feat(profiles): add owner runtime configuration tab

[kalvinnchau]

Change

• Adds an owner-only Runtime tab to the profile panel. It shows:
  • a start-on-launch switch;
  • respond-to, backend and command;
  • effective model/provider rows;
  • advanced settings;
  • an itemized restart diff.
• The copy follows base Buzz (20131488).
• start_on_app_launch is a separate persisted preference.
  • Legacy records fall back to enabled.
  • New and imported records store an explicit false.
  • It is set through agent_control_start_on_app_launch, which is granted to the main window only.
• Queued restore now checks for an explicit user action before it touches a pending Start ticket or reads a credential. A Stop or Start issued during restore is honored.
• Environment values never cross IPC. Snapshots carry only key names, and the UI shows "Set by environment (KEY)".

Verification

• cargo fmt --check: pass.
• clippy --all-targets -D warnings on buzz-agent-controller and buzz-foundation: pass.
• Native tests: controller 61 passed / 1 ignored, build-config 11 passed, foundation 64 passed / 3 ignored. They include:
  • an overlapping-restore test that uses the real host, IPC Stop/Start and per-credential gates;
  • a real-handler start-on-launch persistence test covering write failure, retry and reopen;
  • key-only snapshot regressions.
• pnpm check: pass.
• Chromium/WebKit profile journeys: 8/8.
• Full Vitest was green at an earlier commit in this branch. At the final SHA, a loaded host hits the dev/vite-config.test.mjs 10 s spawnSync timeout. The same timeout occurs on b276b867, which does not contain this branch.
• Windows: the Unix-only overlap fixtures are gated in one cfg(unix) module. This was checked with a cfg-disabled proxy only; the on-demand Windows CI lane has not run.
• Not covered:
  • a rendered click inside a running Tauri webview;
  • OS credential dialogs;
  • a child-observed model/provider selector matrix;
  • the packaged runtime.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one P2 browser-fixture regression, detailed inline. Merge criteria: restore coherent launch-preference fixtures and both stopped-state branches without dropping lifecycle assertions, then pass the required CI gate. Do not change the independent production launch preference to satisfy legacy test expectations.

Source review covered owner/native-record gating, preference persistence, main-window IPC permissions, restore-versus-explicit-action ordering, and saved/running configuration redaction. No additional demonstrated production blocker survived integration review.

Existing exact-head CI, on this head merged with base df7b7e7f45739f3e06e12d81623385701acdc51d, failed 16 browser case executions (eight per engine). Vitest (3,702), Rust/tool integration and the other browser shards passed. Review was source-only on Blox; no PR code executed or CI rerun. The new Runtime tab has component coverage, not a browser journey; native webview, packaged/macOS/Windows runtime and OS credential-dialog acceptance remain unverified.

[wesbillman]

[P2] Preserve the browser fixture’s launch-preference contract

Adding startOnAppLaunch: true makes the shared fixture behave like an explicitly opted-in record. Its action() (lines 82–88) clears enabled on Stop but leaves this flag true, so AgentEditor now renders “Stopped · starts with buzz-app.” The unchanged browser fixture uses this factory, while seven positive assertion sites in tests/browser/agent-control.spec.mjs (141, 366, 436, 816, 837, 856, 863) still expect the preference-off text. CI run 36094738270 fails eight cases in each of Chromium and WebKit as a result.

This also aborts the tests before their late-launch supersession/pending-launch cleanup, unavailable-runtime IPC, and import-preview assertions. It is not a production Stop bug: native legacy records derive the flag from enabled, while an explicit preference must survive Stop.

Make the fixtures deliberately distinguish legacy fallback from an explicitly set preference, including the copied-agent/custom-action browser cases. Alternatively, update the scenarios intentionally while preserving equivalent branch and lifecycle coverage. Keep a stopped/preference-off witness and an explicit-preference-on-after-Stop witness; a blanket string replacement loses the former. Restore the required gate without changing production preference semantics.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review clear: the previous fixture-contract blocker is resolved. No new blocker found in the two-file follow-up from a4b5cae4665e38185ef4af10d9e260eb9da0478d to this head. This is a COMMENTED review, not approval.

The browser fixture now deliberately starts with the real explicit-off preference. The stopped/preference-off assertions and their later lifecycle checks remain, while a separate explicit-on witness checks that Stop clears enabled without clearing the launch preference. Native legacy fallback remains covered at the store layer; no production preference semantics were changed to make tests pass.

CI run 36116085824 is green on merge abfc460 of this head into df7b7e7f45739f3e06e12d81623385701acdc51d: all 16 previously failing browser executions pass, 660/660 functional cases plus 7/7 measurements, and 3702/3702 Vitest tests. The author-local Vite timeout did not reproduce in hosted CI.

Source-only re-review on isolated Blox; no PR code executed or CI rerun. Unchanged gaps: no rendered Runtime-tab browser journey, attended native/packaged launch or OS credential-dialog acceptance; Windows native CI skipped and two macOS-only Node cases skipped. This closeout addresses the prior blocker and changed paths, not a new release certification.