block / block/buzz

Per-account local workspace file leaks agent roster & relay info across communities

Open
#3,106 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
32.7k
Forks
4.3k
Avg merge
1d 13h
Merged PRs (30d)
253

Description

On a single Buzz account with multiple communities (e.g. a personal community and a separate business community), the local on-disk workspace directory is shared across all of that account's communities — including the file that lists active agents and workspace info (`AGENTS.md`).

Actual channel membership is correctly scoped: calling the channel-members endpoint for a given channel only returns the bots actually added to that specific channel.

However, the shared workspace file lists the *full* agent roster from every community under the account, not just the current one, and its documented relay differs from the relay the current session is actually connected to (each community appears to connect via its own relay subdomain, e.g. `.communities.buzz.xyz`). Several agent entries also appear duplicated in the roster table, consistent with the file being appended to by multiple communities without deduplication.

**Expected:** the local workspace file (or equivalent) should be scoped per-community, or at minimum clearly label which community each roster entry/relay reference belongs to.

**Actual:** roster and relay info from one community bleeds into another community's workspace file on the same account — likely also surfacing in Desktop's agent list/picker UI, which is confusing when a user has more than one community.

Contributor guide

Open the contributing guide

Research direction

Start with the per-account workspace directory and AGENTS.md, then trace how the active-agent roster and relay information are assembled for each community. Check the Desktop agent list/picker as well as the channel-members endpoint behavior. Done means one community's workspace and UI show no other community's agents or relay, with duplicate roster entries removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.