fix(desktop): bound the device stamp to local agents and validate every label

Review follow-up. Four issues, all confirmed against the code first.

**A provider-backed agent was given the wrong location.**
`agent_event_content` stamped the current device onto every record without
consulting `record.backend`. A `Provider` body runs elsewhere -- deployed to a
cluster from a laptop -- and stays online after that laptop sleeps, so the
mention UI told the user "only that device can reply" about a machine that is
not where the agent runs. The stamp is now gated on `BackendKind::Local`.

That alone closes the false guidance: `describeUnrunnableMention` already
returns `null` when no `device_id` is published, so such an agent now produces
no notice at all rather than a corrected one.

Distinguishing key *custody* from *execution* is a protocol change, not a second
stamp, and is left as a named future-work note.

**The label contract was bypassed on stored and inbound data.**
Validation ran only when a label was typed. Three holes:

- `load_or_create_at` returned whatever deserialized. A hand-edited
  `device.json` was published unchecked. It now validates the whole identity --
  id shape and label -- and an invalid file takes the path a corrupt one
  already did: preserved as `device.json.corrupt`, replaced, never failing the
  caller.
- The inbound kind:30177 projection forwarded `device_id`/`device_label`
  verbatim. Owner authentication proves authorship, not well-formedness; a
  sibling device on an older or tampered build can sign anything. Each field is
  now validated independently and degrades to `None`, so a bad label never
  hides an otherwise reachable agent.
- `char::is_control` is category `Cc` only, so zero-width (U+200B) and bidi
  overrides (U+202E) passed through. Rather than a second rule, the label now
  goes through `validate_device_label`, reusing the visible-text policy that
  already guards agent definition text -- whose own doc comment asks for
  validation "at every local, inbound, and publication boundary".

An over-long label is now refused rather than truncated: publishing something
other than what the owner typed is the worse failure.

**Rename claimed more than it did.** It reconciles only the active retention
scope. Republishing every scope needs owner keys for communities that are not
applied -- identity handling, not this command -- so the contract is now stated
truthfully instead: immediate for the active community, eventual elsewhere via
`run_event_sync` on activation.

**The OS host name could be published before the owner saw the warning.**
First-run labels are now opaque (`device-<8 hex>`) and `mint_identity` no longer
reads the host name. It is offered as an explicit opt-in in the settings card
via `get_device_name_suggestion`, so nothing derived from it reaches a relay
until the owner applies it.

The new tests share a process-global cache, so the seam is an RAII guard holding
a mutex and restoring on drop -- deliberately not repeating the pattern that
makes `claude_spawn_uses_the_probed_cli_executable` flaky.

Signed-off-by: Michael Feth <michael@jira-flow.com>

Author: Michael Feth

desktop/src-tauri/src/commands/agent_discovery/relay_directory.rs

@@ -261,6 +261,8 @@ mod tests {
                 status: "offline".to_string(),
                 respond_to: None,
                 respond_to_allowlist: Vec::new(),
+                device_id: None,
+                device_label: None,
             },
             RelayAgentInfo {
                 pubkey: "c".repeat(64),
@@ -273,6 +275,8 @@ mod tests {
                 status: "online".to_string(),
                 respond_to: None,
                 respond_to_allowlist: Vec::new(),
+                device_id: None,
+                device_label: None,
             },
         ];
 
@@ -299,6 +303,8 @@ mod tests {
             status: "online".to_string(),
             respond_to: None,
             respond_to_allowlist: Vec::new(),
+            device_id: None,
+            device_label: None,
         }];
 
         retain_agents_allowed_by_build(&mut agents, false);

desktop/src-tauri/src/device_identity.rs

@@ -713,6 +713,7 @@ pub fn run() {
             set_global_agent_config,
             device_identity::get_device_identity,
             device_identity::set_device_label,
+            device_identity::get_device_name_suggestion,
             mesh_start_node,
             mesh_stop_node,
             mesh_node_status,

desktop/src-tauri/src/lib.rs

@@ -92,7 +92,23 @@ pub fn agent_event_content(record: &ManagedAgentRecord) -> ManagedAgentEventCont
     // Device fields describe the INSTANCE (which install holds its secret),
     // never the definition, so they are emitted regardless of slimming.
     // `None` before the Tauri setup hook runs — unit tests publish no stamp.
-    let device = crate::device_identity::current();
+    //
+    // Only a LOCAL backend is device-bound. A `Provider` backend's body runs
+    // elsewhere — deployed to Kubernetes from a laptop, say — and stays online
+    // after this install sleeps, so stamping it with this Desktop would make
+    // the mention UI claim "only that device can reply" about a machine that is
+    // not where the agent runs. Such a record publishes no device at all and
+    // degrades to the same "no device information" rendering as a pre-Stage-0
+    // peer.
+    //
+    // Future work (out of scope for Stage 0): a provider-backed agent still has
+    // a *custody* device — the install holding its secret — which is a
+    // different coordinate from its *execution* location. Distinguishing the
+    // two needs a protocol change, not a second stamp here.
+    let device = match record.backend {
+        super::BackendKind::Local => crate::device_identity::current(),
+        super::BackendKind::Provider { .. } => None,
+    };
     ManagedAgentEventContent {
         name: record.name.clone(),
         persona_id: record.persona_id.clone(),
@@ -483,6 +499,9 @@ mod tests {
     /// device fields existed. This is why no other test in the crate changed.
     #[test]
     fn projection_omits_device_fields_without_a_device_identity() {
+        // Takes the guard (with `None`) purely to serialize against the tests
+        // below that seed a device — `CURRENT` is process-global.
+        let _guard = crate::device_identity::DeviceGuard::set(None);
         assert!(
             crate::device_identity::current().is_none(),
             "unit tests must never boot the device identity"
@@ -498,6 +517,54 @@ mod tests {
         assert!(!json.contains("device_label"), "{json}");
     }
 
+    /// A local-backend agent's secret lives on this install, so it is the one
+    /// case where naming this computer is true.
+    #[test]
+    fn projection_stamps_the_device_for_a_local_backend() {
+        use crate::device_identity::DeviceGuard;
+        let device = DeviceGuard::sample();
+        let _guard = DeviceGuard::set(Some(device.clone()));
+
+        let mut record = sample_agent();
+        record.backend = super::super::BackendKind::Local;
+
+        let content = agent_event_content(&record);
+        assert_eq!(
+            content.device_id.as_deref(),
+            Some(device.device_id.as_str())
+        );
+        assert_eq!(
+            content.device_label.as_deref(),
+            Some(device.device_label.as_str())
+        );
+    }
+
+    /// A provider-backed agent's body runs elsewhere and outlives this install,
+    /// so stamping it here would make the mention UI claim "only that device can
+    /// reply" about a machine that is not where the agent runs.
+    #[test]
+    fn projection_omits_the_device_for_a_provider_backend() {
+        use crate::device_identity::DeviceGuard;
+        let _guard = DeviceGuard::set(Some(DeviceGuard::sample()));
+
+        let mut record = sample_agent();
+        record.backend = super::super::BackendKind::Provider {
+            id: "buzz-backend-x".to_string(),
+            config: serde_json::json!({ "cluster": "staging" }),
+        };
+
+        let content = agent_event_content(&record);
+        assert_eq!(
+            content.device_id, None,
+            "a remote body must not be given this computer's id"
+        );
+        assert_eq!(content.device_label, None);
+
+        let json = serde_json::to_string(&content).unwrap();
+        assert!(!json.contains("deviceId"), "{json}");
+        assert!(!json.contains("deviceLabel"), "{json}");
+    }
+
     /// Mixed-fleet back-compat: a 30177 event published by a build that predates
     /// device identity parses cleanly, with both fields absent rather than an
     /// invented value.

desktop/src-tauri/src/managed_agents/agent_events.rs

@@ -79,6 +79,32 @@ pub(crate) fn validate_managed_agent_definition_text(
     validate_agent_definition_text(name, executable_prompt)
 }
 
+/// Maximum length of a device label, in `char`s.
+pub(crate) const MAX_DEVICE_LABEL_CHARS: usize = 32;
+
+/// Validate a device label against the same visible-text policy as agent
+/// definition text.
+///
+/// A device label names the computer an agent lives on and is published in a
+/// world-readable kind:30177 event, then rendered beside an agent's name in
+/// other people's clients. That makes it the same class of input as a display
+/// name: `char::is_control` alone would pass zero-width characters (U+200B) and
+/// bidi overrides (U+202E), which are Unicode category `Cf` and can visually
+/// reorder the text around them.
+pub(crate) fn validate_device_label(label: &str) -> Result<(), String> {
+    let trimmed = label.trim();
+    if trimmed.is_empty() {
+        return Err("Device name must not be empty".to_string());
+    }
+    let count = trimmed.chars().count();
+    if count > MAX_DEVICE_LABEL_CHARS {
+        return Err(format!(
+            "Device name is too long ({count} characters, max {MAX_DEVICE_LABEL_CHARS})"
+        ));
+    }
+    validate_visible_text(trimmed, "Device name", false)
+}
+
 /// Reject control and default-ignorable characters in human-reviewed text.
 ///
 /// The shared executable-definition invariant: a recipient reviews a visible

desktop/src-tauri/src/managed_agents/definition_validation.rs

@@ -14,7 +14,9 @@ mod backend;
 pub(crate) mod claude_config;
 pub(crate) mod config_bridge;
 pub(crate) mod custom_harnesses;
-mod definition_validation;
+// `pub(crate)` so the device-identity and inbound-directory paths can reuse the
+// one visible-text policy instead of growing a second, drifting copy.
+pub(crate) mod definition_validation;
 mod discovery;
 pub(crate) mod effective_config;
 mod env_vars;

desktop/src-tauri/src/managed_agents/mod.rs

@@ -4,6 +4,8 @@ use std::collections::{BTreeSet, HashMap};
 
 use nostr::Event;
 
+use crate::device_identity::validate_device_id;
+use crate::managed_agents::definition_validation::validate_device_label;
 use crate::managed_agents::{agent_events::managed_agent_content_from_event, RelayAgentInfo};
 
 use super::{agents_from_events, first_tag_value, profile_valid_oa_owner_pubkey, tags_named};
@@ -138,8 +140,22 @@ fn relay_agent_from_managed_policy(agent_pubkey: &str, event: &Event) -> Option<
         status: "offline".to_string(),
         respond_to: Some(content.respond_to),
         respond_to_allowlist: content.respond_to_allowlist,
-        device_id: content.device_id,
-        device_label: content.device_label,
+        // Owner authentication proves *who wrote this*, not that what they
+        // wrote is well-formed. A sibling device running an older, buggy, or
+        // tampered-with build can publish any string here, and these two values
+        // are rendered verbatim beside an agent's name — so they are validated
+        // like any other untrusted input before they reach the UI.
+        //
+        // A value that fails degrades to `None` on its own. Dropping the whole
+        // directory entry over a bad label would hide a real, reachable agent;
+        // dropping just the label falls back to the same "no device
+        // information" rendering as a peer that predates Stage 0.
+        device_id: content
+            .device_id
+            .filter(|id| validate_device_id(id).is_ok()),
+        device_label: content
+            .device_label
+            .filter(|label| validate_device_label(label).is_ok()),
     })
 }
 

desktop/src-tauri/src/nostr_convert/agent_directory.rs

@@ -496,6 +496,73 @@ fn managed_agent_directory_surfaces_the_owner_verified_device_label() {
     assert_eq!(agents[0].device_label, None);
 }
 
+/// Owner authentication proves authorship, not well-formedness: a sibling
+/// device on an older, buggy, or tampered build can sign anything. A bad value
+/// must degrade to `None` on its own without hiding a real, reachable agent.
+#[test]
+fn managed_agent_directory_drops_invalid_device_metadata_but_keeps_the_agent() {
+    let agent_keys = Keys::generate();
+    let owner_keys = Keys::generate();
+    let agent_pubkey = agent_keys.public_key().to_hex();
+
+    let auth_tag_json =
+        buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_keys, &agent_keys.public_key(), "")
+            .expect("compute auth tag");
+    let auth_tag_values: Vec<String> =
+        serde_json::from_str(&auth_tag_json).expect("parse auth tag json");
+    let profile = EventBuilder::new(Kind::Metadata, r#"{"display_name":"Bumble"}"#)
+        .tags([Tag::parse(auth_tag_values).expect("parse auth tag")])
+        .sign_with_keys(&agent_keys)
+        .expect("sign profile");
+
+    // A bidi override in the label and a malformed id, both correctly signed.
+    let hostile = EventBuilder::new(
+        Kind::Custom(30177),
+        serde_json::json!({
+            "name": "Bumble",
+            "parallelism": 1,
+            "respond_to": "anyone",
+            "device_id": "not-a-uuid",
+            "device_label": "mfeth\u{202E}win",
+        })
+        .to_string(),
+    )
+    .tags([Tag::parse(["d", agent_pubkey.as_str()]).expect("parse d tag")])
+    .sign_with_keys(&owner_keys)
+    .expect("sign managed-agent event");
+
+    let agents = relay_agents_from_managed_agent_events(&[hostile], std::slice::from_ref(&profile));
+    assert_eq!(agents.len(), 1, "the agent itself must still be reachable");
+    assert_eq!(agents[0].name, "Bumble");
+    assert_eq!(agents[0].device_id, None, "malformed id dropped");
+    assert_eq!(agents[0].device_label, None, "bidi-bearing label dropped");
+
+    // An over-long label is refused by the same policy.
+    let long = EventBuilder::new(
+        Kind::Custom(30177),
+        serde_json::json!({
+            "name": "Bumble",
+            "parallelism": 1,
+            "respond_to": "anyone",
+            "device_id": "0123456789abcdef0123456789abcdef",
+            "device_label": "a".repeat(33),
+        })
+        .to_string(),
+    )
+    .tags([Tag::parse(["d", agent_pubkey.as_str()]).expect("parse d tag")])
+    .sign_with_keys(&owner_keys)
+    .expect("sign managed-agent event");
+
+    let agents = relay_agents_from_managed_agent_events(&[long], std::slice::from_ref(&profile));
+    assert_eq!(agents.len(), 1);
+    assert_eq!(
+        agents[0].device_id.as_deref(),
+        Some("0123456789abcdef0123456789abcdef"),
+        "a valid id survives its label being dropped"
+    );
+    assert_eq!(agents[0].device_label, None);
+}
+
 #[test]
 fn managed_agent_directory_rejects_agents_without_verified_owner_profiles() {
     let owner_keys = Keys::generate();

desktop/src-tauri/src/nostr_convert/tests.rs

@@ -20,7 +20,6 @@ export type MentionSuggestionCandidate = {
   role?: ChannelRole | null;
   ownerPubkey?: string | null;
   deviceLabel?: string | null;
-  isManagedAgent?: boolean;
 };
 
 export function mapMentionCandidateToSuggestion(opts: {

desktop/src/features/messages/lib/mentionSuggestionMapping.ts

@@ -274,13 +274,22 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
             // Same account on several computers mints one keypair per
             // computer, so identically named agents are usually different
             // devices.
-            const deviceLine = suggestion.isAgent
-              ? describeAgentDevice({
-                  isLocal: suggestion.isLocalAgent === true,
-                  deviceLabel: suggestion.deviceLabel,
-                  hasNameCollision,
-                })
-              : null;
+            // Only speak when we actually know something about the device.
+            // A suggestion carrying neither a label nor a local/remote verdict
+            // (upstream fixtures, teams, pre-feature agents) must stay silent:
+            // guessing "on another device" is the same false statement
+            // describeUnrunnableMention already refuses to make.
+            const hasDeviceKnowledge =
+              suggestion.deviceLabel != null ||
+              suggestion.isLocalAgent !== undefined;
+            const deviceLine =
+              suggestion.isAgent && hasDeviceKnowledge
+                ? describeAgentDevice({
+                    isLocal: suggestion.isLocalAgent === true,
+                    deviceLabel: suggestion.deviceLabel,
+                    hasNameCollision,
+                  })
+                : null;
             const hasMetadataBeforeNpub = Boolean(
               suggestion.kind === "team" ||
                 suggestion.isAgent ||