fix(desktop): bound the device stamp to local agents and validate every label

Review follow-up. Four issues, all confirmed against the code first.

**A provider-backed agent was given the wrong location.**
`agent_event_content` stamped the current device onto every record without
consulting `record.backend`. A `Provider` body runs elsewhere -- deployed to a
cluster from a laptop -- and stays online after that laptop sleeps, so the
mention UI told the user "only that device can reply" about a machine that is
not where the agent runs. The stamp is now gated on `BackendKind::Local`.

That alone closes the false guidance: `describeUnrunnableMention` already
returns `null` when no `device_id` is published, so such an agent now produces
no notice at all rather than a corrected one.

Distinguishing key *custody* from *execution* is a protocol change, not a second
stamp, and is left as a named future-work note.

**The label contract was bypassed on stored and inbound data.**
Validation ran only when a label was typed. Three holes:

- `load_or_create_at` returned whatever deserialized. A hand-edited
  `device.json` was published unchecked. It now validates the whole identity --
  id shape and label -- and an invalid file takes the path a corrupt one
  already did: preserved as `device.json.corrupt`, replaced, never failing the
  caller.
- The inbound kind:30177 projection forwarded `device_id`/`device_label`
  verbatim. Owner authentication proves authorship, not well-formedness; a
  sibling device on an older or tampered build can sign anything. Each field is
  now validated independently and degrades to `None`, so a bad label never
  hides an otherwise reachable agent.
- `char::is_control` is category `Cc` only, so zero-width (U+200B) and bidi
  overrides (U+202E) passed through. Rather than a second rule, the label now
  goes through `validate_device_label`, reusing the visible-text policy that
  already guards agent definition text -- whose own doc comment asks for
  validation "at every local, inbound, and publication boundary".

An over-long label is now refused rather than truncated: publishing something
other than what the owner typed is the worse failure.

**Rename claimed more than it did.** It reconciles only the active retention
scope. Republishing every scope needs owner keys for communities that are not
applied -- identity handling, not this command -- so the contract is now stated
truthfully instead: immediate for the active community, eventual elsewhere via
`run_event_sync` on activation.

**The OS host name could be published before the owner saw the warning.**
First-run labels are now opaque (`device-<8 hex>`) and `mint_identity` no longer
reads the host name. It is offered as an explicit opt-in in the settings card
via `get_device_name_suggestion`, so nothing derived from it reaches a relay
until the owner applies it.

The new tests share a process-global cache, so the seam is an RAII guard holding
a mutex and restoring on drop -- deliberately not repeating the pattern that
makes `claude_spawn_uses_the_probed_cli_executable` flaky.

Signed-off-by: Michael Feth <michael@jira-flow.com>

Author: Michael Feth

desktop/src-tauri/src/device_identity.rs

@@ -784,6 +784,7 @@ pub fn run() {
             set_global_agent_config,
             device_identity::get_device_identity,
             device_identity::set_device_label,
+            device_identity::get_device_name_suggestion,
             mesh_start_node,
             mesh_stop_node,
             mesh_node_status,

desktop/src-tauri/src/lib.rs

@@ -92,7 +92,23 @@ pub fn agent_event_content(record: &ManagedAgentRecord) -> ManagedAgentEventCont
     // Device fields describe the INSTANCE (which install holds its secret),
     // never the definition, so they are emitted regardless of slimming.
     // `None` before the Tauri setup hook runs — unit tests publish no stamp.
-    let device = crate::device_identity::current();
+    //
+    // Only a LOCAL backend is device-bound. A `Provider` backend's body runs
+    // elsewhere — deployed to Kubernetes from a laptop, say — and stays online
+    // after this install sleeps, so stamping it with this Desktop would make
+    // the mention UI claim "only that device can reply" about a machine that is
+    // not where the agent runs. Such a record publishes no device at all and
+    // degrades to the same "no device information" rendering as a pre-Stage-0
+    // peer.
+    //
+    // Future work (out of scope for Stage 0): a provider-backed agent still has
+    // a *custody* device — the install holding its secret — which is a
+    // different coordinate from its *execution* location. Distinguishing the
+    // two needs a protocol change, not a second stamp here.
+    let device = match record.backend {
+        super::BackendKind::Local => crate::device_identity::current(),
+        super::BackendKind::Provider { .. } => None,
+    };
     ManagedAgentEventContent {
         name: record.name.clone(),
         persona_id: record.persona_id.clone(),
@@ -480,6 +496,9 @@ mod tests {
     /// device fields existed. This is why no other test in the crate changed.
     #[test]
     fn projection_omits_device_fields_without_a_device_identity() {
+        // Takes the guard (with `None`) purely to serialize against the tests
+        // below that seed a device — `CURRENT` is process-global.
+        let _guard = crate::device_identity::DeviceGuard::set(None);
         assert!(
             crate::device_identity::current().is_none(),
             "unit tests must never boot the device identity"
@@ -495,6 +514,54 @@ mod tests {
         assert!(!json.contains("device_label"), "{json}");
     }
 
+    /// A local-backend agent's secret lives on this install, so it is the one
+    /// case where naming this computer is true.
+    #[test]
+    fn projection_stamps_the_device_for_a_local_backend() {
+        use crate::device_identity::DeviceGuard;
+        let device = DeviceGuard::sample();
+        let _guard = DeviceGuard::set(Some(device.clone()));
+
+        let mut record = sample_agent();
+        record.backend = super::super::BackendKind::Local;
+
+        let content = agent_event_content(&record);
+        assert_eq!(
+            content.device_id.as_deref(),
+            Some(device.device_id.as_str())
+        );
+        assert_eq!(
+            content.device_label.as_deref(),
+            Some(device.device_label.as_str())
+        );
+    }
+
+    /// A provider-backed agent's body runs elsewhere and outlives this install,
+    /// so stamping it here would make the mention UI claim "only that device can
+    /// reply" about a machine that is not where the agent runs.
+    #[test]
+    fn projection_omits_the_device_for_a_provider_backend() {
+        use crate::device_identity::DeviceGuard;
+        let _guard = DeviceGuard::set(Some(DeviceGuard::sample()));
+
+        let mut record = sample_agent();
+        record.backend = super::super::BackendKind::Provider {
+            id: "buzz-backend-x".to_string(),
+            config: serde_json::json!({ "cluster": "staging" }),
+        };
+
+        let content = agent_event_content(&record);
+        assert_eq!(
+            content.device_id, None,
+            "a remote body must not be given this computer's id"
+        );
+        assert_eq!(content.device_label, None);
+
+        let json = serde_json::to_string(&content).unwrap();
+        assert!(!json.contains("deviceId"), "{json}");
+        assert!(!json.contains("deviceLabel"), "{json}");
+    }
+
     /// Mixed-fleet back-compat: a 30177 event published by a build that predates
     /// device identity parses cleanly, with both fields absent rather than an
     /// invented value.

desktop/src-tauri/src/managed_agents/agent_events.rs

@@ -60,6 +60,32 @@ pub(crate) fn validate_managed_agent_definition_text(
     validate_agent_definition_text(name, executable_prompt)
 }
 
+/// Maximum length of a device label, in `char`s.
+pub(crate) const MAX_DEVICE_LABEL_CHARS: usize = 32;
+
+/// Validate a device label against the same visible-text policy as agent
+/// definition text.
+///
+/// A device label names the computer an agent lives on and is published in a
+/// world-readable kind:30177 event, then rendered beside an agent's name in
+/// other people's clients. That makes it the same class of input as a display
+/// name: `char::is_control` alone would pass zero-width characters (U+200B) and
+/// bidi overrides (U+202E), which are Unicode category `Cf` and can visually
+/// reorder the text around them.
+pub(crate) fn validate_device_label(label: &str) -> Result<(), String> {
+    let trimmed = label.trim();
+    if trimmed.is_empty() {
+        return Err("Device name must not be empty".to_string());
+    }
+    let count = trimmed.chars().count();
+    if count > MAX_DEVICE_LABEL_CHARS {
+        return Err(format!(
+            "Device name is too long ({count} characters, max {MAX_DEVICE_LABEL_CHARS})"
+        ));
+    }
+    validate_visible_text(trimmed, "Device name", false)
+}
+
 fn validate_visible_text(
     value: &str,
     label: &str,

desktop/src-tauri/src/managed_agents/definition_validation.rs

@@ -11,7 +11,9 @@ pub(crate) use agent_env::{
 mod backend;
 pub(crate) mod config_bridge;
 pub(crate) mod custom_harnesses;
-mod definition_validation;
+// `pub(crate)` so the device-identity and inbound-directory paths can reuse the
+// one visible-text policy instead of growing a second, drifting copy.
+pub(crate) mod definition_validation;
 mod discovery;
 pub(crate) mod effective_config;
 mod env_vars;

desktop/src-tauri/src/managed_agents/mod.rs

@@ -4,6 +4,8 @@ use std::collections::{BTreeSet, HashMap};
 
 use nostr::Event;
 
+use crate::device_identity::validate_device_id;
+use crate::managed_agents::definition_validation::validate_device_label;
 use crate::managed_agents::{agent_events::managed_agent_content_from_event, RelayAgentInfo};
 
 use super::{agents_from_events, first_tag_value, profile_valid_oa_owner_pubkey, tags_named};
@@ -138,8 +140,22 @@ fn relay_agent_from_managed_policy(agent_pubkey: &str, event: &Event) -> Option<
         status: "offline".to_string(),
         respond_to: Some(content.respond_to),
         respond_to_allowlist: content.respond_to_allowlist,
-        device_id: content.device_id,
-        device_label: content.device_label,
+        // Owner authentication proves *who wrote this*, not that what they
+        // wrote is well-formed. A sibling device running an older, buggy, or
+        // tampered-with build can publish any string here, and these two values
+        // are rendered verbatim beside an agent's name — so they are validated
+        // like any other untrusted input before they reach the UI.
+        //
+        // A value that fails degrades to `None` on its own. Dropping the whole
+        // directory entry over a bad label would hide a real, reachable agent;
+        // dropping just the label falls back to the same "no device
+        // information" rendering as a peer that predates Stage 0.
+        device_id: content
+            .device_id
+            .filter(|id| validate_device_id(id).is_ok()),
+        device_label: content
+            .device_label
+            .filter(|label| validate_device_label(label).is_ok()),
     })
 }
 

desktop/src-tauri/src/nostr_convert/agent_directory.rs

@@ -496,6 +496,73 @@ fn managed_agent_directory_surfaces_the_owner_verified_device_label() {
     assert_eq!(agents[0].device_label, None);
 }
 
+/// Owner authentication proves authorship, not well-formedness: a sibling
+/// device on an older, buggy, or tampered build can sign anything. A bad value
+/// must degrade to `None` on its own without hiding a real, reachable agent.
+#[test]
+fn managed_agent_directory_drops_invalid_device_metadata_but_keeps_the_agent() {
+    let agent_keys = Keys::generate();
+    let owner_keys = Keys::generate();
+    let agent_pubkey = agent_keys.public_key().to_hex();
+
+    let auth_tag_json =
+        buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_keys.public_key(), "")
+            .expect("compute auth tag");
+    let auth_tag_values: Vec<String> =
+        serde_json::from_str(&auth_tag_json).expect("parse auth tag json");
+    let profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Bumble"}"#)
+        .tags([Tag::parse(auth_tag_values).expect("parse auth tag")])
+        .sign_with_keys(&agent_keys)
+        .expect("sign profile");
+
+    // A bidi override in the label and a malformed id, both correctly signed.
+    let hostile = EventBuilder::new(
+        Kind::Custom(30177),
+        serde_json::json!({
+            "name": "Bumble",
+            "parallelism": 1,
+            "respond_to": "anyone",
+            "device_id": "not-a-uuid",
+            "device_label": "mfeth\u{202E}win",
+        })
+        .to_string(),
+    )
+    .tags([Tag::parse(["d", agent_pubkey.as_str()]).expect("parse d tag")])
+    .sign_with_keys(&owner_keys)
+    .expect("sign managed-agent event");
+
+    let agents = relay_agents_from_managed_agent_events(&[hostile], std::slice::from_ref(&profile));
+    assert_eq!(agents.len(), 1, "the agent itself must still be reachable");
+    assert_eq!(agents[0].name, "Bumble");
+    assert_eq!(agents[0].device_id, None, "malformed id dropped");
+    assert_eq!(agents[0].device_label, None, "bidi-bearing label dropped");
+
+    // An over-long label is refused by the same policy.
+    let long = EventBuilder::new(
+        Kind::Custom(30177),
+        serde_json::json!({
+            "name": "Bumble",
+            "parallelism": 1,
+            "respond_to": "anyone",
+            "device_id": "0123456789abcdef0123456789abcdef",
+            "device_label": "a".repeat(33),
+        })
+        .to_string(),
+    )
+    .tags([Tag::parse(["d", agent_pubkey.as_str()]).expect("parse d tag")])
+    .sign_with_keys(&owner_keys)
+    .expect("sign managed-agent event");
+
+    let agents = relay_agents_from_managed_agent_events(&[long], std::slice::from_ref(&profile));
+    assert_eq!(agents.len(), 1);
+    assert_eq!(
+        agents[0].device_id.as_deref(),
+        Some("0123456789abcdef0123456789abcdef"),
+        "a valid id survives its label being dropped"
+    );
+    assert_eq!(agents[0].device_label, None);
+}
+
 #[test]
 fn managed_agent_directory_rejects_agents_without_verified_owner_profiles() {
     let owner_keys = Keys::generate();

desktop/src-tauri/src/nostr_convert/tests.rs

@@ -6,7 +6,10 @@ import {
   deviceIdentityQueryKey,
   useDeviceIdentityQuery,
 } from "@/features/agents/hooks";
-import { setDeviceLabel } from "@/shared/api/tauriDeviceIdentity";
+import {
+  getDeviceNameSuggestion,
+  setDeviceLabel,
+} from "@/shared/api/tauriDeviceIdentity";
 import { Button } from "@/shared/ui/button";
 import { Input } from "@/shared/ui/input";
 import { SettingsOptionGroup, SettingsOptionRow } from "./SettingsOptionGroup";
@@ -51,7 +54,33 @@ export function DeviceNameSettingsCard() {
     },
   });
 
+  // The OS host name is only ever *offered*. A device's name starts opaque
+  // (`device-xxxxxxxx`) precisely because host names routinely carry a real
+  // person's name and this label is published world-readable — so the owner
+  // opts in here, seeing the warning above before anything leaves the machine.
+  const [suggestion, setSuggestion] = React.useState<string | null>(null);
+  React.useEffect(() => {
+    let cancelled = false;
+    void getDeviceNameSuggestion()
+      .then((value) => {
+        if (!cancelled) {
+          setSuggestion(value);
+        }
+      })
+      .catch(() => {
+        // Advisory only — a device with no usable host name simply gets no
+        // suggestion, which is not worth surfacing as an error.
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
   const trimmedLabel = draftLabel.trim();
+  const showSuggestion =
+    suggestion !== null &&
+    suggestion !== savedLabel &&
+    suggestion !== trimmedLabel;
   const saveDisabled =
     trimmedLabel.length === 0 ||
     trimmedLabel === savedLabel ||
@@ -74,6 +103,19 @@ export function DeviceNameSettingsCard() {
               other devices. Published with your agents, so avoid personal
               details.
             </p>
+            {showSuggestion ? (
+              <button
+                className="mt-1 text-xs text-muted-foreground underline underline-offset-2 hover:text-foreground"
+                data-testid="device-name-use-hostname"
+                onClick={() => {
+                  setEditedLabel(true);
+                  setDraftLabel(suggestion);
+                }}
+                type="button"
+              >
+                Use this computer's name ({suggestion})
+              </button>
+            ) : null}
           </div>
           <div className="flex shrink-0 items-center gap-2">
             <Input

desktop/src/features/settings/ui/DeviceNameSettingsCard.tsx

@@ -9,10 +9,24 @@ export async function getDeviceIdentity(): Promise<DeviceIdentity> {
 /**
  * Rename this device.
  *
- * The backend trims, rejects control characters, caps the label at 32
- * characters, and republishes the label on every local agent's kind:30177
- * event, so callers need no follow-up write.
+ * The backend trims and rejects an empty, over-long (>32 char), or
+ * invisible-character-bearing label — including the zero-width and bidi
+ * codepoints `char::is_control` misses — then republishes the label on the
+ * active community's local agents, so callers need no follow-up write. The
+ * owner's other communities pick it up when next activated.
  */
 export async function setDeviceLabel(label: string): Promise<DeviceIdentity> {
   return invokeTauri<DeviceIdentity>("set_device_label", { label });
 }
+
+/**
+ * The OS host name, offered as a suggested device name.
+ *
+ * `null` when the host name is unusable under the label policy. This is only a
+ * suggestion: a device's name starts opaque (`device-xxxxxxxx`) and the host
+ * name — which routinely contains a real person's name — is never published
+ * until the owner applies it.
+ */
+export async function getDeviceNameSuggestion(): Promise<string | null> {
+  return invokeTauri<string | null>("get_device_name_suggestion");
+}

desktop/src/shared/api/tauriDeviceIdentity.ts

@@ -3345,6 +3345,9 @@ const DEFAULT_MOCK_DEVICE_IDENTITY = {
   createdAt: "2026-01-01T00:00:00Z",
 };
 let mockDeviceIdentity = { ...DEFAULT_MOCK_DEVICE_IDENTITY };
+// Stands in for the OS host name the settings card offers as an opt-in. Kept
+// distinct from MOCK_DEVICE_LABEL so a test can tell "suggested" from "applied".
+const MOCK_HOSTNAME_SUGGESTION = "marys-macbook";
 
 const defaultMockRelayAgents: RawRelayAgent[] = [
   {
@@ -12285,6 +12288,8 @@ export function maybeInstallE2eTauriMocks() {
       }
       case "get_device_identity":
         return { ...mockDeviceIdentity };
+      case "get_device_name_suggestion":
+        return MOCK_HOSTNAME_SUGGESTION;
       case "set_device_label": {
         const label = (payload as { label?: unknown } | undefined)?.label;
         if (typeof label === "string" && label.trim().length > 0) {