fix(desktop): isolate dev keyring from production and make BUZZ_SHARE_IDENTITY keyring-aware

desktop/scripts/check-file-sizes.mjs

@@ -95,6 +95,9 @@ const overrides = new Map([
   // unified-agent-model 1A.1: inline test module moved to nest/tests.rs,
   // ratcheting 1575 -> 679 (under the 1000 default; entry kept as a ratchet).
   ["src-tauri/src/managed_agents/nest.rs", 679],
+  // keyring-dev-isolation: agent key migration added copy_agent_keys_between_stores
+  // and load_readonly support; file grew past 1000 default. Queued to split.
+  ["src-tauri/src/managed_agents/storage.rs", 1325],
   // harness-persona-sync: persona-runtime resolution threaded into the spawn
   // path here. Load-bearing feature growth; queued to split in the resolver
   // unify refactor followup. +26 for resolve_effective_prompt_model_provider
@@ -192,7 +195,8 @@ const overrides = new Map([
   // + inner fn with baked-env gate + 26 tests. Load-bearing correctness fix.
   // am review fix: also clear stale V1 model field on provider rewrite +
   // new model-clear test. Load-bearing chimera fix.
-  ["src-tauri/src/migration.rs", 1402],
+  // keyring-dev-isolation: run_boot_migrations wires agent-key migration.
+  ["src-tauri/src/migration.rs", 1415],
   // onMarkRead + isUnread prop threading (mirrors the onMarkUnread prop
   // already here) for the single-toggle mark-read/unread menu item — a small
   // overage from load-bearing per-message plumbing, not generic debt growth.
@@ -213,8 +217,10 @@ const overrides = new Map([
   // cross-process keychain race fix (D3): interprocess lock + BlobLockGuard +
   // uid-keyed lockfile path + behavioral tests add ~303 lines. Load-bearing
   // security fix for the lost-update race that stranded agent keys.
-  ["src-tauri/src/secret_store.rs", 1043],
-  ["src-tauri/src/app_state.rs", 1033],
+  ["src-tauri/src/secret_store.rs", 1110],
+  // keyring-dev-isolation: keyring_service() fn (7 lines) replaces the const
+  // to return "buzz-desktop-dev" in debug builds. Load-bearing isolation fix.
+  ["src-tauri/src/app_state.rs", 1042],
   // multi-slot splitting + no-op suppression (#1309): the ReadStateManager
   // class grew from ~700 lines to ~1019 with the addition of
   // splitContextsIntoBudgetedSlots (pure fn + 5 tests), publishSplitSlots,

desktop/src-tauri/src/app_state.rs

@@ -184,7 +184,16 @@ pub fn resolve_persisted_identity(app: &AppHandle, state: &AppState) -> Result<(
 
 /// Service name for the desktop OS keyring. Shared by the human identity key
 /// and managed-agent keys (each addressed by a distinct key name within it).
-pub(crate) const KEYRING_SERVICE: &str = "buzz-desktop";
+///
+/// Debug builds use a distinct service name so dev and production keyring
+/// entries never collide on the same machine.
+pub(crate) fn keyring_service() -> &'static str {
+    if cfg!(debug_assertions) {
+        "buzz-desktop-dev"
+    } else {
+        "buzz-desktop"
+    }
+}
 
 /// Keyring key name for the human identity nsec.
 const IDENTITY_KEY_NAME: &str = "identity";
@@ -238,7 +247,7 @@ fn load_or_create_identity(data_dir: &std::path::Path) -> Result<Keys, String> {
         return load_file_or_generate(&legacy_path, data_dir);
     }
 
-    let store = crate::secret_store::SecretStore::shared(KEYRING_SERVICE);
+    let store = crate::secret_store::SecretStore::shared(keyring_service());
     resolve_identity_with_store(store, &legacy_path, data_dir)
 }