From 813d100c0cf2059b9f72fee5a4a37d581aa41121 Mon Sep 17 00:00:00 2001 From: Diego-F-Aguirre Date: Fri, 7 Aug 2026 10:35:52 -0400 Subject: [PATCH] docs(acp): correct Codex quick-start, idle timeout, and author gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three README statements disagree with the code they describe. The Codex quick-start never sets BUZZ_ACP_AGENT_COMMAND, so following it verbatim spawns goose rather than codex-acp: the flag defaults to "goose" (config.rs). The Claude Code section already sets it, so this also removes an internal inconsistency between the two runtime sections. BUZZ_ACP_IDLE_TIMEOUT is documented as 620, but DEFAULT_IDLE_TIMEOUT_SECS is 900 (config.rs), asserted by a unit test in the same file. The author-gate section documents four modes and notes the owner is implicitly included, but omits two behaviors that materially change who can prompt an agent. owner-only and allowlist also accept same-owner siblings, verified from the author's NIP-OA auth tag (is_owner_or_sibling in lib.rs). Inside a DM, anyone and allowlist do not apply at all — only the owner and verified siblings may fire a turn, and unknown channel type is treated as a DM. Both are already described in the author_allowed doc comment; this surfaces them in the README. Docs only; no behavior change. Signed-off-by: Diego-F-Aguirre --- crates/buzz-acp/README.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/crates/buzz-acp/README.md b/crates/buzz-acp/README.md index e6164b02dd..f02104e27a 100644 --- a/crates/buzz-acp/README.md +++ b/crates/buzz-acp/README.md @@ -74,6 +74,7 @@ npm install -g @agentclientprotocol/codex-acp # Run export OPENAI_API_KEY="sk-..." # required — use an OpenAI API key, not a ChatGPT subscription +export BUZZ_ACP_AGENT_COMMAND="codex-acp" buzz-acp ``` @@ -111,7 +112,7 @@ All configuration is via environment variables (or CLI flags — every env var h | `BUZZ_ACP_AGENT_COMMAND` | no | `goose` | Agent binary to spawn. | | `BUZZ_ACP_AGENT_ARGS` | no | `acp` | Agent arguments (comma-separated). | | `BUZZ_ACP_MCP_COMMAND` | no | `""` (empty) | Path to an optional MCP server binary to provide to the agent subprocess. | -| `BUZZ_ACP_IDLE_TIMEOUT` | no | `620` | Idle timeout: max seconds of silence before cancelling a turn. Resets on any agent stdout activity. | +| `BUZZ_ACP_IDLE_TIMEOUT` | no | `900` | Idle timeout: max seconds of silence before cancelling a turn. Resets on any agent stdout activity. | | `BUZZ_ACP_MAX_TURN_DURATION` | no | `7200` | Absolute wall-clock cap per turn (safety valve). | | `BUZZ_API_TOKEN` | no | — | API token (required if relay enforces token auth). | @@ -161,6 +162,19 @@ Owner control commands must be kind:9 stream messages from the owner, must menti > **Note:** The default mode is `owner-only`. Agents without a registered `agent_owner_pubkey` will not respond to any events until the owner is resolved. Set `--respond-to anyone` to disable the gate entirely. +> **Same-owner siblings:** `owner-only` and `allowlist` also accept other agents +> that share this agent's owner, verified from the author's NIP-OA auth tag in +> its kind:0 profile. The allowlist adds external pubkeys on top; it never +> revokes same-owner team bots. + +> **DMs are stricter than the mode suggests:** clients auto-p-tag every DM +> participant, so any participant's message would otherwise look like a mention +> and fire a turn — which would turn `anyone` and `allowlist` into transitive +> access grants for whoever lands in a DM with the agent. Inside a DM only the +> owner and verified same-owner siblings may prompt the agent; `anyone` and the +> explicit allowlist do not apply, and `nobody` still drops everything. Channel +> type resolves fail-closed: unknown type is treated as a DM. + **Examples:** ```bash