Organize app and community settings

[delkc]

Why

Buzz 1.0 had useful preferences, but their scope and organization were unclear. Profile could not edit an already-published community profile after joining. Community-owned Personal groups and Templates & teams were also hidden behind an inaccurate destination and could not open after the earlier navigation reorganization.

What

• Organize Settings into two scopes:
  • the selected community, with Profile and contributed community settings
  • App, with Appearance, Notifications, Shortcuts, Agents, and Plugins
• Make Profile load and edit the viewer’s existing profile in the captured community.
• Add a live profile preview, 500-character bio, safe avatar URL validation, dirty-state actions, and copyable hex and npub identities.
• Update the local profile seed only after community publication is accepted; leave profiles in other communities unchanged.
• Give Personal groups and Templates & teams stable, working Settings destinations.
• Add System appearance, preserve Light and Dark choices, and apply the resolved palette before app render.
• Move Remember mentioned agents to Agents and add Home to the live, rebindable shortcut registry.
• Rework Notifications around shared preference rows, explicit alert/badge ownership, nested desktop-alert options, and honest development-only Dock states.
• Record the current-Buzz inventory, ownership rules, and follow-up roadmap in docs/settings.md.

How

Settings navigation captures the exact viewer/community scope it opened from. Section changes and browser history retain that scope rather than reading a later rail selection.

Profile reuses the existing signed community profile boundary:

1. Read the viewer’s latest kind-0 profile from the captured community.
2. Preserve metadata fields this editor does not own.
3. Publish the edited profile to that same community.
4. After accepted publication, save the same details as the local seed used by the shell and future community setup.

Loading, missing-profile, retry, failed publication, draft retention, and stale asynchronous work are handled explicitly. Selecting another community in the rail leaves Settings and opens that community normally.

The new shared PreferenceRow composes supporting text with the existing accessible Switch and is documented in the design-system viewer.

Risk

Profile now performs a real signed community write. The broker retains signing and destination authority; no private key crosses into browser code. Other community profiles are never republished.

The local shell can update after a successful publication even if a later relay read still returns older evidence; a fresh Settings open always treats the community read as authoritative. Live relay propagation and packaged-native acceptance remain separate attended checks.

This PR does not add community administration, sign out, destructive data deletion, runtime catalogs, agent defaults, sleep prevention, or placeholder controls for unsupported settings.

Testing

• TypeScript and Biome
• 59 focused profile, navigation, history, services, and integration tests
• 14 focused Settings journeys in Chromium and WebKit, including community profile load/publication, Personal groups navigation, responsive layout, and App navigation
• Design-system types, guards, and focused tests
• Mandatory pre-push gate: 2,991 tests
• git diff --check

Clay reviewed the Settings structure, profile preview, Appearance, Notifications, and Dock unavailable state in the running macOS desktop development app.

Deferred: attended publication against an existing live community, packaged native relaunch, and hosted CI on the pushed head.

Bigger picture

This establishes one Settings hierarchy for ordinary members and future permission-gated community controls. Appearance modes, notification sounds, bounded agent sleep prevention, and community administration remain separately scoped follow-up work documented in docs/settings.md and BOT-1834.

Generated with Goose

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: three P2 regressions in settings destination handling and profile-save ordering, detailed inline. Fix those paths and add regressions for the stated click/history and delayed-publication sequences.

Source-only review of 1503078e3d22526f4ed85cdcfd1f0151f5f00c47; actual PR delta is from merge-base 49a1d05d6343a951a515ecb123397391eace1fc2, with pinned base f6caa83f724253ca11fb83481e7b60f091b4cf7a checked separately. No PR code was executed.

Existing CI run 36057456642 passed on synthetic merge 1d01d8c against then-current main 1e15d5d3; Windows native validation was skipped. GitHub currently reports merge conflicts, so the resolved head needs fresh CI. Live-community publication and packaged-native acceptance remain unverified.

[salman1993]

🤖 SmartReviewer review at afc8ed3: request changes.

Carl's three P2s look fixed at this head. Developer is back in visibleSections. Retired contributed destinations are checked against the active card set. The profile-seed fence held in a runtime A-held / B-accepted / A-released probe, and the seed stayed B Accepted. Three new issues remain, each with an inline comment:

1. P2: the rebase drops main's SettingsCard.group contract. Hosted communities and Invites now appear under the selected community, and they disappear when no community is selected. This also causes the red CI browser jobs.
2. P2: a description-only edit in the join dialog is silently dropped.
3. P3: an existing bio over 500 characters is silently truncated on any save.

Verified at runtime (FastValidator, Chromium, production relayBrokerPlugin with a signed fake upstream, app code at 1b5e942; src, dev, and src-tauri are byte-identical to afc8ed3):

• Rejected publish keeps the draft, and the seed is unchanged.
• Unowned kind-0 fields (website) survive a save.
• The A/B ordering fence holds.
• Findings 2 and 3 were reproduced (payloads inline).
• Reload on Personal groups reopens the section.

At afc8ed3:

• CI: JavaScript and Rust jobs pass. Browser journeys 2/2 fail only settings.spec.mjs:114 (assertion at :264) in Chromium and WebKit.
• Local run of settings, settings-developer, new-message, agent-activity, initial-position, and navigation-groups in both engines: 50 passed, and the only failures are the same 2 at :264.
• test:browser:ci --list now discovers 705 tests, so the fixture error is gone.

Not tested: a live relay or an existing live community, packaged native, and Personal groups data loading after reload. The fixture showed AbortError: Relay read cancelled, so only route restoration is proven.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one P2 regression in the oversized-bio repair. The original three findings are resolved; the inline finding covers a different consequence in the unchanged-profile community-open path.

• Merge criterion: let an existing, unchanged profile open its community without publication, even when its preserved bio exceeds the edit limit; add the focused dialog regression described inline.
• Source-only re-review at 63e4fda8df14a49378be52f946b210b8428532b8 against 01523e2c1781da1cd84620e61188df6c3d365938, including grouped-card restoration and profile repairs. Existing CI passed 3,805 JavaScript tests and 349 browser cases in each of Chromium and WebKit, including Developer routing and retired-card Back navigation.
• That run tested synthetic merge 305195a12554d68b9316b3eb59678fb9bc8c12a8 (parents bebcd66e0adb27efa2c320f2bf72b8f3e63a8a45 and this head), not the pristine head/pinned base/current main. Native/Tauri, Windows, live-relay acceptance and relaunch persistence remain unverified; no tests or PR code were run by this review.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No remaining blocking findings at f7f2d96dad7b615f9becb877b855b60d8af70207. I recommend approval. This is a closing re-review comment, not an approval or dismissal of the previous review.

The last P2 is resolved: an unchanged existing profile can open without publication while preserving its oversized bio; edited profiles still face publication validation. The added dialog regression covers both cases. The final contribution-key/startup-wait changes also have no new material findings after independent source review. All seven review threads are resolved.

Re-review covers 63e4fda8..f7f2d96d, with pinned PR base 01523e2c1781da1cd84620e61188df6c3d365938 and earlier findings carried forward as resolved. Hosted CI is green, including 3,842 Vitest tests, Rust/tool integration, and Chromium/WebKit journeys. JavaScript ran on synthetic merge a5235521edd2605802d76c3f71c1c791268584bb, combining this head with 80511fa86c2543e10447779c451ecfaf4652bff6; those results are not pristine-head tests. No PR code or tests were executed locally for this re-review. Live-community acceptance, packaged-native/relaunch behavior remain unverified; Windows native validation was skipped.

Non-blocking documentation cleanup only: docs/settings.md still describes Profile as device-local-only, and docs/plugin-architecture.md:116–125 retains the old Settings → Messages card location. These descriptions should catch up with the implemented behavior; they do not reopen the code-review merge criteria.