[kazemek21]

TL;DR

Removes the six owner-session read tools that let a Buzz-hosted agent read with its owner's own access: channel, member and DM lists, channel details, messages and canvases. An agent's own reads and the channel archive, unarchive and delete changes are unchanged. The tools are gone from discovery on every harness, and a cached or direct call to one is refused before anything is read with the owner's session.

Fixes NEXUS-4348 · Initiative: https://blockcell.sqprod.co/sites/kylez-buzz-mcp-initiative/

Scope

Kyle's request was to remove "the channel/member/dm list/get" endpoints and leave the archive/delete channel changes for now. Removing owner_read and the two Canvas tools as well is the initiative lead's interpretation: they read through the same owner session and handle, and leaving them would keep the owner-read capability this removes. If that is wrong, the #2881 half can be restored on its own.

Removed

From #2745 (owner channels and members):

• owner_channel_list, owner_channel_get, owner_member_list, their hint text and discovery on Claude Code, Codex, Pi, the session RPC and the harness kit.
• src/features/agents/owner-access.ts, the run handle's ownerAccess field and the runner's host hook that built it for bundled-revision runs.
• The BUZZ_OWNER_MCP_COMMUNITIES build setting (vite.config.ts). A distributor build that still sets it now gets nothing from it; docs/configuration.md lists it with the other retired inputs.
• The owner-tool sections in docs/agents.md, docs/configuration.md, docs/buzz-help.md and src/buzz-mcp/AGENTS.md.

From #2881 (owner messages and canvases):

• owner_read, owner_canvas_get, owner_canvas_history, src/buzz-mcp/owner.ts and the Owner* client types.
• The docs/relay-queries.md paragraph, and the exports of tools.ts helpers that only owner.ts used. edited() keeps its author-only edit selection, minus the owner parameter.

Kept

• From feat(agents): let app-hosted agents read their owner's channels and members #2745: the Stop and cancellation fences in the Claude Code, Goose and ACP sessions (workLifetime, current()), which every Buzz tool call now depends on, and the channel-lifecycle changes (channel-lifecycle.ts, including its records parameter).
• addTool still refuses plugin tool names starting with owner_, so a stale call to a retired name can never reach plugin code. There is no other owner-prefixed restriction and no new permission layer.
• Ordinary agent-scoped reads, Codex per-thread/turn tool validation, plugin and external isolation.

Alternate routes checked

Nothing else reached these tools: no Rust, IPC, sidecar or RPC path, and Mesh and external agents use the same run handle that no longer carries owner access. Codex thread tool keys no longer carry the :owner suffix, so threads created with owner tools are replaced instead of reused with a stale tool list.

Tests

The new tests list the six names as a fixed fixture rather than reading them from the catalog:

• session-tools.test.ts: sessionTools() and sessionHint(), which every harness lists from, name none of the six.
• service.test.ts: a real bundled run handle has no ownerAccess. With the owner's session stubbed to return an OWNER_ONLY message for an owner-only channel, each retired name is refused with No tool <name> before any relay query. An ordinary read of that channel then runs with the agent's own key, filtered to that channel, and returns No messages.. The same client's read of the agent's own channel returns its message, and no read through the owner's session ever names the owner-only channel. External agents see none of the names and are refused the same way.
• codex/runtime.test.ts: dynamicTools lists none of the names, each call fails Codex's validation, a planted owner-access spy is never called, and the thread's own read works.
• app-client.test.ts: a handle that still carries an owner capability doesn't pass it to the tool client.
• The Claude Code and Goose Stop/timer tests now hold an ordinary mem_get read instead of an owner tool.

On a Blox box with these commits applied to main: tsc passes, and the 12 affected Vitest files pass (claude, codex, goose, pi runtimes, app-client, tools, session-tools, service, kit, ACP client, channel-lifecycle). Full CI covers the rest. git push --no-verify skipped the pre-push lanes (types-and-related-unit-tests, design-system, rust-clippy); CI's pnpm check, sharded Vitest and clippy jobs repeat all three.

Fail-before check: the removal tests in service.test.ts and codex/runtime.test.ts were run against the pre-removal source (0a5c190). Three of them fail on real assertions:

• Codex dynamicTools contains owner_channel_list.
• An external agent's call returns "Owner tools are not available to this agent here; nothing was read." instead of No tool owner_channel_list.
• The bundled handle has ownerAccess.

All three pass on this branch. Vitest strips types, so this check doesn't cover tsc. The session-tools.test.ts discovery test also passes on the old source, because that source only lists the tools when the owner setting is on, so it doesn't count as a fail-before check.

Not covered

• No native app run or live relay check. The removal is exercised through the service, runner and harness tests above.
• A Buzz process already running a build with these tools keeps them until it updates. This doesn't revoke anything remotely.

Related open PRs

• Human work in overlapping files keeps its behavior but may need a rebase: BUZZ-615: Separate viewer membership from peer rosters #2700, feat(search): match verified names in from:, the author picker and MCP users #2974, fix(agents): link Settings from key failures and quote the provider #3081, Cancel added tools when native work stops #2972 (cancel added tools on native Stop), Update when agents are idle #2935, fix(agents): catch up an agent's mentions, in their own pass #1634, feat(bestie): add Inbox access and refine settings #2622, agents: store agent attention in its community (opt-in per agent) #3095, Stream protected evidence across agent runtimes #2882.
• feat(owner-mcp): let agents add, remove and re-role channel members with their owner's access #3004, fix(agents): bind external app consent to the displayed request; revoke closes locally first #3005, feat(agents): let app-hosted agents manage their owner's channels #3006, feat(owner-tools): let agents manage their owner's private Solo workspaces #3008 and feat(agents): let a bundled agent get its community's media as its owner #2980 build on the removed owner access and are not part of this change.

🤖 Generated with Claude Code (claude-opus-5-5) on behalf of kylez

[dr0uleau]

🤖 approved at 43a9614 -- CI passes. Native app and live relay checks remain unverified