fix(desktop): rename SPROUT_ env vars to BUZZ_ for child agent processes (#971)

Author: tlongwell-block

desktop/src-tauri/src/commands/agent_models.rs

@@ -83,8 +83,8 @@ pub async fn get_agent_models(
         }
         cmd.arg("models")
             .arg("--json")
-            .env("SPROUT_ACP_AGENT_COMMAND", &agent_command)
-            .env("SPROUT_ACP_AGENT_ARGS", agent_args.join(","));
+            .env("BUZZ_ACP_AGENT_COMMAND", &agent_command)
+            .env("BUZZ_ACP_AGENT_ARGS", agent_args.join(","));
         if let Some(meta) = known_acp_runtime(&agent_command) {
             for (key, value) in meta.default_env {
                 if std::env::var(key).is_err() {

desktop/src-tauri/src/managed_agents/discovery.rs

@@ -152,8 +152,8 @@ const KNOWN_ACP_RUNTIMES: &[KnownAcpRuntime] = &[
         adapter_install_hint: "",
         skill_dir: None,
         supports_acp_model_switching: true,
-        model_env_var: Some("SPROUT_AGENT_MODEL"),
-        provider_env_var: Some("SPROUT_AGENT_PROVIDER"),
+        model_env_var: Some("BUZZ_AGENT_MODEL"),
+        provider_env_var: Some("BUZZ_AGENT_PROVIDER"),
         provider_locked: false,
         default_env: &[],
     },

desktop/src-tauri/src/managed_agents/env_vars.rs

@@ -5,10 +5,10 @@
 //! Precedence: desktop parent env < persona env < agent env (last wins on
 //! key collision). See `runtime::spawn_agent_child`.
 //!
-//! A small set of *reserved* keys — Sprout's identity and secrets — are
+//! A small set of *reserved* keys — Buzz's identity and secrets — are
 //! rejected at save time and stripped at runtime so a typo or malicious
 //! value can't swap the agent's nsec. Behavior knobs (GOOSE_MODE,
-//! SPROUT_TOOLSETS, SPROUT_ACP_MODEL, SPROUT_ACP_SYSTEM_PROMPT, …) remain
+//! BUZZ_TOOLSETS, BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain
 //! freely overridable — those have dedicated UI fields, but power users
 //! may want to bypass them.
 
@@ -28,8 +28,8 @@ use std::collections::BTreeMap;
 pub(crate) const DERIVED_PROVIDER_MODEL_ENV_KEYS: &[&str] = &[
     "GOOSE_MODEL",
     "GOOSE_PROVIDER",
-    "SPROUT_AGENT_MODEL",
-    "SPROUT_AGENT_PROVIDER",
+    "BUZZ_AGENT_MODEL",
+    "BUZZ_AGENT_PROVIDER",
 ];
 
 /// Returns `true` if `key` is a derived provider/model env key that should be
@@ -68,32 +68,32 @@ pub(crate) fn filter_derived_provider_model_env_vars(
 ///    example), or redirect the agent to an attacker-controlled relay.
 ///
 /// This list is deliberately narrow — it only covers keys with security
-/// implications. Behavior knobs (GOOSE_MODE, SPROUT_TOOLSETS,
-/// SPROUT_ACP_MODEL, SPROUT_ACP_SYSTEM_PROMPT, …) remain freely
+/// implications. Behavior knobs (GOOSE_MODE, BUZZ_TOOLSETS,
+/// BUZZ_ACP_MODEL, BUZZ_ACP_SYSTEM_PROMPT, …) remain freely
 /// overridable; those have dedicated UI fields but power users may want
 /// to bypass them.
 pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[
     // Identity / secrets.
-    "SPROUT_PRIVATE_KEY",
+    "BUZZ_PRIVATE_KEY",
     "NOSTR_PRIVATE_KEY",
-    "SPROUT_AUTH_TAG",
-    "SPROUT_API_TOKEN",
-    "SPROUT_ACP_PRIVATE_KEY",
-    "SPROUT_ACP_API_TOKEN",
+    "BUZZ_AUTH_TAG",
+    "BUZZ_API_TOKEN",
+    "BUZZ_ACP_PRIVATE_KEY",
+    "BUZZ_ACP_API_TOKEN",
     // Relay URL: overriding would let a malicious config redirect the
     // agent to an attacker-controlled relay.
-    "SPROUT_RELAY_URL",
+    "BUZZ_RELAY_URL",
     // Code-execution surface: overriding would let the user run arbitrary
     // binaries/args as the agent process.
-    "SPROUT_ACP_AGENT_COMMAND",
-    "SPROUT_ACP_AGENT_ARGS",
-    "SPROUT_ACP_MCP_COMMAND",
+    "BUZZ_ACP_AGENT_COMMAND",
+    "BUZZ_ACP_AGENT_ARGS",
+    "BUZZ_ACP_MCP_COMMAND",
     // Security gates: respond-to mode + allowlist + legacy owner-only
     // fallback. Overriding would make the running agent's gate diverge
     // from the saved/UI-visible settings.
-    "SPROUT_ACP_RESPOND_TO",
-    "SPROUT_ACP_RESPOND_TO_ALLOWLIST",
-    "SPROUT_ACP_AGENT_OWNER",
+    "BUZZ_ACP_RESPOND_TO",
+    "BUZZ_ACP_RESPOND_TO_ALLOWLIST",
+    "BUZZ_ACP_AGENT_OWNER",
 ];
 
 pub(crate) fn is_reserved_env_key(key: &str) -> bool {
@@ -109,7 +109,7 @@ pub(crate) fn is_reserved_env_key(key: &str) -> bool {
 /// where `getenv("FOO")` then matches whatever comes after the first
 /// `=`. That means a key like `SPROUT_AUTH_TAG=x` with value `forged`
 /// lands as `SPROUT_AUTH_TAG=x=forged` in the child env and
-/// `getenv("SPROUT_AUTH_TAG")` returns `"x=forged"` — a full reserved-
+/// `getenv("BUZZ_AUTH_TAG")` returns `"x=forged"` — a full reserved-
 /// key bypass. Rejecting non-POSIX keys closes this hole at the
 /// boundary where the input enters the system.
 pub(crate) fn is_well_formed_env_key(key: &str) -> bool {

desktop/src-tauri/src/managed_agents/env_vars/tests.rs

@@ -90,11 +90,11 @@ fn merged_env_strips_reserved_keys_from_persona() {
     // persona data (e.g. older record from before validation existed),
     // it must be stripped before reaching the child process.
     let persona = map(&[
-        ("SPROUT_PRIVATE_KEY", "nsec1evil"),
+        ("BUZZ_PRIVATE_KEY", "nsec1evil"),
         ("ANTHROPIC_API_KEY", "ok"),
     ]);
     let merged = merged_user_env(&persona, &BTreeMap::new());
-    assert!(!merged.contains_key("SPROUT_PRIVATE_KEY"));
+    assert!(!merged.contains_key("BUZZ_PRIVATE_KEY"));
     assert_eq!(
         merged.get("ANTHROPIC_API_KEY").map(String::as_str),
         Some("ok")
@@ -105,22 +105,22 @@ fn merged_env_strips_reserved_keys_from_persona() {
 fn merged_env_strips_reserved_keys_from_agent() {
     let agent = map(&[
         ("NOSTR_PRIVATE_KEY", "nsec1evil"),
-        ("SPROUT_AUTH_TAG", "{}"),
+        ("BUZZ_AUTH_TAG", "{}"),
         ("FOO", "1"),
     ]);
     let merged = merged_user_env(&BTreeMap::new(), &agent);
     assert!(!merged.contains_key("NOSTR_PRIVATE_KEY"));
-    assert!(!merged.contains_key("SPROUT_AUTH_TAG"));
+    assert!(!merged.contains_key("BUZZ_AUTH_TAG"));
     assert_eq!(merged.get("FOO").map(String::as_str), Some("1"));
     assert_eq!(merged.len(), 1);
 }
 
 #[test]
 fn merged_env_strips_reserved_case_insensitive() {
     // Unix env vars are case-sensitive at the syscall level, but we
-    // refuse close-typo variants too — a lowercase `sprout_private_key`
+    // refuse close-typo variants too — a lowercase `buzz_private_key`
     // is almost certainly a footgun, not a legitimate use.
-    let agent = map(&[("sprout_private_key", "x"), ("Sprout_Auth_Tag", "y")]);
+    let agent = map(&[("buzz_private_key", "x"), ("Buzz_Auth_Tag", "y")]);
     let merged = merged_user_env(&BTreeMap::new(), &agent);
     assert!(merged.is_empty());
 }
@@ -132,16 +132,16 @@ fn is_reserved_recognises_full_list() {
     }
     assert!(!is_reserved_env_key("GOOSE_MODE"));
     assert!(!is_reserved_env_key("ANTHROPIC_API_KEY"));
-    assert!(!is_reserved_env_key("SPROUT_ACP_MODEL")); // behavior knob
-    assert!(!is_reserved_env_key("SPROUT_TOOLSETS"));
+    assert!(!is_reserved_env_key("BUZZ_ACP_MODEL")); // behavior knob
+    assert!(!is_reserved_env_key("BUZZ_TOOLSETS"));
 }
 
 #[test]
 fn reserved_keys_include_agent_owner_for_legacy_records() {
-    // Legacy records without auth_tag fall back to SPROUT_ACP_AGENT_OWNER
+    // Legacy records without auth_tag fall back to BUZZ_ACP_AGENT_OWNER
     // to enforce the respond-to gate. Must not be user-overridable.
-    assert!(is_reserved_env_key("SPROUT_ACP_AGENT_OWNER"));
-    let agent = map(&[("SPROUT_ACP_AGENT_OWNER", "imposter")]);
+    assert!(is_reserved_env_key("BUZZ_ACP_AGENT_OWNER"));
+    let agent = map(&[("BUZZ_ACP_AGENT_OWNER", "imposter")]);
     let merged = merged_user_env(&BTreeMap::new(), &agent);
     assert!(merged.is_empty());
 }
@@ -151,7 +151,7 @@ fn reserved_keys_include_respond_to_gate() {
     // Respond-to mode + allowlist control who the agent answers.
     // Overriding via env_vars would let the running agent answer
     // anyone even when the UI/record says owner-only.
-    for key in ["SPROUT_ACP_RESPOND_TO", "SPROUT_ACP_RESPOND_TO_ALLOWLIST"] {
+    for key in ["BUZZ_ACP_RESPOND_TO", "BUZZ_ACP_RESPOND_TO_ALLOWLIST"] {
         assert!(is_reserved_env_key(key), "{key} should be reserved");
         let agent = map(&[(key, "anyone")]);
         let merged = merged_user_env(&BTreeMap::new(), &agent);
@@ -164,9 +164,9 @@ fn reserved_keys_include_code_execution_surface() {
     // The agent/MCP command + args are what Sprout actually exec's.
     // Overriding lets the user run arbitrary code as the agent.
     for key in [
-        "SPROUT_ACP_AGENT_COMMAND",
-        "SPROUT_ACP_AGENT_ARGS",
-        "SPROUT_ACP_MCP_COMMAND",
+        "BUZZ_ACP_AGENT_COMMAND",
+        "BUZZ_ACP_AGENT_ARGS",
+        "BUZZ_ACP_MCP_COMMAND",
     ] {
         assert!(is_reserved_env_key(key), "{key} should be reserved");
     }
@@ -176,8 +176,8 @@ fn reserved_keys_include_code_execution_surface() {
 fn reserved_keys_include_relay_url() {
     // Overriding the relay URL could redirect the agent to an
     // attacker-controlled relay.
-    assert!(is_reserved_env_key("SPROUT_RELAY_URL"));
-    let agent = map(&[("SPROUT_RELAY_URL", "ws://attacker.example")]);
+    assert!(is_reserved_env_key("BUZZ_RELAY_URL"));
+    let agent = map(&[("BUZZ_RELAY_URL", "ws://attacker.example")]);
     let merged = merged_user_env(&BTreeMap::new(), &agent);
     assert!(merged.is_empty());
 }
@@ -192,21 +192,21 @@ fn validate_keys_accepts_normal_env() {
 
 #[test]
 fn validate_keys_rejects_reserved() {
-    let env = map(&[("SPROUT_PRIVATE_KEY", "nsec1evil")]);
+    let env = map(&[("BUZZ_PRIVATE_KEY", "nsec1evil")]);
     let err = validate_user_env_keys(&env).unwrap_err();
-    assert!(err.contains("SPROUT_PRIVATE_KEY"), "got: {err}");
+    assert!(err.contains("BUZZ_PRIVATE_KEY"), "got: {err}");
     assert!(err.contains("reserved"), "got: {err}");
 }
 
 #[test]
 fn validate_keys_lists_all_reserved_keys_found() {
     let env = map(&[
-        ("SPROUT_PRIVATE_KEY", "x"),
+        ("BUZZ_PRIVATE_KEY", "x"),
         ("NOSTR_PRIVATE_KEY", "y"),
         ("ANTHROPIC_API_KEY", "ok"),
     ]);
     let err = validate_user_env_keys(&env).unwrap_err();
-    assert!(err.contains("SPROUT_PRIVATE_KEY"));
+    assert!(err.contains("BUZZ_PRIVATE_KEY"));
     assert!(err.contains("NOSTR_PRIVATE_KEY"));
 }
 
@@ -228,8 +228,8 @@ fn validate_keys_accepts_empty_map() {
 // Rust's `Command::env(k, v)` will accept a key containing `=` and
 // pass it straight into the child's environ block, where
 // `getenv("PREFIX")` matches anything after the first `=`. Concretely:
-// `c.env("SPROUT_AUTH_TAG=x", "forged")` results in the child seeing
-// `SPROUT_AUTH_TAG=x=forged` and `getenv("SPROUT_AUTH_TAG") == "x=forged"`.
+// `c.env("BUZZ_AUTH_TAG=x", "forged")` results in the child seeing
+// `BUZZ_AUTH_TAG=x=forged` and `getenv("BUZZ_AUTH_TAG") == "x=forged"`.
 // That bypasses our reserved-key check, which compares strings.
 // These tests pin the fix at the validator boundary.
 
@@ -250,35 +250,35 @@ fn is_well_formed_accepts_posix_keys() {
 #[test]
 fn is_well_formed_rejects_malformed_keys() {
     for key in [
-        "",                    // empty
-        "=",                   // bare equals
-        "SPROUT_AUTH_TAG=x",   // =-in-key bypass
-        "SPROUT_PRIVATE_KEY=", // trailing equals
-        "FOO BAR",             // space
-        " FOO",                // leading whitespace
-        "FOO\nBAR",            // newline
-        "FOO\0BAR",            // NUL
-        "123_LEADING_DIGIT",   // POSIX forbids leading digit
-        "FOO-BAR",             // hyphen
-        "FOO.BAR",             // dot
-        "FOO/BAR",             // slash
-        "ünicode_key",         // non-ASCII
+        "",                  // empty
+        "=",                 // bare equals
+        "BUZZ_AUTH_TAG=x",   // =-in-key bypass
+        "BUZZ_PRIVATE_KEY=", // trailing equals
+        "FOO BAR",           // space
+        " FOO",              // leading whitespace
+        "FOO\nBAR",          // newline
+        "FOO\0BAR",          // NUL
+        "123_LEADING_DIGIT", // POSIX forbids leading digit
+        "FOO-BAR",           // hyphen
+        "FOO.BAR",           // dot
+        "FOO/BAR",           // slash
+        "ünicode_key",       // non-ASCII
     ] {
         assert!(!is_well_formed_env_key(key), "{key:?} should be malformed");
     }
 }
 
 #[test]
 fn validate_keys_rejects_equals_in_key_bypass() {
-    // The actual exploit: `SPROUT_AUTH_TAG=x` smuggles a value past
+    // The actual exploit: `BUZZ_AUTH_TAG=x` smuggles a value past
     // the reserved-key string compare and into the child's environ.
-    let env = map(&[("SPROUT_AUTH_TAG=x", "forged")]);
+    let env = map(&[("BUZZ_AUTH_TAG=x", "forged")]);
     let err = validate_user_env_keys(&env).unwrap_err();
     assert!(err.contains("[A-Za-z_]"), "got: {err}");
     // After P2 fix the key is truncated at `=` in the error to avoid
     // surfacing pasted secrets — only the prefix should appear, with an
     // ellipsis marking that we elided trailing content.
-    assert!(err.contains("SPROUT_AUTH_TAG"), "got: {err}");
+    assert!(err.contains("BUZZ_AUTH_TAG"), "got: {err}");
     assert!(err.contains('…'), "expected ellipsis marker: {err}");
     assert!(!err.contains("=x"), "leak of value past `=`: {err}");
 }
@@ -296,7 +296,7 @@ fn validate_keys_reports_malformed_before_reserved() {
     // the way that other key is reserved" — they've got a typo to fix
     // first. Ordering is a UX detail but pinning it stops the message
     // from churning.
-    let env = map(&[("SPROUT_AUTH_TAG=x", "v"), ("SPROUT_PRIVATE_KEY", "v")]);
+    let env = map(&[("BUZZ_AUTH_TAG=x", "v"), ("BUZZ_PRIVATE_KEY", "v")]);
     let err = validate_user_env_keys(&env).unwrap_err();
     assert!(err.contains("[A-Za-z_]"), "got: {err}");
     assert!(!err.contains("reserved"), "got: {err}");
@@ -307,12 +307,12 @@ fn merged_env_drops_malformed_keys() {
     // Defense in depth: on-disk records written before the validator
     // tightened must not be able to smuggle reserved keys through.
     let agent = map(&[
-        ("SPROUT_AUTH_TAG=x", "forged"),
+        ("BUZZ_AUTH_TAG=x", "forged"),
         ("FOO=bar", "v"),
         ("LEGIT", "ok"),
     ]);
     let merged = merged_user_env(&BTreeMap::new(), &agent);
-    assert!(!merged.contains_key("SPROUT_AUTH_TAG=x"));
+    assert!(!merged.contains_key("BUZZ_AUTH_TAG=x"));
     assert!(!merged.contains_key("FOO=bar"));
     assert_eq!(merged.get("LEGIT").map(String::as_str), Some("ok"));
     assert_eq!(merged.len(), 1);
@@ -420,7 +420,7 @@ fn merged_env_drops_oversize_value() {
 // ── derived provider/model key filter ──────────────────────────────
 //
 // Pack import must strip derived env keys (GOOSE_MODEL, GOOSE_PROVIDER,
-// SPROUT_AGENT_MODEL, SPROUT_AGENT_PROVIDER) so they don't shadow the
+// BUZZ_AGENT_MODEL, BUZZ_AGENT_PROVIDER) so they don't shadow the
 // structured PersonaRecord.model / PersonaRecord.provider fields after
 // the user edits them in the UI.
 
@@ -438,16 +438,16 @@ fn is_derived_key_matches_all_known_keys() {
 fn is_derived_key_is_case_insensitive() {
     assert!(is_derived_provider_model_key("goose_model"));
     assert!(is_derived_provider_model_key("Goose_Provider"));
-    assert!(is_derived_provider_model_key("sprout_agent_model"));
-    assert!(is_derived_provider_model_key("SPROUT_AGENT_PROVIDER"));
+    assert!(is_derived_provider_model_key("buzz_agent_model"));
+    assert!(is_derived_provider_model_key("BUZZ_AGENT_PROVIDER"));
 }
 
 #[test]
 fn is_derived_key_does_not_match_unrelated_keys() {
     assert!(!is_derived_provider_model_key("GOOSE_TEMPERATURE"));
     assert!(!is_derived_provider_model_key("GOOSE_CONTEXT_LIMIT"));
     assert!(!is_derived_provider_model_key("ANTHROPIC_API_KEY"));
-    assert!(!is_derived_provider_model_key("SPROUT_PRIVATE_KEY"));
+    assert!(!is_derived_provider_model_key("BUZZ_PRIVATE_KEY"));
     assert!(!is_derived_provider_model_key("MODEL"));
     assert!(!is_derived_provider_model_key("PROVIDER"));
 }
@@ -460,8 +460,8 @@ fn filter_derived_strips_provider_model_keys_preserves_rest() {
             "claude-sonnet-4-20250514".to_string(),
         ),
         ("GOOSE_PROVIDER".to_string(), "anthropic".to_string()),
-        ("SPROUT_AGENT_MODEL".to_string(), "gpt-4o".to_string()),
-        ("SPROUT_AGENT_PROVIDER".to_string(), "openai".to_string()),
+        ("BUZZ_AGENT_MODEL".to_string(), "gpt-4o".to_string()),
+        ("BUZZ_AGENT_PROVIDER".to_string(), "openai".to_string()),
         ("GOOSE_TEMPERATURE".to_string(), "0.7".to_string()),
         ("ANTHROPIC_API_KEY".to_string(), "sk-test".to_string()),
     ];