fix(workflows): use the bracket-aware scanner for the multi-arg filter check

Review catch: my hand-rolled `_has_top_level_comma` was quote-aware but NOT
bracket-aware, so it treated the comma inside a list literal as an argument
separator. The evaluator supports list literals, so this rejected
expressions that work on main today:

  main:        {{ inputs.missing | default([1, 2]) }} -> [1, 2]
  with my PR:  ValueError: filter 'default' used in an unsupported form

That is a breaking change, not a fix.

Drop the helper and use `_find_top_level`, the same scanner the operator
splitting already uses — it skips commas inside quotes AND inside nested
brackets. Verified:

  default([1, 2])            -> [1, 2]      (restored)
  default([1,2])             -> [1, 2]      (restored)
  default([])                -> []          (restored)
  join(", ") / default("a, b") -> unchanged
  default(1, 2)              -> rejected    (the actual bug)
  join(",", "extra")         -> rejected
  default([1,2], 3)          -> rejected    (real 2nd arg after a literal)

Dict literals resolve to None both before and after, matching main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/workflows/expressions.py

@@ -366,25 +366,6 @@ def _find_top_level(text: str, token: str) -> int:
     return -1
 
 
-def _has_top_level_comma(text: str) -> bool:
-    """True when *text* has a comma outside any quoted span.
-
-    Every filter in this subset takes exactly one argument, but that argument may
-    itself contain a comma -- ``join(", ")`` and ``default("a, b")`` are both
-    valid -- so the check has to be quote-aware rather than a plain ``split``.
-    """
-    quote = ""
-    for ch in text:
-        if quote:
-            if ch == quote:
-                quote = ""
-        elif ch in ("'", '"'):
-            quote = ch
-        elif ch == ",":
-            return True
-    return False
-
-
 def _apply_filter(value: Any, filter_expr: str, namespace: dict[str, Any]) -> Any:
     """Apply a single pipe filter segment to *value*.
 
@@ -426,8 +407,14 @@ def _apply_filter(value: Any, filter_expr: str, namespace: dict[str, Any]) -> An
     # None (silently wrong) and ``join(",", "extra")`` raise a message blaming
     # the separator rather than the extra argument. Fall through to the
     # unsupported-form error below instead, which names the filter and lists
-    # the accepted forms. The check is quote-aware so ``join(", ")`` still works.
-    if filter_match and _has_top_level_comma(filter_match.group(2)):
+    # the accepted forms.
+    #
+    # Use ``_find_top_level``, the same scanner the operator splitting uses: it
+    # skips commas inside quotes AND inside nested brackets, so a single
+    # argument that happens to contain a comma still works -- ``join(", ")``,
+    # ``default("a, b")``, and the list/dict literals the evaluator supports
+    # (``default([1, 2])``, ``default({"a": 1, "b": 2})``).
+    if filter_match and _find_top_level(filter_match.group(2), ",") != -1:
         filter_match = None
     if filter_match:
         fname = filter_match.group(1)

tests/test_workflows.py

@@ -735,10 +735,16 @@ def test_multi_argument_filter_call_fails_loudly(self):
             )
 
     def test_single_argument_containing_a_comma_still_works(self):
-        """The multi-argument check must be quote-aware.
+        """The multi-argument check must skip quotes AND nested brackets.
 
-        `join(", ")` and `default("a, b")` are single arguments that happen to
-        contain a comma, so a plain split would reject valid expressions.
+        A single argument may legitimately contain a comma in two ways:
+
+        * inside quotes — `join(", ")`, `default("a, b")`
+        * inside a bracketed literal — `default([1, 2])`, which the expression
+          evaluator supports and which resolves to a real list
+
+        so the check uses `_find_top_level` (the same scanner the operator
+        splitting uses) rather than a quote-only scan.
         """
         from specify_cli.workflows.expressions import evaluate_expression
         from specify_cli.workflows.base import StepContext
@@ -750,6 +756,25 @@ def test_single_argument_containing_a_comma_still_works(self):
             evaluate_expression('{{ inputs.missing | default("a, b") }}', ctx)
             == "a, b"
         )
+        # List literals: a comma inside brackets is not an argument separator.
+        assert evaluate_expression(
+            "{{ inputs.missing | default([1, 2]) }}", ctx
+        ) == [1, 2]
+        assert evaluate_expression(
+            "{{ inputs.missing | default([1,2]) }}", ctx
+        ) == [1, 2]
+        assert evaluate_expression("{{ inputs.missing | default([]) }}", ctx) == []
+
+    def test_multi_argument_after_a_literal_is_still_rejected(self):
+        """A real second argument is rejected even when the first is a literal."""
+        import pytest
+        from specify_cli.workflows.expressions import evaluate_expression
+        from specify_cli.workflows.base import StepContext
+
+        with pytest.raises(ValueError, match="unsupported form"):
+            evaluate_expression(
+                "{{ inputs.missing | default([1,2], 3) }}", StepContext(inputs={})
+            )
 
     def test_chained_filters_apply_left_to_right(self):
         # Filters chain: each filter's result feeds the next. `map` yields a