feat(cli): add buzz gifs command group and NIP-30 emoji tags on messages

[wpfleger96]

What

Two new agent-facing capabilities in buzz-cli:

1. buzz gifs command group (agent KLIPY picker path)

Agents can now search and share GIFs via the relay's authenticated KLIPY proxy without holding a provider credential.

buzz gifs search                         # trending GIFs
buzz gifs search --query "celebration"   # search GIFs
buzz gifs share --slug <slug>            # report selection to provider Recents

Output is a JSON array of GIF objects. Paste the cdn_url field directly into buzz messages send --content — sending a GIF is a plain message containing the CDN URL, no special send-path handling.

Implementation details:

• Gates on NIP-11 supported_extensions containing buzz-gif and gif.provider == "klipy"
• Uses relay-relative paths from the NIP-11 gif descriptor — no hardcoded paths; safe-path validation mirrors desktop/src/features/gifs/api.ts
• New post_json_authed helper in BuzzClient handles NIP-98-signed JSON POSTs and 204 No Content responses
• customer_id derived as SHA-256(secret_key_bytes || '\0' || relay_url_bytes)[..16] → 32 hex chars: stable, relay-scoped, not computable from public data, no storage needed
• locale defaults to $LANG (stripped of encoding suffix) or en_US

2. NIP-30 custom emoji tags on outgoing messages

buzz messages send now automatically attaches ["emoji", shortcode, url] tags for any :shortcode: patterns in the content that resolve in the workspace palette — identical to the desktop composer behavior.

buzz messages send --channel <uuid> --content "hello :wave: everyone :tada:"
# → event carries ["emoji", "wave", "..."] and ["emoji", "tada", "..."] tags

Implementation details:

• Hand-rolled single-pass scanner (no new dependency) implementing :([a-z0-9_-]+): case-insensitively with canonical lowercase output — mirrors desktop/src/shared/lib/customEmojiTags.ts exactly
• Zero extra relay round-trips when content contains no : character; one query when candidates exist but none match
• Palette fetch reuses the existing union_custom_emoji logic from commands/emoji.rs
• build_message in buzz-sdk gains a new emoji_tags: &[Vec<String>] parameter (additive — all existing callers pass &[]); NIP-30 tag attachment lives in the SDK alongside imeta tags
• MCP send path (buzz-acp) continues to pass &[] and is not affected; the MCP gap is noted in a comment

Files changed

Crate	File	Change
buzz-cli	src/commands/gifs.rs	New — search + share handlers, NIP-11 gating, tests
buzz-cli	src/commands/mod.rs	pub mod gifs
buzz-cli	src/lib.rs	Gifs(GifsCmd) variant, dispatch arm, inventory test update
buzz-cli	src/client.rs	post_json_authed helper
buzz-cli	src/commands/emoji.rs	scan_shortcodes + resolve_emoji_tags_for_content + tests
buzz-cli	src/commands/messages.rs	Emoji scan + tag injection in cmd_send_message + seam tests
buzz-cli	README.md	buzz gifs section + emoji-in-messages note
buzz-sdk	src/builders.rs	build_message gains emoji_tags param + tests
buzz-acp	src/pool.rs	Update build_message call site (&[])
buzz-acp	src/setup_mode.rs	Update build_message call site (&[])
countdown-bot	src/main.rs	Update build_message call site (&[])

Relates to: https://buzz.block.builderlab.xyz — buzz-team channel thread on agent GIF/emoji support

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one P2

Reviewed head ef2adb4dc3e6be0daa07a5d31556ed2da0cf6c33 against base 0dbd036f5bff33e7ade75e7639f3218d424a6e73.

P2: Normalize and deduplicate each palette event before automatic emoji lookup

The new resolver at crates/buzz-cli/src/commands/emoji.rs:341–345 builds a case-sensitive map from the existing raw union, but the scanner lowercases every candidate. A current member kind-30030 set containing ["emoji","WAVE","https://example.com/wave.png"] is accepted by the relay and resolves on Desktop/Mobile. Sending :wave: through this new CLI path instead emits no NIP-30 tag. Recipients relying on the message tags receive literal text rather than the emoji.

The same seam can pin the wrong image: within one event, tags for wave ordered https://example.com/z.png, then https://example.com/a.png resolve to z in Desktop/Mobile (first normalized entry wins), but a in CLI (the cross-event lexical tie-break is also applied within the event).

These are valid stored inputs, not merely malformed fake responses: ingest.rs:145–158 validates the shortcode through the SDK normalizer but discards the normalized result and does not reject duplicates. Ingest passes the original signed event to replacement; storage serializes the original tags. The raw CLI parser predates this PR; its new use to pin outgoing message tags is the introduced failure.

Smallest fix / exit criteria: match customEmojiFromTags before applying the cross-event union: normalize shortcode keys, ignore missing/empty URLs, and keep the first normalized shortcode within each event. Add production-resolver regressions with uppercase palette keys, normalized duplicates and empty URLs. Keep the existing newest-set / equal-timestamp-smallest-URL rule across distinct events.

Scope and validation

Source-only review; no checkout, build, tests, or PR-code execution. The examples above are source-derived reproductions, not runtime results. Independent GIF and emoji lanes returned before this integrated review.

Reviewed CLI GIF capability discovery, authenticated request/response and relay authority boundaries, customer-ID derivation, emoji send/tag integration, and all exact-head Rust build_message references. Existing SDK callers supply the new argument; Desktop uses a separate builder. GIF sharing remains an ordinary CDN-URL message, with provider credentials staying at the relay. No additional blocker established in those paths.

Forum, ACP notices and CLI edits remain unchanged in capability; legacy tag-less edits preserve original emoji tags in the Desktop overlay. Broader pagination and unrelated hardening are not additional exit criteria.