From 67da23b1c7884a07d4f2765497f3365c00ecdbf8 Mon Sep 17 00:00:00 2001 From: Hayt <41ea58f1e64c243627e8acde7c89be667052ee6e17d8f021c1195be4324ebf04@buzz.block.builderlab.xyz> Date: Thu, 13 Aug 2026 03:30:56 -0400 Subject: [PATCH] docs(desktop): correct harness .bak safety comments for inline fallback The save-path .bak comments called a leaked backup unconditionally harmless. That holds only when the harness env was projected into the keyring; in the keyring-unavailable/keyless fallback the env stays inline, so the .bak carries plaintext secrets. State the real contract and point at the boot migration that scrubs *.json.bak for exactly that case. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../src-tauri/src/managed_agents/custom_harnesses.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/desktop/src-tauri/src/managed_agents/custom_harnesses.rs b/desktop/src-tauri/src/managed_agents/custom_harnesses.rs index 5557d975a1..d581b44011 100644 --- a/desktop/src-tauri/src/managed_agents/custom_harnesses.rs +++ b/desktop/src-tauri/src/managed_agents/custom_harnesses.rs @@ -587,7 +587,11 @@ pub(crate) fn save_custom_harness_to_dir( /// carries inline env in the keyless / keyring-unavailable fallback). /// 2. If the target already exists, rename it to `.bak` (the backup). /// 3. `commit()` the temp file (renames temp → target). -/// * On success: delete `.bak` (best-effort; a stale `.bak` is harmless). +/// * On success: delete `.bak` (best-effort). A leaked `.bak` is harmless +/// when the file it backs up had its env projected into the keyring, but +/// carries inline secrets in the keyring-unavailable fallback — which is +/// why the boot migration scrubs `*.json.bak` (see +/// [`crate::migration::migration_harness_secrets`]). /// * On failure: restore `.bak` → target so the original is never lost. /// 4. If `rename_old_id` is `Some`, remove `/.json` after the /// new file is committed (non-fatal if NotFound). @@ -665,7 +669,9 @@ pub(crate) fn save_custom_harness_to_dir_with( return Err(format!("failed to finalize harness definition: {e}")); } - // Commit succeeded — remove the backup (best-effort; stale .bak is harmless). + // Commit succeeded — remove the backup (best-effort). A leaked `.bak` is + // harmless once env was projected to the keyring, but secret-bearing in the + // inline fallback; the boot migration scrubs `*.json.bak` for that case. if had_backup { let _ = std::fs::remove_file(&bak_path); }