Add settings gates for local -> cloud handoff

[harryalbert]

Description

We need to add a way for folks (and admins) to disable local -> cloud handoff. This PR adds a few ways to do that. This PR adds:

• a setting to disable local -> cloud handoff. This disabled the & entrypoint, the /handoff command, the handoff chip, and local -> cloud handoff generally.
• a sub-setting to disable the & entrypoint specifically, just because I'm guessing some folks will take issue with it and we should have an easy way to make it so that typing & doesn't kick you into local -> cloud handoff.

We also automatically disable the local -> cloud handoff setting when cloud conversations are disabled (as local -> cloud handoff is not possible without cloud conversations).

Testing

• I have manually tested my changes locally with ./script/run

Screenshots / Videos

https://www.loom.com/share/bbad1cd7cd0b4b5b9370f9ad180aae0e

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

[harryalbert]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add settings gates for local -> cloud handoff #10492 👈 (View in Graphite)
• Add environment setup flow for local -> cloud handoff #10401
• Hide unnecessary chips when in handoff input mode #10389
• add & entrypoint for local -> cloud handoff #10271
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[oz-for-oss]

@harryalbert

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR adds AI settings for local-to-cloud handoff, gates the &, /handoff, chip, and workspace action surfaces, and adds snapshot_disabled to cloud agent spawn requests when cloud conversation storage is disabled.

Concerns

• Remote child agent spawns still hard-code snapshot_disabled: None, so they bypass the cloud-conversation-storage privacy gate.
• The & sub-setting is hidden when the parent handoff setting is off instead of remaining visible and disabled as described by the PR behavior.

Security

• The remote child spawn path can omit snapshot_disabled: true when cloud conversation storage is disabled, allowing end-of-run snapshots where the user/org opted out.

Verdict

Found: 0 critical, 2 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

⚠️ [IMPORTANT] [SECURITY] This hard-codes snapshot_disabled: None for remote child agent spawns, bypassing the cloud-conversation-storage privacy gate. When storage is disabled, this path can still allow an end-of-run snapshot upload; thread the effective setting here or normalize it in spawn_agent_with_request before spawn_internal.

[oz-for-oss]

⚠️ [IMPORTANT] This hides the & sub-setting whenever cloud handoff is disabled. The described behavior keeps the sub-toggle visible but disabled so users can see and preserve their stored choice; render the row unconditionally and disable it when !effective_handoff.