#23796: Config UI: tag filters and complete schema help/labels coverage

## Summary Describe the problem and fix in 2–5 bullets: - Problem: Config UI search and schema metadata were hard to use at scale: no tag-based filtering in the form UI, and help/label coverage was inconsistent across many config keys. - Why it matters: Operators struggled to find cross-cutting settings (security/auth/network/etc.) and several schema fields lacked clear in-product explanations. - What changed: Added config tag derivation + UI tag filtering, expanded labels/help coverage to full help/label parity, and added quality/parity tests for config docs metadata. - What did NOT change (scope boundary): No runtime gateway/tool behavior changes; this is config metadata + UI/search UX and test coverage only. ## Change Type (select all) - [x] Bug fix - [x] Feature - [x] Refactor - [ ] Docs - [ ] Security hardening - [ ] Chore/infra ## Scope (select all touched areas) - [ ] Gateway / orchestration - [ ] Skills / tool execution - [ ] Auth / tokens - [x] Memory / storage - [x] Integrations - [x] API / contracts - [x] UI / DX - [ ] CI/CD / infra ## Linked Issue/PR - Closes # - Related # ## User-visible / Behavior Changes - Config sidebar search now supports tag filters and tag-picker UI for multi-tag filtering. - Config form fields now render derived tags to improve discoverability. - Config metadata now includes much broader, higher-quality help text and complete label/help parity. - `schema.hints` now carries derived tags for UI consumers. ## Security Impact (required) - New permissions/capabilities? (`Yes/No`): No - Secrets/tokens handling changed? (`Yes/No`): No - New/changed network calls? (`Yes/No`): No - Command/tool execution surface changed? (`Yes/No`): No - Data access scope changed? (`Yes/No`): No - If any `Yes`, explain risk + mitigation: ## Repro + Verification ### Environment - OS: macOS (local dev) - Runtime/container: Node 22+/pnpm workspace - Model/provider: N/A - Integration/channel (if any): Config UI - Relevant config (redacted): N/A ### Steps 1. Open Control UI config screen and use search/tag filter controls. 2. Run config metadata tests and typecheck. 3. Verify no remaining help/label parity gaps. ### Expected - Tag filters constrain visible config nodes correctly. - Help/label coverage remains complete and regression-protected by tests. - Typecheck and targeted tests pass. ### Actual - Matches expected. ## Evidence Attach at least one: - [x] Failing test/log before + passing after - [ ] Trace/log snippets - [ ] Screenshot/recording - [ ] Perf numbers (if relevant) ## Human Verification (required) What you personally verified (not just CI), and how: - Verified scenarios: - `pnpm tsgo` passes. - `pnpm test -- src/config/schema.help.quality.test.ts src/config/schema.hints.test.ts src/config/schema.tags.test.ts src/config/schema.test.ts src/tui/tui-command-handlers.test.ts` passes. - Parity audit shows `labelMissingHelp: 0` and `helpMissingLabel: 0`. - Edge cases checked: - Search parsing for `tag:<name>` with replacement/toggle helpers. - Node-level matching with text + multi-tag criteria. - What you did **not** verify: - Full browser Playwright suite was not run in this environment. ## Compatibility / Migration - Backward compatible? (`Yes/No`): Yes - Config/env changes? (`Yes/No`): No - Migration needed? (`Yes/No`): No - If yes, exact upgrade steps: ## Failure Recovery (if this breaks) - How to disable/revert this change quickly: - Revert this PR commit. - Use Raw config mode if UI filtering presentation regresses. - Files/config to restore: - `ui/src/ui/views/config*.ts` - `src/config/schema.help.ts` - `src/config/schema.labels.ts` - `src/config/schema.hints.ts` - `src/config/schema.tags.ts` - Known bad symptoms reviewers should watch for: - Missing config fields when tag search is active. - Unexpected field filtering for object/array nodes. - Help/label parity test regressions. ## Risks and Mitigations List only real risks for this PR. Add/remove entries as needed. If none, write `None`. - Risk: Search/tag filtering may hide intended nested fields under complex schemas. - Mitigation: Added node-level search tests and retained text-based search fallback. - Risk: Large help-text additions could drift without guardrails. - Mitigation: Added quality/parity tests enforcing help presence and minimum guidance quality. <!-- greptile_comment --> <h3>Greptile Summary</h3> This PR adds tag-based filtering to the config UI and significantly expands help/label coverage across config schema fields. The implementation introduces a tag derivation system that automatically categorizes config keys by security, auth, network, and other cross-cutting concerns, making it easier for operators to discover related settings. **Key Changes:** - Added tag derivation engine (`schema.tags.ts`) with rule-based classification using prefix patterns, keyword matching, and path-specific overrides - Implemented UI tag picker with multi-select filtering in config search (15 predefined tags: security, auth, network, access, privacy, observability, performance, reliability, storage, models, media, automation, channels, tools, advanced) - Expanded `FIELD_HELP` with 700+ lines of detailed guidance text for config keys that previously lacked documentation - Expanded `FIELD_LABELS` with 300+ human-readable labels for improved config form readability - Added quality/parity tests to prevent help/label regressions (`schema.help.quality.test.ts`) - Fixed test code smell in `tui-command-handlers.test.ts` (resolver initialization) **Architecture:** - Tags flow through the schema build pipeline: base hints → derived tags → sensitive hints → final merged hints - Search matching uses recursive descent through object/array nodes with combined text + tag criteria - Tag normalization ensures case-insensitive deduplication across UI and backend <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - it's a metadata and UI enhancement with no runtime behavior changes - Score reflects comprehensive test coverage (tag derivation, search parsing, node matching, UI interaction), focused scope (config metadata/UI only), backward compatibility (tags are additive), quality guardrails (parity tests prevent regressions), and adherence to repo patterns (ESM, TypeScript strict mode, colocated tests). No security surface changes, no gateway logic changes, and the TUI test fix improves code quality. - No files require special attention - all changes are straightforward metadata additions and UI enhancements _{Last reviewed commit: b0cbd8d} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->