Allow bot owners to remove their agents from any channel#284
Merged
Conversation
Extends remove_member authorization to check agent_owner_pubkey: if the actor owns the target bot (via agent_owner_pubkey), they can remove it from any channel they're both members of, even without owner/admin role. Updated both the DB layer (remove_member) and the NIP-29 kind:9001 validation (validate_admin_event) with the same agent-owner check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add isMyBot() helper to useClassifiedMembers that checks if a member is in the current user's managedAgentPubkeys set. Use it in MembersSidebar so the "Remove" button appears for bots the user owns, regardless of their channel role. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add comment explaining why is_agent_owner queries pool instead of tx (agent_owner_pubkey is immutable, set at mint) - Guard isMyBot condition with selfMember check so non-members don't see a Remove button that the relay would reject Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace is_agent_owner() indirect query via get_agent_channel_policy() with a direct agent_owner_pubkey comparison query - Fix stale docstring on remove_member re: transaction boundaries - Add comment explaining non-member bot owners can't remove bots - Add clarifying comment on frontend canRemoveMember logic Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tlongwell-block
approved these changes
Apr 9, 2026
tlongwell-block
added a commit
that referenced
this pull request
Apr 11, 2026
…ona-migration * origin/main: feat(desktop): add Pulse social notes surface (#296) Fix flaky desktop smoke tests (#294) Add agent lifecycle controls to channel members sidebar (#291) Update nest_agents.md tagging info (#292) feat: add Sprout nest — persistent agent workspace at ~/.sprout (#290) Fix auth and SSRF vulns (#261) Add per-agent MCP toolset configuration to agent setup (#279) feat(desktop): team & persona import/edit flows (#288) Remove menu item subtitles and fix persona card overflow (#289) feat: Phase 1 video upload support (Blossom-compliant-ish) (#285) Add inline subtitles to menu items and field descriptions (#276) Improve ephemeral channel affordances and hide archived sidebar rows (#286) Fix @mention search to use word-boundary prefix matching (#278) Allow bot owners to remove their agents from any channel (#284) [codex] Polish agent selectors and settings layout (#283) # Conflicts: # desktop/scripts/check-file-sizes.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
is_agent_owner()DB helper that checks if a user is the owner of a bot agent (viaagent_owner_pubkey, set immutably at token mint)isMyBot()frontend helper and updatescanRemoveMemberlogic in MembersSidebar so bot owners see the Remove button for their agents regardless of channel roleMotivation
Users can add their bots to other people's channels but previously couldn't remove them unless they were a channel owner/admin. This aligns with the VISION.md principle of letting users manage their own agents.
Test plan
channel.rscover happy path + negative case🤖 Generated with Claude Code