fix(cli): apply --channel to the root filter in messages thread

[BradGroux]

Note: This is a replacement for PR #6042, which was accidentally closed when branches were force-pushed after a commit identity rewrite. The changes are identical, rebased onto the latest main.

Summary

cmd_get_thread validates --channel and applies it to the reply filter, but the root filter (the ids lookup for the thread root event itself) has no #h tag. So messages thread --channel A --event E returns event E even when E lives in a different channel — the relay's ID lookup is unscoped and returns any event matching the 64-hex ID regardless of channel.

The fix adds "#h": [channel_id] to the root filter, scoping the ID lookup to the same channel the reply filter already restricts. One line.

The root filter intentionally keeps no kinds restriction: a thread root can be any kind (e.g. a kind:7 reaction that starts a sub-thread), and the reply filter's kind list should not constrain what the root lookup can return. The issue notes this asymmetry; it is preserved as-is.

Related issue

Closes #6006

Testing

Full buzz-cli test suite: 349 passed, 0 failed. Clippy clean. Rustfmt clean.

The fix is a single-field addition to the root filter JSON. The existing test suite covers the validate-and-build path; the filter construction itself is verified by code inspection against the issue's reproduction (asking channel A for an event in channel B previously returned the event at rc=0; now the #h tag scopes the lookup to channel A).

[BradGroux]

This is a replacement for #6042, which was accidentally closed when branches were force-pushed after a commit identity rewrite. Prior review comments and feedback are preserved on the old PR:

#6042

[BradGroux]

Rebased onto the latest main (was 36 commits behind). The branch applied cleanly — the root filter in cmd_get_thread still lacks the #h channel scoping on current main, so this fix is still needed.

No review comments on this PR. CI will verify the build and test gate.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is f038cbbb0d4092a72ffd93f17916f84d2b39bb43...43fc3aad23190bd1d8f4889a833b8c3c07dca5cf.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 43fc3aad23190bd1d8f4889a833b8c3c07dca5cf to authorize a new review.
Any previous review applies only to its recorded range.

[BradGroux]

Rebased onto the latest main (was 62 commits behind at f249710, now at 00e61ea). The branch applies cleanly with all tests passing.

Still-needed assessment: No upstream commits in the 62-commit window address the same issue. This PR remains needed.

Review requests: buzz-oss-team review request is active from the previous pass.

[BradGroux]

Rebased onto current block:main (2af9773d6) — 38 new commits since the last rebase pass (Aug 29, 00e61eafa). Rebased cleanly with no conflicts.

Still needed: Checked all 38 new upstream commits for overlap with this PR's topic. None of the upstream changes address the issue this PR fixes. The PR remains relevant.

Verification:

• Branch is 0 commits behind block:main, mergeable on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits

[BradGroux]

Rebase and review — 2026-09-03

Base commit: 752cbfc03 (latest main)
Mergeable: Yes
Conflict resolution: messages.rs test imports — merged both HEAD's new imports (cmd_send_message, format_events) and the PR's build_thread_root_filter.

Accuracy review: The root filter in messages thread still does not apply --channel to the root event lookup.
Continued relevance: Still needed.

[BradGroux]

Rebase and review update — Sep 3, 2026

Rebased onto latest main (88687876f). No conflicts.

Accuracy review: Main already includes "#h": [channel_id] in the root filter for messages thread, so the original channel-scoping bug is no longer present. However, the PR also extracts build_thread_root_filter as a pure function with a regression test asserting the channel constraint is present, and corrects an inaccurate comment about which filter restricts kinds. These code-quality improvements are still valid.

Mergeable status: Confirmed MERGEABLE on GitHub after force-push.

[BradGroux]

Rebase pass — Sep 5, 2025

Rebased onto current upstream main (f038cbbb0). Main moved 62 commits since the Sep 2 rebase pass (2af9773d6).

Rebase result

Conflict resolved in crates/buzz-cli/src/commands/messages.rs (test import list — upstream added format_events import, PR added build_thread_root_filter import; merged both).

Still-needed assessment

Checked all 62 new main commits for overlap with this PR's topic. None obsoleted:

• Verify ACP relay events before prompt routing #7010 (verify ACP relay events before prompt routing) adds signature verification to relay event handling — does not address SubscribeMode filtering (fix(acp): stop SubscribeMode::All from subscribing to every event kind #6646) or mention latency tracing (feat(acp): show where reply time goes after an agent @mention #6637)
• fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation #7337 (bound busy-owner hold to prevent cross-channel starvation) changes ACP dispatch scheduling — does not add latency observers (feat(acp): show where reply time goes after an agent @mention #6637)
• fix(acp): rename system tag to agent-instructions #7332 (rename system tag to agent-instructions) renames prompt boundary tags — does not affect MCP server wiring (feat(acp): accept extra MCP servers via BUZZ_ACP_EXTRA_MCP_COMMANDS #6651, fix(acp): add BUZZ_ACP_AGENT_ARGS_JSON for lossless structured argument transport #6654, fix(desktop): wire MCP server for Claude Code agents #6658) or agent args transport (fix(acp): add BUZZ_ACP_AGENT_ARGS_JSON for lossless structured argument transport #6654)
• perf(desktop): publish mention sends before waking agents #7154 (publish mention sends before waking agents) is a desktop send-path optimization — does not address ACP latency observability (feat(acp): show where reply time goes after an agent @mention #6637)
• feat(agents): harness-agnostic effort write path and spawn bridge #4625 (harness-agnostic effort write path) extracts runtime catalog to catalog.rs and adds effort normalization — does not fix Claude MCP wiring (fix(desktop): wire MCP server for Claude Code agents #6658, still has mcp_command: None upstream), Goose provider URL translation (fix(desktop): let Goose agents use OpenAI-compatible provider URLs #6641), or capability readiness manifests (feat(agent): show readiness and capabilities before delegation #6643)
• feat(cli): add buzz gifs command group and NIP-30 emoji tags on messages #7259 (buzz gifs command group and NIP-30 emoji tags) adds emoji tag support to build_message and new CLI commands — does not address NUL byte validation (fix(cli): reject NUL bytes in message content instead of silently truncating #6653), thread root filter (fix(cli): apply --channel to the root filter in messages thread #6655), or include_aux (fix(cli): plumb include_aux so messages thread/get can see reactions #6656)
• refactor(relay): extract NIP-29 membership authorization #7285 (extract NIP-29 membership authorization) refactors relay authz — does not affect multi-channel HTTP query (fix(relay): stop multi-channel HTTP query from narrowing to one UUID #6648)
• fix(desktop): authorize remote mentions at publication #7124, fix(desktop): bind duplicate mention selections to exact recipients #7133, fix(desktop): restore mention chip identity icons #7338 (mention chip identity, duplicate selections, authorize remote mentions) are desktop mention UI changes — do not affect SDK self-targeted p tags (fix(sdk): preserve self-targeted p tags in add-member, remove-member, and DM builders #6657)

Verification

• PR confirmed MERGEABLE on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits
• Review requests to buzz-oss-team still active from the Aug 24 recovery pass