feat(desktop): port channel Files tab from upstream #4316

[wiggdevin]

feat(desktop): port channel Files tab from upstream block#4316

Summary

Ports upstream PR block#4316 (mismai-li:feat/channel-files-tab) into
desktop/src/features/channel-files/: a Files tab on the channel screen listing the
channel's attachments, with folders, bulk select, and drag-and-drop, alongside a shared
ChannelScreen.tsx tab strip. Upstream shipped no tests; this port adds unit coverage
(useChannelFiles.test.mjs, useFileFolders.test.mjs, folderStore.test.mjs,
ChannelFilesTab.test.mjs, ChannelTabStrip.test.mjs) and an e2e spec
(channel-files-tab.spec.ts, registered in the smoke allow-list), plus a header/tab-strip
layout fix so the tab strip sits inside the channel header box instead of pushing the header
down and stacking a second offset underneath it (channels.spec.ts sticky-divider regression,
now closed).

D1 — Folders v2 is a deliberate wire-format change from upstream, not a bug. Upstream's
PR stores one kind-30078 event per folder, in plaintext, keyed by the raw channel id. That
model failed five separate findings in review (plaintext metadata and channel id on the
relay, unbounded #d/limit queries, mutable folder ids, multi-write renames and deletes,
one shared key across all a user's attachments). Per fix-spec.md D1, this port replaces it
before any folder event has ever been published (upstream block#4316 is unmerged, so there is
nothing to migrate): one kind-30078 event per (user, channel), d = files-v2-<sha256(channelId)[0:32]> (never the raw channel id), t = file-folders, content
NIP-44-encrypted to the user's own key the same way readState does it, payload {v:1, folders:[{id, name, parent}], files:{<fileKey>: folderId}}. D2–D6 (queued single-write
mutations with inspected publish results, parse-time bounds, a bounded imeta parser, ARIA
tabs, and production-seam tests) are also part of this port, not follow-on work — see
fix-spec.md for the full decision record.

A consolidated two-round fix pass then closed every verified BLOCK from the review loop
(bulk-select races, folder-cycle bugs, the header/tab-strip stacking bug, an impure folder-create
transform that could duplicate or lose a folder on a relay-level retry, and an imeta budget that
bounded the wrong quantity) — see Defect checklist and the GPT-5.6 Sol audit below for what
is fixed and what remains open as a WARN.

Fork deviations

• Added one change the findings did not name: folderStore.ts withFolderCreated returns
  the snapshot unchanged when the folder id already exists. Making the transform pure
  introduced this narrow torn-state case — our write commits, another device writes on top
  of it before our duplicate OK arrives, the re-read head already holds our folder and
  head.id != event.id, so the replay would append a duplicate id. Six lines, one unit test.
• Falsification method: guards were removed with file copies rather than git checkout after
  an early checkout reverted the in-progress useFileFolders.ts edit; the edit was
  re-applied and verified in the committed diff. No history was rewritten and nothing was
  pushed.

Defect checklist

1. Cap relay/user strings at the DTO and test the cap — MET. boundedImeta.ts already caps
   url, filename, mime, dim, blurhash, caption, size and attachments-per-event, each with a
   test in useChannelFiles.test.mjs. This round supplied the missing count half (the
   tag-scan bound) with its own test.
2. Order multi-step writes so every prefix is consistent — MET. A folder mutation is still
   exactly one publish; this round removes the only path that turned one user action into two
   writes (replay after a committed duplicate OK), and the idempotent create means a replay
   cannot leave two folders under one id.
3. Gates bound the quantity that costs — MET by finding 2: the budget now bounds tags walked,
   which is what the per-message main-thread projection pays for, not the count of imeta tags
   found.
4. A test that fails when each guard is removed — MET. Each of the four guards was removed
   and the suite rerun: head-id check → 2 failures, id hoist → 3, scan bound → 1, idempotent
   create → 1. All restored; final tree is clean and green.
5. No swallowed failure — MET. The superseded path either returns success on proof the write
   landed (head id equals the signed event id), replays once, or throws "Another device
   changed these folders at the same time." into the caller and its toast. The new early
   return is a proven success, not a silenced error.

Gates

Tested base OID (fix round 2, builder, pre-merge): 8fea88f61db26853496fd740df4c08ef720fc28b
(origin/zs/main).

Fix round 2 (builder, commits eecf43c2a, d45bfeaea):

Command	Exit	Notes
just desktop-check	0
just desktop-typecheck	0
just file-size-check	0
just desktop-test	0	6353/6353
node --test src/features/channel-files/*.test.mjs	0	65/65
pnpm exec playwright test --project=smoke tests/e2e/channel-files-tab.spec.ts	0	1/1

desktop/src-tauri/Cargo.lock untouched this round; no Rust dependency added.

PR-updater gates (this session, worktree port-4316), tested base OID
a9a529f2c992912f3fb0d8a94ea88f34bf0d5fc5 (origin/zs/main, fetched fresh):

Command	Exit	Notes
git merge --signoff --no-edit origin/zs/main	0	Clean merge, no conflicts; merge commit 011309a82. merged_base=true. Brought in 56 unrelated files (agent prompt-source, MCP registry plan docs, OpenSEO smoke scripts) plus a Cargo.lock update from those branches' own dependency changes — none touch channel-files/channels/ChannelScreen.
DCO check (git rev-list origin/zs/main..HEAD × grep Signed-off-by)	0	Nothing missing (known older commit 1ce91cf58 carries an extra model Signed-off-by, left as instructed).
just desktop-check	0	4 pre-existing warnings / 5 pre-existing infos, all in files this branch never touched (inboxReopenNavigation.test.mjs, channelMutesStorage.test.mjs, channelStarsStorage.test.mjs, terminal.css, badge.spec.ts, project-pr-review.spec.ts).
just desktop-typecheck	0
just desktop-test	0	6390/6390
just file-size-check	0
node --import ./test-loader.mjs --experimental-strip-types --test src/features/channel-files/*.test.mjs	0	65/65
pnpm exec playwright test --project=smoke tests/e2e/channel-files-tab.spec.ts	0	1/1
git push origin port/4316 (pre-push hook suite: push-head-scope, branch-skew, file-size-check, desktop-check, desktop-typecheck, rust-tests, desktop-test, desktop-tauri-checks)	0	950.9s total; origin/port/4316 verified == HEAD (011309a82) after push.

desktop/src-tauri/Cargo.lock carries only the merge's own legitimate changes (new deps from
the merged branches); no gate in this session modified it further, so nothing was restored.

Gemini 3.8 Flash tester

• Verdict: PASS
• Repro: none
• Dirty files after run: none
• Missing tests noted (follow-ups, not FAILs):
  1. HTML5 drag-and-drop event wiring (dragstart/dragover/drop) on FileRow and folder
     drop zones in ChannelFilesTab.test.mjs.
  2. Bulk toolbar actions (Select all, Clear, Move-to-folder dropdown) in
     ChannelFilesTab.test.mjs.
  3. E2E folder creation and file assignment against the mock bridge in
     channel-files-tab.spec.ts.
• Report: scratchpad/wave2/port-4316/gemini-report.md (session-local path)

GPT-5.6 Sol audit

Run 1 (effort xhigh, full pass against origin/zs/main...HEAD): 12 BLOCK / 6 WARN, all 18
findings independently CONFIRMED by 18 separate verifiers.

Delta 1 (verdict: OPEN) — 2 BLOCK + 5 WARN still open after the first fix round:

• BLOCK useFileFolders.ts:241 — createFolder's transform was not pure:
  newFolderId() ran inside the retryable transform, so a superseded-OK replay (a socket
  resend the relay answers duplicate: after it already committed) minted a second random
  id and published a duplicate folder while telling the user one action succeeded; the
  symmetric delete case reported a committed delete as "That folder no longer exists."
• BLOCK boundedImeta.ts:77 — MAX_IMETA_TAGS_SCANNED bounded the wrong quantity: the
  counter only incremented after tag[0] !== "imeta" had already continued, so the declared
  64-tag budget never bounded the scan; a channel member could post a few hundred tag-stuffed
  events and drive tens of millions of main-thread iterations per incoming message once the
  Files tab had been opened.
• WARN useFileFolders.ts:70 — folder-head read validated only event.pubkey, no kind/d/t check.
• WARN boundedImeta.ts:74 — tag[0] indexed with no Array.isArray(tag) guard; a malformed tag could crash the render instead of hitting the new retryable error state.
• WARN ChannelScreen.tsx:236 — first Files-tab open could paint an authoritative "No files yet" for a frame.
• WARN ChannelFilesTab.test.mjs:59 — no test bound the component's handlers to useFileFolders (fix-spec D6).
• WARN useFileFolders.ts:77 — relay-supplied ciphertext reached nip44DecryptFromSelf with no pre-decrypt length bound.

Delta 2 (verdict: OPEN, run after fix round 2 / commits eecf43c2a, d45bfeaea) — both
BLOCKs are resolved; 8 WARNs open, none blocking:

• WARN useFileFolders.ts:64 — carried: folder head still selected on event.pubkey alone, no kind/d/t coordinate check (not reachable from any client in this repo).
• WARN ChannelScreen.tsx:237 — carried: filesTabOpened is set from a useEffect keyed on activeTab, so the first Files render can still paint "No files yet" for a frame.
• WARN ChannelFilesTab.test.mjs:268 — carried (fix-spec D6): still no test drives the real useFileFolders callbacks through the component; a no-op at ChannelScreen.tsx:1117 would leave every suite green.
• WARN useFileFolders.ts:77 — carried: unbounded relay head.content still reaches nip44DecryptFromSelf before any size check; not a regression, every NIP-78 reader in this repo does the same.
• WARN useFileFolders.ts:186 — new: the conflict "force read" (readHead(true)) can be served by an in-flight queryClient.fetchQuery refetch instead of a fresh read, so a retry can rebuild on a pre-conflict head and publish over another device's write.
• WARN FileCard.tsx:232 — new: the imeta x hash is accepted on shape alone and never checked against the downloaded bytes, yet the UI renders a green "SHA-256 verified" badge.
• WARN useChannelFiles.ts:117 — new (absorbs the WARN-2 residual): a non-string event.content or non-array tag throws inside the projection's useMemo during render, escaping the retryable error state this round added; reachable only from a hostile/non-conforming relay.
• WARN ChannelFilesTab.tsx:334 — new: handleFolderDrop reads text/plain from any drag source with no membership check, so a crafted external drag can persist an assignment for a file key that doesn't exist, spending the assignment budget.

Final state: no verified BLOCK remains open. Per the loop's severity rubric, verified WARNs
outside the BLOCK list are follow-ups recorded below and on the fork, not a loop condition —
this PR is ready for the merge queue on that basis.

Follow-ups

• useFileFolders.ts:64 — bind the folder-head read to channelFolderDTag(channelId) + t=file-folders, not event.pubkey alone (Sol WARN, carried).
• ChannelScreen.tsx:237 — set activeTab and filesTabOpened together in the tab-select handler instead of an effect, to close the first-open "No files yet" flash (Sol WARN, carried).
• ChannelFilesTab.test.mjs:268 — add the fix-spec D6 seam test: real useFileFolders wired to the component, signing/publish mocked, asserting publish count and order for a drop and a bulk move (Sol WARN, carried).
• useFileFolders.ts:77 — reject head.content above the max NIP-44 ciphertext expansion before calling nip44DecryptFromSelf (Sol WARN, carried).
• useFileFolders.ts:186 — await queryClient.cancelQueries({ queryKey }) (or bypass the cache and setQueryData directly) before a conflict force-read, so it can't join an in-flight pre-conflict refetch (Sol WARN, new).
• FileCard.tsx:232 — relabel the badge "SHA-256 provided by sender" or remove it until downloaded bytes are actually hashed and compared (Sol WARN, new).
• useChannelFiles.ts:117 — validate id/pubkey/content as strings and tags as an array at the projection boundary, skip the malformed row (Sol WARN, new).
• ChannelFilesTab.tsx:334 — carry file/folder identity on a private drag MIME type and check the key against the current row set before calling onAssignFiles (Sol WARN, new).
• Add HTML5 drag-and-drop event wiring (dragstart/dragover/drop) coverage on FileRow and folder drop zones in ChannelFilesTab.test.mjs (tester missing-test).
• Add bulk toolbar action coverage (Select all, Clear, Move-to-folder dropdown) in ChannelFilesTab.test.mjs (tester missing-test).
• Add an e2e case for folder creation and file assignment against the mock bridge in channel-files-tab.spec.ts (tester missing-test).
• T3b (feat/files-index): dedicated attachment index and bulk-upload-default change, scoped separately per the implementation plan.
• T3c: relay-side channel scoping for folder events, if the team ever self-hosts a relay (Folders v2's d-tag hides the channel id from a Block-hosted relay by design; a self-hosted relay could instead enforce channel membership server-side).

Test plan

• cd desktop && node --import ./test-loader.mjs --experimental-strip-types --test src/features/channel-files/*.test.mjs — 65/65 pass.
• just desktop-check desktop-typecheck desktop-test file-size-check — all exit 0; desktop-test 6390/6390.
• pnpm exec playwright test --project=smoke tests/e2e/channel-files-tab.spec.ts (from desktop/) — 1/1 pass.
• git rev-list origin/zs/main..HEAD DCO check — no commit missing Signed-off-by.
• CI on Blacksmith (triggered by gh pr ready 11) is the authoritative full gate, including the full e2e smoke suite and the Rust test/clippy/fmt lanes this session did not rerun locally beyond the pre-push hook's own pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E51uwemNnQ6wdrBWU9EhPE

Round 3 (CI regression)

CI run 33949461538, Desktop Smoke E2E shard 2, failed
tests/e2e/file-attachment.spec.ts:450 › dropping a file on the channel column attaches it to the composer on all three attempts in ~1.0s each — a deterministic
layout failure, not the shard's known timeout flake (custom-emoji.spec.ts:370 and
mentions.spec.ts:3051 each failed once at ~16s and passed on retry; those are
untouched here).

Cause

desktop/src/features/chat/ui/ChatHeader.tsx:206 (was :147). Commit 64c7f9dfc
moved chromeWrapperRef off the header's outer chrome wrapper and onto a new inner
title row, so --buzz-channel-content-top-padding measured the title row alone (52px)
while the wrapper grew by the 42px tab strip (94px). That variable is also the
wrapper's own negative bottom margin (channelChrome.negativeMargin), so the header
stopped cancelling its own height: it contributed 42px of real flow and pushed every
sibling in the channel column down by that much.

Offsets built on the variable stayed correct — column top + (header height − var) +
var is header height whatever var is — which is exactly why the sticky day divider
(channels.spec.ts:1974) and the Files-row stacking assertions the port added still
passed, and why the regression got through review. What broke is anything sized to the
column rather than offset inside it. The Chat column's drop overlay is
absolute inset-0 inside that shifted sibling (ChannelPane.tsx:806, rendered inside
the relative isolate content div at ChannelPane.tsx:615), so it came out 42px
shorter than the channel-drop-zone section it must cover:
overlay y=83 h=629 against drop zone y=41 h=671.

Reproduced locally at the identical numbers, and confirmed passing on a detached
origin/zs/main worktree (file-attachment.spec.ts is untouched by this branch, so
the spec's selectors are correct for a layout the ticket did not intend to change).

Fix

chromeWrapperRef goes back on the outer chrome wrapper, so the measured height is the
whole header box — tab strip included — and the negative margin cancels it exactly. The
header is a zero-flow overlay again, as on zs/main. The inner py-2 row stays: it is
what keeps tabs flush under the title row instead of below a stale 8px gap, and it
leaves <header>'s own px-5 inline padding alone for the header-action gap
assertions.

Every downstream offset is unchanged by construction (the column-top/var trade above),
so the sticky divider, timeline padding, Files-tab content padding, and the shared blur
band all measure the same as before; only the column-sized children move back. The
Chat tab's drop-to-attach path is byte-for-byte zs/main — no handler, no z-index,
no preventDefault moved — and the Files tab's folder drop zones are untouched and
still fire only while the Files tab is the mounted panel.

Tests

• desktop/tests/e2e/channel-files-tab.spec.ts — new case "the tab strip grows the
  header box without shrinking the Chat column": asserts the measured chrome variable
  equals the chat-header box while the strip is rendered, that the drop overlay covers
  channel-drop-zone edge to edge, and that the drop still reaches the composer, all
  with Chat as the selected tab. This binds the strip to the Chat column, which
  file-attachment.spec.ts (which never mentions tabs) does not.
• desktop/src/features/channel-files/ChannelFilesTab.test.mjs — new case "dragging a
  file row onto a folder row assigns that one file to the folder": drives the real
  dragstart → dragover → drop handlers on FileRow and the folder row through a
  DataTransfer stub, asserting the drag carries the attachment key and onAssignFiles
  receives exactly that one key. Also closes the recorded follow-up "add HTML5
  drag-and-drop event wiring coverage on FileRow and folder drop zones".

Falsification: with chromeWrapperRef put back on the inner row, both new assertions
fail alongside file-attachment.spec.ts:450; restored, all three pass.

Gates

Tested base OID: 011309a82 (the round-2 merge commit). Head 7ff396e2b.

Command	Exit	Notes
playwright test tests/e2e/file-attachment.spec.ts --project=smoke -g "dropping a file on the channel column" --repeat-each=5	0	5/5
playwright test tests/e2e/channel-files-tab.spec.ts --project=smoke	0	2/2
playwright test channels.spec.ts file-attachment.spec.ts channel-files-tab.spec.ts timeline-no-shift.spec.ts --project=smoke	0	113/113 — the geometry-sensitive set, incl. the sticky-divider assertions
just desktop-check	0	same 4 pre-existing warnings / 5 infos, none in files this branch touches
just desktop-typecheck	0
just desktop-test	0	6391/6391
just file-size-check	0
node --import ./test-loader.mjs --experimental-strip-types --test src/features/channel-files/*.test.mjs	0	66/66
git push origin port/4316 (pre-push suite)	0	188.4s; origin/port/4316 verified == HEAD (7ff396e2b)

Not verified locally: a full local playwright test --project=smoke run is not a
usable gate on this machine — it reported 418 failures spread across nearly every spec
file, and the same specs pass in isolation (community-rail.spec.ts + smoke.spec.ts:
57/58, the one failure a 5s-budget timing flake in an unrelated keyboard-reorder case).
Local runs get Playwright's 5s expect budget and no retries, where CI uses 15s and two;
CI remains the authoritative full-suite gate, as in earlier rounds. Rust lanes were not
rerun beyond the pre-push hook's own pass.