fix(desktop): export agent NIP-OA attestation to git credential helper - #3205
Open
alu042 wants to merge 1 commit into
Open
fix(desktop): export agent NIP-OA attestation to git credential helper#3205alu042 wants to merge 1 commit into
alu042 wants to merge 1 commit into
Conversation
Agent-owned PR merges authenticate git as the managed agent, but the desktop did not pass the agent's NIP-OA auth tag to git-credential-nostr, so relays that enforce membership rejected the merge's initial clone. Pass the tag through GitAuthConfig, resolve the owner identity with the existing stored-or-computed fallback so legacy agent records work, and clear inherited identity env vars before running git. Tests: cargo test --manifest-path desktop/src-tauri/Cargo.toml Signed-off-by: Alexander Lundervold <alexander.lundervold@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merging a pull request in an agent-owned repo fails on membership-enforcing relays. The desktop authenticates git as the managed agent but does not pass its NIP-OA owner attestation to
git-credential-nostr, so the merge's initial clone is rejected with403 restricted: not a relay member— even though the agent's own pushes to the same repo work (the ACP harness injectsBUZZ_AUTH_TAGfor agent subprocesses, and #2120 taught the helper and relay to carry the attestation inside the NIP-98 event).This passes the auth tag through
GitAuthConfigand exports it asBUZZ_AUTH_TAGfor credentialed git commands. Agents created before auth tags were persisted resolve one through the existing stored-or-computed fallback from the message path, which also covers the PR status event submissions made under the same identity.NOSTR_PRIVATE_KEY,BUZZ_AUTH_TAGandBUZZ_PRIVATE_KEYare now cleared before every git command so ambient values can't be inherited accidentally.Viewer-owned operations continue to authenticate without an owner attestation. Missing-helper diagnostics and a friendlier merge error message are left for follow-ups.
Related issue
N/A — no duplicate found in open or closed issues and PRs; the diagnosis is above rather than in a separate issue. Two related but distinct reports: #2316 is a different failure earlier in the same git-auth path (the helper yields no credentials at all, needs git >= 2.46), and #2345 touches
project_git_exec.rsfor helper diagnostics, so there is a small overlap if it lands first.Testing
cargo test --manifest-path desktop/src-tauri/Cargo.tomljust desktop-tauri-fmt-checkjust desktop-tauri-clippyjust desktop-checkUnit tests cover auth-tag propagation from the owner identity into the git environment, environment scrubbing for credentialed, local and missing-helper commands, and stored-vs-computed attestation selection for legacy records.
I also ran a live integration test of the git/auth path against a locally built relay with
BUZZ_REQUIRE_RELAY_MEMBERSHIP=trueandBUZZ_ALLOW_NIP_OA_AUTH=true, driving the patchedrun_git/configure_git_authwith a repo owned by a non-member agent whose owner is a member. Without the attestation the merge's first clone fails withremote: restricted: not a relay memberand HTTP 403, matching the reported failure; with it, the merge sequence (clone, fetch, merge, push) succeeds and a fresh clone contained the merged content on the target branch. The original failure was separately observed on v0.4.26 against a hosted community.No UI change.