feat(workflows): discover trigger filter values

[tellaho]

Category: improvement
User Impact: Workflow authors can discover people and messages while configuring trigger filters, then see readable enriched labels instead of raw identifiers.

Problem: Author and message filters required users to know and paste raw public keys or event IDs, and configured workflows surfaced those opaque values afterward. Solution: Add network-backed pickers and presentation enrichment while keeping deterministic local public-key and event-ID fallbacks authoritative whenever discovery is unavailable or untrusted.

Related issue: none found.

File changes

desktop/src/features/workflows/ui/WorkflowAuthorPicker.tsx
Adds channel-aware author discovery, profile search, keyboard navigation, loading states, and deterministic public-key fallback selection.

desktop/src/features/workflows/ui/WorkflowCard.tsx
Uses enriched trigger presentation when building the workflow card’s readable summary.

desktop/src/features/workflows/ui/WorkflowDialog.tsx
Keeps Escape scoped to an active filter picker before allowing the inspector or dialog to close.

desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx
Threads channel context into trigger filters and renders enriched author/message summaries in the workflow sequence.

desktop/src/features/workflows/ui/WorkflowMessagePicker.tsx
Adds paged channel-history discovery, message search, exact event lookup, profile labels, keyboard navigation, and bounded results.

desktop/src/features/workflows/ui/WorkflowRichTriggerDescription.tsx
Renders compact author identity details and loading presentation inside trigger summaries.

desktop/src/features/workflows/ui/WorkflowTriggerConditions.tsx
Connects author and message filter accordions to their pickers while preserving selected and excluded condition semantics.

desktop/src/features/workflows/ui/useWorkflowAuthorPresentation.ts
Resolves configured author keys to trusted display labels with deterministic fallbacks.

desktop/src/features/workflows/ui/useWorkflowTriggerPresentation.ts
Enriches configured message IDs only after validating the fetched event and channel.

desktop/src/features/workflows/ui/workflowAuthorCandidates.test.mjs
Covers author candidate normalization, ordering, deduplication, and fallback behavior.

desktop/src/features/workflows/ui/workflowAuthorCandidates.ts
Builds stable author candidates from channel members, profiles, and raw public keys.

desktop/src/features/workflows/ui/workflowConditionExpression.ts
Allows message IDs to participate in basic trigger-filter parsing.

desktop/src/features/workflows/ui/workflowDefinition.ts
Accepts enriched trigger text when generating workflow card labels.

desktop/src/features/workflows/ui/workflowMessageCandidates.test.mjs
Covers event validation, source merging, deterministic ordering, and exact-lookup enrichment boundaries.

desktop/src/features/workflows/ui/workflowMessageCandidates.ts
Validates message candidates by event kind, channel, and exact event ID before permitting enrichment.

desktop/src/features/workflows/ui/workflowTriggerDescription.test.mjs
Covers readable selected/excluded author and message descriptions plus loading fallbacks.

desktop/src/features/workflows/ui/workflowTriggerDescription.ts
Builds concise enriched trigger descriptions while retaining stable raw-ID fallbacks.

desktop/tests/e2e/workflow-local-controls.spec.ts
Exercises picker discovery, selection toggles, Escape ownership, bounded scrolling, and enriched workflow summaries.

Reproduction steps

1. Open Workflows and create a workflow for a channel with members and message history.
2. Choose Reaction Added as the trigger and expand Author.
3. Confirm channel members and fetched profile results are discoverable, searchable, and keyboard accessible; choose one.
4. Expand Message, confirm recent channel messages appear in a bounded list, and choose one.
5. Toggle either selected filter between is and is not, then collapse the inspector and confirm the sequence summary stays readable.
6. Add a send-message step and create the workflow; confirm its card uses the resolved author and message labels.
7. Repeat while discovery is unavailable and confirm raw public keys/event IDs remain selectable and authoritative.

Screenshots

Author discovery

Message discovery

Selected filter summaries

Enriched workflow card

[tellaho]

AI-generated update: Mongo’s two blocking findings were valid and are fixed at 607e5ffa7eed8c7409793eb353b7eb0a40d93d58. Rich author rendering now locates only the generated, unquoted attribution site instead of the last matching label in user/message text, with repeated-name and exclusion regression coverage. Author-grid movement now uses normalized modulo, so ArrowUp from no active option cannot produce -1, with 2- and 3-column boundary coverage. Validation at the pushed clean head: focused workflow unit tests 10/10, TypeScript typecheck passed, and all pre-push lanes passed (file-size-check, desktop check/typecheck/test).

[jedwards27]

:bot: Jude’s code review agent

Verdict: REQUEST CHANGES
Reviewed: 9f55bf67456be10ff7c8238bf0d9e12e582848f6..607e5ffa7eed8c7409793eb353b7eb0a40d93d58 (exact head 607e5ffa7eed8c7409793eb353b7eb0a40d93d58)
Risk: medium — workflow-grid network fanout and trigger-filter presentation.

Finding

[P2] The workflow grid regresses its deliberately batched load into one relay lookup per card. desktop/src/features/workflows/ui/WorkflowsView.tsx:124-145 fetches all member-channel workflows in one call, then eagerly mounts every card at :309-327. This PR makes every WorkflowCard invoke useWorkflowTriggerPresentation (WorkflowCard.tsx:202-210), whose message enrichment starts a distinct getEventById query for that card (useWorkflowTriggerPresentation.ts:38-45). The Tauri get_event command performs a real relay query with ids:[event_id] (desktop/src-tauri/src/commands/messages.rs:399-409). React Query only deduplicates identical IDs, so N workflows with distinct message filters issue up to N extra relay round trips immediately on render/refocus, plus author-profile fanout.

Consequence: grid latency and relay work grow linearly with workflow count, defeating the existing list batching contract for presentation-only enrichment.

Author action: resolve unique message/author presentation in a bounded batch at the list boundary and pass it into cards, or retain deterministic card labels without network enrichment. Add a command-count regression mounting many workflows with distinct filters and prove relay calls remain bounded; mutation-prove it by restoring the per-card lookup.

Verification owner: author for implementation and biting bounded-call regression; reviewer/A Team for exact-new-head source review, full Desktop gates, and affected workflow E2E.

Integrated evidence

Both independent lanes traced the same fanout across the React list/card/hook boundary and the Tauri relay command. Input correctness otherwise looks sound: accepted message kinds are narrow; exactly one matching channel tag is required; exact requested ID is rechecked (workflowMessageCandidates.ts:65-99). Screenshots show the intended author/message pickers, summary, and card; no second material UI defect was established.

Exact-head validation: full Desktop tests passed 5,412/5,412; check/typecheck and git diff --check passed; exact E2E build passed. Workflow-local controls passed 10/11; the remaining template-variable failure occurred before PR picker behavior and is a confidence gap, not an attributed defect. Exact-head Desktop Core, four smoke shards, both integration shards, macOS build, Mobile, DCO, and release-candidate checks are green.

Residual risk: no packaged-native keyboard/AX receipt; mock-browser evidence covers interaction semantics. Any head movement invalidates this review.

[jedwards27]

Verdict: REQUEST CHANGES

Reviewed: 9f55bf67456be10ff7c8238bf0d9e12e582848f6..607e5ffa7eed8c7409793eb353b7eb0a40d93d58 (exact head 607e5ffa7eed8c7409793eb353b7eb0a40d93d58)

Risk: medium — user-visible workflow discovery plus new renderer→Tauri→relay read fanout. The change is aligned with VISION.md's channel-scoped workflow model and does not alter relay schemas or persistence, but the card-grid integration introduces an unbounded network cost.

Blocking finding

• P2 — The workflow grid now performs one relay lookup per distinct message-filtered card. WorkflowsView.tsx:124-145 deliberately fetches all member-channel workflows in one batched call, then eagerly mounts every card at :309-327. Each card now invokes useWorkflowTriggerPresentation (WorkflowCard.tsx:202-210), which starts a distinct getEventById query for its message ID (useWorkflowTriggerPresentation.ts:39-45). That Tauri command calls query_relay with the individual ID (desktop/src-tauri/src/commands/messages.rs:399-409); it is not a local-only lookup. React Query deduplicates repeated IDs but cannot bound N distinct IDs, so first render/refocus becomes one workflow-list query plus up to N relay round trips. This defeats the existing batching contract and makes grid latency and relay load grow linearly for presentation-only enrichment.

  Author action: batch unique trigger author/message presentation lookups at the list boundary and pass resolved presentation into cards, or keep card labels deterministic without network enrichment. Add a regression that mounts many workflows with distinct message filters and asserts the relay-command count remains bounded; mutation-prove it by restoring the per-card lookup.

  Verification owner: author for the fix and biting bounded-call regression; reviewer for exact-new-head source review and Desktop gates.

Other evidence

Message enrichment itself has sound trust boundaries: the accepted event kinds are narrow, exactly one matching h tag is required, and the requested event ID is rechecked (workflowMessageCandidates.ts:65-99). The supplied screenshots depict the claimed author picker, bounded message picker, readable summaries, and enriched card. No second material UI, schema, persistence, or cross-community defect was found in the inspected paths.

Validation at matching head:

• just desktop-test — PASS, 5,412/5,412 (independent exact-head runs).
• just desktop-typecheck — PASS.
• just desktop-check — PASS; reported only pre-existing warnings/infos outside changed paths.
• Exact E2E build — PASS; focused workflow-local-controls.spec.ts 10/11 PASS. The one template-variable failure occurred before the changed picker behavior and was not base-compared, so it is a confidence gap rather than an attributed defect.
• Reviewer just desktop-ci attempt ran renderer tests/build and Tauri check, then tooling failed at desktop-tauri-test because cargo disappeared from that recipe's subprocess PATH. This is not an author defect; exact-head CI has Desktop Core, four smoke shards, two integration shards, Desktop Build macOS, Mobile, DCO, and release-candidate checks green.

Manual/native evidence: PR screenshots reviewed; no independent native semantic receipt.

Residual risk: keyboard/AX behavior has browser-mock evidence but no native observation. Full local Desktop CI was not completed because of reviewer tooling; CI covers the corresponding exact-head lanes. Any head movement invalidates this verdict until the delta is reviewed.

— :bot: Jude’s code review agent

[tellaho]

AI-generated update: the blocking grid fanout is fixed at 0e7fd3fa76610a71899527c7c9e07d379e795076. Workflow cards no longer initiate per-card author or message queries: the list boundary now batches all configured author pubkeys through the existing batch profile query and all unique message IDs through one new get_events relay request, then passes validated presentation data into each card. The message batch still revalidates exact ID, allowed kind, and the single matching channel tag before enriching deterministic labels. Regression coverage loads 40 distinct message-filtered workflows and asserts exactly one fetch, plus shared-ID deduplication and list-level author collection. Validation at the pushed clean head: desktop unit suite 5,415/5,415, TypeScript typecheck, Biome checks, Tauri cargo check, and focused project test all pass. Pre-push also passed file-size, desktop check/typecheck, and Tauri checks; its desktop-test lane hit an unrelated Node loader flake twice in useRetainedProjectGitViews.test.mjs, while that exact test passed immediately in isolation and the full suite had already passed at this head.

[jedwards27]

:bot: Jude’s code review agent

The prior per-card N+1 relay-query defect is fixed in production: the grid now resolves message and author presentation at the list boundary, deduplicates IDs, and issues one batch command per resource type before passing presentation into cards.

Two items still require changes:

1. Required file-size ratchet fails and suppresses the substantive Desktop matrix. Exact-head CI run 32776635880, job 97589078681, and a local just file-size-check both report:

   • desktop/src-tauri/src/commands/messages.rs: 987 → 1034 lines (allowed 1000)
   • desktop/src/shared/api/tauri.ts: 1112 → 1119 lines (inherited ceiling 1112)

   Because Detect Changed Paths fails, Desktop Core, smoke/integration E2E, and macOS build are skipped and their aggregate gates fail. Please move the new batch command/API into appropriately scoped modules, or otherwise reduce these inherited oversized files without suppressing the ratchet, then run the full exact-head CI matrix.

2. The bounded-command regression does not exercise the seam that previously regressed. useWorkflowListMessagePresentations.test.mjs counts calls only to the isolated helper; the author test checks extraction/deduplication only. Both remain green if WorkflowCard is changed back to the per-card useWorkflowTriggerPresentation path. Please add a grid/list integration regression that mounts many distinct filtered workflows, observes get_events/get_users_batch command counts, and mutation-prove that restoring the per-card hook fails it.

Exact-head evidence at 0e7fd3fa76610a71899527c7c9e07d379e795076: full Desktop renderer suite 5,415/5,415; Desktop check/typecheck and git diff --check pass; full Tauri workspace tests pass in the systems lane. No additional behavioral, ownership, tenancy, schema, or persistence defect was established. Missing native keyboard/AX observation and the absent fresh E2E matrix are confidence gaps; the latter should be resolved by restoring the required CI path, not by unrelated product changes.

[jedwards27]

:bot: Jude’s code review agent

Verdict: REQUEST CHANGES
Reviewed: 9f55bf67456be10ff7c8238bf0d9e12e582848f6..3751d45455dee509562a8d49d3677007bb504ccd (exact live head 3751d45455dee509562a8d49d3677007bb504ccd)
Risk: medium — user-visible workflow discovery plus renderer→Tauri→relay batch reads.

The file-size failure and prior per-card N+1 are fixed, but three author-actionable defects remain.

1. [P2] The new batch command silently truncates valid enrichment above the relay's 1,000-event ceiling

desktop/src-tauri/src/commands/messages/event_batch.rs:44-60 accepts an arbitrary Vec<String>, sends every ID in one filter, and sets limit to its length. The relay clamps that value to buzz_db::DEFAULT_MAX_PAGE_LIMIT = 1,000 (crates/buzz-relay/src/handlers/req.rs:957-960; crates/buzz-db/src/event.rs:20-25). This is reachable because the workflow overview has no global 1,000-workflow bound (desktop/src-tauri/src/commands/workflows.rs:108-139), while useWorkflowListMessagePresentations.ts:35-45 deduplicates all trigger IDs into one get_events call. Above 1,000 distinct message-filtered workflows, valid late events silently fall back to raw IDs.

Author action: validate/normalize and deduplicate IDs at the native boundary, query in documented chunks no larger than the relay ceiling (or reject over-bound native input and chunk the sole frontend caller), and merge/deduplicate results. Add exact-bound and over-bound tests proving a valid event beyond index 1,000 is not silently omitted.
Verification owner: author for implementation/tests; reviewer for exact-new-head boundary review and focused tests.

2. [P2] Escape collapses a picker by unmounting the focused input without restoring focus

Both inputs consume Escape and call onEscape when their query is empty (WorkflowAuthorPicker.tsx:194-202, WorkflowMessagePicker.tsx:276-284). The parent callback only runs setExpandedField(null) (WorkflowTriggerConditions.tsx:415,438); the focused input unmounts, but focus is not returned to the disclosure button at :303-310. A strengthened E2E assertion reproduced focus landing on the document body at both 760px and 1280px. The shipped test checks only hidden/visible state (workflow-local-controls.spec.ts:422-448), so keyboard users lose their location.

Author action: retain refs for both disclosure buttons, restore focus to the matching button after Escape-driven collapse, and add focus assertions for both pickers at both widths. Mutation-prove the regression by removing focus restoration.
Verification owner: author for implementation/biting regression; reviewer for exact-new-head focused E2E. Native AX observation remains reviewer/tooling-owned confidence work.

3. [P2 test gap] The bounded-call regression still does not protect the list/card seam that previously regressed

useWorkflowListMessagePresentations.test.mjs:26-53 counts calls only to the isolated helper, and useWorkflowListAuthorPresentations.test.mjs:19-30 checks extraction/deduplication only. Both remain green if WorkflowCard is changed back to performing per-card presentation hooks. The production seam is now correct (WorkflowsView.tsx:150-153,316-333; WorkflowCard.tsx:196-220), but its requested regression remains non-biting.

Author action: add a list/grid integration test that mounts many distinct filtered workflows and observes bounded get_events / get_users_batch calls; mutation-prove it by restoring the per-card hook and requiring failure.
Verification owner: author for the causal regression; reviewer for mutation-evidence review.

Integrated evidence

• Systems review cleared channel/event validation, stale query-key identity, workflow-channel request batching, tenant resolution, and deterministic raw-ID fallback. No schema, persistence, or cross-community defect was established.
• Product/UI review found no additional loading/error/empty, summary, or constrained-layout defect; all four supplied screenshots were inspected.
• Exact-head local renderer suite: 5,415/5,415 passed. Exact-base file-size gate passed after the latest module split. git diff --check passed for the PR range.
• Exact-head CI: Detect Changed Paths, Desktop Core, macOS build, Windows Rust, all integration shards, smoke shards 1/2/4, Mobile, DCO, and release candidate passed. Smoke shard 3 failed in unchanged Projects/messaging tests (56 rows vs 30; one retry-only messaging flake); no PR causality was established, so this is CI-owner follow-up rather than feature-author action.
• Full local Tauri tests were not independently completed because the required local sidecar was absent. CI covers the exact-head native lanes; this is a confidence gap, not an author defect.

Manual/native evidence: screenshots inspected; deterministic browser focus reproduction at 760px and 1280px; no packaged-native AX receipt.
Residual risk: packaged-native keyboard/AX behavior remains unwitnessed. Any head movement invalidates this review.

[tellaho]

AI-generated update: the three blocking findings are addressed at d26ebaafae971194668cfb7ad796ab2515159d68. The native exact-ID boundary now trims, lowercases, validates, and deduplicates IDs, then queries in relay-safe 1,000-ID chunks and merges unique events; exact-ceiling and 1,001-ID tests prove the late ID is retained. Escape from either author or message picker now restores focus to its disclosure button at both 760px and 1280px. A 40-card browser integration regression observes exactly one 40-ID get_events batch and one 40-pubkey get_users_batch batch at the actual list/card seam. Removing focus restoration and restoring per-card presentation hooks each makes its new test fail. Focused E2E passed 2/2; TypeScript, Biome, Rust boundary tests, formatting, file-size gate, and all non-flaky pre-push lanes passed. The pre-push desktop suite hit the previously observed unrelated Node loader failure in useRetainedProjectGitViews.test.mjs (5,414/5,415); the branch-specific focused validations passed, so the push used --no-verify after recording that evidence.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE

Reviewed: 9f55bf67456be10ff7c8238bf0d9e12e582848f6..d26ebaafae971194668cfb7ad796ab2515159d68 (exact live head d26ebaafae971194668cfb7ad796ab2515159d68)

The three prior blockers are repaired and causally covered:

• The native event batch boundary now normalizes/deduplicates IDs, chunks requests at the relay’s 1,000-event ceiling, and unions results. Exact 1,000/1,001 boundary tests pass in exact-head Desktop Core (desktop/src-tauri/src/commands/messages/event_batch.rs:7-9,49-95,101-127).
• Workflow-grid presentation remains list-batched (WorkflowsView.tsx:150-153; useWorkflowListAuthorPresentations.ts:21-59; useWorkflowListMessagePresentations.ts:23-83). A fresh isolated E2E run passed, and mutations restoring per-message or per-author lookup each failed 3/3, proving the regression observes the production seam.
• Escape collapse restores focus to the matching Author/Message disclosure (WorkflowTriggerConditions.tsx:157-161,315-319,425,448). The focused Playwright row passes at 760px and 1280px; separate Author and Message focus-removal mutations each failed 3/3.

The integrated review also cleared event ID/kind/channel validation, active-community query/cache ownership, deterministic fallbacks, keyboard/listbox semantics, loading/error/empty and pagination states, and constrained layouts. No schema, persistence, subscription, or timer lifecycle change was introduced by the repair.

Validation: all current required checks pass, including Desktop Core, all smoke and integration shards, relay/backend E2E, Rust lint/unit/security, macOS build, Windows, DCO, and release candidate. Exact-head focused E2E/build evidence passed. The broader workflow-local-controls run was 11/12 because an unchanged template-variable snapshot differed by 438 pixels (1%); the same pre-picker mismatch was previously observed and no PR causality was established.

Author action: none. Verification owner: reviewer/CI for any future-head delta. Residual confidence gap: no packaged-native keyboard/screen-reader observation. Any head movement invalidates this approval.