From fda771498e563b66e0385a5b024994687ea2fec8 Mon Sep 17 00:00:00 2001 From: SHL0MS Date: Tue, 28 Jul 2026 13:47:46 -0400 Subject: [PATCH] docs(acp): warn that Buzz auto-approves Hermes tool permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Buzz Desktop section covered discovery only. The combination that actually needs stating: the hermes-acp toolset carries terminal and execute_code, and buzz-acp answers session/request_permission itself with allow_once instead of surfacing it. A Hermes agent in Buzz runs shell commands on the host unattended. Buzz defaults every agent to owner-only and that default holds through to the spawned process env, so nobody reaches the open state by accident. But Anyone is one dropdown change away with no warning shown, and it hands channel-wide shell access to the host. Also record that the two obvious mitigations do not work: approvals.mode manual raises the request but Buzz auto-approves it anyway, and platform_toolsets.acp does not narrow the ACP toolset. Both verified by running rm -rf through the ACP path under each setting. Amend the Approvals section too — it promised prompts route back to the editor, which is only true for hosts that choose to surface them. en + zh-Hans. Signed-off-by: SHL0MS --- website/docs/user-guide/features/acp.md | 29 +++++++++++++++++++ .../current/user-guide/features/acp.md | 25 ++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/website/docs/user-guide/features/acp.md b/website/docs/user-guide/features/acp.md index 89c7afdcebe3..03a96aaa688e 100644 --- a/website/docs/user-guide/features/acp.md +++ b/website/docs/user-guide/features/acp.md @@ -163,6 +163,30 @@ Recent installs write both `hermes` and `hermes-acp` launchers into older installs. As a manual fallback, configure Buzz's agent command as `hermes` with args `["acp"]`. +#### Keep Buzz agents owner-only + +Buzz creates every agent with **Who can talk to this agent** set to `Owner only`. +Leave it there when the runtime is Hermes. + +Two behaviors combine on this path. The `hermes-acp` toolset includes `terminal` +and `execute_code`, and Buzz's ACP bridge answers Hermes' permission requests +itself with `allow_once` rather than surfacing them. A Hermes agent in Buzz +therefore runs shell commands on the host without prompting. I asked one to run +`rm -rf` against a scratch directory and it deleted it, no prompt anywhere. + +Selecting `Anyone` hands that same shell access to every author who can reach +the channel. Buzz does not warn when you pick it. + +Neither of the obvious mitigations works today: + +- `approvals.mode: manual` does make Hermes raise the permission request, but + Buzz auto-approves it and the command still runs. +- `platform_toolsets.acp` does not narrow the ACP toolset, so it cannot be used + to drop `terminal`. + +`!shutdown` from the owner stops the agent in any mode, and Buzz ignores that +command from everyone else. + ## Configuration and credentials ACP mode uses the same Hermes configuration as the CLI: @@ -222,6 +246,11 @@ Dangerous terminal commands can be routed back to the editor as approval prompts - allow always - deny +Whether you actually see a prompt is up to the host. A host is free to answer the +request programmatically instead of showing it to you, in which case these +options exist on the wire but never reach a human. Buzz Desktop does this, so +treat that path as unattended execution regardless of your `approvals` setting. + On timeout or error, the approval bridge denies the request. ### Session-scoped edit auto-approval diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/acp.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/acp.md index 0a53a44be46c..4da6708e4c84 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/acp.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/acp.md @@ -159,6 +159,27 @@ command -v hermes-acp || command -v hermes 运行 `hermes update` 会为较旧的安装补上 `hermes-acp` 启动器。作为手动兜底方案， 可以将 Buzz 的 agent 命令配置为 `hermes`，参数为 `["acp"]`。 +#### 将 Buzz agent 保持为 owner-only + +Buzz 创建的每个 agent 默认都将 **Who can talk to this agent** 设为 `Owner only`。 +当运行时为 Hermes 时，请保持该设置。 + +这条路径上有两种行为叠加。`hermes-acp` 工具集包含 `terminal` 和 `execute_code`， +而 Buzz 的 ACP 桥接层会自行以 `allow_once` 回应 Hermes 的权限请求，不会转交给你确认。 +因此 Buzz 中的 Hermes agent 会在不提示的情况下在宿主机上执行 shell 命令。 +让它对一个临时目录执行 `rm -rf`，该目录会被直接删除，全程没有任何提示。 + +将该设置改为 `Anyone`，等于把同样的 shell 访问权限交给频道中的每一位发言者。 +Buzz 在你选择该选项时不会给出任何警告。 + +目前两种看起来可行的缓解手段都无效： + +- `approvals.mode: manual` 确实会让 Hermes 发出权限请求，但 Buzz 仍会自动批准， + 命令照样执行。 +- `platform_toolsets.acp` 不会收窄 ACP 工具集，因此无法用它去掉 `terminal`。 + +来自 owner 的 `!shutdown` 在任何模式下都能停止 agent，而 Buzz 会忽略其他人发出的同一命令。 + ## 配置与凭据 ACP 模式使用与 CLI 相同的 Hermes 配置： @@ -196,6 +217,10 @@ ACP 会话将编辑器的 cwd 绑定到 Hermes 任务 ID，使文件和终端工 - 始终允许 - 拒绝 +你是否真的会看到提示取决于宿主端。宿主可以用程序方式直接回应该请求而不展示给你， +此时这些选项只存在于协议层面，永远不会到达人类手中。Buzz Desktop 就是这样做的， +因此无论你的 `approvals` 如何设置，都应把该路径视为无人值守执行。 + 超时或出错时，审批桥接会拒绝请求。 ### 会话范围的编辑自动审批