fix(webview/meet): gate orchestrator handoff on user opt-in (tinyhumansai#1299) (tinyhumansai#1310)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: oxoxDev

app/src/components/settings/panels/PrivacyPanel.tsx

@@ -35,8 +35,9 @@ const KIND_BADGE_CLASS: Record<PrivacyDataKind, string> = {
 
 const PrivacyPanel = () => {
   const { navigateBack, breadcrumbs } = useSettingsNavigation();
-  const { snapshot, setAnalyticsEnabled } = useCoreState();
+  const { snapshot, setAnalyticsEnabled, setMeetAutoOrchestratorHandoff } = useCoreState();
   const analyticsEnabled = snapshot.analyticsEnabled;
+  const meetAutoHandoff = snapshot.meetAutoOrchestratorHandoff;
 
   const [capabilities, setCapabilities] = useState<AnnotatedCapability[]>([]);
   const [loadState, setLoadState] = useState<'loading' | 'ready' | 'error'>('loading');
@@ -73,6 +74,15 @@ const PrivacyPanel = () => {
     }
   };
 
+  const handleToggleMeetAutoHandoff = async () => {
+    const newValue = !meetAutoHandoff;
+    try {
+      await setMeetAutoOrchestratorHandoff(newValue);
+    } catch (error) {
+      console.warn('[privacy] failed to persist meet auto-handoff setting:', error);
+    }
+  };
+
   return (
     <div data-testid="settings-privacy-panel">
       <SettingsHeader
@@ -168,6 +178,42 @@ const PrivacyPanel = () => {
             </div>
           </div>
 
+          {/* Meeting Follow-ups Section (#1299) */}
+          <div>
+            <h3 className="text-xs font-semibold uppercase tracking-wider text-stone-400 mb-3 px-1">
+              Meeting follow-ups
+            </h3>
+            <div className="bg-white rounded-xl border border-stone-200 overflow-hidden">
+              <div className="flex items-center justify-between p-4">
+                <div className="flex-1 mr-4">
+                  <p className="text-sm font-medium text-stone-900">
+                    Auto-handoff Google Meet transcripts to the orchestrator
+                  </p>
+                  <p className="text-xs text-stone-500 mt-1 leading-relaxed">
+                    When a Google Meet call ends, OpenHuman&rsquo;s orchestrator can read the
+                    transcript and may take actions like drafting messages, scheduling follow-ups,
+                    or posting summaries to your connected Slack workspace. Off by default.
+                  </p>
+                </div>
+                <button
+                  data-testid="privacy-meet-handoff-toggle"
+                  onClick={handleToggleMeetAutoHandoff}
+                  aria-label="Auto-handoff Google Meet transcripts to the orchestrator"
+                  className={`relative inline-flex h-6 w-11 flex-shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors duration-200 ease-in-out focus:outline-none ${
+                    meetAutoHandoff ? 'bg-primary-500' : 'bg-stone-600'
+                  }`}
+                  role="switch"
+                  aria-checked={meetAutoHandoff}>
+                  <span
+                    className={`pointer-events-none inline-block h-5 w-5 transform rounded-full bg-white shadow ring-0 transition duration-200 ease-in-out ${
+                      meetAutoHandoff ? 'translate-x-5' : 'translate-x-0'
+                    }`}
+                  />
+                </button>
+              </div>
+            </div>
+          </div>
+
           {/* Info Box */}
           <div className="p-4 bg-stone-50 rounded-xl border border-stone-200">
             <div className="flex items-start space-x-3">

app/src/components/settings/panels/__tests__/PrivacyPanel.test.tsx

@@ -1,4 +1,4 @@
-import { screen, waitFor } from '@testing-library/react';
+import { fireEvent, screen, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { renderWithProviders } from '../../../../test/test-utils';
@@ -7,8 +7,13 @@ import PrivacyPanel from '../PrivacyPanel';
 
 vi.mock('../../../../utils/tauriCommands/aboutApp', () => ({ listCapabilities: vi.fn() }));
 
+const setMeetAutoOrchestratorHandoffMock = vi.fn();
 vi.mock('../../../../providers/CoreStateProvider', () => ({
-  useCoreState: () => ({ snapshot: { analyticsEnabled: false }, setAnalyticsEnabled: vi.fn() }),
+  useCoreState: () => ({
+    snapshot: { analyticsEnabled: false, meetAutoOrchestratorHandoff: false },
+    setAnalyticsEnabled: vi.fn(),
+    setMeetAutoOrchestratorHandoff: (v: boolean) => setMeetAutoOrchestratorHandoffMock(v),
+  }),
 }));
 
 vi.mock('../../hooks/useSettingsNavigation', () => ({
@@ -88,7 +93,21 @@ describe('PrivacyPanel', () => {
       expect(screen.getByTestId('privacy-load-error')).toBeTruthy();
     });
     expect(screen.queryByTestId('privacy-capability-list')).toBeNull();
-    // Analytics toggle still rendered
-    expect(screen.getByRole('switch')).toBeTruthy();
+    // Analytics + meet-handoff toggles still rendered
+    expect(screen.getAllByRole('switch').length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('flips the meet auto-handoff toggle from OFF to ON when clicked (#1299)', async () => {
+    vi.mocked(listCapabilities).mockResolvedValue([]);
+    renderWithProviders(<PrivacyPanel />);
+
+    const toggle = await screen.findByTestId('privacy-meet-handoff-toggle');
+    expect(toggle.getAttribute('aria-checked')).toBe('false');
+
+    fireEvent.click(toggle);
+
+    await waitFor(() => {
+      expect(setMeetAutoOrchestratorHandoffMock).toHaveBeenCalledWith(true);
+    });
   });
 });

app/src/lib/coreState/__tests__/store.test.ts

@@ -10,6 +10,7 @@ function makeSnapshot(overrides: Partial<CoreAppSnapshot> = {}): CoreAppSnapshot
     onboardingCompleted: true,
     chatOnboardingCompleted: false,
     analyticsEnabled: false,
+    meetAutoOrchestratorHandoff: false,
     localState: { encryptionKey: null, primaryWalletAddress: null, onboardingTasks: null },
     runtime: { screenIntelligence: null, localAi: null, autocomplete: null, service: null },
     ...overrides,

app/src/lib/coreState/store.ts

@@ -46,6 +46,16 @@ export interface CoreAppSnapshot {
    */
   chatOnboardingCompleted: boolean;
   analyticsEnabled: boolean;
+  /**
+   * Whether ending a Google Meet call hands the transcript to the
+   * orchestrator agent for proactive follow-up actions (drafting Slack
+   * messages, scheduling, etc.). Mirrors
+   * `Config::meet.auto_orchestrator_handoff` in the Rust core (see
+   * `src/openhuman/config/schema/meet.rs`). Defaults to `false` —
+   * privacy-conservative gate added in #1299. The webview meet flow
+   * reads this before invoking `handoffToOrchestrator`.
+   */
+  meetAutoOrchestratorHandoff: boolean;
   localState: CoreLocalState;
   runtime: CoreRuntimeSnapshot;
 }
@@ -66,6 +76,7 @@ const emptySnapshot: CoreAppSnapshot = {
   onboardingCompleted: false,
   chatOnboardingCompleted: false,
   analyticsEnabled: false,
+  meetAutoOrchestratorHandoff: false,
   localState: { encryptionKey: null, primaryWalletAddress: null, onboardingTasks: null },
   runtime: { screenIntelligence: null, localAi: null, autocomplete: null, service: null },
 };

app/src/providers/CoreStateProvider.tsx

@@ -32,6 +32,7 @@ import { loadThreads, resetThreadCachesPreservingSelection } from '../store/thre
 import { getActiveUserId, setActiveUserId } from '../store/userScopedStorage';
 import {
   openhumanUpdateAnalyticsSettings,
+  openhumanUpdateMeetSettings,
   restartApp,
   setOnboardingCompleted,
   storeSession,
@@ -66,6 +67,7 @@ interface CoreStateContextValue extends CoreState {
   refreshTeamMembers: (teamId: string) => Promise<void>;
   refreshTeamInvites: (teamId: string) => Promise<void>;
   setAnalyticsEnabled: (enabled: boolean) => Promise<void>;
+  setMeetAutoOrchestratorHandoff: (enabled: boolean) => Promise<void>;
   setOnboardingCompletedFlag: (value: boolean) => Promise<void>;
   setEncryptionKey: (value: string | null) => Promise<void>;
   setPrimaryWalletAddress: (value: string | null) => Promise<void>;
@@ -142,6 +144,7 @@ function normalizeSnapshot(
     onboardingCompleted: result.onboardingCompleted,
     chatOnboardingCompleted: result.chatOnboardingCompleted,
     analyticsEnabled: result.analyticsEnabled,
+    meetAutoOrchestratorHandoff: result.meetAutoOrchestratorHandoff ?? false,
     localState: {
       encryptionKey: result.localState.encryptionKey ?? null,
       primaryWalletAddress: result.localState.primaryWalletAddress ?? null,
@@ -479,6 +482,22 @@ export default function CoreStateProvider({ children }: { children: ReactNode })
     [commitState, refresh]
   );
 
+  const setMeetAutoOrchestratorHandoff = useCallback(
+    async (enabled: boolean) => {
+      await openhumanUpdateMeetSettings({ auto_orchestrator_handoff: enabled });
+      // Optimistic commit so the toggle flips instantly; full snapshot
+      // refresh follows so the cached value matches what core just wrote.
+      commitState(previous => ({
+        ...previous,
+        snapshot: { ...previous.snapshot, meetAutoOrchestratorHandoff: enabled },
+      }));
+      await refresh().catch(err => {
+        log('refresh failed after setMeetAutoOrchestratorHandoff: %O', sanitizeError(err));
+      });
+    },
+    [commitState, refresh]
+  );
+
   const setOnboardingCompletedFlag = useCallback(
     async (value: boolean) => {
       await setOnboardingCompleted(value);
@@ -567,6 +586,7 @@ export default function CoreStateProvider({ children }: { children: ReactNode })
       refreshTeamInvites,
       patchSnapshot,
       setAnalyticsEnabled,
+      setMeetAutoOrchestratorHandoff,
       setOnboardingCompletedFlag,
       setEncryptionKey: value => updateLocalState({ encryptionKey: value }),
       setPrimaryWalletAddress: value => updateLocalState({ primaryWalletAddress: value }),
@@ -582,6 +602,7 @@ export default function CoreStateProvider({ children }: { children: ReactNode })
       refreshTeams,
       patchSnapshot,
       setAnalyticsEnabled,
+      setMeetAutoOrchestratorHandoff,
       setOnboardingCompletedFlag,
       state,
       storeSessionToken,

app/src/providers/__tests__/CoreStateProvider.identityFlip.test.tsx

@@ -74,6 +74,7 @@ function resetCoreStateStore() {
       onboardingCompleted: false,
       chatOnboardingCompleted: false,
       analyticsEnabled: false,
+      meetAutoOrchestratorHandoff: false,
       localState: { encryptionKey: null, primaryWalletAddress: null, onboardingTasks: null },
       runtime: { screenIntelligence: null, localAi: null, autocomplete: null, service: null },
     },

app/src/providers/__tests__/CoreStateProvider.test.tsx

@@ -3,6 +3,7 @@ import { useEffect } from 'react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import * as coreStateApi from '../../services/coreStateApi';
+import * as tauriCommands from '../../utils/tauriCommands';
 import { setCoreStateSnapshot } from '../../lib/coreState/store';
 import CoreStateProvider, { useCoreState } from '../CoreStateProvider';
 
@@ -78,6 +79,7 @@ function resetCoreStateStore() {
       onboardingCompleted: false,
       chatOnboardingCompleted: false,
       analyticsEnabled: false,
+      meetAutoOrchestratorHandoff: false,
       localState: { encryptionKey: null, primaryWalletAddress: null, onboardingTasks: null },
       runtime: { screenIntelligence: null, localAi: null, autocomplete: null, service: null },
     },
@@ -241,4 +243,68 @@ describe('CoreStateProvider — identity-change cache clearing', () => {
       expect(ctx?.snapshot.currentUser).toEqual({ first_name: 'Ada', username: 'ada' })
     );
   });
+
+  it('setMeetAutoOrchestratorHandoff(true) calls update RPC + flips snapshot optimistically (#1299)', async () => {
+    fetchSnapshot.mockResolvedValue(makeSnapshot({ userId: 'u1', sessionToken: 'tok1' }));
+    listTeams.mockResolvedValue([]);
+    vi.mocked(tauriCommands.openhumanUpdateMeetSettings).mockReset();
+    vi.mocked(tauriCommands.openhumanUpdateMeetSettings).mockResolvedValue({
+      result: { config: {}, workspace_dir: '/tmp', config_path: '/tmp/cfg.toml' },
+      logs: [],
+    } as never);
+
+    let ctx: CoreStateContextValue | undefined;
+    render(
+      <CoreStateProvider>
+        <Consumer
+          captureCtx={next => {
+            ctx = next;
+          }}
+        />
+      </CoreStateProvider>
+    );
+
+    await waitFor(() => expect(screen.getByTestId('ready').textContent).toBe('ready'));
+    expect(ctx?.snapshot.meetAutoOrchestratorHandoff).toBe(false);
+
+    await act(async () => {
+      await ctx!.setMeetAutoOrchestratorHandoff(true);
+    });
+
+    expect(vi.mocked(tauriCommands.openhumanUpdateMeetSettings)).toHaveBeenCalledWith({
+      auto_orchestrator_handoff: true,
+    });
+  });
+
+  it('setMeetAutoOrchestratorHandoff swallows refresh errors after the RPC succeeds (#1299)', async () => {
+    fetchSnapshot.mockResolvedValueOnce(makeSnapshot({ userId: 'u1', sessionToken: 'tok1' }));
+    listTeams.mockResolvedValue([]);
+    vi.mocked(tauriCommands.openhumanUpdateMeetSettings).mockReset();
+    vi.mocked(tauriCommands.openhumanUpdateMeetSettings).mockResolvedValue({
+      result: { config: {}, workspace_dir: '/tmp', config_path: '/tmp/cfg.toml' },
+      logs: [],
+    } as never);
+
+    let ctx: CoreStateContextValue | undefined;
+    render(
+      <CoreStateProvider>
+        <Consumer
+          captureCtx={next => {
+            ctx = next;
+          }}
+        />
+      </CoreStateProvider>
+    );
+
+    await waitFor(() => expect(screen.getByTestId('ready').textContent).toBe('ready'));
+    fetchSnapshot.mockRejectedValueOnce(new Error('refresh failed'));
+
+    await act(async () => {
+      await expect(ctx!.setMeetAutoOrchestratorHandoff(false)).resolves.toBeUndefined();
+    });
+
+    expect(vi.mocked(tauriCommands.openhumanUpdateMeetSettings)).toHaveBeenCalledWith({
+      auto_orchestrator_handoff: false,
+    });
+  });
 });