[kazemek21]

TL;DR

Adds owner_media_get, so an agent running in this app on a bundled harness can get one of its community's media blobs signed as its owner, matching the other owner read tools. The bytes stay in native memory. They are saved to a file only after protection has reviewed the answer and the owner binding, sign-in and agent still hold. Agents on remote Codex/Claude targets never see the tool and are refused it before any read.

How it works

• Stage (app_agent_owner_media_stage, src-tauri/src/app_agents/owner_media.rs)
  • Takes the owner, agent and community from host state, never from the caller.
  • Refuses anything but the agent's own community blob, with the same URL, hash, type and name rules as media_get.
  • Signs the Blossom get auth (kind 24242) only through a purpose-limited IdentityHost::sign_owner_media_get. It does not add a generic signer.
  • Reads into memory:
    • 500 MiB per file and 512 MiB held at once.
    • At most 16 operations.
    • A reservation is made before the body is read. Without a Content-Length the full per-file limit is reserved, and chunks past the reservation are refused. The buffer grows fallibly and never past its reservation.
    • Staged bodies expire lazily after 330 s.
• Release (owner-access.ts): after the tool-result review, one synchronous segment checks the held binding and the caller check, then invokes native publish.
• Publish
  • hold_owner keeps the owner signed in.
  • commit_caller takes the existing lock order (IdentityHost → AgentTokens retired → incarnations → FI state → op), re-checks the agent's retirement (including a pending organization sign-out) and incarnation, takes the staged op, and writes the first chunk.
  • The rest is written after the locks drop and persisted to the media path. Nothing named exists before then. The op keeps its memory reservation until the write finishes, so the 512 MiB bound still holds while bytes are being saved.
• Discard
  • Review denial, a binding change, a cancelled turn or any failure discards the op.
  • A discard that arrives before its stage leaves a bounded tombstone (64), so the late stage is refused.
  • Page reload and window Destroyed clear every read and staged body. A publication already writing its file stays counted until it finishes.
  • No new timer, poll or retry.
• Remote targets
  • Codex and Claude runtimes strip ownerAccess.media for a remote target.
  • The tool is not listed, and a direct or cached call returns "not available … nothing was read".
  • Pi, Goose, Mesh and kit run locally and keep it. Plugin and external clients still never get ownerAccess.
  • Codex's saved-thread key now includes whether owner_media_get is listed. An existing local owner thread therefore starts fresh once instead of resuming with a stale tool list.

Evidence

• Rust: 10 new owner_media tests cover:

  • the auth event's pubkey equals the owner;
  • nothing is on disk before publish;
  • another owner is never signed or sent for;
  • foreign URLs and hash mismatches are refused;
  • absent or dishonest lengths are bounded;
  • the shared budget;
  • tombstones that overtake the stage;
  • single take and expiry;
  • no write after deletion, sign-out (including a pending organization sign-out), identity close or a switch to another owner;
  • a publishing op keeps its reservation until the write finishes;
  • the fence order, under controlled interleavings. A test-only pause holds a publication at a chosen point:
    • Held after its review and before the fence, a publication is refused once a deletion, sign-out or closed identity comes first. Nothing is written and the body is dropped.
    • Held inside the fence, a publication makes a sign-out wait. The existing sign-out contention hook observes the sign-out blocked on the retirement lock. The whole file is written, and then the sign-out completes.

  They run against the loopback TLS community fixture, so the host→relay request is real. Result: cargo test --lib filtered to owner_media, identity, relay, federated_identity::agent, app_agents and browser_permissions gave 490 passed, 0 failed, run on Linux Blox. The fence tests passed five repeated runs. Each of three mutants of commit_caller makes one of them fail: dropping the retirement check, dropping the deletion check, and writing after releasing the retirement lock.

• JS: tests in owner-access.test.ts, owner.test.ts, codex/runtime.test.ts and claude-code/execution.test.ts cover:

  • the release ordering;
  • binding changes before release;
  • cancel during stage;
  • review allow and deny (tool → stage → tool-result → publish/discard);
  • local versus remote discovery and refusal.

  The Claude remote test and the Codex stale-thread test fail without their fixes, as do the Rust pending-sign-out and buffer-capacity cases. Vitest across src/buzz-mcp, src/features/agents, src/features/agent-harness and src/bundled/{codex,claude-code,pi} passed: 2946 tests.

• Not exercised: the native publish path has not been run in the live app. The fence tests drive the real publish and the real credential locks, not the WebView. A deletion or identity close that arrives inside the fence is ordered by the same locks, but no test observes it waiting.

Overlap

Touches areas also changed by open PRs #2972, #2882, #2336, #2937, #1939, #2950, #2976, #2642, #2700, #1735, #1893, #2953, #2896, #2836 and #2473. Of these, #2882 (streaming protected evidence) is the closest. This PR doesn't stream full bytes to protection; the existing review sees the reply's metadata, path and inline image data only.

🤖 Generated with Claude Code

— Posted by Claude Code (claude-opus-5-5) on behalf of kylez