jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-27 12:40:30 +00:00

Files

Will Pfleger d1b7da45a2 feat(acp): add BUZZ_GIT_IDENTITY switch for agent commit identity (#8024 )

🤖 This adds an operator switch for whose identity an agent's commits
carry, and removes the reason agents were clearing their git identity
env vars. Replaces #6177.

Since #7819, every agent authors and signs commits as its nostr identity
through `GIT_CONFIG_*` env vars, which beat repo and global config in
every shell the agent runs. Operators had no way to opt out of that.

**`BUZZ_GIT_IDENTITY=agent|user`.** It's read once in
`GitEnvironment::install`. Unset or `agent` keeps today's behavior.
`user` keeps only relay git auth (the credential helper and keyfile) and
installs no identity, no `git-sign-nostr` and no signing config, so git
uses the operator's own config. It also drops inherited `GIT_CONFIG_*`
entries for the agent identity and signing keys,
`author.*`/`committer.*`, and `include.path`/`includeIf.*.path`, so a
nested agent in `user` mode can't pick up its parent agent's identity.
Any other value fails startup with an error naming the variable and both
allowed values. The resolved mode is forwarded in the managed env to MCP
servers, which `buzz-agent` starts with a cleared env, so a nested
`buzz-acp` launched from an MCP shell keeps the operator's choice
instead of falling back to `agent`.

**Known limitation:** in `user` mode, an operator whose own git config
signs with `git-sign-nostr` has commits refused with a key-mismatch
error, because the agent shell's `BUZZ_PRIVATE_KEY` (needed by the
`buzz` CLI) loads ahead of `nostr.keyfile` and NIP-GS requires the
signer to exit when the loaded key doesn't match `-u`. Nothing is signed
with the wrong key. SSH and GPG signing are unaffected.

**Desktop reserves `GIT_CONFIG*`.** User env overrides are layered onto
the spawn command after the relay credential helper, so a single
`GIT_CONFIG_COUNT=0` used to silently drop it. `GIT_CONFIG` and every
`GIT_CONFIG_*` name are now reserved keys.

**`session_new_forwards_complete_git_block_without_duplicate_names` no
longer reads the runner's env.** Run inside an agent session, it picked
up the session's own inherited `GIT_CONFIG_*` and failed. Agents worked
around that by unsetting `GIT_CONFIG_COUNT`, and any commit made in that
shell fell back to the human's git identity and signing key. The test
now hides the runner's `GIT_CONFIG*` and `BUZZ_GIT_IDENTITY` under
`ENV_LOCK` and restores them afterwards.

**Agent instructions.** `base_prompt.md` and the nest `AGENTS.md` now
say the runtime sets the agent's commit identity and signing, and that
agents shouldn't override them with `user.*` config, `-c user.*`,
`--author` or another signing key. Trailers are added only when the
repository or the person the agent works for requires them. If a
repository requires a different author, the agent tells the operator,
who can switch to `BUZZ_GIT_IDENTITY=user`, instead of overriding the
identity. The nest `AGENTS.md` scopes this to agents Buzz runs through
its stock `buzz-acp` harness, and notes that custom harnesses get only
relay git auth and control their own attribution. `NEST_AGENTS_VERSION`
goes from 5 to 6.

---------

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

2026-10-01 17:04:33 -04:00