[kazemek21]

TL;DR

Completes the owner-context MCP reads that #2745 started. An agent's app-hosted run can now read a message, thread or search (owner_read), the current Canvas (owner_canvas_get) and Canvas revision history (owner_canvas_history) with its signed-in owner's access, including in private channels the agent is not in. These reach the owner's session only through new typed OwnerAccess operations, and they write nothing. It also stops external app connections from getting the owner's access. Saving the owner's attachments (owner_media_get) is left out; see Outstanding.

Fixes NEXUS-4285 · Initiative status: https://blockcell.sqprod.co/sites/kylez-buzz-mcp-initiative/

How it reads

• Same binding and fences as feat(agents): let app-hosted agents read their owner's channels and members #2745. createOwnerAccess runs each new operation on the owner's current binding. Each answer is released only if that binding still holds after the protection review of the tool result. A sign-out, account switch, reconnect, Stop or turn end returns nothing. The host still decides the agent, owner and community, and every answer names them in executedAs.
• Channel checks come first. Every read checks the channel against the owner's list, then against the relay-signed 39000/39001/39002 records, before any content is read. System channels are refused at both steps. Searches are post-filtered to the owner's channels and report partial while that list is incomplete. Other channels' matches still fill the relay's page, so q tells the agent to narrow by channel or time when a limited page shows few results. One read fetches a page's edits, as read does; when it fills the relay's 500 cap, the answer says edits_limited instead of passing earlier text off as current.
• Content comes from session.snapshotRead. That is the relay's own access-checked answer, which feeds no session projection. So owner reads change no unread or read state, membership, subscriptions or channel lists. A test asserts that readRemote sees only relay-signed channel records.
• Paging matches the ordinary read and the app's Canvas history. Reads use the before/before_id cursor, fetch limit+1 to detect an older page, and apply the author's newest edit. A thread page holds at most 499, not the ordinary read's 500, because owner reads go through the relay reader, which caps a filter at 500 and the lookahead needs one. The first history page is read from the writer, as the app's history is, and so is an explicit revision, so an ID history just listed is found.
• A newer edit by someone else no longer hides the author's. The shared edited() chose the newest edit before checking its author, so if an agent edited its message and its owner edited it later, both read and owner_read showed the original. It now picks the newest eligible edit. For owner_read that also follows the app's fold (fold.ts byAuthor, documented in docs/relay-queries.md): in a chat message's or forum post's channel, an edit by the author's owner counts when the owner's Buzz has verified that ownership from the author's signed profile. Without that verification only the author's own edits count. read passes no owner map, so it keeps author-only edits.
• External apps lose the owner's access again. An external app connection reused the bundled run's handle, which has carried ownerAccess since feat(agents): let app-hosted agents read their owner's channels and members #2745, so it listed and could call the owner_* tools. connectExternal now drops ownerAccess from that handle, as the docs already promised.
• Mesh agents keep it. A Mesh agent is app-hosted, so it has these tools; docs/agents.md now notes that, as its setup already warns of all tool output, members serving its model can read what they return.

There is no new logger, signer, client or lifecycle. The ordinary tools' identity, schemas and errors are unchanged: messageLine was extracted from tools.ts without behavior changes.

Tests

• owner-access.test.ts covers:
  • a private channel the agent is not in, paged, with edits and names;
  • an archived open forum;
  • a whole thread from any of its replies;
  • search limited to the owner's channels, with limited and partial;
  • an unlisted channel, a system channel, a non-UUID channel, a channel the relay withholds, and a missing message;
  • offline (no snapshot reader);
  • the Canvas head, a revision, and a revision from another channel;
  • history paging;
  • a binding change mid-read, Stop during a content read, and a second owner's session never being read;
  • the MCP path callSessionTool → appClient → createOwnerAccess for the new tools.
• service.test.ts proves an external connection to a bundled harness's run lists no owner_* tool and refuses a guessed owner_channel_list call, while that run's own handle does carry the owner's access. It fails without the fix.
• owner.test.ts covers the tools' arguments, limits, continuations and errors. app-client.test.ts covers the turn checks and signal for the new wrappers.

Native gaps

• The MCP-to-host proof runs the real tool dispatch, app client and owner-access binding against a fake owner session. It does not run a live relay or the native app.
• The service-level test from feat(agents): let app-hosted agents read their owner's channels and members #2745 already proves that a run handle carries this binding, and that plugins and other communities never get it. It was not extended to the new tools.

Outstanding

• owner_media_get is not in this PR. The native app_agent_media command saves a file where the agent's own tools can open it before the call's final checks run: the result protection review, and whether the owner's binding still holds after a download. No existing mechanism holds the file back until those pass, so the tool is neither listed nor callable. It needs a stage-then-publish step in the native media command first. The removed implementation is kept on the worker's preserve ref for that follow-up.

🤖 Generated with Claude Code

[dr0uleau]

🤖 reviewed 158505b -- no P2 or worse findings remain. the owner-edit regression has test coverage, and CI passes for this commit. live relay and native checks remain unverified