From 56c68b2e3560d02f2363f7ff93156c7551e5b34c Mon Sep 17 00:00:00 2001
From: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co>
Date: Wed, 10 Jun 2026 14:24:39 -0400
Subject: [PATCH] fix(desktop): drop env_vars from public PersonaEventContent

The kind:30175 content body is published unencrypted, so carrying env_vars there leaked any secrets a persona held (API keys, tokens) in plaintext to every relay and reader. Per NIP-AP, persona events are public configuration; secrets travel only via the NIP-44-encrypted mem/persona engram. persona_from_event now returns an empty env_vars map; engram instantiation is the sole secret path.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
---
 desktop/src-tauri/src/managed_agents/persona_events.rs | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/desktop/src-tauri/src/managed_agents/persona_events.rs b/desktop/src-tauri/src/managed_agents/persona_events.rs
index 1f9f69eb1e..31e1e93b5d 100644
--- a/desktop/src-tauri/src/managed_agents/persona_events.rs
+++ b/desktop/src-tauri/src/managed_agents/persona_events.rs
@@ -27,8 +27,6 @@ pub struct PersonaEventContent {
     pub provider: Option<String>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub name_pool: Vec<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub env_vars: BTreeMap<String, String>,
 }
 
 /// Derive the d-tag (persona slug) from a `PersonaRecord`.
@@ -54,7 +52,6 @@ pub fn build_persona_event(record: &PersonaRecord) -> Result<EventBuilder, Strin
         model: record.model.clone(),
         provider: record.provider.clone(),
         name_pool: record.name_pool.clone(),
-        env_vars: record.env_vars.clone(),
     };
 
     let content_json = serde_json::to_string(&content)
@@ -101,7 +98,7 @@ pub fn persona_from_event(event: &nostr::Event) -> Result<PersonaRecord, String>
         is_active: true,
         source_team: None,
         source_team_persona_slug: Some(d_tag),
-        env_vars: content.env_vars,
+        env_vars: BTreeMap::new(),
         created_at: created_at.clone(),
         updated_at: created_at,
     })
@@ -197,7 +194,9 @@ mod tests {
         assert_eq!(restored.model, Some("claude-opus-4".to_string()));
         assert_eq!(restored.provider, Some("anthropic".to_string()));
         assert_eq!(restored.name_pool, vec!["Alpha", "Beta"]);
-        assert_eq!(restored.env_vars.get("KEY"), Some(&"value".to_string()));
+        // env_vars are not included in public persona events (secrets travel
+        // via NIP-44-encrypted engrams only).
+        assert!(restored.env_vars.is_empty());
         assert_eq!(
             restored.source_team_persona_slug,
             Some("test-slug".to_string())