feat(tvc): debug mode in app and deployment intents by daniilrrr · Pull Request #132 · tkhq/rust-sdk

daniilrrr · 2026-05-05T01:06:01Z

Summary

Debug-mode deployments expose enclave logs and zero out attestation PCRs, permanently marking an app's quorum key insecure. To make that risk explicit, debug-mode deployment requires a two-step opt-in: an app-level flag set at creation, plus a per-deployment flag that the server only accepts for capable apps. Attempting a debug-mode deployment on an app that isn't opted in will error from mono.

This is implemented in
mono PR 6314.

This PR adds equivalent functionality to the Rust SDK with the updated protos/intents

`tvc app create`

New flag:

Flag	Env var	Default
`--dangerous-enable-debug-mode-deployments`	`TVC_DANGEROUS_ENABLE_DEBUG_MODE_DEPLOYMENTS`	`false`

New JSON config field matching the field in the proto:

{
  "enableDebugModeDeployments": false
}

Warning

Cannot be changed after the app is created. To move between debug-capable and non-debug, create a new app with a fresh quorum key.

`tvc deploy create`

Old	New
`--debug-mode`	`--dangerous-deploy-debug-mode`
`TVC_DEBUG_MODE`	`TVC_DANGEROUS_DEPLOY_DEBUG_MODE`

--debug-mode was previously a no-op, so this breaking change is fine.

The server rejects debug-mode deployments for apps that weren't created with `--dangerous-enable-debug-mode-deployments`.

The JSON deploy config's `debugMode` field is now plain `bool` (defaults to `false` when omitted) rather than `bool | null`. Existing configs with `true`, `false`, or the field omitted keep working unchanged.

Override order

Both flags follow the existing clap order:

CLI flag > env var > config file

Proto

Synced proto/external/data/v1/tvc.proto and proto/immutable/activity/v1/activity.proto from mono PR #6314 to pick up the new enable_debug_mode_deployments field on CreateTvcAppIntent and TvcApp.

daniilrrr · 2026-05-27T22:43:22Z

reminder to self to regenerate protos from mono/main once PR #6314 merges, to make sure no other changes are missed

richardpringle

Just want you to change the doc warning and the Cargo.lock change (unless it's needed for some reason)

Everything else is optional

richardpringle · 2026-05-28T22:01:59Z

 pub async fn run(args: Args) -> Result<()> {
-    let app_config = load_or_fill_app_config(&args.config_file).await?;
+    let mut app_config = load_or_fill_app_config(&args.config_file).await?;
+    apply_overrides(&mut app_config, &args);


bit of a nit

I'm not sure you need this extra function. I understand why you would want to have it if you had more than one override, but I think we should put that in there if and only if we have more overrides.

In any case, I think it's better to keep the newly constructed app_config immutable and apply any overrides inside the apply_overrides function.

I like the clarity and readability of apply_overrides() even though it is overkill for one update. i've changed it to be a one-liner with the resulting config immutable, which I think is what you meant

richardpringle · 2026-05-28T22:16:22Z

+    fn dangerous_debug_mode_flag_enables_debug_mode() {
+        let file = write_config(&file_config()); // file has debug_mode = false
+        let args = Args {
+            config_file: Some(file.path().to_path_buf()),
+            dangerous_deploy_debug_mode: true,
+            ..empty_args()
+        };
+        let resolved = run_resolve(&args).unwrap();
+        assert!(resolved.debug_mode);
+    }


Don't need to change this, but this is why I don't like to hide logic inside functions. resolve_deploy_config Should just take Option<DeployConfig> as an argument which is the result of read_config_file. When we flatten out our logic, we don't have to do things like write an actual file and read it in just to see if the file that's read in is properly overwritten.

agree that this should be cleaned up and flattened into a pipeline of more pure functions. Won't do in this PR

richardpringle · 2026-05-28T22:18:17Z

+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]


Why did this change? I don't think there should be any Cargo.lock changes without Cargo.toml changes, right? At least they probably shouldn't be coupled with logic that doesn't use the changes.

+1 for reverting if possible

not sure why it changed, will attempt to revert

Richard fixed it in #147, so I will rebase and this should go away

- matches work and protos in mono PR #6314

- PR comments

Addressed Richard's changes and fixed Cargo.lock drift with PR #148

Copilot

Pull request overview

This PR adds Rust SDK support for TVC debug-mode app/deployment opt-ins, aligning CLI/config handling and generated proto types with the server-side intent changes.

Changes:

Adds app config and intent support for enableDebugModeDeployments.
Renames deployment debug CLI/env opt-in to the dangerous debug-mode flag/env.
Updates proto definitions and generated Rust client structs for the new TVC app field.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`tvc/src/config/deploy.rs`	Changes deployment `debugMode` config to a defaulted boolean with warning docs.
`tvc/src/config/app.rs`	Adds app-level debug-mode deployment capability config.
`tvc/src/commands/deploy/create.rs`	Adds dangerous deployment debug flag handling and forwards it to create intent.
`tvc/src/commands/app/create.rs`	Adds dangerous app debug-capability flag handling and forwards it to app create intent.
`proto/immutable/activity/v1/activity.proto`	Adds `enable_debug_mode_deployments` to `CreateTvcAppIntent`.
`proto/external/data/v1/tvc.proto`	Adds `enable_debug_mode_deployments` to `TvcApp`.
`client/src/generated/immutable.activity.v1.rs`	Regenerates Rust intent struct with the new optional field.
`client/src/generated/external.data.v1.rs`	Regenerates Rust TVC app struct with the new field.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    ///
+    /// Overrides `debugMode` in the config file when set.
+    #[arg(long, env = "TVC_DANGEROUS_DEPLOY_DEBUG_MODE")]
+    pub dangerous_deploy_debug_mode: bool,


+    /// attestation cannot succeed. Cannot be changed after app creation; setting
+    /// this true means the app's quorum key is considered permanently insecure.
+    #[arg(long, env = "TVC_DANGEROUS_ENABLE_DEBUG_MODE_DEPLOYMENTS")]
+    pub dangerous_enable_debug_mode_deployments: bool,


daniilrrr force-pushed the daniil/TVC-22-debug-mode-in-cli branch 2 times, most recently from fab61ef to 2fb1888 Compare May 27, 2026 21:48

daniilrrr changed the title ~~feat(tvc): add --dangerous_deploy_insecure to create deployment~~ feat(tvc): debug mode in app and deployment intents May 27, 2026

daniilrrr marked this pull request as ready for review May 27, 2026 22:22

daniilrrr requested a review from a team as a code owner May 27, 2026 22:22

daniilrrr requested review from emostov, narimonf and richardpringle May 27, 2026 22:23

richardpringle previously requested changes May 28, 2026

View reviewed changes

daniilrrr mentioned this pull request May 29, 2026

Default login api-url to prod #146

Merged

feat(tvc): debug mode in app and deployment intents

549b919

- matches work and protos in mono PR #6314

daniilrrr force-pushed the daniil/TVC-22-debug-mode-in-cli branch from 2fb1888 to 549b919 Compare May 30, 2026 02:16

daniilrrr added 2 commits May 29, 2026 19:41

feat(tvc): debug mode in app and deployment intents

cb84229

- PR comments

feat(tvc): debug mode in app and deployment intents

072ad42

- PR comments

daniilrrr requested a review from richardpringle May 30, 2026 03:04

daniilrrr requested a review from Copilot May 30, 2026 03:04

Copilot started reviewing on behalf of daniilrrr May 30, 2026 03:05 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Conversation

daniilrrr commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

tvc app create

tvc deploy create

Override order

Proto

Uh oh!

daniilrrr commented May 27, 2026

Uh oh!

richardpringle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

daniilrrr commented May 5, 2026 •

edited

Loading

`tvc app create`

`tvc deploy create`