Repository navigation
Per-Bot grants leak: accepting a Helper invite exposes the joiner's Chief; face-room Chief shows in Friends' Bots; Manage access wrong/raw #138
Description
Environment: ThinkFlowLab/FlyBot main 1ac7104 (core, plugins/social, plugins/tree) on @deepseek-ai/dsh@0.2.0-rc.2, two fresh installs on one Linux box (A on :3080, B on :3081), Bot Social server https://47-80-69-220.sslip.io. Found in the scheduled two-instance UI self-test on 2026-10-16 (~19:35 UTC+8).
What happened
- A invited B to Helper only (Helper → Settings → "Invite to this Bot", text: "Accepting the invite grants them Helper only"). B accepted with + → Accept invite. Status: "You are now friends with Helper as Chief." B was never asked which Bot to join as.
- A's sidebar then shows Friends' Bots 1 → SelfB1935 → "SelfB1935's Chief", although B never granted any Bot to A.
- After a face-to-face room together, B's Friends' Bots, which said "No Bots shared yet", lists "SelfA1935's Chief", although A never invited B to Chief (face-room join is supposed to be room-only).
- A's Helper → Manage access: right after B joined (after a reload) it said "Nobody has this Bot yet". Later it lists "Chief@chief.selfb1935.home" with Revoke: a raw member handle instead of the person (SelfB1935).
Repro
- Two fresh installs A and B. A: Helper → details → gear → Invite to this Bot → Copy link.
- B: + → Accept invite → paste → Join.
- Look at A's Friends' Bots, and A's Helper → Manage access.
- Create a face-to-face room A+B (bring Chief), chat, Leave on both; look at B's Friends' Bots.
Expected (owner design: per-Bot grants, default deny, Chief included; no publish)
- Accepting an invite grants exactly the invited Bot to me. It does not grant any of my Bots back. If the protocol needs a Bot on my side to talk through, ask which one (default Chief) and make clear it is not shared with the inviter unless I invite them to it.
- Face-to-face join stays room-only: after leaving, no Bot from the room shows in Friends' Bots.
- Manage access lists people ("SelfB1935 (@selfb1935.home)") and is correct right after the join.
- Success copy names the person and the Bot: "SelfA1935 shared Helper with you."
Activity
fix(social): name collisions, per-Bot grant leaks, Bot removal and ap…
Birfy commentedon Oct 16, 2026
Fixed on main (
566f1e6) by #141 plus the review follow-up #142.All four points from the report:
inboundBots, with a one-time backfill in fix(social): Codex review follow-up for #141 (canonical grants, inbound backfill, scoped unhide) #142 so an upgrade doesn't drop real reciprocal friends). Accept invite always shows "Talk through [Bot] (not shared unless you invite them to it)".markRoomRemotere-adding friends already on the roster). Test:#138: leaving a face room drops room-only remotes from Friends' Bots.list_bot_grantsand render asName (@home). fix(social): Codex review follow-up for #141 (canonical grants, inbound backfill, scoped unhide) #142 stores core grants as the canonical@handle, soreach()matches them. Test:#136 / #138: grant labels use the person home….{person} shared {Bot} with you.Caveat: the leak is fixed in the client and core grants (what appears in Friends' Bots and what
reach()allows). The Bot Social relationship itself is still home-to-home on the server.Closing as completed.
Restore both directions when a re-invite is accepted (ThinkFlowLab#1000…