriptions(vec![]).await; + assert_eq!( + next_frame(&mut frames, "the CLOSE for the deleted subscription").await, + Frame::Close(PROBE_ID.to_string()), + ); + session.set_subscriptions(vec![probe_subscription()]).await; + assert_eq!( + next_req(&mut frames, "the REQ for the recreated subscription").await, + PROBE_ID, + ); + settle().await; + + // The old generation's terminal CLOSED, delayed past the new REQ. + closed + .send(StubCommand::Closed( + PROBE_ID.into(), + "restricted: not authorized".into(), + )) + .await + .expect("stub relay accepts the closed command"); + // The new generation's EOSE, which the wire orders after it. + closed + .send(StubCommand::Eose(PROBE_ID.into())) + .await + .expect("stub relay accepts the eose command"); + + // The EOSE found the id closed, so it must drive a reconcile that + // reopens it. Nothing else can: terminal schedules no timer, and the + // desired set is stable. + assert_eq!( + next_req(&mut frames, "the REQ healing the open-map mismatch").await, + PROBE_ID, + ); + + // And the heal converges rather than storming: the replacement EOSE + // finds the id open, so it wakes nothing. + closed + .send(StubCommand::Eose(PROBE_ID.into())) + .await + .expect("stub relay accepts the second eose command"); + let extra = tokio::time::timeout(Duration::from_secs(3), frames.recv()).await; + assert!( + extra.is_err(), + "an EOSE for an already-open subscription must not re-reconcile, got {extra:?}" + ); + + // The point of the heal: events flow again. + let event = EventBuilder::text_note("post-heal") + .sign_with_keys(&Keys::generate()) + .expect("sign event"); + let event_id = event.id.to_hex(); + closed + .send(StubCommand::Event( + PROBE_ID.into(), + serde_json::to_value(&event).expect("serialize event"), + )) + .await + .expect("stub relay accepts the event command"); + + let delivered = tokio::time::timeout(Duration::from_secs(10), events.recv()) + .await + .expect("timed out waiting for an event after the heal") + .expect("session channel closed"); + assert_eq!( + delivered.event.id.to_hex(), + event_id, + "events must flow again once the open map is healed" + ); + + session.shutdown(); +} + +/// M23: reusing an id for a changed filter must be *detected*. +/// +/// This test pins detection and nothing else. Post-violation behavior — +/// whether the subscription reopens, what happens to its retry state, what +/// the relay is sent — is unspecified by design, because the wire carries +/// only the id and an in-flight CLOSED from the old filter is +/// indistinguishable from one caused by the new one. Asserting any of that +/// would turn an unsupported input into a supported one. +/// +/// It exists because the `(id, filter)` departure diff is otherwise +/// unpinned: on every supported path it is byte-equivalent to an id-only +/// diff, so a refactor could revert it, pass every other test here, and +/// silently remove the one signal that tells C and D they broke the +/// contract. +#[test] +fn a_filter_change_under_a_reused_id_is_reported_as_a_contract_violation() { + let mut state = SessionState::default(); + + assert!( + state.replace_desired(vec![probe_subscription()]).is_empty(), + "a first desired set violates nothing" + ); + assert!( + state.replace_desired(vec![probe_subscription()]).is_empty(), + "an unchanged subscription is not a filter change" + ); + + let violations = state.replace_desired(vec![Subscription { + id: PROBE_ID.to_string(), + filter: serde_json::json!({ "kinds": [7], "limit": 0 }), + }]); + + assert_eq!( + violations, + vec![PROBE_ID.to_string()], + "a filter changed under a reused id must be reported" + ); +} + +#[test] +fn closed_messages_classify_like_the_renderer_policy() { + assert_eq!( + classify_closed("rate-limited: quota exceeded; retry in 4s"), + ClosedClass::RateLimited + ); + assert_eq!( + classify_closed("restricted: not authorized"), + ClosedClass::Terminal + ); + assert_eq!( + classify_closed("error: too many subscriptions"), + ClosedClass::Terminal + ); + // Transient AUTH race, not a permanent rejection — the one prefix that + // looks terminal and deliberately is not. + assert_eq!( + classify_closed("auth-required: we can't serve unauthenticated"), + ClosedClass::Retryable + ); + assert_eq!(classify_closed(""), ClosedClass::Retryable); + // Case and padding come from the relay, not from us. + assert_eq!( + classify_closed(" RESTRICTED: nope "), + ClosedClass::Terminal + ); +} + +#[test] +fn retry_delay_grows_and_stops_at_the_ceiling() { + let mut retry = ClosedRetry::default(); + assert_eq!(retry.backoff(), CLOSED_RETRY_BASE_DELAY); + + retry.schedule("error: temporary"); + assert_eq!(retry.backoff(), CLOSED_RETRY_BASE_DELAY * 2); + + for _ in 0..40 { + retry.schedule("error: temporary"); + } + assert_eq!( + retry.backoff(), + CLOSED_RETRY_MAX_DELAY, + "backoff must saturate at the ceiling rather than wrapping" + ); +} + +#[test] +fn a_rate_limited_closed_waits_at_least_the_relay_hint() { + let mut retry = ClosedRetry::default(); + retry.schedule("rate-limited: quota exceeded; retry in 12s"); + + let due = retry.due_at.expect("rate-limited must schedule a reopen"); + // The hint dominates the 1s first backoff, so this asserts the hint was + // honored rather than that anything at all was scheduled. + assert!( + due >= Instant::now() + Duration::from_secs(11), + "a 12s hint must not be undercut by the base backoff" + ); + crate::relay_admission::reset_rate_limit_gate(); +} + +#[test] +fn a_hintless_rate_limited_closed_uses_the_shared_default() { + let mut retry = ClosedRetry::default(); + retry.schedule("rate-limited: quota exceeded"); + + let due = retry.due_at.expect("rate-limited must schedule a reopen"); + assert!( + due >= Instant::now() + CLOSED_RATE_LIMIT_DEFAULT - Duration::from_secs(1), + "a hintless rate-limit must fall back to the shared default window" + ); + crate::relay_admission::reset_rate_limit_gate(); +} + +#[test] +fn retry_hints_parse_the_relays_canonical_format() { + assert_eq!( + parse_retry_in_seconds("rate-limited: quota exceeded; retry in 4s"), + Some(4) + ); + assert_eq!(parse_retry_in_seconds("rate-limited: quota exceeded"), None); + assert_eq!(parse_retry_in_seconds("retry in s"), None); +} + +// ── Scope fencing at the client boundary ───────────────────────────────────── +// +// `ensure_session` is destructive on entry: a different scope's socket is shut +// down before the new one is installed. The archive lifecycle earns that right +// with `ArchiveOwnership`; the persona catalog and unread catch-up hold no such +// proof and reach the client through `session` instead. +// +// These tests drive `ensure_session` directly rather than `archive_session`, +// because `ArchiveOwnership` is un-constructible outside `archive::sync` — the +// compiler already enforces that half. `archive_session` delegates to +// `ensure_session` with no other effect on the slot, so this stages the exact +// state a live archive leaves behind. +// +// The relay URLs never accept a connection. Nothing here waits on a socket: +// the session task is spawned, its connect fails, and it backs off — while the +// slot bookkeeping and cancellation these tests assert on are synchronous. + +/// A scope's relay URL. Distinct ports, on a closed loopback address, so the +/// two scopes are unequal and neither can connect. +fn scope_url(port: u16) -> String { + format!("ws://127.0.0.1:{port}") +} + +async fn installed_session(client: &NativeRelayClient) -> Option> { + client + .current + .lock() + .await + .as_ref() + .map(|managed| Arc::clone(&managed.session)) +} + +/// The required regression: a finite request that resumes after the scope +/// switched must not disturb the new scope's live session. +/// +/// Staged in the order the bug needs — archive A installed, scope switches and +/// archive B installs, and only then does A's delayed fetch acquire. Against +/// the unfenced `session` (a straight `ensure_session` call) A's late arrival +/// shut B's socket down and installed its own, leaving B's archive attached to +/// a cancelled session: no events, no error, until the next lifecycle edge. +#[tokio::test] +async fn a_stale_finite_request_cannot_displace_the_new_scopes_session() { + let client = NativeRelayClient::default(); + let scope_a = (scope_url(9), Keys::generate()); + let scope_b = (scope_url(10), Keys::generate()); + + let archive_a = client + .ensure_session(scope_a.0.clone(), scope_a.1.clone()) + .await; + let archive_b = client + .ensure_session(scope_b.0.clone(), scope_b.1.clone()) + .await; + assert!( + archive_a.cancel.is_cancelled(), + "the archive lifecycle must still replace its own scope's session" + ); + + // Scope A's in-flight catalog/catch-up command, resuming late. + let stale = client.session(scope_a.0.clone(), scope_a.1.clone()).await; + + assert!( + !archive_b.cancel.is_cancelled(), + "a stale finite request cancelled the live scope's session; its archive \ + is now attached to a dead socket and will sit silent until the next \ + lifecycle edge" + ); + let installed = installed_session(&client) + .await + .expect("the slot must still hold a session"); + assert!( + Arc::ptr_eq(&installed, &archive_b), + "a stale finite request replaced the installed session, so the next \ + same-scope caller shares the wrong socket" + ); + assert!( + !Arc::ptr_eq(&stale.session, &archive_b), + "the stale request must run on its own session, not the live scope's" + ); + + // Its own session is the lease's to end, and it must actually end: an + // un-cancelled private session leaks a reconnecting socket per request. + let private = stale.handle(); + drop(stale); + assert!( + private.cancel.is_cancelled(), + "dropping a private lease must shut its session down" + ); +} + +/// The sharing half, and the mutant that matters: making every lease private +/// would satisfy the test above while quietly undoing the one-socket design and +/// letting a finite request's drop cancel the archive's session. +#[tokio::test] +async fn a_same_scope_lease_shares_the_installed_session_and_never_ends_it() { + let client = NativeRelayClient::default(); + let (relay_url, keys) = (scope_url(11), Keys::generate()); + + let archive = client.ensure_session(relay_url.clone(), keys.clone()).await; + let lease = client.session(relay_url.clone(), keys.clone()).await; + assert!( + Arc::ptr_eq(&lease.session, &archive), + "a same-scope finite request must multiplex over the installed socket \ + rather than opening a second one" + ); + + drop(lease); + assert!( + !archive.cancel.is_cancelled(), + "dropping a shared lease cancelled the archive's session" + ); + assert!( + installed_session(&client) + .await + .is_some_and(|installed| Arc::ptr_eq(&installed, &archive)), + "the shared session must stay installed after a lease is dropped" + ); +} + +/// A lease taken before any archive start installs, so the archive start that +/// follows reuses that socket instead of opening a second one. This is the +/// common boot order: the catalog fetch runs before archive sync. +#[tokio::test] +async fn the_first_lease_installs_a_session_the_archive_then_reuses() { + let client = NativeRelayClient::default(); + let (relay_url, keys) = (scope_url(12), Keys::generate()); + + let lease = client.session(relay_url.clone(), keys.clone()).await; + let leased = lease.handle(); + drop(lease); + assert!( + !leased.cancel.is_cancelled(), + "the first lease owns the slot, so dropping it must not cancel the \ + session the archive is about to reuse" + ); + + let archive = client.ensure_session(relay_url, keys).await; + assert!( + Arc::ptr_eq(&archive, &leased), + "the archive start must reuse the installed session rather than \ + replacing an identically scoped one" + ); +} diff --git a/desktop/src-tauri/src/native_websocket.rs b/desktop/src-tauri/src/native_websocket.rs index 128f2df79dd..a7a51fb2904 100644 --- a/desktop/src-tauri/src/native_websocket.rs +++ b/desktop/src-tauri/src/native_websocket.rs @@ -2,7 +2,13 @@ use std::{collections::HashMap, sync::Arc, time::Duration}; use futures_util::{SinkExt, StreamExt}; use serde::{Deserialize, Serialize}; -use tauri::{ipc::Channel, plugin::TauriPlugin, Manager, Runtime}; +use tauri::{ + ipc::{Channel, InvokeResponseBody}, + plugin::TauriPlugin, + Manager, Runtime, +}; + +use crate::native_websocket_batch::{is_auth_challenge, FrameBatch, BATCH_MAX_SERIALIZED_BYTES}; use tokio::sync::{mpsc, oneshot, Mutex}; use tokio_tungstenite::{ connect_async, @@ -124,7 +130,7 @@ impl WebSocketManager { async fn open_connection( manager: &WebSocketManager, url: &str, - on_message: Channel, + on_message: Channel, ) -> Result { let connect_cancel = manager.connect_cancel.lock().await.clone(); let (socket, _) = tokio::select! { @@ -176,7 +182,7 @@ async fn open_connection( async fn connect( manager: tauri::State<'_, WebSocketManager>, url: String, - on_message: Channel, + on_message: Channel, _config: Option, ) -> Result { open_connection(manager.inner(), &url, on_message).await @@ -261,11 +267,12 @@ async fn run_connection( mut socket: tokio_tungstenite::WebSocketStream, mut receiver: mpsc::Receiver, cancel: CancellationToken, - on_message: Channel, + on_message: Channel, manager: WebSocketManager, ) where S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin, { + let mut batch = FrameBatch::default(); loop { tokio::select! { _ = cancel.cancelled() => { @@ -278,6 +285,7 @@ async fn run_connection( ).await; break; } + _ = batch.due() => batch.flush(&on_message), request = receiver.recv() => { let Some(request) = request else { break }; let result = tokio::time::timeout(WRITE_TIMEOUT, socket.send(request.message)) @@ -295,13 +303,35 @@ async fn run_connection( None => OutboundMessage::Close(None), }; let terminal = matches!(message, OutboundMessage::Close(_) | OutboundMessage::Error(_)); - if let Ok(value) = serde_json::to_value(message) { - let _ = on_message.send(value); + // Classify the relay payload before it is wrapped, while its + // structure is still readable. + let urgent = match &message { + OutboundMessage::Text(payload) => is_auth_challenge(payload), + _ => false, + }; + let Ok(frame) = serde_json::to_string(&message) else { continue }; + + // Flush before appending when the frame would carry the batch + // over the direct-eval ceiling, so the oversized frame starts a + // batch of its own rather than pushing its predecessors onto the + // fetch path. A frame that exceeds the bound alone is delivered + // alone, exactly as it is today. + if batch.projected_len(&frame) > BATCH_MAX_SERIALIZED_BYTES { + batch.flush(&on_message); + } + batch.push(frame); + // Ordering is FIFO in all cases: buffered frames are flushed + // together with the frame that forced the flush, never after it. + if terminal || urgent { + batch.flush(&on_message); } if terminal { break; } } } } + // A terminal frame already flushed; this covers cancellation and send + // failure, which must not strand frames the relay already delivered. + batch.flush(&on_message); manager.remove(id).await; } @@ -338,17 +368,241 @@ pub fn init() -> TauriPlugin { #[cfg(test)] mod tests { use super::*; + use crate::native_websocket_batch::BATCH_WINDOW; use futures_util::FutureExt; use std::sync::atomic::{AtomicBool, Ordering}; - use tauri::ipc::InvokeResponseBody; use tokio::io::duplex; use tokio_tungstenite::{tungstenite::protocol::Role, WebSocketStream}; - fn silent_channel() -> Channel { + fn silent_channel() -> Channel { Channel::new(|_: InvokeResponseBody| Ok(())) } + /// Records each delivery as its raw JSON payload, so tests assert on what + /// the renderer actually receives rather than on internal batch state. + fn recording_channel() -> ( + Channel, + Arc>>, + ) { + // A std mutex: `Channel::send` is synchronous and runs on whatever + // thread flushed, including inside the async runtime. + let deliveries = Arc::new(std::sync::Mutex::new(Vec::new())); + let sink = deliveries.clone(); + let channel = Channel::new(move |body: InvokeResponseBody| { + let payload = match body { + InvokeResponseBody::Json(json) => json, + InvokeResponseBody::Raw(bytes) => String::from_utf8_lossy(&bytes).into_owned(), + }; + sink.lock().unwrap().push(payload); + Ok(()) + }); + (channel, deliveries) + } + + /// Drives the real `run_connection` loop over a live in-memory socket, so + /// flush policy is exercised as the loop applies it. Asserting against + /// `FrameBatch` alone cannot see the loop's decisions and lets a broken + /// policy pass. + struct LoopHarness { + server: WebSocketStream, + deliveries: Arc>>, + cancel: CancellationToken, + _sender: mpsc::Sender, + } + + impl LoopHarness { + async fn start() -> Self { + let manager = WebSocketManager::default(); + let (client_io, server_io) = duplex(256 * 1024); + let (client, server) = tokio::join!( + WebSocketStream::from_raw_socket(client_io, Role::Client, None), + WebSocketStream::from_raw_socket(server_io, Role::Server, None), + ); + let (channel, deliveries) = recording_channel(); + // The sender is held by the harness: dropping it would end the + // loop before the test could drive it. + let (sender, receiver) = mpsc::channel(SEND_QUEUE_CAPACITY); + let cancel = CancellationToken::new(); + // `tokio::spawn`, not `tauri::async_runtime::spawn`: the latter + // runs the task on Tauri's own runtime, where this test's paused + // clock does not apply and `advance` would silently do nothing. + tokio::spawn(run_connection( + 1, + client, + receiver, + cancel.clone(), + channel, + manager, + )); + Self { + server, + deliveries, + cancel, + _sender: sender, + } + } + + async fn relay_says(&mut self, payload: &str) { + self.server + .send(Message::Text(payload.into())) + .await + .unwrap(); + } + + /// Lets the connection task run without letting the batch timer + /// elapse, so what arrives here arrived because policy forced it out. + async fn settle(&self) { + for _ in 0..64 { + tokio::task::yield_now().await; + } + } + + fn deliveries(&self) -> Vec { + self.deliveries.lock().unwrap().clone() + } + } + + #[tokio::test(start_paused = true)] + async fn auth_challenge_does_not_wait_for_the_batch_timer() { + let mut harness = LoopHarness::start().await; + + // Control: an ordinary frame stays buffered, proving the window is + // genuinely holding frames back rather than the clock running out. + harness.relay_says(r#"["EOSE","sub"]"#).await; + harness.settle().await; + assert!( + harness.deliveries().is_empty(), + "EOSE must ride the batch window" + ); + + harness.relay_says(r#"["AUTH","challenge"]"#).await; + harness.settle().await; + + let deliveries = harness.deliveries(); + assert_eq!(deliveries.len(), 1, "AUTH must not wait for the timer"); + let frames: Vec = serde_json::from_str(&deliveries[0]).unwrap(); + assert_eq!(frames.len(), 2, "the buffered EOSE rides out with AUTH"); + assert_eq!(frames[0]["data"], r#"["EOSE","sub"]"#, "FIFO preserved"); + } + + #[tokio::test(start_paused = true)] + async fn batch_window_eventually_delivers_unforced_frames() { + let mut harness = LoopHarness::start().await; + harness.relay_says(r#"["EOSE","sub"]"#).await; + harness.settle().await; + assert!(harness.deliveries().is_empty()); + + // Same frame, once the window elapses: the control above is waiting on + // the timer, not stuck. + tokio::time::advance(BATCH_WINDOW * 2).await; + harness.settle().await; + assert_eq!(harness.deliveries().len(), 1); + } + + #[tokio::test(start_paused = true)] + async fn cancellation_delivers_frames_the_relay_already_sent() { + let mut harness = LoopHarness::start().await; + harness.relay_says(r#"["EVENT","sub",{}]"#).await; + harness.settle().await; + assert!(harness.deliveries().is_empty(), "frame is buffered"); + + // Teardown must not strand a frame that never reached the renderer. + harness.cancel.cancel(); + harness.settle().await; + + let seen = harness.deliveries().join(""); + assert!( + seen.contains("EVENT"), + "buffered frame lost on cancel: {seen}" + ); + } + + #[tokio::test(start_paused = true)] + async fn oversize_frame_does_not_drag_buffered_frames_over_the_threshold() { + let mut harness = LoopHarness::start().await; + harness.relay_says(r#"["EOSE","sub"]"#).await; + harness.settle().await; + + let big = format!( + r#"["EVENT","sub","{}"]"#, + "x".repeat(BATCH_MAX_SERIALIZED_BYTES) + ); + harness.relay_says(&big).await; + harness.settle().await; + // The small frame is forced out by the straddle; the oversize frame + // itself still rides the window. + assert_eq!( + harness.deliveries().len(), + 1, + "straddle flushes immediately" + ); + tokio::time::advance(BATCH_WINDOW * 2).await; + harness.settle().await; + + // The small frame must ship on its own rather than riding a delivery + // that crosses tauri's direct-eval threshold. + let deliveries = harness.deliveries(); + assert_eq!( + deliveries.len(), + 2, + "straddling frames must not share a batch" + ); + assert!( + deliveries[0].len() < 8192, + "first delivery {} crossed the direct-eval threshold", + deliveries[0].len() + ); + let first: Vec = serde_json::from_str(&deliveries[0]).unwrap(); + assert_eq!(first[0]["data"], r#"["EOSE","sub"]"#); + } + + #[tokio::test] + async fn eof_delivers_buffered_frames_before_the_close() { + let manager = WebSocketManager::default(); + let (client_io, server_io) = duplex(4096); + let (client, mut server) = tokio::join!( + WebSocketStream::from_raw_socket(client_io, Role::Client, None), + WebSocketStream::from_raw_socket(server_io, Role::Server, None), + ); + let (channel, deliveries) = recording_channel(); + let (sender, receiver) = mpsc::channel(SEND_QUEUE_CAPACITY); + let handle = Arc::new(ConnectionHandle { + sender, + cancel: CancellationToken::new(), + task: Mutex::new(None), + }); + manager.connections.lock().await.insert(1, handle.clone()); + let task = tauri::async_runtime::spawn(run_connection( + 1, + client, + receiver, + handle.cancel.clone(), + channel, + manager.clone(), + )); + *handle.task.lock().await = Some(task); + + server.send(Message::Text("buffered".into())).await.unwrap(); + drop(server); + + tokio::time::timeout(Duration::from_secs(2), async { + while manager.connections.lock().await.contains_key(&1) { + tokio::task::yield_now().await; + } + }) + .await + .expect("EOF should clean up its native connection ID"); + + // A frame the relay already delivered must reach the renderer even + // though the socket closed inside the batch window. + let seen = deliveries.lock().unwrap().join(""); + assert!( + seen.contains("buffered"), + "buffered frame was dropped: {seen}" + ); + } + #[tokio::test] async fn secure_websocket_reaches_tls_without_panicking() { install_crypto_provider(); diff --git a/desktop/src-tauri/src/native_websocket_batch.rs b/desktop/src-tauri/src/native_websocket_batch.rs new file mode 100644 index 00000000000..bf82804fd2d --- /dev/null +++ b/desktop/src-tauri/src/native_websocket_batch.rs @@ -0,0 +1,265 @@ +use std::time::Duration; + +use tauri::ipc::{Channel, InvokeResponseBody}; +use tokio::time::Instant; + +/// Inbound text frames are coalesced into one `Channel::send` for this long +/// before delivery. Collapses N main-run-loop wakeups into one under a +/// catch-up storm without adding latency the relay protocol can observe. +pub(crate) const BATCH_WINDOW: Duration = Duration::from_millis(8); +/// Byte ceiling for a coalesced batch, measured on the *serialized* payload. +/// +/// `tauri::ipc::Channel::send` forks on payload size: below +/// `MAX_JSON_DIRECT_EXECUTE_THRESHOLD` (8192) it goes straight to +/// `webview.eval`; at or above it the body is parked in a `ChannelDataIpcQueue` +/// and the webview is made to call *back* into Rust over the IPC to fetch it +/// (tauri-2.11.5 `src/ipc/channel.rs:37,154-181,319-331`). That round-trip is +/// what batching is supposed to remove, so a batch must never cross the line — +/// bounding by frame count instead would put every batch on the slow path. +/// The margin absorbs the envelope; the check itself uses real serialized +/// length, because JSON escaping inflates payloads by an amount no fixed +/// per-frame estimate can bound. +pub(crate) const BATCH_MAX_SERIALIZED_BYTES: usize = 7680; + +/// Coalesces inbound frames into a single IPC delivery. +/// +/// Frames are serialized once on arrival so the batch can be bounded by its +/// true serialized length, and are concatenated into a JSON array at flush — +/// no value is serialized twice. Every delivery is an array, including the +/// single-frame case; the renderer accepts both shapes. +#[derive(Default)] +pub(crate) struct FrameBatch { + frames: Vec, + /// Serialized length of the delivered array, kept in sync with `frames`: + /// the enclosing brackets plus each frame and its separating comma. + serialized_len: usize, + deadline: Option, +} + +impl FrameBatch { + /// Serialized length of the array if `frame` were appended. + pub(crate) fn projected_len(&self, frame: &str) -> usize { + let separator = usize::from(!self.frames.is_empty()); + self.serialized_len.max(2) + separator + frame.len() + } + + pub(crate) fn push(&mut self, frame: String) { + self.serialized_len = self.projected_len(&frame); + self.frames.push(frame); + self.deadline + .get_or_insert_with(|| Instant::now() + BATCH_WINDOW); + } + + /// Resolves when the open batch is due, or never while there is none. + pub(crate) async fn due(&self) { + match self.deadline { + Some(deadline) => tokio::time::sleep_until(deadline).await, + None => std::future::pending().await, + } + } + + pub(crate) fn flush(&mut self, on_message: &Channel) { + if self.frames.is_empty() { + return; + } + let payload = format!("[{}]", self.frames.join(",")); + self.frames.clear(); + self.serialized_len = 0; + self.deadline = None; + let _ = on_message.send(InvokeResponseBody::Json(payload)); + } +} + +/// Whether a relay frame must reach the renderer without waiting out the batch +/// window. Only the NIP-42 challenge qualifies: it gates a round trip the +/// relay is waiting on, whereas `OK`/`EOSE` ride the window so catch-up +/// batching survives. +/// +/// Takes the relay payload, not the serialized envelope — inside the envelope +/// the payload's quotes are escaped and no plain `"AUTH"` prefix exists. +/// +/// Conservative by construction — a missed match costs at most one batch +/// window of latency against a 25s auth timeout, never correctness. +pub(crate) fn is_auth_challenge(payload: &str) -> bool { + payload + .trim_start() + .strip_prefix('[') + .unwrap_or_default() + .trim_start() + .starts_with("\"AUTH\"") +} + +#[cfg(test)] +mod tests { + use super::*; + use std::sync::Arc; + + /// Records each delivery as its raw JSON payload, so tests assert on what + /// the renderer actually receives rather than on internal batch state. + fn recording_channel() -> ( + Channel, + Arc>>, + ) { + // A std mutex: `Channel::send` is synchronous and runs on whatever + // thread flushed, including inside the async runtime. + let deliveries = Arc::new(std::sync::Mutex::new(Vec::new())); + let sink = deliveries.clone(); + let channel = Channel::new(move |body: InvokeResponseBody| { + let payload = match body { + InvokeResponseBody::Json(json) => json, + InvokeResponseBody::Raw(bytes) => String::from_utf8_lossy(&bytes).into_owned(), + }; + sink.lock().unwrap().push(payload); + Ok(()) + }); + (channel, deliveries) + } + + /// Mirrors the envelope `native_websocket` serializes, so these tests bind + /// to the real wire shape rather than a convenient stand-in. + fn text_frame(payload: &str) -> String { + serde_json::json!({ "type": "Text", "data": payload }).to_string() + } + + #[test] + fn batch_bound_tracks_real_serialized_length() { + let mut batch = FrameBatch::default(); + let first = text_frame("one"); + let second = text_frame("two"); + batch.push(first.clone()); + batch.push(second.clone()); + + // The tracked length must equal the payload actually built at flush; + // an estimate that drifts from it would silently cross the 8192 fork. + let expected = format!("[{first},{second}]"); + assert_eq!(batch.serialized_len, expected.len()); + } + + #[test] + fn escape_heavy_frames_stay_under_the_direct_eval_threshold() { + // Quotes double under JSON escaping, so a bound applied to raw relay + // bytes would pass here while the serialized body crosses 8192 and + // silently moves every batch onto the fetch round-trip. + let mut batch = FrameBatch::default(); + let mut pushed = 0; + loop { + let frame = text_frame(&"\"".repeat(512)); + if batch.projected_len(&frame) > BATCH_MAX_SERIALIZED_BYTES { + break; + } + batch.push(frame); + pushed += 1; + } + + assert!( + pushed > 0, + "bound must admit at least one escape-heavy frame" + ); + assert!( + batch.serialized_len < 8192, + "serialized batch {} must stay under the direct-eval threshold", + batch.serialized_len + ); + } + + #[tokio::test] + async fn frames_within_the_window_arrive_as_one_delivery() { + let (channel, deliveries) = recording_channel(); + let mut batch = FrameBatch::default(); + batch.push(text_frame("one")); + batch.push(text_frame("two")); + batch.push(text_frame("three")); + batch.flush(&channel); + + let deliveries = deliveries.lock().unwrap(); + assert_eq!(deliveries.len(), 1, "three frames must cost one IPC wakeup"); + // Asserted as the wire shape the renderer parses, not as a Rust type. + let frames: Vec = serde_json::from_str(&deliveries[0]).unwrap(); + let texts: Vec<&str> = frames + .iter() + .map(|frame| frame["data"].as_str().expect("text frame carries data")) + .collect(); + assert_eq!(texts, ["one", "two", "three"], "FIFO order is preserved"); + } + + #[tokio::test] + async fn oversize_frame_is_delivered_alone_without_stranding_predecessors() { + let (channel, deliveries) = recording_channel(); + let mut batch = FrameBatch::default(); + batch.push(text_frame("small")); + + // A frame that cannot share a batch must flush what is buffered first, + // then travel alone — the straddle case. + let oversize = text_frame(&"x".repeat(BATCH_MAX_SERIALIZED_BYTES)); + assert!(batch.projected_len(&oversize) > BATCH_MAX_SERIALIZED_BYTES); + batch.flush(&channel); + batch.push(oversize); + batch.flush(&channel); + + let deliveries = deliveries.lock().unwrap(); + assert_eq!( + deliveries.len(), + 2, + "predecessor must not ride the oversize batch" + ); + let first: Vec = serde_json::from_str(&deliveries[0]).unwrap(); + assert_eq!(first.len(), 1); + let second: Vec = serde_json::from_str(&deliveries[1]).unwrap(); + assert_eq!(second.len(), 1); + assert!(deliveries[1].len() >= BATCH_MAX_SERIALIZED_BYTES); + } + + #[tokio::test] + async fn auth_challenge_flushes_immediately_and_keeps_earlier_frames_ahead_of_it() { + let (channel, deliveries) = recording_channel(); + let auth_payload = serde_json::json!(["AUTH", "challenge"]).to_string(); + assert!(is_auth_challenge(&auth_payload)); + + let mut batch = FrameBatch::default(); + batch.push(text_frame("earlier")); + batch.push(text_frame(&auth_payload)); + batch.flush(&channel); + + let deliveries = deliveries.lock().unwrap(); + assert_eq!(deliveries.len(), 1); + let frames: Vec = serde_json::from_str(&deliveries[0]).unwrap(); + assert_eq!( + frames.len(), + 2, + "AUTH carries buffered frames with it, in order" + ); + assert_eq!( + frames[0]["data"], "earlier", + "buffered frame stays ahead of AUTH" + ); + } + + #[test] + fn only_the_auth_challenge_bypasses_the_batch_window() { + // OK and EOSE must ride the timer, or catch-up batching collapses back + // to one delivery per frame. + for payload in [ + serde_json::json!(["OK", "id", true, ""]).to_string(), + serde_json::json!(["EOSE", "sub"]).to_string(), + serde_json::json!(["EVENT", "sub", {"content": "AUTH"}]).to_string(), + serde_json::json!(["NOTICE", "AUTH required"]).to_string(), + ] { + assert!( + !is_auth_challenge(&payload), + "{payload} must not force a flush" + ); + } + + // The serialized envelope escapes the payload's quotes, so matching + // against it would never fire — the bug this pair pins down. + let envelope = text_frame(r#"["AUTH","c"]"#); + assert!(!is_auth_challenge(&envelope)); + } + + #[tokio::test] + async fn empty_batch_never_wakes_the_renderer() { + let (channel, deliveries) = recording_channel(); + FrameBatch::default().flush(&channel); + assert!(deliveries.lock().unwrap().is_empty()); + } +} diff --git a/desktop/src-tauri/src/nostr_convert.rs b/desktop/src-tauri/src/nostr_convert.rs index ec4970e0c92..64c8df05a79 100644 --- a/desktop/src-tauri/src/nostr_convert.rs +++ b/desktop/src-tauri/src/nostr_convert.rs @@ -495,6 +495,15 @@ pub fn agents_from_events(events: &[Event]) -> Value { json!({ "agents": arr }) } +// ── kind:0 + kind:30177 managed-agent directory ──────────────────────────── + +mod agent_directory; +pub use agent_directory::{ + managed_agent_pubkeys_from_events, member_agent_channel_ids_from_events, + relay_agents_from_directory_events, relay_agents_from_managed_agent_events, + verified_agent_owners_from_profiles, +}; + // ── kind:13534 (relay membership list) ────────────────────────────────────── /// Convert a kind:13534 relay membership list to the relay members format. @@ -578,434 +587,4 @@ fn days_to_ymd(days: i64) -> (i64, u32, u32) { } #[cfg(test)] -mod tests { - use super::*; - use nostr::{EventBuilder, Keys, Kind, Tag}; - - /// Build a signed event for testing with the given kind, content, and tags. - fn ev(kind: u16, content: &str, tags: Vec>) -> Event { - let keys = Keys::generate(); - let parsed: Vec = tags - .into_iter() - .map(|t| Tag::parse(t).expect("parse tag")) - .collect(); - EventBuilder::new(Kind::from_u16(kind), content) - .tags(parsed) - .sign_with_keys(&keys) - .expect("sign") - } - - /// Build a kind:0 profile with a valid NIP-OA auth tag. - fn oa_profile_event(content: &str) -> (Event, String) { - let agent_keys = Keys::generate(); - let owner_keys = Keys::generate(); - let agent_pubkey = agent_keys.public_key(); - let tag_json = buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_pubkey, "") - .expect("compute auth tag"); - let tag_values: Vec = serde_json::from_str(&tag_json).expect("parse auth tag json"); - let auth_tag = Tag::parse(tag_values).expect("parse auth tag"); - - let event = EventBuilder::new(Kind::Metadata, content) - .tags(vec![auth_tag]) - .sign_with_keys(&agent_keys) - .expect("sign"); - (event, owner_keys.public_key().to_hex()) - } - - #[test] - fn channel_info_minimal() { - let e = ev( - 39000, - "", - vec![ - vec!["d", "chan-uuid-1"], - vec!["name", "general"], - vec!["about", "main channel"], - vec!["t", "stream"], - vec!["public"], - ], - ); - let info = channel_info_from_event(&e, None, None).unwrap(); - assert_eq!(info.id, "chan-uuid-1"); - assert_eq!(info.name, "general"); - assert_eq!(info.description, "main channel"); - assert_eq!(info.channel_type, "stream"); - assert_eq!(info.visibility, "open"); - assert_eq!(info.member_count, 0); - assert!(info.is_member); - } - - #[test] - fn channel_info_private_when_visibility_tag_present() { - let e = ev( - 39000, - "", - vec![ - vec!["d", "u"], - vec!["name", "n"], - vec!["t", "forum"], - vec!["visibility", "private"], - vec!["ttl", "86400"], - ], - ); - let info = channel_info_from_event(&e, None, None).unwrap(); - assert_eq!(info.visibility, "private"); - assert_eq!(info.channel_type, "forum"); - assert_eq!(info.ttl_seconds, Some(86400)); - } - - #[test] - fn channel_info_open_when_neither_public_nor_private() { - // Neither tag present → open (matches NIP-29 default). - let e = ev( - 39000, - "", - vec![vec!["d", "u"], vec!["name", "n"], vec!["t", "forum"]], - ); - let info = channel_info_from_event(&e, None, None).unwrap(); - assert_eq!(info.visibility, "open"); - } - - #[test] - fn channel_info_dm_inferred_from_hidden_tag() { - // Fallback: relays without ["t", "dm"] still emit ["hidden"] for DMs. - let e = ev( - 39000, - "", - vec![vec!["d", "u"], vec!["name", "n"], vec!["hidden"]], - ); - let info = channel_info_from_event(&e, None, None).unwrap(); - assert_eq!(info.channel_type, "dm"); - } - - #[test] - fn channel_info_merges_summary() { - let chan = ev(39000, "", vec![vec!["d", "u"], vec!["name", "n"]]); - let summary = ev( - 40901, - r#"{"member_count": 7, "last_message_at": "2026-01-01T00:00:00Z"}"#, - vec![vec!["d", "u"]], - ); - let info = channel_info_from_event(&chan, Some(&summary), None).unwrap(); - assert_eq!(info.member_count, 7); - assert_eq!( - info.last_message_at.as_deref(), - Some("2026-01-01T00:00:00Z") - ); - } - - #[test] - fn channel_info_missing_d_errors() { - let e = ev(39000, "", vec![vec!["name", "n"]]); - assert!(channel_info_from_event(&e, None, None).is_err()); - } - - #[test] - fn channel_detail_basic() { - let e = ev( - 39000, - "", - vec![ - vec!["d", "uuid"], - vec!["name", "n"], - vec!["about", "desc"], - vec!["topic", "tt"], - vec!["purpose", "pp"], - vec!["t", "dm"], - vec!["visibility", "private"], - vec!["ttl", "86400"], - vec!["ttl_deadline", "2026-06-11T00:00:00Z"], - ], - ); - let d = channel_detail_from_event(&e).unwrap(); - assert_eq!(d.id, "uuid"); - assert_eq!(d.topic.as_deref(), Some("tt")); - assert_eq!(d.purpose.as_deref(), Some("pp")); - assert_eq!(d.channel_type, "dm"); - assert_eq!(d.visibility, "private"); - assert_eq!(d.ttl_seconds, Some(86400)); - assert_eq!(d.ttl_deadline.as_deref(), Some("2026-06-11T00:00:00Z")); - assert!(d.created_at.ends_with("Z")); - assert_eq!(d.created_by, e.pubkey.to_hex()); - } - - #[test] - fn channel_members_extracts_p_tags() { - let pk1 = "a".repeat(64); - let pk2 = "b".repeat(64); - let e = ev( - 39002, - "", - vec![ - vec!["d", "uuid"], - vec!["p", &pk1, "", "admin"], - vec!["p", &pk2], - // Duplicate must be deduped. - vec!["p", &pk1, "wss://x", "owner"], - ], - ); - let r = channel_members_from_event(&e).unwrap(); - assert_eq!(r.members.len(), 2); - assert_eq!(r.members[0].pubkey, pk1); - assert_eq!(r.members[0].role, "admin"); - assert!(r.members[0].joined_at.is_none()); - assert_eq!(r.members[1].role, "member"); // default - } - - #[test] - fn channel_members_missing_d_errors() { - let e = ev(39002, "", vec![]); - assert!(channel_members_from_event(&e).is_err()); - } - - #[test] - fn profile_info_parses_content() { - let e = ev( - 0, - r#"{"name":"alice","display_name":"Alice","picture":"http://x/a.png","about":"hi","nip05":"alice@x"}"#, - vec![], - ); - let p = profile_info_from_event(&e).unwrap(); - assert_eq!(p.display_name.as_deref(), Some("Alice")); - assert_eq!(p.avatar_url.as_deref(), Some("http://x/a.png")); - assert_eq!(p.about.as_deref(), Some("hi")); - assert_eq!(p.nip05_handle.as_deref(), Some("alice@x")); - assert_eq!(p.pubkey, e.pubkey.to_hex()); - assert!(p.owner_pubkey.is_none()); - } - - #[test] - fn profile_info_extracts_valid_nip_oa_owner() { - let (event, owner_pubkey) = oa_profile_event(r#"{"display_name":"Mira"}"#); - let p = profile_info_from_event(&event).unwrap(); - - assert_eq!(p.owner_pubkey.as_deref(), Some(owner_pubkey.as_str())); - } - - #[test] - fn profile_info_falls_back_to_name() { - let e = ev(0, r#"{"name":"bob"}"#, vec![]); - let p = profile_info_from_event(&e).unwrap(); - assert_eq!(p.display_name.as_deref(), Some("bob")); - } - - #[test] - fn profile_info_invalid_json_errors() { - let e = ev(0, "not-json", vec![]); - assert!(profile_info_from_event(&e).is_err()); - } - - #[test] - fn users_batch_keeps_latest_and_reports_missing() { - let e1 = ev(0, r#"{"name":"old"}"#, vec![]); - // Same author, newer event with display_name. - let keys = Keys::generate(); - let e_old = EventBuilder::new(Kind::Metadata, r#"{"name":"old"}"#) - .custom_created_at(nostr::Timestamp::from(1000)) - .sign_with_keys(&keys) - .unwrap(); - let e_new = EventBuilder::new(Kind::Metadata, r#"{"display_name":"New"}"#) - .custom_created_at(nostr::Timestamp::from(2000)) - .sign_with_keys(&keys) - .unwrap(); - let pk = keys.public_key().to_hex(); - let other_pk = e1.pubkey.to_hex(); - - let missing_pk = "f".repeat(64); - let resp = users_batch_from_events( - &[e1, e_old, e_new], - &[pk.clone(), other_pk.clone(), missing_pk.clone()], - ); - assert_eq!(resp.profiles.len(), 2); - assert_eq!(resp.profiles[&pk].display_name.as_deref(), Some("New")); - assert_eq!(resp.missing, vec![missing_pk]); - } - - #[test] - fn users_batch_marks_valid_nip_oa_profiles_as_agents() { - let (agent, owner_pubkey) = oa_profile_event(r#"{"display_name":"Mira"}"#); - let pubkey = agent.pubkey.to_hex(); - let resp = - users_batch_from_events(std::slice::from_ref(&agent), std::slice::from_ref(&pubkey)); - - assert!(resp.profiles[&pubkey].is_agent); - assert_eq!( - resp.profiles[&pubkey].owner_pubkey.as_deref(), - Some(owner_pubkey.as_str()) - ); - } - - #[test] - fn user_notes_builds_cursor_from_last() { - let e1 = ev(1, "first", vec![]); - let e2 = ev(1, "second", vec![]); - let r = user_notes_from_events(&[e1, e2]); - assert_eq!(r.notes.len(), 2); - assert_eq!(r.notes[0].content, "first"); - let cursor = r.next_cursor.expect("cursor"); - assert_eq!(cursor.before_id, r.notes[1].id); - } - - #[test] - fn user_notes_empty_has_no_cursor() { - let r = user_notes_from_events(&[]); - assert!(r.notes.is_empty()); - assert!(r.next_cursor.is_none()); - } - - #[test] - fn contact_list_preserves_tags_and_content() { - let pk = "1".repeat(64); - let e = ev(3, "rel-json", vec![vec!["p", &pk]]); - let r = contact_list_from_event(&e).unwrap(); - assert_eq!(r.content, "rel-json"); - assert_eq!(r.tags.len(), 1); - assert_eq!(r.tags[0], vec!["p".to_string(), pk]); - } - - #[test] - fn search_response_assigns_descending_scores() { - let e1 = ev(1, "one", vec![vec!["h", "chan"]]); - let e2 = ev(1, "two", vec![]); - let r = search_response_from_events(&[e1, e2]); - assert_eq!(r.found, 2); - assert!(r.hits[0].score > r.hits[1].score); - assert_eq!(r.hits[0].channel_id.as_deref(), Some("chan")); - assert!(r.hits[1].channel_id.is_none()); - } - - #[test] - fn search_response_single_hit_full_score() { - let e = ev(1, "only", vec![]); - let r = search_response_from_events(&[e]); - assert_eq!(r.hits.len(), 1); - assert_eq!(r.hits[0].score, 1.0); - } - - #[test] - fn agents_overwrites_pubkey_from_event_author() { - let e = ev(10100, r#"{"pubkey":"forged","name":"agent-1"}"#, vec![]); - let v = agents_from_events(std::slice::from_ref(&e)); - let arr = v.get("agents").and_then(Value::as_array).unwrap(); - assert_eq!(arr.len(), 1); - assert_eq!( - arr[0].get("pubkey").and_then(Value::as_str).unwrap(), - e.pubkey.to_hex() - ); - assert_eq!(arr[0].get("name").and_then(Value::as_str), Some("agent-1")); - } - - #[test] - fn agents_handles_invalid_content() { - let e = ev(10100, "not-json", vec![]); - let v = agents_from_events(std::slice::from_ref(&e)); - let arr = v.get("agents").and_then(Value::as_array).unwrap(); - assert_eq!( - arr[0].get("pubkey").and_then(Value::as_str).unwrap(), - e.pubkey.to_hex() - ); - } - - #[test] - fn agents_default_sparse_agent_profiles_for_directory_parse() { - let e = ev( - 10100, - r#"{"channel_add_policy":"owner-only","display_name":"Scout"}"#, - vec![], - ); - let v = agents_from_events(std::slice::from_ref(&e)); - let agents = v.get("agents").cloned().unwrap(); - let parsed: Vec = - serde_json::from_value(agents).unwrap(); - - assert_eq!(parsed.len(), 1); - assert_eq!(parsed[0].pubkey, e.pubkey.to_hex()); - assert_eq!(parsed[0].name, "Scout"); - assert_eq!(parsed[0].agent_type, "agent"); - assert_eq!(parsed[0].channels, Vec::::new()); - assert_eq!(parsed[0].capabilities, Vec::::new()); - assert_eq!(parsed[0].status, "offline"); - assert_eq!(parsed[0].respond_to, None); - } - - #[test] - fn agents_preserves_public_respond_to_mode_for_directory_parse() { - let e = ev(10100, r#"{"name":"Scout","respond_to":"anyone"}"#, vec![]); - let v = agents_from_events(std::slice::from_ref(&e)); - let agents = v.get("agents").cloned().unwrap(); - let parsed: Vec = - serde_json::from_value(agents).unwrap(); - - assert_eq!(parsed.len(), 1); - assert_eq!( - parsed[0].respond_to, - Some(crate::managed_agents::RespondTo::Anyone) - ); - } - - #[test] - fn agents_preserves_allowlist_metadata_for_directory_parse() { - let e = ev( - 10100, - r#"{"name":"Scout","respond_to":"allowlist","respond_to_allowlist":["aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]}"#, - vec![], - ); - let v = agents_from_events(std::slice::from_ref(&e)); - let agents = v.get("agents").cloned().unwrap(); - let parsed: Vec = - serde_json::from_value(agents).unwrap(); - - assert_eq!(parsed.len(), 1); - assert_eq!( - parsed[0].respond_to, - Some(crate::managed_agents::RespondTo::Allowlist) - ); - assert_eq!(parsed[0].respond_to_allowlist, vec!["a".repeat(64)]); - } - - #[test] - fn relay_members_dedupes_and_defaults_role() { - let pk1 = "a".repeat(64); - let pk2 = "b".repeat(64); - // Current relay format: ["member", pubkey, role] - let e = ev( - 13534, - "", - vec![ - vec!["member", &pk1, "owner"], - vec!["member", &pk2], - vec!["member", &pk1, "moderator"], // dupe — ignored - ], - ); - let v = relay_members_from_event(&e); - let arr = v.get("members").and_then(Value::as_array).unwrap(); - assert_eq!(arr.len(), 2); - assert_eq!(arr[0].get("role").and_then(Value::as_str), Some("owner")); - assert_eq!(arr[1].get("role").and_then(Value::as_str), Some("member")); - } - - #[test] - fn relay_members_fallback_p_tags() { - let pk1 = "a".repeat(64); - let pk2 = "b".repeat(64); - // Legacy/fallback format: ["p", pubkey, relay_url?, role?] - let e = ev( - 13534, - "", - vec![vec!["p", &pk1, "", "admin"], vec!["p", &pk2]], - ); - let v = relay_members_from_event(&e); - let arr = v.get("members").and_then(Value::as_array).unwrap(); - assert_eq!(arr.len(), 2); - assert_eq!(arr[0].get("role").and_then(Value::as_str), Some("admin")); - assert_eq!(arr[1].get("role").and_then(Value::as_str), Some("member")); - } - - #[test] - fn timestamp_to_iso_known_value() { - // 2021-01-01T00:00:00Z = 1609459200 - assert_eq!(timestamp_to_iso(1_609_459_200), "2021-01-01T00:00:00Z"); - // Epoch - assert_eq!(timestamp_to_iso(0), "1970-01-01T00:00:00Z"); - } -} +mod tests; diff --git a/desktop/src-tauri/src/nostr_convert/agent_directory.rs b/desktop/src-tauri/src/nostr_convert/agent_directory.rs new file mode 100644 index 00000000000..28604de5e5f --- /dev/null +++ b/desktop/src-tauri/src/nostr_convert/agent_directory.rs @@ -0,0 +1,191 @@ +//! Conversion and verification for relay-discovered agents. + +use std::collections::{BTreeSet, HashMap}; + +use nostr::Event; + +use crate::managed_agents::{agent_events::managed_agent_content_from_event, RelayAgentInfo}; + +use super::{agents_from_events, first_tag_value, profile_valid_oa_owner_pubkey, tags_named}; + +/// Collect valid agent pubkeys from kind:30177 `d` tags for follow-up relay +/// queries. Malformed tags are ignored so one hostile event cannot invalidate +/// the whole directory request. +pub fn managed_agent_pubkeys_from_events(events: &[Event]) -> std::collections::HashSet { + events + .iter() + .filter_map(|event| first_tag_value(event, "d")) + .filter_map(|pubkey| nostr::PublicKey::from_hex(pubkey).ok()) + .map(|pubkey| pubkey.to_hex()) + .collect() +} + +fn event_is_newer(candidate: &Event, previous: &Event) -> bool { + candidate.created_at > previous.created_at + || (candidate.created_at == previous.created_at && candidate.id < previous.id) +} + +fn relay_agents_from_legacy_events(events: &[Event]) -> Vec { + let mut latest: HashMap = HashMap::new(); + for event in events { + let pubkey = event.pubkey.to_hex(); + if latest + .get(&pubkey) + .is_none_or(|previous| event_is_newer(event, previous)) + { + latest.insert(pubkey, event); + } + } + + latest + .into_values() + .filter_map(|event| { + let value = agents_from_events(std::slice::from_ref(event)); + let mut agent: RelayAgentInfo = + serde_json::from_value(value.get("agents")?.as_array()?.first()?.clone()).ok()?; + // Legacy directory entries are not authenticated managed-policy + // coordinates, so they must not drive the live 30177 watcher. + agent.owner_pubkey = None; + // Channel membership is authoritative only in relay-signed kind:39002. + agent.channel_ids.clear(); + Some(agent) + }) + .collect() +} + +/// Merge self-authored kind:10100 runtime profiles with verified Desktop-managed +/// policy records. A verified managed coordinate reserves the agent identity even +/// when its current policy is malformed, so stale legacy permissions cannot win. +pub fn relay_agents_from_directory_events( + directory_events: &[Event], + managed_agent_events: &[Event], + profile_events: &[Event], +) -> Vec { + let verified_policies = latest_verified_managed_policies(managed_agent_events, profile_events); + let mut agents: HashMap = + relay_agents_from_legacy_events(directory_events) + .into_iter() + .map(|agent| (agent.pubkey.clone(), agent)) + .collect(); + for agent_pubkey in verified_policies.keys() { + agents.remove(agent_pubkey); + } + for (agent_pubkey, event) in verified_policies { + if let Some(agent) = relay_agent_from_managed_policy(&agent_pubkey, event) { + agents.insert(agent_pubkey, agent); + } + } + + let mut agents: Vec<_> = agents.into_values().collect(); + agents.sort_by(|left, right| left.name.cmp(&right.name)); + agents +} + +/// Resolve each agent's owner from its latest signed NIP-OA profile. +pub fn verified_agent_owners_from_profiles(events: &[Event]) -> HashMap { + let mut latest_profiles: HashMap = HashMap::new(); + for profile in events { + let agent_pubkey = profile.pubkey.to_hex(); + if latest_profiles + .get(&agent_pubkey) + .is_none_or(|previous| event_is_newer(profile, previous)) + { + latest_profiles.insert(agent_pubkey, profile); + } + } + latest_profiles + .into_iter() + .filter_map(|(agent_pubkey, profile)| { + profile_valid_oa_owner_pubkey(profile).map(|owner| (agent_pubkey, owner)) + }) + .collect() +} + +fn latest_verified_managed_policies<'a>( + managed_agent_events: &'a [Event], + profile_events: &[Event], +) -> HashMap { + let verified_owners = verified_agent_owners_from_profiles(profile_events); + + let mut latest: HashMap = HashMap::new(); + for event in managed_agent_events { + let Some(agent_pubkey) = first_tag_value(event, "d") else { + continue; + }; + if verified_owners.get(agent_pubkey) != Some(&event.pubkey.to_hex()) { + continue; + } + if latest + .get(agent_pubkey) + .is_none_or(|previous| event_is_newer(event, previous)) + { + latest.insert(agent_pubkey.to_string(), event); + } + } + latest +} + +fn relay_agent_from_managed_policy(agent_pubkey: &str, event: &Event) -> Option { + let content = managed_agent_content_from_event(event).ok()?; + Some(RelayAgentInfo { + pubkey: agent_pubkey.to_string(), + owner_pubkey: Some(event.pubkey.to_hex()), + name: content.name, + agent_type: "agent".to_string(), + channels: Vec::new(), + channel_ids: Vec::new(), + capabilities: Vec::new(), + status: "offline".to_string(), + respond_to: Some(content.respond_to), + respond_to_allowlist: content.respond_to_allowlist, + }) +} + +/// Build the relay agent directory from owner-authenticated managed-agent +/// records. A kind:30177 event is accepted only when its author matches the +/// owner cryptographically declared by the agent's latest kind:0 NIP-OA tag. +pub fn relay_agents_from_managed_agent_events( + managed_agent_events: &[Event], + profile_events: &[Event], +) -> Vec { + let mut agents: Vec<_> = latest_verified_managed_policies(managed_agent_events, profile_events) + .into_iter() + .filter_map(|(agent_pubkey, event)| relay_agent_from_managed_policy(&agent_pubkey, event)) + .collect(); + agents.sort_by(|left, right| left.name.cmp(&right.name)); + agents +} + +/// Build a pubkey-to-channel-id candidate map from relay-signed membership +/// events. Only p-tags explicitly marked with the `bot` role are agents. +pub fn member_agent_channel_ids_from_events( + events: &[Event], + relay_pubkey: &str, +) -> HashMap> { + let mut channel_ids: HashMap> = HashMap::new(); + for event in events { + if !event.pubkey.to_hex().eq_ignore_ascii_case(relay_pubkey) { + continue; + } + let Some(channel_id) = first_tag_value(event, "d") else { + continue; + }; + for tag in tags_named(event, "p") { + let (Some(pubkey), Some(role)) = (tag.get(1), tag.get(3)) else { + continue; + }; + if role != "bot" || nostr::PublicKey::from_hex(pubkey).is_err() { + continue; + } + channel_ids + .entry(pubkey.clone()) + .or_default() + .insert(channel_id.to_string()); + } + } + + channel_ids + .into_iter() + .map(|(pubkey, ids)| (pubkey, ids.into_iter().collect())) + .collect() +} diff --git a/desktop/src-tauri/src/nostr_convert/tests.rs b/desktop/src-tauri/src/nostr_convert/tests.rs new file mode 100644 index 00000000000..9401d19add4 --- /dev/null +++ b/desktop/src-tauri/src/nostr_convert/tests.rs @@ -0,0 +1,762 @@ +//! Tests for the Nostr conversion surface. + +use super::*; +use nostr::{EventBuilder, Keys, Kind, Tag}; + +/// Build a signed event for testing with the given kind, content, and tags. +fn ev(kind: u16, content: &str, tags: Vec>) -> Event { + let keys = Keys::generate(); + let parsed: Vec = tags + .into_iter() + .map(|t| Tag::parse(t).expect("parse tag")) + .collect(); + EventBuilder::new(Kind::from_u16(kind), content) + .tags(parsed) + .sign_with_keys(&keys) + .expect("sign") +} + +/// Build a kind:0 profile with a valid NIP-OA auth tag. +fn oa_profile_event(content: &str) -> (Event, String) { + let agent_keys = Keys::generate(); + let owner_keys = Keys::generate(); + let agent_pubkey = agent_keys.public_key(); + let tag_json = buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_pubkey, "") + .expect("compute auth tag"); + let tag_values: Vec = serde_json::from_str(&tag_json).expect("parse auth tag json"); + let auth_tag = Tag::parse(tag_values).expect("parse auth tag"); + + let event = EventBuilder::new(Kind::Metadata, content) + .tags(vec![auth_tag]) + .sign_with_keys(&agent_keys) + .expect("sign"); + (event, owner_keys.public_key().to_hex()) +} + +fn managed_agent_event( + owner_keys: &Keys, + agent_pubkey: &str, + name: &str, + respond_to: &str, + respond_to_allowlist: &[String], +) -> Event { + let content = serde_json::json!({ + "name": name, + "parallelism": 1, + "respond_to": respond_to, + "respond_to_allowlist": respond_to_allowlist, + }) + .to_string(); + EventBuilder::new(Kind::Custom(30177), content) + .tags([Tag::parse(["d", agent_pubkey]).expect("parse d tag")]) + .sign_with_keys(owner_keys) + .expect("sign managed-agent event") +} + +#[test] +fn channel_info_minimal() { + let e = ev( + 39000, + "", + vec![ + vec!["d", "chan-uuid-1"], + vec!["name", "general"], + vec!["about", "main channel"], + vec!["t", "stream"], + vec!["public"], + ], + ); + let info = channel_info_from_event(&e, None, None).unwrap(); + assert_eq!(info.id, "chan-uuid-1"); + assert_eq!(info.name, "general"); + assert_eq!(info.description, "main channel"); + assert_eq!(info.channel_type, "stream"); + assert_eq!(info.visibility, "open"); + assert_eq!(info.member_count, 0); + assert!(info.is_member); +} + +#[test] +fn channel_info_private_when_visibility_tag_present() { + let e = ev( + 39000, + "", + vec![ + vec!["d", "u"], + vec!["name", "n"], + vec!["t", "forum"], + vec!["visibility", "private"], + vec!["ttl", "86400"], + ], + ); + let info = channel_info_from_event(&e, None, None).unwrap(); + assert_eq!(info.visibility, "private"); + assert_eq!(info.channel_type, "forum"); + assert_eq!(info.ttl_seconds, Some(86400)); +} + +#[test] +fn channel_info_open_when_neither_public_nor_private() { + // Neither tag present → open (matches NIP-29 default). + let e = ev( + 39000, + "", + vec![vec!["d", "u"], vec!["name", "n"], vec!["t", "forum"]], + ); + let info = channel_info_from_event(&e, None, None).unwrap(); + assert_eq!(info.visibility, "open"); +} + +#[test] +fn channel_info_dm_inferred_from_hidden_tag() { + // Fallback: relays without ["t", "dm"] still emit ["hidden"] for DMs. + let e = ev( + 39000, + "", + vec![vec!["d", "u"], vec!["name", "n"], vec!["hidden"]], + ); + let info = channel_info_from_event(&e, None, None).unwrap(); + assert_eq!(info.channel_type, "dm"); +} + +#[test] +fn channel_info_merges_summary() { + let chan = ev(39000, "", vec![vec!["d", "u"], vec!["name", "n"]]); + let summary = ev( + 40901, + r#"{"member_count": 7, "last_message_at": "2026-01-01T00:00:00Z"}"#, + vec![vec!["d", "u"]], + ); + let info = channel_info_from_event(&chan, Some(&summary), None).unwrap(); + assert_eq!(info.member_count, 7); + assert_eq!( + info.last_message_at.as_deref(), + Some("2026-01-01T00:00:00Z") + ); +} + +#[test] +fn channel_info_missing_d_errors() { + let e = ev(39000, "", vec![vec!["name", "n"]]); + assert!(channel_info_from_event(&e, None, None).is_err()); +} + +#[test] +fn channel_detail_basic() { + let e = ev( + 39000, + "", + vec![ + vec!["d", "uuid"], + vec!["name", "n"], + vec!["about", "desc"], + vec!["topic", "tt"], + vec!["purpose", "pp"], + vec!["t", "dm"], + vec!["visibility", "private"], + vec!["ttl", "86400"], + vec!["ttl_deadline", "2026-06-11T00:00:00Z"], + ], + ); + let d = channel_detail_from_event(&e).unwrap(); + assert_eq!(d.id, "uuid"); + assert_eq!(d.topic.as_deref(), Some("tt")); + assert_eq!(d.purpose.as_deref(), Some("pp")); + assert_eq!(d.channel_type, "dm"); + assert_eq!(d.visibility, "private"); + assert_eq!(d.ttl_seconds, Some(86400)); + assert_eq!(d.ttl_deadline.as_deref(), Some("2026-06-11T00:00:00Z")); + assert!(d.created_at.ends_with("Z")); + assert_eq!(d.created_by, e.pubkey.to_hex()); +} + +#[test] +fn channel_members_extracts_p_tags() { + let pk1 = "a".repeat(64); + let pk2 = "b".repeat(64); + let e = ev( + 39002, + "", + vec![ + vec!["d", "uuid"], + vec!["p", &pk1, "", "admin"], + vec!["p", &pk2], + // Duplicate must be deduped. + vec!["p", &pk1, "wss://x", "owner"], + ], + ); + let r = channel_members_from_event(&e).unwrap(); + assert_eq!(r.members.len(), 2); + assert_eq!(r.members[0].pubkey, pk1); + assert_eq!(r.members[0].role, "admin"); + assert!(r.members[0].joined_at.is_none()); + assert_eq!(r.members[1].role, "member"); // default +} + +#[test] +fn channel_members_missing_d_errors() { + let e = ev(39002, "", vec![]); + assert!(channel_members_from_event(&e).is_err()); +} + +#[test] +fn profile_info_parses_content() { + let e = ev( + 0, + r#"{"name":"alice","display_name":"Alice","picture":"http://x/a.png","about":"hi","nip05":"alice@x"}"#, + vec![], + ); + let p = profile_info_from_event(&e).unwrap(); + assert_eq!(p.display_name.as_deref(), Some("Alice")); + assert_eq!(p.avatar_url.as_deref(), Some("http://x/a.png")); + assert_eq!(p.about.as_deref(), Some("hi")); + assert_eq!(p.nip05_handle.as_deref(), Some("alice@x")); + assert_eq!(p.pubkey, e.pubkey.to_hex()); + assert!(p.owner_pubkey.is_none()); +} + +#[test] +fn profile_info_extracts_valid_nip_oa_owner() { + let (event, owner_pubkey) = oa_profile_event(r#"{"display_name":"Mira"}"#); + let p = profile_info_from_event(&event).unwrap(); + + assert_eq!(p.owner_pubkey.as_deref(), Some(owner_pubkey.as_str())); +} + +#[test] +fn profile_info_falls_back_to_name() { + let e = ev(0, r#"{"name":"bob"}"#, vec![]); + let p = profile_info_from_event(&e).unwrap(); + assert_eq!(p.display_name.as_deref(), Some("bob")); +} + +#[test] +fn profile_info_invalid_json_errors() { + let e = ev(0, "not-json", vec![]); + assert!(profile_info_from_event(&e).is_err()); +} + +#[test] +fn users_batch_keeps_latest_and_reports_missing() { + let e1 = ev(0, r#"{"name":"old"}"#, vec![]); + // Same author, newer event with display_name. + let keys = Keys::generate(); + let e_old = EventBuilder::new(Kind::Metadata, r#"{"name":"old"}"#) + .custom_created_at(nostr::Timestamp::from(1000)) + .sign_with_keys(&keys) + .unwrap(); + let e_new = EventBuilder::new(Kind::Metadata, r#"{"display_name":"New"}"#) + .custom_created_at(nostr::Timestamp::from(2000)) + .sign_with_keys(&keys) + .unwrap(); + let pk = keys.public_key().to_hex(); + let other_pk = e1.pubkey.to_hex(); + + let missing_pk = "f".repeat(64); + let resp = users_batch_from_events( + &[e1, e_old, e_new], + &[pk.clone(), other_pk.clone(), missing_pk.clone()], + ); + assert_eq!(resp.profiles.len(), 2); + assert_eq!(resp.profiles[&pk].display_name.as_deref(), Some("New")); + assert_eq!(resp.missing, vec![missing_pk]); +} + +#[test] +fn users_batch_marks_valid_nip_oa_profiles_as_agents() { + let (agent, owner_pubkey) = oa_profile_event(r#"{"display_name":"Mira"}"#); + let pubkey = agent.pubkey.to_hex(); + let resp = users_batch_from_events(std::slice::from_ref(&agent), std::slice::from_ref(&pubkey)); + + assert!(resp.profiles[&pubkey].is_agent); + assert_eq!( + resp.profiles[&pubkey].owner_pubkey.as_deref(), + Some(owner_pubkey.as_str()) + ); +} + +#[test] +fn user_notes_builds_cursor_from_last() { + let e1 = ev(1, "first", vec![]); + let e2 = ev(1, "second", vec![]); + let r = user_notes_from_events(&[e1, e2]); + assert_eq!(r.notes.len(), 2); + assert_eq!(r.notes[0].content, "first"); + let cursor = r.next_cursor.expect("cursor"); + assert_eq!(cursor.before_id, r.notes[1].id); +} + +#[test] +fn user_notes_empty_has_no_cursor() { + let r = user_notes_from_events(&[]); + assert!(r.notes.is_empty()); + assert!(r.next_cursor.is_none()); +} + +#[test] +fn contact_list_preserves_tags_and_content() { + let pk = "1".repeat(64); + let e = ev(3, "rel-json", vec![vec!["p", &pk]]); + let r = contact_list_from_event(&e).unwrap(); + assert_eq!(r.content, "rel-json"); + assert_eq!(r.tags.len(), 1); + assert_eq!(r.tags[0], vec!["p".to_string(), pk]); +} + +#[test] +fn search_response_assigns_descending_scores() { + let e1 = ev(1, "one", vec![vec!["h", "chan"]]); + let e2 = ev(1, "two", vec![]); + let r = search_response_from_events(&[e1, e2]); + assert_eq!(r.found, 2); + assert!(r.hits[0].score > r.hits[1].score); + assert_eq!(r.hits[0].channel_id.as_deref(), Some("chan")); + assert!(r.hits[1].channel_id.is_none()); +} + +#[test] +fn search_response_single_hit_full_score() { + let e = ev(1, "only", vec![]); + let r = search_response_from_events(&[e]); + assert_eq!(r.hits.len(), 1); + assert_eq!(r.hits[0].score, 1.0); +} + +#[test] +fn agents_overwrites_pubkey_from_event_author() { + let e = ev(10100, r#"{"pubkey":"forged","name":"agent-1"}"#, vec![]); + let v = agents_from_events(std::slice::from_ref(&e)); + let arr = v.get("agents").and_then(Value::as_array).unwrap(); + assert_eq!(arr.len(), 1); + assert_eq!( + arr[0].get("pubkey").and_then(Value::as_str).unwrap(), + e.pubkey.to_hex() + ); + assert_eq!(arr[0].get("name").and_then(Value::as_str), Some("agent-1")); +} + +#[test] +fn agents_handles_invalid_content() { + let e = ev(10100, "not-json", vec![]); + let v = agents_from_events(std::slice::from_ref(&e)); + let arr = v.get("agents").and_then(Value::as_array).unwrap(); + assert_eq!( + arr[0].get("pubkey").and_then(Value::as_str).unwrap(), + e.pubkey.to_hex() + ); +} + +#[test] +fn agents_default_sparse_agent_profiles_for_directory_parse() { + let e = ev( + 10100, + r#"{"channel_add_policy":"owner-only","display_name":"Scout"}"#, + vec![], + ); + let v = agents_from_events(std::slice::from_ref(&e)); + let agents = v.get("agents").cloned().unwrap(); + let parsed: Vec = + serde_json::from_value(agents).unwrap(); + + assert_eq!(parsed.len(), 1); + assert_eq!(parsed[0].pubkey, e.pubkey.to_hex()); + assert_eq!(parsed[0].name, "Scout"); + assert_eq!(parsed[0].agent_type, "agent"); + assert_eq!(parsed[0].channels, Vec::::new()); + assert_eq!(parsed[0].capabilities, Vec::::new()); + assert_eq!(parsed[0].status, "offline"); + assert_eq!(parsed[0].respond_to, None); +} + +#[test] +fn agents_preserves_public_respond_to_mode_for_directory_parse() { + let e = ev(10100, r#"{"name":"Scout","respond_to":"anyone"}"#, vec![]); + let v = agents_from_events(std::slice::from_ref(&e)); + let agents = v.get("agents").cloned().unwrap(); + let parsed: Vec = + serde_json::from_value(agents).unwrap(); + + assert_eq!(parsed.len(), 1); + assert_eq!( + parsed[0].respond_to, + Some(crate::managed_agents::RespondTo::Anyone) + ); +} + +#[test] +fn agents_preserves_allowlist_metadata_for_directory_parse() { + let e = ev( + 10100, + r#"{"name":"Scout","respond_to":"allowlist","respond_to_allowlist":["aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]}"#, + vec![], + ); + let v = agents_from_events(std::slice::from_ref(&e)); + let agents = v.get("agents").cloned().unwrap(); + let parsed: Vec = + serde_json::from_value(agents).unwrap(); + + assert_eq!(parsed.len(), 1); + assert_eq!( + parsed[0].respond_to, + Some(crate::managed_agents::RespondTo::Allowlist) + ); + assert_eq!(parsed[0].respond_to_allowlist, vec!["a".repeat(64)]); +} + +#[test] +fn managed_agent_directory_accepts_only_the_verified_owner_policy() { + let agent_keys = Keys::generate(); + let owner_keys = Keys::generate(); + let attacker_keys = Keys::generate(); + let agent_pubkey = agent_keys.public_key().to_hex(); + let viewer_pubkey = "a".repeat(64); + + let auth_tag_json = + buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_keys.public_key(), "") + .expect("compute auth tag"); + let auth_tag_values: Vec = + serde_json::from_str(&auth_tag_json).expect("parse auth tag json"); + let profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Codex"}"#) + .tags([Tag::parse(auth_tag_values).expect("parse auth tag")]) + .sign_with_keys(&agent_keys) + .expect("sign profile"); + let authentic = managed_agent_event( + &owner_keys, + &agent_pubkey, + "Codex", + "allowlist", + std::slice::from_ref(&viewer_pubkey), + ); + let forged = managed_agent_event(&attacker_keys, &agent_pubkey, "Fake Codex", "anyone", &[]); + + let agents = relay_agents_from_managed_agent_events( + &[forged, authentic], + std::slice::from_ref(&profile), + ); + + assert_eq!(agents.len(), 1); + assert_eq!(agents[0].pubkey, agent_pubkey); + assert_eq!(agents[0].name, "Codex"); + assert_eq!( + agents[0].respond_to, + Some(crate::managed_agents::RespondTo::Allowlist) + ); + assert_eq!(agents[0].respond_to_allowlist, vec![viewer_pubkey]); +} + +#[test] +fn managed_agent_directory_rejects_agents_without_verified_owner_profiles() { + let owner_keys = Keys::generate(); + let unverified_agent_keys = Keys::generate(); + let agent_pubkey = unverified_agent_keys.public_key().to_hex(); + let profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Codex"}"#) + .sign_with_keys(&unverified_agent_keys) + .expect("sign profile"); + let managed = managed_agent_event(&owner_keys, &agent_pubkey, "Codex", "anyone", &[]); + + let agents = relay_agents_from_managed_agent_events( + std::slice::from_ref(&managed), + std::slice::from_ref(&profile), + ); + + assert!(agents.is_empty()); +} + +#[test] +fn managed_agent_directory_uses_the_latest_profile_head() { + let agent_keys = Keys::generate(); + let owner_keys = Keys::generate(); + let agent_pubkey = agent_keys.public_key().to_hex(); + let auth_tag_json = + buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_keys.public_key(), "") + .expect("compute auth tag"); + let auth_tag_values: Vec = + serde_json::from_str(&auth_tag_json).expect("parse auth tag json"); + let verified_profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Codex"}"#) + .tags([Tag::parse(auth_tag_values).expect("parse auth tag")]) + .custom_created_at(nostr::Timestamp::from(10)) + .sign_with_keys(&agent_keys) + .expect("sign verified profile"); + let revoked_profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Codex"}"#) + .custom_created_at(nostr::Timestamp::from(20)) + .sign_with_keys(&agent_keys) + .expect("sign revoked profile"); + let managed = managed_agent_event(&owner_keys, &agent_pubkey, "Codex", "anyone", &[]); + + let agents = relay_agents_from_managed_agent_events( + std::slice::from_ref(&managed), + &[verified_profile, revoked_profile], + ); + + assert!(agents.is_empty()); +} + +#[test] +fn managed_agent_candidates_use_only_relay_signed_bot_membership() { + let relay_keys = Keys::generate(); + let agent_pubkey = Keys::generate().public_key().to_hex(); + let stranger = Keys::generate().public_key().to_hex(); + let general = EventBuilder::new(Kind::Custom(39002), "") + .tags([ + Tag::parse(["d", "family"]).expect("parse d tag"), + Tag::parse(["p", &agent_pubkey, "", "bot"]).expect("parse agent tag"), + Tag::parse(["p", &stranger, "", "member"]).expect("parse member tag"), + ]) + .sign_with_keys(&relay_keys) + .expect("sign membership"); + let forged = ev( + 39002, + "", + vec![vec!["d", "forged"], vec!["p", &agent_pubkey, "", "bot"]], + ); + + let channel_ids = + member_agent_channel_ids_from_events(&[forged, general], &relay_keys.public_key().to_hex()); + + assert_eq!( + channel_ids.get(&agent_pubkey), + Some(&vec!["family".to_string()]) + ); + assert!(!channel_ids.contains_key(&stranger)); +} + +#[test] +fn managed_agent_directory_query_pubkeys_reject_malformed_d_tags() { + let valid_pubkey = Keys::generate().public_key().to_hex(); + let valid = ev(30177, "{}", vec![vec!["d", &valid_pubkey]]); + let malformed = ev(30177, "{}", vec![vec!["d", "not-a-pubkey"]]); + + let pubkeys = managed_agent_pubkeys_from_events(&[malformed, valid]); + + assert_eq!(pubkeys, [valid_pubkey].into_iter().collect()); +} + +#[test] +fn relay_agent_directory_preserves_headless_profiles_and_prefers_verified_managed_policy() { + let owner_keys = Keys::generate(); + let managed_agent_keys = Keys::generate(); + let managed_pubkey = managed_agent_keys.public_key().to_hex(); + let headless_keys = Keys::generate(); + let headless_pubkey = headless_keys.public_key().to_hex(); + let viewer_pubkey = "a".repeat(64); + + let headless_profile = EventBuilder::new( + Kind::Custom(10100), + serde_json::json!({ + "name": "Headless", + "respond_to": "anyone", + "channel_ids": ["untrusted-channel"] + }) + .to_string(), + ) + .sign_with_keys(&headless_keys) + .expect("sign headless directory profile"); + let stale_managed_profile = EventBuilder::new( + Kind::Custom(10100), + serde_json::json!({ + "name": "Stale Codex", + "respond_to": "anyone" + }) + .to_string(), + ) + .sign_with_keys(&managed_agent_keys) + .expect("sign managed directory profile"); + + let auth_tag_json = + buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &managed_agent_keys.public_key(), "") + .expect("compute auth tag"); + let auth_tag_values: Vec = + serde_json::from_str(&auth_tag_json).expect("parse auth tag json"); + let managed_identity = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Codex"}"#) + .tags([Tag::parse(auth_tag_values).expect("parse auth tag")]) + .sign_with_keys(&managed_agent_keys) + .expect("sign managed profile"); + let managed_policy = managed_agent_event( + &owner_keys, + &managed_pubkey, + "Codex", + "allowlist", + std::slice::from_ref(&viewer_pubkey), + ); + + let agents = relay_agents_from_directory_events( + &[headless_profile, stale_managed_profile], + std::slice::from_ref(&managed_policy), + std::slice::from_ref(&managed_identity), + ); + + assert_eq!(agents.len(), 2); + let headless = agents + .iter() + .find(|agent| agent.pubkey == headless_pubkey) + .expect("headless profile retained"); + assert_eq!( + headless.respond_to, + Some(crate::managed_agents::RespondTo::Anyone) + ); + assert!( + headless.channel_ids.is_empty(), + "claimed channel ids are not trusted" + ); + + let managed = agents + .iter() + .find(|agent| agent.pubkey == managed_pubkey) + .expect("managed profile retained"); + assert_eq!(managed.name, "Codex"); + assert_eq!( + managed.respond_to, + Some(crate::managed_agents::RespondTo::Allowlist) + ); + assert_eq!(managed.respond_to_allowlist, vec![viewer_pubkey]); +} + +#[test] +fn authenticated_malformed_managed_policy_does_not_fall_back_to_legacy_permissions() { + let owner_keys = Keys::generate(); + let agent_keys = Keys::generate(); + let agent_pubkey = agent_keys.public_key().to_hex(); + let legacy = EventBuilder::new( + Kind::Custom(10100), + r#"{"name":"Stale","respond_to":"anyone"}"#, + ) + .sign_with_keys(&agent_keys) + .expect("sign legacy profile"); + let auth_tag_json = + buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_keys.public_key(), "") + .expect("compute auth tag"); + let auth_tag_values: Vec = + serde_json::from_str(&auth_tag_json).expect("parse auth tag json"); + let profile = EventBuilder::new(Kind::Metadata, "{}") + .tags([Tag::parse(auth_tag_values).expect("parse auth tag")]) + .sign_with_keys(&agent_keys) + .expect("sign profile"); + let malformed = EventBuilder::new( + Kind::Custom(30177), + r#"{"name":"Current","parallelism":1,"respond_to":"future-mode"}"#, + ) + .tags([Tag::parse(["d", &agent_pubkey]).expect("parse d tag")]) + .sign_with_keys(&owner_keys) + .expect("sign managed policy"); + + let agents = relay_agents_from_directory_events(&[legacy], &[malformed], &[profile]); + + assert!(agents.is_empty()); +} + +#[test] +fn relay_agent_directory_resolves_equal_timestamp_heads_by_event_id() { + let keys = Keys::generate(); + let timestamp = nostr::Timestamp::from(42); + let first = EventBuilder::new( + Kind::Custom(10100), + r#"{"name":"First","respond_to":"anyone"}"#, + ) + .custom_created_at(timestamp) + .sign_with_keys(&keys) + .expect("sign first directory head"); + let second = EventBuilder::new( + Kind::Custom(10100), + r#"{"name":"Second","respond_to":"anyone"}"#, + ) + .custom_created_at(timestamp) + .sign_with_keys(&keys) + .expect("sign second directory head"); + let expected_name = if first.id < second.id { + "First" + } else { + "Second" + }; + + let forward = relay_agents_from_directory_events(&[first.clone(), second.clone()], &[], &[]); + let reverse = relay_agents_from_directory_events(&[second, first], &[], &[]); + + assert_eq!(forward.len(), 1); + assert_eq!(reverse.len(), 1); + assert_eq!(forward[0].name, expected_name); + assert_eq!(reverse[0].name, expected_name); +} + +#[test] +fn forged_managed_policy_cannot_suppress_a_headless_directory_agent() { + let attacker_keys = Keys::generate(); + let targeted_agent_keys = Keys::generate(); + let targeted_pubkey = targeted_agent_keys.public_key().to_hex(); + let headless_keys = Keys::generate(); + let headless_pubkey = headless_keys.public_key().to_hex(); + let targeted_profile = EventBuilder::new( + Kind::Custom(10100), + r#"{"name":"Targeted","respond_to":"anyone"}"#, + ) + .sign_with_keys(&targeted_agent_keys) + .expect("sign targeted profile"); + let headless = EventBuilder::new( + Kind::Custom(10100), + r#"{"name":"Headless","respond_to":"anyone"}"#, + ) + .sign_with_keys(&headless_keys) + .expect("sign headless profile"); + let forged_policy = managed_agent_event( + &attacker_keys, + &targeted_pubkey, + "Codex", + "allowlist", + &["a".repeat(64)], + ); + + let agents = relay_agents_from_directory_events( + &[targeted_profile, headless], + std::slice::from_ref(&forged_policy), + &[], + ); + + assert_eq!(agents.len(), 2); + assert!(agents.iter().any(|agent| agent.pubkey == targeted_pubkey)); + assert!(agents.iter().any(|agent| agent.pubkey == headless_pubkey)); +} + +#[test] +fn relay_members_dedupes_and_defaults_role() { + let pk1 = "a".repeat(64); + let pk2 = "b".repeat(64); + // Current relay format: ["member", pubkey, role] + let e = ev( + 13534, + "", + vec![ + vec!["member", &pk1, "owner"], + vec!["member", &pk2], + vec!["member", &pk1, "moderator"], // dupe — ignored + ], + ); + let v = relay_members_from_event(&e); + let arr = v.get("members").and_then(Value::as_array).unwrap(); + assert_eq!(arr.len(), 2); + assert_eq!(arr[0].get("role").and_then(Value::as_str), Some("owner")); + assert_eq!(arr[1].get("role").and_then(Value::as_str), Some("member")); +} + +#[test] +fn relay_members_fallback_p_tags() { + let pk1 = "a".repeat(64); + let pk2 = "b".repeat(64); + // Legacy/fallback format: ["p", pubkey, relay_url?, role?] + let e = ev( + 13534, + "", + vec![vec!["p", &pk1, "", "admin"], vec!["p", &pk2]], + ); + let v = relay_members_from_event(&e); + let arr = v.get("members").and_then(Value::as_array).unwrap(); + assert_eq!(arr.len(), 2); + assert_eq!(arr[0].get("role").and_then(Value::as_str), Some("admin")); + assert_eq!(arr[1].get("role").and_then(Value::as_str), Some("member")); +} + +#[test] +fn timestamp_to_iso_known_value() { + // 2021-01-01T00:00:00Z = 1609459200 + assert_eq!(timestamp_to_iso(1_609_459_200), "2021-01-01T00:00:00Z"); + // Epoch + assert_eq!(timestamp_to_iso(0), "1970-01-01T00:00:00Z"); +} diff --git a/desktop/src-tauri/src/observed_unread.rs b/desktop/src-tauri/src/observed_unread.rs new file mode 100644 index 00000000000..3ca59482627 --- /dev/null +++ b/desktop/src-tauri/src/observed_unread.rs @@ -0,0 +1,884 @@ +//! Native observed-unread read model. +//! +//! The renderer is the only writer today, so request/response ordering is the +//! delivery mechanism: there is no push channel. If native relay ingestion adds +//! a second writer, that assumption breaks; consumers must then use the same +//! revision-gap rule here to request a fresh snapshot. +//! +//! Failure contract: sequence + revision advance in the same SQLite transaction +//! as events, markers, pruning, and migration. A lost ack is replayed as a no-op; +//! a gap is rejected; stale-scope responses are fenced in the renderer. Legacy +//! rows and their migration marker commit together, and localStorage is removed +//! only after the renderer observes that marker. + +use std::{ + collections::{HashMap, HashSet}, + path::{Path, PathBuf}, + sync::{Arc, Mutex}, +}; + +use rusqlite::{params, Connection, Transaction}; +use serde::{Deserialize, Serialize}; +use tauri::{AppHandle, Manager, State}; + +const SCHEMA_VERSION: i64 = 1; +const PER_CHANNEL_CAP: i64 = 1_000; +const GLOBAL_CAP: i64 = 5_000; +const HORIZON_SECONDS: i64 = 7 * 24 * 60 * 60; + +/// Serializes the two observed-unread commands against each other. +/// +/// `Arc` because the guard is taken *inside* the blocking closure the commands +/// hand to `spawn_blocking`: a `std::sync::MutexGuard` is not `Send`, so it +/// cannot be acquired on the caller side of an await. Cloning the handle into +/// the closure keeps serialization identical while moving the wait off the +/// thread that runs the IPC handler. +#[derive(Default)] +pub(crate) struct ObservedUnreadStore { + write_lock: Arc>, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub(crate) struct ObservedUnreadScope { + pub(crate) pubkey: String, + pub(crate) relay_url: String, +} + +impl ObservedUnreadScope { + fn key(&self) -> String { + format!( + "{}:{}", + self.pubkey.trim().to_ascii_lowercase(), + self.relay_url.trim().trim_end_matches('/') + ) + } +} + +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(rename_all = "camelCase")] +struct IngestEvent { + channel_id: String, + id: String, + created_at: u64, + root_id: Option, + high_priority: bool, + counts_toward_badge: bool, + counts_toward_app_badge: bool, +} + +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(rename_all = "camelCase")] +struct ChannelLatestUpdate { + channel_id: String, + created_at: u64, +} + +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(rename_all = "camelCase")] +struct MarkerUpdate { + context_id: String, + read_at: Option, +} + +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(rename_all = "camelCase")] +struct MembershipUpdate { + kind: String, + value: String, + present: bool, +} + +#[derive(Clone, Debug, Default, Deserialize, Serialize)] +#[serde(rename_all = "camelCase")] +struct MembershipSeed { + participated_root_ids: Vec, + authored_root_ids: Vec, + mentioned_root_ids: Vec, + followed_root_ids: Vec, + muted_root_ids: Vec, + muted_channel_ids: Vec, +} + +#[derive(Deserialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct OpenScopeRequest { + scope: ObservedUnreadScope, + legacy_payload: Option, + membership_seed: Option, +} + +#[derive(Deserialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct IngestRequest { + scope: ObservedUnreadScope, + sequence: u64, + base_revision: u64, + events: Vec, + channel_latest: Vec, + markers: Vec, + membership: Vec, + clear_channels: Vec, + clear_all: bool, +} + +#[derive(Clone, Debug, PartialEq, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct ChannelProjection { + channel_id: String, + latest: u64, + count: u64, + badge_count: u64, + app_badge_count: u64, + top_level_unread: bool, + high_priority_unread: bool, +} + +#[derive(Debug, Serialize)] +#[serde( + tag = "kind", + rename_all = "camelCase", + rename_all_fields = "camelCase" +)] +pub(crate) enum ObservedUnreadResponse { + Snapshot { + scope: ObservedUnreadScope, + generation: String, + revision: u64, + last_acked_sequence: u64, + migration_complete: bool, + membership_seeded: bool, + channels: Vec, + }, + Delta { + scope: ObservedUnreadScope, + generation: String, + base_revision: u64, + revision: u64, + acked_sequence: u64, + upserts: Vec, + removed: Vec, + }, + SnapshotRequired { + scope: ObservedUnreadScope, + generation: String, + revision: u64, + last_acked_sequence: u64, + }, +} + +fn db_path(app: &AppHandle) -> Result { + let dir = app + .path() + .app_data_dir() + .map_err(|e| format!("resolve observed-unread data dir: {e}"))?; + std::fs::create_dir_all(&dir).map_err(|e| format!("create observed-unread data dir: {e}"))?; + Ok(dir.join("observed-unread.db")) +} + +fn open_db(path: &Path) -> Result { + let conn = Connection::open(path).map_err(|e| format!("open observed-unread db: {e}"))?; + conn.pragma_update(None, "busy_timeout", 5_000) + .map_err(|e| format!("configure observed-unread db: {e}"))?; + conn.pragma_update(None, "journal_mode", "WAL") + .map_err(|e| format!("configure observed-unread WAL: {e}"))?; + conn.execute_batch("CREATE TABLE IF NOT EXISTS schema_meta(version INTEGER NOT NULL); + INSERT INTO schema_meta(version) SELECT 1 WHERE NOT EXISTS(SELECT 1 FROM schema_meta); + CREATE TABLE IF NOT EXISTS scope_state( + scope TEXT PRIMARY KEY, generation TEXT NOT NULL, revision INTEGER NOT NULL DEFAULT 0, + last_sequence INTEGER NOT NULL DEFAULT 0, migration_complete INTEGER NOT NULL DEFAULT 0, + membership_seeded INTEGER NOT NULL DEFAULT 0); + CREATE TABLE IF NOT EXISTS observed_events( + scope TEXT NOT NULL, event_id TEXT NOT NULL, channel_id TEXT NOT NULL, + created_at INTEGER NOT NULL, root_id TEXT, high_priority INTEGER NOT NULL, + counts_badge INTEGER NOT NULL, counts_app_badge INTEGER NOT NULL, + PRIMARY KEY(scope,event_id)); + CREATE INDEX IF NOT EXISTS observed_events_channel ON observed_events(scope,channel_id,created_at,event_id); + CREATE TABLE IF NOT EXISTS channel_latest( + scope TEXT NOT NULL, channel_id TEXT NOT NULL, created_at INTEGER NOT NULL, + PRIMARY KEY(scope,channel_id)); + CREATE TABLE IF NOT EXISTS read_markers( + scope TEXT NOT NULL, context_id TEXT NOT NULL, read_at INTEGER NOT NULL, + PRIMARY KEY(scope,context_id)); + CREATE TABLE IF NOT EXISTS unread_membership( + scope TEXT NOT NULL, kind TEXT NOT NULL, value TEXT NOT NULL, + PRIMARY KEY(scope,kind,value));") + .map_err(|e| format!("initialize observed-unread db: {e}"))?; + let version: i64 = conn + .query_row("SELECT version FROM schema_meta LIMIT 1", [], |row| { + row.get(0) + }) + .map_err(|e| format!("read observed-unread schema: {e}"))?; + if version != SCHEMA_VERSION { + return Err(format!( + "unsupported observed-unread schema version {version}" + )); + } + Ok(conn) +} + +fn ensure_scope(tx: &Transaction<'_>, scope: &str) -> Result<(), String> { + tx.execute( + "INSERT OR IGNORE INTO scope_state(scope,generation) VALUES(?1,?2)", + params![scope, uuid::Uuid::new_v4().to_string()], + ) + .map_err(|e| format!("initialize observed-unread scope: {e}"))?; + Ok(()) +} + +fn state(tx: &Transaction<'_>, scope: &str) -> Result<(String, u64, u64, bool, bool), String> { + tx.query_row("SELECT generation,revision,last_sequence,migration_complete,membership_seeded FROM scope_state WHERE scope=?1", [scope], |r| Ok((r.get(0)?,r.get(1)?,r.get(2)?,r.get::<_,i64>(3)? != 0,r.get::<_,i64>(4)? != 0))) + .map_err(|e| format!("read observed-unread scope state: {e}")) +} + +fn valid_legacy_event(value: &serde_json::Value, channel_id: &str) -> Option { + let object = value.as_object()?; + Some(IngestEvent { + channel_id: channel_id.to_string(), + id: object.get("id")?.as_str()?.to_string(), + created_at: object.get("createdAt")?.as_u64()?, + root_id: match object.get("rootId")? { + serde_json::Value::Null => None, + v => Some(v.as_str()?.to_string()), + }, + high_priority: object.get("highPriority")?.as_bool()?, + counts_toward_badge: object.get("countsTowardBadge")?.as_bool()?, + counts_toward_app_badge: object.get("countsTowardAppBadge")?.as_bool()?, + }) +} + +fn upsert_event(tx: &Transaction<'_>, scope: &str, event: &IngestEvent) -> Result<(), String> { + tx.execute("INSERT INTO observed_events(scope,event_id,channel_id,created_at,root_id,high_priority,counts_badge,counts_app_badge) + VALUES(?1,?2,?3,?4,?5,?6,?7,?8) ON CONFLICT(scope,event_id) DO NOTHING", + params![scope,event.id,event.channel_id,event.created_at,event.root_id,event.high_priority,event.counts_toward_badge,event.counts_toward_app_badge]) + .map_err(|e| format!("upsert observed-unread event: {e}"))?; + Ok(()) +} + +fn seed_membership(tx: &Transaction<'_>, scope: &str, seed: &MembershipSeed) -> Result<(), String> { + // The renderer snapshot is authoritative while it remains the only writer. + // Replace transactionally so removals made while Buzz was closed are not + // silently resurrected by an insert-only seed. + tx.execute("DELETE FROM unread_membership WHERE scope=?1", [scope]) + .map_err(|e| format!("reset unread membership: {e}"))?; + for (kind, values) in [ + ("participated", &seed.participated_root_ids), + ("authored", &seed.authored_root_ids), + ("mentioned", &seed.mentioned_root_ids), + ("followed", &seed.followed_root_ids), + ("muted_root", &seed.muted_root_ids), + ("muted_channel", &seed.muted_channel_ids), + ] { + for value in values { + tx.execute( + "INSERT OR IGNORE INTO unread_membership(scope,kind,value) VALUES(?1,?2,?3)", + params![scope, kind, value], + ) + .map_err(|e| format!("seed unread membership: {e}"))?; + } + } + tx.execute( + "UPDATE scope_state SET membership_seeded=1 WHERE scope=?1", + [scope], + ) + .map_err(|e| format!("mark unread membership seeded: {e}"))?; + Ok(()) +} + +fn advance_channel_latest( + tx: &Transaction<'_>, + scope: &str, + channel_id: &str, + created_at: u64, +) -> Result<(), String> { + tx.execute( + "INSERT INTO channel_latest(scope,channel_id,created_at) VALUES(?1,?2,?3) ON CONFLICT(scope,channel_id) DO UPDATE SET created_at=MAX(created_at,excluded.created_at)", + params![scope, channel_id, created_at], + ) + .map_err(|e| format!("advance channel latest: {e}"))?; + Ok(()) +} + +fn seed_membership_once( + tx: &Transaction<'_>, + scope: &str, + membership_seeded: bool, + seed: Option<&MembershipSeed>, +) -> Result<(), String> { + if membership_seeded { + return Ok(()); + } + if let Some(seed) = seed { + seed_membership(tx, scope, seed)?; + } + Ok(()) +} + +fn prune(tx: &Transaction<'_>, scope: &str) -> Result<(), String> { + let cutoff = chrono::Utc::now().timestamp() - HORIZON_SECONDS; + tx.execute( + "DELETE FROM observed_events WHERE scope=?1 AND created_at<=?2", + params![scope, cutoff], + ) + .map_err(|e| format!("age-prune observed unread: {e}"))?; + tx.execute("DELETE FROM observed_events WHERE rowid IN (SELECT rowid FROM (SELECT rowid,ROW_NUMBER() OVER(PARTITION BY channel_id ORDER BY created_at DESC,event_id DESC) rank FROM observed_events WHERE scope=?1) WHERE rank>?2)", params![scope,PER_CHANNEL_CAP]).map_err(|e| format!("channel-prune observed unread: {e}"))?; + tx.execute("DELETE FROM observed_events WHERE rowid IN (SELECT rowid FROM observed_events WHERE scope=?1 ORDER BY created_at DESC,event_id DESC LIMIT -1 OFFSET ?2)", params![scope,GLOBAL_CAP]).map_err(|e| format!("global-prune observed unread: {e}"))?; + Ok(()) +} + +fn marker(markers: &HashMap, key: &str) -> u64 { + markers.get(key).copied().unwrap_or(0) +} + +fn projections(tx: &Transaction<'_>, scope: &str) -> Result, String> { + let mut marker_stmt = tx + .prepare("SELECT context_id,read_at FROM read_markers WHERE scope=?1") + .map_err(|e| format!("prepare unread markers: {e}"))?; + let markers: HashMap = marker_stmt + .query_map([scope], |r| Ok((r.get(0)?, r.get(1)?))) + .map_err(|e| format!("query unread markers: {e}"))? + .collect::>() + .map_err(|e| format!("read unread markers: {e}"))?; + let mut by_channel: HashMap = HashMap::new(); + let mut latest_stmt = tx + .prepare("SELECT channel_id,created_at FROM channel_latest WHERE scope=?1") + .map_err(|e| format!("prepare channel latest: {e}"))?; + for row in latest_stmt + .query_map([scope], |r| { + Ok((r.get::<_, String>(0)?, r.get::<_, u64>(1)?)) + }) + .map_err(|e| format!("query channel latest: {e}"))? + { + let (channel_id, latest) = row.map_err(|e| format!("read channel latest: {e}"))?; + by_channel.insert( + channel_id.clone(), + ChannelProjection { + channel_id, + latest, + count: 0, + badge_count: 0, + app_badge_count: 0, + top_level_unread: false, + high_priority_unread: false, + }, + ); + } + let mut stmt = tx.prepare("SELECT event_id,channel_id,created_at,root_id,high_priority,counts_badge,counts_app_badge FROM observed_events WHERE scope=?1 ORDER BY channel_id,created_at,event_id").map_err(|e| format!("prepare observed projection: {e}"))?; + let rows = stmt + .query_map([scope], |r| { + Ok(( + r.get::<_, String>(0)?, + r.get::<_, String>(1)?, + r.get::<_, u64>(2)?, + r.get::<_, Option>(3)?, + r.get::<_, bool>(4)?, + r.get::<_, bool>(5)?, + r.get::<_, bool>(6)?, + )) + }) + .map_err(|e| format!("query observed projection: {e}"))?; + for row in rows { + let (id, channel, created, root, high, badge, app) = + row.map_err(|e| format!("read observed projection: {e}"))?; + let mut read_at = marker(&markers, &channel).max(marker(&markers, &format!("msg:{id}"))); + if let Some(root) = &root { + read_at = read_at.max(marker(&markers, &format!("thread:{root}"))); + } + if created <= read_at { + continue; + } + let entry = by_channel + .entry(channel.clone()) + .or_insert(ChannelProjection { + channel_id: channel, + latest: 0, + count: 0, + badge_count: 0, + app_badge_count: 0, + top_level_unread: false, + high_priority_unread: false, + }); + entry.latest = entry.latest.max(created); + entry.count += 1; + entry.badge_count += u64::from(badge); + entry.app_badge_count += u64::from(app); + entry.top_level_unread |= root.is_none(); + entry.high_priority_unread |= high; + } + let mut result: Vec<_> = by_channel.into_values().collect(); + result.sort_by(|a, b| a.channel_id.cmp(&b.channel_id)); + Ok(result) +} + +/// Runs one observed-unread SQLite unit on the blocking pool. +/// +/// A sync `#[tauri::command]` is `ExecutionContext::Blocking`, which runs the +/// body inline in the IPC handler — the main thread on macOS. The projection is +/// linear in the whole scope (measured 7.2 ms release / 27.6 ms debug at +/// 15 channels / 5000 events, and callers issue these in per-root loops during +/// catch-up), so inline execution holds the UI thread past the 16.7 ms frame +/// budget. `archive_events` next door already routes its SQLite work this way; +/// these two were the exception. +/// +/// The token is what makes that structural rather than a convention. Its field +/// is private to this module, so `OnBlockingThread` cannot be constructed +/// anywhere else — and since the bodies below require one, a command that +/// stopped going through [`blocking::run`] would not compile. That covers both +/// regressions: dropping `async` leaves no way to await this, and keeping +/// `async` while calling a body directly leaves no way to obtain the token. +mod blocking { + /// Evidence that the holder is executing on the blocking pool. + pub(super) struct OnBlockingThread(()); + + pub(super) async fn run(task: F) -> Result + where + T: Send + 'static, + F: FnOnce(OnBlockingThread) -> Result + Send + 'static, + { + tauri::async_runtime::spawn_blocking(move || task(OnBlockingThread(()))) + .await + .map_err(|error| format!("observed-unread db task failed: {error}"))? + } +} +use blocking::OnBlockingThread; + +/// Off-thread execution lets two invocations reach the lock in an order the IPC +/// arrival order no longer fixes. Nothing here depends on that order: the +/// renderer keeps one call per scope in flight, and a request that arrives +/// against a moved revision is rejected with `SnapshotRequired` rather than +/// applied — the same gate that already covers a lost ack. +#[tauri::command] +pub(crate) async fn observed_unread_open_scope( + request: OpenScopeRequest, + app: AppHandle, + store: State<'_, ObservedUnreadStore>, +) -> Result { + let write_lock = Arc::clone(&store.write_lock); + blocking::run(move |proof| open_scope_locked(proof, &write_lock, &app, request)).await +} + +fn open_scope_locked( + _proof: OnBlockingThread, + write_lock: &Mutex<()>, + app: &AppHandle, + request: OpenScopeRequest, +) -> Result { + let _guard = write_lock.lock().map_err(|e| e.to_string())?; + let mut conn = open_db(&db_path(app)?)?; + let tx = conn + .transaction() + .map_err(|e| format!("begin observed-unread open: {e}"))?; + let scope = request.scope.key(); + ensure_scope(&tx, &scope)?; + let (_, _, _, migration_complete, membership_seeded) = state(&tx, &scope)?; + if !migration_complete { + if let Some(payload) = &request.legacy_payload { + if let Some(channels) = payload + .get("eventsByChannel") + .and_then(serde_json::Value::as_object) + { + for (channel, events) in channels { + if let Some(events) = events.as_array() { + for value in events { + if let Some(event) = valid_legacy_event(value, channel) { + upsert_event(&tx, &scope, &event)?; + } + } + } + } + } + } + tx.execute( + "UPDATE scope_state SET migration_complete=1 WHERE scope=?1", + [&scope], + ) + .map_err(|e| format!("mark observed migration: {e}"))?; + } + seed_membership_once( + &tx, + &scope, + membership_seeded, + request.membership_seed.as_ref(), + )?; + prune(&tx, &scope)?; + let channels = projections(&tx, &scope)?; + let (generation, revision, last, migrated, seeded) = state(&tx, &scope)?; + tx.commit() + .map_err(|e| format!("commit observed-unread open: {e}"))?; + Ok(ObservedUnreadResponse::Snapshot { + scope: request.scope, + generation, + revision, + last_acked_sequence: last, + migration_complete: migrated, + membership_seeded: seeded, + channels, + }) +} + +#[tauri::command] +pub(crate) async fn observed_unread_ingest( + request: IngestRequest, + app: AppHandle, + store: State<'_, ObservedUnreadStore>, +) -> Result { + let write_lock = Arc::clone(&store.write_lock); + blocking::run(move |proof| ingest_locked(proof, &write_lock, &app, request)).await +} + +fn ingest_locked( + _proof: OnBlockingThread, + write_lock: &Mutex<()>, + app: &AppHandle, + request: IngestRequest, +) -> Result { + let _guard = write_lock.lock().map_err(|e| e.to_string())?; + let mut conn = open_db(&db_path(app)?)?; + let tx = conn + .transaction() + .map_err(|e| format!("begin observed ingest: {e}"))?; + let scope = request.scope.key(); + ensure_scope(&tx, &scope)?; + let (generation, revision, last, _, _) = state(&tx, &scope)?; + if request.sequence <= last { + let channels = projections(&tx, &scope)?; + tx.commit() + .map_err(|e| format!("commit observed replay: {e}"))?; + return Ok(ObservedUnreadResponse::Snapshot { + scope: request.scope, + generation, + revision, + last_acked_sequence: last, + migration_complete: true, + membership_seeded: true, + channels, + }); + } + if request.sequence != last + 1 || request.base_revision != revision { + return Ok(ObservedUnreadResponse::SnapshotRequired { + scope: request.scope, + generation, + revision, + last_acked_sequence: last, + }); + } + let before = projections(&tx, &scope)?; + let before_by_channel: HashMap<_, _> = before + .into_iter() + .map(|projection| (projection.channel_id.clone(), projection)) + .collect(); + if request.clear_all { + tx.execute("DELETE FROM observed_events WHERE scope=?1", [&scope]) + .map_err(|e| format!("clear observed scope: {e}"))?; + tx.execute("DELETE FROM channel_latest WHERE scope=?1", [&scope]) + .map_err(|e| format!("clear channel latest scope: {e}"))?; + } + for channel in &request.clear_channels { + tx.execute( + "DELETE FROM observed_events WHERE scope=?1 AND channel_id=?2", + params![scope, channel], + ) + .map_err(|e| format!("clear observed channel: {e}"))?; + tx.execute( + "DELETE FROM channel_latest WHERE scope=?1 AND channel_id=?2", + params![scope, channel], + ) + .map_err(|e| format!("clear channel latest: {e}"))?; + } + for event in &request.events { + upsert_event(&tx, &scope, event)?; + } + for update in &request.channel_latest { + advance_channel_latest(&tx, &scope, &update.channel_id, update.created_at)?; + } + for update in &request.membership { + if update.present { + tx.execute( + "INSERT OR IGNORE INTO unread_membership(scope,kind,value) VALUES(?1,?2,?3)", + params![scope, update.kind, update.value], + ) + } else { + tx.execute( + "DELETE FROM unread_membership WHERE scope=?1 AND kind=?2 AND value=?3", + params![scope, update.kind, update.value], + ) + } + .map_err(|e| format!("update unread membership: {e}"))?; + } + for update in &request.markers { + match update.read_at { Some(read_at)=>{tx.execute("INSERT INTO read_markers(scope,context_id,read_at) VALUES(?1,?2,?3) ON CONFLICT(scope,context_id) DO UPDATE SET read_at=MAX(read_at,excluded.read_at)",params![scope,update.context_id,read_at])},None=>tx.execute("DELETE FROM read_markers WHERE scope=?1 AND context_id=?2",params![scope,update.context_id])}.map_err(|e| format!("update observed marker: {e}"))?; + } + prune(&tx, &scope)?; + let after = projections(&tx, &scope)?; + let after_ids: HashSet<_> = after + .iter() + .map(|projection| projection.channel_id.clone()) + .collect(); + let removed: Vec<_> = before_by_channel + .keys() + .filter(|channel_id| !after_ids.contains(*channel_id)) + .cloned() + .collect(); + let upserts: Vec<_> = after + .into_iter() + .filter(|projection| before_by_channel.get(&projection.channel_id) != Some(projection)) + .collect(); + let next_revision = revision + 1; + tx.execute( + "UPDATE scope_state SET revision=?2,last_sequence=?3 WHERE scope=?1", + params![scope, next_revision, request.sequence], + ) + .map_err(|e| format!("advance observed sequence: {e}"))?; + tx.commit() + .map_err(|e| format!("commit observed ingest: {e}"))?; + Ok(ObservedUnreadResponse::Delta { + scope: request.scope, + generation, + base_revision: revision, + revision: next_revision, + acked_sequence: request.sequence, + upserts, + removed, + }) +} + +pub(crate) fn load_membership( + app: &AppHandle, + scope: &ObservedUnreadScope, +) -> Result>, String> { + let conn = open_db(&db_path(app)?)?; + let key = scope.key(); + let mut stmt = conn + .prepare("SELECT kind,value FROM unread_membership WHERE scope=?1") + .map_err(|e| format!("prepare unread membership: {e}"))?; + let rows = stmt + .query_map([key], |row| { + Ok((row.get::<_, String>(0)?, row.get::<_, String>(1)?)) + }) + .map_err(|e| format!("query unread membership: {e}"))?; + let mut result: HashMap> = HashMap::new(); + for row in rows { + let (kind, value) = row.map_err(|e| format!("read unread membership: {e}"))?; + result.entry(kind).or_default().insert(value); + } + Ok(result) +} + +pub(crate) fn flush(app: &AppHandle) { + if let Ok(path) = db_path(app) { + if let Ok(conn) = open_db(&path) { + let _ = conn.execute_batch("PRAGMA wal_checkpoint(PASSIVE);"); + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + fn scope() -> ObservedUnreadScope { + ObservedUnreadScope { + pubkey: "PK".into(), + relay_url: "wss://relay/".into(), + } + } + fn db() -> (tempfile::TempDir, Connection) { + let dir = tempfile::tempdir().unwrap(); + let conn = open_db(&dir.path().join("observed-unread.db")).unwrap(); + (dir, conn) + } + #[test] + fn ingest_replay_gap_prune_and_projection() { + let (_d, mut conn) = db(); + let tx = conn.transaction().unwrap(); + let key = scope().key(); + ensure_scope(&tx, &key).unwrap(); + upsert_event( + &tx, + &key, + &IngestEvent { + channel_id: "ch".into(), + id: "e".into(), + created_at: chrono::Utc::now().timestamp() as u64, + root_id: Some("root".into()), + high_priority: true, + counts_toward_badge: true, + counts_toward_app_badge: false, + }, + ) + .unwrap(); + tx.execute( + "INSERT INTO read_markers(scope,context_id,read_at) VALUES(?1,'thread:root',0)", + [&key], + ) + .unwrap(); + let p = projections(&tx, &key).unwrap(); + assert_eq!(p[0].count, 1); + assert_eq!(p[0].badge_count, 1); + tx.commit().unwrap(); + } + #[test] + fn latest_anchor_survives_without_a_notify_event_and_seed_is_one_shot() { + let (_d, mut conn) = db(); + let tx = conn.transaction().unwrap(); + let key = scope().key(); + ensure_scope(&tx, &key).unwrap(); + let first = MembershipSeed { + participated_root_ids: vec!["kept".into()], + ..Default::default() + }; + seed_membership(&tx, &key, &first).unwrap(); + let empty = MembershipSeed::default(); + let (_, _, _, _, seeded) = state(&tx, &key).unwrap(); + if !seeded { + seed_membership(&tx, &key, &empty).unwrap(); + } + tx.execute( + "INSERT INTO channel_latest(scope,channel_id,created_at) VALUES(?1,'ch',42)", + [&key], + ) + .unwrap(); + let membership: i64 = tx + .query_row( + "SELECT COUNT(*) FROM unread_membership WHERE scope=?1 AND value='kept'", + [&key], + |r| r.get(0), + ) + .unwrap(); + assert_eq!(membership, 1); + let projected = projections(&tx, &key).unwrap(); + assert_eq!(projected[0].latest, 42); + assert_eq!(projected[0].count, 0); + } + #[test] + fn ingest_request_wire_accepts_channel_latest() { + let request: IngestRequest = serde_json::from_value(serde_json::json!({ + "scope":{"pubkey":"PK","relayUrl":"wss://relay/"}, + "sequence":1,"baseRevision":0,"events":[], + "channelLatest":[{"channelId":"ch","createdAt":42}], + "markers":[],"membership":[],"clearChannels":[],"clearAll":false + })) + .unwrap(); + assert_eq!(request.channel_latest[0].channel_id, "ch"); + assert_eq!(request.channel_latest[0].created_at, 42); + } + /// Both commands must stay `async`. A sync `#[tauri::command]` is + /// `ExecutionContext::Blocking` and runs its body inline in the IPC + /// handler — the main thread on macOS — which is the defect this fix + /// closes. The bound is the assertion: dropping `async` makes the return + /// type `Result`, which is not a `Future`, and this stops compiling. + /// + /// The companion half — `async` kept but the body called directly, skipping + /// `spawn_blocking` — is held by `blocking::OnBlockingThread`, which the + /// bodies require and only `blocking::run` can mint. This test survived that + /// mutant while it asserted the helper's own behavior; the token is what + /// killed it, so the invariant lives in the types, not here. + const _: () = { + fn returns_future(_: fn(A, B, C) -> F) {} + fn assert() { + returns_future( + observed_unread_open_scope + as fn(OpenScopeRequest, AppHandle, State<'static, ObservedUnreadStore>) -> _, + ); + returns_future( + observed_unread_ingest + as fn(IngestRequest, AppHandle, State<'static, ObservedUnreadStore>) -> _, + ); + } + let _ = assert; + }; + /// `blocking::run` must actually leave the caller's thread. This pins the + /// helper only; that the commands go *through* it is the token's job. + #[test] + fn blocking_run_leaves_the_calling_thread() { + let caller = std::thread::current().id(); + let observed = tauri::async_runtime::block_on(blocking::run(move |_proof| { + Ok::<_, String>(std::thread::current().id()) + })) + .unwrap(); + assert_ne!(observed, caller); + } + #[test] + fn second_seed_cannot_erase_discovered_membership() { + let (_d, mut conn) = db(); + let tx = conn.transaction().unwrap(); + let key = scope().key(); + ensure_scope(&tx, &key).unwrap(); + // First open seeds from the renderer. + let (_, _, _, _, seeded) = state(&tx, &key).unwrap(); + seed_membership_once( + &tx, + &key, + seeded, + Some(&MembershipSeed { + participated_root_ids: vec!["from-seed".into()], + ..Default::default() + }), + ) + .unwrap(); + // Native discovers a root incrementally (the ingest path). + tx.execute( + "INSERT INTO unread_membership(scope,kind,value) VALUES(?1,'participated','discovered')", + [&key], + ) + .unwrap(); + // Second open with an EMPTY seed must not erase it. + let (_, _, _, _, seeded) = state(&tx, &key).unwrap(); + seed_membership_once(&tx, &key, seeded, Some(&MembershipSeed::default())).unwrap(); + let kept: i64 = tx + .query_row( + "SELECT COUNT(*) FROM unread_membership WHERE scope=?1 AND value='discovered'", + [&key], + |r| r.get(0), + ) + .unwrap(); + assert_eq!(kept, 1, "an empty second seed erased discovered membership"); + } + + #[test] + fn channel_latest_anchor_never_moves_backward() { + let (_d, mut conn) = db(); + let tx = conn.transaction().unwrap(); + let key = scope().key(); + ensure_scope(&tx, &key).unwrap(); + let advance = |created_at: u64| { + advance_channel_latest(&tx, &key, "ch", created_at).unwrap(); + }; + advance(500); + advance(100); // an older catch-up trigger arriving late + let anchor: u64 = tx + .query_row( + "SELECT created_at FROM channel_latest WHERE scope=?1 AND channel_id='ch'", + [&key], + |r| r.get(0), + ) + .unwrap(); + assert_eq!( + anchor, 500, + "a late older trigger rewound the latest anchor" + ); + } + + #[test] + fn serialized_response_matches_typescript_contract() { + let actual = serde_json::to_value(ObservedUnreadResponse::Delta { + scope: scope(), + generation: "gen".into(), + base_revision: 4, + revision: 5, + acked_sequence: 7, + upserts: vec![ChannelProjection { + channel_id: "ch".into(), + latest: 42, + count: 2, + badge_count: 1, + app_badge_count: 1, + top_level_unread: true, + high_priority_unread: false, + }], + removed: vec!["old".into()], + }) + .unwrap(); + let expected = serde_json::json!({"kind":"delta","scope":{"pubkey":"PK","relayUrl":"wss://relay/"},"generation":"gen","baseRevision":4,"revision":5,"ackedSequence":7,"upserts":[{"channelId":"ch","latest":42,"count":2,"badgeCount":1,"appBadgeCount":1,"topLevelUnread":true,"highPriorityUnread":false}],"removed":["old"]}); + assert_eq!(actual, expected); + } +} diff --git a/desktop/src-tauri/src/persona_catalog.rs b/desktop/src-tauri/src/persona_catalog.rs new file mode 100644 index 00000000000..5d1717d67c3 --- /dev/null +++ b/desktop/src-tauri/src/persona_catalog.rs @@ -0,0 +1,296 @@ +//! Native persona-catalog fetch and trust-boundary projection. +//! +//! The renderer owns presentation/linkage to local personas. Relay paging, +//! signature verification, NIP-33 head selection, and untrusted-content parsing +//! stay here so a catalog refresh crosses IPC once instead of once per page and +//! never performs Schnorr verification on the webview thread. + +use std::{collections::HashMap, time::Duration}; + +use buzz_core_pkg::kind::KIND_PERSONA; +use nostr::Event; +use regex::Regex; +use serde::Serialize; +use serde_json::Value; +use std::sync::LazyLock; +use tauri::State; + +use crate::{ + app_state::AppState, managed_agents::validate_agent_definition_text, + native_relay_client::NativeRelayClient, +}; + +const CATALOG_PAGE_SIZE: usize = 500; +const MAX_CATALOG_PAGES: usize = 40; +const PAGE_TIMEOUT: Duration = Duration::from_secs(10); +const MAX_HTTP_AVATAR_LENGTH: usize = 2_048; +const INLINE_SVG_AVATAR_PREFIX: &str = "data:image/svg+xml,"; +const MAX_INLINE_SVG_AVATAR_LENGTH: usize = 8_192; +const MAX_INLINE_RASTER_AVATAR_LENGTH: usize = 256 * 1_024; + +static INLINE_RASTER_AVATAR: LazyLock> = LazyLock::new(|| { + Regex::new(r"^data:image/(?:png|jpeg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$").ok() +}); + +#[derive(Debug, PartialEq, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct PersonaCatalogPublication { + event_id: String, + owner_pubkey: String, + source_persona_id: String, + created_at: u64, + agent: CatalogAgentProjection, +} + +#[derive(Debug, PartialEq, Serialize)] +#[serde(rename_all = "camelCase")] +struct CatalogAgentProjection { + display_name: String, + avatar_url: Option, + system_prompt: String, + runtime: Option, + model: Option, + provider: Option, + name_pool: Vec, + respond_to: Option, + parallelism: Option, +} + +/// Fetches the active community's relay-confirmed persona catalog. +/// +/// The command accepts no relay or identity input: both are snapshotted from +/// `AppState`, then checked again before return so an in-flight old-community +/// response cannot populate the new community's query cache. +#[tauri::command] +pub(crate) async fn fetch_persona_catalog( + state: State<'_, AppState>, + relay_client: State<'_, NativeRelayClient>, +) -> Result, String> { + let keys = state.signing_keys()?; + let owner = keys.public_key().to_hex(); + let relay_url = crate::relay::relay_ws_url_with_override(&state); + let session = relay_client.session(relay_url.clone(), keys).await; + let mut by_id = HashMap::new(); + let mut until = None; + + for _ in 0..MAX_CATALOG_PAGES { + let mut filter = serde_json::json!({ + "kinds": [KIND_PERSONA], + "limit": CATALOG_PAGE_SIZE, + }); + if let Some(until) = until { + filter["until"] = serde_json::json!(until); + } + let page = session.fetch_events(filter, PAGE_TIMEOUT).await?; + let page_len = page.len(); + // Schnorr verification is CPU-bound. Keep the complete page off the + // async executor (and therefore off Tauri command scheduling). + let verified = tauri::async_runtime::spawn_blocking(move || { + page.into_iter() + .filter(|event| event.verify().is_ok()) + .collect::>() + }) + .await + .map_err(|error| format!("catalog signature verification failed: {error}"))?; + + let progress = merge_verified_page(&mut by_id, page_len, verified); + match progress { + PageProgress::Done => break, + PageProgress::Next(next_until) => until = Some(next_until), + } + } + + let current_keys = state.signing_keys()?; + if current_keys.public_key().to_hex() != owner + || crate::relay::relay_ws_url_with_override(&state) != relay_url + { + return Err("persona catalog scope changed while fetching".to_string()); + } + + Ok(publications_from_verified_events( + by_id.into_values().collect(), + )) +} + +#[derive(Debug, PartialEq)] +enum PageProgress { + Done, + Next(u64), +} + +fn merge_verified_page( + by_id: &mut HashMap, + wire_page_len: usize, + verified: Vec, +) -> PageProgress { + let size_before = by_id.len(); + let oldest = verified + .iter() + .map(|event| event.created_at.as_secs()) + .min(); + for event in verified { + by_id.insert(event.id.to_hex(), event); + } + + // A short page is the end of the catalog; a page of only repeats means the + // inclusive `until` cursor cannot advance past tied timestamps. + if wire_page_len < CATALOG_PAGE_SIZE || by_id.len() == size_before { + return PageProgress::Done; + } + // A full page of invalid signatures cannot supply a trusted cursor. + oldest.map_or(PageProgress::Done, PageProgress::Next) +} + +fn publications_from_verified_events(mut events: Vec) -> Vec { + events.sort_by(|left, right| { + right + .created_at + .cmp(&left.created_at) + .then_with(|| left.id.cmp(&right.id)) + }); + let mut claimed = std::collections::HashSet::new(); + let mut publications = Vec::new(); + + for event in events { + if event.kind.as_u16() as u32 != KIND_PERSONA { + continue; + } + let Some(source_persona_id) = coordinate_tag(&event, "d") else { + continue; + }; + if source_persona_id.is_empty() { + continue; + } + let owner_pubkey = event.pubkey.to_hex().to_ascii_lowercase(); + let coordinate = (owner_pubkey.clone(), source_persona_id.clone()); + if !claimed.insert(coordinate) { + continue; + } + + // Claim happens before visibility or parsing. A valid newest unshared + // or malformed head is still the NIP-33 head and must not resurrect an + // older shared definition. + if exact_tag(&event, "shared").as_deref() != Some("true") { + continue; + } + let Some(agent) = parse_agent(&event.content) else { + continue; + }; + publications.push(PersonaCatalogPublication { + event_id: event.id.to_hex(), + owner_pubkey, + source_persona_id, + created_at: event.created_at.as_secs(), + agent, + }); + } + publications +} + +fn coordinate_tag(event: &Event, name: &str) -> Option { + let matches = event + .tags + .iter() + .filter_map(|tag| { + let values = tag.as_slice(); + (values.len() >= 2 && values.first().is_some_and(|value| value == name)) + .then(|| values[1].clone()) + }) + .collect::>(); + (matches.len() == 1).then(|| matches[0].clone()) +} + +fn exact_tag(event: &Event, name: &str) -> Option { + let matches = event + .tags + .iter() + .filter_map(|tag| { + let values = tag.as_slice(); + (values.len() == 2 && values.first().is_some_and(|value| value == name)) + .then(|| values[1].clone()) + }) + .collect::>(); + (matches.len() == 1).then(|| matches[0].clone()) +} + +fn parse_agent(content: &str) -> Option { + let value: Value = serde_json::from_str(content).ok()?; + let object = value.as_object()?; + let display_name = object.get("display_name")?.as_str()?.to_string(); + let system_prompt = object + .get("system_prompt") + .and_then(Value::as_str) + .unwrap_or_default() + .to_string(); + validate_agent_definition_text(&display_name, &system_prompt).ok()?; + + let respond_to = match object.get("respond_to").and_then(Value::as_str) { + Some("allowlist") => Some("owner-only".to_string()), + Some(value @ ("owner-only" | "anyone")) => Some(value.to_string()), + _ => None, + }; + let parallelism = object + .get("parallelism") + .and_then(Value::as_u64) + .filter(|value| (1..=32).contains(value)); + let name_pool = object + .get("name_pool") + .and_then(Value::as_array) + .map(|values| { + values + .iter() + .filter_map(Value::as_str) + .map(ToOwned::to_owned) + .collect() + }) + .unwrap_or_default(); + + Some(CatalogAgentProjection { + display_name, + avatar_url: object + .get("avatar_url") + .and_then(Value::as_str) + .filter(|value| safe_avatar(value)) + .map(ToOwned::to_owned), + system_prompt, + runtime: optional_string(object.get("runtime")), + model: optional_string(object.get("model")), + provider: optional_string(object.get("provider")), + name_pool, + respond_to, + parallelism, + }) +} + +fn optional_string(value: Option<&Value>) -> Option { + value + .and_then(Value::as_str) + .filter(|value| !value.trim().is_empty()) + .map(ToOwned::to_owned) +} + +fn safe_avatar(value: &str) -> bool { + if value.starts_with(INLINE_SVG_AVATAR_PREFIX) { + return value.len() <= MAX_INLINE_SVG_AVATAR_LENGTH; + } + if value.len() <= MAX_INLINE_RASTER_AVATAR_LENGTH { + if let Some(captures) = INLINE_RASTER_AVATAR + .as_ref() + .and_then(|pattern| pattern.captures(value)) + { + return captures + .get(1) + .is_some_and(|payload| payload.as_str().len() % 4 == 0); + } + } + value.len() <= MAX_HTTP_AVATAR_LENGTH + && !value.chars().any(char::is_whitespace) + && !value.contains(['(', ')']) + && url::Url::parse(value) + .ok() + .is_some_and(|url| matches!(url.scheme(), "http" | "https")) +} + +#[cfg(test)] +#[path = "persona_catalog_tests.rs"] +mod tests; diff --git a/desktop/src-tauri/src/persona_catalog_tests.rs b/desktop/src-tauri/src/persona_catalog_tests.rs new file mode 100644 index 00000000000..d3175ef9807 --- /dev/null +++ b/desktop/src-tauri/src/persona_catalog_tests.rs @@ -0,0 +1,235 @@ +use super::*; +use nostr::{EventBuilder, Keys, Kind, Tag, Timestamp}; +use serde_json::json; + +fn event(keys: &Keys, created_at: u64, source: &str, shared: bool, content: Value) -> Event { + let mut tags = vec![Tag::parse(["d", source]).unwrap()]; + if shared { + tags.push(Tag::parse(["shared", "true"]).unwrap()); + } + EventBuilder::new(Kind::Custom(KIND_PERSONA as u16), content.to_string()) + .tags(tags) + .custom_created_at(Timestamp::from(created_at)) + .sign_with_keys(keys) + .unwrap() +} + +fn valid_content(name: &str) -> Value { + json!({ + "display_name": name, + "system_prompt": "Review changes.", + "avatar_url": "https://relay.example/avatar.png", + "runtime": " goose ", + "model": "claude", + "provider": null, + "name_pool": ["Reviewer", 7], + "respond_to": "allowlist", + "parallelism": 4 + }) +} + +#[test] +fn paging_uses_oldest_verified_cursor_and_stops_on_ties_or_short_pages() { + let keys = Keys::generate(); + let newest = event(&keys, 9, "newest", true, valid_content("Newest")); + let oldest = event(&keys, 4, "oldest", true, valid_content("Oldest")); + let mut by_id = HashMap::new(); + + assert_eq!( + merge_verified_page( + &mut by_id, + CATALOG_PAGE_SIZE, + vec![newest.clone(), oldest.clone()] + ), + PageProgress::Next(4) + ); + assert_eq!( + merge_verified_page(&mut by_id, CATALOG_PAGE_SIZE, vec![newest, oldest]), + PageProgress::Done + ); + + let short = event(&keys, 1, "short", true, valid_content("Short")); + assert_eq!( + merge_verified_page(&mut by_id, CATALOG_PAGE_SIZE - 1, vec![short]), + PageProgress::Done + ); + assert_eq!( + merge_verified_page(&mut HashMap::new(), CATALOG_PAGE_SIZE, Vec::new()), + PageProgress::Done + ); +} + +#[test] +fn forged_newest_head_is_dropped_before_it_can_claim_the_coordinate() { + let keys = Keys::generate(); + let older = event(&keys, 1, "reviewer", true, valid_content("Older")); + let mut forged = event(&keys, 2, "reviewer", true, valid_content("Forged")); + forged.content = valid_content("Tampered").to_string(); + + let verified = [older.clone(), forged] + .into_iter() + .filter(|candidate| candidate.verify().is_ok()) + .collect(); + let publications = publications_from_verified_events(verified); + assert_eq!(publications.len(), 1); + assert_eq!(publications[0].event_id, older.id.to_hex()); +} + +#[test] +fn valid_newest_head_claims_before_visibility_and_content_parsing() { + let keys = Keys::generate(); + for newest in [ + event(&keys, 2, "reviewer", false, valid_content("Unshared")), + event(&keys, 2, "reviewer", true, json!({})), + ] { + let older = event(&keys, 1, "reviewer", true, valid_content("Older")); + assert!(publications_from_verified_events(vec![older, newest]).is_empty()); + } +} + +#[test] +fn equal_second_heads_use_lowest_event_id_and_authors_are_independent() { + let alice = Keys::generate(); + let bob = Keys::generate(); + let shared = event(&alice, 1, "reviewer", true, valid_content("Shared")); + let unshared = event(&alice, 1, "reviewer", false, valid_content("Hidden")); + let bob_head = event(&bob, 1, "reviewer", true, valid_content("Bob")); + let expected_alice = if shared.id < unshared.id { 1 } else { 0 }; + + let publications = publications_from_verified_events(vec![shared, unshared, bob_head]); + assert_eq!(publications.len(), expected_alice + 1); +} + +#[test] +fn parser_projects_types_and_foreign_allowlists_exactly() { + let projection = parse_agent(&valid_content("Reviewer").to_string()).unwrap(); + assert_eq!(projection.display_name, "Reviewer"); + assert_eq!(projection.runtime.as_deref(), Some(" goose ")); + assert_eq!(projection.provider, None); + assert_eq!(projection.name_pool, vec!["Reviewer"]); + assert_eq!(projection.respond_to.as_deref(), Some("owner-only")); + assert_eq!(projection.parallelism, Some(4)); + + for bad in [0, 33] { + let mut content = valid_content("Reviewer"); + content["parallelism"] = json!(bad); + assert_eq!(parse_agent(&content.to_string()).unwrap().parallelism, None); + } +} + +#[test] +fn parser_rejects_malformed_and_invisible_definition_text() { + for content in [ + "not-json".to_string(), + "[]".to_string(), + json!({"display_name": 7}).to_string(), + valid_content("Review\u{202e}er").to_string(), + ] { + assert!(parse_agent(&content).is_none()); + } + let visible = parse_agent( + &json!({ + "display_name": "Reviewer 🐝", + "system_prompt": "Review.\n\t||literal markdown||" + }) + .to_string(), + ) + .unwrap(); + assert_eq!(visible.display_name, "Reviewer 🐝"); +} + +#[test] +fn avatar_allowlist_and_bounds_match_the_renderer_contract() { + assert!(safe_avatar("https://relay.example/avatar.png")); + assert!(!safe_avatar("javascript:alert(1)")); + assert!(safe_avatar("data:image/svg+xml,")); + assert!(!safe_avatar(&format!( + "data:image/svg+xml,{}", + "a".repeat(MAX_INLINE_SVG_AVATAR_LENGTH) + ))); + for mime in ["png", "jpeg", "gif", "webp"] { + assert!(safe_avatar(&format!( + "data:image/{mime};base64,iVBORw0KGgo=" + ))); + } + assert!(!safe_avatar("data:image/bmp;base64,aA==")); + assert!(!safe_avatar("data:image/png;base64,not base64")); +} + +#[test] +fn exact_tags_reject_duplicates_and_extra_fields() { + let keys = Keys::generate(); + let base = event(&keys, 1, "reviewer", true, valid_content("Reviewer")); + assert_eq!(exact_tag(&base, "shared").as_deref(), Some("true")); + + let duplicate = EventBuilder::new( + Kind::Custom(KIND_PERSONA as u16), + valid_content("x").to_string(), + ) + .tags([ + Tag::parse(["d", "reviewer"]).unwrap(), + Tag::parse(["shared", "true"]).unwrap(), + Tag::parse(["shared", "true"]).unwrap(), + ]) + .sign_with_keys(&keys) + .unwrap(); + assert_eq!(exact_tag(&duplicate, "shared"), None); + + // The old renderer accepts an extended d tag (it reads tag[1]) but shared + // is opt-in only for the exact two-field shape. + let extended = EventBuilder::new( + Kind::Custom(KIND_PERSONA as u16), + valid_content("x").to_string(), + ) + .tags([ + Tag::parse(["d", "reviewer", "relay hint"]).unwrap(), + Tag::parse(["shared", "true", "extra"]).unwrap(), + ]) + .sign_with_keys(&keys) + .unwrap(); + assert_eq!(coordinate_tag(&extended, "d").as_deref(), Some("reviewer")); + assert_eq!(exact_tag(&extended, "shared"), None); +} + +/// Pins the serialized DTO output against the renderer's catalog contract. +/// The Tauri generic is only a TypeScript assertion; serde's bytes are the +/// actual boundary, so populate every optional field and compare the value. +#[test] +fn serialized_catalog_matches_the_typescript_contract() { + let publication = PersonaCatalogPublication { + event_id: "ev1".into(), + owner_pubkey: "owner".into(), + source_persona_id: "persona-1".into(), + created_at: 42, + agent: CatalogAgentProjection { + display_name: "Ada".into(), + avatar_url: Some("https://example.com/a.png".into()), + system_prompt: "be kind".into(), + runtime: Some("acp".into()), + model: Some("m1".into()), + provider: Some("p1".into()), + name_pool: vec!["Ada".into(), "Lin".into()], + respond_to: Some("mentions".into()), + parallelism: Some(2), + }, + }; + let actual = serde_json::to_value(vec![publication]).unwrap(); + let expected = serde_json::json!([{ + "eventId": "ev1", + "ownerPubkey": "owner", + "sourcePersonaId": "persona-1", + "createdAt": 42, + "agent": { + "displayName": "Ada", + "avatarUrl": "https://example.com/a.png", + "systemPrompt": "be kind", + "runtime": "acp", + "model": "m1", + "provider": "p1", + "namePool": ["Ada", "Lin"], + "respondTo": "mentions", + "parallelism": 2, + }, + }]); + assert_eq!(actual, expected); +} diff --git a/desktop/src-tauri/src/ptt_shortcut.rs b/desktop/src-tauri/src/ptt_shortcut.rs index a80af67a4d9..7a85140f5af 100644 --- a/desktop/src-tauri/src/ptt_shortcut.rs +++ b/desktop/src-tauri/src/ptt_shortcut.rs @@ -8,6 +8,111 @@ use crate::huddle::HuddleState; #[cfg(not(test))] use crate::huddle::{HuddlePhase, VoiceInputMode}; +use tauri::{Builder, Runtime}; + +/// Install the global-shortcut plugin and its push-to-talk key handler. +/// +/// No-op in test builds: linking the plugin into the lib-test binary makes it +/// fail to load on Windows (STATUS_ENTRYPOINT_NOT_FOUND) before any test runs. +/// `sync_registration` is stubbed out under the same cfg for the same reason. +#[cfg(test)] +pub fn install(builder: Builder) -> Builder { + builder +} + +/// Install the global-shortcut plugin and its push-to-talk key handler. +/// +/// Registration itself is driven by huddle state through [`sync_registration`]; +/// this only installs the plugin the handler runs on. +#[cfg(not(test))] +pub fn install(builder: Builder) -> Builder { + use crate::app_state::AppState; + use std::sync::Arc; + use tauri::{Emitter, Manager}; + use tauri_plugin_global_shortcut::ShortcutState; + + // Generation counter for the release delay task. Incremented on + // every press — a delayed release only fires if the generation + // hasn't changed (i.e. no new press happened during the delay). + // This prevents press→release→press within 200 ms from having + // the first release clobber the second press. + let ptt_press_gen = Arc::new(std::sync::atomic::AtomicU64::new(0)); + + builder.plugin( + tauri_plugin_global_shortcut::Builder::new() + .with_handler(move |app, _shortcut, event| { + let state = match app.try_state::() { + Some(s) => s, + None => return, + }; + + // Only act if a huddle is active and mode is PTT. + let (is_ptt_mode, is_active) = match state.huddle_state.lock() { + Ok(hs) => ( + hs.voice_input_mode == VoiceInputMode::PushToTalk, + matches!(hs.phase, HuddlePhase::Connected | HuddlePhase::Active), + ), + Err(_) => return, + }; + + if !is_ptt_mode || !is_active { + return; + } + + match event.state { + ShortcutState::Pressed => { + // Bump generation — invalidates any pending release delay. + ptt_press_gen.fetch_add(1, std::sync::atomic::Ordering::Release); + + if let Ok(hs) = state.huddle_state.lock() { + hs.ptt_active + .store(true, std::sync::atomic::Ordering::Release); + // Only cancel TTS if it's actually playing — avoids + // a stale cancel flag that drops the next queued message. + if hs.tts_active.load(std::sync::atomic::Ordering::Acquire) { + hs.tts_cancel + .store(true, std::sync::atomic::Ordering::Release); + } + } + // Emit ptt-state=true to the frontend. + // The React side plays the press audio cue on this event + // (Web Audio API via HuddleContext). Rust-side rodio audio + // was considered but rejected: the rodio OutputStream must + // outlive the handler and sharing it across the shortcut + // closure adds lifecycle complexity for marginal gain. + // The React implementation is sufficient and simpler. + let _ = app.emit("ptt-state", true); + } + ShortcutState::Released => { + // Capture generation at release time. + let gen_at_release = + ptt_press_gen.load(std::sync::atomic::Ordering::Acquire); + let gen_arc = Arc::clone(&ptt_press_gen); + let app_handle = app.clone(); + // 200 ms release delay — captures the tail of the utterance. + // Only applies if no new press happened during the delay. + tauri::async_runtime::spawn(async move { + tokio::time::sleep(std::time::Duration::from_millis(200)).await; + // Check generation — if it changed, a new press arrived. + if gen_arc.load(std::sync::atomic::Ordering::Acquire) != gen_at_release + { + return; // Superseded by a new press. + } + if let Some(state) = app_handle.try_state::() { + if let Ok(hs) = state.huddle_state.lock() { + hs.ptt_active + .store(false, std::sync::atomic::Ordering::Release); + } + } + // Emit ptt-state=false — React plays the release audio cue. + let _ = app_handle.emit("ptt-state", false); + }); + } + } + }) + .build(), + ) +} /// Whether the PTT shortcut should currently be reserved with the OS. #[cfg(not(test))] diff --git a/desktop/src-tauri/src/relay.rs b/desktop/src-tauri/src/relay.rs index 71aa21c4133..f408ef2afda 100644 --- a/desktop/src-tauri/src/relay.rs +++ b/desktop/src-tauri/src/relay.rs @@ -16,6 +16,19 @@ const DEFAULT_RELAY_WS_URL: &str = "ws://localhost:3000"; // classifier keys on. Extracted to a const so a test can pin that contract. const MALFORMED_RESPONSE_MESSAGE: &str = "relay returned malformed response: not valid JSON"; +// Per-request deadline for the `POST /query` HTTP bridge, covering both the +// header exchange and full body consumption. The shared `http_client` sets no +// client-level timeout — deliberately, because it is also used for long-running +// STT/TTS model downloads, builderlab auth, and the media proxy — so a stalled +// or half-open `/query` connection would otherwise leave the request pending +// forever, hanging the caller (e.g. a thread-history load that never resolves +// and shows a permanent skeleton). A per-request timeout scoped to `/query` +// bounds that without affecting the client's other users. A timeout surfaces +// through `classify_request_error` as the stable `"relay unreachable: request +// timed out"` string. Set above the 25s WS history timeout so a slow-but-live +// relay is not cut off before the WebSocket path would be. +const QUERY_REQUEST_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30); + fn configured_env_var(name: &str) -> Option { std::env::var(name) .ok() @@ -31,7 +44,7 @@ pub fn relay_ws_url() -> String { /// Read the workspace relay URL override, if set. Returns `None` when no /// override is active or when the mutex is poisoned (best-effort). -fn workspace_relay_override(state: &AppState) -> Option { +pub(crate) fn workspace_relay_override(state: &AppState) -> Option { state .relay_url_override .lock() @@ -84,6 +97,12 @@ pub fn relay_http_base_url(relay_url: &str) -> String { trimmed.to_string() } +mod scope; +pub use scope::{ + assert_expected_relay_scope, assert_expected_signer, bind_expected_relay_scope, + bind_expected_signer, ScopedWorkspaceRelay, +}; + pub fn relay_api_base_url() -> String { if let Some(base) = configured_env_var("BUZZ_RELAY_HTTP") { return base.trim_end_matches('/').to_string(); @@ -161,6 +180,22 @@ pub(crate) fn classify_request_error(e: &reqwest::Error) -> String { } } +/// Preserve a body-consumption timeout as the stable connectivity classification. +/// +/// `send()` resolves once response headers arrive, so a body that stalls past +/// the request deadline trips the timeout during body consumption rather than +/// at `send()`. That is a connectivity failure, not a malformed body or a plain +/// status error. Both body-consumption paths — the 2xx `parse_json_response` +/// and the non-2xx `relay_error_message` — route their consumption error +/// through this one helper so a stalled body can never be classified as +/// "request timed out" on one path while the other buries it under a malformed +/// or status label. Returns `Some("relay unreachable: request timed out")` for +/// a timeout; `None` otherwise, leaving the caller to apply its own non-timeout +/// label. +fn classify_body_timeout(e: &reqwest::Error) -> Option { + e.is_timeout().then(|| classify_request_error(e)) +} + /// Detect responses that were intercepted by a captive portal or auth proxy. /// /// Returns `Some(msg)` when the response clearly did not come from the relay: @@ -224,10 +259,16 @@ pub(crate) async fn parse_json_response( // "relay unreachable:" bucket so it surfaces loudly instead of being treated // as a transient unreachable-relay condition. The reqwest error detail is // dropped because it contains the raw URL. - response - .json::() - .await - .map_err(|_| MALFORMED_RESPONSE_MESSAGE.to_string()) + // + // A body-consumption timeout is the exception: `send()` resolves once + // headers arrive, so a body that stalls past the request deadline trips the + // timeout HERE rather than at send(). That is a connectivity failure, not a + // malformed body, so route it through `classify_body_timeout` — the same + // helper the non-2xx error-body path uses — to preserve the stable + // "relay unreachable: request timed out" label. + response.json::().await.map_err(|e| { + classify_body_timeout(&e).unwrap_or_else(|| MALFORMED_RESPONSE_MESSAGE.to_string()) + }) } /// Extract the `retry in Ns` hint from a rate-limit error string. @@ -258,7 +299,21 @@ pub async fn relay_error_message(response: reqwest::Response) -> String { } // Real relay error: extract the structured message field if available. - let body = response.text().await.unwrap_or_default(); + // `text()` consumes the body, which — like the 2xx path — can trip the + // request deadline if the relay sends status headers then stalls the body. + // Preserve that timeout as the stable connectivity classification via the + // shared helper instead of letting `unwrap_or_default` swallow it into a + // bare status label. A non-timeout body error still degrades to an empty + // body → status-only message, exactly as before. + let body = match response.text().await { + Ok(body) => body, + Err(e) => { + if let Some(timeout) = classify_body_timeout(&e) { + return timeout; + } + String::new() + } + }; // 429 Too Many Requests → typed `relay rate-limited:` prefix so the TS // client can activate the rate-limit gate without confusing it with a @@ -322,22 +377,15 @@ pub async fn query_relay_at( let body_bytes = serde_json::to_vec(filters).map_err(|e| format!("filter serialization failed: {e}"))?; let auth = build_nip98_auth_header(&Method::POST, &url, &body_bytes, state)?; - - let response = state - .http_client - .post(&url) - .header("Authorization", auth) - .header("Content-Type", "application/json") - .body(body_bytes) - .send() - .await - .map_err(|e| classify_request_error(&e))?; - - if !response.status().is_success() { - return Err(relay_error_message(response).await); - } - - parse_json_response(response).await + send_query_request( + &state.http_client, + &url, + &auth, + None, + body_bytes, + QUERY_REQUEST_TIMEOUT, + ) + .await } pub async fn query_relay_at_with_keys( @@ -352,11 +400,38 @@ pub async fn query_relay_at_with_keys( let body_bytes = serde_json::to_vec(filters).map_err(|e| format!("filter serialization failed: {e}"))?; let auth = build_nip98_auth_header_for_keys(keys, &Method::POST, &url, &body_bytes)?; - let mut request = state - .http_client - .post(&url) + send_query_request( + &state.http_client, + &url, + &auth, + auth_tag, + body_bytes, + QUERY_REQUEST_TIMEOUT, + ) + .await +} + +/// Issue an authenticated `POST /query` and parse the response, applying the +/// per-request `timeout` that bounds a stalled or half-open relay connection. +/// +/// Both `/query` builders funnel through this one helper so the timeout can +/// never be applied to one builder and dropped from the other, and so a test +/// can drive the real send/timeout/classify path with a short deadline against +/// a stalled loopback. A timeout surfaces through `classify_request_error` as +/// the stable `"relay unreachable: request timed out"` string. +async fn send_query_request( + http_client: &reqwest::Client, + url: &str, + auth: &str, + auth_tag: Option<&str>, + body_bytes: Vec, + timeout: std::time::Duration, +) -> Result, String> { + let mut request = http_client + .post(url) .header("Authorization", auth) - .header("Content-Type", "application/json"); + .header("Content-Type", "application/json") + .timeout(timeout); if let Some(tag) = auth_tag { request = request.header("x-auth-tag", tag); } @@ -532,9 +607,13 @@ pub struct AgentProfileInfo { // ── Signed-event submission ───────────────────────────────────────────────── +mod get; +pub use get::get_relay_json; + mod submit; pub use submit::{ - submit_event, submit_event_at_with_keys, submit_signed_event_at_with_keys, SubmitEventResponse, + submit_event, submit_event_at_created_at, submit_event_at_with_keys, + submit_event_with_keys_created_at, submit_signed_event_at_with_keys, SubmitEventResponse, }; /// Sign an event with explicit keys and POST it to `/events` with NIP-98 auth. @@ -601,380 +680,4 @@ pub async fn submit_signed_event_with_keys( // ── Tests ─────────────────────────────────────────────────────────────────── #[cfg(test)] -mod tests { - use super::{ - build_profile_event, classify_intercepted_response, effective_agent_relay_url, - extract_retry_in_hint, parse_command_response, relay_http_base_url, - MALFORMED_RESPONSE_MESSAGE, - }; - use serde::Deserialize; - - // ── extract_retry_in_hint ──────────────────────────────────────────────── - - #[test] - fn extracts_hint_from_429_body() { - assert_eq!( - extract_retry_in_hint(r#"{"error":"rate-limited: quota exceeded; retry in 4s"}"#), - Some(4) - ); - } - - #[test] - fn extracts_hint_when_no_json_wrapper() { - assert_eq!(extract_retry_in_hint("retry in 30s"), Some(30)); - } - - #[test] - fn returns_none_when_no_hint_present() { - assert_eq!( - extract_retry_in_hint(r#"{"error":"rate-limited: quota exceeded"}"#), - None - ); - assert_eq!(extract_retry_in_hint(""), None); - } - - #[test] - fn overlong_digit_string_returns_none() { - // A digit sequence that exceeds u64::MAX cannot be parsed; the function - // must return None (→ caller uses the default) rather than panicking. - assert_eq!( - extract_retry_in_hint("retry in 99999999999999999999999s"), - None - ); - } - - // ── relay_error_message: hint capping ──────────────────────────────────── - // - // Verify that an oversized relay hint is capped in the returned message - // string, not just inside `activate_rate_limit()`. This guarantees every - // consumer — including the TS gate via `applyTauriRateLimitIfNeeded` — - // receives the capped value rather than the raw untrusted relay value. - - #[tokio::test] - async fn oversized_hint_is_capped_in_relay_error_message_string() { - use crate::relay_admission::MAX_HINT_SECONDS; - use std::io::{Read as _, Write as _}; - - // Use a std::net listener on a std::thread — the same pattern as the - // relay_admission loopback tests. This avoids two races that cause CI - // failures with tokio::net + into_std(): - // 1. No request read: the client is still sending when the response - // arrives → hyper `UnexpectedMessage`/`Canceled` under load. - // 2. into_std() leaves the socket in nonblocking mode → write_all - // may return WouldBlock and silently drop the response. - let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); - let addr = listener.local_addr().unwrap(); - - // Serve a 429 with a hint far exceeding MAX_HINT_SECONDS (300). - let oversized = 1_000_000u64; - let body = format!(r#"{{"error":"rate-limited: quota exceeded; retry in {oversized}s"}}"#); - let body_len = body.len(); - std::thread::spawn(move || { - if let Ok((mut stream, _)) = listener.accept() { - // Read the request first so the client finishes sending before - // we write the response — mirrors relay_admission.rs pattern. - let mut buf = [0u8; 4096]; - let _ = stream.read(&mut buf); - let response = format!( - "HTTP/1.1 429 Too Many Requests\r\nContent-Type: application/json\r\nContent-Length: {body_len}\r\nConnection: close\r\n\r\n{body}" - ); - let _ = stream.write_all(response.as_bytes()); - let _ = stream.flush(); - } - }); - - let client = reqwest::Client::new(); - let response = client - .get(format!("http://{addr}/")) - .send() - .await - .expect("request must succeed"); - - let msg = super::relay_error_message(response).await; - - // The message must embed the CAPPED hint, not the raw 1 000 000. - assert_eq!( - msg, - format!("relay rate-limited: retry in {MAX_HINT_SECONDS}s"), - "relay_error_message must embed the capped hint, not the raw untrusted value" - ); - assert!( - !msg.contains(&oversized.to_string()), - "raw oversized hint must not appear in the message string" - ); - } - - // ── effective_agent_relay_url: legacy pin ignored ───────────────────────── - - #[test] - fn stored_relay_pin_is_ignored() { - // Zero-touch cutover (#2122): a creation-era per-record relay pin is - // parsed and persisted but never consulted — the workspace relay wins. - assert_eq!( - effective_agent_relay_url("wss://relay.other.com", "wss://staging.example.com"), - "wss://staging.example.com" - ); - } - - #[test] - fn empty_relay_resolves_to_workspace() { - // A never-set record resolves to the active workspace relay at read-time, - // so a stale stored default can never make it load-bearing. - assert_eq!( - effective_agent_relay_url("", "wss://staging.example.com"), - "wss://staging.example.com" - ); - } - - #[test] - fn whitespace_only_relay_resolves_to_workspace() { - // Whitespace-only behaves identically — no value survives. - assert_eq!( - effective_agent_relay_url(" ", "wss://staging.example.com"), - "wss://staging.example.com" - ); - } - - // ── relay_http_base_url scheme conversion ──────────────────────────────── - - #[test] - fn loopback_ws_localhost_preserves_authority() { - // Tenant host-binding keys off the HTTP Host/authority. The desktop must - // not rewrite localhost to 127.0.0.1, or local dev HTTP calls target a - // different unmapped community than the WebSocket URL. - assert_eq!( - relay_http_base_url("ws://localhost:3000"), - "http://localhost:3000" - ); - } - - #[test] - fn loopback_trailing_slash_removed_authority_preserved() { - assert_eq!( - relay_http_base_url("ws://localhost:3000/"), - "http://localhost:3000" - ); - } - - #[test] - fn remote_wss_host_unchanged() { - assert_eq!( - relay_http_base_url("wss://relay.example.com"), - "https://relay.example.com" - ); - } - - #[test] - fn loopback_ipv4_literal_unchanged() { - assert_eq!( - relay_http_base_url("ws://127.0.0.1:3000"), - "http://127.0.0.1:3000" - ); - } - - #[test] - fn localhost_substring_host_unchanged() { - assert_eq!( - relay_http_base_url("ws://localhost.evil.com:3000"), - "http://localhost.evil.com:3000" - ); - } - - #[test] - fn loopback_wss_localhost_preserves_authority() { - assert_eq!( - relay_http_base_url("wss://localhost:3000"), - "https://localhost:3000" - ); - } - - // ── classify_intercepted_response ──────────────────────────────────────── - - #[test] - fn intercepted_cloudflare_host_returns_some() { - let result = classify_intercepted_response("sqprod.cloudflareaccess.com", "text/html"); - assert!(result.is_some()); - let msg = result.unwrap(); - assert!( - msg.starts_with("relay unreachable:"), - "should have unreachable prefix" - ); - assert!(msg.contains("Cloudflare"), "should mention Cloudflare"); - } - - #[test] - fn intercepted_cloudflare_apex_host_returns_some() { - // The apex domain itself should also match. - let result = classify_intercepted_response("cloudflareaccess.com", "application/json"); - assert!(result.is_some()); - let msg = result.unwrap(); - assert!(msg.starts_with("relay unreachable:")); - assert!(msg.contains("Cloudflare")); - } - - #[test] - fn intercepted_non_cloudflare_html_returns_some() { - let result = - classify_intercepted_response("proxy.corporate.example", "text/html; charset=utf-8"); - assert!(result.is_some()); - let msg = result.unwrap(); - assert!(msg.starts_with("relay unreachable:")); - } - - #[test] - fn normal_relay_json_returns_none() { - let result = classify_intercepted_response("relay.myapp.example.com", "application/json"); - assert!(result.is_none()); - } - - #[test] - fn content_type_case_insensitive() { - // Uppercase content-type must still be detected. - let result = classify_intercepted_response("proxy.example.com", "TEXT/HTML"); - assert!(result.is_some()); - assert!(result.unwrap().starts_with("relay unreachable:")); - } - - #[test] - fn evil_suffix_does_not_match_cloudflare() { - // A host whose suffix happens to contain the Cloudflare string but is - // not actually a subdomain must NOT match. - let result = classify_intercepted_response( - "notcloudflareaccess.com.evil.example", - "application/json", - ); - assert!( - result.is_none(), - "false suffix match should not trigger Cloudflare branch" - ); - } - - // classify_request_error requires a real reqwest::Error (not publicly - // constructable) — tested indirectly through integration; skipped here. - - // ── parse_json_response malformed-body contract ────────────────────────── - - #[test] - fn malformed_response_message_stays_off_unreachable_bucket() { - // A reached-but-malformed 2xx body is not a connectivity failure. If this - // message ever regains the "relay unreachable:" prefix, the frontend - // classifier would misroute it as unreachable — pin that it never does. - assert!( - !MALFORMED_RESPONSE_MESSAGE.starts_with("relay unreachable:"), - "malformed-response message must not match the unreachable prefix" - ); - } - - // ── parse_command_response ─────────────────────────────────────────────── - - #[derive(Debug, Deserialize, PartialEq)] - struct ChannelCreated { - channel_id: String, - } - - #[test] - fn parse_command_response_decodes_typed_payload() { - let msg = r#"response:{"channel_id":"abc123"}"#; - let parsed: ChannelCreated = parse_command_response(msg).expect("should parse"); - assert_eq!( - parsed, - ChannelCreated { - channel_id: "abc123".to_string() - } - ); - } - - #[test] - fn parse_command_response_accepts_raw_json_fallback() { - // Backward-compat: relays that emit raw JSON (no prefix) still work. - let msg = r#"{"channel_id":"abc"}"#; - let parsed: ChannelCreated = parse_command_response(msg).expect("fallback parse"); - assert_eq!( - parsed, - ChannelCreated { - channel_id: "abc".to_string() - } - ); - } - - #[test] - fn parse_command_response_rejects_invalid_prefixed_json() { - let msg = "response:not-json"; - let result: Result = parse_command_response(msg); - assert!(result.is_err()); - assert!(result.unwrap_err().contains("response parse failed")); - } - - #[test] - fn parse_command_response_rejects_garbage() { - let msg = "totally not json or response"; - let result: Result = parse_command_response(msg); - assert!(result.is_err()); - } - - // ── build_profile_event ────────────────────────────────────────────────── - - /// Generate a valid NIP-OA auth tag JSON string signed by a fresh owner key - /// and addressed to `agent_keys`. - /// - /// Uses `nostr_compat` (nostr 0.36) for the owner keys because - /// `buzz_sdk_pkg::nip_oa::compute_auth_tag` expects nostr 0.36 types. - /// The agent pubkey is bridged via hex encoding. - fn make_valid_auth_tag(agent_keys: &nostr::Keys) -> String { - let owner_keys = nostr::Keys::generate(); - let agent_pubkey_hex = agent_keys.public_key().to_hex(); - let agent_compat_pubkey = - nostr::PublicKey::from_hex(&agent_pubkey_hex).expect("valid hex pubkey should parse"); - buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_compat_pubkey, "") - .expect("compute_auth_tag should not fail with distinct keys") - } - - #[test] - fn profile_event_with_valid_auth_tag() { - let agent_keys = nostr::Keys::generate(); - let tag_json = make_valid_auth_tag(&agent_keys); - let event = build_profile_event(&agent_keys, "TestBot", None, Some(&tag_json)) - .expect("should succeed with a valid auth tag"); - - // Exactly one "auth" tag must be present. - let auth_tags: Vec<_> = event - .tags - .iter() - .filter(|t| t.as_slice().first().map(|s| s.as_str()) == Some("auth")) - .collect(); - assert_eq!(auth_tags.len(), 1, "expected exactly 1 auth tag"); - - // Must be a kind:0 (Metadata) event. - assert_eq!(event.kind, nostr::Kind::Metadata); - } - - #[test] - fn profile_event_without_auth_tag() { - let agent_keys = nostr::Keys::generate(); - let event = build_profile_event(&agent_keys, "TestBot", None, None) - .expect("should succeed without an auth tag"); - - // No "auth" tags should be present. - let auth_tags: Vec<_> = event - .tags - .iter() - .filter(|t| t.as_slice().first().map(|s| s.as_str()) == Some("auth")) - .collect(); - assert_eq!(auth_tags.len(), 0, "expected no auth tags"); - - assert_eq!(event.kind, nostr::Kind::Metadata); - } - - #[test] - fn profile_event_rejects_invalid_auth_tag() { - let agent_keys = nostr::Keys::generate(); - // Structurally valid JSON array but with a bogus signature — verification must fail. - let bad_json = format!(r#"["auth","{}","","{}"]"#, "a".repeat(64), "b".repeat(128)); - let result = build_profile_event(&agent_keys, "TestBot", None, Some(&bad_json)); - assert!(result.is_err(), "should reject an invalid auth tag"); - assert!( - result.unwrap_err().contains("verification failed"), - "error message should mention verification failure" - ); - } -} +mod tests; diff --git a/desktop/src-tauri/src/relay/get.rs b/desktop/src-tauri/src/relay/get.rs new file mode 100644 index 00000000000..7d0855f463f --- /dev/null +++ b/desktop/src-tauri/src/relay/get.rs @@ -0,0 +1,37 @@ +use reqwest::Method; +use serde::de::DeserializeOwned; + +use crate::app_state::AppState; + +use super::{ + build_nip98_auth_header, classify_request_error, parse_json_response, + relay_api_base_url_with_override, relay_error_message, +}; + +/// Execute an authenticated GET against the active relay and decode its JSON body. +pub async fn get_relay_json( + state: &AppState, + path_with_query: &str, +) -> Result { + if !path_with_query.starts_with('/') { + return Err("relay GET path must begin with '/'".to_string()); + } + crate::relay_admission::wait_for_rate_limit().await; + let url = format!( + "{}{}", + relay_api_base_url_with_override(state), + path_with_query + ); + let auth = build_nip98_auth_header(&Method::GET, &url, &[], state)?; + let response = state + .http_client + .get(&url) + .header("Authorization", auth) + .send() + .await + .map_err(|error| classify_request_error(&error))?; + if !response.status().is_success() { + return Err(relay_error_message(response).await); + } + parse_json_response(response).await +} diff --git a/desktop/src-tauri/src/relay/scope.rs b/desktop/src-tauri/src/relay/scope.rs new file mode 100644 index 00000000000..b9c73328aff --- /dev/null +++ b/desktop/src-tauri/src/relay/scope.rs @@ -0,0 +1,239 @@ +use super::relay_http_base_url; + +/// Fail closed when a caller-captured relay scope no longer matches the +/// relay a command actually resolved. +/// +/// Long-lived UI callbacks (e.g. the Projects agent submit flow) capture the +/// community relay before their first await; a workspace switch during that +/// await would otherwise retarget the eventual publication to the new +/// tenant's relay. Callers pass the captured scope as a ws(s) URL; it is +/// normalized through [`relay_http_base_url`] and compared against the base +/// the command resolved once and uses for every side effect. `None` preserves +/// the unscoped behavior for callers without a tenant boundary. +pub fn assert_expected_relay_scope( + expected_relay_url: Option<&str>, + resolved_api_base_url: &str, +) -> Result<(), String> { + let Some(expected) = expected_relay_url.map(str::trim).filter(|s| !s.is_empty()) else { + return Ok(()); + }; + let expected_base = relay_http_base_url(expected); + if expected_base != resolved_api_base_url.trim().trim_end_matches('/') { + return Err( + "active community changed before the message was submitted; not sent".to_string(), + ); + } + Ok(()) +} + +/// A workspace-relay read that has passed the caller-captured scope check. +/// +/// The only constructor is [`bind_expected_relay_scope`], so any side effect +/// that takes this type is proven — by construction — to consume the exact +/// value the check passed on, never a re-read of the mutable override. This +/// closes the check/use gap where a workspace switch landing between a scope +/// assertion and the side effect retargets it to a tenant the caller never +/// validated. +#[derive(Debug)] +pub struct ScopedWorkspaceRelay(String); + +impl ScopedWorkspaceRelay { + pub fn as_str(&self) -> &str { + &self.0 + } +} + +/// Validate a caller-captured relay scope against one workspace-relay read +/// and bind that exact read for the side effect to consume. +/// +/// `None` preserves the unscoped behavior for callers without a tenant +/// boundary — the read is still bound so the side effect stays single-read. +pub fn bind_expected_relay_scope( + expected_relay_url: Option<&str>, + workspace_relay_url: String, +) -> Result { + assert_expected_relay_scope( + expected_relay_url, + &relay_http_base_url(&workspace_relay_url), + )?; + Ok(ScopedWorkspaceRelay(workspace_relay_url)) +} + +/// Fail closed when a caller-captured signer identity no longer matches the +/// identity a command actually read. +/// +/// The relay URL and the signing keys live under separate locks and a +/// workspace switch mutates them in sequence, so a caller that only pins the +/// relay can still have its event signed — and its NIP-98 auth minted — by +/// the *new* tenant's identity if the switch lands between the URL check and +/// the key read. Callers capture the expected owner pubkey together with the +/// relay scope; commands read one identity snapshot, assert it here, and use +/// that exact snapshot for every signature. `None` preserves the unscoped +/// behavior for callers without a tenant boundary. +pub fn assert_expected_signer( + expected_signer_pubkey: Option<&str>, + actual_signer_hex: &str, +) -> Result<(), String> { + let Some(expected) = expected_signer_pubkey + .map(str::trim) + .filter(|s| !s.is_empty()) + else { + return Ok(()); + }; + if !expected.eq_ignore_ascii_case(actual_signer_hex) { + return Err( + "active identity changed before the message was submitted; not sent".to_string(), + ); + } + Ok(()) +} + +/// A workspace-signer read that has passed the caller-captured identity check. +/// +/// The only constructor is [`bind_expected_signer`], so side effects consume +/// the exact owner read that was validated rather than a stale pre-await value. +#[derive(Debug)] +pub struct ScopedWorkspaceSigner(String); + +impl ScopedWorkspaceSigner { + pub fn as_str(&self) -> &str { + &self.0 + } +} + +/// Validate a caller-captured signer against one active-owner read and bind +/// that exact read for the side effect to consume. `None` preserves unscoped +/// callers while still making the owner input single-read. +pub fn bind_expected_signer( + expected_signer_pubkey: Option<&str>, + actual_signer_hex: String, +) -> Result { + assert_expected_signer(expected_signer_pubkey, &actual_signer_hex)?; + Ok(ScopedWorkspaceSigner(actual_signer_hex)) +} + +#[cfg(test)] +mod tests { + use super::{ + assert_expected_relay_scope, assert_expected_signer, bind_expected_relay_scope, + bind_expected_signer, + }; + + #[test] + fn matching_scope_passes_across_ws_http_normalization() { + assert_expected_relay_scope(Some("wss://tenant-a.example"), "https://tenant-a.example") + .unwrap(); + assert_expected_relay_scope(Some("ws://localhost:3000"), "http://localhost:3000").unwrap(); + // Trailing-slash and whitespace tolerance mirrors relay_http_base_url. + assert_expected_relay_scope( + Some(" wss://tenant-a.example/ "), + "https://tenant-a.example/", + ) + .unwrap(); + } + + #[test] + fn changed_scope_fails_closed() { + let error = + assert_expected_relay_scope(Some("wss://tenant-a.example"), "https://tenant-b.example") + .unwrap_err(); + assert!(error.contains("active community changed"), "{error}"); + } + + #[test] + fn absent_scope_preserves_unscoped_sends() { + assert_expected_relay_scope(None, "https://anything.example").unwrap(); + assert_expected_relay_scope(Some(""), "https://anything.example").unwrap(); + assert_expected_relay_scope(Some(" "), "https://anything.example").unwrap(); + } + + #[test] + fn bound_scope_is_immune_to_a_switch_landing_after_the_bind() { + // Models the round-7 startup race: the caller captured tenant A, the + // post-preflight bind reads the workspace relay while it is still A, + // and THEN the switch to B lands — after the check, before the spawn. + // The spawn consumes the BOUND value, not a re-read, so the pair can + // only ever be keyed to the tenant the caller validated; the switch + // mutates state the spawn no longer consults. + let mut workspace = "wss://tenant-a.example".to_string(); + let bound = + bind_expected_relay_scope(Some("wss://tenant-a.example"), workspace.clone()).unwrap(); + workspace = "wss://tenant-b.example".to_string(); // the switch lands post-check + assert_eq!(bound.as_str(), "wss://tenant-a.example"); + assert_ne!( + bound.as_str(), + workspace, + "spawn input must be the checked value" + ); + } + + #[test] + fn bind_fails_closed_when_the_switch_lands_before_the_read() { + // The switch landed during the preflight await, so the one workspace + // read already sees tenant B: no relay may be released to the spawn. + let error = bind_expected_relay_scope( + Some("wss://tenant-a.example"), + "wss://tenant-b.example".to_string(), + ) + .unwrap_err(); + assert!(error.contains("active community changed"), "{error}"); + } + + #[test] + fn bind_returns_the_exact_read_for_unscoped_callers() { + let bound = bind_expected_relay_scope(None, "wss://anything.example".to_string()).unwrap(); + assert_eq!(bound.as_str(), "wss://anything.example"); + } + + // The round-7 pair-key regression moved to + // `managed_agents::runtime::tests::production_spawn_key_derives_from_the_bound_relay_not_the_post_switch_workspace`, + // which exercises `bound_runtime_key` — the seam production spawn keys on — + // instead of reconstructing the derivation by hand here. + + #[test] + fn matching_signer_passes_case_insensitively() { + let keys = nostr::Keys::generate(); + let hex = keys.public_key().to_hex(); + assert_expected_signer(Some(&hex), &hex).unwrap(); + assert_expected_signer(Some(&hex.to_ascii_uppercase()), &hex).unwrap(); + assert_expected_signer(Some(&format!(" {hex} ")), &hex).unwrap(); + } + + #[test] + fn changed_signer_fails_closed() { + // Models the workspace-switch race: the caller captured tenant A's + // owner identity, but the switch landed before the command read the + // keys, so the snapshot now holds tenant B's identity. + let captured = nostr::Keys::generate().public_key().to_hex(); + let switched = nostr::Keys::generate().public_key().to_hex(); + let error = assert_expected_signer(Some(&captured), &switched).unwrap_err(); + assert!(error.contains("active identity changed"), "{error}"); + } + + #[test] + fn signer_bind_fails_closed_after_same_relay_identity_switch() { + let captured = nostr::Keys::generate().public_key().to_hex(); + let switched = nostr::Keys::generate().public_key().to_hex(); + let error = bind_expected_signer(Some(&captured), switched).unwrap_err(); + assert!(error.contains("active identity changed"), "{error}"); + } + + #[test] + fn signer_bind_returns_exact_read_for_scoped_and_unscoped_callers() { + let actual = nostr::Keys::generate().public_key().to_hex(); + let scoped = bind_expected_signer(Some(&actual), actual.clone()).unwrap(); + assert_eq!(scoped.as_str(), actual); + + let unscoped_actual = nostr::Keys::generate().public_key().to_hex(); + let unscoped = bind_expected_signer(None, unscoped_actual.clone()).unwrap(); + assert_eq!(unscoped.as_str(), unscoped_actual); + } + + #[test] + fn absent_signer_preserves_unscoped_sends() { + let hex = nostr::Keys::generate().public_key().to_hex(); + assert_expected_signer(None, &hex).unwrap(); + assert_expected_signer(Some(""), &hex).unwrap(); + assert_expected_signer(Some(" "), &hex).unwrap(); + } +} diff --git a/desktop/src-tauri/src/relay/submit.rs b/desktop/src-tauri/src/relay/submit.rs index eaad29d3b17..b6a5703fd96 100644 --- a/desktop/src-tauri/src/relay/submit.rs +++ b/desktop/src-tauri/src/relay/submit.rs @@ -76,3 +76,50 @@ pub async fn submit_event( let keys = state.signing_keys()?; submit_event_at_with_keys(builder, state, &api_base_url, &keys).await } + +/// Sign with an explicit identity, submit to an explicit HTTP API base URL, +/// and also return the signed event's `created_at`. +/// +/// Callers that persist a timestamp as an event cursor (e.g. the Projects +/// conversation opener) need the signed event's own second — a +/// post-publication clock read can land a second later and permanently +/// exclude other events stamped in the event's real second. +/// +/// The explicit base (rather than a re-read of the workspace override at +/// submit time) matters for the same callers: they validated a tenant scope +/// against the resolved base earlier in the same command, and re-resolving +/// here would reopen the window where a workspace switch retargets the event +/// after the check passed. The explicit `keys` close the sibling window: the +/// relay URL and the signing keys mutate under separate locks during a +/// workspace switch, so re-reading the keys here could sign — and NIP-98 +/// authenticate — the event as the *new* tenant's identity after the caller +/// validated the old one. The caller passes the exact snapshot it asserted. +pub async fn submit_event_at_created_at( + builder: nostr::EventBuilder, + state: &AppState, + api_base_url: &str, + keys: &nostr::Keys, +) -> Result<(SubmitEventResponse, i64), String> { + let event = builder + .sign_with_keys(keys) + .map_err(|e| format!("failed to sign event: {e}"))?; + let created_at = event.created_at.as_secs() as i64; + let result = submit_signed_event_at_with_keys(&event, state, api_base_url, keys).await?; + Ok((result, created_at)) +} + +/// Like `submit_event_with_keys`, but also returns the signed event's +/// `created_at` — same cursor rationale as [`submit_event_at_created_at`]. +pub async fn submit_event_with_keys_created_at( + builder: nostr::EventBuilder, + state: &AppState, + keys: &nostr::Keys, + auth_tag: Option<&str>, +) -> Result<(SubmitEventResponse, i64), String> { + let event = builder + .sign_with_keys(keys) + .map_err(|e| format!("failed to sign event: {e}"))?; + let created_at = event.created_at.as_secs() as i64; + let result = super::submit_signed_event_with_keys(&event, state, keys, auth_tag).await?; + Ok((result, created_at)) +} diff --git a/desktop/src-tauri/src/relay/tests.rs b/desktop/src-tauri/src/relay/tests.rs new file mode 100644 index 00000000000..4ae39249328 --- /dev/null +++ b/desktop/src-tauri/src/relay/tests.rs @@ -0,0 +1,615 @@ +//! Unit tests for the relay HTTP/command bridge helpers. +//! Extracted from `relay.rs` to keep that module under the file-size ratchet. + +use super::{ + build_profile_event, classify_intercepted_response, effective_agent_relay_url, + extract_retry_in_hint, parse_command_response, relay_http_base_url, MALFORMED_RESPONSE_MESSAGE, +}; +use serde::Deserialize; + +// ── extract_retry_in_hint ──────────────────────────────────────────────── + +#[test] +fn extracts_hint_from_429_body() { + assert_eq!( + extract_retry_in_hint(r#"{"error":"rate-limited: quota exceeded; retry in 4s"}"#), + Some(4) + ); +} + +#[test] +fn extracts_hint_when_no_json_wrapper() { + assert_eq!(extract_retry_in_hint("retry in 30s"), Some(30)); +} + +#[test] +fn returns_none_when_no_hint_present() { + assert_eq!( + extract_retry_in_hint(r#"{"error":"rate-limited: quota exceeded"}"#), + None + ); + assert_eq!(extract_retry_in_hint(""), None); +} + +#[test] +fn overlong_digit_string_returns_none() { + // A digit sequence that exceeds u64::MAX cannot be parsed; the function + // must return None (→ caller uses the default) rather than panicking. + assert_eq!( + extract_retry_in_hint("retry in 99999999999999999999999s"), + None + ); +} + +// ── relay_error_message: hint capping ──────────────────────────────────── +// +// Verify that an oversized relay hint is capped in the returned message +// string, not just inside `activate_rate_limit()`. This guarantees every +// consumer — including the TS gate via `applyTauriRateLimitIfNeeded` — +// receives the capped value rather than the raw untrusted relay value. + +#[tokio::test] +async fn oversized_hint_is_capped_in_relay_error_message_string() { + use crate::relay_admission::{reset_rate_limit_gate, MAX_HINT_SECONDS, TEST_SERIAL}; + use std::io::{Read as _, Write as _}; + + let _serial = TEST_SERIAL.lock().await; + reset_rate_limit_gate(); + + // Use a std::net listener on a std::thread — the same pattern as the + // relay_admission loopback tests. This avoids two races that cause CI + // failures with tokio::net + into_std(): + // 1. No request read: the client is still sending when the response + // arrives → hyper `UnexpectedMessage`/`Canceled` under load. + // 2. into_std() leaves the socket in nonblocking mode → write_all + // may return WouldBlock and silently drop the response. + let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + + // Serve a 429 with a hint far exceeding MAX_HINT_SECONDS (300). + let oversized = 1_000_000u64; + let body = format!(r#"{{"error":"rate-limited: quota exceeded; retry in {oversized}s"}}"#); + let body_len = body.len(); + std::thread::spawn(move || { + if let Ok((mut stream, _)) = listener.accept() { + // Read the request first so the client finishes sending before + // we write the response — mirrors relay_admission.rs pattern. + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + let response = format!( + "HTTP/1.1 429 Too Many Requests\r\nContent-Type: application/json\r\nContent-Length: {body_len}\r\nConnection: close\r\n\r\n{body}" + ); + let _ = stream.write_all(response.as_bytes()); + let _ = stream.flush(); + } + }); + + let client = reqwest::Client::new(); + let response = client + .get(format!("http://{addr}/")) + .send() + .await + .expect("request must succeed"); + + let msg = super::relay_error_message(response).await; + + // The message must embed the CAPPED hint, not the raw 1 000 000. + assert_eq!( + msg, + format!("relay rate-limited: retry in {MAX_HINT_SECONDS}s"), + "relay_error_message must embed the capped hint, not the raw untrusted value" + ); + assert!( + !msg.contains(&oversized.to_string()), + "raw oversized hint must not appear in the message string" + ); + reset_rate_limit_gate(); +} + +// ── effective_agent_relay_url: legacy pin ignored ───────────────────────── + +#[test] +fn stored_relay_pin_is_ignored() { + // Zero-touch cutover (#2122): a creation-era per-record relay pin is + // parsed and persisted but never consulted — the workspace relay wins. + assert_eq!( + effective_agent_relay_url("wss://relay.other.com", "wss://staging.example.com"), + "wss://staging.example.com" + ); +} + +#[test] +fn empty_relay_resolves_to_workspace() { + // A never-set record resolves to the active workspace relay at read-time, + // so a stale stored default can never make it load-bearing. + assert_eq!( + effective_agent_relay_url("", "wss://staging.example.com"), + "wss://staging.example.com" + ); +} + +#[test] +fn whitespace_only_relay_resolves_to_workspace() { + // Whitespace-only behaves identically — no value survives. + assert_eq!( + effective_agent_relay_url(" ", "wss://staging.example.com"), + "wss://staging.example.com" + ); +} + +// ── relay_http_base_url scheme conversion ──────────────────────────────── + +#[test] +fn loopback_ws_localhost_preserves_authority() { + // Tenant host-binding keys off the HTTP Host/authority. The desktop must + // not rewrite localhost to 127.0.0.1, or local dev HTTP calls target a + // different unmapped community than the WebSocket URL. + assert_eq!( + relay_http_base_url("ws://localhost:3000"), + "http://localhost:3000" + ); +} + +#[test] +fn loopback_trailing_slash_removed_authority_preserved() { + assert_eq!( + relay_http_base_url("ws://localhost:3000/"), + "http://localhost:3000" + ); +} + +#[test] +fn remote_wss_host_unchanged() { + assert_eq!( + relay_http_base_url("wss://relay.example.com"), + "https://relay.example.com" + ); +} + +#[test] +fn loopback_ipv4_literal_unchanged() { + assert_eq!( + relay_http_base_url("ws://127.0.0.1:3000"), + "http://127.0.0.1:3000" + ); +} + +#[test] +fn localhost_substring_host_unchanged() { + assert_eq!( + relay_http_base_url("ws://localhost.evil.com:3000"), + "http://localhost.evil.com:3000" + ); +} + +#[test] +fn loopback_wss_localhost_preserves_authority() { + assert_eq!( + relay_http_base_url("wss://localhost:3000"), + "https://localhost:3000" + ); +} + +// ── classify_intercepted_response ──────────────────────────────────────── + +#[test] +fn intercepted_cloudflare_host_returns_some() { + let result = classify_intercepted_response("sqprod.cloudflareaccess.com", "text/html"); + assert!(result.is_some()); + let msg = result.unwrap(); + assert!( + msg.starts_with("relay unreachable:"), + "should have unreachable prefix" + ); + assert!(msg.contains("Cloudflare"), "should mention Cloudflare"); +} + +#[test] +fn intercepted_cloudflare_apex_host_returns_some() { + // The apex domain itself should also match. + let result = classify_intercepted_response("cloudflareaccess.com", "application/json"); + assert!(result.is_some()); + let msg = result.unwrap(); + assert!(msg.starts_with("relay unreachable:")); + assert!(msg.contains("Cloudflare")); +} + +#[test] +fn intercepted_non_cloudflare_html_returns_some() { + let result = + classify_intercepted_response("proxy.corporate.example", "text/html; charset=utf-8"); + assert!(result.is_some()); + let msg = result.unwrap(); + assert!(msg.starts_with("relay unreachable:")); +} + +#[test] +fn normal_relay_json_returns_none() { + let result = classify_intercepted_response("relay.myapp.example.com", "application/json"); + assert!(result.is_none()); +} + +#[test] +fn content_type_case_insensitive() { + // Uppercase content-type must still be detected. + let result = classify_intercepted_response("proxy.example.com", "TEXT/HTML"); + assert!(result.is_some()); + assert!(result.unwrap().starts_with("relay unreachable:")); +} + +#[test] +fn evil_suffix_does_not_match_cloudflare() { + // A host whose suffix happens to contain the Cloudflare string but is + // not actually a subdomain must NOT match. + let result = + classify_intercepted_response("notcloudflareaccess.com.evil.example", "application/json"); + assert!( + result.is_none(), + "false suffix match should not trigger Cloudflare branch" + ); +} + +// classify_request_error requires a real reqwest::Error (not publicly +// constructable) — tested indirectly through integration; skipped here. + +// ── /query per-request timeout → classified error ──────────────────────── +// +// A stalled `/query` connection (headers never arrive) must not hang the +// caller forever. Both production `/query` builders funnel through +// `send_query_request`, which owns the per-request `.timeout(...)`; this test +// drives that exact helper against a loopback server that accepts the +// connection but never responds. It asserts two things the frontend depends +// on: (1) the helper returns instead of hanging, and (2) the failure is the +// stable `"relay unreachable: request timed out"` classified string. +// +// The outer `tokio::time::timeout` is the regression guard: if the production +// `.timeout(...)` is ever removed from `send_query_request`, this call would +// hang forever, so the guard fires and the test fails fast rather than +// stalling CI. A short 200ms deadline keeps the happy path fast. +#[tokio::test] +async fn stalled_query_request_times_out_with_classified_error() { + use std::io::Read as _; + use std::time::Duration; + + // A listener that accepts the connection and then holds it open without + // ever writing a response — the "headers never arrive" stall. + let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + let handle = std::thread::spawn(move || { + if let Ok((mut stream, _)) = listener.accept() { + // Drain the request but deliberately never respond, then hold + // the socket until the client aborts on its own timeout. + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + std::thread::sleep(Duration::from_secs(2)); + } + }); + + let client = reqwest::Client::new(); + let url = format!("http://{addr}/query"); + let result = tokio::time::timeout( + Duration::from_secs(5), + super::send_query_request( + &client, + &url, + "Nostr test-auth", + None, + b"[]".to_vec(), + Duration::from_millis(200), + ), + ) + .await + .expect( + "send_query_request must honor its per-request timeout and resolve within 5s; \ + if this guard fires, the production .timeout(...) was lost", + ); + + let err = result.expect_err("a stalled /query must surface an error, not succeed"); + assert_eq!( + err, "relay unreachable: request timed out", + "a timed-out /query must surface the stable classified string" + ); + + let _ = handle.join(); +} + +// ── /query body-stall timeout → classified error (not malformed) ───────── +// +// `send()` resolves once response headers arrive, so a relay that returns a +// valid 2xx JSON header block and then stalls the body trips the request +// deadline inside `response.json()` — the branch the pre-header stall above +// cannot reach. That is a connectivity failure, not a malformed body, so it +// must surface the stable "relay unreachable: request timed out" string rather +// than the malformed-response bucket. This drives `send_query_request` against +// a loopback that writes headers promising a body it never sends. +#[tokio::test] +async fn stalled_response_body_times_out_with_classified_error() { + use std::io::{Read as _, Write as _}; + use std::time::Duration; + + // Accept, drain the request, write a complete 2xx JSON header block that + // promises a body (Content-Length), then send nothing and hold the socket + // — the "headers arrive, body stalls" half-open case. + let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + let handle = std::thread::spawn(move || { + if let Ok((mut stream, _)) = listener.accept() { + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + let _ = stream.write_all( + b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 64\r\n\r\n", + ); + let _ = stream.flush(); + // Never write the promised body; hold past the client deadline. + std::thread::sleep(Duration::from_secs(2)); + } + }); + + let client = reqwest::Client::new(); + let url = format!("http://{addr}/query"); + let result = tokio::time::timeout( + Duration::from_secs(5), + super::send_query_request( + &client, + &url, + "Nostr test-auth", + None, + b"[]".to_vec(), + Duration::from_millis(200), + ), + ) + .await + .expect( + "send_query_request must honor its per-request timeout through body \ + consumption and resolve within 5s", + ); + + let err = result.expect_err("a stalled response body must surface an error, not succeed"); + assert_eq!( + err, "relay unreachable: request timed out", + "a body-stall timeout must surface the classified timeout string, not the \ + malformed-response bucket" + ); + + let _ = handle.join(); +} + +// ── /query non-2xx body-stall timeout → classified error (not status) ──── +// +// The 2xx path is not the only body-consuming path. A relay that returns a +// non-success status (500, 429, …) routes through `relay_error_message`, which +// consumes the body via `text()` to extract the structured error field. If the +// relay sends the status headers and then stalls the promised body, that +// consumption trips the same request deadline — and it must surface the stable +// "relay unreachable: request timed out" classification, not a bare +// "relay returned 500" that hides the connectivity failure. This drives +// `send_query_request` against a loopback that writes 500 headers promising a +// body it never sends. +#[tokio::test] +async fn stalled_error_response_body_times_out_with_classified_error() { + use std::io::{Read as _, Write as _}; + use std::time::Duration; + + let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + let handle = std::thread::spawn(move || { + if let Ok((mut stream, _)) = listener.accept() { + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + // 500 status headers promising a body (Content-Length) that never + // arrives — the "error headers arrive, body stalls" half-open case. + let _ = stream.write_all( + b"HTTP/1.1 500 Internal Server Error\r\nContent-Type: application/json\r\nContent-Length: 64\r\n\r\n", + ); + let _ = stream.flush(); + std::thread::sleep(Duration::from_secs(2)); + } + }); + + let client = reqwest::Client::new(); + let url = format!("http://{addr}/query"); + let result = tokio::time::timeout( + Duration::from_secs(5), + super::send_query_request( + &client, + &url, + "Nostr test-auth", + None, + b"[]".to_vec(), + Duration::from_millis(200), + ), + ) + .await + .expect( + "send_query_request must honor its per-request timeout through error-body \ + consumption and resolve within 5s", + ); + + let err = result.expect_err("a stalled error-response body must surface an error, not succeed"); + assert_eq!( + err, "relay unreachable: request timed out", + "a non-2xx body-stall timeout must surface the classified timeout string, not the \ + status bucket" + ); + + let _ = handle.join(); +} + +// ── /query non-stalled 500 → status message (timeout preservation is scoped) ─ +// +// The timeout preservation above must not swallow genuine relay errors: a 500 +// whose body arrives promptly still surfaces as "relay returned 500". This +// pins that `classify_body_timeout` only fires on an actual timeout, so the +// error-classification path stays intact for live relay failures. +#[tokio::test] +async fn non_stalled_error_response_yields_status_message() { + use std::io::{Read as _, Write as _}; + use std::time::Duration; + + let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + let handle = std::thread::spawn(move || { + if let Ok((mut stream, _)) = listener.accept() { + let mut buf = [0u8; 4096]; + let _ = stream.read(&mut buf); + // A complete 500 with a non-JSON body delivered immediately. + let body = "internal error"; + let response = format!( + "HTTP/1.1 500 Internal Server Error\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", + body.len() + ); + let _ = stream.write_all(response.as_bytes()); + let _ = stream.flush(); + } + }); + + let client = reqwest::Client::new(); + let url = format!("http://{addr}/query"); + let result = tokio::time::timeout( + Duration::from_secs(5), + super::send_query_request( + &client, + &url, + "Nostr test-auth", + None, + b"[]".to_vec(), + Duration::from_millis(200), + ), + ) + .await + .expect("a promptly-served 500 must resolve well within 5s"); + + let err = result.expect_err("a 500 must surface an error, not succeed"); + assert_eq!( + err, "relay returned 500 Internal Server Error", + "a non-stalled 500 must keep its status classification, not be reclassified as a timeout" + ); + + let _ = handle.join(); +} + +// ── parse_json_response malformed-body contract ────────────────────────── + +#[test] +fn malformed_response_message_stays_off_unreachable_bucket() { + // A reached-but-malformed 2xx body is not a connectivity failure. If this + // message ever regains the "relay unreachable:" prefix, the frontend + // classifier would misroute it as unreachable — pin that it never does. + assert!( + !MALFORMED_RESPONSE_MESSAGE.starts_with("relay unreachable:"), + "malformed-response message must not match the unreachable prefix" + ); +} + +// ── parse_command_response ─────────────────────────────────────────────── + +#[derive(Debug, Deserialize, PartialEq)] +struct ChannelCreated { + channel_id: String, +} + +#[test] +fn parse_command_response_decodes_typed_payload() { + let msg = r#"response:{"channel_id":"abc123"}"#; + let parsed: ChannelCreated = parse_command_response(msg).expect("should parse"); + assert_eq!( + parsed, + ChannelCreated { + channel_id: "abc123".to_string() + } + ); +} + +#[test] +fn parse_command_response_accepts_raw_json_fallback() { + // Backward-compat: relays that emit raw JSON (no prefix) still work. + let msg = r#"{"channel_id":"abc"}"#; + let parsed: ChannelCreated = parse_command_response(msg).expect("fallback parse"); + assert_eq!( + parsed, + ChannelCreated { + channel_id: "abc".to_string() + } + ); +} + +#[test] +fn parse_command_response_rejects_invalid_prefixed_json() { + let msg = "response:not-json"; + let result: Result = parse_command_response(msg); + assert!(result.is_err()); + assert!(result.unwrap_err().contains("response parse failed")); +} + +#[test] +fn parse_command_response_rejects_garbage() { + let msg = "totally not json or response"; + let result: Result = parse_command_response(msg); + assert!(result.is_err()); +} + +// ── build_profile_event ────────────────────────────────────────────────── + +/// Generate a valid NIP-OA auth tag JSON string signed by a fresh owner key +/// and addressed to `agent_keys`. +/// +/// Uses `nostr_compat` (nostr 0.36) for the owner keys because +/// `buzz_sdk_pkg::nip_oa::compute_auth_tag` expects nostr 0.36 types. +/// The agent pubkey is bridged via hex encoding. +fn make_valid_auth_tag(agent_keys: &nostr::Keys) -> String { + let owner_keys = nostr::Keys::generate(); + let agent_pubkey_hex = agent_keys.public_key().to_hex(); + let agent_compat_pubkey = + nostr::PublicKey::from_hex(&agent_pubkey_hex).expect("valid hex pubkey should parse"); + buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_compat_pubkey, "") + .expect("compute_auth_tag should not fail with distinct keys") +} + +#[test] +fn profile_event_with_valid_auth_tag() { + let agent_keys = nostr::Keys::generate(); + let tag_json = make_valid_auth_tag(&agent_keys); + let event = build_profile_event(&agent_keys, "TestBot", None, Some(&tag_json)) + .expect("should succeed with a valid auth tag"); + + // Exactly one "auth" tag must be present. + let auth_tags: Vec<_> = event + .tags + .iter() + .filter(|t| t.as_slice().first().map(|s| s.as_str()) == Some("auth")) + .collect(); + assert_eq!(auth_tags.len(), 1, "expected exactly 1 auth tag"); + + // Must be a kind:0 (Metadata) event. + assert_eq!(event.kind, nostr::Kind::Metadata); +} + +#[test] +fn profile_event_without_auth_tag() { + let agent_keys = nostr::Keys::generate(); + let event = build_profile_event(&agent_keys, "TestBot", None, None) + .expect("should succeed without an auth tag"); + + // No "auth" tags should be present. + let auth_tags: Vec<_> = event + .tags + .iter() + .filter(|t| t.as_slice().first().map(|s| s.as_str()) == Some("auth")) + .collect(); + assert_eq!(auth_tags.len(), 0, "expected no auth tags"); + + assert_eq!(event.kind, nostr::Kind::Metadata); +} + +#[test] +fn profile_event_rejects_invalid_auth_tag() { + let agent_keys = nostr::Keys::generate(); + // Structurally valid JSON array but with a bogus signature — verification must fail. + let bad_json = format!(r#"["auth","{}","","{}"]"#, "a".repeat(64), "b".repeat(128)); + let result = build_profile_event(&agent_keys, "TestBot", None, Some(&bad_json)); + assert!(result.is_err(), "should reject an invalid auth tag"); + assert!( + result.unwrap_err().contains("verification failed"), + "error message should mention verification failure" + ); +} diff --git a/desktop/src-tauri/src/relay_admission.rs b/desktop/src-tauri/src/relay_admission.rs index 15222f85908..4b0dd1f3696 100644 --- a/desktop/src-tauri/src/relay_admission.rs +++ b/desktop/src-tauri/src/relay_admission.rs @@ -42,6 +42,10 @@ pub const MAX_HINT_SECONDS: u64 = 300; static GATE_EXPIRY: Mutex> = Mutex::new(None); +// The gate is process-wide, so every test that can arm it must serialize. +#[cfg(test)] +pub(crate) static TEST_SERIAL: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(()); + /// Arm (or extend) the admission gate from a relay 429. /// /// `retry_in_seconds` is the parsed `retry in Ns` hint, if the relay provided @@ -105,9 +109,8 @@ mod tests { use super::*; // The gate is a process-wide static shared by every test in this binary, - // so all gate tests serialize on one async lock to keep armed expiries + // so all tests that arm it serialize on one async lock to keep expiries // from bleeding between parallel test threads. - pub(crate) static TEST_SERIAL: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(()); #[tokio::test(start_paused = true)] async fn wait_returns_immediately_when_gate_is_inactive() { diff --git a/desktop/src-tauri/src/shutdown.rs b/desktop/src-tauri/src/shutdown.rs index 95f9efc3c5e..b1548c69370 100644 --- a/desktop/src-tauri/src/shutdown.rs +++ b/desktop/src-tauri/src/shutdown.rs @@ -19,6 +19,10 @@ pub(crate) fn shut_down_app(app: &tauri::AppHandle, shutdown_done: &std::sync::a .store(true, Ordering::SeqCst); if !shutdown_done.swap(true, Ordering::SeqCst) { prevent_sleep::release(&app.state::().prevent_sleep); + crate::observed_unread::flush(app); + crate::channel_head_cache::flush(app); + app.state::() + .shutdown_all(); if let Err(error) = shutdown_managed_agents(app) { eprintln!("buzz-desktop: failed to stop managed agents: {error}"); } @@ -40,6 +44,8 @@ pub(crate) fn install_signal_handler( .shutdown_started .store(true, Ordering::SeqCst); if !shutdown_done.swap(true, Ordering::SeqCst) { + app.state::() + .shutdown_all(); let _ = shutdown_managed_agents(&app); #[cfg(feature = "mesh-llm")] shutdown_mesh_runtime(&app); diff --git a/desktop/src-tauri/src/terminal_runtime.rs b/desktop/src-tauri/src/terminal_runtime.rs new file mode 100644 index 00000000000..840c0ee2573 --- /dev/null +++ b/desktop/src-tauri/src/terminal_runtime.rs @@ -0,0 +1,997 @@ +//! Rust-owned PTY sessions and the typed Tauri transport for Buzz Substrate. + +use std::io::{Read, Write}; +use std::sync::atomic::{AtomicBool, Ordering}; +use std::sync::{Arc, Mutex}; +use std::thread::JoinHandle; + +use buzz_terminal::context::{context_vars, GuiContext}; +use buzz_terminal::damage::{Frame, Style}; +use buzz_terminal::{Fences, SharedTerminal, Size, Terminal, Viewport}; +use portable_pty::{native_pty_system, CommandBuilder, MasterPty, PtySize}; +use serde::{Deserialize, Serialize}; +use tauri::ipc::Channel; +use uuid::Uuid; + +use crate::terminal_transport::{FramePublisher, OfferError, Publication, SubscriptionId}; + +mod scroll_sign; + +use scroll_sign::{scroll_by_dom_lines, DomLines}; + +const MAX_LIVE_SESSIONS: usize = 20; +const MAX_INPUT_BYTES: usize = 1024 * 1024; + +type Result = std::result::Result; + +#[derive(Debug, Deserialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct AttachRequest { + /// Present when a renderer remounts onto an existing PTY-backed tab. + session_id: Option, + channel_id: String, + channel_name: String, + thread_id: Option, + npub: String, + relay_url: String, + columns: u16, + rows: u16, + pixel_width: u16, + pixel_height: u16, +} + +#[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] +#[serde(rename_all = "camelCase")] +pub(crate) struct WireViewport { + generation: u64, + columns: usize, + screen_lines: usize, +} + +impl From for WireViewport { + fn from(value: Viewport) -> Self { + Self { + generation: value.generation, + columns: value.columns, + screen_lines: value.screen_lines, + } + } +} + +impl From for Viewport { + fn from(value: WireViewport) -> Self { + Self { + generation: value.generation, + columns: value.columns, + screen_lines: value.screen_lines, + } + } +} + +#[derive(Debug, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct AttachResponse { + session_id: String, + subscription_id: String, + viewport: WireViewport, +} + +#[derive(Debug, Serialize)] +#[serde(rename_all = "camelCase")] +pub(crate) struct WireStyle { + fg: u32, + bg: u32, + flags: u16, +} + +impl From