fix(desktop): restore mention chip identity icons

[loganj]

Summary

Restore the missing @ glyph for people and robot icon for agents after #7133, and incorporate the requested compact public-key display.

• Wrapping mention chips render their existing bounded icon-bearing leading fragment.
• Readonly chips show bound keys using the same 8 leading…4 trailing formatter as the channel member list: Scout (150b20bd…15dc).
• Full literal labels and exact keys remain authoritative in metadata, profile targets, title/accessible-name attributes, editor text, saved bodies and recipient tags. Display abbreviations are never used for recipient lookup.
• Copy/paste restores the full literal label for a complete compact chip; partial selections remain plain text. Two keys sharing the same abbreviation still round-trip to their separate exact recipients.
• No recipient-resolution, authorization, wire-format, composer, or CSS changes. Existing labels, icons, cloud markers and ordinary mentions remain intact.

Verification

Published candidate 9365ab9bc9d9c5d10802580cd576f8e378ff492f, based on main e09f715c9d0ee2cb7bf8a39061e601f3a502f588:

• 6,444 desktop unit tests passed on this candidate's final source tree.
• 44 mock-Chromium tests passed, zero retries in the final run across mention recipients, clipboard and cloud provenance: exact recipient selection, ambiguity rejection, send/edit/reopen, forwarding, full/partial copy, mismatched-key rejection, matching-abbreviation collisions and 100%/150% narrow-window geometry.
• TypeScript, desktop Biome/check guards, protected-feature production build and E2E build passed.
• The compact-renderer regression fails with the formatting call removed. Original missing-icon and hidden-text accessibility regressions have red/green evidence.
• Fresh self-review traced rendering, full-key metadata, copy classifier, paste normalization and identity trust. The same display formatter owns the accepted compact form on both clipboard sides.

Iteration exposed an existing team-insertion separator flake (passed final full run) and two new fixture assumptions: non-member sends require invitation, and Chromium rich paste may retain an NBSP separator. Tests now exercise invitation and normalize only that separator when comparing the captured full body and exact tags; no product change was needed for either.

Earlier local repository-wide just ci completed in two invocations because its initial call hit the ten-minute tool limit during Tauri compilation. Unchanged native/mobile/backend evidence is reused; the desktop delta received the full checks above and new remote CI. Native VoiceOver, real Tauri selection, dark theme and non-Chromium observation were not performed. Browser artifacts exercise real frontend with mocked Tauri/relay boundaries, not an installed release.

Review and visual evidence

Current-head CI and automated review must complete after this update; the old 2997bfb5 green results do not establish this new head. Required human review remains separate from agent approvals. No merge/install/restart authorization.

Before/after icon evidence: #7338 (comment)

Updated compact-key screenshots are posted below. The editor intentionally retains the full literal address; only readonly chip display is abbreviated.

Origin: buzz://message?channel=3355d33a-b72a-423a-b064-a58275f9a8af&id=38b3a27e689f5a9604e273d45f4e3122fceba76081e7bcd3bbdbf439524a5a18

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is e09f715c9d0ee2cb7bf8a39061e601f3a502f588...9365ab9bc9d9c5d10802580cd576f8e378ff492f.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 9365ab9bc9d9c5d10802580cd576f8e378ff492f to authorize a new review.
Any previous review applies only to its recorded range.

[loganj]

@buzz-security-review 579f490

[loganj]

Mention icons restored

Mock-Chromium frontend captures. Before: unchanged main e7e29937. After: the source published at 579f490b (only test comments changed after capture).

Agent chip — before

Robot missing; the cloud marker is present but means something different.

Agent chip — after

Robot restored alongside the existing cloud marker.

Narrow layout at 150% — before

Both ordinary and full-key-qualified chips lack their identity icons.

Narrow layout at 150% — after

Agent robot and human @ restored; the complete key remains wrapped and accessible. The browser workflow separately asserted both exact outgoing recipients and successful edit/reopen.

[loganj]

@buzz-security-review 579f490

[loganj]

@buzz-security-review 2997bfb

[loganj]

Fixed the accessibility finding in 2997bfb5: the text-bearing prefix is no longer aria-hidden. New Chromium accessibility snapshots reproduced the issue (John Smith exposed only Smith in a non-interactive inbox preview; a short Scout prefix was empty), then passed after the fix for inbox preview/detail and both human/agent timeline chips. All 6,435 desktop units and 42 browser cases pass again. The rebase onto e09f715c is conflict-free and has zero desktop delta relative to the tested candidate.

The sibling BuzzLinkChip leading fragment also uses aria-hidden on text. That pre-existing link-chip accessibility issue is outside this mention repair; it is not silently changed here.

[jedwards27]

Review verdict: approve

Reviewed live base e09f715c9d0ee2cb7bf8a39061e601f3a502f588 through exact head 2997bfb5575f8e7d4ed0f69b76455b5266a0558f as :bot: Jude’s code review agent.

No concrete product, accessibility, systems, identity, clipboard, or recipient-contract defect remains. The implementation restores bounded human/agent icon fragments while preserving full labels, exact mention metadata, resolution, recipient tags, copy/forward/reopen behavior, and cloud provenance. The latest delta removes aria-hidden from the text-bearing leading fragment and adds accessibility assertions, so the complete visible label remains represented to assistive technology while the icon remains CSS-only.

Exact-head evidence:

• The affected Markdown renderer suite passed 86/86.
• All three changed browser files—mention recipients, clipboard, and cloud provenance—passed 42/42 together against a fresh isolated preview server at the exact head. Coverage includes duplicate human/agent labels, exact recipients, edit/reopen/forward, whole/partial clipboard behavior, mismatched-key rejection, cloud markers, 1x/1.5x narrow wrapping, and accessible-label snapshots.
• Desktop package tests, typecheck, check, and E2E build passed in the team lanes; git diff --check passed and the exact-head worktree was clean.
• Removing the restored icon behavior makes the renderer regressions fail, binding coverage to the production seam.

One unchanged composer-spacing browser case intermittently missed a synthesized typed space in a separate lane, then passed 3/3 without retries; the integrated isolated run passed all 42. This is not causal to the rendered-Markdown delta and is a test-infrastructure confidence gap, not author action.

Native VoiceOver/real-Tauri keyboard selection, dark-theme artifact inspection, and non-Chromium behavior were not directly exercised. Those remain reviewer/release confidence gaps with no author action required; normal exact-head CI/release gates retain ownership.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 2997bfb5575f8e7d4ed0f69b76455b5266a0558f (base e09f715c9d0ee2cb7bf8a39061e601f3a502f588).

No concrete correctness, integration, product, or accessibility defect was found in the complete five-file Desktop diff.

The review traced the renderer split through identity metadata, clipboard behavior, recipient selection, edit/reopen/forward paths, cloud-marker coexistence, and narrow 100%/150% layouts. The follow-up commit removes aria-hidden only from the text-bearing leading fragment, preserving the complete accessible label without changing recipient resolution, publication tags, wire data, styling, or clipboard metadata.

Exact-head evidence included:

• renderer tests: 86/86 passed;
• typecheck and E2E build passed;
• the three changed browser files passed 42/42 together in one isolated run;
• a second exact-head run ultimately passed 42/42, with one unrelated typed-space input case passing on retry and then 3/3 with retries disabled;
• mixed human/agent and all-agent screenshots at 100%/150% showed distinct icons and bounded wrapping;
• git diff --check passed; local and remote head SHAs matched.

One full 6,435-test Desktop run produced a single unrelated ordering-sensitive failure in useKnownAgentPubkeys.test.mjs; the exact test passed immediately in isolation. Together with the typed-space retry above, this is a suite-stability confidence gap, not evidence of a PR-caused defect.

Residual reviewer-owned gaps: native VoiceOver/keyboard-selection, real-Tauri, dark-theme, and non-Chromium observation were not completed. No author action is required for those gaps. Exact-head CI was still running when this review was submitted and remains the final verification owner.

[loganj]

@buzz-security-review 9365ab9

[loganj]

Compact mention-key display — 9365ab9b

Real frontend, mock Tauri/relay, Chromium; 800px window at 150% text size. Full-key bindings remain unchanged. These screenshots supersede the full-key display in the earlier after-images; the earlier before/after icon evidence remains available.

Human key qualifier with @ icon

The duplicate human label uses the member-list abbreviation while the ordinary agent retains its robot icon.

Agent key qualifier with robot icon

Both agents retain robot icons; the duplicate label uses the same compact key form.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 9365ab9bc9d9c5d10802580cd576f8e378ff492f against base e09f715c9d0ee2cb7bf8a39061e601f3a502f588.

No material correctness, systems/integration, product/UI, accessibility, or regression defect was found.

The compact formatter is presentation-only: it activates only when the literal mention label resolves to the same exact 64-hex key. Full identity remains in mention metadata, profile targeting, title, and accessible labeling. Clipboard handling restores the full literal label and retains the exact key only for a whole-chip selection whose compact spelling and metadata agree; partial selections and mismatches fail closed. Colliding compact labels remain separate exact recipients, and no persistence schema or durable message format changes.

Validation on a clean exact-head worktree:

• Full Desktop unit suite: 6,444/6,444 passed.
• just desktop-typecheck && just desktop-check: passed; only pre-existing diagnostics outside the diff.
• Fresh focused Playwright run across recipient resolution, clipboard, and cloud provenance: 44/44 passed, including collision, partial-copy, mismatch, send/reopen/replacement/forward, narrow-layout, and 150% zoom cases.
• Mutation checks demonstrated that the exact-key clipboard arguments and renderer compaction path are exercised by the relevant regression suites.
• UI artifacts showed correct human/agent icons, clean wrapping at 800px/150% zoom, duplicate compact labels, full hover/accessibility identity, and persistence after reopen.
• Exact-head required CI is now terminal and green, including Desktop Core, all four Desktop smoke shards, Windows/macOS builds, and Desktop integration.

Confidence note: one independent focused run initially observed a missing typed separator after a chip, then passed on retry; the complete isolated rerun passed 44/44. The reviewed display-only delta does not establish causation. This is not an author-actionable defect; recurring evidence should be isolated by Desktop test maintainers.

Author action: none.

Verification owner: Desktop test maintainers for recurrence of the isolated spacing flake. Any newer head invalidates this approval.

[loganj]

@buzz-security-review 9365ab9