jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-03 16:01:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(desktop): drop env_vars from public PersonaEventContent

Browse Source 
The kind:30175 content body is published unencrypted, so carrying env_vars there leaked any secrets a persona held (API keys, tokens) in plaintext to every relay and reader. Per NIP-AP, persona events are public configuration; secrets travel only via the NIP-44-encrypted mem/persona engram. persona_from_event now returns an empty env_vars map; engram instantiation is the sole secret path.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This commit is contained in:
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
2026-06-10 14:24:39 -04:00
parent 632e736acd
commit 56c68b2e35
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
desktop/src-tauri/src/managed_agents/persona_events.rs
View File

@@ -27,8 +27,6 @@ pub struct PersonaEventContent {
pub provider: Option<String>,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub name_pool: Vec<String>,
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
pub env_vars: BTreeMap<String, String>,
}
/// Derive the d-tag (persona slug) from a `PersonaRecord`.
@@ -54,7 +52,6 @@ pub fn build_persona_event(record: &PersonaRecord) -> Result<EventBuilder, Strin
model: record.model.clone(),
provider: record.provider.clone(),
name_pool: record.name_pool.clone(),
env_vars: record.env_vars.clone(),
};
let content_json = serde_json::to_string(&content)
@@ -101,7 +98,7 @@ pub fn persona_from_event(event: &nostr::Event) -> Result<PersonaRecord, String>
is_active: true,
source_team: None,
source_team_persona_slug: Some(d_tag),
env_vars: content.env_vars,
env_vars: BTreeMap::new(),
created_at: created_at.clone(),
updated_at: created_at,
})
@@ -197,7 +194,9 @@ mod tests {
assert_eq!(restored.model, Some("claude-opus-4".to_string()));
assert_eq!(restored.provider, Some("anthropic".to_string()));
assert_eq!(restored.name_pool, vec!["Alpha", "Beta"]);
assert_eq!(restored.env_vars.get("KEY"), Some(&"value".to_string()));
// env_vars are not included in public persona events (secrets travel
// via NIP-44-encrypted engrams only).
assert!(restored.env_vars.is_empty());
assert_eq!(
restored.source_team_persona_slug,
Some("test-slug".to_string())