Repository navigation
Enable mobile huddles with Codex agents - #9269
Conversation
Co-authored-by: Terp <5856f6900e8e0a4e0ea1f4f8d2ee33e4753d2119bc122f94ecafc660b46c0511@buzz.block.builderlab.xyz> Signed-off-by: kenny lopez <[email protected]>
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
GitHub Actions
Inactive
github-actions
Bot
added
the
codex-security-review-current
🔐 Codex Security Review
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a1a950e42
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jedwards27
left a comment
jedwards27
left a comment
There was a problem hiding this comment.
🤖 :bot: Jude’s code review agent
Verdict: REQUEST CHANGES. Reviewed 65e864301d2e51a93003816b45e77cae96be901f...4a1a950e4274fb36913569c29296dfdbf2942d35, with companion buzz-app #3048 at c16ab618a23252362d3d30bf2b02d9fd23f0534f. Risk: high — cross-device voice admission, lifecycle and user-visible recovery. Source-traced findings below were not reproduced on live devices.
Blocking findings
-
[P2] Replacements omit the Codex agent. Both recovery actions start a replacement with only
parentChannelId(huddle_sheet.dart:412–416,449–457, 562–570). Since the controller invites only when given the key, the replacement opens without the agent. Re-resolve and invite an eligible agent on both recovery paths; add production-journey tests. Also identified in the automated review. -
[P2] Eligibility is stale while connected. The new provider has no dependency on desktop inventory updates, and confirmation reads that same cached future. A desktop-added Codex agent can remain unavailable, or a removed/runtime-changed agent can remain offered. Refresh discovery on remote changes and revalidate at admission; test add, remove and runtime change without a reconnect. Also identified in the automated review.
-
[P2] An unavailable agent appears to have joined. The confirmation promises the agent will join, but the call stage includes invited bots from room membership, not actual audio presence. The paired host only seats a running, local, unprotected agent (dm-agent.ts:35–45) and reports remote seat failures on desktop, not the phone. A caller can speak into an empty room with no indication why the agent is silent. Distinguish invited/connecting from connected and provide bounded, actionable unavailable/recovery feedback on the phone; test stopped or failed host and later successful connection.
-
[P2] Joining an existing uninvited room cannot seat the agent. The header joins an active room without inviting the peer. A desktop room started while the agent was stopped has no invitation (service.ts:275–280); starting the agent afterward does not bypass the room-membership gate. Offer an explicit authorized invitation or a clear new-call route, without silently adding a listener to an existing call; test this journey.
-
[P2] One owner device can end another's Codex Huddle. The mobile leave path counts distinct human room members, not live audio admissions (52–70). If the same owner joins on two devices, either mobile device can publish the end and archive the room while the other remains connected, causing the host to retire its voice. The heuristic predates this diff, but the newly enabled Codex-DM flow contradicts the companion's per-device admission contract. Preserve the room and voice while another owner admission remains; add a production-path two-device leave regression.
Verification owner for blockers: author and paired-integration reviewer on fixed heads.
Evidence and residual risk
- Reviewed the changed mobile diff, inventory/ownership and retry paths, room creation and membership, plus companion host selection, bridge and native validation.
VISION.md,VISION_MOBILE.mdandTESTING.mddescribe the applicable voice, mobile and test contracts. Minimalness 9/10; elegance 8/10 (start/recovery paths diverge; share eligibility handling); correctness 6/10 (the failures above). - CI run 42552193871 is bound to mobile head
4a1a950: mobile checks, all three mobile test shards, Android and Swift-native jobs passed; Flutter flake job was still running at review time. Reviewers reportedgit diff --checkandjust file-size-checkpassing on clean pinned worktrees; same-shell HEAD proof for those commands was not supplied. - The new widget test overrides eligibility and asserts the local participant, not a connected agent. No local Flutter suite, simulator accessibility pass or live phone-to-desktop audio was run for this review. Author action for missing reviewer observation alone: none. Verification owner: reviewer/tooling and CI/release gates; human trial remains a separate repository readiness step.
- A possible cross-pod ordering race deserves a paired host/relay test: 48101 fan-out precedes owner-pod
CommitConfirmed, and the host fails a seat whose initial roster lacks the owner. A reachable end-to-end schedule with no already-committed owner has not been demonstrated. Author action: none established; verification owner: paired host/relay reviewer. - The companion automated non-UUID finding is not supported by the traced path: voice.ts generates a separate UUID for bridge.open; the
remote:…value is a different internal call identity.
Co-authored-by: Terp <5856f6900e8e0a4e0ea1f4f8d2ee33e4753d2119bc122f94ecafc660b46c0511@buzz.block.builderlab.xyz> Signed-off-by: kenny lopez <[email protected]>
github-actions
Bot
removed
the
codex-security-review-current
GitHub Actions
Inactive
|
🤖 Addressed all five blocking findings in 75a57a4:
Validated: 4,559 mobile tests (67 skipped), 4 unconfigured-push tests and 27 native crypto tests passed through push hooks; analysis, formatting, file-size checks and independent source review. Live phone-to-desktop audio remains unverified. PR review status preserved. |
github-actions
Bot
added
the
codex-security-review-current
Targets `mobile-codex-huddle-20261108` ([#9269](#9269)). Opening a one-to-one agent DM already loads the owner's agent directory (`ownedAgentDirectoryProvider`, used by the compose bar and mention candidates). It reads the kind 30177 inventory, verifies each registration and profile, and keeps each agent's `runtime`. The Codex voice check added a second and third inventory read on top of that: `loadMeAgentInventory` with a runtime filter, then a forced refresh of `meAssistantsProvider`, which reads the inventory again plus profiles and the archive list. Each one ran again on every reconnect. This derives Codex voice eligibility from the directory that's already loaded, minus desktop's known-archived agents (the cached `meArchivedAgentsProvider`, as before). Voice adds no inventory read. - The live kind 30177 subscription now invalidates the shared directory, so a desktop runtime change still reaches the phone without a reconnect, and mentions pick it up too. - Call start, recovery and the invite confirmation still reread fresh evidence: they invalidate the directory and wait for it. - The `runtime:` filter on `loadMeAgentInventory` has no caller left, so it's removed and that file matches `main` again. ### Validation - Changed test: the voice discovery test now reads through the real directory provider and asserts the DM's directory and voice eligibility share one inventory read, then still follows desktop add, runtime change and removal without reconnect. The test for the removed runtime filter is deleted. - Full `mobile` test suite and `flutter analyze` pass. - Not run in the app: a real Codex huddle needs a desktop hosting the agent. This only changes where eligibility is read from; the huddle widget journeys in `channel_detail_page_test.dart` still pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Tom Brow <[email protected]> Co-authored-by: Tom Brow <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>
github-actions
Bot
removed
the
codex-security-review-current
GitHub Actions
Error
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59726dabbf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| FlutterError.reportError( | ||
| FlutterErrorDetails(exception: error, stack: stack), | ||
| ); |
There was a problem hiding this comment.
If the live inventory subscription throws while the relay remains connected, this new catch path only reports the error and leaves _voiceInventoryChangesProvider successfully initialized without a subscription or retry. Subsequent kind:30177 additions/removals are then missed indefinitely, so newly imported Codex agents do not gain the Huddle action and removed agents remain displayed until a reconnect or unrelated refresh. The new evidence is this swallowed subscription failure path; propagate the failure or schedule a bounded retry.
AGENTS.md reference: AGENTS.md:L222-L229
Useful? React with 👍 / 👎.
GitHub Actions
Error
Activate desktop-hosted Codex voice when its owner joins the agent’s DM huddle from mobile. Reuses the existing voice connection and owner-only audio checks without opening the desktop microphone; handles device departures, rejoins, and relay generation changes. Requires the companion mobile change in block/buzz#9269. Desktop and the Codex agent must remain running. Validated: 240 huddle tests, TypeScript, lint, independent review, and push hooks. Live phone-to-desktop audio and human trial remain pending; remote voice failures currently appear on desktop. Signed-off-by: klopez4212 <[email protected]> Co-authored-by: Terp <5856f6900e8e0a4e0ea1f4f8d2ee33e4753d2119bc122f94ecafc660b46c0511@buzz.block.builderlab.xyz>
…-profile * origin/main: (307 commits) fix: inline ARM64 atomics in Sprig image build (#9291) fix(mobile): show observed thread replies in Activity (#9286) Enable mobile huddles with Codex agents (#9269) fix(mobile): read mentions taller than the screen (#9243) test(relay): give every media e2e upload its own blob hash (#9272) Add invite preview video and fallback poster (#9282) NEXUS-4336: Wait for desktop-provider socket ownership proof (#9270) fix: unblock image audit with patched MCP SDK (#9287) feat(ci): allow admin dispatch of desktop candidate validation (#9288) feat(mobile): tag the reacted-to message author on reactions (#9141) fix(mobile): steady New DM picker rows and animate picks (#9249) perf(mobile): keep remote images on disk and show small ones as thumbnails (#9158) fix(relay): deliver slow cross-node events late instead of closing their recipients (#9235) fix(mobile): read only shown events from filtered Activity rows (#9215) fix(mobile): show the channel name as the notification subtitle (#9173) fix(mobile): keep Home's header clean under sheets (#9152) fix(mobile): show already-loaded custom emoji in the iOS reactions sheet (#9150) mobile: add follow and remind actions to inbox row menu (#9142) fix(mobile): start no threads in Solo chats (#9123) mobile: persist user profiles so names and avatars render on launch (#9116) ... Signed-off-by: Franco Sola <[email protected]> # Conflicts: # docs/nips/NIP-FA.md # docs/nips/NIP-FI.md
…e-mode * origin/main: (36 commits) feat(relay): let an operator mint invites for a community owner or admin (#9265) fix: inline ARM64 atomics in Sprig image build (#9291) fix(mobile): show observed thread replies in Activity (#9286) Enable mobile huddles with Codex agents (#9269) fix(mobile): read mentions taller than the screen (#9243) test(relay): give every media e2e upload its own blob hash (#9272) Add invite preview video and fallback poster (#9282) NEXUS-4336: Wait for desktop-provider socket ownership proof (#9270) fix: unblock image audit with patched MCP SDK (#9287) feat(ci): allow admin dispatch of desktop candidate validation (#9288) feat(mobile): tag the reacted-to message author on reactions (#9141) fix(mobile): steady New DM picker rows and animate picks (#9249) perf(mobile): keep remote images on disk and show small ones as thumbnails (#9158) fix(relay): deliver slow cross-node events late instead of closing their recipients (#9235) fix(mobile): read only shown events from filtered Activity rows (#9215) fix(mobile): show the channel name as the notification subtitle (#9173) fix(mobile): keep Home's header clean under sheets (#9152) fix(mobile): show already-loaded custom emoji in the iOS reactions sheet (#9150) mobile: add follow and remind actions to inbox row menu (#9142) fix(mobile): start no threads in Solo chats (#9123) ... Signed-off-by: Will Pfleger <[email protected]>
Show the Huddle action in owned Codex agent DMs and invite the agent before connecting audio. Revalidate eligibility on starts/recovery, ask before inviting into an existing call, and distinguish pending invitations from connected audio peers with actionable timeout feedback. DM hangup leaves shared room cleanup to the relay so another owner device stays connected.
Pairs with block/buzz-app#3048. Desktop and the Codex agent must remain running.
Validated: 4,559 mobile tests, analysis, formatting, push hooks, and independent source review. Live phone-to-desktop audio and human trial remain pending.