feat(workflows): add workflow editor - #6248

:bot: Jude’s code review agent

Requesting changes at exact head b59375b5d71da234b26727baa9223456cf6351e3.

[P1] The editor teaches a trigger condition that cannot execute

desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx:58-72 suggests contains(text, "deploy"), but the executor registers str_contains(...) and exposes message content as trigger_text (crates/buzz-workflow/src/executor.rs:203-223,232-242,289-300). The working syntax is already used in WorkflowStepCard.tsx:378 and desktop/tests/e2e/workflows.spec.ts:260: str_contains(trigger_text, "deploy").

The editor serializes this field unchanged, and evaluation errors are only logged before the workflow is skipped (crates/buzz-workflow/src/lib.rs:904-927). A user following the product's own example can therefore save a workflow that silently never fires. Please correct the example and add a regression assertion for the visible trigger-condition guidance.

[P1] The PR's changed Desktop smoke test is deterministically failing

desktop/tests/e2e/navigation.spec.ts:139-142 scopes the trigger assertion under getByRole("dialog", { name: workflowName }), but the dialog's accessible name is Edit workflow; the workflow name is separate content. The trigger node is rendered, yet the locator cannot reach it. CI run 32201513980, job 95916252006, failed the test on the initial attempt and both retries, leaving the aggregate Desktop gate red. Independent exact-head reproduction after pnpm build:e2e failed at the same line with the same accessibility snapshot.

Please scope the locator by the stable dialog title and assert the workflow name separately, following desktop/tests/e2e/workflows.spec.ts:812-815, then rerun the required smoke gate.

Validation at this exact head and clean worktree:

• cargo test -p buzz-workflow — 156 passed, 2 ignored
• just desktop-test — 5045 passed
• just desktop-typecheck — passed
• targeted changed smoke test — failed reproducibly as described above

The reaction-trigger schema/runtime expansion was traced through crates/buzz-workflow/src/schema.rs:45-52 and crates/buzz-workflow/src/lib.rs:878-1001; no additional material relay, identity, persistence, or release-boundary issue was found in the 27-file base-to-head diff.

:bot: Jude’s code review agent

Approved at exact head 59bee36684651e3f250a26b78f1f5f49993d26e8 against base 9c2f05346fdf3f058e4c579f6eea03dbe65fcca4. The two prior blockers are cleared, and the full re-review found no remaining material issue.

• The condition-builder guidance now uses executor-valid str_contains(trigger_text, "deploy"), with visible E2E coverage.
• The direct-route smoke now derives the target workflow ID, opens /#/workflows/<id>, scopes assertions to the Edit workflow dialog, and checks the title and trigger independently.
• Dirty route and overlay transitions defer the pending action until explicit discard; keeping the editor preserves the YAML draft.
• Deletion awaits completion, blocks dismissal while pending, and preserves the editor, draft, confirmation, and error state on rejection.
• Channel ingress and its query are experiment-gated, including defensive fallback if the flag changes while the view is active.
• Updates carry the opened revision; conflict failures preserve the local draft. The one-time webhook secret stays hidden by default and remains guarded across route/close transitions.

Exact-head evidence from clean worktrees:

• cargo test -p buzz-workflow: 156 passed, 2 ignored.
• Desktop unit suite: 5,115 passed.
• Desktop typecheck and static checks passed (only unrelated pre-existing diagnostics).
• Fresh isolated Playwright runs covered the two prior blockers plus dirty transitions, deletion failure recovery, feature-disabled/enabled channel ingress, stale-save behavior, and webhook-secret behavior. The targeted sets passed; one channel-ingress timeout passed on retry and again in an isolated 2.5s rerun.
• Required GitHub checks are green at this SHA (run 32316957536).

Invalid mixed-build Playwright attempts against an occupied port were discarded rather than counted. Residual risk is limited to the single recovered timing flake and the absence of native-app/live-relay manual validation; the clean isolated reruns, browser E2E coverage, core tests, and pinned CI are sufficient for this change.

:bot: Jude’s code review agent

Conditional re-review at exact head 76ebba7b7ace1e13445744200da70ca9da231b7e against base 9c2f05346fdf3f058e4c579f6eea03dbe65fcca4. I found no remaining material code defect in the repair delta, but I am not renewing approval while required CI is red and the user-visible change still lacks native-app evidence.

The repair is internally coherent:

• Reaction selection now stores the picker’s executor-compared value verbatim—native glyph or custom :shortcode:—and preserves unsupported legacy text losslessly (desktop/src/features/workflows/ui/WorkflowEmojiField.tsx:43-93, desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx:92-108, crates/buzz-workflow/src/lib.rs:888-900,951-956).
• The channel-origin editor keeps its backing settings sheet mounted and returns to the Workflows subview without route churn (desktop/src/features/channels/ui/ChannelManagementSheet.tsx:249-281).
• Direct regression coverage exercises those contracts (desktop/tests/e2e/channels.spec.ts:2987-3088, desktop/tests/e2e/workflow-reaction-picker.spec.ts:1-205). Both deliberate mutations—closing the backing sheet before overlay open and suppressing reaction onChange—caused the relevant assertions to fail before the sources were restored.
• The six-file repair delta does not expand relay, schema, identity, persistence, or release scope.

Exact-head evidence from clean worktrees:

• Desktop static check and typecheck passed; reported diagnostics are pre-existing and outside the delta.
• Desktop unit suite passed: 5,115/5,115.
• Fresh E2E build passed.
• Two independent isolated Playwright selections passed, including a 9/9 product/adversarial set covering channel return, direct links, reaction persistence/clear/legacy/reload/narrow-window behavior, deletion rejection, and dirty-create close guarding.
• Mutation checks failed causally for both repaired behaviors; worktrees were restored clean.
• GitHub smoke shards, relay-backed E2E, Rust lint/unit, security, macOS build, and both Desktop integration shards are green at this SHA.

The remaining red Windows job is Windows Rust (x86_64-pc-windows-msvc) in run 32329719164, job 96308092910. Its sole failure is key_backup::tests::generated_passphrase_respects_word_count_and_separator (2,557 passed, 1 failed, 12 ignored). The PR does not touch desktop/src-tauri, Cargo configuration, or key backup. The unchanged test splits a generated phrase on -, while the unchanged EFF word list contains yo-yo (desktop/src-tauri/src/key_backup_tests.rs:231-247, desktop/src-tauri/src/assets/eff_short_wordlist_2_0.txt:1281), so a random draw can produce five split pieces for four selected words. The same job passed at the base SHA. This is strong evidence of an unrelated stochastic test defect, not a workflow-editor regression, but the required exact-head gate remains red and Desktop Core is still running at submission time.

Residual product risk: browser Playwright does not prove Tauri/WKWebView rendering, OS focus/input behavior, or native accessibility. No exact-head native Desktop recording, screenshots, or accessibility receipt was produced. Because this is a substantial user-visible editor, renew approval only after (1) the Windows failure is cleared by a clean rerun or repair and all required checks complete, (2) exact-head native-app behavior/accessibility evidence is attached or reviewed, and (3) the head remains unchanged.

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewing exact head 76ebba7b7ace1e13445744200da70ca9da231b7e against base 9c2f05346fdf3f058e4c579f6eea03dbe65fcca4.

[P2] Escape cannot dismiss the narrow node inspector

desktop/src/features/workflows/ui/WorkflowFormBuilder.tsx:695-711 presents the responsive inspector as a trapped aria-modal dialog, and :789-798 provides an explicit Close inspector action, but the inspector does not handle Escape. The enclosing workflow dialog owns dismissal instead.

Focused Playwright reproduction at 760×820:

1. Open Create Workflow and select a channel so the trigger inspector is visible.
2. Confirm the inspector is exposed as role="dialog" with aria-modal="true".
3. Press Escape.

The workflow editor remains visible and the inspector also remains visible; a regression assertion expecting Escape to close the inspector fails deterministically. Depending on outer-editor dirty state/focus routing, this can also enter the editor-close path instead of dismissing the topmost modal layer. Keyboard users therefore cannot perform the inspector’s visible close action with the standard dialog key.

Please make the narrow inspector own Escape (close it and stop propagation) and add an E2E asserting the first Escape closes only the inspector while leaving the workflow editor open.

Focused evidence at this exact head: the Escape regression failed as described; a control reproduction confirmed dirty pathname navigation does show the existing discard guard, and the suspected stale custom-cron mode did not reproduce. I did not duplicate the broad CI suites.

Verdict: COMMENT (conditional; not approved)

Reviewed: 2e7583bf5ad5926ca32367af9954bc79d108e42d..13491c27154d4be3ee6bf2321050261517e5e652 (exact head 13491c27154d4be3ee6bf2321050261517e5e652)

Risk: high — this is a route-addressable, responsive editor that owns destructive/dirty-state transitions, webhook-secret handoff, exact-revision persistence, channel ingress, and keyboard/focus behavior.

Findings: no material code defect found at this head. The repair in WorkflowDialog.tsx:514-521 and WorkflowFormBuilder.tsx:523-540,701-729 now consumes the first Escape to close an open node inspector before allowing the outer editor to close. The regression test in workflows.spec.ts:162-184 covers both 760px and 1280px layouts. The reviewed delta does not alter the previously traced dirty/deletion/gating/revision/secret contracts; executor guidance remains str_contains(trigger_text, "deploy").

Behavior/contracts traced:

• Narrow inspector: named modal with trapped/looped focus; first Escape closes it, restores focus to its trigger, and retains the editor/route. Second Escape closes the editor.
• Wide inspector: complementary region with the same two-stage Escape behavior.
• Channel-origin edit/discard/create-cancel returns to the still-mounted channel Workflows panel without changing the channel URL (channels.spec.ts:2987-3088).
• Reaction values (glyph/custom/legacy) round-trip losslessly; clearing removes the optional YAML key, and the shared picker remains within an 800px viewport (WorkflowEmojiField.tsx:43-93, workflow-reaction-picker.spec.ts:57-205).
• Direct-route close, stale-save preservation, exact-revision update, and webhook-secret handoff were revalidated.

Exact-head validation: clean checkout; frozen install PASS; pnpm test 5,171/5,171 PASS; pnpm typecheck PASS; pnpm check PASS with four diagnostics outside the workflow files; pnpm build:e2e PASS; targeted Playwright 11/11 PASS; focus contract 2/2 PASS; narrow reaction picker 1/1 PASS. A mutation forcing closeInspector() to return false causally failed the Escape regression; restored source passed. Windows Rust is now green, clearing the earlier stochastic-test condition. At submission time, GitHub still has Desktop Core and Desktop E2E Integration shards 1/2 and 2/2 running; all completed required jobs are green.

Manual/native evidence: responsive Chromium captures and keyboard interaction evidence exist for narrow/medium/wide layouts. There is no exact-head Tauri/WKWebView run, MP4, screenshot, or semantic/AX receipt. Browser E2E does not establish native focus delivery, WKWebView layout, or native accessibility.

Residual risk / condition: do not treat this as approval until (1) all required checks finish green, (2) exact-13491c27154d4be3ee6bf2321050261517e5e652 native Tauri/WKWebView evidence is reviewed, and (3) the head remains unchanged. Any new head invalidates this review.

— :bot: Jude’s code review agent

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-reviewed exact head 13491c27154d4be3ee6bf2321050261517e5e652 against base 2e7583bf5ad5926ca32367af9954bc79d108e42d.

The prior Escape blocker is resolved. The editor now gives an open trigger/step inspector first ownership of Escape in both responsive layouts: the first keypress clears the routed inspector pane and prevents outer-dialog dismissal; the next keypress follows the editor’s normal close/dirty-state lifecycle. The regression test covers 760px and 1280px.

I found no remaining material code defect in the repair delta. Persistence, YAML losslessness/unsupported-field handling, deletion/dirty transitions, reaction filters, exact-revision updates, and webhook-secret handling remain unchanged from the prior traced contracts. Focused exact-head Playwright reproduced the intended two-stage Escape behavior; a separate focused control verified switching a selected inspector to YAML does not leave stale Escape ownership. The worktree was clean before and after validation. All exact-head GitHub checks are green.

No approval submitted because Wes did not request approval. Residual risk is limited to the lack of an exact-head native Tauri/WKWebView accessibility run; browser E2E does not prove native focus delivery or the platform AX tree.