fix(config): allow clearing a webhook auth header

Editing an outbound webhook and leaving the auth-header field blank preserves the
stored header (intended), but there was no way to remove a header once set — blank
always meant 'keep', and no deletion gesture existed.

Treat a single '-' in the auth field as an explicit clear (Headers = null); blank
still preserves. The edit-form placeholder now reads '(stored header preserved —
enter - to clear)' so the gesture is discoverable.

Author: Aaronontheweb

openspec/changes/harden-config-tui-io-and-failloud/tasks.md

@@ -35,7 +35,7 @@ Cited file:line numbers are from the review doc and may drift as fixes land. -->
 - [x] 3.2 `ProviderManagerViewModel` (review:519) — write the fixed credential to disk only after the probe succeeds; a failed probe preserves the prior secret. Test: probe-fail leaves the stored secret unchanged. — `SubmitFixCredentials` no longer writes `secrets.json`/`netclaw.json` before probing; the write moved into a new `WriteFixedCredentials` helper called only from the `IsFixFlow` probe-**success** branch (matching the add flow's deferred `WriteProviderConfig`). A typo in the new API key/endpoint no longer clobbers the working credential with no rollback. New `FixCredentials_ProbeFailure_LeavesStoredSecretUnchanged` (secrets file byte-unchanged; bad key never written).
 - [x] 3.3 `SlackStepViewModel.BuildChannelAudiences` (review:299) — do not write an unresolved channel name as an ACL key; omit/flag it (or block) so it grants nothing. Test: unresolved channel → no inert name key in `ChannelAudiences`. — `ResolveChannelAudienceKey` (which returned the channel NAME when `LastChannelResolution` was null or the name was unresolved) is now `TryResolveChannelAudienceKey`: it yields a key only for the DM row (`"dm"`) or a resolved canonical channel ID, and `BuildChannelAudiences` omits any entry it can't resolve — so a dead, name-keyed ACL entry the Slack runtime can never match is never written. The health-check phase already warns about unresolved channels. New `ContributeConfig_OmitsUnresolvedChannelNameFromAudiences_KeepsResolvedById`.
 - [x] 3.4 `ChannelsConfigViewModel.ApplyAddChannelAsync` (review:582) — replace `Single()` with a safe predicate so a resolved id of `"dm"` with DMs enabled does not throw. Test: add a `"dm"`-resolving channel → no exception. — The row-focus lookup that positioned `_channelRowIndex` used `Single(row.Id == channelId)`; a resolved id of exactly `"dm"` with DMs enabled collided with the DM row (also `Id="dm"`) → `InvalidOperationException` crashing the add flow. Now `FirstOrDefault` over `!IsDirectMessage && !IsAction && Id==channelId` (matches only real channel rows), guarded against not-found. New `Add_channel_resolving_to_dm_with_dms_enabled_does_not_throw`.
-- [ ] 3.5 `TelemetryAlertingConfigViewModel` (review:289) — add an explicit gesture to clear a webhook auth header (blank-preserve still keeps it). Test: clear gesture removes the header; blank keeps it.
+- [x] 3.5 `TelemetryAlertingConfigViewModel` (review:289) — add an explicit gesture to clear a webhook auth header (blank-preserve still keeps it). Test: clear gesture removes the header; blank keeps it. — `SaveWebhookForm` now treats a single `-` in the auth field as an explicit clear (`target.Headers = null`); blank still preserves the stored header. The edit-form placeholder now reads `(stored header preserved — enter - to clear)` so the gesture is discoverable. New `Editing_a_webhook_clears_the_auth_header_with_the_dash_gesture`; the existing blank-preserve test still passes.
 - [ ] 3.6 `McpToolPermissionsViewModel.BuildAllowedServerList` (review:533) — operate on a copy, not the live in-memory profile object. Test: building the list does not mutate the source profile.
 
 ## 4. Verification & close

src/Netclaw.Cli.Tests/Tui/Config/TelemetryAlertingConfigViewModelTests.cs

@@ -161,6 +161,23 @@ public void Editing_a_webhook_replaces_the_auth_header_when_a_nonblank_header_is
         Assert.Equal("Bearer new", webhook.Headers?["Authorization"]);
     }
 
+    [Fact]
+    public void Editing_a_webhook_clears_the_auth_header_with_the_dash_gesture()
+    {
+        File.WriteAllText(_paths.NetclawConfigPath,
+            "{\"configVersion\":1,\"Notifications\":{\"Webhooks\":[{\"Name\":\"ops-alerts\",\"Url\":\"https://alerts.example.test/hook\",\"Headers\":{\"Authorization\":\"Bearer old\"},\"Format\":\"Generic\"}]}}");
+        using var vm = new TelemetryAlertingConfigViewModel(_paths);
+
+        vm.BeginEditWebhook(0);
+        Assert.True(vm.EditingHasPersistedAuthHeader.Value);
+        // A blank field would preserve the header; "-" explicitly removes it.
+        vm.WebhookAuthHeaderDraft.Value = "-";
+        vm.ActivateSelected();
+
+        var webhook = Assert.Single(Bind<NotificationsConfig>("Notifications").Webhooks);
+        Assert.Null(webhook.Headers);
+    }
+
     [Fact]
     public void Saving_a_webhook_without_a_url_is_rejected_before_persistence()
     {

src/Netclaw.Cli/Tui/Config/TelemetryAlertingConfigPage.cs

@@ -98,7 +98,7 @@ private ILayoutNode BuildWebhookForm()
     {
         var format = ViewModel.DraftFormat;
         var authState = ViewModel.EditingHasPersistedAuthHeader.Value && string.IsNullOrWhiteSpace(ViewModel.WebhookAuthHeaderDraft.Value)
-            ? "(stored header preserved)"
+            ? "(stored header preserved — enter - to clear)"
             : string.IsNullOrWhiteSpace(ViewModel.WebhookAuthHeaderDraft.Value) ? "(optional)" : "(new header entered)";
 
         var title = ViewModel.EditingHasPersistedAuthHeader.Value || !string.IsNullOrWhiteSpace(ViewModel.WebhookNameDraft.Value)

src/Netclaw.Cli/Tui/Config/TelemetryAlertingConfigViewModel.cs

@@ -260,9 +260,13 @@ private void SaveWebhookForm()
         }
 
         var authDraft = WebhookAuthHeaderDraft.Value.Trim();
+        // A single "-" explicitly clears a persisted auth header; a blank field preserves it. Without
+        // this gesture there is no way to remove a header once set (blank always means "keep").
+        var clearAuth = authDraft == "-";
         string? headerName = null;
         string? headerValue = null;
-        if (!string.IsNullOrWhiteSpace(authDraft)
+        if (!clearAuth
+            && !string.IsNullOrWhiteSpace(authDraft)
             && !TryParseHeader(authDraft, out headerName, out headerValue, out var headerError))
         {
             Status.Value = new ConfigStatusMessage(headerError, ConfigStatusTone.Error);
@@ -275,7 +279,7 @@ private void SaveWebhookForm()
             : WebhookNameDraft.Value.Trim();
 
         var editing = _editingWebhookIndex;
-        var newAuth = !string.IsNullOrWhiteSpace(authDraft);
+        var newAuth = !clearAuth && !string.IsNullOrWhiteSpace(authDraft);
         var verb = editing is null ? "added" : "updated";
         var saved = PersistWebhooks(webhooks =>
         {
@@ -293,6 +297,12 @@ private void SaveWebhookForm()
                     [headerName!] = headerValue!
                 };
             }
+            else if (clearAuth)
+            {
+                target.Headers = null;
+            }
+
+            // Otherwise (blank, no "-"): leave target.Headers untouched so an unedited header is kept.
 
             if (editing is null)
                 webhooks.Add(target);