diff --git a/.dockerignore b/.dockerignore index 8ce14320ca..8b70e3ce1a 100644 --- a/.dockerignore +++ b/.dockerignore @@ -34,6 +34,7 @@ secrets/ Thumbs.db # CI artifacts and tooling that the image doesn't need +.hermit/ .cache/ coverage/ dist/ diff --git a/Cargo.lock b/Cargo.lock index 937ead564a..babd04af23 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -915,6 +915,17 @@ dependencies = [ "uuid", ] +[[package]] +name = "buzz-backend-fly" +version = "0.1.0" +dependencies = [ + "hex", + "nostr", + "serde", + "serde_json", + "sha2 0.11.0", +] + [[package]] name = "buzz-backend-kubernetes" version = "0.1.0" diff --git a/Cargo.toml b/Cargo.toml index cc1dd0f9df..2f28485116 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -28,6 +28,7 @@ members = [ "crates/buzz-dev-mcp", "crates/buzz-voice", "crates/buzz-backend-kubernetes", + "crates/buzz-backend-fly", "examples/countdown-bot", ] exclude = ["desktop/src-tauri"] diff --git a/Dockerfile.fly-agent b/Dockerfile.fly-agent new file mode 100644 index 0000000000..2767ac8195 --- /dev/null +++ b/Dockerfile.fly-agent @@ -0,0 +1,42 @@ +# syntax=docker/dockerfile:1.7 +# Buzz cloud-agent image: the pinned Sprig runtime used by isolated Fly agents. +FROM rust:1.95-alpine3.22@sha256:064dfc925d68d1a63f4fd2871bd7dc6e6ea56692989a487185855d62885d90aa AS builder + +RUN apk add --no-cache \ + build-base \ + cmake \ + git \ + musl-dev \ + openssl-dev \ + openssl-libs-static \ + perl \ + pkgconf \ + protoc +WORKDIR /build +COPY . . +RUN cargo build --locked --profile sprig -p sprig \ + && strip target/sprig/sprig + +FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce + +RUN apk add --no-cache bash ca-certificates curl git su-exec \ + && adduser -D -h /home/agent agent \ + && install -d -o agent -g agent /workspace /home/agent \ + && git config --system gpg.format x509 \ + && git config --system gpg.x509.program /usr/local/bin/git-sign-nostr \ + && git config --system commit.gpgSign true \ + && git config --system tag.gpgSign true + +COPY --from=builder --chmod=0755 /build/target/sprig/sprig /usr/local/bin/sprig +COPY --chmod=0755 scripts/sprig-entrypoint.sh /usr/local/bin/sprig-entrypoint +COPY --chmod=0755 scripts/fly-agent-entrypoint.sh /usr/local/bin/fly-agent-entrypoint +RUN for name in \ + buzz-acp buzz-agent buzz-dev-mcp rg tree buzz \ + git-credential-nostr git-sign-nostr; do \ + ln -s sprig "/usr/local/bin/$name"; \ + done + +ENV HOME=/home/agent \ + PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin +WORKDIR /home/agent +ENTRYPOINT ["/usr/local/bin/fly-agent-entrypoint"] diff --git a/crates/buzz-backend-fly/Cargo.toml b/crates/buzz-backend-fly/Cargo.toml new file mode 100644 index 0000000000..486e7351c0 --- /dev/null +++ b/crates/buzz-backend-fly/Cargo.toml @@ -0,0 +1,18 @@ +[package] +name = "buzz-backend-fly" +version.workspace = true +edition.workspace = true +rust-version.workspace = true +license.workspace = true +description = "Fly.io backend provider for Buzz remote agents" + +[[bin]] +name = "buzz-backend-fly" +path = "src/main.rs" + +[dependencies] +nostr = { workspace = true } +serde = { workspace = true } +serde_json = { workspace = true } +sha2 = { workspace = true } +hex = { workspace = true } diff --git a/crates/buzz-backend-fly/src/config.rs b/crates/buzz-backend-fly/src/config.rs new file mode 100644 index 0000000000..53436663b8 --- /dev/null +++ b/crates/buzz-backend-fly/src/config.rs @@ -0,0 +1,223 @@ +pub const DEFAULT_REGION: &str = "ams"; +pub const DEFAULT_IMAGE: &str = + "registry.fly.io/buzz-agent-runtime-anneday:pilot-20260804-project-mcp-boundary"; +pub const DEFAULT_VM_SIZE: &str = "shared-cpu-1x"; +pub const DEFAULT_MEMORY_MB: u64 = 1024; +pub const DEFAULT_VOLUME_GB: u64 = 5; + +#[derive(Debug, Clone, PartialEq, Eq)] +pub struct ProviderConfig { + pub organization: String, + pub region: String, + pub image: String, + pub vm_size: String, + pub memory_mb: u64, + pub volume_gb: u64, + pub app_prefix: String, +} + +fn optional_string(value: &serde_json::Value, field: &str) -> Result, String> { + match value.get(field) { + None | Some(serde_json::Value::Null) => Ok(None), + Some(serde_json::Value::String(value)) if value.trim().is_empty() => Ok(None), + Some(serde_json::Value::String(value)) => Ok(Some(value.trim().to_string())), + Some(other) => Err(format!( + "provider_config.{field} must be a string, got {other}" + )), + } +} + +fn optional_u64(value: &serde_json::Value, field: &str) -> Result, String> { + match value.get(field) { + None | Some(serde_json::Value::Null) => Ok(None), + Some(serde_json::Value::Number(value)) => value + .as_u64() + .map(Some) + .ok_or_else(|| format!("provider_config.{field} must be a non-negative integer")), + Some(serde_json::Value::String(value)) if value.trim().is_empty() => Ok(None), + Some(serde_json::Value::String(value)) => value + .trim() + .parse::() + .map(Some) + .map_err(|_| format!("provider_config.{field} must be a non-negative integer")), + Some(other) => Err(format!( + "provider_config.{field} must be a non-negative integer, got {other}" + )), + } +} + +fn valid_slug(value: &str, max_len: usize) -> bool { + !value.is_empty() + && value.len() <= max_len + && value + .chars() + .next() + .is_some_and(|c| c.is_ascii_lowercase() || c.is_ascii_digit()) + && value + .chars() + .last() + .is_some_and(|c| c.is_ascii_lowercase() || c.is_ascii_digit()) + && value + .chars() + .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-') +} + +fn normalize_digest_image(value: &str) -> Result { + let value = value.trim(); + // `fly machine run` 0.4.77 resolves digest references, then rejects the + // resolved identifier. Use the unique, reviewed release tag for the + // first-party image; arbitrary images must still be digest-pinned. + if value == DEFAULT_IMAGE { + return Ok(value.to_string()); + } + let Some((name_and_tag, digest)) = value.split_once('@') else { + return Err( + "provider_config.image must be digest-pinned (name@sha256:<64 lowercase hex>)" + .to_string(), + ); + }; + if digest.matches(':').count() != 1 { + return Err("provider_config.image has an invalid digest".to_string()); + } + let Some(hex) = digest.strip_prefix("sha256:") else { + return Err("provider_config.image digest must use sha256".to_string()); + }; + if hex.len() != 64 + || !hex + .chars() + .all(|c| c.is_ascii_digit() || ('a'..='f').contains(&c)) + { + return Err( + "provider_config.image digest must contain 64 lowercase hexadecimal characters" + .to_string(), + ); + } + let name = match name_and_tag.rfind(':') { + Some(position) if !name_and_tag[position + 1..].contains('/') => &name_and_tag[..position], + _ => name_and_tag, + }; + if name.is_empty() || name.contains('@') { + return Err("provider_config.image has no valid repository name".to_string()); + } + Ok(format!("{name}@sha256:{hex}")) +} + +pub fn parse(value: &serde_json::Value) -> Result { + if !value.is_object() && !value.is_null() { + return Err("provider_config must be a JSON object".to_string()); + } + let organization = + optional_string(value, "organization")?.unwrap_or_else(|| "personal".to_string()); + if !valid_slug(&organization, 63) { + return Err(format!( + "provider_config.organization {organization:?} is not a valid Fly.io organization slug" + )); + } + let region = optional_string(value, "region")?.unwrap_or_else(|| DEFAULT_REGION.to_string()); + if !valid_slug(®ion, 16) { + return Err(format!( + "provider_config.region {region:?} must be a lowercase Fly.io region code" + )); + } + let image = normalize_digest_image( + optional_string(value, "image")? + .unwrap_or_else(|| DEFAULT_IMAGE.to_string()) + .as_str(), + )?; + let vm_size = optional_string(value, "vm_size")?.unwrap_or_else(|| DEFAULT_VM_SIZE.to_string()); + if !valid_slug(&vm_size, 32) { + return Err(format!( + "provider_config.vm_size {vm_size:?} is not a valid Fly.io VM size" + )); + } + let memory_mb = optional_u64(value, "memory_mb")?.unwrap_or(DEFAULT_MEMORY_MB); + if !(512..=32768).contains(&memory_mb) { + return Err("provider_config.memory_mb must be between 512 and 32768".to_string()); + } + let volume_gb = optional_u64(value, "volume_gb")?.unwrap_or(DEFAULT_VOLUME_GB); + if !(1..=500).contains(&volume_gb) { + return Err("provider_config.volume_gb must be between 1 and 500".to_string()); + } + let app_prefix = + optional_string(value, "app_prefix")?.unwrap_or_else(|| "buzz-agent".to_string()); + if !valid_slug(&app_prefix, 20) { + return Err( + "provider_config.app_prefix must be 1-20 lowercase letters, digits or '-'".to_string(), + ); + } + Ok(ProviderConfig { + organization, + region, + image, + vm_size, + memory_mb, + volume_gb, + app_prefix, + }) +} + +pub fn config_schema() -> serde_json::Value { + serde_json::json!({ + "type": "object", + "properties": { + "organization": { + "type": "string", + "title": "Fly organization", + "description": "Organization slug from `fly orgs list`.", + "default": "personal" + }, + "region": { + "type": "string", + "title": "Fly region", + "default": DEFAULT_REGION + }, + "image": { + "type": "string", + "title": "Agent image", + "description": "Version-pinned first-party image, or a digest-pinned custom image, containing buzz-acp and the selected ACP runtime.", + "default": DEFAULT_IMAGE + }, + "vm_size": { + "type": "string", + "title": "VM size", + "default": DEFAULT_VM_SIZE + }, + "memory_mb": { + "type": "number", + "title": "Memory (MB)", + "default": DEFAULT_MEMORY_MB + }, + "volume_gb": { + "type": "number", + "title": "Persistent volume (GB)", + "default": DEFAULT_VOLUME_GB + }, + "app_prefix": { + "type": "string", + "title": "App name prefix", + "default": "buzz-agent" + } + }, + "required": ["organization", "region", "image"] + }) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn defaults_are_small_and_version_pinned() { + let config = parse(&serde_json::json!({})).unwrap(); + assert_eq!(config.region, "ams"); + assert_eq!(config.memory_mb, 1024); + assert_eq!(config.volume_gb, 5); + assert_eq!(config.image, DEFAULT_IMAGE); + } + + #[test] + fn rejects_tag_only_images() { + let error = parse(&serde_json::json!({"image":"example/image:latest"})).unwrap_err(); + assert!(error.contains("digest-pinned")); + } +} diff --git a/crates/buzz-backend-fly/src/env.rs b/crates/buzz-backend-fly/src/env.rs new file mode 100644 index 0000000000..c510260a02 --- /dev/null +++ b/crates/buzz-backend-fly/src/env.rs @@ -0,0 +1,297 @@ +use crate::config::ProviderConfig; +use crate::wire::{AgentPayload, LaunchBlock}; +use std::collections::BTreeMap; + +const AUTHORITATIVE_KEYS: &[&str] = &[ + "BUZZ_RELAY_URL", + "BUZZ_PRIVATE_KEY", + "NOSTR_PRIVATE_KEY", + "BUZZ_AUTH_TAG", + "BUZZ_ACP_AGENT_OWNER", + "BUZZ_ACP_AGENT_COMMAND", + "BUZZ_ACP_AGENT_ARGS", + "BUZZ_ACP_RESPOND_TO", + "BUZZ_ACP_RESPOND_TO_ALLOWLIST", + "BUZZ_ACP_MCP_COMMAND", + "BUZZ_ACP_MCP_SERVERS", +]; + +const HOST_ONLY_KEYS: &[&str] = &[ + "PATH", + "CLAUDE_CODE_EXECUTABLE", + "BUZZ_ACP_SETUP_PAYLOAD", + "BUZZ_MANAGED_AGENT", + "BUZZ_DESKTOP_MODEL_OVERRIDE", + "BUZZ_DESKTOP_PROVIDER_OVERRIDE", +]; + +const MAX_ENV_VALUE_BYTES: usize = 1024 * 1024; + +fn valid_env_name(value: &str) -> bool { + let mut chars = value.chars(); + matches!(chars.next(), Some(c) if c.is_ascii_alphabetic() || c == '_') + && chars.all(|c| c.is_ascii_alphanumeric() || c == '_') +} + +fn identity_component(value: &str) -> Option<&str> { + let value = value.trim(); + (!value.is_empty()).then_some(value) +} + +pub fn build_env( + agent: &AgentPayload, + config: &ProviderConfig, +) -> Result, String> { + let fallback = LaunchBlock::default(); + let launch = agent.launch.as_ref().unwrap_or(&fallback); + + let mut env = launch.policy_env.clone(); + if agent.launch.is_some() { + env.extend(launch.env.clone()); + } else { + env.extend(agent.env_vars.clone()); + } + for key in HOST_ONLY_KEYS { + env.remove(*key); + } + for (key, value) in &env { + if !valid_env_name(key) { + return Err(format!( + "agent environment key {key:?} is not a valid environment variable name" + )); + } + if value.contains('\0') { + return Err(format!("agent environment value for {key:?} contains NUL")); + } + if key.eq_ignore_ascii_case("BUZZ_ACP_NO_PRESENCE") { + return Err( + "BUZZ_ACP_NO_PRESENCE cannot be set for a remote agent because relay presence is its liveness signal" + .to_string(), + ); + } + } + + for key in AUTHORITATIVE_KEYS { + env.remove(*key); + } + let relay_url = identity_component(&agent.relay_url) + .ok_or_else(|| "deploy refused: relay_url is empty".to_string())?; + env.insert("BUZZ_RELAY_URL".into(), relay_url.to_string()); + env.insert("BUZZ_PRIVATE_KEY".into(), agent.private_key_nsec.clone()); + env.insert("NOSTR_PRIVATE_KEY".into(), agent.private_key_nsec.clone()); + + let auth_tag = agent.auth_tag.as_deref().and_then(identity_component); + let owner = launch.owner_pubkey.as_deref().and_then(identity_component); + if auth_tag.is_none() && owner.is_none() { + return Err( + "deploy refused: neither auth_tag nor launch.owner_pubkey resolved; the agent could not honor !shutdown" + .to_string(), + ); + } + if let Some(value) = auth_tag { + env.insert("BUZZ_AUTH_TAG".into(), value.to_string()); + } + if let Some(value) = owner { + env.insert("BUZZ_ACP_AGENT_OWNER".into(), value.to_string()); + } + + let command = launch + .command + .as_deref() + .and_then(identity_component) + .unwrap_or("buzz-agent"); + let known_buzz_agent_image = config.image.starts_with("ghcr.io/block/buzz-sprig@") + || config.image == crate::config::DEFAULT_IMAGE; + if known_buzz_agent_image && command != "buzz-agent" { + return Err(format!( + "the default Sprig image contains the buzz-agent runtime, but this agent resolves to {command:?}; select Buzz Agent or provide a digest-pinned custom image containing that command" + )); + } + if command == "buzz-agent" { + validate_buzz_agent_config(&env)?; + } + env.insert("BUZZ_ACP_AGENT_COMMAND".into(), command.to_string()); + if !launch.args.is_empty() { + if launch.args.iter().any(|argument| argument.contains(',')) { + return Err( + "agent arguments containing ',' cannot be represented by BUZZ_ACP_AGENT_ARGS" + .to_string(), + ); + } + env.insert("BUZZ_ACP_AGENT_ARGS".into(), launch.args.join(",")); + } + env.insert("BUZZ_ACP_MCP_COMMAND".into(), "buzz-dev-mcp".into()); + + if let Some(value) = agent.respond_to.as_deref().and_then(identity_component) { + env.insert("BUZZ_ACP_RESPOND_TO".into(), value.to_string()); + } + if let Some(values) = agent + .respond_to_allowlist + .as_ref() + .filter(|values| !values.is_empty()) + { + env.insert("BUZZ_ACP_RESPOND_TO_ALLOWLIST".into(), values.join(",")); + } + + let total_value_bytes: usize = env.values().map(String::len).sum(); + if total_value_bytes > MAX_ENV_VALUE_BYTES { + return Err(format!( + "agent environment contains {total_value_bytes} value bytes; the Fly secret import limit for this provider is {MAX_ENV_VALUE_BYTES}" + )); + } + + Ok(env) +} + +fn validate_buzz_agent_config(env: &BTreeMap) -> Result<(), String> { + let value = |key: &str| { + env.get(key) + .map(String::as_str) + .filter(|value| !value.trim().is_empty()) + }; + let provider = value("BUZZ_AGENT_PROVIDER").ok_or_else(|| { + "deploy refused: Buzz Agent has no LLM provider; edit the agent in Buzz and choose an LLM provider before starting it on Fly" + .to_string() + })?; + if value("BUZZ_AGENT_MODEL").is_none() { + return Err( + "deploy refused: Buzz Agent has no model; edit the agent in Buzz and choose a model before starting it on Fly" + .to_string(), + ); + } + + let required_key = match provider { + "anthropic" => Some("ANTHROPIC_API_KEY"), + "openai" | "openai-compat" => Some("OPENAI_COMPAT_API_KEY"), + "openrouter" => Some("OPENROUTER_API_KEY"), + "databricks" | "databricks_v2" | "databricks-v2" => Some("DATABRICKS_HOST"), + _ => None, + }; + if let Some(key) = required_key.filter(|key| value(key).is_none()) { + return Err(format!( + "deploy refused: provider {provider:?} requires {key}; add it through the agent's Buzz credential field before starting it on Fly" + )); + } + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn config() -> ProviderConfig { + crate::config::parse(&serde_json::json!({})).unwrap() + } + + fn agent() -> AgentPayload { + serde_json::from_value(serde_json::json!({ + "relay_url":"wss://relay.example", + "private_key_nsec":"nsec1example", + "auth_tag":"owner-attestation", + "launch":{ + "command":"buzz-agent", + "env":{ + "BUZZ_AGENT_PROVIDER":"openai", + "BUZZ_AGENT_MODEL":"gpt-test", + "OPENAI_COMPAT_API_KEY":"scoped" + }, + "policy_env":{"BUZZ_ACP_AGENTS":"1"} + } + })) + .unwrap() + } + + #[test] + fn authoritative_identity_overwrites_user_values() { + let mut agent = agent(); + agent + .launch + .as_mut() + .unwrap() + .env + .insert("BUZZ_PRIVATE_KEY".into(), "wrong".into()); + let env = build_env(&agent, &config()).unwrap(); + assert_eq!(env["BUZZ_PRIVATE_KEY"], "nsec1example"); + assert_eq!(env["OPENAI_COMPAT_API_KEY"], "scoped"); + } + + #[test] + fn default_image_refuses_missing_runtime() { + let mut agent = agent(); + agent.launch.as_mut().unwrap().command = Some("codex-acp".into()); + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("contains the buzz-agent runtime")); + } + + #[test] + fn refuses_ownerless_agent() { + let mut agent = agent(); + agent.auth_tag = None; + agent.launch.as_mut().unwrap().owner_pubkey = None; + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("neither auth_tag")); + } + + #[test] + fn refuses_oversized_secret_payload() { + let mut agent = agent(); + agent + .launch + .as_mut() + .unwrap() + .env + .insert("OVERSIZED".into(), "x".repeat(MAX_ENV_VALUE_BYTES + 1)); + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("Fly secret import limit")); + } + + #[test] + fn refuses_buzz_agent_without_provider_before_fly_access() { + let mut agent = agent(); + agent + .launch + .as_mut() + .unwrap() + .env + .remove("BUZZ_AGENT_PROVIDER"); + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("no LLM provider")); + } + + #[test] + fn refuses_buzz_agent_without_model_before_fly_access() { + let mut agent = agent(); + agent + .launch + .as_mut() + .unwrap() + .env + .remove("BUZZ_AGENT_MODEL"); + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("no model")); + } + + #[test] + fn refuses_buzz_agent_without_provider_credential_before_fly_access() { + let mut agent = agent(); + agent + .launch + .as_mut() + .unwrap() + .env + .remove("OPENAI_COMPAT_API_KEY"); + let error = build_env(&agent, &config()).unwrap_err(); + assert!(error.contains("requires OPENAI_COMPAT_API_KEY")); + } + + #[test] + fn drops_agent_owned_mcp_configuration() { + let mut agent = agent(); + agent.launch.as_mut().unwrap().env.insert( + "BUZZ_ACP_MCP_SERVERS".into(), + r#"[{"name":"crm","command":"mcp-remote","args":["https://mcp.example"]}]"#.into(), + ); + let env = build_env(&agent, &config()).unwrap(); + assert!(!env.contains_key("BUZZ_ACP_MCP_SERVERS")); + } +} diff --git a/crates/buzz-backend-fly/src/fly.rs b/crates/buzz-backend-fly/src/fly.rs new file mode 100644 index 0000000000..9dd27c6bbd --- /dev/null +++ b/crates/buzz-backend-fly/src/fly.rs @@ -0,0 +1,367 @@ +use crate::config::ProviderConfig; +use std::collections::BTreeMap; +use std::io::Write; +use std::process::{Command, Output, Stdio}; + +const OUTPUT_LIMIT: usize = 64 * 1024; + +pub struct FlyCli { + binary: String, +} + +impl FlyCli { + pub fn discover() -> Result { + for candidate in ["fly", "flyctl"] { + if Command::new(candidate) + .arg("version") + .stdout(Stdio::null()) + .stderr(Stdio::null()) + .status() + .is_ok_and(|status| status.success()) + { + return Ok(Self { + binary: candidate.to_string(), + }); + } + } + Err("Fly.io CLI not found on PATH. Install it with `brew install flyctl`, then run `fly auth login`.".to_string()) + } + + pub fn require_auth(&self) -> Result<(), String> { + self.run(&["auth", "whoami"]).map(|_| ()).map_err(|_| { + "Fly.io is not authenticated. Run `fly auth login` in a terminal and retry Start." + .to_string() + }) + } + + pub fn ensure_app(&self, app: &str, organization: &str) -> Result<(), String> { + if self.run(&["status", "--app", app, "--json"]).is_ok() { + return Ok(()); + } + self.run(&[ + "apps", + "create", + app, + "--org", + organization, + "--yes", + "--json", + ]) + .map(|_| ()) + .map_err(|error| format!("could not create Fly app {app:?}: {error}")) + } + + pub fn import_secrets(&self, app: &str, env: &BTreeMap) -> Result<(), String> { + let mut input = String::new(); + for (name, value) in env { + let quoted = serde_json::to_string(value) + .map_err(|error| format!("could not encode secret {name}: {error}"))?; + input.push_str(name); + input.push('='); + input.push_str("ed); + input.push('\n'); + } + self.run_with_stdin(&["secrets", "import", "--app", app, "--stage"], &input) + .map(|_| ()) + .map_err(|_| { + "could not import Fly app secrets; no secret values were included in this error. Check `fly auth whoami` and the Fly dashboard, then retry Start." + .to_string() + }) + } + + pub fn remove_legacy_mcp_secrets(&self, app: &str) -> Result<(), String> { + let output = self.run(&["secrets", "list", "--app", app, "--json"])?; + let names = legacy_mcp_secret_names(&output)?; + if names.is_empty() { + return Ok(()); + } + + let mut args = vec!["secrets", "unset", "--app", app, "--stage"]; + args.extend(names.iter().map(String::as_str)); + self.run(&args).map(|_| ()).map_err(|_| { + "could not remove legacy agent-owned MCP secrets from the Fly app; no secret values were included in this error. Retry Start before deploying this agent." + .to_string() + }) + } + + pub fn ensure_volume(&self, app: &str, config: &ProviderConfig) -> Result { + let output = self.run(&["volumes", "list", "--app", app, "--json"])?; + let value: serde_json::Value = serde_json::from_str(&output) + .map_err(|error| format!("could not parse `fly volumes list --json`: {error}"))?; + let volumes = value + .as_array() + .ok_or_else(|| "`fly volumes list --json` did not return an array".to_string())?; + let matches: Vec<&serde_json::Value> = volumes + .iter() + .filter(|volume| json_string(volume, &["name", "Name"]) == Some("agent_data")) + .collect(); + if matches.len() > 1 { + return Err(format!( + "Fly app {app:?} has multiple volumes named agent_data; refusing an ambiguous mount" + )); + } + if let Some(volume) = matches.first() { + let id = json_string(volume, &["id", "ID"]) + .ok_or_else(|| "existing agent_data volume has no id".to_string())?; + let region = json_string(volume, &["region", "Region"]); + if region != Some(config.region.as_str()) { + return Err(format!( + "existing agent_data volume is in region {:?}, but provider_config.region is {:?}", + region.unwrap_or("unknown"), + config.region + )); + } + return Ok(id.to_string()); + } + + let output = self.run(&[ + "volumes", + "create", + "agent_data", + "--app", + app, + "--region", + &config.region, + "--size", + &config.volume_gb.to_string(), + "--scheduled-snapshots", + "--snapshot-retention", + "5", + "--yes", + "--json", + ])?; + let value: serde_json::Value = serde_json::from_str(&output) + .map_err(|error| format!("could not parse created Fly volume: {error}"))?; + json_string(&value, &["id", "ID"]) + .map(str::to_string) + .ok_or_else(|| "Fly created a volume but returned no id".to_string()) + } + + pub fn reconcile_machine( + &self, + app: &str, + pubkey: &str, + volume_id: &str, + config: &ProviderConfig, + ) -> Result { + let output = self.run(&["machine", "list", "--app", app, "--json"])?; + let value: serde_json::Value = serde_json::from_str(&output) + .map_err(|error| format!("could not parse `fly machine list --json`: {error}"))?; + let machines = value + .as_array() + .ok_or_else(|| "`fly machine list --json` did not return an array".to_string())?; + if machines.len() > 1 { + return Err(format!( + "Fly app {app:?} contains {} Machines; expected at most one per agent", + machines.len() + )); + } + if let Some(machine) = machines.first() { + let id = json_string(machine, &["id", "ID"]) + .ok_or_else(|| "existing Fly Machine has no id".to_string())?; + let state = json_string(machine, &["state", "State"]); + let recorded = machine + .pointer("/config/metadata/buzz-agent-pubkey") + .and_then(serde_json::Value::as_str) + .or_else(|| { + machine + .pointer("/Config/metadata/buzz-agent-pubkey") + .and_then(serde_json::Value::as_str) + }); + if recorded != Some(pubkey) { + return Err(format!( + "existing Machine {id:?} is not marked for this agent pubkey; refusing to overwrite it" + )); + } + self.run(&[ + "machine", + "update", + id, + "--app", + app, + "--image", + &config.image, + "--vm-size", + &config.vm_size, + "--vm-memory", + &config.memory_mb.to_string(), + "--restart", + "on-failure", + "--autostop=off", + "--command", + "", + "--skip-health-checks", + "--yes", + ])?; + if !matches!(state, Some("started" | "starting")) { + self.run(&["machine", "start", id, "--app", app])?; + } + return Ok(id.to_string()); + } + + self.run(&[ + "machine", + "run", + &config.image, + "--app", + app, + "--region", + &config.region, + "--name", + "agent", + "--volume", + &format!("{volume_id}:/home/agent"), + "--restart", + "on-failure", + "--autostop=off", + "--vm-size", + &config.vm_size, + "--vm-memory", + &config.memory_mb.to_string(), + "--metadata", + &format!("buzz-agent-pubkey={pubkey}"), + "--metadata", + "buzz-provider=buzz-backend-fly", + "--detach", + ])?; + + let output = self.run(&["machine", "list", "--app", app, "--json"])?; + let value: serde_json::Value = serde_json::from_str(&output) + .map_err(|error| format!("could not parse created Fly Machine: {error}"))?; + let machines = value + .as_array() + .ok_or_else(|| "created Fly Machine list was not an array".to_string())?; + if machines.len() != 1 { + return Err(format!( + "Fly Machine creation returned {}, expected exactly one", + machines.len() + )); + } + json_string(&machines[0], &["id", "ID"]) + .map(str::to_string) + .ok_or_else(|| "created Fly Machine has no id".to_string()) + } + + fn run(&self, args: &[&str]) -> Result { + let output = Command::new(&self.binary) + .args(args) + .output() + .map_err(|error| format!("could not execute {}: {error}", self.binary))?; + checked_output(output) + } + + fn run_with_stdin(&self, args: &[&str], input: &str) -> Result { + let mut child = Command::new(&self.binary) + .args(args) + .stdin(Stdio::piped()) + .stdout(Stdio::piped()) + .stderr(Stdio::piped()) + .spawn() + .map_err(|error| format!("could not execute {}: {error}", self.binary))?; + let stdin = child + .stdin + .as_mut() + .ok_or_else(|| "could not open Fly CLI stdin".to_string())?; + stdin + .write_all(input.as_bytes()) + .map_err(|error| format!("could not write Fly CLI stdin: {error}"))?; + let output = child + .wait_with_output() + .map_err(|error| format!("could not wait for Fly CLI: {error}"))?; + checked_output(output) + } +} + +fn checked_output(output: Output) -> Result { + let stdout = bounded(&output.stdout); + if output.status.success() { + return Ok(stdout); + } + let stderr = bounded(&output.stderr); + let message = if stderr.trim().is_empty() { + stdout + } else { + stderr + }; + Err(format!( + "Fly CLI exited with {}: {}", + output.status, + message.trim() + )) +} + +fn bounded(bytes: &[u8]) -> String { + let end = bytes.len().min(OUTPUT_LIMIT); + String::from_utf8_lossy(&bytes[..end]).into_owned() +} + +fn json_string<'a>(value: &'a serde_json::Value, keys: &[&str]) -> Option<&'a str> { + keys.iter() + .find_map(|key| value.get(*key).and_then(serde_json::Value::as_str)) +} + +fn is_legacy_mcp_secret_name(name: &str) -> bool { + name.eq_ignore_ascii_case("BUZZ_ACP_MCP_SERVERS") + || name + .get(..9) + .is_some_and(|prefix| prefix.eq_ignore_ascii_case("BUZZ_MCP_")) +} + +fn legacy_mcp_secret_names(output: &str) -> Result, String> { + let value: serde_json::Value = serde_json::from_str(output) + .map_err(|error| format!("could not parse `fly secrets list --json`: {error}"))?; + let secrets = value + .as_array() + .ok_or_else(|| "`fly secrets list --json` did not return an array".to_string())?; + let mut names: Vec = secrets + .iter() + .filter_map(|secret| json_string(secret, &["name", "Name"])) + .filter(|name| is_legacy_mcp_secret_name(name)) + .map(str::to_string) + .collect(); + names.sort(); + names.dedup(); + Ok(names) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn bounded_output_caps_provider_messages() { + let bytes = vec![b'x'; OUTPUT_LIMIT + 100]; + assert_eq!(bounded(&bytes).len(), OUTPUT_LIMIT); + } + + #[test] + fn json_string_accepts_fly_field_casing() { + let lower = serde_json::json!({"id":"vol_1"}); + let upper = serde_json::json!({"ID":"vol_2"}); + assert_eq!(json_string(&lower, &["id", "ID"]), Some("vol_1")); + assert_eq!(json_string(&upper, &["id", "ID"]), Some("vol_2")); + } + + #[test] + fn legacy_mcp_secret_names_selects_only_retired_agent_owned_keys() { + let output = serde_json::json!([ + {"Name":"BUZZ_ACP_MCP_SERVERS","Digest":"one"}, + {"name":"BUZZ_MCP_CRM_AUTH_HEADER","digest":"two"}, + {"name":"OPENAI_COMPAT_API_KEY","digest":"three"} + ]) + .to_string(); + assert_eq!( + legacy_mcp_secret_names(&output).unwrap(), + ["BUZZ_ACP_MCP_SERVERS", "BUZZ_MCP_CRM_AUTH_HEADER"] + ); + } + + #[test] + fn legacy_mcp_secret_names_is_case_insensitive_and_deduplicates() { + let output = r#"[{"name":"buzz_mcp_crm_token"},{"Name":"buzz_mcp_crm_token"}]"#; + assert_eq!( + legacy_mcp_secret_names(output).unwrap(), + ["buzz_mcp_crm_token"] + ); + } +} diff --git a/crates/buzz-backend-fly/src/main.rs b/crates/buzz-backend-fly/src/main.rs new file mode 100644 index 0000000000..0bfff35274 --- /dev/null +++ b/crates/buzz-backend-fly/src/main.rs @@ -0,0 +1,116 @@ +mod config; +mod env; +mod fly; +mod wire; + +use std::io::Read; +use wire::{Request, Response}; + +const RELAY_MESH_PROVIDER: &str = "relay-mesh"; + +fn main() { + let mut input = String::new(); + if let Err(error) = std::io::stdin().read_to_string(&mut input) { + eprintln!("could not read provider request: {error}"); + std::process::exit(1); + } + let response = respond(&input); + println!( + "{}", + serde_json::to_string(&response).unwrap_or_else(|error| format!( + r#"{{"ok":false,"error":"could not serialize provider response: {error}"}}"# + )) + ); +} + +fn respond(input: &str) -> Response { + let raw: serde_json::Value = match serde_json::from_str(input) { + Ok(value) => value, + Err(error) => return Response::error(format!("request is not valid JSON: {error}")), + }; + if let Some(provider) = raw + .get("agent") + .and_then(|agent| agent.get("provider")) + .and_then(serde_json::Value::as_str) + { + if provider.trim() == RELAY_MESH_PROVIDER { + return Response::error( + "deploy refused: relay-mesh uses a desktop-local transport and cannot run on Fly.io", + ); + } + } + let request: Request = match serde_json::from_value(raw) { + Ok(request) => request, + Err(error) => { + return Response::error(format!("could not understand provider request: {error}")) + } + }; + match request { + Request::Info => Response::info(), + Request::Deploy(request) => match deploy(&request) { + Ok(agent_id) => Response::deployed(agent_id), + Err(error) => Response::error(error), + }, + } +} + +fn deploy(request: &wire::DeployRequest) -> Result { + let config = config::parse(&request.provider_config)?; + let keys = nostr::Keys::parse(&request.agent.private_key_nsec).map_err(|_| { + "deploy refused: private_key_nsec is not a valid Nostr secret key".to_string() + })?; + let pubkey = keys.public_key().to_hex(); + let app = format!("{}-{}", config.app_prefix, &pubkey[..16]); + + // Validate and resolve the full environment before creating paid Fly resources. + let env = env::build_env(&request.agent, &config)?; + + let fly = fly::FlyCli::discover()?; + fly.require_auth()?; + fly.ensure_app(&app, &config.organization)?; + let volume_id = fly.ensure_volume(&app, &config)?; + fly.remove_legacy_mcp_secrets(&app)?; + fly.import_secrets(&app, &env)?; + let machine_id = fly.reconcile_machine(&app, &pubkey, &volume_id, &config)?; + Ok(format!("{app}/{machine_id}")) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn error(response: Response) -> String { + let value = serde_json::to_value(response).unwrap(); + assert_eq!(value["ok"], false); + value["error"].as_str().unwrap().to_string() + } + + #[test] + fn info_is_pure_and_has_a_schema() { + let value = serde_json::to_value(respond(r#"{"op":"info"}"#)).unwrap(); + assert_eq!(value["ok"], true); + assert_eq!(value["name"], "fly"); + assert!(value["config_schema"]["properties"]["region"].is_object()); + } + + #[test] + fn malformed_input_is_an_in_band_error() { + assert!(error(respond("not-json")).contains("valid JSON")); + } + + #[test] + fn relay_mesh_is_refused_before_identity_or_fly_access() { + let request = r#"{"op":"deploy","agent":{ + "relay_url":"wss://relay","private_key_nsec":"invalid","provider":" relay-mesh " + }}"#; + assert!(error(respond(request)).contains("relay-mesh")); + } + + #[test] + fn invalid_identity_is_refused_before_fly_access() { + let request = r#"{"op":"deploy","agent":{ + "relay_url":"wss://relay","private_key_nsec":"invalid","auth_tag":"owner" + }}"#; + assert!(error(respond(request)).contains("valid Nostr secret key")); + } +} diff --git a/crates/buzz-backend-fly/src/wire.rs b/crates/buzz-backend-fly/src/wire.rs new file mode 100644 index 0000000000..12bcd6b22a --- /dev/null +++ b/crates/buzz-backend-fly/src/wire.rs @@ -0,0 +1,129 @@ +use serde::{Deserialize, Serialize}; +use std::collections::BTreeMap; + +pub const PROTOCOL_VERSION: u32 = 1; + +#[derive(Debug, Deserialize)] +#[serde(tag = "op", rename_all = "lowercase")] +pub enum Request { + Info, + Deploy(Box), +} + +#[derive(Debug, Deserialize)] +pub struct DeployRequest { + pub agent: AgentPayload, + #[serde(default)] + pub provider_config: serde_json::Value, +} + +#[derive(Debug, Deserialize)] +pub struct AgentPayload { + pub relay_url: String, + pub private_key_nsec: String, + #[serde(default)] + pub auth_tag: Option, + #[serde(default)] + pub respond_to: Option, + #[serde(default)] + pub respond_to_allowlist: Option>, + #[serde(default)] + pub env_vars: BTreeMap, + #[serde(default)] + pub launch: Option, +} + +#[derive(Debug, Default, Deserialize)] +pub struct LaunchBlock { + #[serde(default)] + pub command: Option, + #[serde(default)] + pub args: Vec, + #[serde(default)] + pub env: BTreeMap, + #[serde(default)] + pub policy_env: BTreeMap, + #[serde(default)] + pub owner_pubkey: Option, +} + +#[derive(Debug, Serialize)] +#[serde(untagged)] +pub enum Response { + Info(InfoResponse), + Deploy(DeployResponse), + Error(ErrorResponse), +} + +#[derive(Debug, Serialize)] +pub struct InfoResponse { + pub ok: bool, + pub name: &'static str, + pub version: &'static str, + pub protocol_version: u32, + pub description: &'static str, + pub config_schema: serde_json::Value, +} + +#[derive(Debug, Serialize)] +pub struct DeployResponse { + pub ok: bool, + pub agent_id: String, +} + +#[derive(Debug, Serialize)] +pub struct ErrorResponse { + pub ok: bool, + pub error: String, +} + +impl Response { + pub fn error(message: impl Into) -> Self { + Self::Error(ErrorResponse { + ok: false, + error: message.into(), + }) + } + + pub fn info() -> Self { + Self::Info(InfoResponse { + ok: true, + name: "fly", + version: env!("CARGO_PKG_VERSION"), + protocol_version: PROTOCOL_VERSION, + description: "Runs each agent in its own Fly.io app and Machine", + config_schema: crate::config::config_schema(), + }) + } + + pub fn deployed(agent_id: impl Into) -> Self { + Self::Deploy(DeployResponse { + ok: true, + agent_id: agent_id.into(), + }) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn accepts_desktop_request_id_and_extra_agent_fields() { + let request: Request = serde_json::from_str( + r#"{"op":"deploy","request_id":"r1","agent":{ + "name":"a","relay_url":"wss://relay","private_key_nsec":"nsec1x", + "provider":"openai","model":"gpt" + },"provider_config":{"region":"mad","image":"img@sha256:x"}}"#, + ) + .unwrap(); + assert!(matches!(request, Request::Deploy(_))); + } + + #[test] + fn response_shape_is_flat() { + let value = serde_json::to_value(Response::deployed("app/machine")).unwrap(); + assert_eq!(value["ok"], true); + assert_eq!(value["agent_id"], "app/machine"); + } +} diff --git a/deploy/fly-agent/README.md b/deploy/fly-agent/README.md new file mode 100644 index 0000000000..612fa4527f --- /dev/null +++ b/deploy/fly-agent/README.md @@ -0,0 +1,71 @@ +# Buzz agents on Fly.io + +This deployment keeps every Buzz agent in a separate Fly app, Machine, +persistent volume, and secret namespace. The `buzz-backend-fly` provider is +discovered by Buzz Desktop and receives the new agent identity only when its +owner presses **Start**. + +## One-time operator setup + +1. Install and authenticate Fly's official CLI: + + ```bash + brew install flyctl + fly auth login + ``` + +2. Install `buzz-backend-fly` somewhere Buzz Desktop scans: + + ```bash + cargo build --release -p buzz-backend-fly + install -m 0755 target/release/buzz-backend-fly ~/.local/bin/buzz-backend-fly + ``` + +3. Build `Dockerfile.fly-agent` and publish it to a registry Fly can pull. + Give the reviewed build a unique release tag and record the resulting + manifest digest. Fly CLI 0.4.77 rejects digest references in `machine run`, + so the pilot provider uses the unique + `pilot-20260804-project-mcp-boundary` tag while retaining the build digest + in the deployment record. + The image contains Sprig and does not fetch runtime packages when an agent + restarts. + +4. In Buzz Desktop, create an agent with the **Buzz Agent** runtime, select + the **fly** backend, and save. The Desktop keeps the Nostr key and owner + authorization in its existing owner-reviewed flow. Starting the agent + creates or reconciles exactly one Fly Machine for that public key. + +The provider defaults to Amsterdam (`ams`), 1 GB RAM, and a 5 GB encrypted volume +with scheduled snapshots. It creates no public service or IP because the +agent only makes outbound connections to the Buzz relay and model API. The +Machine uses `on-failure`, so crashes restart while an intentional +clean `!shutdown` stays down. A minimal root entrypoint assigns a newly mounted +volume to the unprivileged `agent` user, then permanently drops privileges +before starting `buzz-acp` or any child process. + +## Project connection boundary + +This provider intentionally does not accept agent-owned MCP endpoints or +credentials. Project configuration owns the concrete connection, secret, +health state, and discovered tools; an agent owns only a connection binding and +optional tool allowlist. Those bindings are being developed in #4588 on the +shared MCP schema from #4164 and the HTTP transport work in #4271. + +Fly agents cannot execute a Desktop-local stdio connection. A future Project +binding must therefore resolve to a cloud-reachable HTTP connection or a +gateway. At deploy time, the control plane may materialize a scoped runtime +copy of the Project credential into that Fly app's secret boundary, but the +credential must never be serialized into the agent, persona, template, or +snapshot. + +## Operational checks + +```bash +fly status --app +fly logs --app +fly machine list --app --json +fly volumes list --app --json +``` + +Do not copy the current local agent's `BUZZ_PRIVATE_KEY` into Fly. New cloud +agents must use the separate identity created through Buzz Desktop. diff --git a/deploy/fly-agent/fly.toml.example b/deploy/fly-agent/fly.toml.example new file mode 100644 index 0000000000..665aebf8c1 --- /dev/null +++ b/deploy/fly-agent/fly.toml.example @@ -0,0 +1,27 @@ +# Copy to fly.toml and set a globally unique app name before deploying. +app = "replace-with-buzz-agent-app" +primary_region = "ams" +kill_signal = "SIGTERM" +kill_timeout = "60s" + +[build] + dockerfile = "../../Dockerfile.fly-agent" + +[env] + BUZZ_ACP_AGENT_COMMAND = "buzz-agent" + BUZZ_ACP_AGENT_ARGS = "" + BUZZ_ACP_AGENTS = "1" + BUZZ_ACP_LAZY_POOL = "true" + BUZZ_ACP_MCP_COMMAND = "buzz-dev-mcp" + BUZZ_ACP_RESPOND_TO = "owner-only" + BUZZ_AGENT_PROVIDER = "openai" + OPENAI_COMPAT_BASE_URL = "https://api.openai.com/v1" + +[[mounts]] + source = "agent_data" + destination = "/home/agent" + +[[vm]] + size = "shared-cpu-1x" + memory = "1gb" + cpus = 1 diff --git a/desktop/src-tauri/src/managed_agents/effective_config/mod.rs b/desktop/src-tauri/src/managed_agents/effective_config/mod.rs index e079c76a1d..3aac335833 100644 --- a/desktop/src-tauri/src/managed_agents/effective_config/mod.rs +++ b/desktop/src-tauri/src/managed_agents/effective_config/mod.rs @@ -14,9 +14,13 @@ use super::types::{AgentDefinition, ManagedAgentRecord}; pub enum ConfigSource { Definition, Global, + InstanceOverride, InstanceLegacy, } +pub const MODEL_OVERRIDE_ENV_KEY: &str = "BUZZ_DESKTOP_MODEL_OVERRIDE"; +pub const PROVIDER_OVERRIDE_ENV_KEY: &str = "BUZZ_DESKTOP_PROVIDER_OVERRIDE"; + #[derive(Debug, Clone, PartialEq, Eq)] pub struct ResolvedField { pub value: Option, @@ -72,28 +76,51 @@ fn non_blank(v: Option<&str>) -> Option<&str> { } fn resolve_linked( + record: &ManagedAgentRecord, definition: &AgentDefinition, global: &GlobalAgentConfig, ) -> EffectiveAgentConfig { - let model = match non_blank(definition.model.as_deref()) { + let model = match non_blank( + record + .env_vars + .get(MODEL_OVERRIDE_ENV_KEY) + .map(String::as_str), + ) { Some(m) => ResolvedField { value: Some(m.to_owned()), - source: ConfigSource::Definition, + source: ConfigSource::InstanceOverride, }, - None => ResolvedField { - value: global.model.clone(), - source: ConfigSource::Global, + None => match non_blank(definition.model.as_deref()) { + Some(m) => ResolvedField { + value: Some(m.to_owned()), + source: ConfigSource::Definition, + }, + None => ResolvedField { + value: global.model.clone(), + source: ConfigSource::Global, + }, }, }; - let provider = match non_blank(definition.provider.as_deref()) { + let provider = match non_blank( + record + .env_vars + .get(PROVIDER_OVERRIDE_ENV_KEY) + .map(String::as_str), + ) { Some(p) => ResolvedField { value: Some(p.to_owned()), - source: ConfigSource::Definition, + source: ConfigSource::InstanceOverride, }, - None => ResolvedField { - value: global.provider.clone(), - source: ConfigSource::Global, + None => match non_blank(definition.provider.as_deref()) { + Some(p) => ResolvedField { + value: Some(p.to_owned()), + source: ConfigSource::Definition, + }, + None => ResolvedField { + value: global.provider.clone(), + source: ConfigSource::Global, + }, }, }; @@ -251,7 +278,7 @@ pub fn resolve_effective_config( ) -> EffectiveConfigResult { match &record.persona_id { Some(pid) => match definitions.iter().find(|d| d.id == *pid) { - Some(def) => EffectiveConfigResult::Resolved(resolve_linked(def, global)), + Some(def) => EffectiveConfigResult::Resolved(resolve_linked(record, def, global)), None => EffectiveConfigResult::OrphanedInstance { record_pubkey: record.pubkey.clone(), missing_persona_id: pid.clone(), diff --git a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs index c8e437809c..afd306bab9 100644 --- a/desktop/src-tauri/src/managed_agents/effective_config/tests.rs +++ b/desktop/src-tauri/src/managed_agents/effective_config/tests.rs @@ -135,6 +135,35 @@ fn linked_definition_model_wins_over_stale_record() { assert_eq!(cfg.system_prompt.source, ConfigSource::Definition); } +#[test] +fn linked_instance_override_wins_without_reinterpreting_snapshot_fields() { + let mut rec = record( + Some("d1"), + Some("stale-model"), + Some("stale-prov"), + Some("stale prompt"), + ); + rec.env_vars + .insert(MODEL_OVERRIDE_ENV_KEY.into(), "claude-opus".into()); + rec.env_vars + .insert(PROVIDER_OVERRIDE_ENV_KEY.into(), "anthropic".into()); + let defs = vec![definition( + "d1", + Some("gpt-default"), + Some("openai"), + "def prompt", + )]; + + let cfg = resolve_effective_config(&rec, &defs, &global(None, None)) + .require_resolved() + .unwrap(); + assert_eq!(cfg.model.value.as_deref(), Some("claude-opus")); + assert_eq!(cfg.model.source, ConfigSource::InstanceOverride); + assert_eq!(cfg.provider.value.as_deref(), Some("anthropic")); + assert_eq!(cfg.provider.source, ConfigSource::InstanceOverride); + assert_eq!(cfg.system_prompt.value.as_deref(), Some("def prompt")); +} + #[test] fn linked_inherit_global_when_definition_blank() { let rec = record( diff --git a/desktop/src-tauri/src/managed_agents/env_vars.rs b/desktop/src-tauri/src/managed_agents/env_vars.rs index 1653371e7f..4493bbd744 100644 --- a/desktop/src-tauri/src/managed_agents/env_vars.rs +++ b/desktop/src-tauri/src/managed_agents/env_vars.rs @@ -71,6 +71,9 @@ pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[ "BUZZ_ACP_AGENT_COMMAND", "BUZZ_ACP_AGENT_ARGS", "BUZZ_ACP_MCP_COMMAND", + // Retired agent-owned MCP configuration. Project connections own MCP + // endpoints and credentials; legacy values must never reach a runtime. + "BUZZ_ACP_MCP_SERVERS", // Security gates: respond-to mode + allowlist + legacy owner-only // fallback. Overriding would make the running agent's gate diverge // from the saved/UI-visible settings. @@ -97,6 +100,14 @@ pub(crate) fn is_reserved_env_key(key: &str) -> bool { RESERVED_ENV_KEYS .iter() .any(|reserved| reserved.eq_ignore_ascii_case(key)) + || is_legacy_agent_mcp_env_key(key) +} + +pub(crate) fn is_legacy_agent_mcp_env_key(key: &str) -> bool { + key.eq_ignore_ascii_case("BUZZ_ACP_MCP_SERVERS") + || key + .get(..9) + .is_some_and(|prefix| prefix.eq_ignore_ascii_case("BUZZ_MCP_")) } /// Returns true if `key` is a well-formed POSIX-shaped env var name: diff --git a/desktop/src-tauri/src/managed_agents/env_vars/tests.rs b/desktop/src-tauri/src/managed_agents/env_vars/tests.rs index 534c2e0835..7039e45ca7 100644 --- a/desktop/src-tauri/src/managed_agents/env_vars/tests.rs +++ b/desktop/src-tauri/src/managed_agents/env_vars/tests.rs @@ -1,8 +1,8 @@ use std::collections::BTreeMap; use super::{ - display_invalid_key, is_derived_provider_model_key, is_reserved_env_key, - is_well_formed_env_key, merged_user_env, validate_user_env_keys, + display_invalid_key, is_derived_provider_model_key, is_legacy_agent_mcp_env_key, + is_reserved_env_key, is_well_formed_env_key, merged_user_env, validate_user_env_keys, DERIVED_PROVIDER_MODEL_ENV_KEYS, MAX_ENV_TOTAL_BYTES, MAX_ENV_VALUE_BYTES, RESERVED_ENV_KEYS, }; @@ -460,6 +460,21 @@ fn is_derived_key_does_not_match_unrelated_keys() { assert!(!is_derived_provider_model_key("PROVIDER")); } +#[test] +fn legacy_agent_mcp_keys_are_reserved_case_insensitively() { + for key in [ + "BUZZ_ACP_MCP_SERVERS", + "buzz_acp_mcp_servers", + "BUZZ_MCP_CRM_AUTH_HEADER", + "buzz_mcp_crm_token", + ] { + assert!(is_legacy_agent_mcp_env_key(key)); + assert!(is_reserved_env_key(key)); + } + assert!(!is_legacy_agent_mcp_env_key("BUZZ_ACP_MCP_COMMAND")); + assert!(!is_legacy_agent_mcp_env_key("OPENAI_COMPAT_API_KEY")); +} + // ── deploy payload model precedence ──────────────────────────────── /// Documents the model precedence rule used by `build_deploy_payload`: diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs index 3173126b90..4619c57177 100644 --- a/desktop/src-tauri/src/managed_agents/runtime.rs +++ b/desktop/src-tauri/src/managed_agents/runtime.rs @@ -768,10 +768,7 @@ pub fn spawn_agent_child( } else { command.env_remove("BUZZ_ACP_MODEL"); } - // Session title for the harness to pass out-of-band on `session/new`. The - // adapter names the session after it; it never reaches the prompt, so this - // is display metadata only. `spawn_config_hash` hashes the same resolve, so - // a rename raises the restart badge instead of leaving the process stale. + // Display-only title; hashing the same resolve keeps restart state accurate. if let Some(title) = resolve_session_title(record.display_name.as_deref(), &record.name) { command.env(SESSION_TITLE_ENV_VAR, title); } else { @@ -789,6 +786,9 @@ pub fn spawn_agent_child( command.env(key, value); } } + // Record-only Desktop metadata must not leak to agent/MCP subprocesses. + command.env_remove(super::effective_config::MODEL_OVERRIDE_ENV_KEY); + command.env_remove(super::effective_config::PROVIDER_OVERRIDE_ENV_KEY); command.env_remove("BUZZ_ACP_PRIVATE_KEY"); command.env_remove("BUZZ_ACP_API_TOKEN"); command.env_remove("BUZZ_API_TOKEN"); diff --git a/desktop/src-tauri/src/migration.rs b/desktop/src-tauri/src/migration.rs index b3e613621e..4e63a104c2 100644 --- a/desktop/src-tauri/src/migration.rs +++ b/desktop/src-tauri/src/migration.rs @@ -171,11 +171,10 @@ fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) { reconcile_legacy_command_names(app); // Fold personas.json into the unified store HERE: after the JSON-level // personas.json migrations above (which must see the legacy file), and - // before every consumer of the load/save_personas shims below — - // sync_team_personas would otherwise operate on an empty definition set. - // Post-fold readers of the runtime map (`load_persona_runtimes`) fall - // back to the unified store's definitions. + // before every consumer below — sync_team_personas would otherwise operate + // on an empty definition set. fold_personas_into_agent_store(app); + mcp_boundary::strip_legacy_agent_mcp_env(app); // Clean the legacy baked team-instructions suffix out of stored prompts // AFTER the fold (so definitions lifted out of personas.json are cleaned in // the same boot) and BEFORE backfill_standalone_agents (so a manufactured @@ -1370,6 +1369,7 @@ pub fn migrate_persona_provider_to_runtime(app: &tauri::AppHandle) { mod materialize; pub use materialize::materialize_agent_runtimes; mod fold; +mod mcp_boundary; pub use fold::fold_personas_into_agent_store; use fold::load_persona_runtimes; mod backfill; diff --git a/desktop/src-tauri/src/migration/mcp_boundary.rs b/desktop/src-tauri/src/migration/mcp_boundary.rs new file mode 100644 index 0000000000..501ade1860 --- /dev/null +++ b/desktop/src-tauri/src/migration/mcp_boundary.rs @@ -0,0 +1,99 @@ +use std::path::Path; + +use tauri::Manager; + +use super::{canonical_dev_data_dir, patch_json_records}; + +pub(super) fn strip_legacy_agent_mcp_env_in_file(path: &Path) { + patch_json_records(path, |obj| { + let Some(serde_json::Value::Object(env_vars)) = obj.get_mut("env_vars") else { + return false; + }; + let stale_keys: Vec = env_vars + .keys() + .filter(|key| crate::managed_agents::is_legacy_agent_mcp_env_key(key)) + .cloned() + .collect(); + for key in &stale_keys { + env_vars.remove(key); + eprintln!( + "buzz-desktop: project-mcp-boundary: removed legacy agent-owned env var {key:?}" + ); + } + !stale_keys.is_empty() + }); +} + +/// Remove the retired per-agent MCP profile and generated credential values +/// before any managed-agent record is restored or deployed. Project +/// connections own this state now; the runtime filter remains defense in depth +/// for records that cannot be rewritten on this boot. +pub(super) fn strip_legacy_agent_mcp_env(app: &tauri::AppHandle) { + let Ok(current_dir) = app.path().app_data_dir() else { + return; + }; + let mut dirs = vec![current_dir.clone()]; + if let Some(canonical) = canonical_dev_data_dir(¤t_dir) { + if canonical.exists() && canonical != current_dir { + dirs.push(canonical); + } + } + for dir in dirs { + let path = dir.join("agents/managed-agents.json"); + if path.exists() { + strip_legacy_agent_mcp_env_in_file(&path); + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::migration::test_support::{read_agents_json, write_agents_json}; + + #[test] + fn removes_profile_and_generated_credentials() { + let dir = tempfile::tempdir().unwrap(); + write_agents_json( + dir.path(), + &serde_json::json!([{ + "name": "Cloud Agent", + "env_vars": { + "BUZZ_ACP_MCP_SERVERS": "profile", + "BUZZ_MCP_CRM_AUTH_HEADER": "secret", + "buzz_mcp_case_variant": "secret-two", + "OPENAI_COMPAT_API_KEY": "keep" + } + }]), + ); + let path = dir.path().join("agents/managed-agents.json"); + + strip_legacy_agent_mcp_env_in_file(&path); + + let records = read_agents_json(dir.path()); + let env_vars = &records[0]["env_vars"]; + assert!(env_vars.get("BUZZ_ACP_MCP_SERVERS").is_none()); + assert!(env_vars.get("BUZZ_MCP_CRM_AUTH_HEADER").is_none()); + assert!(env_vars.get("buzz_mcp_case_variant").is_none()); + assert_eq!(env_vars["OPENAI_COMPAT_API_KEY"], "keep"); + } + + #[test] + fn migration_is_idempotent() { + let dir = tempfile::tempdir().unwrap(); + write_agents_json( + dir.path(), + &serde_json::json!([{ + "name": "Cloud Agent", + "env_vars": {"BUZZ_MCP_CRM_TOKEN": "secret"} + }]), + ); + let path = dir.path().join("agents/managed-agents.json"); + + strip_legacy_agent_mcp_env_in_file(&path); + let after_first = std::fs::read_to_string(&path).unwrap(); + strip_legacy_agent_mcp_env_in_file(&path); + + assert_eq!(after_first, std::fs::read_to_string(&path).unwrap()); + } +} diff --git a/desktop/src/features/agents/ui/AgentInstanceConfigurationSections.tsx b/desktop/src/features/agents/ui/AgentInstanceConfigurationSections.tsx new file mode 100644 index 0000000000..a48473219c --- /dev/null +++ b/desktop/src/features/agents/ui/AgentInstanceConfigurationSections.tsx @@ -0,0 +1,71 @@ +import type * as React from "react"; +import { ChevronDown } from "lucide-react"; +import { AnimatePresence, motion, useReducedMotion } from "motion/react"; + +import { cn } from "@/shared/lib/cn"; +import { AdvancedRequiredBadge } from "./AdvancedRequiredBadge"; +import { EditAgentAdvancedFields } from "./EditAgentAdvancedFields"; + +const ADVANCED_FIELDS_MOTION_TRANSITION = { + duration: 0.18, + ease: [0.23, 1, 0.32, 1], +} as const; + +type AdvancedFieldsProps = React.ComponentProps; + +export function AgentInstanceConfigurationSections({ + advancedFieldsProps, + badgeEnvVars, + onShowAdvancedFieldsChange, + requiredEnvKeys, + showAdvancedFields, +}: { + advancedFieldsProps: AdvancedFieldsProps; + badgeEnvVars: Record; + onShowAdvancedFieldsChange: (show: boolean) => void; + requiredEnvKeys: readonly string[]; + showAdvancedFields: boolean; +}) { + const shouldReduceMotion = useReducedMotion(); + const transition = shouldReduceMotion + ? { duration: 0 } + : ADVANCED_FIELDS_MOTION_TRANSITION; + + return ( +
+ + + {showAdvancedFields ? ( + + + + ) : null} + +
+ ); +} diff --git a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx index adfb8182a8..f45da95f64 100644 --- a/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx +++ b/desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx @@ -1,6 +1,4 @@ import * as React from "react"; -import { ChevronDown } from "lucide-react"; -import { AnimatePresence, motion, useReducedMotion } from "motion/react"; import { toast } from "sonner"; import { @@ -24,9 +22,7 @@ import { ChooserDialogContent } from "@/shared/ui/chooser-dialog-content"; import { Dialog } from "@/shared/ui/dialog"; import { Input } from "@/shared/ui/input"; import { setManagedAgentAutoRestart } from "@/shared/api/tauriManagedAgents"; -import { EditAgentAdvancedFields } from "./EditAgentAdvancedFields"; import { - ADVANCED_FIELDS_MOTION_TRANSITION, AUTO_PROVIDER_DROPDOWN_VALUE, BLOCK_BUILD_HIDDEN_PROVIDER_IDS, CUSTOM_PROVIDER_DROPDOWN_VALUE, @@ -86,7 +82,6 @@ import { AgentAiDefaultsNotice } from "./AgentAiDefaults"; import { AgentDefaultsDialog } from "./AgentDefaultsDialog"; import { useProviderApiKeyFieldState } from "./providerApiKeyFieldState"; import { resolveModelFieldStatusMessage } from "./agentConfigControls"; -import { AdvancedRequiredBadge } from "./AdvancedRequiredBadge"; import { showAgentProfileSyncWarning } from "./agentProfileSyncWarning"; import { AddCustomHarnessDialog } from "./AddCustomHarnessDialog"; import { @@ -94,6 +89,12 @@ import { runtimeDropdownAction, usePendingHarnessSelection, } from "./addCustomHarness"; +import { AgentInstanceConfigurationSections } from "./AgentInstanceConfigurationSections"; +import { + MODEL_OVERRIDE_ENV_KEY, + PROVIDER_OVERRIDE_ENV_KEY, + applyLinkedModelProviderOverrides, +} from "./agentInstanceOverrides"; export function AgentInstanceEditDialog({ agent, @@ -142,6 +143,7 @@ export function AgentInstanceEditDialog({ const [isCustomProviderEditing, setIsCustomProviderEditing] = React.useState(false); const [envVars, setEnvVars] = React.useState(agent.envVars); + const overrideTouched = React.useRef({ model: false, provider: false }); const [autoRestartOnConfigChange, setAutoRestartOnConfigChange] = React.useState(agent.autoRestartOnConfigChange); const personasQuery = usePersonasQuery(); @@ -164,7 +166,6 @@ export function AgentInstanceEditDialog({ const [isAvatarUploadPending, setIsAvatarUploadPending] = React.useState(false); const [isAddHarnessOpen, setIsAddHarnessOpen] = React.useState(false); - const shouldReduceMotion = useReducedMotion(); // Runtime selector: defaults to "custom" until the dialog opens and the // catalog loads. The open-effect re-derives the correct id from the catalog. @@ -192,6 +193,7 @@ export function AgentInstanceEditDialog({ setProvider(agent.provider ?? ""); setIsCustomProviderEditing(false); setEnvVars(agent.envVars); + overrideTouched.current = { model: false, provider: false }; setAutoRestartOnConfigChange(agent.autoRestartOnConfigChange); setRespondTo(agent.respondTo); setRespondToAllowlist(agent.respondToAllowlist); @@ -503,6 +505,7 @@ export function AgentInstanceEditDialog({ // Mark that the user has made an explicit runtime choice. The catalog-arrival // effect will no longer overwrite selectedRuntimeId after this point. runtimeTouched.current = true; + overrideTouched.current = { model: true, provider: true }; const resolvedRuntimeId = nextRuntimeId || "custom"; setSelectedRuntimeId(resolvedRuntimeId); @@ -554,6 +557,7 @@ export function AgentInstanceEditDialog({ ); function handleProviderDropdownChange(nextValue: string) { + overrideTouched.current.provider = true; const nextProvider = nextValue === AUTO_PROVIDER_DROPDOWN_VALUE ? "" : nextValue; if (nextProvider === "relay-mesh" && selectedRuntimeId !== "buzz-agent") { @@ -574,6 +578,7 @@ export function AgentInstanceEditDialog({ } function handleModelDropdownChange(nextValue: string) { + overrideTouched.current.model = true; applySelection( selectionOnModelDropdownChange(selection, { nextValue, @@ -651,7 +656,14 @@ export function AgentInstanceEditDialog({ // (same values the credential gate validates), so gate ↔ record ↔ spawn // all agree. See resolveInheritedRuntimeSubmission. const normalizedSubmitProvider = inheritedSubmission.provider; - const submitEnvVars = inheritedSubmission.envVars; + const submitEnvVars = applyLinkedModelProviderOverrides({ + envVars: inheritedSubmission.envVars, + linked: linkedPersona != null, + model: normalizedModel, + modelTouched: overrideTouched.current.model, + provider: normalizedSubmitProvider, + providerTouched: overrideTouched.current.provider, + }); const input: UpdateManagedAgentInput = { pubkey: agent.pubkey, name: name.trim() !== agent.name ? name.trim() : undefined, @@ -839,9 +851,11 @@ export function AgentInstanceEditDialog({ const previewLabel = name.trim() || "Agent name"; const previewAvatarUrl = avatarUrl.trim() || null; - const advancedFieldsTransition = shouldReduceMotion - ? { duration: 0 } - : ADVANCED_FIELDS_MOTION_TRANSITION; + const hiddenEnvKeys = [ + ...(topLevelSecretEnvVar ? [topLevelSecretEnvVar] : []), + MODEL_OVERRIDE_ENV_KEY, + PROVIDER_OVERRIDE_ENV_KEY, + ]; return ( @@ -1144,74 +1158,43 @@ export function AgentInstanceEditDialog({ /> {/* Advanced settings */} -
- - - {showAdvancedFields ? ( - - - - ) : null} - -
+ {/* Error */} {updateMutation.error instanceof Error ? ( diff --git a/desktop/src/features/agents/ui/agentInstanceOverrides.test.mjs b/desktop/src/features/agents/ui/agentInstanceOverrides.test.mjs new file mode 100644 index 0000000000..d4ad6ba098 --- /dev/null +++ b/desktop/src/features/agents/ui/agentInstanceOverrides.test.mjs @@ -0,0 +1,71 @@ +import assert from "node:assert/strict"; +import { describe, it } from "node:test"; + +import { + MODEL_OVERRIDE_ENV_KEY, + PROVIDER_OVERRIDE_ENV_KEY, + applyLinkedModelProviderOverrides, +} from "./agentInstanceOverrides.ts"; + +describe("applyLinkedModelProviderOverrides", () => { + it("stores explicit linked-instance choices without disturbing secrets", () => { + assert.deepEqual( + applyLinkedModelProviderOverrides({ + envVars: { ANTHROPIC_API_KEY: "secret" }, + linked: true, + model: "claude-opus-4-7", + modelTouched: true, + provider: "anthropic", + providerTouched: true, + }), + { + ANTHROPIC_API_KEY: "secret", + [MODEL_OVERRIDE_ENV_KEY]: "claude-opus-4-7", + [PROVIDER_OVERRIDE_ENV_KEY]: "anthropic", + }, + ); + }); + + it("removes only the override the user reset to inherit", () => { + assert.deepEqual( + applyLinkedModelProviderOverrides({ + envVars: { + [MODEL_OVERRIDE_ENV_KEY]: "old-model", + [PROVIDER_OVERRIDE_ENV_KEY]: "anthropic", + }, + linked: true, + model: null, + modelTouched: true, + provider: "anthropic", + providerTouched: false, + }), + { [PROVIDER_OVERRIDE_ENV_KEY]: "anthropic" }, + ); + }); + + it("leaves definition-less agents and untouched linked agents alone", () => { + const envVars = { KEEP: "yes" }; + assert.equal( + applyLinkedModelProviderOverrides({ + envVars, + linked: false, + model: "m", + modelTouched: true, + provider: "p", + providerTouched: true, + }), + envVars, + ); + assert.equal( + applyLinkedModelProviderOverrides({ + envVars, + linked: true, + model: "m", + modelTouched: false, + provider: "p", + providerTouched: false, + }), + envVars, + ); + }); +}); diff --git a/desktop/src/features/agents/ui/agentInstanceOverrides.ts b/desktop/src/features/agents/ui/agentInstanceOverrides.ts new file mode 100644 index 0000000000..29c453b6ef --- /dev/null +++ b/desktop/src/features/agents/ui/agentInstanceOverrides.ts @@ -0,0 +1,33 @@ +export const MODEL_OVERRIDE_ENV_KEY = "BUZZ_DESKTOP_MODEL_OVERRIDE"; +export const PROVIDER_OVERRIDE_ENV_KEY = "BUZZ_DESKTOP_PROVIDER_OVERRIDE"; + +export function applyLinkedModelProviderOverrides({ + envVars, + linked, + model, + modelTouched, + provider, + providerTouched, +}: { + envVars: Record; + linked: boolean; + model: string | null; + modelTouched: boolean; + provider: string | null; + providerTouched: boolean; +}): Record { + if (!linked || (!modelTouched && !providerTouched)) return envVars; + + const next = { ...envVars }; + if (modelTouched) { + const value = model?.trim() ?? ""; + if (value) next[MODEL_OVERRIDE_ENV_KEY] = value; + else delete next[MODEL_OVERRIDE_ENV_KEY]; + } + if (providerTouched) { + const value = provider?.trim() ?? ""; + if (value) next[PROVIDER_OVERRIDE_ENV_KEY] = value; + else delete next[PROVIDER_OVERRIDE_ENV_KEY]; + } + return next; +} diff --git a/desktop/src/shared/api/managedAgentConfigSource.ts b/desktop/src/shared/api/managedAgentConfigSource.ts new file mode 100644 index 0000000000..ce23e091da --- /dev/null +++ b/desktop/src/shared/api/managedAgentConfigSource.ts @@ -0,0 +1,5 @@ +export type ManagedAgentConfigSource = + | "definition" + | "global" + | "instance_override" + | "instance_legacy"; diff --git a/desktop/src/shared/api/types.ts b/desktop/src/shared/api/types.ts index fd2c71bced..a1f04a7272 100644 --- a/desktop/src/shared/api/types.ts +++ b/desktop/src/shared/api/types.ts @@ -1,7 +1,8 @@ +import type { ManagedAgentConfigSource } from "./managedAgentConfigSource"; + export type ChannelType = "stream" | "forum" | "dm"; export type ChannelVisibility = "open" | "private"; export type ChannelRole = "owner" | "admin" | "member" | "guest" | "bot"; - export type Channel = { id: string; name: string; @@ -20,7 +21,6 @@ export type Channel = { ttlSeconds: number | null; ttlDeadline: string | null; }; - export type ChannelDetail = Channel & { createdBy: string; createdAt: string; @@ -334,7 +334,7 @@ export type ManagedAgent = { systemPrompt: string | null; avatarUrl: string | null; model: string | null; - modelSource: "definition" | "global" | "instance_legacy" | null; + modelSource: ManagedAgentConfigSource | null; /** LLM inference provider, from the agent's pinned record snapshot. */ provider: string | null; /** diff --git a/scripts/fly-agent-entrypoint.sh b/scripts/fly-agent-entrypoint.sh new file mode 100644 index 0000000000..01e0e7eb1d --- /dev/null +++ b/scripts/fly-agent-entrypoint.sh @@ -0,0 +1,10 @@ +#!/bin/sh +set -eu + +# A new Fly volume is mounted over the image's pre-created home directory and +# starts root-owned. Fix only this dedicated mount before permanently dropping +# privileges; buzz-acp and every child runtime then run as the non-root agent. +chown agent:agent /home/agent +chmod 0700 /home/agent + +exec su-exec agent /usr/local/bin/sprig-entrypoint "$@"