Feature: user-defined slash-command workflow macros

[sincera7]

Problem

Buzz can pass slash commands through to one ACP agent, and workflows can fan out messages, but users cannot define a stable bare command that invokes a reusable workflow. A command such as /new-task Build feature XYZ should be able to dispatch deterministic, channel-scoped steps without asking an LLM to rediscover the routing recipe each time.

This is distinct from agent-owned commands. @Agent /review ... should continue to pass through to that agent runtime.

Proposed contract

Add a workflow trigger:

trigger:
  on: slash_command
  command: new-task

The command name omits /, uses a portable lowercase alphanumeric/hyphen shape, and matches only an exact bare leading token. The remainder is exposed as {{trigger.args}} and the name as {{trigger.command}}.

name: New task
trigger:
  on: slash_command
  command: new-task
steps:
  - id: plan
    action: send_message
    text: "@Planner /plan {{trigger.args}}"
    reply_in_thread: true
  - id: review
    action: send_message
    text: "@Reviewer /review {{trigger.args}}"
    reply_in_thread: true

The existing buzz workflows create/update/delete CLI then gives managed agents a generic authoring path: a user can ask an agent to create or change a macro, and the agent can translate the request into workflow YAML after checking the channel for name collisions.

Routing and safety

• Bare /name ... belongs to a channel workflow macro.
• Mention-prefixed @Agent /name ... remains ACP pass-through.
• Workflow loop suppression remains unchanged.
• Macro creation does not imply invocation; agents should save and report the definition without running it unless separately requested.
• Secrets must not be stored in macro definitions or arguments.
• Duplicate enabled names should be surfaced as a conflict, not silently selected.

Scope

In scope: workflow schema/runtime matching, argument templates, Desktop workflow authoring, docs, and the bundled Buzz CLI skill guidance for agent-authored macros.

Out of scope: composer command autocomplete (#2528, #5700, #6567), a new Nostr kind, global macros, and a new agent-invocation action (#3114/#6060).

Agent fan-out through send_message also depends on resolving the existing trusted workflow wake defect (#3858); this feature should not weaken ACP author policy to work around it.

Acceptance

• /new-task Build feature XYZ fires a new-task workflow and sets trigger.args to Build feature XYZ.
• /new-task-extra does not match new-task.
• @Hermes /new-task ... does not match the workflow.
• Names are validated consistently in Rust and Desktop.
• Existing workflow steps and reply_in_thread work unchanged.
• A managed agent can discover, create, update, and remove macros through the existing CLI.