fix(mobile): offer role controls for agents by brow · Pull Request #9475 · block/buzz

brow · 2026-11-13T17:49:25Z

Mobile hides every role control for a channel member whose role is bot. On relays running #8494 bot role from owner, any agent with a recorded owner is reported as bot whenever it holds an ordinary role. So if an admin demotes an owned agent from admin to member, the refreshed roster says bot and mobile no longer offers "Make channel admin": the demotion can't be undone from mobile.

This change gives agents the same role controls as people, matching desktop:

The member profile actions offer "Make channel admin" for bot members. "Change to member" still appears only for admins and guests, so an agent that is already ordinary isn't offered it.
The members sheet shows the Role selector for agents, with Member selected for bot (the two are permission-equivalent). The row label still reads "Agent".

Rollout: ship this in a mobile release before relays with #8494 deploy.

Review discussion: buzz-mobile-tomb-review-work thread.

Regressions

None expected. The relay already accepts admin, member and guest for agents (owned agents can hold admin today), so the newly shown actions submit role changes it accepts. On current relays an agent added as bot now also shows these controls; tapping Member on its selector is a no-op because Member is already selected.

Validation

Changed tests: the profile-actions role table now expects "Make channel admin" for bot; the promote, demote journey continues with the refreshed role coming back as bot and expects promotion to be offered again; the members-sheet agent row expects the Role selector with Member selected.

Full mobile suite: 4,828 passed, 70 skipped, 1 failed. The failure, video_controls_test.dart "iOS timeline requests native Liquid Glass and fades with the toolbar", is unrelated media-viewer code; it passed when rerun on its own, and the pre-push hook's full mobile run passed.

Simulator check against a live relay: an agent added with the bot role, viewed by the channel owner in its member profile.

Before	After

Relays that derive the bot label from a recorded owner report an owned agent as bot whenever it holds an ordinary role, so demoting it from admin hid the controls needed to promote it again. Show the same role actions for agents as for people, with Member selected for bot, matching desktop. Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz> Signed-off-by: Tom Brow <[email protected]>

brow · 2026-11-13T17:49:37Z

@codex review

chatgpt-codex-connector · 2026-11-13T17:49:54Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T18:29:15.569837Z	`1e9628d`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-13T17:51:20Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 1e9628d6ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-11-13T18:29:52Z

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

Exact PR diff: 1fb33e4545660196d4c863daf70e1d3bc245f164...1e9628d6efcea9372313aea20b6e052437908af1

Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings in the authorized PR range after tracing role controls through signed submission, relay authorization, and database updates.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

No additional limitations were reported.

_{Generated by Codex Security Review |

Requested by: @brow |

Workflow run}

kazemek21

Kyle reviewed the PR and the Nexus review-tracker notes and approved with no comments.

Posted by Codex (gpt-6.1-sol) on behalf of kylez

* origin/main: (24 commits) docs(readme): point desktop readers at block/buzz-app and describe where each client lives (#9493) test(cli,db): freeze the assertion test clock and give pool release tests a test-lane acquire budget (#9442) test(desktop): unmount every TerminalSubstrate tree before the window closes (#9440) fix(mobile): drop the iOS share extension from the build until it's signed (#9489) chore(release): release Buzz Desktop version 0.5.30 (#9491) perf(mobile): parse each event's thread reference once (#9460) perf(mobile): load only the directory when search opens (#9466) perf(mobile): stop rebuilding Home's channel list when a route covers it (#9459) perf(mobile): ask typing subscriptions only for the typing window (#9454) perf(mobile): skip avatar URL parsing for non-HTTP URLs (#9448) perf(mobile): download the identity archive list only when it changed (#9445) perf(mobile): don't treat a Control Center pull as a resume (#9443) fix(mobile): keep a superseded roster read out of the offline snapshot (#9452) perf(mobile): read channel bot roles from the member list (#9451) perf(mobile): read Activity once per reconnect (#9455) fix(mobile): offer role controls for agents (#9475) perf(mobile): stop rebuilding the native nav bar on every scrolled frame (#9458) perf(mobile): keep verified-name batches open as people are added (#9450) perf(mobile): read only changed custom emoji sets on reconnect (#9446) perf(mobile): keep latest-message times on a directory load (#9457) ... Signed-off-by: Will Pfleger <[email protected]> # Conflicts: # crates/buzz-cli/src/desktop_provider.rs

…eaction-recipients * origin/main: (111 commits) perf(acp): avoid repeated observer batch serialization (#9483) docs(readme): point desktop readers at block/buzz-app and describe where each client lives (#9493) test(cli,db): freeze the assertion test clock and give pool release tests a test-lane acquire budget (#9442) test(desktop): unmount every TerminalSubstrate tree before the window closes (#9440) fix(mobile): drop the iOS share extension from the build until it's signed (#9489) chore(release): release Buzz Desktop version 0.5.30 (#9491) perf(mobile): parse each event's thread reference once (#9460) perf(mobile): load only the directory when search opens (#9466) perf(mobile): stop rebuilding Home's channel list when a route covers it (#9459) perf(mobile): ask typing subscriptions only for the typing window (#9454) perf(mobile): skip avatar URL parsing for non-HTTP URLs (#9448) perf(mobile): download the identity archive list only when it changed (#9445) perf(mobile): don't treat a Control Center pull as a resume (#9443) fix(mobile): keep a superseded roster read out of the offline snapshot (#9452) perf(mobile): read channel bot roles from the member list (#9451) perf(mobile): read Activity once per reconnect (#9455) fix(mobile): offer role controls for agents (#9475) perf(mobile): stop rebuilding the native nav bar on every scrolled frame (#9458) perf(mobile): keep verified-name batches open as people are added (#9450) perf(mobile): read only changed custom emoji sets on reconnect (#9446) ... Signed-off-by: Matthew Boston <[email protected]>

brow mentioned this pull request Nov 13, 2026

feat(relay): compute the bot role from the recorded agent owner #8494

Open

brow marked this pull request as ready for review November 13, 2026 18:27

brow requested a review from a team as a code owner November 13, 2026 18:27

brow deployed to codex-review November 13, 2026 18:28 — with GitHub Actions Active

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 13, 2026

kazemek21 approved these changes Nov 13, 2026

View reviewed changes

brow merged commit 04af708 into main Nov 13, 2026
60 checks passed

brow deleted the mobile-agent-role-controls branch November 13, 2026 22:05

Navigation Menu

Repository navigation

fix(mobile): offer role controls for agents - #9475

fix(mobile): offer role controls for agents#9475
brow merged 1 commit into
mainfrom
mobile-agent-role-controls

brow commented Nov 13, 2026 •

edited

Loading

Uh oh!

brow commented Nov 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026

Uh oh!

kazemek21 left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

brow commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regressions

Validation

Uh oh!

brow commented Nov 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026

🔐 Codex Security Review

Review Summary

Findings

Notes

Uh oh!

kazemek21 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brow commented Nov 13, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 13, 2026 •

edited

Loading