Repository navigation
fix(codex): drop the security-review sign-in prompt from harness defaults - #3188
Merged
Merged
Conversation
…ults Codex's harness defaults showed "Security reviews need a ChatGPT sign-in made in Buzz." and Sign in again to everyone once Codex was ready, whether or not a protection provider was installed, and whether or not a Buzz sign-in was already recorded. A sign-in that worked looked as if it had not. Remove the prompt and its button, so the dialog is as it was before the protection stack. The first-run Sign in still runs `codex.sh login` and records the review workspace. The review error message and docs no longer point at the removed button. Co-authored-by: Jitter <2b2e6415e748c35180847a37aadae06a11e30dddc76b784e7fd9354c4eb42e7a@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>
kalvinnchau
approved these changes
Nov 10, 2026
|
Can someone please explain why you’re making ChatGPT sign-in easier while Claude subscription sign-in is still removed and #2995 remains unresolved? We’ve been recommending Buzz to a lot of people and getting our clients and students to sign up and build their agents here. Then an update stops their Claude agents working unless they add an API key and pay separately from their subscription. We’re now left explaining this to people we encouraged to use Buzz, without a clear answer ourselves. Was this required by Anthropic, or was it a Buzz decision? And are you planning to bring Claude subscription sign-in back alongside API keys? We love the product, but we need some clarity here. |
damienrj
added a commit
that referenced
this pull request
Nov 10, 2026
…rminal-font-picker * 'main' of https://github.com/block/buzz-app: (168 commits) Unify Membership sharing and live roster updates (#3147) fix(activity): show one working cue per agent request (#3166) Introduce opt-in first-agent setup (#2804) fix(codex): drop the security-review sign-in prompt from harness defaults (#3188) feat(releases): publish desktop download manifest (#3154) fix(mcp): preserve current attachments across edits (#2937) fix(agents): call the Claude and Codex first-run download "the integration" (#3165) chore(goose): bump bundled goose-acp to v1.58.1 (#3161) Revert "ci: use larger GitHub runners for Rust and browser journeys (#3090)" (#3180) Show Goose's unset thinking level as Default, not Off (#3124) ci(release): publish stable and beta desktop releases from v tags (#3150) fix(messages): end the New messages hold when no repair can sample (#3169) fix(search): make Command F search the Bestie conversation (#3084) fix(plugins): keep failed update checks on the plugin's Settings row instead of a toast (#3088) Show single-agent Stop on the activity bubble (#3140) fix: support explicit hosted browser origins (#3149) fix: keep Codex tool namespace descriptions bounded (#3128) fix(messages): show "New messages" in channels longer than one page (#3071) Keep shared agent guidance generic (#3134) fix(typing): a thread reply also ends the agent's channel-level typing (#3148) ... Signed-off-by: damienrj <damien@squareup.com> # Conflicts: # src-tauri/Cargo.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codex's harness defaults (Settings → Agent setup → Harness defaults → Codex → Edit configuration) showed "Security reviews need a ChatGPT sign-in made in Buzz." and a Sign in again button to everyone once Codex was ready. That happened whether or not a protection provider was installed, and whether or not a Buzz sign-in had already recorded the review workspace. After a successful sign-in the dialog looked the same as before, so it seemed to have failed. Reopening the dialog asked again.
Public builds ship no protection provider, so this cuts the prompt at the UI level and leaves the protection runtime alone.
Before and after
Before is
409b6fa47(merge base withmain); after is this branch. Every surface except the last two is rendered in Chromium from the real components (ProviderDialogwith Codex'sProviderDialogBody, andPluginReadmewith the bundled Codex README). Codex itself is a simulated launcher (codex --version,login status,login,reviewand the app server).1. Harness defaults → Codex, ready and signed in outside Buzz
2. Harness defaults → Codex, after the first-run Sign in finishes
The dialog while it waits for the browser is unchanged. Once the sign-in finishes, before still asks for a sign-in; after does not.
3. Settings → Plugins → Codex README
4. Codex security review error (not rendered here)
This error is raised when a protected agent's Codex security review finds no Buzz sign-in. Only a protection provider plugin shows it, in that plugin's own surfaces, and none ships with Buzz, so it isn't rendered here.
5. Buzz help for agents (
docs/buzz-help.md, not a UI surface)Agents read this through the Buzz MCP help tool.
docs/agent-protection.mdgets the same wording change; it is a developer doc and isn't shown in the app.What changes
src/bundled/codex/tabs.tsx: removes the prompt, its button and thesigningInstate. The setup output area goes back tohidden={state.readiness === "ready"}, as it was before [4/5] Add protection to the Codex harness plugin #1879. This block was added only by [4/5] Add protection to the Codex harness plugin #1879; the only later change to that part oftabs.tsxwas fix(agents): call the Claude and Codex first-run download "the integration" #3165's install copy, which this leaves as is.security-review.ts) and the three docs above no longer point at Sign in again.What stays the same
codex.sh login, records the review workspace and hands the sign-in to the shared one.Follow-up
People who use a protection provider and are already signed in to Codex outside Buzz no longer have a button for the Buzz sign-in that Codex reviews need. They can sign out of Codex and then sign in from the dialog. A later change can bring the button back, shown only when a protection provider is registered and saying whether a Buzz sign-in is already recorded.
Validation
vitest run src/bundled/codex/ src/bundled/readmes.test.ts: 461 passed, 2 skipped.tsc --noEmitandbiome checkare clean (at 546ae61).🤖 Generated with Claude Code