jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-06 01:11:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(desktop): correct harness .bak safety comments for inline fallback

Browse Source 
The save-path .bak comments called a leaked backup unconditionally harmless. That holds only when the harness env was projected into the keyring; in the keyring-unavailable/keyless fallback the env stays inline, so the .bak carries plaintext secrets. State the real contract and point at the boot migration that scrubs *.json.bak for exactly that case.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This commit is contained in:
Hayt
2026-08-13 03:30:56 -04:00
parent f048f3bb84
commit 67da23b1c7
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
desktop/src-tauri/src/managed_agents/custom_harnesses.rs
View File

@@ -587,7 +587,11 @@ pub(crate) fn save_custom_harness_to_dir(
/// carries inline env in the keyless / keyring-unavailable fallback).
/// 2. If the target already exists, rename it to `<target>.bak` (the backup).
/// 3. `commit()` the temp file (renames temp → target).
/// * On success: delete `.bak` (best-effort; a stale `.bak` is harmless).
/// * On success: delete `.bak` (best-effort). A leaked `.bak` is harmless
/// when the file it backs up had its env projected into the keyring, but
/// carries inline secrets in the keyring-unavailable fallback — which is
/// why the boot migration scrubs `*.json.bak` (see
/// [`crate::migration::migration_harness_secrets`]).
/// * On failure: restore `.bak` → target so the original is never lost.
/// 4. If `rename_old_id` is `Some`, remove `<dir>/<old_id>.json` after the
/// new file is committed (non-fatal if NotFound).
@@ -665,7 +669,9 @@ pub(crate) fn save_custom_harness_to_dir_with<S: ProjectionStore>(
return Err(format!("failed to finalize harness definition: {e}"));
}
// Commit succeeded — remove the backup (best-effort; stale .bak is harmless).
// Commit succeeded — remove the backup (best-effort). A leaked `.bak` is
// harmless once env was projected to the keyring, but secret-bearing in the
// inline fallback; the boot migration scrubs `*.json.bak` for that case.
if had_backup {
let _ = std::fs::remove_file(&bak_path);
}