Browse legacy identities without a destination and review text before cloning

crates/agent-controller/src/import.rs

@@ -48,6 +48,14 @@ pub struct Candidate {
     pub relay_url: String,
     pub name: String,
 }
+/// Reviewed text only. Never project legacy environment, commands, arguments,
+/// credentials, paths, owner authorization or retained source records for cloning.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CloneSettings {
+    pub name: String,
+    pub system_prompt: String,
+}
 #[derive(Clone)]
 struct Pending {
     preview: ImportPreview,
@@ -69,6 +77,30 @@ struct Source {
     digest: String,
 }
 impl Imports {
+    pub fn clone_settings(
+        source_kind: LegacySource,
+        app_data_parent: PathBuf,
+        pubkey: &str,
+    ) -> Result<CloneSettings> {
+        if !canonical_key(pubkey) {
+            return Err("Invalid source identity".into());
+        }
+        let data = read_source(&app_data_parent.join(source_kind.app_directory()))?;
+        let records: Vec<_> = data
+            .records
+            .iter()
+            .filter(|record| string(record, "pubkey") == pubkey)
+            .collect();
+        if records.len() != 1 {
+            return Err("Choose one existing source identity".into());
+        }
+        let record = records[0];
+        let definition = source_definition(&data, record)?;
+        Ok(CloneSettings {
+            name: string(record, "name").into(),
+            system_prompt: string(definition, "system_prompt").into(),
+        })
+    }
     pub fn discard(&mut self) {
         self.pending = None;
     }
@@ -82,7 +114,12 @@ impl Imports {
         destination: &str,
     ) -> Result<ImportPreview> {
         self.pending = None;
-        let relay = canonical_relay(destination)?;
+        // Browsing local files needs no destination and grants no import authority.
+        let relay = if destination.is_empty() {
+            String::new()
+        } else {
+            canonical_relay(destination)?
+        };
         let source = app_data_parent.join(source_kind.app_directory());
         let data = read_source(&source)?;
         let mut candidates = Vec::new();
@@ -110,7 +147,7 @@ impl Imports {
             .sequence
             .checked_add(1)
             .ok_or("Import preview exhausted")?;
-        let preview = ImportPreview {
+        let mut preview = ImportPreview {
             token: format!("{}-{}", self.sequence, data.digest),
             source_path: source.join("agents/managed-agents.json").display().to_string(),
             candidates,
@@ -121,6 +158,13 @@ impl Imports {
                 "This copies selected identities and resolved settings; old Buzz remains unchanged.".into(),
             ],
         };
+        if relay.is_empty() {
+            preview.token.clear();
+            preview.warnings = vec![
+                "Local identities only. Choose a destination before reviewing an import.".into(),
+            ];
+            return Ok(preview);
+        }
         self.pending = Some(Pending {
             preview: preview.clone(),
             source,
@@ -303,8 +347,8 @@ fn object(value: &Value) -> Result<BTreeMap<String, String>> {
     serde_json::from_value(value.clone())
         .map_err(|_| "Source environment must contain string values".into())
 }
-fn resolve(data: &Source, record: &Value, workspace: &Path, destination: &str) -> Result<Agent> {
-    let definition = if string(record, "persona_id").is_empty() {
+fn source_definition<'a>(data: &'a Source, record: &'a Value) -> Result<&'a Value> {
+    Ok(if string(record, "persona_id").is_empty() {
         record
     } else {
         data.records
@@ -313,7 +357,10 @@ fn resolve(data: &Source, record: &Value, workspace: &Path, destination: &str) -
                 string(r, "pubkey").is_empty() && string(r, "slug") == string(record, "persona_id")
             })
             .ok_or("Linked agent definition is missing; source left unchanged")?
-    };
+    })
+}
+fn resolve(data: &Source, record: &Value, workspace: &Path, destination: &str) -> Result<Agent> {
+    let definition = source_definition(data, record)?;
     let fallback = |key| {
         let selected = string(definition, key);
         if selected.trim().is_empty() {

crates/agent-controller/src/import/tests.rs

@@ -530,7 +530,7 @@ fn invalid_destination_discards_pending_without_echoing_inputs_or_acquiring_keys
     let mut store = Store::open(dest.path().into()).unwrap();
     let keys = Memory::default();
     for invalid in [
-        "",
+        " ",
         "not a URL",
         "ws://raw.example",
         "http://raw.example",
@@ -828,6 +828,97 @@ fn team_snapshot_handles_empty_deleted_and_invalid_teams() {
         assert!(team_instructions(&data, &data.records[1]).is_err());
     }
 }
+#[test]
+fn local_browse_without_destination_cannot_commit_or_reuse_prior_authority() {
+    let old = tempfile::tempdir().unwrap();
+    let dest = tempfile::tempdir().unwrap();
+    let bytes = source(old.path());
+    let mut imports = Imports::default();
+    let mut store = Store::open(dest.path().into()).unwrap();
+    let keys = Memory::default();
+    let prior = imports
+        .preview(
+            LegacySource::Installed,
+            old.path().into(),
+            dest.path().into(),
+            "wss://chosen.example",
+        )
+        .unwrap();
+    let browse = imports
+        .preview(
+            LegacySource::Installed,
+            old.path().into(),
+            dest.path().into(),
+            "",
+        )
+        .unwrap();
+    assert_eq!(browse.candidates.len(), 1);
+    assert_eq!(browse.candidates[0].pubkey, PUB);
+    assert!(browse.candidates[0].relay_url.is_empty());
+    assert!(browse.token.is_empty());
+    for (token, id) in [
+        (&browse.token, &browse.candidates[0].id),
+        (&prior.token, &prior.candidates[0].id),
+    ] {
+        assert!(imports
+            .commit(token, std::slice::from_ref(id), &mut store, &keys)
+            .is_err());
+    }
+    assert_eq!(keys.reads.load(Ordering::SeqCst), 0);
+    assert!(keys.keys.lock().unwrap().is_empty());
+    assert!(store.agents().unwrap().is_empty());
+    assert_eq!(
+        fs::read(
+            old.path()
+                .join(LegacySource::Installed.app_directory())
+                .join("agents/managed-agents.json")
+        )
+        .unwrap(),
+        bytes
+    );
+    let serialized = serde_json::to_string(&browse).unwrap();
+    assert!(!serialized.contains("private_key"));
+}
+
+#[test]
+fn clone_settings_projects_only_reviewed_text_without_source_or_credential_writes() {
+    let old = tempfile::tempdir().unwrap();
+    let before = source(old.path());
+    let settings =
+        Imports::clone_settings(LegacySource::Installed, old.path().into(), PUB).unwrap();
+    assert_eq!(
+        serde_json::to_value(settings).unwrap(),
+        json!({
+            "name": "Brain", "systemPrompt": "definition-prompt"
+        })
+    );
+    assert_eq!(
+        fs::read(
+            old.path()
+                .join(LegacySource::Installed.app_directory())
+                .join("agents/managed-agents.json")
+        )
+        .unwrap(),
+        before
+    );
+    assert!(Imports::clone_settings(LegacySource::Development, old.path().into(), PUB).is_err());
+    assert!(
+        Imports::clone_settings(LegacySource::Installed, old.path().into(), "../path").is_err()
+    );
+    assert!(
+        Imports::clone_settings(LegacySource::Installed, old.path().into(), &"ab".repeat(32))
+            .is_err()
+    );
+    let path = old
+        .path()
+        .join(LegacySource::Installed.app_directory())
+        .join("agents/managed-agents.json");
+    let mut records: Vec<Value> = serde_json::from_slice(&before).unwrap();
+    records.push(records[1].clone());
+    fs::write(path, serde_json::to_vec(&records).unwrap()).unwrap();
+    assert!(Imports::clone_settings(LegacySource::Installed, old.path().into(), PUB).is_err());
+}
+
 #[test]
 fn import_excludes_overlapping_destinations_before_credentials_through_commit() {
     let old = tempfile::tempdir().unwrap();

crates/agent-controller/src/lib.rs

@@ -30,7 +30,9 @@ pub use config::{AgentEdit, AgentView, ControlSnapshot, HarnessEdit, ProcessStat
 pub use create::{CreationProfile, NewAgent};
 pub use credentials::PlatformCredentials;
 pub use defaults::{build_defaults, BuildDefaults};
-pub use import::{CredentialedImport, ImportPreview, Imports, LegacySource, PreparedImport};
+pub use import::{
+    CloneSettings, CredentialedImport, ImportPreview, Imports, LegacySource, PreparedImport,
+};
 pub use restart::{RestartChange, RestartDiffEntry};
 pub use runtime::{installed, managed_tool, Action, Controller, GooseModelContext, ModelContext};
 pub use secret::{Credentials, Secret};

src-tauri/build.rs

@@ -50,6 +50,7 @@ fn main() {
             "agent_control_attach_mention",
             "agent_control_import_preview",
             "agent_control_import_commit",
+            "agent_control_clone_settings",
             "agent_control_use_here",
             "agent_models_begin",
             "agent_models_cancel",

src-tauri/capabilities/default.json

@@ -37,6 +37,7 @@
     "allow-agent-control-attach-mention",
     "allow-agent-control-import-preview",
     "allow-agent-control-import-commit",
+    "allow-agent-control-clone-settings",
     "allow-agent-control-use-here",
     "allow-agent-models-begin",
     "allow-agent-models-cancel",

src-tauri/src/agents.rs

@@ -1086,6 +1086,17 @@ pub(crate) async fn agent_control_use_here(
     .await
 }
 #[tauri::command]
+pub(crate) async fn agent_control_clone_settings(
+    state: tauri::State<'_, AgentHost>,
+    source: LegacySource,
+    pubkey: String,
+) -> Result<buzz_agent_controller::CloneSettings, String> {
+    run(state.inner().clone(), move |host| {
+        Imports::clone_settings(source, host.legacy_parent.clone(), &pubkey)
+    })
+    .await
+}
+#[tauri::command]
 pub(crate) async fn agent_control_import_preview(
     state: tauri::State<'_, AgentHost>,
     source: LegacySource,

src-tauri/src/browser_permissions_tests.rs

@@ -93,6 +93,7 @@ fn native_command_permissions_allow_only_main_webview() {
         "agent_control_action",
         "agent_control_import_preview",
         "agent_control_import_commit",
+        "agent_control_clone_settings",
         "agent_control_use_here",
         "agent_models_begin",
         "agent_models_cancel",

src-tauri/src/lib.rs

@@ -26,11 +26,12 @@ mod harness_setup;
 mod managed_pi;
 mod pi_models;
 use agents::{
-    agent_control_action, agent_control_attach_mention, agent_control_create_commit,
-    agent_control_create_prepare, agent_control_creation_profile, agent_control_delete,
-    agent_control_import_commit, agent_control_import_preview, agent_control_log_challenge,
-    agent_control_read_log, agent_control_save, agent_control_save_defaults,
-    agent_control_snapshot, agent_control_start_on_app_launch, agent_control_use_here, AgentHost,
+    agent_control_action, agent_control_attach_mention, agent_control_clone_settings,
+    agent_control_create_commit, agent_control_create_prepare, agent_control_creation_profile,
+    agent_control_delete, agent_control_import_commit, agent_control_import_preview,
+    agent_control_log_challenge, agent_control_read_log, agent_control_save,
+    agent_control_save_defaults, agent_control_snapshot, agent_control_start_on_app_launch,
+    agent_control_use_here, AgentHost,
 };
 use buzzodz_plugins::{
     imports::{prepare_folder, prepare_git, PreparedImport, Preview},
@@ -383,6 +384,7 @@ fn commands<R: tauri::Runtime>() -> impl Fn(tauri::ipc::Invoke<R>) -> bool + Sen
         agent_control_action,
         agent_control_attach_mention,
         agent_control_start_on_app_launch,
+        agent_control_clone_settings,
         agent_control_import_preview,
         agent_control_import_commit,
         agent_models_begin,

src/bundled/agents/AgentControlPanel.tsx

@@ -10,6 +10,7 @@ import type {
   AgentControl,
   AgentControlState,
   AgentView,
+  CloneSettings,
 } from "../../features/agents/control";
 import { PlusIcon } from "../../shared/design-system/icons/index";
 import { Button } from "../../shared/design-system/ui/Button";
@@ -54,6 +55,7 @@ export function AgentControlPanel({
     destination: string;
     owner: string;
     source?: AgentView;
+    initialSettings?: CloneSettings;
   } | null>(null);
   const [importSections, setImportSections] = useState<string[]>([]);
   const [importedId, setImportedId] = useState<string | null>(null);
@@ -194,8 +196,8 @@ export function AgentControlPanel({
             {
               value: "old-buzz",
               title: state.data.agents.some((agent) => agent.needsTeamImport)
-                ? "Import or repair from old Buzz"
-                : "Not imported from old Buzz",
+                ? "Import or repair from another installation"
+                : "Import from another installation",
               content: importSections.includes("old-buzz") ? (
                 <AgentImport
                   key={importDestination}
@@ -206,6 +208,18 @@ export function AgentControlPanel({
                     state.status === "ready" &&
                     state.data.importAvailable !== false
                   }
+                  onClone={
+                    control.cloneSettings && createOwner && importDestination
+                      ? (initialSettings) => {
+                          setImportSections([]);
+                          setAdding({
+                            destination: importDestination,
+                            owner: createOwner,
+                            initialSettings,
+                          });
+                        }
+                      : undefined
+                  }
                   disabled={state.busy}
                   onImported={(agents) => {
                     setImportedId(agents[0]?.id ?? null);
@@ -224,6 +238,9 @@ export function AgentControlPanel({
           destination={adding.destination}
           owner={adding.owner}
           {...(adding.source ? { source: adding.source } : {})}
+          {...(adding.initialSettings
+            ? { initialSettings: adding.initialSettings }
+            : {})}
           onClose={() => setAdding(null)}
           onOpenHarnesses={onOpenHarnesses}
         />