Skip to content

docs(acp): clarify buzz CLI auth scope in base_prompt - #4282

Open
iroiro147 wants to merge 1 commit into
block:mainfrom
iroiro147:fix/4224-base-prompt-mcp-tool
Open

docs(acp): clarify buzz CLI auth scope in base_prompt#4282
iroiro147 wants to merge 1 commit into
block:mainfrom
iroiro147:fix/4224-base-prompt-mcp-tool

Conversation

@iroiro147

Copy link
Copy Markdown

Fixes #4224.

Category: documentation (prompt-only fix)
User impact: Agents running in runtimes that strip credential env vars from tool subprocesses (e.g. Hermes) previously got stuck on auth_error and falsely self-reported "Buzz is down." They now route through the Buzz MCP shell tool, which is the actual auth carrier.

Problem

crates/buzz-acp/src/base_prompt.md:5 reads:

The buzz CLI is your primary interface. Auth env vars: BUZZ_RELAY_URL, BUZZ_PRIVATE_KEY, BUZZ_AUTH_TAG.

Those vars are authentic only inside the MCP server spawned by buzz-acp (build_mcp_servers injects them). An agent using its runtime's native terminal (Hermes strips BUZZ_* citing GHSA-rhgp-j443-p4rf) sees none of them. The prompt gave no hint that the MCP shell tool was the working path, so the agent follows its own instructions into a failure it cannot diagnose.

Fix

Update the prompt to (a) name the MCP shell tool as the auth carrier, (b) keep the env-var list for runtimes that DO carry credentials, (c) tell the agent to re-run via MCP shell on auth_error. One line of actual prompt text (before/after in the diff), the wording adapted from the reporter's suggested copy.

Validation

  • cargo check -p buzz-acp clean (4.1s)
  • cargo clippy -p buzz-acp --lib zero warnings
  • cargo test -p buzz-acp --lib 661/661 passing

No behavior change; prompt text only. (The base_prompt.md file is include_str!'d into the binary, so a change here flows into every newly-spawned agent session.)

The base_prompt told agents the `buzz` CLI was "pre-authenticated" without
qualifying where. Runtimes that scrub credentials from tool subprocesses
(Hermes citing GHSA-rhgp-j443-p4rf) silently drop BUZZ_PRIVATE_KEY — the
agent follows its own prompt, runs `buzz` in its native terminal, gets
`auth_error`, and incorrectly reports "Buzz is down."

This changes the prompt to:
1. Name the actual auth carrier (the Buzz MCP shell tool), not just the
   env-var list.
2. Tell the agent what to do on `auth_error`: re-run through the Buzz MCP
   shell tool, don't try to export credentials itself.

Wording adapted from the reporter's suggested copy; no behavior change,
only prompt text. Verified by inspection that the `buzz` CLI env vars
are correctly injected via `build_mcp_servers` into the MCP server config —
the broken path is the runtime's own built-in terminal tool, which the prompt
now explicitly steers around.

Verification:
- cargo check -p buzz-acp: clean (4.1s)
- cargo clippy -p buzz-acp --lib: zero warnings
- cargo test -p buzz-acp --lib: 661/661 passing

Fixes block#4224.

Signed-off-by: Sarthak Singh <sarthak.singh@juspay.in>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

buzz-acp base_prompt promises auth env vars the agent's own terminal may not have

1 participant