[computerlovebot]

Summary

Closes #26.

• Persist validated desktop backend settings in desktop-v2.json, with compatible gateway / administrator-off defaults and non-destructive validation of existing profiles.
• Add owner-authenticated GET / PUT /desktop/settings, separating pending settings from the immutable running effective configuration. Agent tokens cannot access this API, including when administrator MCP is enabled.
• Add native Advanced settings with gateway/flat/codemode selection, explicit administrator confirmation, backend-reported running values, pending indication, and uploaded-file/context-size/client-refresh warnings.
• Apply settings through save → stop → start → health/effective verification; retain saved settings and provide recovery/reload controls after failure.
• Add Python regression/integration coverage and native model plus packaged-backend lifecycle harness coverage; update the desktop README indexes and usage/security documentation.

Verification

Observed failing regressions before implementation for hardcoded gateway composition, the missing settings API, malformed persisted settings and default migration.

Local checks:

• Desktop Python: 42 passed.
• Focused settings regressions: 9 passed (included in the desktop total).
• Core MCP: 736 passed.
• Core non-MCP: 1290 passed, 31 failed; deployment tests require unavailable Docker or jq. This suite is not reported green.
• Desktop policy tests: 27 passed.
• Desktop/API Ruff and git diff --check: passed.
• Shared Semgrep completed with 41 existing findings in unchanged shared application files; no unrelated refactors were made.

Real desktop subprocess tests cover fresh runtime tool lists for all three exposure modes, administrator tools absent/off and authorized/on, settings API rejection of agent tokens even with administrator MCP enabled, preserved connector configuration/activation/grants/credential bytes, and recovery after an occupied saved-port startup failure.

Native and service verification limitations

• Local environment is Linux without Swift/macOS SDKs, SwiftUI/AppKit or Keychain. The native source and new executable assertion harness have not been compiled/executed locally. macOS CI must establish this coverage; no native CI pass is claimed in this PR description.
• Docker, Kind, kubectl and Helm are unavailable. The required Kind runner was attempted and stopped during prerequisite checks. Real desktop HTTP/MCP process tests are not a substitute for Kind.
• Initial /tmp capacity and an existing stdio timeout were investigated; the final complete desktop suite passed without weakening timeout assertions.

Acceptance mapping

• Existing profiles default to gateway/admin off; saved values survive fresh process composition.
• Authenticated pending/effective settings API validates modes and strict administrator booleans and preserves unrelated profile state.
• Swift picker, confirmed administrator toggle, running/pending indication and required user warnings implemented.
• Native save/restart/health/effective verification and recovery flow implemented, with harness assertions added.
• Real restarted Python desktop MCP surfaces and administrator authorization verified; connector/permission/credential preservation verified.
• Native/macOS harness, packaged application and visible interaction verification established on macOS.
• Required Kind running-service verification established in an environment with its prerequisites.

The branch is based on main at 116fd85; upstream freshness was checked again before committing.

[computerlovebot]

Investigated and pushed repairs:

• Reproduced the macOS failure locally: AdvancedSettingsTests.swift erased main-actor isolation from its async mock request closure. Explicit @MainActor fixes compilation without weakening Swift concurrency checks.
• Merged current main and resolved the README conflict, preserving both Advanced settings and permission-queue documentation. PR is mergeable again.
• Fixed an enabled-but-unusable offline restart path: Advanced permits offline recovery only for an already-saved draft after an unverified restart. Added model assertions and documented the General → Start path.
• Clarified scope: selectable codemode unlocks externally provisioned OpenAPI connectors; native OpenAPI setup/inventory and built-in catalog availability are not added by this PR.

Local verification: desktop Python 42 passed; native model assertion harness passed (--updates-only also runs advanced settings, editor and permission-queue assertions); desktop policy 27 passed; diff whitespace checks passed. Independent repair review found no actionable issues. Shared Semgrep reports 41 findings in unchanged shared Python files.

Full local packaging could not complete because the installed CommandLineTools SDK lacks the SwiftUIMacros plugin; not reported passing. Fresh macOS packaging/artifact acceptance CI is running for head 12be341: https://github.com/computerlovetech/umbod/actions/runs/39306243174 . Kind runtime verification is also underway. No merge performed.

[computerlovebot]

Verification complete for head 12be341:

• Desktop native builds: policy, macos, and macos-acceptance all passed: https://github.com/computerlovetech/umbod/actions/runs/39306243174
• Packaged macOS build, DMG install smoke, disposable Keychain checks, and artifact-only acceptance are green.
• Required Kind runtime runner exited 0: Helm in-cluster tests succeeded and 23 live runtime tests passed. Disposable cluster cleaned up.
• Website Workers build also passed.

GitHub reports the PR CLEAN and MERGEABLE. No merge performed. Remaining native OpenAPI setup/inventory and built-in catalog availability are follow-up feature scope, not capabilities delivered by this settings PR.